Merge branch 'main' into update-tor-0.4.8.19

* Add localizable strings in show commands view n refactor code to remove duplicate string declarations.

* Modify struct to enum in separate file to Models/CommandsInfo.

* Add corrections code in refactory and enum.

* Correct code in command enum and ContentView.

* Dedicated CommandSuggestionsView to extract code

* Simplify CommandInfo + minor optimization

* Fix preview

---------

Co-authored-by: islam <2553451+qalandarov@users.noreply.github.com>

.github/workflows/fetch_georelays.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   update-relay-data:
@@ -17,24 +18,54 @@ jobs:
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-      
+          fetch-depth: 0
+
       - name: Fetch GeoRelays
         run: |
-          wget https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
+          wget -q https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
           mv nostr_relays.csv ./relays/online_relays_gps.csv
 
-      - name: Check for changes
-        id: git-check
+      - name: Configure git
         run: |
-          git diff --exit-code || echo "changes=true" >> $GITHUB_OUTPUT
-    
-      - name: Commit and push changes
-        if: steps.git-check.outputs.changes == 'true'
+          git config user.email "action@github.com"
+          git config user.name "GitHub Action"
+
+      - name: Create update branch if changes
+        id: create_branch
         run: |
-          git config --local user.email "action@github.com"
-          git config --local user.name "GitHub Action"
+          # exit early if no changes
+          if git diff --quiet --relays/online_relays_gps.csv; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # branch name with timestamp
+          BRANCH="update-georelays-$(date -u +%Y%m%dT%H%M%SZ)"
+          git checkout -b "$BRANCH"
+
           git add relays/online_relays_gps.csv
-          git commit -m "Automated update of relay data - $(date -u)"
-          git push
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          git commit -m "Automated update of relay data - $(date -u --rfc-3339=seconds)"
+          echo "changed=true" >> $GITHUB_OUTPUT
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Push branch
+        if: steps.create_branch.outputs.changed == 'true'
+        run: |
+          git push --set-upstream origin "${{ steps.create_branch.outputs.branch }}"
+
+      - name: Create pull request
+        if: steps.create_branch.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: Automated update of relay data
+          branch: ${{ steps.create_branch.outputs.branch }}
+          base: main
+          title: Automated update of relay data
+          body: |
+            This PR was created automatically by the scheduled workflow. It updates relays/online_relays_gps.csv from the GeoRelays source.
+          labels: automated, georelays
+
+      - name: No changes
+        if: steps.create_branch.outputs.changed != 'true'
+        run: echo "No changes to relays/online_relays_gps.csv"

bitchat.xcodeproj/xcshareddata/xcschemes/bitchat (iOS).xcscheme

@@ -98,8 +98,8 @@
       </BuildableProductRunnable>
       <EnvironmentVariables>
          <EnvironmentVariable
-            key = "-DBITCHAT_DEV_ALLOW_CLEARNET"
-            value = ""
+            key = "BITCHAT_LOG_LEVEL"
+            value = "debug"
             isEnabled = "YES">
          </EnvironmentVariable>
       </EnvironmentVariables>

bitchat/BitchatApp.swift

@@ -57,11 +57,9 @@ struct BitchatApp: App {
                         let npub = try? idBridge.getCurrentNostrIdentity()?.npub
                         _ = VerificationService.shared.buildMyQRString(nickname: chatViewModel.nickname, npub: npub)
                     }
-                    #if os(iOS)
+
                     appDelegate.chatViewModel = chatViewModel
-                    #elseif os(macOS)
-                    appDelegate.chatViewModel = chatViewModel
-                    #endif
+
                     // Initialize network activation policy; will start Tor/Nostr only when allowed
                     NetworkActivationService.shared.start()
                     // Check for shared content
@@ -189,6 +187,10 @@ final class AppDelegate: NSObject, UIApplicationDelegate {
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
         return true
     }
+    
+    func applicationWillTerminate(_ application: UIApplication) {
+        chatViewModel?.applicationWillTerminate()
+    }
 }
 #endif
 
@@ -246,7 +248,7 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
             // Get peer ID from userInfo
             if let peerID = userInfo["peerID"] as? String {
                 // Don't show notification if the private chat is already open
-                if chatViewModel?.selectedPrivateChatPeer == peerID {
+                if chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
                     completionHandler([])
                     return
                 }

bitchat/Features/media/ImageUtils.swift

@@ -13,10 +13,10 @@ enum ImageUtilsError: Error {
 }
 
 enum ImageUtils {
-    private static let compressionQuality: CGFloat = 0.85
-    private static let targetImageBytes: Int = 60_000
+    private static let compressionQuality: CGFloat = 0.82
+    private static let targetImageBytes: Int = 45_000
 
-    static func processImage(at url: URL, maxDimension: CGFloat = 512) throws -> URL {
+    static func processImage(at url: URL, maxDimension: CGFloat = 448) throws -> URL {
         // Security H1: Check file size BEFORE reading into memory
         let attrs = try FileManager.default.attributesOfItem(atPath: url.path)
         guard let fileSize = attrs[.size] as? Int else {
@@ -38,7 +38,7 @@ enum ImageUtils {
     }
 
     #if os(iOS)
-    static func processImage(_ image: UIImage, maxDimension: CGFloat = 512) throws -> URL {
+    static func processImage(_ image: UIImage, maxDimension: CGFloat = 448) throws -> URL {
         return try autoreleasepool {
             // Scale the image first
             let scaled = scaledImage(image, maxDimension: maxDimension)
@@ -106,7 +106,7 @@ enum ImageUtils {
         return data as Data
     }
     #else
-    static func processImage(_ image: NSImage, maxDimension: CGFloat = 512) throws -> URL {
+    static func processImage(_ image: NSImage, maxDimension: CGFloat = 448) throws -> URL {
         return try autoreleasepool {
             let scaled = scaledImage(image, maxDimension: maxDimension)
             guard let inputCG = scaled.cgImage(forProposedRect: nil, context: nil, hints: nil) else {

bitchat/Features/voice/VoiceRecorder.swift

@@ -14,6 +14,7 @@ final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {
 
     private let queue = DispatchQueue(label: "com.bitchat.voice-recorder")
     private let paddingInterval: TimeInterval = 0.5
+    private let maxRecordingDuration: TimeInterval = 120
 
     private var recorder: AVAudioRecorder?
     private var currentURL: URL?
@@ -75,14 +76,14 @@ final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {
                 AVFormatIDKey: kAudioFormatMPEG4AAC,
                 AVSampleRateKey: 16_000,
                 AVNumberOfChannelsKey: 1,
-                AVEncoderBitRateKey: 20_000
+                AVEncoderBitRateKey: 16_000
             ]
 
             let audioRecorder = try AVAudioRecorder(url: outputURL, settings: settings)
             audioRecorder.delegate = self
             audioRecorder.isMeteringEnabled = true
             audioRecorder.prepareToRecord()
-            audioRecorder.record()
+            audioRecorder.record(forDuration: maxRecordingDuration)
 
             recorder = audioRecorder
             currentURL = outputURL

bitchat/Localizable.xcstrings

@@ -6268,10 +6268,6 @@
         }
       }
     },
-    "Choose an image" : {
-      "comment" : "A label displayed above a button that allows the user to choose an image to send.",
-      "isCommentAutoGenerated" : true
-    },
     "close" : {
       "comment" : "Button to dismiss fullscreen media viewer",
       "localizations" : {
@@ -35705,7 +35701,545 @@
           }
         }
       }
+    },
+    "Voice notes are only available in mesh chats." : {
+      "extractionState" : "manual",
+      "localizations" : {
+        "ar" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "الملاحظات الصوتية متاحة فقط في محادثات الميش."
+          }
+        },
+        "bn" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ভয়েস নোট শুধু মেশ চ্যাটে উপলব্ধ।"
+          }
+        },
+        "de" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Sprachnachrichten sind nur im Mesh-Chat verfügbar."
+          }
+        },
+        "en" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Voice notes are only available in mesh chats."
+          }
+        },
+        "es" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Las notas de voz solo están disponibles en los chats de mesh."
+          }
+        },
+        "fil" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Ang mga voice note ay available lamang sa mga mesh chat."
+          }
+        },
+        "fr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Les notes vocales sont uniquement disponibles dans les discussions mesh."
+          }
+        },
+        "he" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "הערות קוליות זמינות רק בצ׳אט של mesh."
+          }
+        },
+        "hi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "वॉइस नोट्स केवल मेश चैट में ही उपलब्ध हैं।"
+          }
+        },
+        "id" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Catatan suara hanya tersedia di obrolan mesh."
+          }
+        },
+        "it" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Le note vocali sono disponibili solo nelle chat mesh."
+          }
+        },
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ボイスメモはメッシュチャットでのみ利用できます。"
+          }
+        },
+        "ko" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "음성 메모는 메쉬 채팅에서만 사용할 수 있습니다."
+          }
+        },
+        "ms" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Nota suara hanya tersedia dalam sembang mesh."
+          }
+        },
+        "ne" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "भ्वाइस नोटहरू केवल मेष च्याटमा मात्र उपलब्ध छन्।"
+          }
+        },
+        "nl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Spraaknotities zijn alleen beschikbaar in mesh-chats."
+          }
+        },
+        "pl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Notatki głosowe są dostępne tylko na czatach mesh."
+          }
+        },
+        "pt" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "As notas de voz só estão disponíveis nos chats mesh."
+          }
+        },
+        "pt-BR" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "As mensagens de voz só estão disponíveis nos chats mesh."
+          }
+        },
+        "ru" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Голосовые сообщения доступны только в mesh-чатах."
+          }
+        },
+        "sv" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Röstanteckningar är bara tillgängliga i mesh-chattar."
+          }
+        },
+        "ta" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "குரல் குறிப்புகள் மெஷ் உரையாடல்களில் மட்டுமே கிடைக்கும்."
+          }
+        },
+        "th" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "บันทึกเสียงใช้งานได้เฉพาะในแชต mesh เท่านั้น"
+          }
+        },
+        "tr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Sesli notlar yalnızca mesh sohbetlerinde kullanılabilir."
+          }
+        },
+        "uk" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Голосові нотатки доступні лише в mesh-чатах."
+          }
+        },
+        "ur" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "وائس نوٹس صرف میش چیٹس میں دستیاب ہیں۔"
+          }
+        },
+        "vi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Ghi chú giọng nói chỉ khả dụng trong các cuộc trò chuyện mesh."
+          }
+        },
+        "zh-Hans" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "语音消息仅可在 mesh 聊天中使用。"
+          }
+        },
+        "zh-Hant" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "語音訊息僅能在 mesh 聊天中使用。"
+          }
+        }
+      }
+    },
+    "Images are only available in mesh chats." : {
+      "extractionState" : "manual",
+      "localizations" : {
+        "ar" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "الصور متاحة فقط في محادثات الميش."
+          }
+        },
+        "bn" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ছবি শুধু মেশ চ্যাটে উপলব্ধ।"
+          }
+        },
+        "de" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Bilder sind nur im Mesh-Chat verfügbar."
+          }
+        },
+        "en" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Images are only available in mesh chats."
+          }
+        },
+        "es" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Las imágenes solo están disponibles en los chats de mesh."
+          }
+        },
+        "fil" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Ang mga larawan ay available lamang sa mga mesh chat."
+          }
+        },
+        "fr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Les images sont uniquement disponibles dans les discussions mesh."
+          }
+        },
+        "he" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "תמונות זמינות רק בצ׳אט של mesh."
+          }
+        },
+        "hi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "चित्र केवल मेश चैट में ही उपलब्ध हैं।"
+          }
+        },
+        "id" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Gambar hanya tersedia di obrolan mesh."
+          }
+        },
+        "it" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Le immagini sono disponibili solo nelle chat mesh."
+          }
+        },
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "画像はメッシュチャットでのみ利用できます。"
+          }
+        },
+        "ko" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "이미지는 메쉬 채팅에서만 사용할 수 있습니다."
+          }
+        },
+        "ms" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Imej hanya tersedia dalam sembang mesh."
+          }
+        },
+        "ne" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "तस्बिरहरू केवल मेष च्याटमा मात्र उपलब्ध छन्।"
+          }
+        },
+        "nl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Afbeeldingen zijn alleen beschikbaar in mesh-chats."
+          }
+        },
+        "pl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Obrazy są dostępne tylko na czatach mesh."
+          }
+        },
+        "pt" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "As imagens só estão disponíveis nos chats mesh."
+          }
+        },
+        "pt-BR" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "As imagens só estão disponíveis nos chats mesh."
+          }
+        },
+        "ru" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Изображения доступны только в mesh-чатах."
+          }
+        },
+        "sv" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Bilder är bara tillgängliga i mesh-chattar."
+          }
+        },
+        "ta" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "படங்கள் மெஷ் உரையாடல்களில் மட்டுமே கிடைக்கும்."
+          }
+        },
+        "th" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "รูปภาพใช้งานได้เฉพาะในแชต mesh เท่านั้น"
+          }
+        },
+        "tr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Görseller yalnızca mesh sohbetlerinde kullanılabilir."
+          }
+        },
+        "uk" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Зображення доступні лише в mesh-чатах."
+          }
+        },
+        "ur" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "تصاویر صرف میش چیٹس میں دستیاب ہیں۔"
+          }
+        },
+        "vi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Hình ảnh chỉ khả dụng trong các cuộc trò chuyện mesh."
+          }
+        },
+        "zh-Hans" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "图片仅可在 mesh 聊天中使用。"
+          }
+        },
+        "zh-Hant" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "圖片僅能在 mesh 聊天中使用。"
+          }
+        }
+      }
+    },
+    "Choose an image" : {
+      "comment" : "A label displayed above a button that allows the user to choose an image to send.",
+      "extractionState" : "manual",
+      "localizations" : {
+        "ar" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "اختر صورة"
+          }
+        },
+        "bn" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "একটি ছবি নির্বাচন করুন"
+          }
+        },
+        "de" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Bild auswählen"
+          }
+        },
+        "en" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Choose an image"
+          }
+        },
+        "es" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Elige una imagen"
+          }
+        },
+        "fil" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Pumili ng larawan"
+          }
+        },
+        "fr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Choisir une image"
+          }
+        },
+        "he" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "בחר תמונה"
+          }
+        },
+        "hi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "एक चित्र चुनें"
+          }
+        },
+        "id" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Pilih gambar"
+          }
+        },
+        "it" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Scegli un’immagine"
+          }
+        },
+        "ja" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "画像を選択"
+          }
+        },
+        "ko" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "이미지를 선택하세요"
+          }
+        },
+        "ms" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Pilih imej"
+          }
+        },
+        "ne" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "एउटा तस्वीर चयन गर्नुहोस्"
+          }
+        },
+        "nl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Kies een afbeelding"
+          }
+        },
+        "pl" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Wybierz obraz"
+          }
+        },
+        "pt" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Escolher uma imagem"
+          }
+        },
+        "pt-BR" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Escolha uma imagem"
+          }
+        },
+        "ru" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Выберите изображение"
+          }
+        },
+        "sv" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Välj en bild"
+          }
+        },
+        "ta" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ஒரு படத்தைத் தேர்ந்தெடுக்கவும்"
+          }
+        },
+        "th" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "เลือกภาพ"
+          }
+        },
+        "tr" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Bir görüntü seç"
+          }
+        },
+        "uk" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Виберіть зображення"
+          }
+        },
+        "ur" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "ایک تصویر منتخب کریں"
+          }
+        },
+        "vi" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "Chọn một hình ảnh"
+          }
+        },
+        "zh-Hans" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "选择图像"
+          }
+        },
+        "zh-Hant" : {
+          "stringUnit" : {
+            "state" : "translated",
+            "value" : "選擇圖像"
+          }
+        }
+      }
     }
   },
   "version" : "1.1"
-}
+}

bitchat/Models/BitchatPacket.swift

@@ -21,8 +21,9 @@ struct BitchatPacket: Codable {
     let payload: Data
     var signature: Data?
     var ttl: UInt8
+    var route: [Data]?
     
-    init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8, version: UInt8 = 1) {
+    init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8, version: UInt8 = 1, route: [Data]? = nil) {
         self.version = version
         self.type = type
         self.senderID = senderID
@@ -31,6 +32,7 @@ struct BitchatPacket: Codable {
         self.payload = payload
         self.signature = signature
         self.ttl = ttl
+        self.route = route
     }
     
     // Convenience initializer for new binary format
@@ -53,6 +55,7 @@ struct BitchatPacket: Codable {
         self.payload = payload
         self.signature = nil
         self.ttl = ttl
+        self.route = nil
     }
     
     var data: Data? {
@@ -81,7 +84,8 @@ struct BitchatPacket: Codable {
             payload: payload,
             signature: nil, // Remove signature for signing
             ttl: 0, // Use fixed TTL=0 for signing to ensure relay compatibility
-            version: version
+            version: version,
+            route: route
         )
         return BinaryProtocol.encode(unsignedPacket)
     }

bitchat/Models/CommandInfo.swift

@@ -0,0 +1,58 @@
+//
+// CommandsInfo.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+// MARK: - CommandInfo Enum
+
+enum CommandInfo: String, Identifiable {
+    case block
+    case clear
+    case hug
+    case message = "dm"
+    case slap
+    case unblock
+    case who
+    case favorite
+    case unfavorite
+    
+    var id: String { rawValue }
+    
+    var alias: String { "/" + rawValue }
+    
+    var placeholder: String? {
+        switch self {
+        case .block, .hug, .message, .slap, .unblock, .favorite, .unfavorite:
+            return "<" + String(localized: "content.input.nickname_placeholder") + ">"
+        case .clear, .who:
+            return nil
+        }
+    }
+    
+    var description: String {
+        switch self {
+        case .block:        String(localized: "content.commands.block")
+        case .clear:        String(localized: "content.commands.clear")
+        case .hug:          String(localized: "content.commands.hug")
+        case .message:      String(localized: "content.commands.message")
+        case .slap:         String(localized: "content.commands.slap")
+        case .unblock:      String(localized: "content.commands.unblock")
+        case .who:          String(localized: "content.commands.who")
+        case .favorite:     String(localized: "content.commands.favorite")
+        case .unfavorite:   String(localized: "content.commands.unfavorite")
+        }
+    }
+    
+    static func all(isGeoPublic: Bool, isGeoDM: Bool) -> [CommandInfo] {
+        let baseCommands: [CommandInfo] = [.block, .unblock, .clear, .hug, .message, .slap, .who]
+        if isGeoPublic || isGeoDM {
+            return baseCommands + [.favorite, .unfavorite]
+        }
+        return baseCommands
+    }
+}

bitchat/Models/PeerID.swift

@@ -35,7 +35,7 @@ struct PeerID: Equatable, Hashable {
     // Private so the callers have to go through a convenience init
     private init(prefix: Prefix, bare: any StringProtocol) {
         self.prefix = prefix
-        self.bare = String(bare)
+        self.bare = String(bare).lowercased()
     }
 }
 
@@ -76,6 +76,12 @@ extension PeerID {
     init(hexData: Data) {
         self.init(str: hexData.hexEncodedString())
     }
+    
+    /// Convenience init to "hide" hex-encoding implementation detail
+    init?(hexData: Data?) {
+        guard let hexData else { return nil }
+        self.init(hexData: hexData)
+    }
 }
 
 // MARK: - Noise Public Key Helpers
@@ -130,6 +136,20 @@ extension PeerID {
     }
 }
 
+extension PeerID {
+    var routingData: Data? {
+        if let direct = Data(hexString: id), direct.count == 8 { return direct }
+        if let bareData = Data(hexString: bare), bareData.count == 8 { return bareData }
+        let short = toShort()
+        return Data(hexString: short.id)
+    }
+
+    init?(routingData: Data) {
+        guard routingData.count == 8 else { return nil }
+        self.init(hexData: routingData)
+    }
+}
+
 // MARK: - Validation
 
 extension PeerID {
@@ -191,9 +211,7 @@ extension PeerID: Comparable {
     }
 }
 
-// MARK: - String Interop Helpers
-
-// MARK: CustomStringConvertible
+// MARK: - CustomStringConvertible
 
 extension PeerID: CustomStringConvertible {
     /// So it returns the actual `id` like before even inside another String
@@ -201,17 +219,3 @@ extension PeerID: CustomStringConvertible {
         id
     }
 }
-
-// MARK: Custom Equatable w/ String & Optionality
-
-// PeerID <> String
-extension Optional where Wrapped == PeerID {
-    static func ==(lhs: Optional<Wrapped>, rhs: Optional<String>) -> Bool   { lhs?.id == rhs }
-    static func !=(lhs: Optional<Wrapped>, rhs: Optional<String>) -> Bool   { lhs?.id != rhs }
-}
-
-// String <> PeerID
-extension Optional where Wrapped == String {
-    static func ==(lhs: Optional<Wrapped>, rhs: Optional<PeerID>) -> Bool   { lhs == rhs?.id }
-    static func !=(lhs: Optional<Wrapped>, rhs: Optional<PeerID>) -> Bool   { lhs != rhs?.id }
-}

bitchat/Models/ReadReceipt.swift

@@ -11,11 +11,11 @@ import Foundation
 struct ReadReceipt: Codable {
     let originalMessageID: String
     let receiptID: String
-    var readerID: String  // Who read it
+    var readerID: PeerID  // Who read it
     let readerNickname: String
     let timestamp: Date
     
-    init(originalMessageID: String, readerID: String, readerNickname: String) {
+    init(originalMessageID: String, readerID: PeerID, readerNickname: String) {
         self.originalMessageID = originalMessageID
         self.receiptID = UUID().uuidString
         self.readerID = readerID
@@ -24,7 +24,7 @@ struct ReadReceipt: Codable {
     }
     
     // For binary decoding
-    private init(originalMessageID: String, receiptID: String, readerID: String, readerNickname: String, timestamp: Date) {
+    private init(originalMessageID: String, receiptID: String, readerID: PeerID, readerNickname: String, timestamp: Date) {
         self.originalMessageID = originalMessageID
         self.receiptID = receiptID
         self.readerID = readerID
@@ -48,7 +48,7 @@ struct ReadReceipt: Codable {
         data.appendUUID(receiptID)
         // ReaderID as 8-byte hex string
         var readerData = Data()
-        var tempID = readerID
+        var tempID = readerID.id
         while tempID.count >= 2 && readerData.count < 8 {
             let hexByte = String(tempID.prefix(2))
             if let byte = UInt8(hexByte, radix: 16) {
@@ -78,8 +78,8 @@ struct ReadReceipt: Codable {
               let receiptID = dataCopy.readUUID(at: &offset) else { return nil }
         
         guard let readerIDData = dataCopy.readFixedBytes(at: &offset, count: 8) else { return nil }
-        let readerID = readerIDData.hexEncodedString()
-        guard PeerID(str: readerID).isValid else { return nil }
+        let readerID = PeerID(hexData: readerIDData)
+        guard readerID.isValid else { return nil }
         
         guard let timestamp = dataCopy.readDate(at: &offset),
               InputValidator.validateTimestamp(timestamp),

bitchat/Models/RequestSyncPacket.swift

@@ -8,6 +8,14 @@ struct RequestSyncPacket {
     let p: Int
     let m: UInt32
     let data: Data
+    let types: SyncTypeFlags?
+
+    init(p: Int, m: UInt32, data: Data, types: SyncTypeFlags? = nil) {
+        self.p = p
+        self.m = m
+        self.data = data
+        self.types = types
+    }
 
     func encode() -> Data {
         var out = Data()
@@ -25,6 +33,9 @@ struct RequestSyncPacket {
         putTLV(0x02, withUnsafeBytes(of: &mBE) { Data($0) })
         // data
         putTLV(0x03, data)
+        if let typesData = types?.toData() {
+            putTLV(0x04, typesData)
+        }
         return out
     }
 
@@ -33,6 +44,7 @@ struct RequestSyncPacket {
         var p: Int? = nil
         var m: UInt32? = nil
         var payload: Data? = nil
+        var types: SyncTypeFlags? = nil
 
         while off + 3 <= data.count {
             let t = Int(data[off]); off += 1
@@ -52,12 +64,16 @@ struct RequestSyncPacket {
             case 0x03:
                 if v.count > maxAcceptBytes { return nil }
                 payload = v
+            case 0x04:
+                if let decoded = SyncTypeFlags.decode(v) {
+                    types = decoded
+                }
             default:
                 break // forward compatible; ignore unknown TLVs
             }
         }
 
         guard let pp = p, let mm = m, let dd = payload, pp >= 1, mm > 0 else { return nil }
-        return RequestSyncPacket(p: pp, m: mm, data: dd)
+        return RequestSyncPacket(p: pp, m: mm, data: dd, types: types)
     }
 }

bitchat/Nostr/GeoRelayDirectory.swift

@@ -1,6 +1,11 @@
 import BitLogger
 import Foundation
 import Tor
+#if os(iOS)
+import UIKit
+#elseif os(macOS)
+import AppKit
+#endif
 
 /// Directory of online Nostr relays with approximate GPS locations, used for geohash routing.
 @MainActor
@@ -12,19 +17,32 @@ final class GeoRelayDirectory {
     }
 
     static let shared = GeoRelayDirectory()
+
     private(set) var entries: [Entry] = []
     private let cacheFileName = "georelays_cache.csv"
     private let lastFetchKey = "georelay.lastFetchAt"
     private let remoteURL = URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!
-    private let fetchInterval: TimeInterval = TransportConfig.geoRelayFetchIntervalSeconds // 24h
+    private let fetchInterval: TimeInterval = TransportConfig.geoRelayFetchIntervalSeconds
+
+    private var refreshTimer: Timer?
+    private var retryTask: Task<Void, Never>?
+    private var retryAttempt: Int = 0
+    private var isFetching: Bool = false
+    private var observers: [NSObjectProtocol] = []
 
     private init() {
-        // Load cached or bundled data synchronously
-        self.entries = self.loadLocalEntries()
-        // Fire-and-forget remote refresh if stale
+        entries = loadLocalEntries()
+        registerObservers()
+        startRefreshTimer()
         prefetchIfNeeded()
     }
 
+    deinit {
+        observers.forEach { NotificationCenter.default.removeObserver($0) }
+        refreshTimer?.invalidate()
+        retryTask?.cancel()
+    }
+
     /// Returns up to `count` relay URLs (wss://) closest to the geohash center.
     func closestRelays(toGeohash geohash: String, count: Int = 5) -> [String] {
         let center = Geohash.decodeCenter(geohash)
@@ -62,42 +80,119 @@ final class GeoRelayDirectory {
     }
 
     // MARK: - Remote Fetch
-    func prefetchIfNeeded() {
+    func prefetchIfNeeded(force: Bool = false) {
+        guard !isFetching else { return }
+
         let now = Date()
         let last = UserDefaults.standard.object(forKey: lastFetchKey) as? Date ?? .distantPast
-        guard now.timeIntervalSince(last) >= fetchInterval else { return }
+
+        if !force {
+            guard now.timeIntervalSince(last) >= fetchInterval else { return }
+        } else if last != .distantPast,
+                  now.timeIntervalSince(last) < TransportConfig.geoRelayRetryInitialSeconds {
+            // Skip forced fetches if we just refreshed moments ago.
+            return
+        }
+
+        cancelRetry()
         fetchRemote()
     }
 
     private func fetchRemote() {
-        let req = URLRequest(url: remoteURL, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 15)
-        // Ensure Tor readiness before fetching (fail-closed by default)
-        Task.detached {
+        guard !isFetching else { return }
+        isFetching = true
+
+        let request = URLRequest(
+            url: remoteURL,
+            cachePolicy: .reloadIgnoringLocalCacheData,
+            timeoutInterval: 15
+        )
+
+        Task.detached { [weak self] in
+            guard let self else { return }
+
             let ready = await TorManager.shared.awaitReady()
             if !ready {
-                SecureLogger.warning("GeoRelayDirectory: Tor not ready; skipping remote fetch (fail-closed)", category: .session)
+                await self.handleFetchFailure(.torNotReady)
                 return
             }
-            let task = TorURLSession.shared.session.dataTask(with: req) { [weak self] data, _, error in
-                guard let self = self else { return }
-                if let data = data, error == nil, let text = String(data: data, encoding: .utf8) {
-                    let parsed = GeoRelayDirectory.parseCSV(text)
-                    if !parsed.isEmpty {
-                        Task { @MainActor in
-                            self.entries = parsed
-                            self.persistCache(text)
-                            UserDefaults.standard.set(Date(), forKey: self.lastFetchKey)
-                            SecureLogger.info("GeoRelayDirectory: refreshed \(parsed.count) relays from remote", category: .session)
-                        }
-                        return
-                    }
+
+            do {
+                let (data, _) = try await TorURLSession.shared.session.data(for: request)
+                guard let text = String(data: data, encoding: .utf8) else {
+                    await self.handleFetchFailure(.invalidData)
+                    return
                 }
-                SecureLogger.warning("GeoRelayDirectory: remote fetch failed; keeping local entries", category: .session)
+
+                let parsed = GeoRelayDirectory.parseCSV(text)
+                guard !parsed.isEmpty else {
+                    await self.handleFetchFailure(.invalidData)
+                    return
+                }
+
+                await self.handleFetchSuccess(entries: parsed, csv: text)
+            } catch {
+                await self.handleFetchFailure(.network(error))
             }
-            task.resume()
         }
     }
 
+    private enum FetchFailure {
+        case torNotReady
+        case invalidData
+        case network(Error)
+    }
+
+    @MainActor
+    private func handleFetchSuccess(entries parsed: [Entry], csv: String) {
+        entries = parsed
+        persistCache(csv)
+        UserDefaults.standard.set(Date(), forKey: lastFetchKey)
+        SecureLogger.info("GeoRelayDirectory: refreshed \(parsed.count) relays from remote", category: .session)
+        isFetching = false
+        retryAttempt = 0
+        cancelRetry()
+    }
+
+    @MainActor
+    private func handleFetchFailure(_ reason: FetchFailure) {
+        switch reason {
+        case .torNotReady:
+            SecureLogger.warning("GeoRelayDirectory: Tor not ready; scheduling retry", category: .session)
+        case .invalidData:
+            SecureLogger.warning("GeoRelayDirectory: remote fetch returned invalid data; scheduling retry", category: .session)
+        case .network(let error):
+            SecureLogger.warning("GeoRelayDirectory: remote fetch failed with error: \(error.localizedDescription)", category: .session)
+        }
+        isFetching = false
+        scheduleRetry()
+    }
+
+    @MainActor
+    private func scheduleRetry() {
+        retryAttempt = min(retryAttempt + 1, 10)
+        let base = TransportConfig.geoRelayRetryInitialSeconds
+        let maxDelay = TransportConfig.geoRelayRetryMaxSeconds
+        let multiplier = pow(2.0, Double(max(retryAttempt - 1, 0)))
+        let calculated = base * multiplier
+        let delay = min(maxDelay, max(base, calculated))
+
+        cancelRetry()
+        retryTask = Task { [weak self] in
+            let nanoseconds = UInt64(delay * 1_000_000_000)
+            try? await Task.sleep(nanoseconds: nanoseconds)
+            await MainActor.run {
+                self?.prefetchIfNeeded(force: true)
+            }
+        }
+    }
+
+    @MainActor
+    private func cancelRetry() {
+        retryTask?.cancel()
+        retryTask = nil
+    }
+
     private func persistCache(_ text: String) {
         guard let url = cacheURL() else { return }
         do {
@@ -110,30 +205,35 @@ final class GeoRelayDirectory {
     // MARK: - Loading
     private func loadLocalEntries() -> [Entry] {
         // Prefer cached file if present
-        if let cache = self.cacheURL(),
+        if let cache = cacheURL(),
            let data = try? Data(contentsOf: cache),
            let text = String(data: data, encoding: .utf8) {
             let arr = Self.parseCSV(text)
             if !arr.isEmpty { return arr }
         }
+
         // Try bundled resource(s)
         let bundleCandidates = [
             Bundle.main.url(forResource: "nostr_relays", withExtension: "csv"),
             Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv"),
             Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv", subdirectory: "relays")
         ].compactMap { $0 }
+
         for url in bundleCandidates {
-            if let data = try? Data(contentsOf: url), let text = String(data: data, encoding: .utf8) {
+            if let data = try? Data(contentsOf: url),
+               let text = String(data: data, encoding: .utf8) {
                 let arr = Self.parseCSV(text)
                 if !arr.isEmpty { return arr }
             }
         }
+
         // Try filesystem path (development/test)
         if let cwd = FileManager.default.currentDirectoryPath as String?,
            let data = try? Data(contentsOf: URL(fileURLWithPath: cwd).appendingPathComponent("relays/online_relays_gps.csv")),
            let text = String(data: data, encoding: .utf8) {
             return Self.parseCSV(text)
         }
+
         SecureLogger.warning("GeoRelayDirectory: no local CSV found; entries empty", category: .session)
         return []
     }
@@ -141,7 +241,6 @@ final class GeoRelayDirectory {
     nonisolated static func parseCSV(_ text: String) -> [Entry] {
         var result: Set<Entry> = []
         let lines = text.split(whereSeparator: { $0.isNewline })
-        // Skip header if present
         for (idx, raw) in lines.enumerated() {
             let line = raw.trimmingCharacters(in: .whitespacesAndNewlines)
             if line.isEmpty { continue }
@@ -162,11 +261,76 @@ final class GeoRelayDirectory {
 
     private func cacheURL() -> URL? {
         do {
-            let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
+            let base = try FileManager.default.url(
+                for: .applicationSupportDirectory,
+                in: .userDomainMask,
+                appropriateFor: nil,
+                create: true
+            )
             let dir = base.appendingPathComponent("bitchat", isDirectory: true)
             try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
             return dir.appendingPathComponent(cacheFileName)
-        } catch { return nil }
+        } catch {
+            return nil
+        }
+    }
+
+    // MARK: - Observers & Timers
+    private func registerObservers() {
+        let center = NotificationCenter.default
+
+        let torReady = center.addObserver(
+            forName: .TorDidBecomeReady,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.prefetchIfNeeded(force: true)
+            }
+        }
+        observers.append(torReady)
+
+#if os(iOS)
+        let didBecomeActive = center.addObserver(
+            forName: UIApplication.didBecomeActiveNotification,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.prefetchIfNeeded()
+            }
+        }
+        observers.append(didBecomeActive)
+#elseif os(macOS)
+        let didBecomeActive = center.addObserver(
+            forName: NSApplication.didBecomeActiveNotification,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.prefetchIfNeeded()
+            }
+        }
+        observers.append(didBecomeActive)
+#endif
+    }
+
+    private func startRefreshTimer() {
+        refreshTimer?.invalidate()
+        let interval = TransportConfig.geoRelayRefreshCheckIntervalSeconds
+        guard interval > 0 else { return }
+
+        let timer = Timer.scheduledTimer(withTimeInterval: interval, repeats: true) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.prefetchIfNeeded()
+            }
+        }
+        refreshTimer = timer
+        RunLoop.main.add(timer, forMode: .common)
     }
 }
 

bitchat/Nostr/NostrEmbeddedBitChat.swift

@@ -4,7 +4,7 @@ import Foundation
 
 struct NostrEmbeddedBitChat {
     /// Build a `bitchat1:` base64url-encoded BitChat packet carrying a private message for Nostr DMs.
-    static func encodePMForNostr(content: String, messageID: String, recipientPeerID: String, senderPeerID: String) -> String? {
+    static func encodePMForNostr(content: String, messageID: String, recipientPeerID: PeerID, senderPeerID: PeerID) -> String? {
         // TLV-encode the private message
         let pm = PrivateMessagePacket(messageID: messageID, content: content)
         guard let tlv = pm.encode() else { return nil }
@@ -14,12 +14,12 @@ struct NostrEmbeddedBitChat {
         payload.append(tlv)
 
         // Determine 8-byte recipient ID to embed
-        let recipientIDHex: String = normalizeRecipientPeerID(recipientPeerID)
+        let recipientID = normalizeRecipientPeerID(recipientPeerID)
 
         let packet = BitchatPacket(
             type: MessageType.noiseEncrypted.rawValue,
-            senderID: Data(hexString: senderPeerID) ?? Data(),
-            recipientID: Data(hexString: recipientIDHex),
+            senderID: Data(hexString: senderPeerID.id) ?? Data(),
+            recipientID: Data(hexString: recipientID.id),
             timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
             payload: payload,
             signature: nil,
@@ -31,18 +31,18 @@ struct NostrEmbeddedBitChat {
     }
 
     /// Build a `bitchat1:` base64url-encoded BitChat packet carrying a delivery/read ack for Nostr DMs.
-    static func encodeAckForNostr(type: NoisePayloadType, messageID: String, recipientPeerID: String, senderPeerID: String) -> String? {
+    static func encodeAckForNostr(type: NoisePayloadType, messageID: String, recipientPeerID: PeerID, senderPeerID: PeerID) -> String? {
         guard type == .delivered || type == .readReceipt else { return nil }
 
         var payload = Data([type.rawValue])
         payload.append(Data(messageID.utf8))
 
-        let recipientIDHex: String = normalizeRecipientPeerID(recipientPeerID)
+        let recipientID = normalizeRecipientPeerID(recipientPeerID)
 
         let packet = BitchatPacket(
             type: MessageType.noiseEncrypted.rawValue,
-            senderID: Data(hexString: senderPeerID) ?? Data(),
-            recipientID: Data(hexString: recipientIDHex),
+            senderID: Data(hexString: senderPeerID.id) ?? Data(),
+            recipientID: Data(hexString: recipientID.id),
             timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
             payload: payload,
             signature: nil,
@@ -54,7 +54,7 @@ struct NostrEmbeddedBitChat {
     }
 
     /// Build a `bitchat1:` ACK (delivered/read) without an embedded recipient peer ID (geohash DMs).
-    static func encodeAckForNostrNoRecipient(type: NoisePayloadType, messageID: String, senderPeerID: String) -> String? {
+    static func encodeAckForNostrNoRecipient(type: NoisePayloadType, messageID: String, senderPeerID: PeerID) -> String? {
         guard type == .delivered || type == .readReceipt else { return nil }
 
         var payload = Data([type.rawValue])
@@ -62,7 +62,7 @@ struct NostrEmbeddedBitChat {
 
         let packet = BitchatPacket(
             type: MessageType.noiseEncrypted.rawValue,
-            senderID: Data(hexString: senderPeerID) ?? Data(),
+            senderID: Data(hexString: senderPeerID.id) ?? Data(),
             recipientID: nil,
             timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
             payload: payload,
@@ -75,7 +75,7 @@ struct NostrEmbeddedBitChat {
     }
 
     /// Build a `bitchat1:` payload without an embedded recipient peer ID (used for geohash DMs).
-    static func encodePMForNostrNoRecipient(content: String, messageID: String, senderPeerID: String) -> String? {
+    static func encodePMForNostrNoRecipient(content: String, messageID: String, senderPeerID: PeerID) -> String? {
         let pm = PrivateMessagePacket(messageID: messageID, content: content)
         guard let tlv = pm.encode() else { return nil }
 
@@ -84,7 +84,7 @@ struct NostrEmbeddedBitChat {
 
         let packet = BitchatPacket(
             type: MessageType.noiseEncrypted.rawValue,
-            senderID: Data(hexString: senderPeerID) ?? Data(),
+            senderID: Data(hexString: senderPeerID.id) ?? Data(),
             recipientID: nil,
             timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
             payload: payload,
@@ -96,11 +96,11 @@ struct NostrEmbeddedBitChat {
         return "bitchat1:" + base64URLEncode(data)
     }
 
-    private static func normalizeRecipientPeerID(_ recipientPeerID: String) -> String {
-        if let maybeData = Data(hexString: recipientPeerID) {
+    private static func normalizeRecipientPeerID(_ recipientPeerID: PeerID) -> PeerID {
+        if let maybeData = Data(hexString: recipientPeerID.id) {
             if maybeData.count == 32 {
                 // Treat as Noise static public key; derive peerID from fingerprint
-                return PeerID(publicKey: maybeData).id
+                return PeerID(publicKey: maybeData)
             } else if maybeData.count == 8 {
                 // Already an 8-byte peer ID
                 return recipientPeerID

bitchat/Protocols/BinaryProtocol.swift

@@ -137,6 +137,7 @@ struct BinaryProtocol {
         static let hasRecipient: UInt8 = 0x01
         static let hasSignature: UInt8 = 0x02
         static let isCompressed: UInt8 = 0x04
+        static let hasRoute: UInt8 = 0x08
     }
     
     // Encode BitchatPacket to binary format
@@ -160,8 +161,21 @@ struct BinaryProtocol {
         }
 
         let lengthFieldBytes = lengthFieldSize(for: version)
+        let originalRoute = packet.route ?? []
+        if originalRoute.contains(where: { $0.isEmpty }) { return nil }
+        let sanitizedRoute: [Data] = originalRoute.map { hop in
+            if hop.count == senderIDSize { return hop }
+            if hop.count > senderIDSize { return Data(hop.prefix(senderIDSize)) }
+            var padded = hop
+            padded.append(Data(repeating: 0, count: senderIDSize - hop.count))
+            return padded
+        }
+        guard sanitizedRoute.count <= 255 else { return nil }
+
+        let hasRoute = !sanitizedRoute.isEmpty
+        let routeLength = hasRoute ? 1 + sanitizedRoute.count * senderIDSize : 0
         let originalSizeFieldBytes = isCompressed ? lengthFieldBytes : 0
-        let payloadDataSize = payload.count + originalSizeFieldBytes
+        let payloadDataSize = routeLength + payload.count + originalSizeFieldBytes
 
         if version == 1 && payloadDataSize > Int(UInt16.max) { return nil }
         if version == 2 && payloadDataSize > Int(UInt32.max) { return nil }
@@ -185,6 +199,7 @@ struct BinaryProtocol {
         if packet.recipientID != nil { flags |= Flags.hasRecipient }
         if packet.signature != nil { flags |= Flags.hasSignature }
         if isCompressed { flags |= Flags.isCompressed }
+        if hasRoute { flags |= Flags.hasRoute }
         data.append(flags)
 
         if version == 2 {
@@ -212,6 +227,13 @@ struct BinaryProtocol {
             }
         }
 
+        if hasRoute {
+            data.append(UInt8(sanitizedRoute.count))
+            for hop in sanitizedRoute {
+                data.append(hop)
+            }
+        }
+
         if isCompressed, let originalSize = originalPayloadSize {
             if version == 2 {
                 let value = UInt32(originalSize)
@@ -321,9 +343,27 @@ struct BinaryProtocol {
                 if recipientID == nil { return nil }
             }
 
+            var route: [Data]? = nil
+            var remainingPayloadBytes = payloadLength
+
+            if (flags & Flags.hasRoute) != 0 {
+                guard remainingPayloadBytes >= 1, let routeCount = read8() else { return nil }
+                remainingPayloadBytes -= 1
+                if routeCount > 0 {
+                    var hops: [Data] = []
+                    for _ in 0..<Int(routeCount) {
+                        guard remainingPayloadBytes >= senderIDSize,
+                              let hop = readData(senderIDSize) else { return nil }
+                        remainingPayloadBytes -= senderIDSize
+                        hops.append(hop)
+                    }
+                    route = hops
+                }
+            }
+
             let payload: Data
             if isCompressed {
-                guard payloadLength >= lengthFieldBytes else { return nil }
+                guard remainingPayloadBytes >= lengthFieldBytes else { return nil }
                 let originalSize: Int
                 if version == 2 {
                     guard let rawSize = read32() else { return nil }
@@ -332,16 +372,12 @@ struct BinaryProtocol {
                     guard let rawSize = read16() else { return nil }
                     originalSize = Int(rawSize)
                 }
-                // Guard to keep decompression bounded to sane BLE payload limits
-                // Use maxFramedFileBytes to account for TLV overhead in file transfer payloads
+                remainingPayloadBytes -= lengthFieldBytes
                 guard originalSize >= 0 && originalSize <= FileTransferLimits.maxFramedFileBytes else { return nil }
-                let compressedSize = payloadLength - lengthFieldBytes
-                guard compressedSize >= 0, let compressed = readData(compressedSize) else { return nil }
+                let compressedSize = remainingPayloadBytes
+                guard compressedSize > 0, let compressed = readData(compressedSize) else { return nil }
+                remainingPayloadBytes = 0
 
-                // Validate compression ratio to prevent zip bomb attacks
-                // Primary protection: originalSize capped at 1MB (line 336)
-                // Defense-in-depth: reject extreme ratios (prevents DoS via memory allocation)
-                guard compressedSize > 0 else { return nil }
                 let compressionRatio = Double(originalSize) / Double(compressedSize)
                 guard compressionRatio <= 50_000.0 else {
                     SecureLogger.warning("🚫 Suspicious compression ratio: \(String(format: "%.0f", compressionRatio)):1", category: .security)
@@ -352,7 +388,9 @@ struct BinaryProtocol {
                       decompressed.count == originalSize else { return nil }
                 payload = decompressed
             } else {
-                guard let rawPayload = readData(payloadLength) else { return nil }
+                guard remainingPayloadBytes >= 0,
+                      let rawPayload = readData(remainingPayloadBytes) else { return nil }
+                remainingPayloadBytes = 0
                 payload = rawPayload
             }
 
@@ -372,7 +410,8 @@ struct BinaryProtocol {
                 payload: payload,
                 signature: signature,
                 ttl: ttl,
-                version: version
+                version: version,
+                route: route
             )
         }
     }

bitchat/Protocols/BitchatProtocol.swift

@@ -178,7 +178,7 @@ protocol BitchatDelegate: AnyObject {
 
     // Bluetooth state updates for user notifications
     func didUpdateBluetoothState(_ state: CBManagerState)
-    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date)
+    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?)
 }
 
 // Provide default implementation to make it effectively optional
@@ -195,7 +195,7 @@ extension BitchatDelegate {
         // Default empty implementation
     }
 
-    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date) {
+    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {
         // Default empty implementation
     }
 }

bitchat/Protocols/LocationChannel.swift

@@ -116,4 +116,18 @@ enum ChannelID: Equatable, Codable {
         case .location(let ch): return ch.geohash
         }
     }
+    
+    var isMesh: Bool {
+        switch self {
+        case .mesh:     true
+        case .location: false
+        }
+    }
+    
+    var isLocation: Bool {
+        switch self {
+        case .mesh:     false
+        case .location: true
+        }
+    }
 }

bitchat/Protocols/Packets.swift

@@ -6,11 +6,13 @@ struct AnnouncementPacket {
     let nickname: String
     let noisePublicKey: Data            // Noise static public key (Curve25519.KeyAgreement)
     let signingPublicKey: Data          // Ed25519 public key for signing
+    let directNeighbors: [Data]?        // 8-byte peer IDs
 
     private enum TLVType: UInt8 {
         case nickname = 0x01
         case noisePublicKey = 0x02
         case signingPublicKey = 0x03
+        case directNeighbors = 0x04
     }
 
     func encode() -> Data? {
@@ -35,6 +37,16 @@ struct AnnouncementPacket {
         data.append(TLVType.signingPublicKey.rawValue)
         data.append(UInt8(signingPublicKey.count))
         data.append(signingPublicKey)
+        
+        // TLV for direct neighbors (optional)
+        if let neighbors = directNeighbors, !neighbors.isEmpty {
+            let neighborsData = neighbors.prefix(10).reduce(Data()) { $0 + $1 }
+            if !neighborsData.isEmpty && neighborsData.count % 8 == 0 {
+                data.append(TLVType.directNeighbors.rawValue)
+                data.append(UInt8(neighborsData.count))
+                data.append(neighborsData)
+            }
+        }
 
         return data
     }
@@ -44,6 +56,7 @@ struct AnnouncementPacket {
         var nickname: String?
         var noisePublicKey: Data?
         var signingPublicKey: Data?
+        var directNeighbors: [Data]?
 
         while offset + 2 <= data.count {
             let typeRaw = data[offset]
@@ -63,6 +76,17 @@ struct AnnouncementPacket {
                     noisePublicKey = Data(value)
                 case .signingPublicKey:
                     signingPublicKey = Data(value)
+                case .directNeighbors:
+                    if length > 0 && length % 8 == 0 {
+                        var neighbors = [Data]()
+                        let count = length / 8
+                        for i in 0..<count {
+                            let start = value.startIndex + i * 8
+                            let end = start + 8
+                            neighbors.append(Data(value[start..<end]))
+                        }
+                        directNeighbors = neighbors
+                    }
                 }
             } else {
                 // Unknown TLV; skip (tolerant decoder for forward compatibility)
@@ -74,7 +98,8 @@ struct AnnouncementPacket {
         return AnnouncementPacket(
             nickname: nickname,
             noisePublicKey: noisePublicKey,
-            signingPublicKey: signingPublicKey
+            signingPublicKey: signingPublicKey,
+            directNeighbors: directNeighbors
         )
     }
 }

bitchat/Services/BLE/MimeType.swift

@@ -0,0 +1,195 @@
+//
+// MimeType.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import UniformTypeIdentifiers
+
+// MARK: - Extensions for missing UTTypes
+
+extension UTType {
+    static let webP = UTType(importedAs: "image/webp")
+    static let aac  = UTType(importedAs: "audio/aac")
+    static let m4a  = UTType(importedAs: "audio/m4a")
+    static let ogg  = UTType(importedAs: "audio/ogg")
+}
+
+// MARK: - MimeType Enum
+
+enum MimeType: CaseIterable, Hashable {
+    case jpeg
+    case jpg
+    case png
+    case gif
+    case webp
+    case mp4Audio
+    case m4a
+    case aac
+    case mpeg
+    case mp3
+    case wav
+    case xWav
+    case ogg
+    case pdf
+    case octetStream
+
+    var utType: UTType {
+        switch self {
+        case .jpeg, .jpg:   .jpeg
+        case .png:          .png
+        case .gif:          .gif
+        case .webp:         .webP
+        case .aac:          .aac
+        case .m4a:          .m4a
+        case .mp4Audio:     .mpeg4Audio
+        case .mp3, .mpeg:   .mp3
+        case .wav, .xWav:   .wav
+        case .ogg:          .ogg
+        case .pdf:          .pdf
+        case .octetStream:  .data
+        }
+    }
+    
+    var category: Category {
+        switch self {
+        case .jpeg, .jpg, .png, .gif, .webp:
+            return .image
+        case .aac, .m4a, .mp4Audio, .mpeg, .mp3, .wav, .xWav, .ogg:
+            return .audio
+        case .pdf, .octetStream:
+            return .file
+        }
+    }
+
+
+    var mimeString: String {
+        switch self {
+        case .jpeg, .jpg:   "image/jpeg"
+        case .png:          "image/png"
+        case .gif:          "image/gif"
+        case .webp:         "image/webp"
+        case .mp4Audio:     "audio/mp4"
+        case .m4a:          "audio/m4a"
+        case .aac:          "audio/aac"
+        case .mpeg:         "audio/mpeg"
+        case .mp3:          "audio/mp3"
+        case .wav:          "audio/wav"
+        case .xWav:         "audio/x-wav"
+        case .ogg:          "audio/ogg"
+        case .pdf:          "application/pdf"
+        case .octetStream:  "application/octet-stream"
+        }
+    }
+    
+    var defaultExtension: String {
+        switch self {
+        case .jpeg, .jpg:           "jpg"
+        case .png:                  "png"
+        case .webp:                 "webp"
+        case .gif:                  "gif"
+        case .mp4Audio, .m4a, .aac: "m4a"
+        case .mpeg, .mp3:           "mp3"
+        case .wav, .xWav:           "wav"
+        case .ogg:                  "ogg"
+        case .pdf:                  "pdf"
+        case .octetStream:          "bin"
+        }
+    }
+
+    static var allowed: Set<MimeType> = [
+        .jpeg, .jpg, .png, .gif, .webp,
+        .mp4Audio, .m4a, .aac, .mpeg, .mp3,
+        .wav, .xWav, .ogg,
+        .pdf, .octetStream
+    ]
+
+    var isAllowed: Bool {
+        Self.allowed.contains(self)
+    }
+
+    // MARK: - Byte signature validation
+    func matches(data: Data) -> Bool {
+        guard !data.isEmpty else { return false }
+
+        // Generic type → skip validation
+        if self == .octetStream { return true }
+
+        switch self {
+        case .jpeg, .jpg:
+            return data.count >= 3 && data[0] == 0xFF && data[1] == 0xD8 && data[2] == 0xFF
+
+        case .png:
+            return data.count >= 8 &&
+                   data[0] == 0x89 && data[1] == 0x50 && data[2] == 0x4E && data[3] == 0x47 &&
+                   data[4] == 0x0D && data[5] == 0x0A && data[6] == 0x1A && data[7] == 0x0A
+
+        case .gif:
+            return data.count >= 6 && data[0] == 0x47 && data[1] == 0x49 && data[2] == 0x46 &&
+                   data[3] == 0x38 && (data[4] == 0x37 || data[4] == 0x39) && data[5] == 0x61
+
+        case .webp:
+            return data.count >= 12 &&
+                   data[0] == 0x52 && data[1] == 0x49 && data[2] == 0x46 && data[3] == 0x46 &&
+                   data[8] == 0x57 && data[9] == 0x45 && data[10] == 0x42 && data[11] == 0x50
+
+        case .m4a, .mp4Audio, .aac:
+            // AVAudioRecorder output varies by platform - be lenient
+            // Security: size already capped + sandboxed execution
+            return data.count > 100
+
+        case .mpeg, .mp3:
+            if data.count >= 3 && data[0] == 0x49 && data[1] == 0x44 && data[2] == 0x33 {
+                return true // ID3 header
+            }
+            return data.count >= 2 && data[0] == 0xFF && (data[1] & 0xE0) == 0xE0
+
+        case .wav, .xWav:
+            return data.count >= 12 &&
+                   data[0] == 0x52 && data[1] == 0x49 && data[2] == 0x46 && data[3] == 0x46 &&
+                   data[8] == 0x57 && data[9] == 0x41 && data[10] == 0x56 && data[11] == 0x45
+
+        case .ogg:
+            return data.count >= 4 &&
+                   data[0] == 0x4F && data[1] == 0x67 && data[2] == 0x67 && data[3] == 0x53
+
+        case .pdf:
+            return data.count >= 4 &&
+                   data[0] == 0x25 && data[1] == 0x50 && data[2] == 0x44 && data[3] == 0x46
+
+        default:
+            return false
+        }
+    }
+
+    // MARK: - Convenience Initializers
+
+    init?(_ mimeString: String?) {
+        guard let mimeString else { return nil }
+        
+        let normalized = mimeString.lowercased()
+
+        // Direct match with our canonical list
+        if let match = MimeType.allCases.first(where: { $0.mimeString == normalized }) {
+            self = match
+            return
+        }
+
+        // Let UTType normalize aliases like "image/jpg", "audio/x-wav", etc.
+        if let type = UTType(mimeType: normalized),
+           let match = MimeType.allCases.first(where: { type.conforms(to: $0.utType) }) {
+            self = match
+            return
+        }
+
+        return nil
+    }
+}
+
+extension MimeType {
+    enum Category: String {
+        case audio, image, file
+    }
+}

bitchat/Services/MeshTopologyTracker.swift

@@ -0,0 +1,120 @@
+import Foundation
+
+/// Tracks observed mesh topology and computes hop-by-hop routes.
+final class MeshTopologyTracker {
+    private typealias RoutingID = Data
+
+    private let queue = DispatchQueue(label: "mesh.topology", attributes: .concurrent)
+    private let hopSize = 8
+    private var adjacency: [RoutingID: Set<RoutingID>] = [:]
+
+    func reset() {
+        queue.sync(flags: .barrier) {
+            self.adjacency.removeAll()
+        }
+    }
+
+    func recordDirectLink(between a: Data?, and b: Data?) {
+        guard let left = sanitize(a), let right = sanitize(b), left != right else { return }
+        queue.sync(flags: .barrier) {
+            var setA = self.adjacency[left] ?? []
+            setA.insert(right)
+            self.adjacency[left] = setA
+
+            var setB = self.adjacency[right] ?? []
+            setB.insert(left)
+            self.adjacency[right] = setB
+        }
+    }
+
+    func removeDirectLink(between a: Data?, and b: Data?) {
+        guard let left = sanitize(a), let right = sanitize(b), left != right else { return }
+        queue.sync(flags: .barrier) {
+            if var setA = self.adjacency[left] {
+                setA.remove(right)
+                self.adjacency[left] = setA.isEmpty ? nil : setA
+            }
+            if var setB = self.adjacency[right] {
+                setB.remove(left)
+                self.adjacency[right] = setB.isEmpty ? nil : setB
+            }
+        }
+    }
+
+    func removePeer(_ data: Data?) {
+        guard let peer = sanitize(data) else { return }
+        queue.sync(flags: .barrier) {
+            guard let neighbors = self.adjacency.removeValue(forKey: peer) else { return }
+            for neighbor in neighbors {
+                if var set = self.adjacency[neighbor] {
+                    set.remove(peer)
+                    self.adjacency[neighbor] = set.isEmpty ? nil : set
+                }
+            }
+        }
+    }
+
+    func recordRoute(_ hops: [Data]) {
+        let sanitized = hops.compactMap { sanitize($0) }
+        guard sanitized.count >= 2 else { return }
+        queue.sync(flags: .barrier) {
+            for idx in 0..<(sanitized.count - 1) {
+                let left = sanitized[idx]
+                let right = sanitized[idx + 1]
+                guard left != right else { continue }
+
+                var setA = self.adjacency[left] ?? []
+                setA.insert(right)
+                self.adjacency[left] = setA
+
+                var setB = self.adjacency[right] ?? []
+                setB.insert(left)
+                self.adjacency[right] = setB
+            }
+        }
+    }
+
+    func computeRoute(from start: Data?, to goal: Data?, maxHops: Int = 255) -> [Data]? {
+        guard let source = sanitize(start), let target = sanitize(goal) else { return nil }
+        if source == target { return [source] }
+
+        let graph = queue.sync { adjacency }
+        guard graph[source] != nil, graph[target] != nil else { return nil }
+
+        var visited: Set<RoutingID> = [source]
+        var queuePaths: [[RoutingID]] = [[source]]
+        var index = 0
+
+        while index < queuePaths.count {
+            let path = queuePaths[index]
+            index += 1
+            guard path.count <= maxHops else { continue }
+            guard let last = path.last, let neighbors = graph[last] else { continue }
+
+            for neighbor in neighbors {
+                if visited.contains(neighbor) { continue }
+                var nextPath = path
+                nextPath.append(neighbor)
+                if neighbor == target { return nextPath }
+                if nextPath.count <= maxHops {
+                    queuePaths.append(nextPath)
+                }
+                visited.insert(neighbor)
+            }
+        }
+
+        return nil
+    }
+
+    // MARK: - Helpers
+
+    private func sanitize(_ data: Data?) -> Data? {
+        guard var value = data, !value.isEmpty else { return nil }
+        if value.count > hopSize {
+            value = Data(value.prefix(hopSize))
+        } else if value.count < hopSize {
+            value.append(Data(repeating: 0, count: hopSize - value.count))
+        }
+        return value
+    }
+}

bitchat/Services/NoiseEncryptionService.swift

@@ -177,18 +177,18 @@ final class NoiseEncryptionService {
     private let rekeyCheckInterval: TimeInterval = 60.0 // Check every minute
     
     // Callbacks
-    private var onPeerAuthenticatedHandlers: [((String, String) -> Void)] = [] // Array of handlers for peer authentication
+    private var onPeerAuthenticatedHandlers: [((PeerID, String) -> Void)] = [] // Array of handlers for peer authentication
     var onHandshakeRequired: ((PeerID) -> Void)? // peerID needs handshake
     
     // Add a handler for peer authentication
-    func addOnPeerAuthenticatedHandler(_ handler: @escaping (String, String) -> Void) {
+    func addOnPeerAuthenticatedHandler(_ handler: @escaping (PeerID, String) -> Void) {
         serviceQueue.async(flags: .barrier) { [weak self] in
             self?.onPeerAuthenticatedHandlers.append(handler)
         }
     }
     
     // Legacy support - setting this will add to the handlers array
-    var onPeerAuthenticated: ((String, String) -> Void)? {
+    var onPeerAuthenticated: ((PeerID, String) -> Void)? {
         get { nil } // Always return nil for backward compatibility
         set {
             if let handler = newValue {
@@ -546,7 +546,7 @@ final class NoiseEncryptionService {
         // Notify all handlers about authentication
         serviceQueue.async { [weak self] in
             self?.onPeerAuthenticatedHandlers.forEach { handler in
-                handler(peerID.id, fingerprint)
+                handler(peerID, fingerprint)
             }
         }
     }

bitchat/Services/NostrTransport.swift

@@ -82,7 +82,7 @@ final class NostrTransport: Transport {
                 SecureLogger.error("NostrTransport: failed to decode npub -> hex: \(error)", category: .session)
                 return
             }
-            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: messageID, recipientPeerID: peerID.id, senderPeerID: senderPeerID.id) else {
+            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed PM packet", category: .session)
                 return
             }
@@ -114,7 +114,7 @@ final class NostrTransport: Transport {
                 guard hrp == "npub" else { return }
                 recipientHex = data.hexEncodedString()
             } catch { return }
-            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: UUID().uuidString, recipientPeerID: peerID.id, senderPeerID: senderPeerID.id) else {
+            guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: UUID().uuidString, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed favorite notification", category: .session)
                 return
             }
@@ -139,7 +139,7 @@ final class NostrTransport: Transport {
                 guard hrp == "npub" else { return }
                 recipientHex = data.hexEncodedString()
             } catch { return }
-            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .delivered, messageID: messageID, recipientPeerID: peerID.id, senderPeerID: senderPeerID.id) else {
+            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .delivered, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed DELIVERED ack", category: .session)
                 return
             }
@@ -161,7 +161,7 @@ extension NostrTransport {
     func sendDeliveryAckGeohash(for messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
         Task { @MainActor in
             SecureLogger.debug("GeoDM: send DELIVERED -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
-            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .delivered, messageID: messageID, senderPeerID: senderPeerID.id) else { return }
+            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .delivered, messageID: messageID, senderPeerID: senderPeerID) else { return }
             guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: identity) else { return }
             NostrRelayManager.registerPendingGiftWrap(id: event.id)
             NostrRelayManager.shared.sendEvent(event)
@@ -171,7 +171,7 @@ extension NostrTransport {
     func sendReadReceiptGeohash(_ messageID: String, toRecipientHex recipientHex: String, from identity: NostrIdentity) {
         Task { @MainActor in
             SecureLogger.debug("GeoDM: send READ -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
-            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .readReceipt, messageID: messageID, senderPeerID: senderPeerID.id) else { return }
+            guard let embedded = NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .readReceipt, messageID: messageID, senderPeerID: senderPeerID) else { return }
             guard let event = try? NostrProtocol.createPrivateMessage(content: embedded, recipientPubkey: recipientHex, senderIdentity: identity) else { return }
             NostrRelayManager.registerPendingGiftWrap(id: event.id)
             NostrRelayManager.shared.sendEvent(event)
@@ -184,7 +184,7 @@ extension NostrTransport {
             guard !recipientHex.isEmpty else { return }
             SecureLogger.debug("GeoDM: send PM -> recip=\(recipientHex.prefix(8))… mid=\(messageID.prefix(8))… from=\(identity.publicKeyHex.prefix(8))…", category: .session)
             // Build embedded BitChat packet without recipient peer ID
-            guard let embedded = NostrEmbeddedBitChat.encodePMForNostrNoRecipient(content: content, messageID: messageID, senderPeerID: senderPeerID.id) else {
+            guard let embedded = NostrEmbeddedBitChat.encodePMForNostrNoRecipient(content: content, messageID: messageID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed geohash PM packet", category: .session)
                 return
             }
@@ -223,7 +223,7 @@ extension NostrTransport {
                 guard hrp == "npub" else { scheduleNextReadAck(); return }
                 recipientHex = data.hexEncodedString()
             } catch { scheduleNextReadAck(); return }
-            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .readReceipt, messageID: item.receipt.originalMessageID, recipientPeerID: item.peerID.id, senderPeerID: senderPeerID.id) else {
+            guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .readReceipt, messageID: item.receipt.originalMessageID, recipientPeerID: item.peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed READ ack", category: .session)
                 scheduleNextReadAck(); return
             }

bitchat/Services/NotificationService.swift

@@ -29,28 +29,30 @@ final class NotificationService {
         }
     }
     
-    func sendLocalNotification(title: String, body: String, identifier: String, userInfo: [String: Any]? = nil) {
-        // For now, skip app state check entirely to avoid thread issues
-        // The NotificationDelegate will handle foreground presentation
-        DispatchQueue.main.async {
-            let content = UNMutableNotificationContent()
-            content.title = title
-            content.body = body
-            content.sound = .default
-            if let userInfo = userInfo {
-                content.userInfo = userInfo
-            }
-            
-            let request = UNNotificationRequest(
-                identifier: identifier,
-                content: content,
-                trigger: nil // Deliver immediately
-            )
-            
-            UNUserNotificationCenter.current().add(request) { _ in
-                // Notification added
-            }
+    func sendLocalNotification(
+        title: String,
+        body: String,
+        identifier: String,
+        userInfo: [String: Any]? = nil,
+        interruptionLevel: UNNotificationInterruptionLevel = .active
+    ) {
+        let content = UNMutableNotificationContent()
+        content.title = title
+        content.body = body
+        content.sound = .default
+        content.interruptionLevel = interruptionLevel
+
+        if let userInfo = userInfo {
+            content.userInfo = userInfo
         }
+
+        let request = UNNotificationRequest(
+            identifier: identifier,
+            content: content,
+            trigger: nil // Deliver immediately
+        )
+
+        UNUserNotificationCenter.current().add(request)
     }
     
     func sendMentionNotification(from sender: String, message: String) {
@@ -61,11 +63,11 @@ final class NotificationService {
         sendLocalNotification(title: title, body: body, identifier: identifier)
     }
     
-    func sendPrivateMessageNotification(from sender: String, message: String, peerID: String) {
+    func sendPrivateMessageNotification(from sender: String, message: String, peerID: PeerID) {
         let title = "🔒 DM from \(sender)"
         let body = message
         let identifier = "private-\(UUID().uuidString)"
-        let userInfo = ["peerID": peerID, "senderName": sender]
+        let userInfo = ["peerID": peerID.id, "senderName": sender]
         
         sendLocalNotification(title: title, body: body, identifier: identifier, userInfo: userInfo)
     }
@@ -83,25 +85,12 @@ final class NotificationService {
         let title = "👥 bitchatters nearby!"
         let body = peerCount == 1 ? "1 person around" : "\(peerCount) people around"
         let identifier = "network-available-\(Date().timeIntervalSince1970)"
-        
-        // For network notifications, we want to show them even in foreground
-        // No app state check - let the notification delegate handle presentation
-        DispatchQueue.main.async {
-            let content = UNMutableNotificationContent()
-            content.title = title
-            content.body = body
-            content.sound = .default
-            content.interruptionLevel = .timeSensitive  // Make it more prominent
-            
-            let request = UNNotificationRequest(
-                identifier: identifier,
-                content: content,
-                trigger: nil // Deliver immediately
-            )
-            
-            UNUserNotificationCenter.current().add(request) { _ in
-                // Notification added
-            }
-        }
+
+        sendLocalNotification(
+            title: title,
+            body: body,
+            identifier: identifier,
+            interruptionLevel: .timeSensitive
+        )
     }
 }

bitchat/Services/PrivateChatManager.swift

@@ -105,7 +105,7 @@ final class PrivateChatManager: ObservableObject {
         // Create read receipt using the simplified method
         let receipt = ReadReceipt(
             originalMessageID: message.id,
-            readerID: meshService?.myPeerID.id ?? "",
+            readerID: meshService?.myPeerID ?? PeerID(str: ""),
             readerNickname: meshService?.myNickname ?? ""
         )
         

bitchat/Services/RelayController.swift

@@ -13,6 +13,7 @@ struct RelayController {
                        senderIsSelf: Bool,
                        isEncrypted: Bool,
                        isDirectedEncrypted: Bool,
+                       isFragment: Bool,
                        isDirectedFragment: Bool,
                        isHandshake: Bool,
                        isAnnounce: Bool,
@@ -36,6 +37,16 @@ struct RelayController {
             return RelayDecision(shouldRelay: true, newTTL: newTTL, delayMs: delayMs)
         }
 
+        if isFragment {
+            let ttlLimit = min(ttlCap, TransportConfig.bleFragmentRelayTtlCap)
+            guard ttlLimit > 1 else {
+                return RelayDecision(shouldRelay: false, newTTL: ttlLimit, delayMs: 0)
+            }
+            let newTTL = ttlLimit &- 1
+            let delayMs = Int.random(in: TransportConfig.bleFragmentRelayMinDelayMs...TransportConfig.bleFragmentRelayMaxDelayMs)
+            return RelayDecision(shouldRelay: true, newTTL: newTTL, delayMs: delayMs)
+        }
+
         // TTL clamping for broadcast
         // - Dense graphs: keep lower but still allow multi-hop bridging
         // - Announces get a bit more headroom

bitchat/Services/Transport.swift

@@ -45,6 +45,7 @@ protocol Transport: AnyObject {
 
     // Messaging
     func sendMessage(_ content: String, mentions: [String])
+    func sendMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date)
     func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String)
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID)
     func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
@@ -65,6 +66,10 @@ extension Transport {
     func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {}
     func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {}
     func cancelTransfer(_ transferId: String) {}
+
+    func sendMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
+        sendMessage(content, mentions: mentions)
+    }
 }
 
 protocol TransportPeerEventsDelegate: AnyObject {

bitchat/Services/TransportConfig.swift

@@ -8,6 +8,10 @@ enum TransportConfig {
     static let messageTTLDefault: UInt8 = 7                 // Default TTL for mesh flooding
     static let bleMaxInFlightAssemblies: Int = 128          // Cap concurrent fragment assemblies
     static let bleHighDegreeThreshold: Int = 6              // For adaptive TTL/probabilistic relays
+    static let bleMaxConcurrentTransfers: Int = 2           // Limit simultaneous large media sends
+    static let bleFragmentRelayMinDelayMs: Int = 8          // Faster forwarding for media fragments
+    static let bleFragmentRelayMaxDelayMs: Int = 25         // Upper jitter bound for fragment relays
+    static let bleFragmentRelayTtlCap: UInt8 = 5            // Clamp fragment TTL to contain floods
 
     // UI / Storage Caps
     static let privateChatCap: Int = 1337
@@ -66,6 +70,7 @@ enum TransportConfig {
     static let uiAnimationMediumSeconds: TimeInterval = 0.2
     static let uiAnimationSidebarSeconds: TimeInterval = 0.25
     static let uiRecentCutoffFiveMinutesSeconds: TimeInterval = 5 * 60
+    static let uiMeshEmptyConfirmationSeconds: TimeInterval = 30.0
 
     // BLE maintenance & thresholds
     static let bleMaintenanceInterval: TimeInterval = 5.0
@@ -145,6 +150,9 @@ enum TransportConfig {
 
     // Geo relay directory
     static let geoRelayFetchIntervalSeconds: TimeInterval = 60 * 60 * 24
+    static let geoRelayRefreshCheckIntervalSeconds: TimeInterval = 60 * 60
+    static let geoRelayRetryInitialSeconds: TimeInterval = 60
+    static let geoRelayRetryMaxSeconds: TimeInterval = 60 * 60
 
     // BLE operational delays
     static let bleInitialAnnounceDelaySeconds: TimeInterval = 0.6

bitchat/Sync/GossipSyncManager.swift

@@ -8,6 +8,55 @@ final class GossipSyncManager {
         func signPacketForBroadcast(_ packet: BitchatPacket) -> BitchatPacket
     }
 
+    private struct PacketStore {
+        private(set) var packets: [String: BitchatPacket] = [:]
+        private(set) var order: [String] = []
+
+        mutating func insert(idHex: String, packet: BitchatPacket, capacity: Int) {
+            guard capacity > 0 else { return }
+            if packets[idHex] != nil {
+                packets[idHex] = packet
+                return
+            }
+            packets[idHex] = packet
+            order.append(idHex)
+            while order.count > capacity {
+                let victim = order.removeFirst()
+                packets.removeValue(forKey: victim)
+            }
+        }
+
+        func allPackets(isFresh: (BitchatPacket) -> Bool) -> [BitchatPacket] {
+            order.compactMap { key in
+                guard let packet = packets[key], isFresh(packet) else { return nil }
+                return packet
+            }
+        }
+
+        mutating func remove(where shouldRemove: (BitchatPacket) -> Bool) {
+            var nextOrder: [String] = []
+            for key in order {
+                guard let packet = packets[key] else { continue }
+                if shouldRemove(packet) {
+                    packets.removeValue(forKey: key)
+                } else {
+                    nextOrder.append(key)
+                }
+            }
+            order = nextOrder
+        }
+
+        mutating func removeExpired(isFresh: (BitchatPacket) -> Bool) {
+            remove { !isFresh($0) }
+        }
+    }
+
+    private struct SyncSchedule {
+        let types: SyncTypeFlags
+        let interval: TimeInterval
+        var lastSent: Date
+    }
+
     struct Config {
         var seenCapacity: Int = 1000          // max packets per sync (cap across types)
         var gcsMaxBytes: Int = 400           // filter size budget (128..1024)
@@ -16,25 +65,43 @@ final class GossipSyncManager {
         var maintenanceIntervalSeconds: TimeInterval = 30.0
         var stalePeerCleanupIntervalSeconds: TimeInterval = 60.0
         var stalePeerTimeoutSeconds: TimeInterval = 60.0
+        var fragmentCapacity: Int = 600
+        var fileTransferCapacity: Int = 200
+        var fragmentSyncIntervalSeconds: TimeInterval = 30.0
+        var fileTransferSyncIntervalSeconds: TimeInterval = 60.0
+        var messageSyncIntervalSeconds: TimeInterval = 15.0
     }
 
     private let myPeerID: PeerID
     private let config: Config
     weak var delegate: Delegate?
 
-    // Storage: broadcast messages (ordered by insert), and latest announce per sender
-    private var messages: [String: BitchatPacket] = [:] // idHex -> packet
-    private var messageOrder: [String] = []
-    private var latestAnnouncementByPeer: [String: (id: String, packet: BitchatPacket)] = [:]
+    // Storage: broadcast packets by type, and latest announce per sender
+    private var messages = PacketStore()
+    private var fragments = PacketStore()
+    private var fileTransfers = PacketStore()
+    private var latestAnnouncementByPeer: [PeerID: (id: String, packet: BitchatPacket)] = [:]
 
     // Timer
     private var periodicTimer: DispatchSourceTimer?
     private let queue = DispatchQueue(label: "mesh.sync", qos: .utility)
     private var lastStalePeerCleanup: Date = .distantPast
+    private var syncSchedules: [SyncSchedule] = []
 
     init(myPeerID: PeerID, config: Config = Config()) {
         self.myPeerID = myPeerID
         self.config = config
+        var schedules: [SyncSchedule] = []
+        if config.seenCapacity > 0 && config.messageSyncIntervalSeconds > 0 {
+            schedules.append(SyncSchedule(types: .publicMessages, interval: config.messageSyncIntervalSeconds, lastSent: .distantPast))
+        }
+        if config.fragmentCapacity > 0 && config.fragmentSyncIntervalSeconds > 0 {
+            schedules.append(SyncSchedule(types: .fragment, interval: config.fragmentSyncIntervalSeconds, lastSent: .distantPast))
+        }
+        if config.fileTransferCapacity > 0 && config.fileTransferSyncIntervalSeconds > 0 {
+            schedules.append(SyncSchedule(types: .fileTransfer, interval: config.fileTransferSyncIntervalSeconds, lastSent: .distantPast))
+        }
+        syncSchedules = schedules
     }
 
     func start() {
@@ -55,7 +122,18 @@ final class GossipSyncManager {
 
     func scheduleInitialSyncToPeer(_ peerID: PeerID, delaySeconds: TimeInterval = 5.0) {
         queue.asyncAfter(deadline: .now() + delaySeconds) { [weak self] in
-            self?.sendRequestSync(to: peerID)
+            guard let self = self else { return }
+            self.sendRequestSync(to: peerID, types: .publicMessages)
+            if self.config.fragmentCapacity > 0 && self.config.fragmentSyncIntervalSeconds > 0 {
+                self.queue.asyncAfter(deadline: .now() + 0.5) { [weak self] in
+                    self?.sendRequestSync(to: peerID, types: .fragment)
+                }
+            }
+            if self.config.fileTransferCapacity > 0 && self.config.fileTransferSyncIntervalSeconds > 0 {
+                self.queue.asyncAfter(deadline: .now() + 1.0) { [weak self] in
+                    self?.sendRequestSync(to: peerID, types: .fileTransfer)
+                }
+            }
         }
     }
 
@@ -87,47 +165,45 @@ final class GossipSyncManager {
     }
 
     private func _onPublicPacketSeen(_ packet: BitchatPacket) {
-        let mt = MessageType(rawValue: packet.type)
+        guard let messageType = MessageType(rawValue: packet.type) else { return }
         let isBroadcastRecipient: Bool = {
             guard let r = packet.recipientID else { return true }
             return r.count == 8 && r.allSatisfy { $0 == 0xFF }
         }()
-        let isBroadcastMessage = (mt == .message && isBroadcastRecipient)
-        let isAnnounce = (mt == .announce)
-        guard isBroadcastMessage || isAnnounce else { return }
 
-        // Reject expired packets to prevent ghost peers and old messages
-        guard isPacketFresh(packet) else { return }
-
-        if isAnnounce {
+        switch messageType {
+        case .announce:
+            guard isPacketFresh(packet) else { return }
             guard isAnnouncementFresh(packet) else {
-                let sender = packet.senderID.hexEncodedString().lowercased()
-                removeState(forNormalizedPeerID: sender)
+                let sender = PeerID(hexData: packet.senderID)
+                removeState(for: sender)
                 return
             }
-        }
-
-        let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
-
-        if isBroadcastMessage {
-            if messages[idHex] == nil {
-                messages[idHex] = packet
-                messageOrder.append(idHex)
-                // Enforce capacity
-                let cap = max(1, config.seenCapacity)
-                while messageOrder.count > cap {
-                    let victim = messageOrder.removeFirst()
-                    messages.removeValue(forKey: victim)
-                }
-            }
-        } else if isAnnounce {
-            let sender = packet.senderID.hexEncodedString().lowercased()
+            let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
+            let sender = PeerID(hexData: packet.senderID)
             latestAnnouncementByPeer[sender] = (id: idHex, packet: packet)
+        case .message:
+            guard isBroadcastRecipient else { return }
+            guard isPacketFresh(packet) else { return }
+            let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
+            messages.insert(idHex: idHex, packet: packet, capacity: max(1, config.seenCapacity))
+        case .fragment:
+            guard isBroadcastRecipient else { return }
+            guard isPacketFresh(packet) else { return }
+            let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
+            fragments.insert(idHex: idHex, packet: packet, capacity: max(1, config.fragmentCapacity))
+        case .fileTransfer:
+            guard isBroadcastRecipient else { return }
+            guard isPacketFresh(packet) else { return }
+            let idHex = PacketIdUtil.computeId(packet).hexEncodedString()
+            fileTransfers.insert(idHex: idHex, packet: packet, capacity: max(1, config.fileTransferCapacity))
+        default:
+            break
         }
     }
 
-    private func sendRequestSync() {
-        let payload = buildGcsPayload()
+    private func sendRequestSync(for types: SyncTypeFlags) {
+        let payload = buildGcsPayload(for: types)
         let pkt = BitchatPacket(
             type: MessageType.requestSync.rawValue,
             senderID: Data(hexString: myPeerID.id) ?? Data(),
@@ -141,8 +217,8 @@ final class GossipSyncManager {
         delegate?.sendPacket(signed)
     }
 
-    private func sendRequestSync(to peerID: PeerID) {
-        let payload = buildGcsPayload()
+    private func sendRequestSync(to peerID: PeerID, types: SyncTypeFlags) {
+        let payload = buildGcsPayload(for: types)
         var recipient = Data()
         var temp = peerID.id
         while temp.count >= 2 && recipient.count < 8 {
@@ -170,6 +246,7 @@ final class GossipSyncManager {
     }
 
     private func _handleRequestSync(from peerID: PeerID, request: RequestSyncPacket) {
+        let requestedTypes = (request.types ?? .publicMessages)
         // Decode GCS into sorted set and prepare membership checker
         let sorted = GCSFilter.decodeToSortedSet(p: request.p, m: request.m, data: request.data)
         func mightContain(_ id: Data) -> Bool {
@@ -177,60 +254,100 @@ final class GossipSyncManager {
             return GCSFilter.contains(sortedValues: sorted, candidate: bucket)
         }
 
-        // 1) Announcements: send latest per peer if requester lacks them (and not expired)
-        for (_, pair) in latestAnnouncementByPeer {
-            let (idHex, pkt) = pair
-            guard isPacketFresh(pkt) else { continue }
-            let idBytes = Data(hexString: idHex) ?? Data()
-            if !mightContain(idBytes) {
-                var toSend = pkt
-                toSend.ttl = 0
-                delegate?.sendPacket(to: peerID, packet: toSend)
+        if requestedTypes.contains(.announce) {
+            for (_, pair) in latestAnnouncementByPeer {
+                let (idHex, pkt) = pair
+                guard isPacketFresh(pkt) else { continue }
+                let idBytes = Data(hexString: idHex) ?? Data()
+                if !mightContain(idBytes) {
+                    var toSend = pkt
+                    toSend.ttl = 0
+                    delegate?.sendPacket(to: peerID, packet: toSend)
+                }
             }
         }
 
-        // 2) Broadcast messages: send all missing (and not expired)
-        let toSendMsgs = messageOrder.compactMap { messages[$0] }
-        for pkt in toSendMsgs {
-            guard isPacketFresh(pkt) else { continue }
-            let idBytes = PacketIdUtil.computeId(pkt)
-            if !mightContain(idBytes) {
-                var toSend = pkt
-                toSend.ttl = 0
-                delegate?.sendPacket(to: peerID, packet: toSend)
+        if requestedTypes.contains(.message) {
+            let toSendMsgs = messages.allPackets(isFresh: isPacketFresh)
+            for pkt in toSendMsgs {
+                let idBytes = PacketIdUtil.computeId(pkt)
+                if !mightContain(idBytes) {
+                    var toSend = pkt
+                    toSend.ttl = 0
+                    delegate?.sendPacket(to: peerID, packet: toSend)
+                }
+            }
+        }
+
+        if requestedTypes.contains(.fragment) {
+            let frags = fragments.allPackets(isFresh: isPacketFresh)
+            for pkt in frags {
+                let idBytes = PacketIdUtil.computeId(pkt)
+                if !mightContain(idBytes) {
+                    var toSend = pkt
+                    toSend.ttl = 0
+                    delegate?.sendPacket(to: peerID, packet: toSend)
+                }
+            }
+        }
+
+        if requestedTypes.contains(.fileTransfer) {
+            let files = fileTransfers.allPackets(isFresh: isPacketFresh)
+            for pkt in files {
+                let idBytes = PacketIdUtil.computeId(pkt)
+                if !mightContain(idBytes) {
+                    var toSend = pkt
+                    toSend.ttl = 0
+                    delegate?.sendPacket(to: peerID, packet: toSend)
+                }
             }
         }
     }
 
     // Build REQUEST_SYNC payload using current candidates and GCS params
-    private func buildGcsPayload() -> Data {
-        // Collect candidates: latest announce per peer + broadcast messages (only fresh)
+    private func buildGcsPayload(for types: SyncTypeFlags) -> Data {
         var candidates: [BitchatPacket] = []
-        candidates.reserveCapacity(latestAnnouncementByPeer.count + messageOrder.count)
-        for (_, pair) in latestAnnouncementByPeer {
-            if isPacketFresh(pair.packet) {
+        if types.contains(.announce) {
+            for (_, pair) in latestAnnouncementByPeer where isPacketFresh(pair.packet) {
                 candidates.append(pair.packet)
             }
         }
-        for id in messageOrder {
-            if let p = messages[id], isPacketFresh(p) {
-                candidates.append(p)
-            }
+        if types.contains(.message) {
+            candidates.append(contentsOf: messages.allPackets(isFresh: isPacketFresh))
         }
+        if types.contains(.fragment) {
+            candidates.append(contentsOf: fragments.allPackets(isFresh: isPacketFresh))
+        }
+        if types.contains(.fileTransfer) {
+            candidates.append(contentsOf: fileTransfers.allPackets(isFresh: isPacketFresh))
+        }
+        if candidates.isEmpty {
+            let p = GCSFilter.deriveP(targetFpr: config.gcsTargetFpr)
+            let req = RequestSyncPacket(p: p, m: 1, data: Data(), types: types)
+            return req.encode()
+        }
+
         // Sort by timestamp desc
         candidates.sort { $0.timestamp > $1.timestamp }
 
         let p = GCSFilter.deriveP(targetFpr: config.gcsTargetFpr)
         let nMax = GCSFilter.estimateMaxElements(sizeBytes: config.gcsMaxBytes, p: p)
-        let cap = max(1, config.seenCapacity)
+        let cap: Int
+        if types == .fragment {
+            cap = max(1, config.fragmentCapacity)
+        } else if types == .fileTransfer {
+            cap = max(1, config.fileTransferCapacity)
+        } else {
+            cap = max(1, config.seenCapacity)
+        }
         let takeN = min(candidates.count, min(nMax, cap))
         if takeN <= 0 {
-            let req = RequestSyncPacket(p: p, m: 1, data: Data())
+            let req = RequestSyncPacket(p: p, m: 1, data: Data(), types: types)
             return req.encode()
         }
         let ids: [Data] = candidates.prefix(takeN).map { PacketIdUtil.computeId($0) }
         let params = GCSFilter.buildFilter(ids: ids, maxBytes: config.gcsMaxBytes, targetFpr: config.gcsTargetFpr)
-        let req = RequestSyncPacket(p: params.p, m: params.m, data: params.data)
+        let req = RequestSyncPacket(p: params.p, m: params.m, data: params.data, types: types)
         return req.encode()
     }
 
@@ -241,20 +358,21 @@ final class GossipSyncManager {
             isPacketFresh(pair.packet)
         }
 
-        // Remove expired messages
-        let expiredMessageIds = messages.compactMap { id, pkt in
-            isPacketFresh(pkt) ? nil : id
-        }
-        for id in expiredMessageIds {
-            messages.removeValue(forKey: id)
-            messageOrder.removeAll { $0 == id }
-        }
+        messages.removeExpired(isFresh: isPacketFresh)
+        fragments.removeExpired(isFresh: isPacketFresh)
+        fileTransfers.removeExpired(isFresh: isPacketFresh)
     }
 
     private func performPeriodicMaintenance(now: Date = Date()) {
         cleanupExpiredMessages()
         cleanupStaleAnnouncementsIfNeeded(now: now)
-        sendRequestSync()
+        for index in syncSchedules.indices {
+            guard syncSchedules[index].interval > 0 else { continue }
+            if syncSchedules[index].lastSent == .distantPast || now.timeIntervalSince(syncSchedules[index].lastSent) >= syncSchedules[index].interval {
+                syncSchedules[index].lastSent = now
+                sendRequestSync(for: syncSchedules[index].types)
+            }
+        }
     }
 
     private func cleanupStaleAnnouncementsIfNeeded(now: Date) {
@@ -270,40 +388,27 @@ final class GossipSyncManager {
         let nowMs = UInt64(now.timeIntervalSince1970 * 1000)
         guard nowMs >= timeoutMs else { return }
         let cutoff = nowMs - timeoutMs
-        let stalePeerIDs = latestAnnouncementByPeer.compactMap { (peerHex, pair) -> String? in
-            pair.packet.timestamp < cutoff ? peerHex.lowercased() : nil
+        let stalePeerIDs = latestAnnouncementByPeer.compactMap { peerID, pair in
+            pair.packet.timestamp < cutoff ? peerID : nil
         }
         guard !stalePeerIDs.isEmpty else { return }
         for peerKey in stalePeerIDs {
-            removeState(forNormalizedPeerID: peerKey)
+            removeState(for: peerKey)
         }
     }
 
     // Explicit removal hook for LEAVE/stale peer
     func removeAnnouncementForPeer(_ peerID: PeerID) {
         queue.async { [weak self] in
-            self?._removeAnnouncementForPeer(peerID)
+            self?.removeState(for: peerID)
         }
     }
 
-    private func _removeAnnouncementForPeer(_ peerID: PeerID) {
-        let normalizedPeerID = peerID.id.lowercased()
-        removeState(forNormalizedPeerID: normalizedPeerID)
-    }
-
-    private func removeState(forNormalizedPeerID normalizedPeerID: String) {
-        _ = latestAnnouncementByPeer.removeValue(forKey: normalizedPeerID)
-        // Remove messages from this peer
-        // Collect IDs to remove first to avoid concurrent modification
-        let messageIdsToRemove = messages.compactMap { (id, message) -> String? in
-            message.senderID.hexEncodedString().lowercased() == normalizedPeerID ? id : nil
-        }
-        
-        // Remove messages and update messageOrder
-        for id in messageIdsToRemove {
-            messages.removeValue(forKey: id)
-            messageOrder.removeAll { $0 == id }
-        }
+    private func removeState(for peerID: PeerID) {
+        _ = latestAnnouncementByPeer.removeValue(forKey: peerID)
+        messages.remove { PeerID(hexData: $0.senderID) == peerID }
+        fragments.remove { PeerID(hexData: $0.senderID) == peerID }
+        fileTransfers.remove { PeerID(hexData: $0.senderID) == peerID }
     }
 }
 
@@ -317,13 +422,13 @@ extension GossipSyncManager {
 
     func _hasAnnouncement(for peerID: PeerID) -> Bool {
         queue.sync {
-            latestAnnouncementByPeer[peerID.id.lowercased()] != nil
+            latestAnnouncementByPeer[peerID] != nil
         }
     }
 
     func _messageCount(for peerID: PeerID) -> Int {
         queue.sync {
-            messages.values.filter { $0.senderID.hexEncodedString().lowercased() == peerID.id.lowercased() }.count
+            messages.allPackets { _ in true }.filter { PeerID(hexData: $0.senderID) == peerID }.count
         }
     }
 }

bitchat/Sync/SyncTypeFlags.swift

@@ -0,0 +1,104 @@
+import Foundation
+
+/// Bitfield describing which message types are covered by a REQUEST_SYNC round.
+/// Matches the Android mapping (bit index -> message type).
+struct SyncTypeFlags: OptionSet {
+    let rawValue: UInt64
+
+    init(rawValue: UInt64) {
+        self.rawValue = rawValue & 0x00FF_FFFF_FFFF_FFFF // Trim to max 8 bytes
+    }
+
+    private static func bitIndex(for type: MessageType) -> Int? {
+        switch type {
+        case .announce: return 0
+        case .message: return 1
+        case .leave: return 2
+        case .noiseHandshake: return 3
+        case .noiseEncrypted: return 4
+        case .fragment: return 5
+        case .requestSync: return 6
+        case .fileTransfer: return 7
+        }
+    }
+
+    private static func type(forBit index: Int) -> MessageType? {
+        switch index {
+        case 0: return .announce
+        case 1: return .message
+        case 2: return .leave
+        case 3: return .noiseHandshake
+        case 4: return .noiseEncrypted
+        case 5: return .fragment
+        case 6: return .requestSync
+        case 7: return .fileTransfer
+        default:
+            return nil
+        }
+    }
+
+    static let announce = SyncTypeFlags(messageTypes: [.announce])
+    static let message = SyncTypeFlags(messageTypes: [.message])
+    static let fragment = SyncTypeFlags(messageTypes: [.fragment])
+    static let fileTransfer = SyncTypeFlags(messageTypes: [.fileTransfer])
+
+    static let publicMessages = SyncTypeFlags(messageTypes: [.announce, .message])
+
+    init(messageTypes: [MessageType]) {
+        var raw: UInt64 = 0
+        for type in messageTypes {
+            guard let bit = SyncTypeFlags.bitIndex(for: type) else { continue }
+            raw |= (1 << UInt64(bit))
+        }
+        self.init(rawValue: raw)
+    }
+
+    func contains(_ type: MessageType) -> Bool {
+        guard let bit = SyncTypeFlags.bitIndex(for: type) else { return false }
+        return contains(SyncTypeFlags(rawValue: 1 << UInt64(bit)))
+    }
+
+    func union(_ other: SyncTypeFlags) -> SyncTypeFlags {
+        SyncTypeFlags(rawValue: rawValue | other.rawValue)
+    }
+
+    func intersection(_ other: SyncTypeFlags) -> SyncTypeFlags {
+        SyncTypeFlags(rawValue: rawValue & other.rawValue)
+    }
+
+    func toMessageTypes() -> [MessageType] {
+        guard rawValue != 0 else { return [] }
+        var types: [MessageType] = []
+        for bit in 0..<64 {
+            guard (rawValue & (1 << UInt64(bit))) != 0 else { continue }
+            if let type = SyncTypeFlags.type(forBit: bit) {
+                types.append(type)
+            }
+        }
+        return types
+    }
+
+    func toData() -> Data? {
+        guard rawValue != 0 else { return nil }
+        var value = rawValue
+        var bytes: [UInt8] = []
+        while value > 0 && bytes.count < 8 {
+            bytes.append(UInt8(value & 0xFF))
+            value >>= 8
+        }
+        while let last = bytes.last, last == 0 {
+            bytes.removeLast()
+        }
+        guard !bytes.isEmpty, bytes.count <= 8 else { return nil }
+        return Data(bytes)
+    }
+
+    static func decode(_ data: Data) -> SyncTypeFlags? {
+        guard (1...8).contains(data.count) else { return nil }
+        var raw: UInt64 = 0
+        for (index, byte) in data.enumerated() {
+            raw |= UInt64(byte) << UInt64(index * 8)
+        }
+        return SyncTypeFlags(rawValue: raw)
+    }
+}

bitchat/Utils/CompressionUtil.swift

@@ -61,15 +61,13 @@ struct CompressionUtil {
         // 1. Data is too small
         // 2. Data appears to be already compressed (high entropy)
         guard data.count >= compressionThreshold else { return false }
-        
-        // Simple entropy check - count unique bytes
-        var byteFrequency = [UInt8: Int]()
-        for byte in data {
-            byteFrequency[byte, default: 0] += 1
-        }
-        
-        // If we have very high byte diversity, data is likely already compressed
-        let uniqueByteRatio = Double(byteFrequency.count) / Double(min(data.count, 256))
+
+        // Quick uniqueness check — a high diversity of bytes usually means the
+        // payload is already compressed. We only need to know how many unique
+        // values exist rather than keeping full frequency counts.
+        let uniqueByteCount = Set(data).count
+        let sampleSize = min(data.count, 256)
+        let uniqueByteRatio = Double(uniqueByteCount) / Double(sampleSize)
         return uniqueByteRatio < 0.9 // Compress if less than 90% unique bytes
     }
 }

bitchat/Utils/FileTransferLimits.swift

@@ -5,9 +5,9 @@ enum FileTransferLimits {
     /// Absolute ceiling enforced for any file payload (voice, image, other).
     static let maxPayloadBytes: Int = 1 * 1024 * 1024 // 1 MiB
     /// Voice notes stay small for low-latency relays.
-    static let maxVoiceNoteBytes: Int = 1 * 1024 * 1024 // 1 MiB
+    static let maxVoiceNoteBytes: Int = 512 * 1024 // 512 KiB
     /// Compressed images after downscaling should comfortably fit under this budget.
-    static let maxImageBytes: Int = 1 * 1024 * 1024 // 1 MiB
+    static let maxImageBytes: Int = 512 * 1024 // 512 KiB
     /// Worst-case size once TLV metadata and binary packet framing are included for the largest payloads.
     static let maxFramedFileBytes: Int = {
         let maxMetadataBytes = Int(UInt16.max) * 2 // fileName + mimeType TLVs

bitchat/Utils/InputValidator.swift

@@ -1,4 +1,5 @@
 import Foundation
+import BitLogger
 
 /// Comprehensive input validation for BitChat protocol
 /// Prevents injection attacks, buffer overflows, and malformed data
@@ -16,29 +17,28 @@ struct InputValidator {
     // MARK: - String Content Validation
     
     /// Validates and sanitizes user-provided strings used in UI
+    ///
+    /// Rejects strings containing control characters to prevent potential security issues
+    /// and UI rendering problems. This strict approach ensures data integrity at input time.
     static func validateUserString(_ string: String, maxLength: Int) -> String? {
-        // Check empty
-        guard !string.isEmpty else { return nil }
-
-        // Trim whitespace
         let trimmed = string.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !trimmed.isEmpty else { return nil }
-
-        // Check length
         guard trimmed.count <= maxLength else { return nil }
 
-        // Remove control characters
+        // Reject control characters outright instead of rewriting the string.
+        // This prevents injection attacks and ensures consistent UI rendering.
         let controlChars = CharacterSet.controlCharacters
-        let cleaned = trimmed.components(separatedBy: controlChars).joined()
-        
-        // Ensure valid UTF-8 (should already be, but double-check)
-        guard cleaned.data(using: .utf8) != nil else { return nil }
-        
-        // Prevent zero-width characters and other invisible unicode
-        let invisibleChars = CharacterSet(charactersIn: "\u{200B}\u{200C}\u{200D}\u{FEFF}")
-        let visible = cleaned.components(separatedBy: invisibleChars).joined()
-        
-        return visible.isEmpty ? nil : visible
+        if !trimmed.unicodeScalars.allSatisfy({ !controlChars.contains($0) }) {
+            // Log rejection for monitoring, without exposing actual content for privacy
+            let controlCharCount = trimmed.unicodeScalars.filter { controlChars.contains($0) }.count
+            SecureLogger.debug(
+                "Input validation rejected string (length: \(trimmed.count), control chars: \(controlCharCount))",
+                category: .security
+            )
+            return nil
+        }
+
+        return trimmed
     }
     
     /// Validates nickname

bitchat/ViewModels/GeoChannelCoordinator.swift

@@ -0,0 +1,118 @@
+//
+// GeoChannelCoordinator.swift
+// bitchat
+//
+// Centralizes Combine wiring for location channel selection and sampling.
+//
+
+import Combine
+import Foundation
+import Tor
+
+@MainActor
+final class GeoChannelCoordinator {
+    private let locationManager: LocationChannelManager
+    private let bookmarksStore: GeohashBookmarksStore
+    private let torManager: TorManager
+
+    private let onChannelSwitch: (ChannelID) -> Void
+    private let beginSampling: ([String]) -> Void
+    private let endSampling: () -> Void
+
+    private var cancellables = Set<AnyCancellable>()
+    private var regionalGeohashes: [String] = []
+    private var bookmarkedGeohashes: [String] = []
+
+    init(
+        locationManager: LocationChannelManager? = nil,
+        bookmarksStore: GeohashBookmarksStore? = nil,
+        torManager: TorManager? = nil,
+        onChannelSwitch: @escaping (ChannelID) -> Void,
+        beginSampling: @escaping ([String]) -> Void,
+        endSampling: @escaping () -> Void
+    ) {
+        self.locationManager = locationManager ?? Self.defaultLocationManager()
+        self.bookmarksStore = bookmarksStore ?? GeohashBookmarksStore.shared
+        self.torManager = torManager ?? Self.defaultTorManager()
+        self.onChannelSwitch = onChannelSwitch
+        self.beginSampling = beginSampling
+        self.endSampling = endSampling
+
+        start()
+    }
+
+    func start() {
+        regionalGeohashes = locationManager.availableChannels.map { $0.geohash }
+        bookmarkedGeohashes = bookmarksStore.bookmarks
+
+        locationManager.$selectedChannel
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] channel in
+                guard let self else { return }
+                Task { @MainActor in
+                    self.onChannelSwitch(channel)
+                }
+            }
+            .store(in: &cancellables)
+
+        locationManager.$availableChannels
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] channels in
+                guard let self else { return }
+                self.regionalGeohashes = channels.map { $0.geohash }
+                self.updateSampling()
+            }
+            .store(in: &cancellables)
+
+        bookmarksStore.$bookmarks
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] bookmarks in
+                guard let self else { return }
+                self.bookmarkedGeohashes = bookmarks
+                self.updateSampling()
+            }
+            .store(in: &cancellables)
+
+        locationManager.$permissionState
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] state in
+                guard let self, state == .authorized else { return }
+                Task { @MainActor [weak self] in
+                    self?.locationManager.refreshChannels()
+                }
+            }
+            .store(in: &cancellables)
+
+        Task { @MainActor in
+            self.onChannelSwitch(self.locationManager.selectedChannel)
+        }
+        updateSampling()
+    }
+
+    private func updateSampling() {
+        let union = Array(Set(regionalGeohashes).union(bookmarkedGeohashes))
+        Task { @MainActor in
+            guard !union.isEmpty else {
+                endSampling()
+                return
+            }
+            if torManager.isForeground() {
+                beginSampling(union)
+            } else {
+                endSampling()
+            }
+        }
+    }
+
+    func refreshSampling() {
+        updateSampling()
+    }
+    private static func defaultLocationManager() -> LocationChannelManager {
+        LocationChannelManager.shared
+    }
+
+    @MainActor
+    private static func defaultTorManager() -> TorManager {
+        TorManager.shared
+    }
+}

bitchat/ViewModels/MessageRateLimiter.swift

@@ -0,0 +1,77 @@
+//
+// MessageRateLimiter.swift
+// bitchat
+//
+// Handles per-sender and per-content token buckets for public message intake.
+//
+
+import Foundation
+
+struct MessageRateLimiter {
+    private struct TokenBucket {
+        var capacity: Double
+        var tokens: Double
+        var refillPerSec: Double
+        var lastRefill: Date
+
+        mutating func allow(cost: Double = 1.0, now: Date = Date()) -> Bool {
+            let dt = now.timeIntervalSince(lastRefill)
+            if dt > 0 {
+                tokens = min(capacity, tokens + dt * refillPerSec)
+                lastRefill = now
+            }
+            if tokens >= cost {
+                tokens -= cost
+                return true
+            }
+            return false
+        }
+    }
+
+    private var senderBuckets: [String: TokenBucket] = [:]
+    private var contentBuckets: [String: TokenBucket] = [:]
+
+    private let senderCapacity: Double
+    private let senderRefill: Double
+    private let contentCapacity: Double
+    private let contentRefill: Double
+
+    init(
+        senderCapacity: Double,
+        senderRefillPerSec: Double,
+        contentCapacity: Double,
+        contentRefillPerSec: Double
+    ) {
+        self.senderCapacity = senderCapacity
+        self.senderRefill = senderRefillPerSec
+        self.contentCapacity = contentCapacity
+        self.contentRefill = contentRefillPerSec
+    }
+
+    mutating func allow(senderKey: String, contentKey: String, now: Date = Date()) -> Bool {
+        var senderBucket = senderBuckets[senderKey] ?? TokenBucket(
+            capacity: senderCapacity,
+            tokens: senderCapacity,
+            refillPerSec: senderRefill,
+            lastRefill: now
+        )
+        let senderAllowed = senderBucket.allow(now: now)
+        senderBuckets[senderKey] = senderBucket
+
+        var contentBucket = contentBuckets[contentKey] ?? TokenBucket(
+            capacity: contentCapacity,
+            tokens: contentCapacity,
+            refillPerSec: contentRefill,
+            lastRefill: now
+        )
+        let contentAllowed = contentBucket.allow(now: now)
+        contentBuckets[contentKey] = contentBucket
+
+        return senderAllowed && contentAllowed
+    }
+
+    mutating func reset() {
+        senderBuckets.removeAll()
+        contentBuckets.removeAll()
+    }
+}

bitchat/ViewModels/MinimalDistancePalette.swift

@@ -0,0 +1,210 @@
+//
+// MinimalDistancePalette.swift
+// bitchat
+//
+// Lightweight palette generator that keeps peer colors evenly spaced.
+//
+
+import Foundation
+import SwiftUI
+
+final class MinimalDistancePalette {
+    struct Config {
+        let slotCount: Int
+        let avoidCenterHue: Double
+        let avoidHueDelta: Double
+        let saturationLight: Double
+        let saturationDark: Double
+        let baseBrightnessLight: Double
+        let baseBrightnessDark: Double
+        let ringBrightnessDeltaLight: Double
+        let ringBrightnessDeltaDark: Double
+        let preferredBiasWeight: Double
+        let goldenStep: Int
+
+        init(
+            slotCount: Int,
+            avoidCenterHue: Double,
+            avoidHueDelta: Double,
+            saturationLight: Double,
+            saturationDark: Double,
+            baseBrightnessLight: Double,
+            baseBrightnessDark: Double,
+            ringBrightnessDeltaLight: Double,
+            ringBrightnessDeltaDark: Double,
+            preferredBiasWeight: Double = 0.05,
+            goldenStep: Int = 7
+        ) {
+            self.slotCount = slotCount
+            self.avoidCenterHue = avoidCenterHue
+            self.avoidHueDelta = avoidHueDelta
+            self.saturationLight = saturationLight
+            self.saturationDark = saturationDark
+            self.baseBrightnessLight = baseBrightnessLight
+            self.baseBrightnessDark = baseBrightnessDark
+            self.ringBrightnessDeltaLight = ringBrightnessDeltaLight
+            self.ringBrightnessDeltaDark = ringBrightnessDeltaDark
+            self.preferredBiasWeight = preferredBiasWeight
+            self.goldenStep = goldenStep
+        }
+    }
+
+    private struct Entry {
+        let slot: Int
+        let ring: Int
+        let hue: Double
+    }
+
+    private let config: Config
+    private var currentSeeds: [String: String] = [:]
+    private var entries: [String: Entry] = [:]
+    private var previousEntries: [String: Entry] = [:]
+
+    init(config: Config) {
+        self.config = config
+    }
+
+    @MainActor
+    func ensurePalette(for seeds: [String: String]) {
+        guard seeds != currentSeeds || entries.count != seeds.count else { return }
+        previousEntries = entries
+        currentSeeds = seeds
+        rebuildEntries()
+    }
+
+    @MainActor
+    func color(for identifier: String, isDark: Bool) -> Color? {
+        guard let entry = entries[identifier] else { return nil }
+        let saturation = isDark ? config.saturationDark : config.saturationLight
+        let baseBrightness = isDark ? config.baseBrightnessDark : config.baseBrightnessLight
+        let ringDelta = isDark ? config.ringBrightnessDeltaDark : config.ringBrightnessDeltaLight
+        let brightness = min(1.0, max(0.0, baseBrightness + ringDelta * Double(entry.ring)))
+        return Color(hue: entry.hue, saturation: saturation, brightness: brightness)
+    }
+
+    @MainActor
+    func reset() {
+        currentSeeds.removeAll()
+        entries.removeAll()
+        previousEntries.removeAll()
+    }
+
+    @MainActor
+    private func rebuildEntries() {
+        guard !currentSeeds.isEmpty else {
+            entries.removeAll()
+            return
+        }
+
+        let slotCount = max(8, config.slotCount)
+        var slots: [Double] = []
+        for idx in 0..<slotCount {
+            let hue = Double(idx) / Double(slotCount)
+            if abs(hue - config.avoidCenterHue) < config.avoidHueDelta {
+                continue
+            }
+            slots.append(hue)
+        }
+        if slots.isEmpty {
+            for idx in 0..<slotCount {
+                slots.append(Double(idx) / Double(slotCount))
+            }
+        }
+
+        func circularDistance(_ a: Double, _ b: Double) -> Double {
+            let diff = abs(a - b)
+            return diff > 0.5 ? 1.0 - diff : diff
+        }
+
+        let peerIDs = currentSeeds.keys.sorted()
+        let preferredIndex: [String: Int] = Dictionary(uniqueKeysWithValues: peerIDs.map { id in
+            let seed = currentSeeds[id] ?? id
+            let hash = seed.djb2()
+            let index = Int(hash % UInt64(slots.count))
+            return (id, index)
+        })
+
+        var mapping: [String: Entry] = [:]
+        var usedSlots = Set<Int>()
+        var usedHues: [Double] = []
+
+        let prior = entries.isEmpty ? previousEntries : entries
+        for (id, entry) in prior {
+            guard currentSeeds.keys.contains(id), entry.slot < slots.count else { continue }
+            let hue = slots[entry.slot]
+            mapping[id] = Entry(slot: entry.slot, ring: entry.ring, hue: hue)
+            usedSlots.insert(entry.slot)
+            usedHues.append(hue)
+        }
+
+        let unassigned = peerIDs.filter { mapping[$0] == nil }
+        for id in unassigned {
+            let preferred = preferredIndex[id] ?? 0
+            if !usedSlots.contains(preferred), preferred < slots.count {
+                let hue = slots[preferred]
+                mapping[id] = Entry(slot: preferred, ring: 0, hue: hue)
+                usedSlots.insert(preferred)
+                usedHues.append(hue)
+                continue
+            }
+
+            var bestSlot: Int?
+            var bestScore = -Double.infinity
+            for slot in 0..<slots.count where !usedSlots.contains(slot) {
+                let hue = slots[slot]
+                let minDistance = usedHues.isEmpty ? 1.0 : usedHues.map { circularDistance(hue, $0) }.min() ?? 1.0
+                let bias = 1.0 - (Double((abs(slot - (preferredIndex[id] ?? 0)) % slots.count)) / Double(slots.count))
+                let score = minDistance + config.preferredBiasWeight * bias
+                if score > bestScore {
+                    bestScore = score
+                    bestSlot = slot
+                }
+            }
+
+            if let slot = bestSlot {
+                let hue = slots[slot]
+                mapping[id] = Entry(slot: slot, ring: 0, hue: hue)
+                usedSlots.insert(slot)
+                usedHues.append(hue)
+            }
+        }
+
+        let remaining = peerIDs.filter { mapping[$0] == nil }
+        if !remaining.isEmpty {
+            for (index, id) in remaining.enumerated() {
+                let preferred = preferredIndex[id] ?? 0
+                let slot = (preferred + index * config.goldenStep) % slots.count
+                let hue = slots[slot]
+                mapping[id] = Entry(slot: slot, ring: 1, hue: hue)
+            }
+        }
+
+        entries = mapping
+    }
+}
+
+extension MinimalDistancePalette.Config {
+    static let mesh = MinimalDistancePalette.Config(
+        slotCount: TransportConfig.uiPeerPaletteSlots,
+        avoidCenterHue: 30.0 / 360.0,
+        avoidHueDelta: TransportConfig.uiColorHueAvoidanceDelta,
+        saturationLight: 0.70,
+        saturationDark: 0.80,
+        baseBrightnessLight: 0.45,
+        baseBrightnessDark: 0.75,
+        ringBrightnessDeltaLight: TransportConfig.uiPeerPaletteRingBrightnessDeltaLight,
+        ringBrightnessDeltaDark: TransportConfig.uiPeerPaletteRingBrightnessDeltaDark
+    )
+
+    static let nostr = MinimalDistancePalette.Config(
+        slotCount: TransportConfig.uiPeerPaletteSlots,
+        avoidCenterHue: 30.0 / 360.0,
+        avoidHueDelta: TransportConfig.uiColorHueAvoidanceDelta,
+        saturationLight: 0.70,
+        saturationDark: 0.80,
+        baseBrightnessLight: 0.45,
+        baseBrightnessDark: 0.75,
+        ringBrightnessDeltaLight: TransportConfig.uiPeerPaletteRingBrightnessDeltaLight,
+        ringBrightnessDeltaDark: TransportConfig.uiPeerPaletteRingBrightnessDeltaDark
+    )
+}

bitchat/ViewModels/PublicMessagePipeline.swift

@@ -0,0 +1,190 @@
+//
+// PublicMessagePipeline.swift
+// bitchat
+//
+// Handles batching and deduplication of public chat messages before surfacing them to the UI.
+//
+
+import Foundation
+
+@MainActor
+protocol PublicMessagePipelineDelegate: AnyObject {
+    func pipelineCurrentMessages(_ pipeline: PublicMessagePipeline) -> [BitchatMessage]
+    func pipeline(_ pipeline: PublicMessagePipeline, setMessages messages: [BitchatMessage])
+    func pipeline(_ pipeline: PublicMessagePipeline, normalizeContent content: String) -> String
+    func pipeline(_ pipeline: PublicMessagePipeline, contentTimestampForKey key: String) -> Date?
+    func pipeline(_ pipeline: PublicMessagePipeline, recordContentKey key: String, timestamp: Date)
+    func pipelineTrimMessages(_ pipeline: PublicMessagePipeline)
+    func pipelinePrewarmMessage(_ pipeline: PublicMessagePipeline, message: BitchatMessage)
+    func pipelineSetBatchingState(_ pipeline: PublicMessagePipeline, isBatching: Bool)
+}
+
+@MainActor
+final class PublicMessagePipeline {
+    weak var delegate: PublicMessagePipelineDelegate?
+
+    private var buffer: [BitchatMessage] = []
+    private var timer: Timer?
+    private let baseFlushInterval: TimeInterval
+    private var dynamicFlushInterval: TimeInterval
+    private var recentBatchSizes: [Int] = []
+    private let maxRecentBatchSamples: Int
+    private let dedupWindow: TimeInterval
+    private var activeChannel: ChannelID = .mesh
+
+    init(
+        baseFlushInterval: TimeInterval = TransportConfig.basePublicFlushInterval,
+        maxRecentBatchSamples: Int = 10,
+        dedupWindow: TimeInterval = 1.0
+    ) {
+        self.baseFlushInterval = baseFlushInterval
+        self.dynamicFlushInterval = baseFlushInterval
+        self.maxRecentBatchSamples = maxRecentBatchSamples
+        self.dedupWindow = dedupWindow
+    }
+
+    deinit {
+        timer?.invalidate()
+    }
+
+    func updateActiveChannel(_ channel: ChannelID) {
+        activeChannel = channel
+    }
+
+    func enqueue(_ message: BitchatMessage) {
+        buffer.append(message)
+        scheduleFlush()
+    }
+
+    func flushIfNeeded() {
+        flushBuffer()
+    }
+
+    func reset() {
+        timer?.invalidate()
+        timer = nil
+        buffer.removeAll(keepingCapacity: false)
+    }
+
+}
+
+private extension PublicMessagePipeline {
+    func scheduleFlush() {
+        guard timer == nil else { return }
+        timer = Timer.scheduledTimer(withTimeInterval: dynamicFlushInterval, repeats: false) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.flushBuffer()
+            }
+        }
+    }
+
+    func flushBuffer() {
+        timer?.invalidate()
+        timer = nil
+        guard !buffer.isEmpty else { return }
+        guard let delegate = delegate else {
+            buffer.removeAll(keepingCapacity: false)
+            return
+        }
+
+        delegate.pipelineSetBatchingState(self, isBatching: true)
+
+        var existingIDs = Set(delegate.pipelineCurrentMessages(self).map { $0.id })
+        var pending: [(message: BitchatMessage, contentKey: String)] = []
+        var batchContentLatest: [String: Date] = [:]
+
+        for message in buffer {
+            if existingIDs.contains(message.id) { continue }
+            let contentKey = delegate.pipeline(self, normalizeContent: message.content)
+            if let ts = delegate.pipeline(self, contentTimestampForKey: contentKey),
+               abs(ts.timeIntervalSince(message.timestamp)) < dedupWindow {
+                continue
+            }
+            if let ts = batchContentLatest[contentKey],
+               abs(ts.timeIntervalSince(message.timestamp)) < dedupWindow {
+                continue
+            }
+            existingIDs.insert(message.id)
+            pending.append((message, contentKey))
+            batchContentLatest[contentKey] = message.timestamp
+        }
+
+        buffer.removeAll(keepingCapacity: true)
+        guard !pending.isEmpty else {
+            delegate.pipelineSetBatchingState(self, isBatching: false)
+            if !buffer.isEmpty { scheduleFlush() }
+            return
+        }
+
+        pending.sort { $0.message.timestamp < $1.message.timestamp }
+
+        var messages = delegate.pipelineCurrentMessages(self)
+        let threshold = lateInsertThreshold(for: activeChannel)
+        let lastTimestamp = messages.last?.timestamp ?? .distantPast
+
+        for item in pending {
+            let message = item.message
+            if threshold == 0 || message.timestamp < lastTimestamp.addingTimeInterval(-threshold) {
+                let index = insertionIndex(for: message.timestamp, in: messages)
+                if index >= messages.count {
+                    messages.append(message)
+                } else {
+                    messages.insert(message, at: index)
+                }
+            } else {
+                messages.append(message)
+            }
+            delegate.pipeline(self, recordContentKey: item.contentKey, timestamp: message.timestamp)
+        }
+
+        delegate.pipeline(self, setMessages: messages)
+        delegate.pipelineTrimMessages(self)
+
+        updateFlushInterval(withBatchSize: pending.count)
+
+        for item in pending {
+            delegate.pipelinePrewarmMessage(self, message: item.message)
+        }
+
+        delegate.pipelineSetBatchingState(self, isBatching: false)
+
+        if !buffer.isEmpty {
+            scheduleFlush()
+        }
+    }
+
+    func updateFlushInterval(withBatchSize size: Int) {
+        recentBatchSizes.append(size)
+        if recentBatchSizes.count > maxRecentBatchSamples {
+            recentBatchSizes.removeFirst(recentBatchSizes.count - maxRecentBatchSamples)
+        }
+        let avg = recentBatchSizes.isEmpty
+            ? 0.0
+            : Double(recentBatchSizes.reduce(0, +)) / Double(recentBatchSizes.count)
+        dynamicFlushInterval = avg > 100.0 ? 0.12 : baseFlushInterval
+    }
+
+    func lateInsertThreshold(for channel: ChannelID) -> TimeInterval {
+        switch channel {
+        case .mesh:
+            return TransportConfig.uiLateInsertThreshold
+        case .location:
+            return TransportConfig.uiLateInsertThresholdGeo
+        }
+    }
+
+    func insertionIndex(for timestamp: Date, in messages: [BitchatMessage]) -> Int {
+        var low = 0
+        var high = messages.count
+        while low < high {
+            let mid = (low + high) / 2
+            if messages[mid].timestamp < timestamp {
+                low = mid + 1
+            } else {
+                high = mid
+            }
+        }
+        return low
+    }
+}

bitchat/ViewModels/PublicTimelineStore.swift

@@ -0,0 +1,124 @@
+//
+// PublicTimelineStore.swift
+// bitchat
+//
+// Maintains mesh and geohash public timelines with simple caps and helpers.
+//
+
+import Foundation
+
+struct PublicTimelineStore {
+    private var meshTimeline: [BitchatMessage] = []
+    private var geohashTimelines: [String: [BitchatMessage]] = [:]
+    private var pendingGeohashSystemMessages: [String] = []
+
+    private let meshCap: Int
+    private let geohashCap: Int
+
+    init(meshCap: Int, geohashCap: Int) {
+        self.meshCap = meshCap
+        self.geohashCap = geohashCap
+    }
+
+    mutating func append(_ message: BitchatMessage, to channel: ChannelID) {
+        switch channel {
+        case .mesh:
+            guard !meshTimeline.contains(where: { $0.id == message.id }) else { return }
+            meshTimeline.append(message)
+            trimMeshTimelineIfNeeded()
+        case .location(let channel):
+            append(message, toGeohash: channel.geohash)
+        }
+    }
+
+    mutating func append(_ message: BitchatMessage, toGeohash geohash: String) {
+        var timeline = geohashTimelines[geohash] ?? []
+        guard !timeline.contains(where: { $0.id == message.id }) else { return }
+        timeline.append(message)
+        trimGeohashTimelineIfNeeded(&timeline)
+        geohashTimelines[geohash] = timeline
+    }
+
+    /// Append message if absent, returning true when stored.
+    mutating func appendIfAbsent(_ message: BitchatMessage, toGeohash geohash: String) -> Bool {
+        var timeline = geohashTimelines[geohash] ?? []
+        guard !timeline.contains(where: { $0.id == message.id }) else { return false }
+        timeline.append(message)
+        trimGeohashTimelineIfNeeded(&timeline)
+        geohashTimelines[geohash] = timeline
+        return true
+    }
+
+    mutating func messages(for channel: ChannelID) -> [BitchatMessage] {
+        switch channel {
+        case .mesh:
+            return meshTimeline
+        case .location(let channel):
+            let cleaned = geohashTimelines[channel.geohash]?.cleanedAndDeduped() ?? []
+            geohashTimelines[channel.geohash] = cleaned
+            return cleaned
+        }
+    }
+
+    mutating func clear(channel: ChannelID) {
+        switch channel {
+        case .mesh:
+            meshTimeline.removeAll()
+        case .location(let channel):
+            geohashTimelines[channel.geohash] = []
+        }
+    }
+
+    @discardableResult
+    mutating func removeMessage(withID id: String) -> BitchatMessage? {
+        if let index = meshTimeline.firstIndex(where: { $0.id == id }) {
+            return meshTimeline.remove(at: index)
+        }
+
+        for key in Array(geohashTimelines.keys) {
+            var timeline = geohashTimelines[key] ?? []
+            if let index = timeline.firstIndex(where: { $0.id == id }) {
+                let removed = timeline.remove(at: index)
+                geohashTimelines[key] = timeline.isEmpty ? nil : timeline
+                return removed
+            }
+        }
+
+        return nil
+    }
+
+    mutating func removeMessages(in geohash: String, where predicate: (BitchatMessage) -> Bool) {
+        var timeline = geohashTimelines[geohash] ?? []
+        timeline.removeAll(where: predicate)
+        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+    }
+
+    mutating func mutateGeohash(_ geohash: String, _ transform: (inout [BitchatMessage]) -> Void) {
+        var timeline = geohashTimelines[geohash] ?? []
+        transform(&timeline)
+        geohashTimelines[geohash] = timeline.isEmpty ? nil : timeline
+    }
+
+    mutating func queueGeohashSystemMessage(_ content: String) {
+        pendingGeohashSystemMessages.append(content)
+    }
+
+    mutating func drainPendingGeohashSystemMessages() -> [String] {
+        defer { pendingGeohashSystemMessages.removeAll(keepingCapacity: false) }
+        return pendingGeohashSystemMessages
+    }
+
+    func geohashKeys() -> [String] {
+        Array(geohashTimelines.keys)
+    }
+
+    private mutating func trimMeshTimelineIfNeeded() {
+        guard meshTimeline.count > meshCap else { return }
+        meshTimeline = Array(meshTimeline.suffix(meshCap))
+    }
+
+    private func trimGeohashTimelineIfNeeded(_ timeline: inout [BitchatMessage]) {
+        guard timeline.count > geohashCap else { return }
+        timeline = Array(timeline.suffix(geohashCap))
+    }
+}

bitchat/Views/Components/CommandSuggestionsView.swift

@@ -0,0 +1,90 @@
+//
+//  CommandSuggestionsView.swift
+//  bitchat
+//
+//  Created by Islam on 29/10/2025.
+//
+
+import SwiftUI
+
+struct CommandSuggestionsView: View {
+    @EnvironmentObject private var viewModel: ChatViewModel
+    @ObservedObject private var locationManager = LocationChannelManager.shared
+    
+    @Binding var messageText: String
+    
+    let textColor: Color
+    let backgroundColor: Color
+    let secondaryTextColor: Color
+    
+    private var filteredCommands: [CommandInfo] {
+        guard messageText.hasPrefix("/") && !messageText.contains(" ") else { return [] }
+        let isGeoPublic = locationManager.selectedChannel.isLocation
+        let isGeoDM = viewModel.selectedPrivateChatPeer?.isGeoDM == true
+        return CommandInfo.all(isGeoPublic: isGeoPublic, isGeoDM: isGeoDM).filter { command in
+            command.alias.starts(with: messageText.lowercased())
+        }
+    }
+    
+    var body: some View {
+        VStack(alignment: .leading, spacing: 0) {
+            ForEach(filteredCommands) { command in
+                Button {
+                    messageText = command.alias + " "
+                } label: {
+                    buttonRow(for: command)
+                }
+                .buttonStyle(.plain)
+                .background(Color.gray.opacity(0.1))
+            }
+        }
+        .background(backgroundColor)
+        .overlay(
+            RoundedRectangle(cornerRadius: 4)
+                .stroke(secondaryTextColor.opacity(0.3), lineWidth: 1)
+        )
+    }
+    
+    private func buttonRow(for command: CommandInfo) -> some View {
+        HStack {
+            Text(command.alias)
+                .font(.bitchatSystem(size: 11, design: .monospaced))
+                .foregroundColor(textColor)
+                .fontWeight(.medium)
+            
+            if let placeholder = command.placeholder {
+                Text(placeholder)
+                    .font(.bitchatSystem(size: 10, design: .monospaced))
+                    .foregroundColor(secondaryTextColor.opacity(0.8))
+            }
+
+            Spacer()
+            
+            Text(command.description)
+                .font(.bitchatSystem(size: 10, design: .monospaced))
+                .foregroundColor(secondaryTextColor)
+        }
+        .padding(.horizontal, 12)
+        .padding(.vertical, 3)
+        .frame(maxWidth: .infinity, alignment: .leading)
+    }
+}
+
+@available(iOS 17, macOS 14, *)
+#Preview {
+    @Previewable @State var messageText: String = "/"
+    let keychain = KeychainManager()
+    let viewModel = ChatViewModel(
+        keychain: keychain,
+        idBridge: NostrIdentityBridge(),
+        identityManager: SecureIdentityStateManager(keychain)
+    )
+    
+    CommandSuggestionsView(
+        messageText: $messageText,
+        textColor: .green,
+        backgroundColor: .primary,
+        secondaryTextColor: .secondary
+    )
+    .environmentObject(viewModel)
+}

bitchat/Views/ContentView.swift

@@ -43,11 +43,9 @@ struct ContentView: View {
     @State private var showPeerList = false
     @State private var showSidebar = false
     @State private var showAppInfo = false
-    @State private var showCommandSuggestions = false
-    @State private var commandSuggestions: [String] = []
     @State private var showMessageActions = false
     @State private var selectedMessageSender: String?
-    @State private var selectedMessageSenderID: String?
+    @State private var selectedMessageSenderID: PeerID?
     @FocusState private var isNicknameFieldFocused: Bool
     @State private var isAtBottomPublic: Bool = true
     @State private var isAtBottomPrivate: Bool = true
@@ -80,7 +78,7 @@ struct ContentView: View {
     // Timer-based refresh removed; use LocationChannelManager live updates instead
     // Window sizes for rendering (infinite scroll up)
     @State private var windowCountPublic: Int = 300
-    @State private var windowCountPrivate: [String: Int] = [:]
+    @State private var windowCountPrivate: [PeerID: Int] = [:]
     
     // MARK: - Computed Properties
     
@@ -124,7 +122,7 @@ struct ContentView: View {
     
     
     private struct PrivateHeaderContext {
-        let headerPeerID: String
+        let headerPeerID: PeerID
         let peer: BitchatPeer?
         let displayName: String
         let isNostrAvailable: Bool
@@ -188,10 +186,6 @@ struct ContentView: View {
             )
         ) {
             peopleSheetView
-                #if os(iOS)
-                .presentationDetents([.large])
-                .presentationDragIndicator(.visible)
-                #endif
         }
         .sheet(isPresented: $showAppInfo) {
             AppInfoView()
@@ -203,11 +197,19 @@ struct ContentView: View {
             set: { _ in viewModel.showingFingerprintFor = nil }
         )) {
             if let peerID = viewModel.showingFingerprintFor {
-                FingerprintView(viewModel: viewModel, peerID: peerID.id)
+                FingerprintView(viewModel: viewModel, peerID: peerID)
             }
         }
 #if os(iOS)
-        .sheet(isPresented: $showImagePicker) {
+        // Only present image picker from main view when NOT in a sheet
+        .fullScreenCover(isPresented: Binding(
+            get: { showImagePicker && !showSidebar && viewModel.selectedPrivateChatPeer == nil },
+            set: { newValue in
+                if !newValue {
+                    showImagePicker = false
+                }
+            }
+        )) {
             ImagePickerView(sourceType: imagePickerSourceType) { image in
                 showImagePicker = false
                 if let image = image {
@@ -223,13 +225,19 @@ struct ContentView: View {
                     }
                 }
             }
-            .presentationDetents([.large])
-            .presentationDragIndicator(.hidden)
             .ignoresSafeArea()
         }
 #endif
 #if os(macOS)
-        .sheet(isPresented: $showMacImagePicker) {
+        // Only present Mac image picker from main view when NOT in a sheet
+        .sheet(isPresented: Binding(
+            get: { showMacImagePicker && !showSidebar && viewModel.selectedPrivateChatPeer == nil },
+            set: { newValue in
+                if !newValue {
+                    showMacImagePicker = false
+                }
+            }
+        )) {
             MacImagePickerView { url in
                 showMacImagePicker = false
                 if let url = url {
@@ -275,12 +283,12 @@ struct ContentView: View {
 
             Button("content.actions.direct_message") {
                 if let peerID = selectedMessageSenderID {
-                    if peerID.hasPrefix("nostr:") {
-                        if let full = viewModel.fullNostrHex(forSenderPeerID: PeerID(str: peerID)) {
+                    if peerID.isGeoChat {
+                        if let full = viewModel.fullNostrHex(forSenderPeerID: peerID) {
                             viewModel.startGeohashDM(withPubkeyHex: full)
                         }
                     } else {
-                        viewModel.startPrivateChat(with: PeerID(str: peerID))
+                        viewModel.startPrivateChat(with: peerID)
                     }
                     withAnimation(.easeInOut(duration: TransportConfig.uiAnimationMediumSeconds)) {
                         showSidebar = true
@@ -302,8 +310,8 @@ struct ContentView: View {
 
             Button("content.actions.block", role: .destructive) {
                 // Prefer direct geohash block when we have a Nostr sender ID
-                if let peerID = selectedMessageSenderID, peerID.hasPrefix("nostr:"),
-                   let full = viewModel.fullNostrHex(forSenderPeerID: PeerID(str: peerID)),
+                if let peerID = selectedMessageSenderID, peerID.isGeoChat,
+                   let full = viewModel.fullNostrHex(forSenderPeerID: peerID),
                    let sender = selectedMessageSender {
                     viewModel.blockGeohashUser(pubkeyHexLowercased: full, displayName: sender)
                 } else if let sender = selectedMessageSender {
@@ -334,9 +342,9 @@ struct ContentView: View {
     
     // MARK: - Message List View
     
-    private func messagesView(privatePeer: String?, isAtBottom: Binding<Bool>) -> some View {
+    private func messagesView(privatePeer: PeerID?, isAtBottom: Binding<Bool>) -> some View {
         let messages: [BitchatMessage] = {
-            if let peerID = PeerID(str: privatePeer) {
+            if let peerID = privatePeer {
                 return viewModel.getPrivateChatMessages(for: peerID)
             }
             return viewModel.messages
@@ -476,7 +484,7 @@ struct ContentView: View {
             }
             .onChange(of: viewModel.privateChats) { _ in
                 if let peerID = privatePeer,
-                   let messages = viewModel.privateChats[PeerID(str: peerID)],
+                   let messages = viewModel.privateChats[peerID],
                    !messages.isEmpty {
                     // If the newest private message is from me, always scroll
                     let lastMsg = messages.last!
@@ -531,7 +539,7 @@ struct ContentView: View {
             }
             .onAppear {
                 // Also check when view appears
-                if let peerID = PeerID(str: privatePeer) {
+                if let peerID = privatePeer {
                     // Try multiple times to ensure read receipts are sent
                     viewModel.markPrivateMessagesAsRead(from: peerID)
                     
@@ -595,77 +603,12 @@ struct ContentView: View {
                 .padding(.horizontal, 12)
             }
 
-            // Command suggestions
-            if showCommandSuggestions && !commandSuggestions.isEmpty {
-                VStack(alignment: .leading, spacing: 0) {
-                    // Define commands with aliases and syntax
-                    let baseInfo: [(commands: [String], syntax: String?, description: String)] = [
-                        (["/block"], "[nickname]", "block or list blocked peers"),
-                        (["/clear"], nil, "clear chat messages"),
-                        (["/hug"], "<nickname>", "send someone a warm hug"),
-                        (["/m", "/msg"], "<nickname> [message]", "send private message"),
-                        (["/slap"], "<nickname>", "slap someone with a trout"),
-                        (["/unblock"], "<nickname>", "unblock a peer"),
-                        (["/w"], nil, "see who's online")
-                    ]
-                    let isGeoPublic: Bool = { if case .location = locationManager.selectedChannel { return true }; return false }()
-                    let isGeoDM = viewModel.selectedPrivateChatPeer?.isGeoDM == true
-                    let favInfo: [(commands: [String], syntax: String?, description: String)] = [
-                        (["/fav"], "<nickname>", "add to favorites"),
-                        (["/unfav"], "<nickname>", "remove from favorites")
-                    ]
-                    let commandInfo = baseInfo + ((isGeoPublic || isGeoDM) ? [] : favInfo)
-
-                    // Build the display
-                    let allCommands = commandInfo
-
-                    // Show matching commands
-                    ForEach(commandSuggestions, id: \.self) { command in
-                        // Find the command info for this suggestion
-                        if let info = allCommands.first(where: { $0.commands.contains(command) }) {
-                            Button(action: {
-                                // Replace current text with selected command
-                                messageText = command + " "
-                                showCommandSuggestions = false
-                                commandSuggestions = []
-                            }) {
-                                HStack {
-                                    // Show all aliases together
-                                    Text(info.commands.joined(separator: ", "))
-                                        .font(.bitchatSystem(size: 11, design: .monospaced))
-                                        .foregroundColor(textColor)
-                                        .fontWeight(.medium)
-
-                                    // Show syntax if any
-                                    if let syntax = info.syntax {
-                                        Text(syntax)
-                                            .font(.bitchatSystem(size: 10, design: .monospaced))
-                                            .foregroundColor(secondaryTextColor.opacity(0.8))
-                                    }
-
-                                    Spacer()
-
-                                    // Show description
-                                    Text(info.description)
-                                        .font(.bitchatSystem(size: 10, design: .monospaced))
-                                        .foregroundColor(secondaryTextColor)
-                                }
-                                .padding(.horizontal, 12)
-                                .padding(.vertical, 3)
-                                .frame(maxWidth: .infinity, alignment: .leading)
-                            }
-                            .buttonStyle(.plain)
-                            .background(Color.gray.opacity(0.1))
-                        }
-                    }
-                }
-                .background(backgroundColor)
-                .overlay(
-                    RoundedRectangle(cornerRadius: 4)
-                        .stroke(secondaryTextColor.opacity(0.3), lineWidth: 1)
-                )
-                .padding(.horizontal, 12)
-            }
+            CommandSuggestionsView(
+                messageText: $messageText,
+                textColor: textColor,
+                backgroundColor: backgroundColor,
+                secondaryTextColor: secondaryTextColor
+            )
 
             // Recording indicator
             if isPreparingVoiceNote || isRecordingVoiceNote {
@@ -699,68 +642,11 @@ struct ContentView: View {
                 )
                 .frame(maxWidth: .infinity, alignment: .leading)
                 .onChange(of: messageText) { newValue in
-                    // Cancel previous debounce timer
                     autocompleteDebounceTimer?.invalidate()
-
-                    // Debounce autocomplete updates to reduce calls during rapid typing
                     autocompleteDebounceTimer = Timer.scheduledTimer(withTimeInterval: 0.15, repeats: false) { _ in
-                        // Get cursor position (approximate - end of text for now)
                         let cursorPosition = newValue.count
                         viewModel.updateAutocomplete(for: newValue, cursorPosition: cursorPosition)
                     }
-
-                    // Check for command autocomplete (instant, no debounce needed)
-                    if newValue.hasPrefix("/") && newValue.count >= 1 {
-                        // Build context-aware command list
-                        let isGeoPublic: Bool = {
-                            if case .location = locationManager.selectedChannel { return true }
-                            return false
-                        }()
-                        let isGeoDM = viewModel.selectedPrivateChatPeer?.isGeoDM == true
-                        var commandDescriptions = [
-                            ("/block", String(localized: "content.commands.block", comment: "Description for /block command")),
-                            ("/clear", String(localized: "content.commands.clear", comment: "Description for /clear command")),
-                            ("/hug", String(localized: "content.commands.hug", comment: "Description for /hug command")),
-                            ("/m", String(localized: "content.commands.message", comment: "Description for /m command")),
-                            ("/slap", String(localized: "content.commands.slap", comment: "Description for /slap command")),
-                            ("/unblock", String(localized: "content.commands.unblock", comment: "Description for /unblock command")),
-                            ("/w", String(localized: "content.commands.who", comment: "Description for /w command"))
-                        ]
-                        // Only show favorites commands when not in geohash context
-                        if !(isGeoPublic || isGeoDM) {
-                            commandDescriptions.append(("/fav", String(localized: "content.commands.favorite", comment: "Description for /fav command")))
-                            commandDescriptions.append(("/unfav", String(localized: "content.commands.unfavorite", comment: "Description for /unfav command")))
-                        }
-
-                        let input = newValue.lowercased()
-
-                        // Map of aliases to primary commands
-                        let aliases: [String: String] = [
-                            "/join": "/j",
-                            "/msg": "/m"
-                        ]
-
-                        // Filter commands, but convert aliases to primary
-                        commandSuggestions = commandDescriptions
-                            .filter { $0.0.starts(with: input) }
-                            .map { $0.0 }
-
-                        // Also check if input matches an alias
-                        for (alias, primary) in aliases {
-                            if alias.starts(with: input) && !commandSuggestions.contains(primary) {
-                                if commandDescriptions.contains(where: { $0.0 == primary }) {
-                                    commandSuggestions.append(primary)
-                                }
-                            }
-                        }
-
-                        // Remove duplicates and sort
-                        commandSuggestions = Array(Set(commandSuggestions)).sorted()
-                        showCommandSuggestions = !commandSuggestions.isEmpty
-                    } else {
-                        showCommandSuggestions = false
-                        commandSuggestions = []
-                    }
                 }
 
                 HStack(alignment: .center, spacing: 4) {
@@ -777,14 +663,14 @@ struct ContentView: View {
         .padding(.bottom, 8)
         .background(backgroundColor.opacity(0.95))
     }
-
+    
     private func handleOpenURL(_ url: URL) {
         guard url.scheme == "bitchat" else { return }
         switch url.host {
         case "user":
             let id = url.path.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
             let peerID = PeerID(str: id.removingPercentEncoding ?? id)
-            selectedMessageSenderID = peerID.id
+            selectedMessageSenderID = peerID
 
             if peerID.isGeoDM || peerID.isGeoChat {
                 selectedMessageSender = viewModel.geohashDisplayName(for: peerID)
@@ -832,10 +718,10 @@ struct ContentView: View {
     }
 
     private func scrollToBottom(on proxy: ScrollViewProxy,
-                                privatePeer: String?,
+                                privatePeer: PeerID?,
                                 isAtBottom: Binding<Bool>) {
         let targetID: String? = {
-            if let peer = PeerID(str: privatePeer),
+            if let peer = privatePeer,
                let last = viewModel.getPrivateChatMessages(for: peer).suffix(300).last?.id {
                 return "dm:\(peer)|\(last)"
             }
@@ -861,7 +747,7 @@ struct ContentView: View {
 
         DispatchQueue.main.asyncAfter(deadline: .now() + 0.05) {
             let secondTarget: String? = {
-                if let peer = PeerID(str: privatePeer),
+                if let peer = privatePeer,
                    let last = viewModel.getPrivateChatMessages(for: peer).suffix(300).last?.id {
                     return "dm:\(peer)|\(last)"
                 }
@@ -912,6 +798,53 @@ struct ContentView: View {
         #if os(macOS)
         .frame(minWidth: 420, minHeight: 520)
         #endif
+        // Present image picker from sheet context when IN a sheet (parent-child pattern)
+        #if os(iOS)
+        .fullScreenCover(isPresented: Binding(
+            get: { showImagePicker && (showSidebar || viewModel.selectedPrivateChatPeer != nil) },
+            set: { newValue in
+                if !newValue {
+                    showImagePicker = false
+                }
+            }
+        )) {
+            ImagePickerView(sourceType: imagePickerSourceType) { image in
+                showImagePicker = false
+                if let image = image {
+                    Task {
+                        do {
+                            let processedURL = try ImageUtils.processImage(image)
+                            await MainActor.run {
+                                viewModel.sendImage(from: processedURL)
+                            }
+                        } catch {
+                            SecureLogger.error("Image processing failed: \(error)", category: .session)
+                        }
+                    }
+                }
+            }
+            .ignoresSafeArea()
+        }
+        #endif
+        #if os(macOS)
+        .sheet(isPresented: $showMacImagePicker) {
+            MacImagePickerView { url in
+                showMacImagePicker = false
+                if let url = url {
+                    Task {
+                        do {
+                            let processedURL = try ImageUtils.processImage(at: url)
+                            await MainActor.run {
+                                viewModel.sendImage(from: processedURL)
+                            }
+                        } catch {
+                            SecureLogger.error("Image processing failed: \(error)", category: .session)
+                        }
+                    }
+                }
+            }
+        }
+        #endif
     }
     
     // MARK: - People Sheet Views
@@ -998,14 +931,14 @@ struct ContentView: View {
                             textColor: textColor,
                             secondaryTextColor: secondaryTextColor,
                             onTapPeer: { peerID in
-                                viewModel.startPrivateChat(with: PeerID(str: peerID))
+                                viewModel.startPrivateChat(with: peerID)
                                 showSidebar = true
                             },
                             onToggleFavorite: { peerID in
-                                viewModel.toggleFavorite(peerID: PeerID(str: peerID))
+                                viewModel.toggleFavorite(peerID: peerID)
                             },
                             onShowFingerprint: { peerID in
-                                viewModel.showFingerprint(for: PeerID(str: peerID))
+                                viewModel.showFingerprint(for: peerID)
                             }
                         )
                     }
@@ -1020,7 +953,7 @@ struct ContentView: View {
 
     private var privateChatSheetView: some View {
         VStack(spacing: 0) {
-            if let privatePeerID = viewModel.selectedPrivateChatPeer?.id {
+            if let privatePeerID = viewModel.selectedPrivateChatPeer {
                 let headerContext = makePrivateHeaderContext(for: privatePeerID)
 
                 HStack(spacing: 12) {
@@ -1044,12 +977,11 @@ struct ContentView: View {
 
                     HStack(spacing: 8) {
                         privateHeaderInfo(context: headerContext, privatePeerID: privatePeerID)
-                        let peerID = PeerID(str: headerContext.headerPeerID)
-                        let isFavorite = viewModel.isFavorite(peerID: peerID)
+                        let isFavorite = viewModel.isFavorite(peerID: headerContext.headerPeerID)
 
-                        if !privatePeerID.hasPrefix("nostr_") {
+                        if !privatePeerID.isGeoDM {
                             Button(action: {
-                                viewModel.toggleFavorite(peerID: peerID)
+                                viewModel.toggleFavorite(peerID: headerContext.headerPeerID)
                             }) {
                                 Image(systemName: isFavorite ? "star.fill" : "star")
                                     .font(.bitchatSystem(size: 14))
@@ -1088,7 +1020,7 @@ struct ContentView: View {
                 .background(backgroundColor)
             }
 
-            messagesView(privatePeer: viewModel.selectedPrivateChatPeer?.id, isAtBottom: $isAtBottomPrivate)
+            messagesView(privatePeer: viewModel.selectedPrivateChatPeer, isAtBottom: $isAtBottomPrivate)
                 .background(backgroundColor)
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
             Divider()
@@ -1110,9 +1042,9 @@ struct ContentView: View {
         )
     }
 
-    private func privateHeaderInfo(context: PrivateHeaderContext, privatePeerID: String) -> some View {
+    private func privateHeaderInfo(context: PrivateHeaderContext, privatePeerID: PeerID) -> some View {
         Button(action: {
-            viewModel.showFingerprint(for: PeerID(str: context.headerPeerID))
+            viewModel.showFingerprint(for: context.headerPeerID)
         }) {
             HStack(spacing: 6) {
                 if let connectionState = context.peer?.connectionState {
@@ -1135,7 +1067,7 @@ struct ContentView: View {
                     case .offline:
                         EmptyView()
                     }
-                } else if viewModel.meshService.isPeerReachable(PeerID(str: context.headerPeerID)) {
+                } else if viewModel.meshService.isPeerReachable(context.headerPeerID) {
                     Image(systemName: "point.3.filled.connected.trianglepath.dotted")
                         .font(.bitchatSystem(size: 14))
                         .foregroundColor(textColor)
@@ -1145,7 +1077,7 @@ struct ContentView: View {
                         .font(.bitchatSystem(size: 14))
                         .foregroundColor(.purple)
                         .accessibilityLabel(String(localized: "content.accessibility.available_nostr", comment: "Accessibility label for Nostr-available peer indicator"))
-                } else if viewModel.meshService.isPeerConnected(PeerID(str: context.headerPeerID)) || viewModel.connectedPeers.contains(PeerID(str: context.headerPeerID)) {
+                } else if viewModel.meshService.isPeerConnected(context.headerPeerID) || viewModel.connectedPeers.contains(context.headerPeerID) {
                     Image(systemName: "dot.radiowaves.left.and.right")
                         .font(.bitchatSystem(size: 14))
                         .foregroundColor(textColor)
@@ -1156,14 +1088,9 @@ struct ContentView: View {
                     .font(.bitchatSystem(size: 16, weight: .medium, design: .monospaced))
                     .foregroundColor(textColor)
 
-                if !privatePeerID.hasPrefix("nostr_") {
-                    let statusPeerID: String = {
-                        if privatePeerID.count == 64, let short = viewModel.getShortIDForNoiseKey(privatePeerID) {
-                            return short.id
-                        }
-                        return context.headerPeerID
-                    }()
-                    let encryptionStatus = viewModel.getEncryptionStatus(for: PeerID(str: statusPeerID))
+                if !privatePeerID.isGeoDM {
+                    let statusPeerID = viewModel.getShortIDForNoiseKey(privatePeerID)
+                    let encryptionStatus = viewModel.getEncryptionStatus(for: statusPeerID)
                     if let icon = encryptionStatus.icon {
                         Image(systemName: icon)
                             .font(.bitchatSystem(size: 14))
@@ -1195,33 +1122,27 @@ struct ContentView: View {
         .frame(height: headerHeight)
     }
 
-    private func makePrivateHeaderContext(for privatePeerID: String) -> PrivateHeaderContext {
-        let headerPeerID: String = {
-            if privatePeerID.count == 64, let short = viewModel.getShortIDForNoiseKey(privatePeerID) {
-                return short.id
-            }
-            return privatePeerID
-        }()
-
-        let peer = viewModel.getPeer(byID: PeerID(str: headerPeerID))
+    private func makePrivateHeaderContext(for privatePeerID: PeerID) -> PrivateHeaderContext {
+        let headerPeerID = viewModel.getShortIDForNoiseKey(privatePeerID)
+        let peer = viewModel.getPeer(byID: headerPeerID)
 
         let displayName: String = {
-            if privatePeerID.hasPrefix("nostr_"), case .location(let ch) = locationManager.selectedChannel {
-                let disp = viewModel.geohashDisplayName(for: PeerID(str: privatePeerID))
+            if privatePeerID.isGeoDM, case .location(let ch) = locationManager.selectedChannel {
+                let disp = viewModel.geohashDisplayName(for: privatePeerID)
                 return "#\(ch.geohash)/@\(disp)"
             }
             if let name = peer?.displayName { return name }
-            if let name = viewModel.meshService.peerNickname(peerID: PeerID(str: headerPeerID)) { return name }
-            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: Data(hexString: headerPeerID) ?? Data()),
+            if let name = viewModel.meshService.peerNickname(peerID: headerPeerID) { return name }
+            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: Data(hexString: headerPeerID.id) ?? Data()),
                !fav.peerNickname.isEmpty { return fav.peerNickname }
-            if headerPeerID.count == 16 {
-                let candidates = viewModel.identityManager.getCryptoIdentitiesByPeerIDPrefix(PeerID(str: headerPeerID))
+            if headerPeerID.id.count == 16 {
+                let candidates = viewModel.identityManager.getCryptoIdentitiesByPeerIDPrefix(headerPeerID)
                 if let id = candidates.first,
                    let social = viewModel.identityManager.getSocialIdentity(for: id.fingerprint) {
                     if let pet = social.localPetname, !pet.isEmpty { return pet }
                     if !social.claimedNickname.isEmpty { return social.claimedNickname }
                 }
-            } else if headerPeerID.count == 64, let keyData = Data(hexString: headerPeerID) {
+            } else if let keyData = headerPeerID.noiseKey {
                 let fp = keyData.sha256Fingerprint()
                 if let social = viewModel.identityManager.getSocialIdentity(for: fp) {
                     if let pet = social.localPetname, !pet.isEmpty { return pet }
@@ -1233,7 +1154,7 @@ struct ContentView: View {
 
         let isNostrAvailable: Bool = {
             guard let connectionState = peer?.connectionState else {
-                if let noiseKey = Data(hexString: headerPeerID),
+                if let noiseKey = Data(hexString: headerPeerID.id),
                    let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
                    favoriteStatus.isMutual {
                     return true
@@ -1752,7 +1673,7 @@ private extension ContentView {
 
     private func expandWindow(ifNeededFor message: BitchatMessage,
                               allMessages: [BitchatMessage],
-                              privatePeer: String?,
+                              privatePeer: PeerID?,
                               proxy: ScrollViewProxy) {
         let step = TransportConfig.uiWindowStepCount
         let contextKey: String = {
@@ -1812,7 +1733,19 @@ private extension ContentView {
     }
 
     private var shouldShowMediaControls: Bool {
-        if viewModel.selectedPrivateChatPeer != nil {
+        if let peer = viewModel.selectedPrivateChatPeer, !(peer.isGeoDM || peer.isGeoChat) {
+            return true
+        }
+        switch locationManager.selectedChannel {
+        case .mesh:
+            return true
+        case .location:
+            return false
+        }
+    }
+
+    private var shouldShowVoiceControl: Bool {
+        if let peer = viewModel.selectedPrivateChatPeer, !(peer.isGeoDM || peer.isGeoChat) {
             return true
         }
         switch locationManager.selectedChannel {
@@ -1857,17 +1790,23 @@ private extension ContentView {
         #endif
     }
 
+    @ViewBuilder
     var sendOrMicButton: some View {
         let hasText = !trimmedMessageText.isEmpty
-        return ZStack {
-            micButtonView
-                .opacity(hasText ? 0 : 1)
-                .allowsHitTesting(!hasText)
+        if shouldShowVoiceControl {
+            ZStack {
+                micButtonView
+                    .opacity(hasText ? 0 : 1)
+                    .allowsHitTesting(!hasText)
+                sendButtonView(enabled: hasText)
+                    .opacity(hasText ? 1 : 0)
+                    .allowsHitTesting(hasText)
+            }
+            .frame(width: 36, height: 36)
+        } else {
             sendButtonView(enabled: hasText)
-                .opacity(hasText ? 1 : 0)
-                .allowsHitTesting(hasText)
+                .frame(width: 36, height: 36)
         }
-        .frame(width: 36, height: 36)
     }
 
     private var micButtonView: some View {
@@ -1920,6 +1859,7 @@ private extension ContentView {
     }
 
     func startVoiceRecording() {
+        guard shouldShowVoiceControl else { return }
         guard !isRecordingVoiceNote && !isPreparingVoiceNote else { return }
         isPreparingVoiceNote = true
         Task { @MainActor in

bitchat/Views/FingerprintView.swift

@@ -10,7 +10,7 @@ import SwiftUI
 
 struct FingerprintView: View {
     @ObservedObject var viewModel: ChatViewModel
-    let peerID: String
+    let peerID: PeerID
     @Environment(\.dismiss) var dismiss
     @Environment(\.colorScheme) var colorScheme
     
@@ -65,15 +65,12 @@ struct FingerprintView: View {
             
             VStack(alignment: .leading, spacing: 16) {
                 // Prefer short mesh ID for session/encryption status
-                let statusPeerID: String = {
-                    if peerID.count == 64, let short = viewModel.getShortIDForNoiseKey(peerID) { return short.id }
-                    return peerID
-                }()
+                let statusPeerID = viewModel.getShortIDForNoiseKey(peerID)
                 // Resolve a friendly name
                 let peerNickname: String = {
-                    if let p = viewModel.getPeer(byID: PeerID(str: statusPeerID)) { return p.displayName }
-                    if let name = viewModel.meshService.peerNickname(peerID: PeerID(str: statusPeerID)) { return name }
-                    if peerID.count == 64, let data = Data(hexString: peerID) {
+                    if let p = viewModel.getPeer(byID: statusPeerID) { return p.displayName }
+                    if let name = viewModel.meshService.peerNickname(peerID: statusPeerID) { return name }
+                    if let data = peerID.noiseKey {
                         if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: data), !fav.peerNickname.isEmpty { return fav.peerNickname }
                         let fp = data.sha256Fingerprint()
                         if let social = viewModel.identityManager.getSocialIdentity(for: fp) {
@@ -84,7 +81,7 @@ struct FingerprintView: View {
                     return Strings.unknownPeer()
                 }()
                 // Accurate encryption state based on short ID session
-                let encryptionStatus = viewModel.getEncryptionStatus(for: PeerID(str: statusPeerID))
+                let encryptionStatus = viewModel.getEncryptionStatus(for: statusPeerID)
                 
                 HStack {
                     if let icon = encryptionStatus.icon {
@@ -115,7 +112,7 @@ struct FingerprintView: View {
                         .font(.bitchatSystem(size: 12, weight: .bold, design: .monospaced))
                         .foregroundColor(textColor.opacity(0.7))
                     
-                    if let fingerprint = viewModel.getFingerprint(for: PeerID(str: statusPeerID)) {
+                    if let fingerprint = viewModel.getFingerprint(for: statusPeerID) {
                         Text(formatFingerprint(fingerprint))
                             .font(.bitchatSystem(size: 14, design: .monospaced))
                             .foregroundColor(textColor)
@@ -176,7 +173,6 @@ struct FingerprintView: View {
                 // Verification status
                 if encryptionStatus == .noiseSecured || encryptionStatus == .noiseVerified {
                     let isVerified = encryptionStatus == .noiseVerified
-                    let peerID = PeerID(str: peerID)
                     
                     VStack(spacing: 12) {
                         Text(isVerified ? Strings.verifiedBadge : Strings.notVerifiedBadge)
@@ -240,8 +236,6 @@ struct FingerprintView: View {
         .padding()
         .frame(maxWidth: .infinity, maxHeight: .infinity)
         .background(backgroundColor)
-        .presentationDetents([.large])
-        .presentationDragIndicator(.visible)
     }
     
     private func formatFingerprint(_ fingerprint: String) -> String {

bitchat/Views/LocationChannelsSheet.swift

@@ -125,9 +125,6 @@ struct LocationChannelsSheet: View {
             .navigationTitle("")
             #endif
         }
-        #if os(iOS)
-        .presentationDetents([.large])
-        #endif
         #if os(macOS)
         .frame(minWidth: 420, minHeight: 520)
         #endif

bitchat/Views/LocationNotesView.swift

@@ -78,9 +78,6 @@ struct LocationNotesView: View {
             .navigationTitle("")
             #endif
         }
-       #if os(iOS)
-        .presentationDetents([.large])
-        #endif
         .background(backgroundColor)
         .onDisappear { manager.cancel() }
         .onChange(of: geohash) { newValue in

bitchat/Views/MeshPeerList.swift

@@ -4,9 +4,9 @@ struct MeshPeerList: View {
     @ObservedObject var viewModel: ChatViewModel
     let textColor: Color
     let secondaryTextColor: Color
-    let onTapPeer: (String) -> Void
-    let onToggleFavorite: (String) -> Void
-    let onShowFingerprint: (String) -> Void
+    let onTapPeer: (PeerID) -> Void
+    let onToggleFavorite: (PeerID) -> Void
+    let onShowFingerprint: (PeerID) -> Void
     @Environment(\.colorScheme) var colorScheme
 
     @State private var orderedIDs: [String] = []
@@ -130,7 +130,7 @@ struct MeshPeerList: View {
                         }
 
                         if !isMe {
-                            Button(action: { onToggleFavorite(peer.peerID.id) }) {
+                            Button(action: { onToggleFavorite(peer.peerID) }) {
                                 Image(systemName: (peer.favoriteStatus?.isFavorite ?? false) ? "star.fill" : "star")
                                     .font(.bitchatSystem(size: 12))
                                     .foregroundColor((peer.favoriteStatus?.isFavorite ?? false) ? .yellow : secondaryTextColor)
@@ -142,8 +142,8 @@ struct MeshPeerList: View {
                     .padding(.vertical, 4)
                     .padding(.top, idx == 0 ? 10 : 0)
                     .contentShape(Rectangle())
-                    .onTapGesture { if !isMe { onTapPeer(peer.peerID.id) } }
-                    .onTapGesture(count: 2) { if !isMe { onShowFingerprint(peer.peerID.id) } }
+                    .onTapGesture { if !isMe { onTapPeer(peer.peerID) } }
+                    .onTapGesture(count: 2) { if !isMe { onShowFingerprint(peer.peerID) } }
                 }
             }
             // Seed and update order outside result builder

bitchat/Views/VerificationViews.swift

@@ -388,10 +388,6 @@ struct VerificationSheetView: View {
             .padding(.vertical, 14)
         }
         .background(backgroundColor)
-        #if os(iOS)
-        .presentationDetents([.large])
-        .presentationDragIndicator(.visible)
-        #endif
         .onDisappear { showingScanner = false }
     }
 }

bitchatTests/BLEServiceTests.swift

@@ -298,5 +298,5 @@ private final class MockBitchatDelegate: BitchatDelegate {
     func didUpdateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) {}
     func didReceiveNoisePayload(from peerID: PeerID, type: NoisePayloadType, payload: Data, timestamp: Date) {}
     func didUpdateBluetoothState(_ state: CBManagerState) {}
-    func didReceivePublicMessage(from peerID: String, nickname: String, content: String, timestamp: Date) {}
+    func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {}
 }

bitchatTests/EndToEnd/PrivateChatE2ETests.swift

@@ -186,11 +186,11 @@ struct PrivateChatE2ETests {
             // Bob relays private messages for Charlie
             bob.packetDeliveryHandler = { packet in
                 if let recipientID = packet.recipientID,
-                   String(data: recipientID, encoding: .utf8) == charlie.peerID {
+                   PeerID(data: recipientID) == charlie.peerID {
                     // Relay to Charlie
                     var relayPacket = packet
                     relayPacket.ttl = packet.ttl - 1
-                    self.charlie.simulateIncomingPacket(relayPacket)
+                    charlie.simulateIncomingPacket(relayPacket)
                 }
             }
             

bitchatTests/EndToEnd/PublicChatE2ETests.swift

@@ -388,7 +388,7 @@ struct PublicChatE2ETests {
 
             if let message = BitchatMessage(packet.payload) {
                 // Don't relay own messages
-                guard message.senderPeerID?.id != node.peerID else { return }
+                guard message.senderPeerID != node.peerID else { return }
                 
                 // Create relay message
                 let relayMessage = BitchatMessage(

bitchatTests/Fragmentation/FragmentationTests.swift

@@ -209,7 +209,7 @@ extension FragmentationTests {
         func didUpdateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) {}
         func didReceiveNoisePayload(from peerID: PeerID, type: NoisePayloadType, payload: Data, timestamp: Date) {}
         func didUpdateBluetoothState(_ state: CBManagerState) {}
-        func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date) {
+        func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {
             publicMessages.append((peerID, nickname, content))
         }
         func didReceiveRegionalPublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date) {}

bitchatTests/GossipSyncManagerTests.swift

@@ -125,16 +125,138 @@ struct GossipSyncManagerTests {
         #expect(manager._hasAnnouncement(for: PeerID(str: peerHex)) == false)
         #expect(manager._messageCount(for: PeerID(str: peerHex)) == 0)
     }
+
+    @Test func maintenanceEmitsTypedSyncRequests() throws {
+        var config = GossipSyncManager.Config()
+        config.seenCapacity = 10
+        config.fragmentCapacity = 5
+        config.fileTransferCapacity = 4
+        config.messageSyncIntervalSeconds = 1
+        config.fragmentSyncIntervalSeconds = 1
+        config.fileTransferSyncIntervalSeconds = 1
+        config.maintenanceIntervalSeconds = 0
+
+        let manager = GossipSyncManager(myPeerID: myPeerID, config: config)
+        let delegate = RecordingDelegate()
+        manager.delegate = delegate
+
+        let sender = try #require(Data(hexString: "1122334455667788"))
+        let now = UInt64(Date().timeIntervalSince1970 * 1000)
+
+        let announcePacket = BitchatPacket(
+            type: MessageType.announce.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data(),
+            signature: nil,
+            ttl: 1
+        )
+        let messagePacket = BitchatPacket(
+            type: MessageType.message.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data([0x01]),
+            signature: nil,
+            ttl: 1
+        )
+        let fragmentPacket = BitchatPacket(
+            type: MessageType.fragment.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data([0xAA]),
+            signature: nil,
+            ttl: 1
+        )
+        let filePacket = BitchatPacket(
+            type: MessageType.fileTransfer.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data([0xBB]),
+            signature: nil,
+            ttl: 1,
+            version: 2
+        )
+
+        manager.onPublicPacketSeen(announcePacket)
+        manager.onPublicPacketSeen(messagePacket)
+        manager.onPublicPacketSeen(fragmentPacket)
+        manager.onPublicPacketSeen(filePacket)
+
+        manager._performMaintenanceSynchronously(now: Date())
+
+        let sentPackets = delegate.packets
+        #expect(sentPackets.count == 3)
+        let decoded = sentPackets.compactMap { RequestSyncPacket.decode(from: $0.payload) }
+        #expect(decoded.count == 3)
+        #expect(decoded[0].types == .publicMessages)
+        #expect(decoded[1].types == .fragment)
+        #expect(decoded[2].types == .fileTransfer)
+    }
+
+    @Test func handleRequestSyncHonorsTypeFilter() async throws {
+        var config = GossipSyncManager.Config()
+        config.seenCapacity = 5
+        config.fragmentCapacity = 5
+        config.fileTransferCapacity = 0
+        config.messageSyncIntervalSeconds = 0
+        config.fragmentSyncIntervalSeconds = 0
+        config.fileTransferSyncIntervalSeconds = 0
+
+        let manager = GossipSyncManager(myPeerID: myPeerID, config: config)
+        let delegate = RecordingDelegate()
+        manager.delegate = delegate
+
+        let sender = try #require(Data(hexString: "aabbccddeeff0011"))
+        let now = UInt64(Date().timeIntervalSince1970 * 1000)
+
+        let messagePacket = BitchatPacket(
+            type: MessageType.message.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data([0x10]),
+            signature: nil,
+            ttl: 1
+        )
+
+        let fragmentPacket = BitchatPacket(
+            type: MessageType.fragment.rawValue,
+            senderID: sender,
+            recipientID: nil,
+            timestamp: now,
+            payload: Data([0x20]),
+            signature: nil,
+            ttl: 1
+        )
+
+        manager.onPublicPacketSeen(messagePacket)
+        manager.onPublicPacketSeen(fragmentPacket)
+
+        let peer = PeerID(str: "FFFFFFFFFFFFFFFF")
+        let request = RequestSyncPacket(p: 4, m: 1, data: Data(), types: .fragment)
+        manager.handleRequestSync(from: peer, request: request)
+
+        try await sleep(0.01)
+        let sentPackets = delegate.packets
+        #expect(sentPackets.count == 1)
+        #expect(sentPackets[0].type == MessageType.fragment.rawValue)
+    }
 }
 
 private final class RecordingDelegate: GossipSyncManager.Delegate {
     var onSend: (() -> Void)?
     private(set) var lastPacket: BitchatPacket?
+    private(set) var packets: [BitchatPacket] = []
     private let lock = NSLock()
 
     func sendPacket(_ packet: BitchatPacket) {
         lock.lock()
         lastPacket = packet
+        packets.append(packet)
         lock.unlock()
         onSend?()
     }

bitchatTests/InputValidatorTests.swift

@@ -0,0 +1,192 @@
+//
+// InputValidatorTests.swift
+// bitchatTests
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Testing
+import Foundation
+@testable import bitchat
+
+struct InputValidatorTests {
+
+    // MARK: - Basic Validation Tests
+
+    @Test func validStringPassesValidation() throws {
+        let result = InputValidator.validateUserString("Hello World", maxLength: 100)
+        #expect(result == "Hello World")
+    }
+
+    @Test func emptyStringReturnsNil() throws {
+        let result = InputValidator.validateUserString("", maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func whitespaceOnlyStringReturnsNil() throws {
+        let result = InputValidator.validateUserString("   \n\t  ", maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func stringExceedingMaxLengthReturnsNil() throws {
+        let longString = String(repeating: "a", count: 101)
+        let result = InputValidator.validateUserString(longString, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func stringAtMaxLengthIsAccepted() throws {
+        let exactString = String(repeating: "a", count: 100)
+        let result = InputValidator.validateUserString(exactString, maxLength: 100)
+        #expect(result == exactString)
+    }
+
+    @Test func whitespaceIsTrimmed() throws {
+        let result = InputValidator.validateUserString("  Hello  ", maxLength: 100)
+        #expect(result == "Hello")
+    }
+
+    // MARK: - Control Character Tests
+
+    @Test func nullCharacterIsRejected() throws {
+        let stringWithNull = "Hello\u{0000}World"
+        let result = InputValidator.validateUserString(stringWithNull, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func bellCharacterIsRejected() throws {
+        let stringWithBell = "Hello\u{0007}World"
+        let result = InputValidator.validateUserString(stringWithBell, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func backspaceCharacterIsRejected() throws {
+        let stringWithBackspace = "Hello\u{0008}World"
+        let result = InputValidator.validateUserString(stringWithBackspace, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func escapeCharacterIsRejected() throws {
+        let stringWithEscape = "Hello\u{001B}World"
+        let result = InputValidator.validateUserString(stringWithEscape, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func deleteCharacterIsRejected() throws {
+        let stringWithDelete = "Hello\u{007F}World"
+        let result = InputValidator.validateUserString(stringWithDelete, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func multipleControlCharactersAreRejected() throws {
+        let stringWithMultiple = "Hello\u{0000}\u{0007}\u{001B}World"
+        let result = InputValidator.validateUserString(stringWithMultiple, maxLength: 100)
+        #expect(result == nil)
+    }
+
+    // MARK: - Unicode and Special Character Tests
+
+    @Test func emojiIsAccepted() throws {
+        let result = InputValidator.validateUserString("Hello 👋 World", maxLength: 100)
+        #expect(result == "Hello 👋 World")
+    }
+
+    @Test func unicodeCharactersAreAccepted() throws {
+        let result = InputValidator.validateUserString("Hello 世界 مرحبا", maxLength: 100)
+        #expect(result == "Hello 世界 مرحبا")
+    }
+
+    @Test func specialCharactersAreAccepted() throws {
+        let result = InputValidator.validateUserString("Hello!@#$%^&*()_+-=[]{}|;':\",./<>?", maxLength: 100)
+        #expect(result == "Hello!@#$%^&*()_+-=[]{}|;':\",./<>?")
+    }
+
+    // MARK: - Nickname Validation Tests
+
+    @Test func validNicknameIsAccepted() throws {
+        let result = InputValidator.validateNickname("Alice")
+        #expect(result == "Alice")
+    }
+
+    @Test func nicknameWithEmojiIsAccepted() throws {
+        let result = InputValidator.validateNickname("Alice 🚀")
+        #expect(result == "Alice 🚀")
+    }
+
+    @Test func nicknameTooLongIsRejected() throws {
+        let longNickname = String(repeating: "a", count: 51)
+        let result = InputValidator.validateNickname(longNickname)
+        #expect(result == nil)
+    }
+
+    @Test func nicknameAtMaxLengthIsAccepted() throws {
+        let exactNickname = String(repeating: "a", count: 50)
+        let result = InputValidator.validateNickname(exactNickname)
+        #expect(result == exactNickname)
+    }
+
+    @Test func nicknameWithControlCharacterIsRejected() throws {
+        let result = InputValidator.validateNickname("Alice\u{0000}")
+        #expect(result == nil)
+    }
+
+    // MARK: - Timestamp Validation Tests
+
+    @Test func currentTimestampIsValid() throws {
+        let now = Date()
+        let result = InputValidator.validateTimestamp(now)
+        #expect(result == true)
+    }
+
+    @Test func timestampWithinOneHourIsValid() throws {
+        let thirtyMinutesAgo = Date().addingTimeInterval(-30 * 60)
+        let result = InputValidator.validateTimestamp(thirtyMinutesAgo)
+        #expect(result == true)
+    }
+
+    @Test func timestampTwoHoursAgoIsInvalid() throws {
+        let twoHoursAgo = Date().addingTimeInterval(-2 * 3600)
+        let result = InputValidator.validateTimestamp(twoHoursAgo)
+        #expect(result == false)
+    }
+
+    @Test func timestampTwoHoursInFutureIsInvalid() throws {
+        let twoHoursFromNow = Date().addingTimeInterval(2 * 3600)
+        let result = InputValidator.validateTimestamp(twoHoursFromNow)
+        #expect(result == false)
+    }
+
+    @Test func timestampAtOneHourBoundaryIsValid() throws {
+        // Just slightly within the one-hour window
+        let almostOneHourAgo = Date().addingTimeInterval(-3599)
+        let result = InputValidator.validateTimestamp(almostOneHourAgo)
+        #expect(result == true)
+    }
+
+    // MARK: - Edge Cases
+
+    @Test func singleCharacterStringIsAccepted() throws {
+        let result = InputValidator.validateUserString("a", maxLength: 100)
+        #expect(result == "a")
+    }
+
+    @Test func stringWithOnlyNewlinesIsRejected() throws {
+        let result = InputValidator.validateUserString("\n\n\n", maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func stringWithMixedWhitespaceIsTrimmed() throws {
+        let result = InputValidator.validateUserString(" \t\nHello\n\t ", maxLength: 100)
+        #expect(result == "Hello")
+    }
+
+    @Test func stringWithLeadingControlCharacterIsRejected() throws {
+        let result = InputValidator.validateUserString("\u{0000}Hello", maxLength: 100)
+        #expect(result == nil)
+    }
+
+    @Test func stringWithTrailingControlCharacterIsRejected() throws {
+        let result = InputValidator.validateUserString("Hello\u{0000}", maxLength: 100)
+        #expect(result == nil)
+    }
+}

bitchatTests/MimeTypeTests.swift

@@ -0,0 +1,90 @@
+//
+// MimeTypeTests.swift
+// bitchatTests
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Testing
+import Foundation
+@testable import bitchat
+
+// MARK: - MimeType Mapping and Signature Tests
+
+struct MimeTypeTests {
+
+    // MARK: MIME → Enum Parsing + Default Extension
+    @Test(arguments: [
+        ("image/jpeg", MimeType.jpeg, "jpg"),
+        ("image/jpg", MimeType.jpeg, "jpg"),
+        ("image/png", MimeType.png, "png"),
+        ("image/gif", MimeType.gif, "gif"),
+        ("image/webp", MimeType.webp, "webp"),
+        ("audio/mp4", MimeType.mp4Audio, "m4a"),
+        ("audio/m4a", MimeType.m4a, "m4a"),
+        ("audio/aac", MimeType.aac, "m4a"),
+        ("audio/mpeg", MimeType.mpeg, "mp3"),
+        ("audio/mp3", MimeType.mp3, "mp3"),
+        ("audio/wav", MimeType.wav, "wav"),
+        ("audio/x-wav", MimeType.xWav, "wav"),
+        ("audio/ogg", MimeType.ogg, "ogg"),
+        ("application/pdf", MimeType.pdf, "pdf"),
+        ("application/octet-stream", MimeType.octetStream, "bin")
+    ])
+    func mimeTypeParsingAndExtensions(
+        mimeString: String,
+        expectedType: MimeType,
+        expectedExt: String
+    ) throws {
+        guard let mime = MimeType(mimeString) else {
+            Issue.record("Failed to parse \(mimeString)")
+            return
+        }
+
+        #expect(mime == expectedType, "Expected \(expectedType) for \(mimeString)")
+        #expect(mime.mimeString == expectedType.mimeString)
+        #expect(mime.defaultExtension == expectedExt)
+        #expect(mime.isAllowed)
+    }
+
+    // MARK: - File Signature Validation
+    @Test(arguments: [
+        // === Image types ===
+        (MimeType.jpeg, [0xFF, 0xD8, 0xFF]),
+        (MimeType.png,  [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+        (MimeType.gif,  [0x47, 0x49, 0x46, 0x38, 0x39, 0x61]), // "GIF89a"
+        (MimeType.webp, [0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00,
+                         0x57, 0x45, 0x42, 0x50]),             // "RIFF....WEBP"
+
+        // === Audio types ===
+        (MimeType.mp3,  [0x49, 0x44, 0x33]),                   // "ID3"
+        (MimeType.wav,  [0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00,
+                         0x57, 0x41, 0x56, 0x45]),             // "RIFF....WAVE"
+        (MimeType.ogg,  [0x4F, 0x67, 0x67, 0x53]),             // "OggS"
+
+        // === Application types ===
+        (MimeType.pdf,  [0x25, 0x50, 0x44, 0x46])              // "%PDF"
+    ])
+    func validSignatures(mime: MimeType, bytes: [UInt8]) throws {
+        let data = Data(bytes)
+        #expect(mime.matches(data: data),
+                "Expected \(mime.mimeString) to match its signature")
+    }
+
+    // MARK: - Negative Tests
+    @Test func invalidDataDoesNotMatch() throws {
+        let badData = Data(repeating: 0x00, count: 16)
+        for mime in MimeType.allCases where mime != .octetStream {
+            #expect(!mime.matches(data: badData),
+                    "Unexpectedly matched \(mime.mimeString) with zeroed data")
+        }
+    }
+
+    // MARK: - Octet-stream (generic binary)
+    @Test func octetStreamAlwaysMatches() throws {
+        let randomData = Data([0x00, 0x11, 0x22, 0x33])
+        #expect(MimeType.octetStream.matches(data: randomData),
+                "application/octet-stream should always be considered valid")
+    }
+}

bitchatTests/Mocks/MockBLEService.swift

@@ -203,10 +203,7 @@ final class MockBLEService: NSObject {
                let target = bus.service(for: recipientPeerID) {
                 target.simulateIncomingPacket(packet)
             } else {
-                // Not directly connected: deliver to neighbors for relay; also deliver directly if target is known
-                if let target = bus.service(for: recipientPeerID) {
-                    target.simulateIncomingPacket(packet)
-                }
+                // Not directly connected: deliver to neighbors for relay
                 for neighbor in neighbors() where neighbor.peerID != recipientPeerID {
                     neighbor.simulateIncomingPacket(packet)
                 }

bitchatTests/NostrProtocolTests.swift

@@ -126,7 +126,7 @@ struct NostrProtocolTests {
 
         // Build a DELIVERED ack embedded payload (geohash-style, no recipient peer ID)
         let messageID = "TEST-MSG-DELIVERED-1"
-        let senderPeerID = "0123456789abcdef" // 8-byte hex peer ID
+        let senderPeerID = PeerID(str: "0123456789abcdef") // 8-byte hex peer ID
 
         let embedded = try #require(
             NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .delivered, messageID: messageID, senderPeerID: senderPeerID),
@@ -176,7 +176,7 @@ struct NostrProtocolTests {
         let recipient = try NostrIdentity.generate()
         
         let messageID = "TEST-MSG-READ-1"
-        let senderPeerID = "fedcba9876543210" // 8-byte hex peer ID
+        let senderPeerID = PeerID(str: "fedcba9876543210") // 8-byte hex peer ID
         let embedded = try #require(
             NostrEmbeddedBitChat.encodeAckForNostrNoRecipient(type: .readReceipt, messageID: messageID, senderPeerID: senderPeerID),
             "Failed to embed read ack"

bitchatTests/Protocol/BinaryProtocolTests.swift

@@ -54,6 +54,86 @@ struct BinaryProtocolTests {
         #expect(decodedPacket.signature != nil)
         #expect(decodedPacket.signature == TestConstants.testSignature)
     }
+
+    @Test func packetWithRouteRoundTrip() throws {
+        let route: [Data] = [
+            try #require(Data(hexString: "0102030405060708")),
+            try #require(Data(hexString: "1112131415161718")),
+            try #require(Data(hexString: "2122232425262728"))
+        ]
+
+        var packet = BitchatPacket(
+            type: 0x01,
+            senderID: route[0],
+            recipientID: route.last,
+            timestamp: 1_720_000_000_000,
+            payload: Data("route-test".utf8),
+            signature: nil,
+            ttl: 6
+        )
+        packet.route = route
+
+        let encoded = try #require(BinaryProtocol.encode(packet), "Failed to encode packet with route")
+        let flagsByte = encoded[BinaryProtocol.Offsets.flags]
+        #expect((flagsByte & BinaryProtocol.Flags.hasRoute) != 0)
+
+        let decoded = try #require(BinaryProtocol.decode(encoded), "Failed to decode packet with route")
+        let decodedRoute = try #require(decoded.route)
+        #expect(decodedRoute.count == route.count)
+        for (expected, actual) in zip(route, decodedRoute) {
+            #expect(actual == expected)
+        }
+    }
+
+    @Test func packetWithRoutePadsShortHop() throws {
+        let sender = try #require(Data(hexString: "0011223344556677"))
+        let destination = try #require(Data(hexString: "8899aabbccddeeff"))
+        let shortHop = Data([0xAA, 0xBB, 0xCC])
+
+        var packet = BitchatPacket(
+            type: 0x02,
+            senderID: sender,
+            recipientID: destination,
+            timestamp: 1_730_000_000_000,
+            payload: Data("pad-test".utf8),
+            signature: nil,
+            ttl: 5
+        )
+        packet.route = [shortHop, destination]
+
+        let encoded = try #require(BinaryProtocol.encode(packet), "Failed to encode packet with short hop route")
+        let decoded = try #require(BinaryProtocol.decode(encoded), "Failed to decode packet with short hop route")
+        let decodedRoute = try #require(decoded.route)
+        let firstHop = try #require(decodedRoute.first)
+        #expect(firstHop.count == BinaryProtocol.senderIDSize)
+        #expect(firstHop.prefix(shortHop.count) == shortHop)
+        let paddingBytes = firstHop.suffix(firstHop.count - shortHop.count)
+        #expect(paddingBytes.allSatisfy { $0 == 0 })
+    }
+
+    @Test func packetWithRouteAndCompressedPayload() throws {
+        let route: [Data] = [
+            try #require(Data(hexString: "0101010101010101")),
+            try #require(Data(hexString: "0202020202020202"))
+        ]
+        let repeatedString = String(repeating: "compress-me", count: 150)
+        var packet = BitchatPacket(
+            type: 0x03,
+            senderID: route[0],
+            recipientID: route.last,
+            timestamp: 1_740_000_000_000,
+            payload: Data(repeatedString.utf8),
+            signature: nil,
+            ttl: 7
+        )
+        packet.route = route
+
+        let encoded = try #require(BinaryProtocol.encode(packet), "Failed to encode packet with route and compression")
+        let decoded = try #require(BinaryProtocol.decode(encoded), "Failed to decode packet with route and compression")
+        #expect(decoded.payload == Data(repeatedString.utf8))
+        let decodedRoute = try #require(decoded.route)
+        #expect(decodedRoute == route)
+    }
     
     // MARK: - Compression Tests
     

bitchatTests/Services/MeshTopologyTrackerTests.swift

@@ -0,0 +1,86 @@
+//
+// MeshTopologyTrackerTests.swift
+// bitchatTests
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Testing
+import Foundation
+@testable import bitchat
+
+struct MeshTopologyTrackerTests {
+    private func hex(_ value: String) throws -> Data {
+        try #require(Data(hexString: value))
+    }
+
+    @Test func directLinkProducesRoute() throws {
+        let tracker = MeshTopologyTracker()
+        let a = try hex("0102030405060708")
+        let b = try hex("1112131415161718")
+
+        tracker.recordDirectLink(between: a, and: b)
+        let route = try #require(tracker.computeRoute(from: a, to: b))
+        #expect(route == [a, b])
+    }
+
+    @Test func multiHopRouteComputation() throws {
+        let tracker = MeshTopologyTracker()
+        let a = try hex("0001020304050607")
+        let b = try hex("1011121314151617")
+        let c = try hex("2021222324252627")
+        let d = try hex("3031323334353637")
+
+        tracker.recordDirectLink(between: a, and: b)
+        tracker.recordDirectLink(between: b, and: c)
+        tracker.recordDirectLink(between: c, and: d)
+
+        let route = try #require(tracker.computeRoute(from: a, to: d))
+        #expect(route == [a, b, c, d])
+    }
+
+    @Test func recordRouteAddsEdges() throws {
+        let tracker = MeshTopologyTracker()
+        var a = Data([0xAA, 0xBB, 0xCC])
+        let b = try hex("4445464748494A4B")
+        let c = try hex("5455565758595A5B")
+
+        tracker.recordRoute([a, b, c])
+
+        a.append(Data(repeating: 0, count: BinaryProtocol.senderIDSize - a.count))
+        let route = try #require(tracker.computeRoute(from: a, to: c))
+        #expect(route.first == a)
+        #expect(route.last == c)
+    }
+
+    @Test func removingDirectLinkBreaksRoute() throws {
+        let tracker = MeshTopologyTracker()
+        let a = try hex("0101010101010101")
+        let b = try hex("0202020202020202")
+        let c = try hex("0303030303030303")
+
+        tracker.recordDirectLink(between: a, and: b)
+        tracker.recordDirectLink(between: b, and: c)
+        let initialRoute = try #require(tracker.computeRoute(from: a, to: c))
+        #expect(initialRoute == [a, b, c])
+
+        tracker.removeDirectLink(between: b, and: c)
+        #expect(tracker.computeRoute(from: a, to: c) == nil)
+    }
+
+    @Test func removingPeerClearsEdges() throws {
+        let tracker = MeshTopologyTracker()
+        let a = try hex("0F0E0D0C0B0A0908")
+        let b = try hex("0A0B0C0D0E0F0001")
+        let c = try hex("0011223344556677")
+
+        tracker.recordRoute([a, b, c])
+        let initialRoute = try #require(tracker.computeRoute(from: a, to: c))
+        #expect(initialRoute == [a, b, c])
+
+        tracker.removePeer(b)
+        #expect(tracker.computeRoute(from: a, to: c) == nil)
+    }
+
+}

bitchatTests/Utils/PeerIDTests.swift

@@ -217,7 +217,27 @@ struct PeerIDTests {
         let short = peerID.toShort()
         #expect(short == peerID)
     }
-    
+
+    @Test func routingData_fromShortID() throws {
+        let peerID = PeerID(str: hex16)
+        let routing = try #require(peerID.routingData)
+        #expect(routing.count == 8)
+        #expect(routing == Data(hexString: hex16))
+    }
+
+    @Test func routingData_fromNoiseKey() throws {
+        let peerID = PeerID(str: hex64)
+        let routing = try #require(peerID.routingData)
+        let expectedShort = peerID.toShort()
+        #expect(routing == Data(hexString: expectedShort.id))
+    }
+
+    @Test func routingPeerRoundTrip() throws {
+        let raw = try #require(Data(hexString: hex16))
+        let peerID = try #require(PeerID(routingData: raw))
+        #expect(peerID.routingData == raw)
+    }
+
     // MARK: - Codable
 
     @Test func codable_emptyPrefix() throws {
@@ -273,7 +293,7 @@ struct PeerIDTests {
     @Test func comparable_sorting_and_equality() {
         let p1 = PeerID(str: "aaa")
         let p2 = PeerID(str: "bbb")
-        let p3 = PeerID(str: "bbb")
+        let p3 = PeerID(str: "BBB")
         
         #expect(p1 < p2)
         #expect(p2 >= p1)
@@ -284,44 +304,18 @@ struct PeerIDTests {
     }
     
     @Test func equality() {
-        let string = "aaa"
-        let peerID = PeerID(str: string)
-        let badString = "bbb"
-        
-        // PeerID == String
-        #expect(peerID == string)
-        #expect(peerID == Optional(string))
-        #expect(Optional(peerID) == string)
-        #expect(Optional(peerID) == Optional(string))
-
-        // PeerID != String
-        #expect(peerID != badString)
-        #expect(peerID != Optional(badString))
-        #expect(Optional(peerID) != badString)
-        #expect(Optional(peerID) != Optional(badString))
-        
-        // String == PeerID
-        #expect(string == peerID)
-        #expect(Optional(string) == peerID)
-        #expect(string == Optional(peerID))
-        #expect(Optional(string) == Optional(peerID))
-
-        // String != PeerID
-        #expect(badString != peerID)
-        #expect(Optional(badString) != peerID)
-        #expect(badString != Optional(peerID))
-        #expect(Optional(badString) != Optional(peerID))
+        let peerID = PeerID(str: "aaa")
         
         // Regular PeerID <> PeerID
-        #expect(peerID == PeerID(str: "aaa"))
-        #expect(peerID == Optional(PeerID(str: "aaa")))
-        #expect(PeerID(str: "aaa") == peerID)
-        #expect(Optional(PeerID(str: "aaa")) == Optional(peerID))
+        #expect(peerID == PeerID(str: "AAA"))
+        #expect(peerID == Optional(PeerID(str: "AAA")))
+        #expect(PeerID(str: "AAA") == peerID)
+        #expect(Optional(PeerID(str: "AAA")) == Optional(peerID))
         
-        #expect(peerID != PeerID(str: "bbb"))
-        #expect(peerID != Optional(PeerID(str: "bbb")))
-        #expect(PeerID(str: "bbb") != peerID)
-        #expect(Optional(PeerID(str: "bbb")) != Optional(peerID))
+        #expect(peerID != PeerID(str: "BBB"))
+        #expect(peerID != Optional(PeerID(str: "BBB")))
+        #expect(PeerID(str: "BBB") != peerID)
+        #expect(Optional(PeerID(str: "BBB")) != Optional(peerID))
     }
     
     // MARK: - Computed properties

localPackages/BitLogger/Package.swift

@@ -18,6 +18,10 @@ let package = Package(
         .target(
             name: "BitLogger",
             path: "Sources"
+        ),
+        .testTarget(
+            name: "BitLoggerTests",
+            dependencies: ["BitLogger"]
         )
     ]
 )

localPackages/BitLogger/Sources/SecureLogger.swift

@@ -68,22 +68,6 @@ public final class SecureLogger {
         return formatter
     }()
     
-    // MARK: - Cached Regex Patterns
-    
-    private static let fingerprintPattern = #/[a-fA-F0-9]{64}/#
-    private static let base64Pattern = #/[A-Za-z0-9+/]{40,}={0,2}/#
-    private static let passwordPattern = #/password["\s:=]+["']?[^"'\s]+["']?/#
-    private static let peerIDPattern = #/peerID: ([a-zA-Z0-9]{8})[a-zA-Z0-9]+/#
-    
-    // MARK: - Sanitization Cache
-    
-    private static let sanitizationCache: NSCache<NSString, NSString> = {
-        let cache = NSCache<NSString, NSString>()
-        cache.countLimit = 100 // Keep last 100 sanitized strings
-        return cache
-    }()
-    private static let cacheQueue = DispatchQueue(label: "chat.bitchat.securelogger.cache", attributes: .concurrent)
-    
     // MARK: - Log Levels
     
     enum LogLevel {
@@ -161,8 +145,8 @@ public extension SecureLogger {
     static func error(_ error: Error, context: @autoclosure () -> String, category: OSLog = .noise,
                       file: String = #file, line: Int = #line, function: String = #function) {
         let location = formatLocation(file: file, line: line, function: function)
-        let sanitized = sanitize(context())
-        let errorDesc = sanitize(error.localizedDescription)
+        let sanitized = context().sanitized()
+        let errorDesc = error.localizedDescription.sanitized()
         
         #if DEBUG
         os_log("%{public}@ Error in %{public}@: %{public}@", log: category, type: .error, location, sanitized, errorDesc)
@@ -186,15 +170,15 @@ public extension SecureLogger {
         var message: String {
             switch self {
             case .handshakeStarted(let peerID):
-                return "Handshake started with peer: \(sanitize(peerID))"
+                return "Handshake started with peer: \(peerID.sanitized())"
             case .handshakeCompleted(let peerID):
-                return "Handshake completed with peer: \(sanitize(peerID))"
+                return "Handshake completed with peer: \(peerID.sanitized())"
             case .handshakeFailed(let peerID, let error):
-                return "Handshake failed with peer: \(sanitize(peerID)), error: \(error)"
+                return "Handshake failed with peer: \(peerID.sanitized()), error: \(error)"
             case .sessionExpired(let peerID):
-                return "Session expired for peer: \(sanitize(peerID))"
+                return "Session expired for peer: \(peerID.sanitized())"
             case .authenticationFailed(let peerID):
-                return "Authentication failed for peer: \(sanitize(peerID))"
+                return "Authentication failed for peer: \(peerID.sanitized())"
             }
         }
     }
@@ -249,7 +233,7 @@ private extension SecureLogger {
                     file: String, line: Int, function: String) {
         guard shouldLog(level) else { return }
         let location = formatLocation(file: file, line: line, function: function)
-        let sanitized = sanitize("\(location) \(message())")
+        let sanitized = "\(location) \(message())".sanitized()
         
         #if DEBUG
         os_log("%{public}@", log: category, type: level.osLogType, sanitized)
@@ -282,58 +266,6 @@ private extension SecureLogger {
         let timestamp = timestampFormatter.string(from: Date())
         return "[\(timestamp)] [\(fileName):\(line) \(function)]"
     }
-    
-    /// Sanitize strings to remove potentially sensitive data
-    static func sanitize(_ input: String) -> String {
-        let key = input as NSString
-        
-        // Check cache first
-        var cachedValue: String?
-        cacheQueue.sync {
-            cachedValue = sanitizationCache.object(forKey: key) as String?
-        }
-        
-        if let cached = cachedValue {
-            return cached
-        }
-        
-        // Perform sanitization
-        var sanitized = input
-        
-        // Remove full fingerprints (keep first 8 chars for debugging)
-        sanitized = sanitized.replacing(fingerprintPattern) { match in
-            let fingerprint = String(match.output)
-            return String(fingerprint.prefix(8)) + "..."
-        }
-        
-        // Remove base64 encoded data that might be keys
-        sanitized = sanitized.replacing(base64Pattern) { _ in
-            "<base64-data>"
-        }
-        
-        // Remove potential passwords (assuming they're in quotes or after "password:")
-        sanitized = sanitized.replacing(passwordPattern) { _ in
-            "password: <redacted>"
-        }
-        
-        // Truncate peer IDs to first 8 characters
-        sanitized = sanitized.replacing(peerIDPattern) { match in
-            "peerID: \(match.1)..."
-        }
-        
-        // Cache the result
-        cacheQueue.sync {
-            sanitizationCache.setObject(sanitized as NSString, forKey: key)
-        }
-        
-        return sanitized
-    }
-    
-    /// Sanitize individual values
-    static func sanitize<T>(_ value: T) -> String {
-        let stringValue = String(describing: value)
-        return sanitize(stringValue)
-    }
 }
 
 // MARK: - Migration Helper

localPackages/BitLogger/Sources/String+Sanitization.swift

@@ -0,0 +1,67 @@
+//
+// String+Sanitization.swift
+// BitLogger
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import Foundation
+
+extension String {
+    /// Sanitize strings to remove potentially sensitive data
+    func sanitized() -> String {
+        let key = self as NSString
+        
+        // Check cache first
+        if let cached = Self.queue.sync(execute: { Self.cache.object(forKey: key) }) {
+            return cached as String
+        }
+        
+        var sanitized = self
+        
+        // Remove full fingerprints (keep first 8 chars for debugging)
+        let fingerprintPattern = #/[a-fA-F0-9]{64}/#
+        sanitized = sanitized.replacing(fingerprintPattern) { match in
+            let fingerprint = String(match.output)
+            return String(fingerprint.prefix(8)) + "..."
+        }
+        
+        // Remove base64 encoded data that might be keys
+        let base64Pattern = #/[A-Za-z0-9+/]{40,}={0,2}/#
+        sanitized = sanitized.replacing(base64Pattern) { _ in
+            "<base64-data>"
+        }
+        
+        // Remove potential passwords (assuming they're in quotes or after "password:")
+        let passwordPattern = #/password["\s:=]+["']?[^"'\s]+["']?/#
+        sanitized = sanitized.replacing(passwordPattern) { _ in
+            "password: <redacted>"
+        }
+        
+        // Truncate peer IDs to first 8 characters
+        let peerIDPattern = #/peerID: ([a-zA-Z0-9]{8})[a-zA-Z0-9]+/#
+        sanitized = sanitized.replacing(peerIDPattern) { match in
+            "peerID: \(match.1)..."
+        }
+        
+        // Cache the result
+        Self.queue.sync {
+            Self.cache.setObject(sanitized as NSString, forKey: key)
+        }
+        
+        return sanitized
+    }
+}
+
+// MARK: - Cache Helpers
+
+private extension String {
+    static let queue = DispatchQueue(label: "chat.bitchat.securelogger.cache", attributes: .concurrent)
+
+    static let cache: NSCache<NSString, NSString> = {
+        let cache = NSCache<NSString, NSString>()
+        cache.countLimit = 100 // Keep last 100 sanitized strings
+        return cache
+    }()
+}

localPackages/BitLogger/Tests/StringSanitizationTests.swift

@@ -0,0 +1,143 @@
+//
+//  StringSanitizationTests.swift
+//  BitLogger
+//
+//  Created by Islam on 19/10/2025.
+//
+
+import Testing
+@testable import BitLogger
+
+struct StringSanitizationTests {
+    
+    @Test("64-hex fingerprint is truncated to first 8 chars followed by ellipsis")
+    func fingerprintTruncation() async throws {
+        let fingerprint = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+        #expect(fingerprint.count == 64)
+        
+        let input = "fingerprint=\(fingerprint)"
+        let output = input.sanitized()
+        
+        #expect(output.contains("fingerprint=01234567..."))
+        // Ensure no full fingerprint remains
+        #expect(output.contains(fingerprint) == false)
+    }
+    
+    @Test("Multiple fingerprints in a string are all truncated")
+    func multipleFingerprintTruncation() async throws {
+        let fp1 = String(repeating: "a", count: 64)
+        let fp2 = String(repeating: "b", count: 64)
+        let input = "fp1=\(fp1) fp2=\(fp2)"
+        let output = input.sanitized()
+        #expect(output.contains("fp1=aaaaaaaa..."))
+        #expect(output.contains("fp2=bbbbbbbb..."))
+        #expect(output.contains(fp1) == false)
+        #expect(output.contains(fp2) == false)
+    }
+    
+    @Test("Base64-like long data is replaced with <base64-data>")
+    func base64Replacement() async throws {
+        // 44+ chars of base64 characters
+        let base64ish = "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo5ODc2NTQzMjE="
+        let input = "payload=\(base64ish)"
+        let output = input.sanitized()
+        #expect(output == "payload=<base64-data>")
+    }
+    
+    @Test("Base64-like without padding is replaced with <base64-data>")
+    func base64NoPaddingReplacement() async throws {
+        let base64ish = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+        #expect(base64ish.count >= 40)
+        let input = "b64:\(base64ish)"
+        let output = input.sanitized()
+        #expect(output == "b64:<base64-data>")
+    }
+    
+    @Test("Short base64-like strings (below threshold) are not replaced")
+    func shortBase64NotReplaced() async throws {
+        let short = "QUJDREVGR0hJSktMTU5P" // < 40 chars
+        let input = "payload=\(short)"
+        let output = input.sanitized()
+        #expect(output == input)
+    }
+    
+    @Test("Password redaction for key:value formats", arguments: [
+        "password: secret123",
+        "password=secret123",
+        "password = secret123",
+        "password: 'secret123'",
+        "password:\"secret123\"",
+        "password='secret123'"
+    ])
+    func passwordRedactionKeyValue(password: String) async throws {
+        #expect(password.sanitized() == "password: <redacted>")
+    }
+    
+    @Test("Password redaction inside wider messages")
+    func passwordRedactionInContext() async throws {
+        let input = "user=john password: 'p@ssW0rd' attempt=1"
+        let output = input.sanitized()
+        #expect(output == "user=john password: <redacted> attempt=1")
+    }
+    
+    @Test("PeerID is truncated to first 8 chars followed by ellipsis")
+    func peerIDTruncation() async throws {
+        let peer = "ABCDEF12GHIJKL34"
+        let input = "peerID: \(peer)"
+        let output = input.sanitized()
+        #expect(output == "peerID: ABCDEF12...")
+    }
+    
+    @Test("PeerID not truncated when exactly 8 chars")
+    func peerIDExactlyEightNotTruncated() async throws {
+        let peer = "ABCDEF12"
+        let input = "peerID: \(peer)"
+        let output = input.sanitized()
+        // Pattern only matches when there are more than 8 trailing chars, so unchanged
+        #expect(output == input)
+    }
+    
+    @Test("Non-matching content remains unchanged")
+    func nonMatchingUnchanged() async throws {
+        let input = "Hello world 123 - nothing sensitive here."
+        let output = input.sanitized()
+        #expect(output == input)
+    }
+    
+    @Test("Idempotency: sanitizing twice yields same result")
+    func idempotentSanitization() async throws {
+        let input = """
+        fingerprint=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
+        password: "superSecret" \
+        peerID: ZYXWVUT987654321 \
+        payload=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
+        """
+        let once = input.sanitized()
+        let twice = once.sanitized()
+        #expect(once == twice)
+    }
+    
+    @Test("Mixed content: all rules apply in a single string")
+    func mixedContent() async throws {
+        let fingerprint = "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"
+        let base64ish = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+        let peer = "PEERID01EXTRA"
+        let input = "fp=\(fingerprint) password='x' peerID: \(peer) data=\(base64ish)"
+        let output = input.sanitized()
+        #expect(output.contains("fp=fedcba98..."))
+        #expect(output.contains("password: <redacted>"))
+        #expect(output.contains("peerID: PEERID01..."))
+        #expect(output.contains("data=<base64-data>"))
+        #expect(output.contains(fingerprint) == false)
+        #expect(output.contains(base64ish) == false)
+    }
+    
+    @Test("Cache returns consistent result for repeated inputs")
+    func cacheHitConsistency() async throws {
+        let input = "password: hunter2"
+        let first = input.sanitized()
+        let second = input.sanitized()
+        #expect(first == "password: <redacted>")
+        #expect(first == second)
+    }
+}

localPackages/Tor/Frameworks/tor-nolzma.xcframework/Info.plist

@@ -8,7 +8,7 @@
 			<key>BinaryPath</key>
 			<string>tor-nolzma.framework/tor-nolzma</string>
 			<key>LibraryIdentifier</key>
-			<string>macos-arm64</string>
+			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>tor-nolzma.framework</string>
 			<key>SupportedArchitectures</key>
@@ -16,7 +16,7 @@
 				<string>arm64</string>
 			</array>
 			<key>SupportedPlatform</key>
-			<string>macos</string>
+			<string>ios</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
@@ -36,9 +36,9 @@
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
-			<string>tor-nolzma.framework/tor-nolzma</string>
+			<string>tor-nolzma.framework/Versions/A/tor-nolzma</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64</string>
+			<string>macos-arm64</string>
 			<key>LibraryPath</key>
 			<string>tor-nolzma.framework</string>
 			<key>SupportedArchitectures</key>
@@ -46,7 +46,7 @@
 				<string>arm64</string>
 			</array>
 			<key>SupportedPlatform</key>
-			<string>ios</string>
+			<string>macos</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/app/config/or_options_st.h

@@ -203,6 +203,10 @@ struct or_options_t {
   /** Above this value, consider ourselves low on RAM. */
   uint64_t MaxMemInQueues_low_threshold;
 
+  uint64_t MaxHSDirCacheBytes;/**< If we have more memory than this allocated
+                                * for the hidden service directory cache,
+                                * run the HS cache OOM handler */
+
   /** @name port booleans
    *
    * Derived booleans: For server ports and ControlPort, true iff there is a

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/core/or/channelpadding.h

@@ -1,7 +1,7 @@
 /* Copyright (c) 2001 Matej Pfajfar.
  * Copyright (c) 2001-2004, Roger Dingledine.
  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2021, The Tor Project, Inc. */
+ * Copyright (c) 2007-2025, The Tor Project, Inc. */
 /* See LICENSE for licensing information */
 
 /**
@@ -39,4 +39,6 @@ int channelpadding_get_circuits_available_timeout(void);
 unsigned int channelpadding_get_channel_idle_timeout(const channel_t *, int);
 void channelpadding_new_consensus_params(const networkstatus_t *ns);
 
+void channelpadding_log_heartbeat(void);
+
 #endif /* !defined(TOR_CHANNELPADDING_H) */

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/core/or/edge_connection_st.h

@@ -88,6 +88,18 @@ struct edge_connection_t {
    * for this edge, used to compute advisory rates */
   uint64_t drain_start_usec;
 
+  /**
+   * Monotime timestamp of when we started the XOFF grace period for this edge.
+   *
+   * See the comments on `XOFF_GRACE_PERIOD_USEC` for an explanation on how
+   * this is used.
+   *
+   * A value of 0 is considered "unset". This isn't great, but we set this
+   * field as the output from `monotime_absolute_usec()` which should only ever
+   * be 0 within the first 1 microsecond of initializing the monotonic timer
+   * subsystem. */
+  uint64_t xoff_grace_period_start_usec;
+
   /**
    * Number of bytes written since we either emptied our buffers,
    * or sent an advisory drate rate. Can wrap, buf if so,

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/feature/hs/hs_cache.h

@@ -122,6 +122,7 @@ void hs_cache_client_intro_state_purge(void);
 
 bool hs_cache_client_new_auth_parse(const ed25519_public_key_t *service_pk);
 
+uint64_t hs_cache_get_max_bytes(void);
 size_t hs_cache_get_total_allocation(void);
 void hs_cache_decrement_allocation(size_t n);
 void hs_cache_increment_allocation(size_t n);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/lib/cc/orconfig.h

@@ -7,12 +7,12 @@
 /* All assert failures are fatal */
 /* #undef ALL_BUGS_ARE_FATAL */
 
-/* # for 0.4.8.17 Approximate date when this software was released. (Updated
+/* # for 0.4.8.19 Approximate date when this software was released. (Updated
    when the version changes.) */
-#define APPROX_RELEASE_DATE "2025-06-30"
+#define APPROX_RELEASE_DATE "2025-10-06"
 
 /* tor's build directory */
-#define BUILDDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define BUILDDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Compiler name */
 #define COMPILER /**/
@@ -24,10 +24,10 @@
 #define COMPILER_VERSION "17.0.0"
 
 /* tor's configuration directory */
-#define CONFDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
+#define CONFDIR "/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
 
 /* Flags passed to configure */
-#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CFLAGS=-Os -ffunction-sections -fdata-sections -miphonesimulator-version-min=12.0 CPPFLAGS= -Isrc/core -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 LDFLAGS=-lz  LZMA_CFLAGS=-I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/include LZMA_LIBS=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/lib/liblzma.a cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
+#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk -Os -ffunction-sections -fdata-sections CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk CPPFLAGS=-Isrc/core -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 -Os -ffunction-sections -fdata-sections LDFLAGS=-lz cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
 
 /* Enable smartlist debugging */
 /* #undef DEBUG_SMARTLIST */
@@ -720,7 +720,7 @@
 #define PACKAGE_NAME "tor"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "tor 0.4.8.17"
+#define PACKAGE_STRING "tor 0.4.8.19"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "tor"
@@ -729,7 +729,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "0.4.8.17"
+#define PACKAGE_VERSION "0.4.8.19"
 
 /* How to access the PC from a struct ucontext */
 /* #undef PC_FROM_UCONTEXT */
@@ -780,7 +780,7 @@
 #define SIZEOF___INT64 0
 
 /* tor's sourcedir directory */
-#define SRCDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define SRCDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Set to 1 if we can compile a simple stdatomic example. */
 #define STDATOMIC_WORKS 1
@@ -908,7 +908,7 @@
 #define USING_TWOS_COMPLEMENT 1
 
 /* Version number of package */
-#define VERSION "0.4.8.17"
+#define VERSION "0.4.8.19"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/lib/time/compat_time.h

@@ -1,6 +1,6 @@
 /* Copyright (c) 2003-2004, Roger Dingledine
  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2021, The Tor Project, Inc. */
+ * Copyright (c) 2007-2025, The Tor Project, Inc. */
 /* See LICENSE for licensing information */
 
 /**
@@ -361,9 +361,9 @@ monotime_coarse_diff_msec32(const monotime_coarse_t *start,
 #endif /* SIZEOF_VOID_P == 8 */
 }
 
-#ifdef TOR_UNIT_TESTS
 void tor_sleep_msec(int msec);
 
+#ifdef TOR_UNIT_TESTS
 void monotime_enable_test_mocking(void);
 void monotime_disable_test_mocking(void);
 void monotime_set_mock_time_nsec(int64_t);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/asn1.h

@@ -144,7 +144,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_ALGOR, X509_ALGOR, X509_ALGOR)
 #define sk_X509_ALGOR_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr))
 #define sk_X509_ALGOR_pop(sk) ((X509_ALGOR *)OPENSSL_sk_pop(ossl_check_X509_ALGOR_sk_type(sk)))
 #define sk_X509_ALGOR_shift(sk) ((X509_ALGOR *)OPENSSL_sk_shift(ossl_check_X509_ALGOR_sk_type(sk)))
-#define sk_X509_ALGOR_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ALGOR_sk_type(sk),ossl_check_X509_ALGOR_freefunc_type(freefunc))
+#define sk_X509_ALGOR_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_freefunc_type(freefunc))
 #define sk_X509_ALGOR_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr), (idx))
 #define sk_X509_ALGOR_set(sk, idx, ptr) ((X509_ALGOR *)OPENSSL_sk_set(ossl_check_X509_ALGOR_sk_type(sk), (idx), ossl_check_X509_ALGOR_type(ptr)))
 #define sk_X509_ALGOR_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr))
@@ -246,7 +246,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_STRING_TABLE, ASN1_STRING_TABLE, ASN1_STRING_T
 #define sk_ASN1_STRING_TABLE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr))
 #define sk_ASN1_STRING_TABLE_pop(sk) ((ASN1_STRING_TABLE *)OPENSSL_sk_pop(ossl_check_ASN1_STRING_TABLE_sk_type(sk)))
 #define sk_ASN1_STRING_TABLE_shift(sk) ((ASN1_STRING_TABLE *)OPENSSL_sk_shift(ossl_check_ASN1_STRING_TABLE_sk_type(sk)))
-#define sk_ASN1_STRING_TABLE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_TABLE_sk_type(sk),ossl_check_ASN1_STRING_TABLE_freefunc_type(freefunc))
+#define sk_ASN1_STRING_TABLE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_freefunc_type(freefunc))
 #define sk_ASN1_STRING_TABLE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr), (idx))
 #define sk_ASN1_STRING_TABLE_set(sk, idx, ptr) ((ASN1_STRING_TABLE *)OPENSSL_sk_set(ossl_check_ASN1_STRING_TABLE_sk_type(sk), (idx), ossl_check_ASN1_STRING_TABLE_type(ptr)))
 #define sk_ASN1_STRING_TABLE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr))
@@ -259,7 +259,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_STRING_TABLE, ASN1_STRING_TABLE, ASN1_STRING_T
 #define sk_ASN1_STRING_TABLE_set_cmp_func(sk, cmp) ((sk_ASN1_STRING_TABLE_compfunc)OPENSSL_sk_set_cmp_func(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_compfunc_type(cmp)))
 
 
-/* size limits: this stuff is taken straight from RFC2459 */
+/* size limits: this stuff is taken straight from RFC 5280 */
 
 # define ub_name                         32768
 # define ub_common_name                  64
@@ -567,7 +567,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_TYPE, ASN1_TYPE, ASN1_TYPE)
 #define sk_ASN1_TYPE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr))
 #define sk_ASN1_TYPE_pop(sk) ((ASN1_TYPE *)OPENSSL_sk_pop(ossl_check_ASN1_TYPE_sk_type(sk)))
 #define sk_ASN1_TYPE_shift(sk) ((ASN1_TYPE *)OPENSSL_sk_shift(ossl_check_ASN1_TYPE_sk_type(sk)))
-#define sk_ASN1_TYPE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_TYPE_sk_type(sk),ossl_check_ASN1_TYPE_freefunc_type(freefunc))
+#define sk_ASN1_TYPE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_freefunc_type(freefunc))
 #define sk_ASN1_TYPE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr), (idx))
 #define sk_ASN1_TYPE_set(sk, idx, ptr) ((ASN1_TYPE *)OPENSSL_sk_set(ossl_check_ASN1_TYPE_sk_type(sk), (idx), ossl_check_ASN1_TYPE_type(ptr)))
 #define sk_ASN1_TYPE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr))
@@ -647,7 +647,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_OBJECT, ASN1_OBJECT, ASN1_OBJECT)
 #define sk_ASN1_OBJECT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr))
 #define sk_ASN1_OBJECT_pop(sk) ((ASN1_OBJECT *)OPENSSL_sk_pop(ossl_check_ASN1_OBJECT_sk_type(sk)))
 #define sk_ASN1_OBJECT_shift(sk) ((ASN1_OBJECT *)OPENSSL_sk_shift(ossl_check_ASN1_OBJECT_sk_type(sk)))
-#define sk_ASN1_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_OBJECT_sk_type(sk),ossl_check_ASN1_OBJECT_freefunc_type(freefunc))
+#define sk_ASN1_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_freefunc_type(freefunc))
 #define sk_ASN1_OBJECT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr), (idx))
 #define sk_ASN1_OBJECT_set(sk, idx, ptr) ((ASN1_OBJECT *)OPENSSL_sk_set(ossl_check_ASN1_OBJECT_sk_type(sk), (idx), ossl_check_ASN1_OBJECT_type(ptr)))
 #define sk_ASN1_OBJECT_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr))
@@ -713,7 +713,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_INTEGER, ASN1_INTEGER, ASN1_INTEGER)
 #define sk_ASN1_INTEGER_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr))
 #define sk_ASN1_INTEGER_pop(sk) ((ASN1_INTEGER *)OPENSSL_sk_pop(ossl_check_ASN1_INTEGER_sk_type(sk)))
 #define sk_ASN1_INTEGER_shift(sk) ((ASN1_INTEGER *)OPENSSL_sk_shift(ossl_check_ASN1_INTEGER_sk_type(sk)))
-#define sk_ASN1_INTEGER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_INTEGER_sk_type(sk),ossl_check_ASN1_INTEGER_freefunc_type(freefunc))
+#define sk_ASN1_INTEGER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_freefunc_type(freefunc))
 #define sk_ASN1_INTEGER_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr), (idx))
 #define sk_ASN1_INTEGER_set(sk, idx, ptr) ((ASN1_INTEGER *)OPENSSL_sk_set(ossl_check_ASN1_INTEGER_sk_type(sk), (idx), ossl_check_ASN1_INTEGER_type(ptr)))
 #define sk_ASN1_INTEGER_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr))
@@ -775,7 +775,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_UTF8STRING, ASN1_UTF8STRING, ASN1_UTF8STRING)
 #define sk_ASN1_UTF8STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr))
 #define sk_ASN1_UTF8STRING_pop(sk) ((ASN1_UTF8STRING *)OPENSSL_sk_pop(ossl_check_ASN1_UTF8STRING_sk_type(sk)))
 #define sk_ASN1_UTF8STRING_shift(sk) ((ASN1_UTF8STRING *)OPENSSL_sk_shift(ossl_check_ASN1_UTF8STRING_sk_type(sk)))
-#define sk_ASN1_UTF8STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(sk),ossl_check_ASN1_UTF8STRING_freefunc_type(freefunc))
+#define sk_ASN1_UTF8STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_freefunc_type(freefunc))
 #define sk_ASN1_UTF8STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr), (idx))
 #define sk_ASN1_UTF8STRING_set(sk, idx, ptr) ((ASN1_UTF8STRING *)OPENSSL_sk_set(ossl_check_ASN1_UTF8STRING_sk_type(sk), (idx), ossl_check_ASN1_UTF8STRING_type(ptr)))
 #define sk_ASN1_UTF8STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr))
@@ -812,7 +812,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_GENERALSTRING, ASN1_GENERALSTRING, ASN1_GENERA
 #define sk_ASN1_GENERALSTRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr))
 #define sk_ASN1_GENERALSTRING_pop(sk) ((ASN1_GENERALSTRING *)OPENSSL_sk_pop(ossl_check_ASN1_GENERALSTRING_sk_type(sk)))
 #define sk_ASN1_GENERALSTRING_shift(sk) ((ASN1_GENERALSTRING *)OPENSSL_sk_shift(ossl_check_ASN1_GENERALSTRING_sk_type(sk)))
-#define sk_ASN1_GENERALSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_GENERALSTRING_sk_type(sk),ossl_check_ASN1_GENERALSTRING_freefunc_type(freefunc))
+#define sk_ASN1_GENERALSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_freefunc_type(freefunc))
 #define sk_ASN1_GENERALSTRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr), (idx))
 #define sk_ASN1_GENERALSTRING_set(sk, idx, ptr) ((ASN1_GENERALSTRING *)OPENSSL_sk_set(ossl_check_ASN1_GENERALSTRING_sk_type(sk), (idx), ossl_check_ASN1_GENERALSTRING_type(ptr)))
 #define sk_ASN1_GENERALSTRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/asn1t.h

@@ -909,7 +909,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_VALUE, ASN1_VALUE, ASN1_VALUE)
 #define sk_ASN1_VALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr))
 #define sk_ASN1_VALUE_pop(sk) ((ASN1_VALUE *)OPENSSL_sk_pop(ossl_check_ASN1_VALUE_sk_type(sk)))
 #define sk_ASN1_VALUE_shift(sk) ((ASN1_VALUE *)OPENSSL_sk_shift(ossl_check_ASN1_VALUE_sk_type(sk)))
-#define sk_ASN1_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_VALUE_sk_type(sk),ossl_check_ASN1_VALUE_freefunc_type(freefunc))
+#define sk_ASN1_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_freefunc_type(freefunc))
 #define sk_ASN1_VALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr), (idx))
 #define sk_ASN1_VALUE_set(sk, idx, ptr) ((ASN1_VALUE *)OPENSSL_sk_set(ossl_check_ASN1_VALUE_sk_type(sk), (idx), ossl_check_ASN1_VALUE_type(ptr)))
 #define sk_ASN1_VALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/bio.h

@@ -348,7 +348,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(BIO, BIO, BIO)
 #define sk_BIO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr))
 #define sk_BIO_pop(sk) ((BIO *)OPENSSL_sk_pop(ossl_check_BIO_sk_type(sk)))
 #define sk_BIO_shift(sk) ((BIO *)OPENSSL_sk_shift(ossl_check_BIO_sk_type(sk)))
-#define sk_BIO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_BIO_sk_type(sk),ossl_check_BIO_freefunc_type(freefunc))
+#define sk_BIO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_BIO_sk_type(sk), ossl_check_BIO_freefunc_type(freefunc))
 #define sk_BIO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr), (idx))
 #define sk_BIO_set(sk, idx, ptr) ((BIO *)OPENSSL_sk_set(ossl_check_BIO_sk_type(sk), (idx), ossl_check_BIO_type(ptr)))
 #define sk_BIO_find(sk, ptr) OPENSSL_sk_find(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cmp.h

@@ -234,7 +234,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTSTATUS, OSSL_CMP_CERTSTATUS, OSSL_CMP_
 #define sk_OSSL_CMP_CERTSTATUS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr))
 #define sk_OSSL_CMP_CERTSTATUS_pop(sk) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk)))
 #define sk_OSSL_CMP_CERTSTATUS_shift(sk) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk)))
-#define sk_OSSL_CMP_CERTSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk),ossl_check_OSSL_CMP_CERTSTATUS_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTSTATUS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTSTATUS_set(sk, idx, ptr) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr)))
 #define sk_OSSL_CMP_CERTSTATUS_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr))
@@ -263,7 +263,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_ITAV, OSSL_CMP_ITAV, OSSL_CMP_ITAV)
 #define sk_OSSL_CMP_ITAV_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr))
 #define sk_OSSL_CMP_ITAV_pop(sk) ((OSSL_CMP_ITAV *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_ITAV_sk_type(sk)))
 #define sk_OSSL_CMP_ITAV_shift(sk) ((OSSL_CMP_ITAV *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_ITAV_sk_type(sk)))
-#define sk_OSSL_CMP_ITAV_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(sk),ossl_check_OSSL_CMP_ITAV_freefunc_type(freefunc))
+#define sk_OSSL_CMP_ITAV_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_freefunc_type(freefunc))
 #define sk_OSSL_CMP_ITAV_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr), (idx))
 #define sk_OSSL_CMP_ITAV_set(sk, idx, ptr) ((OSSL_CMP_ITAV *)OPENSSL_sk_set(ossl_check_OSSL_CMP_ITAV_sk_type(sk), (idx), ossl_check_OSSL_CMP_ITAV_type(ptr)))
 #define sk_OSSL_CMP_ITAV_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr))
@@ -292,7 +292,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CRLSTATUS, OSSL_CMP_CRLSTATUS, OSSL_CMP_CR
 #define sk_OSSL_CMP_CRLSTATUS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr))
 #define sk_OSSL_CMP_CRLSTATUS_pop(sk) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk)))
 #define sk_OSSL_CMP_CRLSTATUS_shift(sk) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk)))
-#define sk_OSSL_CMP_CRLSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk),ossl_check_OSSL_CMP_CRLSTATUS_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CRLSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CRLSTATUS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr), (idx))
 #define sk_OSSL_CMP_CRLSTATUS_set(sk, idx, ptr) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), (idx), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr)))
 #define sk_OSSL_CMP_CRLSTATUS_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr))
@@ -334,7 +334,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_PKISI, OSSL_CMP_PKISI, OSSL_CMP_PKISI)
 #define sk_OSSL_CMP_PKISI_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr))
 #define sk_OSSL_CMP_PKISI_pop(sk) ((OSSL_CMP_PKISI *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_PKISI_sk_type(sk)))
 #define sk_OSSL_CMP_PKISI_shift(sk) ((OSSL_CMP_PKISI *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_PKISI_sk_type(sk)))
-#define sk_OSSL_CMP_PKISI_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_PKISI_sk_type(sk),ossl_check_OSSL_CMP_PKISI_freefunc_type(freefunc))
+#define sk_OSSL_CMP_PKISI_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_freefunc_type(freefunc))
 #define sk_OSSL_CMP_PKISI_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr), (idx))
 #define sk_OSSL_CMP_PKISI_set(sk, idx, ptr) ((OSSL_CMP_PKISI *)OPENSSL_sk_set(ossl_check_OSSL_CMP_PKISI_sk_type(sk), (idx), ossl_check_OSSL_CMP_PKISI_type(ptr)))
 #define sk_OSSL_CMP_PKISI_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr))
@@ -362,7 +362,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTREPMESSAGE, OSSL_CMP_CERTREPMESSAGE, O
 #define sk_OSSL_CMP_CERTREPMESSAGE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr))
 #define sk_OSSL_CMP_CERTREPMESSAGE_pop(sk) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk)))
 #define sk_OSSL_CMP_CERTREPMESSAGE_shift(sk) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk)))
-#define sk_OSSL_CMP_CERTREPMESSAGE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk),ossl_check_OSSL_CMP_CERTREPMESSAGE_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTREPMESSAGE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTREPMESSAGE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTREPMESSAGE_set(sk, idx, ptr) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr)))
 #define sk_OSSL_CMP_CERTREPMESSAGE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr))
@@ -392,7 +392,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTRESPONSE, OSSL_CMP_CERTRESPONSE, OSSL_
 #define sk_OSSL_CMP_CERTRESPONSE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr))
 #define sk_OSSL_CMP_CERTRESPONSE_pop(sk) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk)))
 #define sk_OSSL_CMP_CERTRESPONSE_shift(sk) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk)))
-#define sk_OSSL_CMP_CERTRESPONSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk),ossl_check_OSSL_CMP_CERTRESPONSE_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTRESPONSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTRESPONSE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTRESPONSE_set(sk, idx, ptr) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr)))
 #define sk_OSSL_CMP_CERTRESPONSE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cms.h

@@ -58,7 +58,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_SignerInfo, CMS_SignerInfo, CMS_SignerInfo)
 #define sk_CMS_SignerInfo_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr))
 #define sk_CMS_SignerInfo_pop(sk) ((CMS_SignerInfo *)OPENSSL_sk_pop(ossl_check_CMS_SignerInfo_sk_type(sk)))
 #define sk_CMS_SignerInfo_shift(sk) ((CMS_SignerInfo *)OPENSSL_sk_shift(ossl_check_CMS_SignerInfo_sk_type(sk)))
-#define sk_CMS_SignerInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_SignerInfo_sk_type(sk),ossl_check_CMS_SignerInfo_freefunc_type(freefunc))
+#define sk_CMS_SignerInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_freefunc_type(freefunc))
 #define sk_CMS_SignerInfo_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr), (idx))
 #define sk_CMS_SignerInfo_set(sk, idx, ptr) ((CMS_SignerInfo *)OPENSSL_sk_set(ossl_check_CMS_SignerInfo_sk_type(sk), (idx), ossl_check_CMS_SignerInfo_type(ptr)))
 #define sk_CMS_SignerInfo_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr))
@@ -84,7 +84,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RecipientEncryptedKey, CMS_RecipientEncryptedKe
 #define sk_CMS_RecipientEncryptedKey_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr))
 #define sk_CMS_RecipientEncryptedKey_pop(sk) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_pop(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk)))
 #define sk_CMS_RecipientEncryptedKey_shift(sk) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_shift(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk)))
-#define sk_CMS_RecipientEncryptedKey_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk),ossl_check_CMS_RecipientEncryptedKey_freefunc_type(freefunc))
+#define sk_CMS_RecipientEncryptedKey_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_freefunc_type(freefunc))
 #define sk_CMS_RecipientEncryptedKey_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr), (idx))
 #define sk_CMS_RecipientEncryptedKey_set(sk, idx, ptr) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_set(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), (idx), ossl_check_CMS_RecipientEncryptedKey_type(ptr)))
 #define sk_CMS_RecipientEncryptedKey_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr))
@@ -110,7 +110,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RecipientInfo, CMS_RecipientInfo, CMS_Recipient
 #define sk_CMS_RecipientInfo_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr))
 #define sk_CMS_RecipientInfo_pop(sk) ((CMS_RecipientInfo *)OPENSSL_sk_pop(ossl_check_CMS_RecipientInfo_sk_type(sk)))
 #define sk_CMS_RecipientInfo_shift(sk) ((CMS_RecipientInfo *)OPENSSL_sk_shift(ossl_check_CMS_RecipientInfo_sk_type(sk)))
-#define sk_CMS_RecipientInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientInfo_sk_type(sk),ossl_check_CMS_RecipientInfo_freefunc_type(freefunc))
+#define sk_CMS_RecipientInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_freefunc_type(freefunc))
 #define sk_CMS_RecipientInfo_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr), (idx))
 #define sk_CMS_RecipientInfo_set(sk, idx, ptr) ((CMS_RecipientInfo *)OPENSSL_sk_set(ossl_check_CMS_RecipientInfo_sk_type(sk), (idx), ossl_check_CMS_RecipientInfo_type(ptr)))
 #define sk_CMS_RecipientInfo_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr))
@@ -136,7 +136,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RevocationInfoChoice, CMS_RevocationInfoChoice,
 #define sk_CMS_RevocationInfoChoice_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr))
 #define sk_CMS_RevocationInfoChoice_pop(sk) ((CMS_RevocationInfoChoice *)OPENSSL_sk_pop(ossl_check_CMS_RevocationInfoChoice_sk_type(sk)))
 #define sk_CMS_RevocationInfoChoice_shift(sk) ((CMS_RevocationInfoChoice *)OPENSSL_sk_shift(ossl_check_CMS_RevocationInfoChoice_sk_type(sk)))
-#define sk_CMS_RevocationInfoChoice_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RevocationInfoChoice_sk_type(sk),ossl_check_CMS_RevocationInfoChoice_freefunc_type(freefunc))
+#define sk_CMS_RevocationInfoChoice_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_freefunc_type(freefunc))
 #define sk_CMS_RevocationInfoChoice_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr), (idx))
 #define sk_CMS_RevocationInfoChoice_set(sk, idx, ptr) ((CMS_RevocationInfoChoice *)OPENSSL_sk_set(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), (idx), ossl_check_CMS_RevocationInfoChoice_type(ptr)))
 #define sk_CMS_RevocationInfoChoice_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr))
@@ -168,6 +168,7 @@ CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq)
 # define CMS_RECIPINFO_KEK               2
 # define CMS_RECIPINFO_PASS              3
 # define CMS_RECIPINFO_OTHER             4
+# define CMS_RECIPINFO_KEM               5
 
 /* S/MIME related flags */
 
@@ -499,6 +500,14 @@ int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms,
 int CMS_SharedInfo_encode(unsigned char **pder, X509_ALGOR *kekalg,
                           ASN1_OCTET_STRING *ukm, int keylen);
 
+int CMS_RecipientInfo_kemri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert);
+int CMS_RecipientInfo_kemri_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk);
+EVP_CIPHER_CTX *CMS_RecipientInfo_kemri_get0_ctx(CMS_RecipientInfo *ri);
+X509_ALGOR *CMS_RecipientInfo_kemri_get0_kdf_alg(CMS_RecipientInfo *ri);
+int CMS_RecipientInfo_kemri_set_ukm(CMS_RecipientInfo *ri,
+                                    const unsigned char *ukm,
+                                    int ukmLength);
+
 /* Backward compatibility for spelling errors. */
 # define CMS_R_UNKNOWN_DIGEST_ALGORITM CMS_R_UNKNOWN_DIGEST_ALGORITHM
 # define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE \

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cmserr.h

@@ -67,6 +67,7 @@
 #  define CMS_R_NOT_A_SIGNED_RECEIPT                       165
 #  define CMS_R_NOT_ENCRYPTED_DATA                         122
 #  define CMS_R_NOT_KEK                                    123
+#  define CMS_R_NOT_KEM                                    197
 #  define CMS_R_NOT_KEY_AGREEMENT                          181
 #  define CMS_R_NOT_KEY_TRANSPORT                          124
 #  define CMS_R_NOT_PWRI                                   177
@@ -106,10 +107,12 @@
 #  define CMS_R_UNKNOWN_CIPHER                             148
 #  define CMS_R_UNKNOWN_DIGEST_ALGORITHM                   149
 #  define CMS_R_UNKNOWN_ID                                 150
+#  define CMS_R_UNKNOWN_KDF_ALGORITHM                      198
 #  define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM          151
 #  define CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM   194
 #  define CMS_R_UNSUPPORTED_CONTENT_TYPE                   152
 #  define CMS_R_UNSUPPORTED_ENCRYPTION_TYPE                192
+#  define CMS_R_UNSUPPORTED_KDF_ALGORITHM                  199
 #  define CMS_R_UNSUPPORTED_KEK_ALGORITHM                  153
 #  define CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM       179
 #  define CMS_R_UNSUPPORTED_LABEL_SOURCE                   193

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/comp.h

@@ -78,7 +78,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SSL_COMP, SSL_COMP, SSL_COMP)
 #define sk_SSL_COMP_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr))
 #define sk_SSL_COMP_pop(sk) ((SSL_COMP *)OPENSSL_sk_pop(ossl_check_SSL_COMP_sk_type(sk)))
 #define sk_SSL_COMP_shift(sk) ((SSL_COMP *)OPENSSL_sk_shift(ossl_check_SSL_COMP_sk_type(sk)))
-#define sk_SSL_COMP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_COMP_sk_type(sk),ossl_check_SSL_COMP_freefunc_type(freefunc))
+#define sk_SSL_COMP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_freefunc_type(freefunc))
 #define sk_SSL_COMP_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr), (idx))
 #define sk_SSL_COMP_set(sk, idx, ptr) ((SSL_COMP *)OPENSSL_sk_set(ossl_check_SSL_COMP_sk_type(sk), (idx), ossl_check_SSL_COMP_type(ptr)))
 #define sk_SSL_COMP_find(sk, ptr) OPENSSL_sk_find(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/conf.h

@@ -56,7 +56,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CONF_VALUE, CONF_VALUE, CONF_VALUE)
 #define sk_CONF_VALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr))
 #define sk_CONF_VALUE_pop(sk) ((CONF_VALUE *)OPENSSL_sk_pop(ossl_check_CONF_VALUE_sk_type(sk)))
 #define sk_CONF_VALUE_shift(sk) ((CONF_VALUE *)OPENSSL_sk_shift(ossl_check_CONF_VALUE_sk_type(sk)))
-#define sk_CONF_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CONF_VALUE_sk_type(sk),ossl_check_CONF_VALUE_freefunc_type(freefunc))
+#define sk_CONF_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_freefunc_type(freefunc))
 #define sk_CONF_VALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr), (idx))
 #define sk_CONF_VALUE_set(sk, idx, ptr) ((CONF_VALUE *)OPENSSL_sk_set(ossl_check_CONF_VALUE_sk_type(sk), (idx), ossl_check_CONF_VALUE_type(ptr)))
 #define sk_CONF_VALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/configuration.h

@@ -30,7 +30,7 @@ extern "C" {
 # ifndef OPENSSL_SYS_iOS
 #  define OPENSSL_SYS_iOS 1
 # endif
-# define OPENSSL_CONFIGURED_API 30500
+# define OPENSSL_CONFIGURED_API 30600
 # ifndef OPENSSL_RAND_SEED_OS
 #  define OPENSSL_RAND_SEED_OS
 # endif
@@ -43,6 +43,9 @@ extern "C" {
 # ifndef OPENSSL_NO_AFALGENG
 #  define OPENSSL_NO_AFALGENG
 # endif
+# ifndef OPENSSL_NO_ALLOCFAIL_TESTS
+#  define OPENSSL_NO_ALLOCFAIL_TESTS
+# endif
 # ifndef OPENSSL_NO_ASAN
 #  define OPENSSL_NO_ASAN
 # endif
@@ -121,6 +124,9 @@ extern "C" {
 # ifndef OPENSSL_NO_KTLS
 #  define OPENSSL_NO_KTLS
 # endif
+# ifndef OPENSSL_NO_LMS
+#  define OPENSSL_NO_LMS
+# endif
 # ifndef OPENSSL_NO_LOADERENG
 #  define OPENSSL_NO_LOADERENG
 # endif

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/core_dispatch.h

@@ -253,6 +253,10 @@ OSSL_CORE_MAKE_FUNC(int, provider_up_ref,
 OSSL_CORE_MAKE_FUNC(int, provider_free,
                     (const OSSL_CORE_HANDLE *prov, int deactivate))
 
+/* Additional error functions provided by the core */
+# define OSSL_FUNC_CORE_COUNT_TO_MARK          120
+OSSL_CORE_MAKE_FUNC(int, core_count_to_mark, (const OSSL_CORE_HANDLE *prov))
+
 /* Functions provided by the provider to the Core, reserved numbers 1024-1535 */
 # define OSSL_FUNC_PROVIDER_TEARDOWN           1024
 OSSL_CORE_MAKE_FUNC(void, provider_teardown, (void *provctx))
@@ -499,6 +503,52 @@ OSSL_CORE_MAKE_FUNC(int, mac_set_ctx_params,
                     (void *mctx, const OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(int, mac_init_skey, (void *mctx, void *key, const OSSL_PARAM params[]))
 
+/*-
+ * Symmetric key management
+ *
+ * The Key Management takes care of provider side of symmetric key objects, and
+ * includes essentially everything that manipulates the keys  themselves and
+ * their parameters.
+ *
+ * The key objects are commonly referred to as |keydata|, and it MUST be able
+ * to contain parameters if the key has any, and the secret key.
+ *
+ * Key objects are created with OSSL_FUNC_skeymgmt_import() (there is no
+ * dedicated memory allocation function), exported with
+ * OSSL_FUNC_skeymgmt_export() and destroyed with OSSL_FUNC_keymgmt_free().
+ *
+ */
+
+/* Key data subset selection - individual bits */
+# define OSSL_SKEYMGMT_SELECT_PARAMETERS      0x01
+# define OSSL_SKEYMGMT_SELECT_SECRET_KEY      0x02
+
+/* Key data subset selection - combinations */
+# define OSSL_SKEYMGMT_SELECT_ALL                \
+    (OSSL_SKEYMGMT_SELECT_PARAMETERS | OSSL_SKEYMGMT_SELECT_SECRET_KEY)
+
+# define OSSL_FUNC_SKEYMGMT_FREE                1
+# define OSSL_FUNC_SKEYMGMT_IMPORT              2
+# define OSSL_FUNC_SKEYMGMT_EXPORT              3
+# define OSSL_FUNC_SKEYMGMT_GENERATE            4
+# define OSSL_FUNC_SKEYMGMT_GET_KEY_ID          5
+# define OSSL_FUNC_SKEYMGMT_IMP_SETTABLE_PARAMS 6
+# define OSSL_FUNC_SKEYMGMT_GEN_SETTABLE_PARAMS 7
+
+OSSL_CORE_MAKE_FUNC(void, skeymgmt_free, (void *keydata))
+OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
+                    skeymgmt_imp_settable_params, (void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, skeymgmt_import, (void *provctx, int selection,
+                                              const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(int, skeymgmt_export,
+                    (void *keydata, int selection,
+                     OSSL_CALLBACK *param_cb, void *cbarg))
+OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
+                    skeymgmt_gen_settable_params, (void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, skeymgmt_generate, (void *provctx,
+                                                const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(const char *, skeymgmt_get_key_id, (void *keydata))
+
 /* KDFs and PRFs */
 
 # define OSSL_FUNC_KDF_NEWCTX                        1
@@ -512,6 +562,8 @@ OSSL_CORE_MAKE_FUNC(int, mac_init_skey, (void *mctx, void *key, const OSSL_PARAM
 # define OSSL_FUNC_KDF_GET_PARAMS                    9
 # define OSSL_FUNC_KDF_GET_CTX_PARAMS               10
 # define OSSL_FUNC_KDF_SET_CTX_PARAMS               11
+# define OSSL_FUNC_KDF_SET_SKEY                     12
+# define OSSL_FUNC_KDF_DERIVE_SKEY                  13
 
 OSSL_CORE_MAKE_FUNC(void *, kdf_newctx, (void *provctx))
 OSSL_CORE_MAKE_FUNC(void *, kdf_dupctx, (void *src))
@@ -529,6 +581,11 @@ OSSL_CORE_MAKE_FUNC(int, kdf_get_ctx_params,
                     (void *kctx, OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(int, kdf_set_ctx_params,
                     (void *kctx, const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(int, kdf_set_skey,
+                    (void *kctx, void *skeydata, const char *paramname))
+OSSL_CORE_MAKE_FUNC(void *, kdf_derive_skey, (void *ctx, const char *key_type, void *provctx,
+                                              OSSL_FUNC_skeymgmt_import_fn *import,
+                                              size_t keylen, const OSSL_PARAM params[]))
 
 /* RAND */
 
@@ -769,6 +826,7 @@ OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, keymgmt_export_types_ex,
 # define OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS         8
 # define OSSL_FUNC_KEYEXCH_GET_CTX_PARAMS              9
 # define OSSL_FUNC_KEYEXCH_GETTABLE_CTX_PARAMS        10
+# define OSSL_FUNC_KEYEXCH_DERIVE_SKEY                11
 
 OSSL_CORE_MAKE_FUNC(void *, keyexch_newctx, (void *provctx))
 OSSL_CORE_MAKE_FUNC(int, keyexch_init, (void *ctx, void *provkey,
@@ -786,6 +844,9 @@ OSSL_CORE_MAKE_FUNC(int, keyexch_get_ctx_params, (void *ctx,
                                                      OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, keyexch_gettable_ctx_params,
                     (void *ctx, void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, keyexch_derive_skey, (void *ctx, const char *key_type, void *provctx,
+                                                  OSSL_FUNC_skeymgmt_import_fn *import,
+                                                  size_t keylen, const OSSL_PARAM params[]))
 
 /* Signature */
 
@@ -899,52 +960,6 @@ OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, signature_settable_ctx_md_params,
                     (void *ctx))
 OSSL_CORE_MAKE_FUNC(const char **, signature_query_key_types, (void))
 
-/*-
- * Symmetric key management
- *
- * The Key Management takes care of provider side of symmetric key objects, and
- * includes essentially everything that manipulates the keys  themselves and
- * their parameters.
- *
- * The key objects are commonly referred to as |keydata|, and it MUST be able
- * to contain parameters if the key has any, and the secret key.
- *
- * Key objects are created with OSSL_FUNC_skeymgmt_import() (there is no
- * dedicated memory allocation function), exported with
- * OSSL_FUNC_skeymgmt_export() and destroyed with OSSL_FUNC_keymgmt_free().
- *
- */
-
-/* Key data subset selection - individual bits */
-# define OSSL_SKEYMGMT_SELECT_PARAMETERS      0x01
-# define OSSL_SKEYMGMT_SELECT_SECRET_KEY      0x02
-
-/* Key data subset selection - combinations */
-# define OSSL_SKEYMGMT_SELECT_ALL                \
-    (OSSL_SKEYMGMT_SELECT_PARAMETERS | OSSL_SKEYMGMT_SELECT_SECRET_KEY)
-
-# define OSSL_FUNC_SKEYMGMT_FREE                1
-# define OSSL_FUNC_SKEYMGMT_IMPORT              2
-# define OSSL_FUNC_SKEYMGMT_EXPORT              3
-# define OSSL_FUNC_SKEYMGMT_GENERATE            4
-# define OSSL_FUNC_SKEYMGMT_GET_KEY_ID          5
-# define OSSL_FUNC_SKEYMGMT_IMP_SETTABLE_PARAMS 6
-# define OSSL_FUNC_SKEYMGMT_GEN_SETTABLE_PARAMS 7
-
-OSSL_CORE_MAKE_FUNC(void, skeymgmt_free, (void *keydata))
-OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
-                    skeymgmt_imp_settable_params, (void *provctx))
-OSSL_CORE_MAKE_FUNC(void *, skeymgmt_import, (void *provctx, int selection,
-                                              const OSSL_PARAM params[]))
-OSSL_CORE_MAKE_FUNC(int, skeymgmt_export,
-                    (void *keydata, int selection,
-                     OSSL_CALLBACK *param_cb, void *cbarg))
-OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
-                    skeymgmt_gen_settable_params, (void *provctx))
-OSSL_CORE_MAKE_FUNC(void *, skeymgmt_generate, (void *provctx,
-                                                const OSSL_PARAM params[]))
-OSSL_CORE_MAKE_FUNC(const char *, skeymgmt_get_key_id, (void *keydata))
-
 /* Asymmetric Ciphers */
 
 # define OSSL_FUNC_ASYM_CIPHER_NEWCTX                  1

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/core_names.h

@@ -65,6 +65,9 @@ extern "C" {
 
 /* Known KDF names */
 # define OSSL_KDF_NAME_HKDF           "HKDF"
+# define OSSL_KDF_NAME_HKDF_SHA256    "HKDF-SHA256"
+# define OSSL_KDF_NAME_HKDF_SHA384    "HKDF-SHA384"
+# define OSSL_KDF_NAME_HKDF_SHA512    "HKDF-SHA512"
 # define OSSL_KDF_NAME_TLS1_3_KDF     "TLS13-KDF"
 # define OSSL_KDF_NAME_PBKDF1         "PBKDF1"
 # define OSSL_KDF_NAME_PBKDF2         "PBKDF2"
@@ -124,6 +127,7 @@ extern "C" {
 # define OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR "fips-indicator"
 # define OSSL_ALG_PARAM_MAC "mac"
 # define OSSL_ALG_PARAM_PROPERTIES "properties"
+# define OSSL_ALG_PARAM_SECURITY_CATEGORY "security-category"
 # define OSSL_ASYM_CIPHER_PARAM_DIGEST OSSL_PKEY_PARAM_DIGEST
 # define OSSL_ASYM_CIPHER_PARAM_ENGINE OSSL_PKEY_PARAM_ENGINE
 # define OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR
@@ -164,6 +168,7 @@ extern "C" {
 # define OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS "tls-sigalg-sec-bits"
 # define OSSL_CAPABILITY_TLS_SIGALG_SIG_NAME "tls-sigalg-sig-name"
 # define OSSL_CAPABILITY_TLS_SIGALG_SIG_OID "tls-sigalg-sig-oid"
+# define OSSL_CIPHER_HMAC_PARAM_MAC OSSL_CIPHER_PARAM_AEAD_TAG
 # define OSSL_CIPHER_PARAM_AEAD "aead"
 # define OSSL_CIPHER_PARAM_AEAD_IVLEN OSSL_CIPHER_PARAM_IVLEN
 # define OSSL_CIPHER_PARAM_AEAD_IV_GENERATED "iv-generated"
@@ -183,6 +188,7 @@ extern "C" {
 # define OSSL_CIPHER_PARAM_CTS_MODE "cts_mode"
 # define OSSL_CIPHER_PARAM_CUSTOM_IV "custom-iv"
 # define OSSL_CIPHER_PARAM_DECRYPT_ONLY "decrypt-only"
+# define OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC "encrypt-then-mac"
 # define OSSL_CIPHER_PARAM_FIPS_APPROVED_INDICATOR OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR
 # define OSSL_CIPHER_PARAM_FIPS_ENCRYPT_CHECK "encrypt-check"
 # define OSSL_CIPHER_PARAM_HAS_RAND_KEY "has-randkey"
@@ -356,6 +362,8 @@ extern "C" {
 # define OSSL_PKEY_PARAM_ALGORITHM_ID_PARAMS OSSL_ALG_PARAM_ALGORITHM_ID_PARAMS
 # define OSSL_PKEY_PARAM_BITS "bits"
 # define OSSL_PKEY_PARAM_CIPHER OSSL_ALG_PARAM_CIPHER
+# define OSSL_PKEY_PARAM_CMS_KEMRI_KDF_ALGORITHM "kemri-kdf-alg"
+# define OSSL_PKEY_PARAM_CMS_RI_TYPE "ri-type"
 # define OSSL_PKEY_PARAM_DEFAULT_DIGEST "default-digest"
 # define OSSL_PKEY_PARAM_DHKEM_IKM "dhkem-ikm"
 # define OSSL_PKEY_PARAM_DH_GENERATOR "safeprime-generator"
@@ -482,6 +490,7 @@ extern "C" {
 # define OSSL_PKEY_PARAM_RSA_TEST_XQ1 "xq1"
 # define OSSL_PKEY_PARAM_RSA_TEST_XQ2 "xq2"
 # define OSSL_PKEY_PARAM_SECURITY_BITS "security-bits"
+# define OSSL_PKEY_PARAM_SECURITY_CATEGORY OSSL_ALG_PARAM_SECURITY_CATEGORY
 # define OSSL_PKEY_PARAM_SLH_DSA_SEED "seed"
 # define OSSL_PKEY_PARAM_USE_COFACTOR_ECDH OSSL_PKEY_PARAM_USE_COFACTOR_FLAG
 # define OSSL_PKEY_PARAM_USE_COFACTOR_FLAG "use-cofactor-flag"

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/crmf.h

@@ -68,7 +68,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_MSG, OSSL_CRMF_MSG, OSSL_CRMF_MSG)
 #define sk_OSSL_CRMF_MSG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr))
 #define sk_OSSL_CRMF_MSG_pop(sk) ((OSSL_CRMF_MSG *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_MSG_sk_type(sk)))
 #define sk_OSSL_CRMF_MSG_shift(sk) ((OSSL_CRMF_MSG *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_MSG_sk_type(sk)))
-#define sk_OSSL_CRMF_MSG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_MSG_sk_type(sk),ossl_check_OSSL_CRMF_MSG_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_MSG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_MSG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr), (idx))
 #define sk_OSSL_CRMF_MSG_set(sk, idx, ptr) ((OSSL_CRMF_MSG *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_MSG_sk_type(sk), (idx), ossl_check_OSSL_CRMF_MSG_type(ptr)))
 #define sk_OSSL_CRMF_MSG_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr))
@@ -98,7 +98,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_ATTRIBUTETYPEANDVALUE, OSSL_CRMF_ATTRIBUT
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop(sk) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk)))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_shift(sk) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk)))
-#define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk),ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr), (idx))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_set(sk, idx, ptr) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), (idx), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr)))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr))
@@ -133,7 +133,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_CERTID, OSSL_CRMF_CERTID, OSSL_CRMF_CERTI
 #define sk_OSSL_CRMF_CERTID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr))
 #define sk_OSSL_CRMF_CERTID_pop(sk) ((OSSL_CRMF_CERTID *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_CERTID_sk_type(sk)))
 #define sk_OSSL_CRMF_CERTID_shift(sk) ((OSSL_CRMF_CERTID *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_CERTID_sk_type(sk)))
-#define sk_OSSL_CRMF_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_CERTID_sk_type(sk),ossl_check_OSSL_CRMF_CERTID_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_CERTID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr), (idx))
 #define sk_OSSL_CRMF_CERTID_set(sk, idx, ptr) ((OSSL_CRMF_CERTID *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), (idx), ossl_check_OSSL_CRMF_CERTID_type(ptr)))
 #define sk_OSSL_CRMF_CERTID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/crypto.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/crypto.h.in
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -99,36 +99,52 @@ int CRYPTO_atomic_store(uint64_t *dst, uint64_t val, CRYPTO_RWLOCK *lock);
 #define OPENSSL_malloc_init() while(0) continue
 
 # define OPENSSL_malloc(num) \
-        CRYPTO_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_zalloc(num) \
-        CRYPTO_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_malloc_array(num, size) \
+    CRYPTO_malloc_array(num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_calloc(num, size) \
+    CRYPTO_calloc(num, size, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_aligned_alloc(num, alignment, freeptr) \
-        CRYPTO_aligned_alloc(num, alignment, freeptr, \
-                             OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_aligned_alloc(num, alignment, freeptr, \
+                         OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_aligned_alloc_array(num, size, alignment, freeptr) \
+    CRYPTO_aligned_alloc_array(num, size, alignment, freeptr, \
+                               OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_realloc(addr, num) \
-        CRYPTO_realloc(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_realloc(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_clear_realloc(addr, old_num, num) \
-        CRYPTO_clear_realloc(addr, old_num, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_clear_realloc(addr, old_num, num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_realloc_array(addr, num, size) \
+    CRYPTO_realloc_array(addr, num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_clear_realloc_array(addr, old_num, num, size) \
+    CRYPTO_clear_realloc_array(addr, old_num, num, size, \
+                               OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_clear_free(addr, num) \
-        CRYPTO_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_free(addr) \
-        CRYPTO_free(addr, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_free(addr, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_memdup(str, s) \
-        CRYPTO_memdup((str), s, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_memdup((str), s, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_strdup(str) \
-        CRYPTO_strdup(str, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_strdup(str, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_strndup(str, n) \
-        CRYPTO_strndup(str, n, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_strndup(str, n, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_malloc(num) \
-        CRYPTO_secure_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_zalloc(num) \
-        CRYPTO_secure_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_secure_malloc_array(num, size) \
+    CRYPTO_secure_malloc_array(num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_secure_calloc(num, size) \
+    CRYPTO_secure_calloc(num, size, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_free(addr) \
-        CRYPTO_secure_free(addr, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_free(addr, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_clear_free(addr, num) \
-        CRYPTO_secure_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_actual_size(ptr) \
-        CRYPTO_secure_actual_size(ptr)
+    CRYPTO_secure_actual_size(ptr)
 
 size_t OPENSSL_strlcpy(char *dst, const char *src, size_t siz);
 size_t OPENSSL_strlcat(char *dst, const char *src, size_t siz);
@@ -209,7 +225,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(void, void, void)
 #define sk_void_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr))
 #define sk_void_pop(sk) ((void *)OPENSSL_sk_pop(ossl_check_void_sk_type(sk)))
 #define sk_void_shift(sk) ((void *)OPENSSL_sk_shift(ossl_check_void_sk_type(sk)))
-#define sk_void_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_void_sk_type(sk),ossl_check_void_freefunc_type(freefunc))
+#define sk_void_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_void_sk_type(sk), ossl_check_void_freefunc_type(freefunc))
 #define sk_void_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr), (idx))
 #define sk_void_set(sk, idx, ptr) ((void *)OPENSSL_sk_set(ossl_check_void_sk_type(sk), (idx), ossl_check_void_type(ptr)))
 #define sk_void_find(sk, ptr) OPENSSL_sk_find(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr))
@@ -355,22 +371,37 @@ void CRYPTO_get_mem_functions(CRYPTO_malloc_fn *malloc_fn,
 
 OSSL_CRYPTO_ALLOC void *CRYPTO_malloc(size_t num, const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_zalloc(size_t num, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_malloc_array(size_t num, size_t size,
+                                            const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_calloc(size_t num, size_t size,
+                                      const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_aligned_alloc(size_t num, size_t align,
                                              void **freeptr, const char *file,
                                              int line);
-OSSL_CRYPTO_ALLOC void *CRYPTO_memdup(const void *str, size_t siz, const char *file, int line);
-OSSL_CRYPTO_ALLOC char *CRYPTO_strdup(const char *str, const char *file, int line);
-OSSL_CRYPTO_ALLOC char *CRYPTO_strndup(const char *str, size_t s, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_aligned_alloc_array(size_t num, size_t size,
+                                                   size_t align, void **freeptr,
+                                                   const char *file, int line);
+void *CRYPTO_memdup(const void *str, size_t siz, const char *file, int line);
+char *CRYPTO_strdup(const char *str, const char *file, int line);
+char *CRYPTO_strndup(const char *str, size_t s, const char *file, int line);
 void CRYPTO_free(void *ptr, const char *file, int line);
 void CRYPTO_clear_free(void *ptr, size_t num, const char *file, int line);
 void *CRYPTO_realloc(void *addr, size_t num, const char *file, int line);
 void *CRYPTO_clear_realloc(void *addr, size_t old_num, size_t num,
                            const char *file, int line);
+void *CRYPTO_realloc_array(void *addr, size_t num, size_t size,
+                           const char *file, int line);
+void *CRYPTO_clear_realloc_array(void *addr, size_t old_num, size_t num,
+                                 size_t size, const char *file, int line);
 
 int CRYPTO_secure_malloc_init(size_t sz, size_t minsize);
 int CRYPTO_secure_malloc_done(void);
 OSSL_CRYPTO_ALLOC void *CRYPTO_secure_malloc(size_t num, const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_secure_zalloc(size_t num, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_secure_malloc_array(size_t num, size_t size,
+                                                   const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_secure_calloc(size_t num, size_t size,
+                                             const char *file, int line);
 void CRYPTO_secure_free(void *ptr, const char *file, int line);
 void CRYPTO_secure_clear_free(void *ptr, size_t num,
                               const char *file, int line);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ct.h

@@ -54,7 +54,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SCT, SCT, SCT)
 #define sk_SCT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
 #define sk_SCT_pop(sk) ((SCT *)OPENSSL_sk_pop(ossl_check_SCT_sk_type(sk)))
 #define sk_SCT_shift(sk) ((SCT *)OPENSSL_sk_shift(ossl_check_SCT_sk_type(sk)))
-#define sk_SCT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SCT_sk_type(sk),ossl_check_SCT_freefunc_type(freefunc))
+#define sk_SCT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SCT_sk_type(sk), ossl_check_SCT_freefunc_type(freefunc))
 #define sk_SCT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr), (idx))
 #define sk_SCT_set(sk, idx, ptr) ((SCT *)OPENSSL_sk_set(ossl_check_SCT_sk_type(sk), (idx), ossl_check_SCT_type(ptr)))
 #define sk_SCT_find(sk, ptr) OPENSSL_sk_find(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
@@ -80,7 +80,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CTLOG, CTLOG, CTLOG)
 #define sk_CTLOG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
 #define sk_CTLOG_pop(sk) ((CTLOG *)OPENSSL_sk_pop(ossl_check_CTLOG_sk_type(sk)))
 #define sk_CTLOG_shift(sk) ((CTLOG *)OPENSSL_sk_shift(ossl_check_CTLOG_sk_type(sk)))
-#define sk_CTLOG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CTLOG_sk_type(sk),ossl_check_CTLOG_freefunc_type(freefunc))
+#define sk_CTLOG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_freefunc_type(freefunc))
 #define sk_CTLOG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr), (idx))
 #define sk_CTLOG_set(sk, idx, ptr) ((CTLOG *)OPENSSL_sk_set(ossl_check_CTLOG_sk_type(sk), (idx), ossl_check_CTLOG_type(ptr)))
 #define sk_CTLOG_find(sk, ptr) OPENSSL_sk_find(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ess.h

@@ -46,7 +46,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ESS_CERT_ID, ESS_CERT_ID, ESS_CERT_ID)
 #define sk_ESS_CERT_ID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr))
 #define sk_ESS_CERT_ID_pop(sk) ((ESS_CERT_ID *)OPENSSL_sk_pop(ossl_check_ESS_CERT_ID_sk_type(sk)))
 #define sk_ESS_CERT_ID_shift(sk) ((ESS_CERT_ID *)OPENSSL_sk_shift(ossl_check_ESS_CERT_ID_sk_type(sk)))
-#define sk_ESS_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_sk_type(sk),ossl_check_ESS_CERT_ID_freefunc_type(freefunc))
+#define sk_ESS_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_freefunc_type(freefunc))
 #define sk_ESS_CERT_ID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr), (idx))
 #define sk_ESS_CERT_ID_set(sk, idx, ptr) ((ESS_CERT_ID *)OPENSSL_sk_set(ossl_check_ESS_CERT_ID_sk_type(sk), (idx), ossl_check_ESS_CERT_ID_type(ptr)))
 #define sk_ESS_CERT_ID_find(sk, ptr) OPENSSL_sk_find(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr))
@@ -78,7 +78,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ESS_CERT_ID_V2, ESS_CERT_ID_V2, ESS_CERT_ID_V2)
 #define sk_ESS_CERT_ID_V2_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr))
 #define sk_ESS_CERT_ID_V2_pop(sk) ((ESS_CERT_ID_V2 *)OPENSSL_sk_pop(ossl_check_ESS_CERT_ID_V2_sk_type(sk)))
 #define sk_ESS_CERT_ID_V2_shift(sk) ((ESS_CERT_ID_V2 *)OPENSSL_sk_shift(ossl_check_ESS_CERT_ID_V2_sk_type(sk)))
-#define sk_ESS_CERT_ID_V2_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_V2_sk_type(sk),ossl_check_ESS_CERT_ID_V2_freefunc_type(freefunc))
+#define sk_ESS_CERT_ID_V2_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_freefunc_type(freefunc))
 #define sk_ESS_CERT_ID_V2_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr), (idx))
 #define sk_ESS_CERT_ID_V2_set(sk, idx, ptr) ((ESS_CERT_ID_V2 *)OPENSSL_sk_set(ossl_check_ESS_CERT_ID_V2_sk_type(sk), (idx), ossl_check_ESS_CERT_ID_V2_type(ptr)))
 #define sk_ESS_CERT_ID_V2_find(sk, ptr) OPENSSL_sk_find(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/evp.h

@@ -376,6 +376,7 @@ OSSL_DEPRECATEDIN_3_0 int
 /* For supplementary wrap cipher support */
 # define         EVP_CIPH_FLAG_GET_WRAP_CIPHER   0x4000000
 # define         EVP_CIPH_FLAG_INVERSE_CIPHER    0x8000000
+# define         EVP_CIPH_FLAG_ENC_THEN_MAC      0x10000000
 
 /*
  * Cipher context flag to indicate we can handle wrap mode: if allowed in
@@ -518,33 +519,40 @@ typedef int (EVP_PBE_KEYGEN_EX) (EVP_CIPHER_CTX *ctx, const char *pass,
                                  int en_de, OSSL_LIB_CTX *libctx, const char *propq);
 
 # ifndef OPENSSL_NO_DEPRECATED_3_0
-#  define EVP_PKEY_assign_RSA(pkey,rsa) EVP_PKEY_assign((pkey),EVP_PKEY_RSA,\
+#  define EVP_PKEY_assign_RSA(pkey, rsa) EVP_PKEY_assign((pkey), EVP_PKEY_RSA, \
                                                          (rsa))
 # endif
 
-# ifndef OPENSSL_NO_DSA
-#  define EVP_PKEY_assign_DSA(pkey,dsa) EVP_PKEY_assign((pkey),EVP_PKEY_DSA,\
-                                        (dsa))
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+#  ifndef OPENSSL_NO_DSA
+#   define EVP_PKEY_assign_DSA(pkey, dsa) EVP_PKEY_assign((pkey), EVP_PKEY_DSA, \
+                                                          (dsa))
+#  endif
 # endif
 
 # if !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-#  define EVP_PKEY_assign_DH(pkey,dh) EVP_PKEY_assign((pkey),EVP_PKEY_DH,(dh))
+#  define EVP_PKEY_assign_DH(pkey, dh) EVP_PKEY_assign((pkey), EVP_PKEY_DH, (dh))
 # endif
 
 # ifndef OPENSSL_NO_DEPRECATED_3_0
 #  ifndef OPENSSL_NO_EC
-#   define EVP_PKEY_assign_EC_KEY(pkey,eckey) \
-        EVP_PKEY_assign((pkey), EVP_PKEY_EC, (eckey))
+#   define EVP_PKEY_assign_EC_KEY(pkey, eckey) EVP_PKEY_assign((pkey), \
+                                                               EVP_PKEY_EC, \
+                                                               (eckey))
 #  endif
 # endif
-# ifndef OPENSSL_NO_SIPHASH
-#  define EVP_PKEY_assign_SIPHASH(pkey,shkey) EVP_PKEY_assign((pkey),\
-                                        EVP_PKEY_SIPHASH,(shkey))
-# endif
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+#  ifndef OPENSSL_NO_SIPHASH
+#   define EVP_PKEY_assign_SIPHASH(pkey, shkey) EVP_PKEY_assign((pkey), \
+                                                                EVP_PKEY_SIPHASH, \
+                                                                (shkey))
+#  endif
 
-# ifndef OPENSSL_NO_POLY1305
-#  define EVP_PKEY_assign_POLY1305(pkey,polykey) EVP_PKEY_assign((pkey),\
-                                        EVP_PKEY_POLY1305,(polykey))
+#  ifndef OPENSSL_NO_POLY1305
+#   define EVP_PKEY_assign_POLY1305(pkey, polykey) EVP_PKEY_assign((pkey), \
+                                                                   EVP_PKEY_POLY1305, \
+                                                                   (polykey))
+#  endif
 # endif
 
 /* Add some extra combinations */
@@ -1370,6 +1378,7 @@ int EVP_PKEY_get_bits(const EVP_PKEY *pkey);
 # define EVP_PKEY_bits EVP_PKEY_get_bits
 int EVP_PKEY_get_security_bits(const EVP_PKEY *pkey);
 # define EVP_PKEY_security_bits EVP_PKEY_get_security_bits
+int EVP_PKEY_get_security_category(const EVP_PKEY *pkey);
 int EVP_PKEY_get_size(const EVP_PKEY *pkey);
 # define EVP_PKEY_size EVP_PKEY_get_size
 int EVP_PKEY_can_sign(const EVP_PKEY *pkey);
@@ -1457,6 +1466,7 @@ EVP_PKEY *d2i_AutoPrivateKey_ex(EVP_PKEY **a, const unsigned char **pp,
 EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp,
                              long length);
 int i2d_PrivateKey(const EVP_PKEY *a, unsigned char **pp);
+int i2d_PKCS8PrivateKey(const EVP_PKEY *a, unsigned char **pp);
 
 int i2d_KeyParams(const EVP_PKEY *a, unsigned char **pp);
 EVP_PKEY *d2i_KeyParams(int type, EVP_PKEY **a, const unsigned char **pp,
@@ -1615,25 +1625,30 @@ int EVP_PBE_get(int *ptype, int *ppbe_nid, size_t num);
 # define ASN1_PKEY_CTRL_GET1_TLS_ENCPT   0xa
 # define ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED 0xb
 
-int EVP_PKEY_asn1_get_count(void);
-const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx);
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_get_count(void);
+OSSL_DEPRECATEDIN_3_6 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx);
+OSSL_DEPRECATEDIN_3_6
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type);
+OSSL_DEPRECATEDIN_3_6
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
                                                    const char *str, int len);
-int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth);
-int EVP_PKEY_asn1_add_alias(int to, int from);
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_add_alias(int to, int from);
+OSSL_DEPRECATEDIN_3_6
 int EVP_PKEY_asn1_get0_info(int *ppkey_id, int *pkey_base_id,
                             int *ppkey_flags, const char **pinfo,
                             const char **ppem_str,
                             const EVP_PKEY_ASN1_METHOD *ameth);
 
-const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
-EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
-                                        const char *pem_str,
-                                        const char *info);
-void EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst,
-                        const EVP_PKEY_ASN1_METHOD *src);
-void EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
+OSSL_DEPRECATEDIN_3_6 EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
+                                                              const char *pem_str,
+                                                              const char *info);
+OSSL_DEPRECATEDIN_3_6 void EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst,
+                                              const EVP_PKEY_ASN1_METHOD *src);
+OSSL_DEPRECATEDIN_3_6 void EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
                               int (*pub_decode) (EVP_PKEY *pk,
                                                  const X509_PUBKEY *pub),
@@ -1646,6 +1661,7 @@ void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
                                                 int indent, ASN1_PCTX *pctx),
                               int (*pkey_size) (const EVP_PKEY *pk),
                               int (*pkey_bits) (const EVP_PKEY *pk));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
                                int (*priv_decode) (EVP_PKEY *pk,
                                                    const PKCS8_PRIV_KEY_INFO
@@ -1656,6 +1672,7 @@ void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
                                                   const EVP_PKEY *pkey,
                                                   int indent,
                                                   ASN1_PCTX *pctx));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
                              int (*param_decode) (EVP_PKEY *pkey,
                                                   const unsigned char **pder,
@@ -1672,11 +1689,14 @@ void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
                                                  int indent,
                                                  ASN1_PCTX *pctx));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
                             void (*pkey_free) (EVP_PKEY *pkey));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*pkey_ctrl) (EVP_PKEY *pkey, int op,
                                               long arg1, void *arg2));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*item_verify) (EVP_MD_CTX *ctx,
                                                 const ASN1_ITEM *it,
@@ -1691,41 +1711,51 @@ void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
                                               X509_ALGOR *alg2,
                                               ASN1_BIT_STRING *sig));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_siginf(EVP_PKEY_ASN1_METHOD *ameth,
                               int (*siginf_set) (X509_SIG_INFO *siginf,
                                                  const X509_ALGOR *alg,
                                                  const ASN1_STRING *sig));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_check(EVP_PKEY_ASN1_METHOD *ameth,
                              int (*pkey_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_public_check(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*pkey_pub_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_param_check(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*pkey_param_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_set_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*set_priv_key) (EVP_PKEY *pk,
                                                          const unsigned char
                                                             *priv,
                                                          size_t len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*set_pub_key) (EVP_PKEY *pk,
                                                        const unsigned char *pub,
                                                        size_t len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*get_priv_key) (const EVP_PKEY *pk,
                                                          unsigned char *priv,
                                                          size_t *len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*get_pub_key) (const EVP_PKEY *pk,
                                                        unsigned char *pub,
                                                        size_t *len));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
                                      int (*pkey_security_bits) (const EVP_PKEY
                                                                 *pk));
+# endif /* OPENSSL_NO_DEPRECATED_3_6 */
 
 int EVP_PKEY_CTX_get_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD **md);
 int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
@@ -2037,6 +2067,9 @@ int EVP_PKEY_derive_set_peer_ex(EVP_PKEY_CTX *ctx, EVP_PKEY *peer,
                                 int validate_peer);
 int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer);
 int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen);
+EVP_SKEY *EVP_PKEY_derive_SKEY(EVP_PKEY_CTX *ctx, EVP_SKEYMGMT *mgmt,
+                               const char *key_type, const char *propquery,
+                               size_t keylen, const OSSL_PARAM params[]);
 
 int EVP_PKEY_encapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
 int EVP_PKEY_auth_encapsulate_init(EVP_PKEY_CTX *ctx, EVP_PKEY *authpriv,
@@ -2292,6 +2325,8 @@ EVP_SKEY *EVP_SKEY_generate(OSSL_LIB_CTX *libctx, const char *skeymgmtname,
 EVP_SKEY *EVP_SKEY_import_raw_key(OSSL_LIB_CTX *libctx, const char *skeymgmtname,
                                   unsigned char *key, size_t keylen,
                                   const char *propquery);
+EVP_SKEY *EVP_SKEY_import_SKEYMGMT(OSSL_LIB_CTX *libctx, EVP_SKEYMGMT *skeymgmt,
+                                   int selection, const OSSL_PARAM *params);
 int EVP_SKEY_get0_raw_key(const EVP_SKEY *skey, const unsigned char **key,
                           size_t *len);
 const char *EVP_SKEY_get0_key_id(const EVP_SKEY *skey);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/kdf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -43,6 +43,10 @@ void EVP_KDF_CTX_reset(EVP_KDF_CTX *ctx);
 size_t EVP_KDF_CTX_get_kdf_size(EVP_KDF_CTX *ctx);
 int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen,
                    const OSSL_PARAM params[]);
+int EVP_KDF_CTX_set_SKEY(EVP_KDF_CTX *ctx, EVP_SKEY *key, const char *paramname);
+EVP_SKEY *EVP_KDF_derive_SKEY(EVP_KDF_CTX *ctx, EVP_SKEYMGMT *mgmt,
+                              const char *key_type, const char *propquery,
+                              size_t keylen, const OSSL_PARAM params[]);
 int EVP_KDF_get_params(EVP_KDF *kdf, OSSL_PARAM params[]);
 int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]);
 int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/macros.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -169,6 +169,7 @@
  * 'no-deprecated'.
  */
 
+# undef OPENSSL_NO_DEPRECATED_3_6
 # undef OPENSSL_NO_DEPRECATED_3_4
 # undef OPENSSL_NO_DEPRECATED_3_1
 # undef OPENSSL_NO_DEPRECATED_3_0
@@ -179,6 +180,17 @@
 # undef OPENSSL_NO_DEPRECATED_1_0_0
 # undef OPENSSL_NO_DEPRECATED_0_9_8
 
+# if OPENSSL_API_LEVEL >= 30600
+#  ifndef OPENSSL_NO_DEPRECATED
+#   define OSSL_DEPRECATEDIN_3_6                OSSL_DEPRECATED(3.6)
+#   define OSSL_DEPRECATEDIN_3_6_FOR(msg)       OSSL_DEPRECATED_FOR(3.6, msg)
+#  else
+#   define OPENSSL_NO_DEPRECATED_3_6
+#  endif
+# else
+#  define OSSL_DEPRECATEDIN_3_6
+#  define OSSL_DEPRECATEDIN_3_6_FOR(msg)
+# endif
 # if OPENSSL_API_LEVEL >= 30500
 #  ifndef OPENSSL_NO_DEPRECATED
 #   define OSSL_DEPRECATEDIN_3_5                OSSL_DEPRECATED(3.5)

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/obj_mac.h

@@ -778,6 +778,10 @@
 #define NID_id_smime_cti                195
 #define OBJ_id_smime_cti                OBJ_SMIME,6L
 
+#define SN_id_smime_ori         "id-smime-ori"
+#define NID_id_smime_ori                1499
+#define OBJ_id_smime_ori                OBJ_SMIME,13L
+
 #define SN_id_smime_mod_cms             "id-smime-mod-cms"
 #define NID_id_smime_mod_cms            196
 #define OBJ_id_smime_mod_cms            OBJ_id_smime_mod,1L
@@ -1062,6 +1066,21 @@
 #define NID_id_alg_PWRI_KEK             893
 #define OBJ_id_alg_PWRI_KEK             OBJ_id_smime_alg,9L
 
+#define SN_HKDF_SHA256          "id-alg-hkdf-with-sha256"
+#define LN_HKDF_SHA256          "HKDF-SHA256"
+#define NID_HKDF_SHA256         1496
+#define OBJ_HKDF_SHA256         OBJ_id_smime_alg,28L
+
+#define SN_HKDF_SHA384          "id-alg-hkdf-with-sha384"
+#define LN_HKDF_SHA384          "HKDF-SHA384"
+#define NID_HKDF_SHA384         1497
+#define OBJ_HKDF_SHA384         OBJ_id_smime_alg,29L
+
+#define SN_HKDF_SHA512          "id-alg-hkdf-with-sha512"
+#define LN_HKDF_SHA512          "HKDF-SHA512"
+#define NID_HKDF_SHA512         1498
+#define OBJ_HKDF_SHA512         OBJ_id_smime_alg,30L
+
 #define SN_id_smime_cd_ldap             "id-smime-cd-ldap"
 #define NID_id_smime_cd_ldap            248
 #define OBJ_id_smime_cd_ldap            OBJ_id_smime_cd,1L
@@ -1098,6 +1117,10 @@
 #define NID_id_smime_cti_ets_proofOfCreation            256
 #define OBJ_id_smime_cti_ets_proofOfCreation            OBJ_id_smime_cti,6L
 
+#define SN_id_smime_ori_kem             "id-smime-ori-kem"
+#define NID_id_smime_ori_kem            1500
+#define OBJ_id_smime_ori_kem            OBJ_id_smime_ori,3L
+
 #define LN_friendlyName         "friendlyName"
 #define NID_friendlyName                156
 #define OBJ_friendlyName                OBJ_pkcs9,20L
@@ -5458,6 +5481,42 @@
 #define LN_chacha20             "chacha20"
 #define NID_chacha20            1019
 
+#define SN_aes_128_cbc_hmac_sha1_etm            "AES-128-CBC-HMAC-SHA1-ETM"
+#define LN_aes_128_cbc_hmac_sha1_etm            "aes-128-cbc-hmac-sha1-etm"
+#define NID_aes_128_cbc_hmac_sha1_etm           1487
+
+#define SN_aes_192_cbc_hmac_sha1_etm            "AES-192-CBC-HMAC-SHA1-ETM"
+#define LN_aes_192_cbc_hmac_sha1_etm            "aes-192-cbc-hmac-sha1-etm"
+#define NID_aes_192_cbc_hmac_sha1_etm           1488
+
+#define SN_aes_256_cbc_hmac_sha1_etm            "AES-256-CBC-HMAC-SHA1-ETM"
+#define LN_aes_256_cbc_hmac_sha1_etm            "aes-256-cbc-hmac-sha1-etm"
+#define NID_aes_256_cbc_hmac_sha1_etm           1489
+
+#define SN_aes_128_cbc_hmac_sha256_etm          "AES-128-CBC-HMAC-SHA256-ETM"
+#define LN_aes_128_cbc_hmac_sha256_etm          "aes-128-cbc-hmac-sha256-etm"
+#define NID_aes_128_cbc_hmac_sha256_etm         1490
+
+#define SN_aes_192_cbc_hmac_sha256_etm          "AES-192-CBC-HMAC-SHA256-ETM"
+#define LN_aes_192_cbc_hmac_sha256_etm          "aes-192-cbc-hmac-sha256-etm"
+#define NID_aes_192_cbc_hmac_sha256_etm         1491
+
+#define SN_aes_256_cbc_hmac_sha256_etm          "AES-256-CBC-HMAC-SHA256-ETM"
+#define LN_aes_256_cbc_hmac_sha256_etm          "aes-256-cbc-hmac-sha256-etm"
+#define NID_aes_256_cbc_hmac_sha256_etm         1492
+
+#define SN_aes_128_cbc_hmac_sha512_etm          "AES-128-CBC-HMAC-SHA512-ETM"
+#define LN_aes_128_cbc_hmac_sha512_etm          "aes-128-cbc-hmac-sha512-etm"
+#define NID_aes_128_cbc_hmac_sha512_etm         1493
+
+#define SN_aes_192_cbc_hmac_sha512_etm          "AES-192-CBC-HMAC-SHA512-ETM"
+#define LN_aes_192_cbc_hmac_sha512_etm          "aes-192-cbc-hmac-sha512-etm"
+#define NID_aes_192_cbc_hmac_sha512_etm         1494
+
+#define SN_aes_256_cbc_hmac_sha512_etm          "AES-256-CBC-HMAC-SHA512-ETM"
+#define LN_aes_256_cbc_hmac_sha512_etm          "aes-256-cbc-hmac-sha512-etm"
+#define NID_aes_256_cbc_hmac_sha512_etm         1495
+
 #define SN_dhpublicnumber               "dhpublicnumber"
 #define LN_dhpublicnumber               "X9.42 DH"
 #define NID_dhpublicnumber              920

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ocsp.h

@@ -107,7 +107,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_CERTID, OCSP_CERTID, OCSP_CERTID)
 #define sk_OCSP_CERTID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr))
 #define sk_OCSP_CERTID_pop(sk) ((OCSP_CERTID *)OPENSSL_sk_pop(ossl_check_OCSP_CERTID_sk_type(sk)))
 #define sk_OCSP_CERTID_shift(sk) ((OCSP_CERTID *)OPENSSL_sk_shift(ossl_check_OCSP_CERTID_sk_type(sk)))
-#define sk_OCSP_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_CERTID_sk_type(sk),ossl_check_OCSP_CERTID_freefunc_type(freefunc))
+#define sk_OCSP_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_freefunc_type(freefunc))
 #define sk_OCSP_CERTID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr), (idx))
 #define sk_OCSP_CERTID_set(sk, idx, ptr) ((OCSP_CERTID *)OPENSSL_sk_set(ossl_check_OCSP_CERTID_sk_type(sk), (idx), ossl_check_OCSP_CERTID_type(ptr)))
 #define sk_OCSP_CERTID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr))
@@ -133,7 +133,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_ONEREQ, OCSP_ONEREQ, OCSP_ONEREQ)
 #define sk_OCSP_ONEREQ_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr))
 #define sk_OCSP_ONEREQ_pop(sk) ((OCSP_ONEREQ *)OPENSSL_sk_pop(ossl_check_OCSP_ONEREQ_sk_type(sk)))
 #define sk_OCSP_ONEREQ_shift(sk) ((OCSP_ONEREQ *)OPENSSL_sk_shift(ossl_check_OCSP_ONEREQ_sk_type(sk)))
-#define sk_OCSP_ONEREQ_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_ONEREQ_sk_type(sk),ossl_check_OCSP_ONEREQ_freefunc_type(freefunc))
+#define sk_OCSP_ONEREQ_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_freefunc_type(freefunc))
 #define sk_OCSP_ONEREQ_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr), (idx))
 #define sk_OCSP_ONEREQ_set(sk, idx, ptr) ((OCSP_ONEREQ *)OPENSSL_sk_set(ossl_check_OCSP_ONEREQ_sk_type(sk), (idx), ossl_check_OCSP_ONEREQ_type(ptr)))
 #define sk_OCSP_ONEREQ_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr))
@@ -173,7 +173,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_RESPID, OCSP_RESPID, OCSP_RESPID)
 #define sk_OCSP_RESPID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr))
 #define sk_OCSP_RESPID_pop(sk) ((OCSP_RESPID *)OPENSSL_sk_pop(ossl_check_OCSP_RESPID_sk_type(sk)))
 #define sk_OCSP_RESPID_shift(sk) ((OCSP_RESPID *)OPENSSL_sk_shift(ossl_check_OCSP_RESPID_sk_type(sk)))
-#define sk_OCSP_RESPID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_RESPID_sk_type(sk),ossl_check_OCSP_RESPID_freefunc_type(freefunc))
+#define sk_OCSP_RESPID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_freefunc_type(freefunc))
 #define sk_OCSP_RESPID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr), (idx))
 #define sk_OCSP_RESPID_set(sk, idx, ptr) ((OCSP_RESPID *)OPENSSL_sk_set(ossl_check_OCSP_RESPID_sk_type(sk), (idx), ossl_check_OCSP_RESPID_type(ptr)))
 #define sk_OCSP_RESPID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr))
@@ -210,7 +210,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_SINGLERESP, OCSP_SINGLERESP, OCSP_SINGLERESP)
 #define sk_OCSP_SINGLERESP_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr))
 #define sk_OCSP_SINGLERESP_pop(sk) ((OCSP_SINGLERESP *)OPENSSL_sk_pop(ossl_check_OCSP_SINGLERESP_sk_type(sk)))
 #define sk_OCSP_SINGLERESP_shift(sk) ((OCSP_SINGLERESP *)OPENSSL_sk_shift(ossl_check_OCSP_SINGLERESP_sk_type(sk)))
-#define sk_OCSP_SINGLERESP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_SINGLERESP_sk_type(sk),ossl_check_OCSP_SINGLERESP_freefunc_type(freefunc))
+#define sk_OCSP_SINGLERESP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_freefunc_type(freefunc))
 #define sk_OCSP_SINGLERESP_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr), (idx))
 #define sk_OCSP_SINGLERESP_set(sk, idx, ptr) ((OCSP_SINGLERESP *)OPENSSL_sk_set(ossl_check_OCSP_SINGLERESP_sk_type(sk), (idx), ossl_check_OCSP_SINGLERESP_type(ptr)))
 #define sk_OCSP_SINGLERESP_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/opensslv.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/opensslv.h.in
  *
- * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -28,8 +28,8 @@ extern "C" {
  * These macros express version number MAJOR.MINOR.PATCH exactly
  */
 # define OPENSSL_VERSION_MAJOR  3
-# define OPENSSL_VERSION_MINOR  5
-# define OPENSSL_VERSION_PATCH  1
+# define OPENSSL_VERSION_MINOR  6
+# define OPENSSL_VERSION_PATCH  0
 
 /*
  * Additional version information
@@ -74,33 +74,28 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.5.1"
-# define OPENSSL_FULL_VERSION_STR "3.5.1"
+# define OPENSSL_VERSION_STR "3.6.0"
+# define OPENSSL_FULL_VERSION_STR "3.6.0"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "1 Jul 2025"
+# define OPENSSL_RELEASE_DATE "1 Oct 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.1 1 Jul 2025"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.6.0 1 Oct 2025"
 
-/* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
-# ifdef OPENSSL_VERSION_PRE_RELEASE
-#  define _OPENSSL_VERSION_PRE_RELEASE 0x0L
-# else
-#  define _OPENSSL_VERSION_PRE_RELEASE 0xfL
-# endif
+/* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PP0L */
 # define OPENSSL_VERSION_NUMBER          \
     ( (OPENSSL_VERSION_MAJOR<<28)        \
       |(OPENSSL_VERSION_MINOR<<20)       \
       |(OPENSSL_VERSION_PATCH<<4)        \
-      |_OPENSSL_VERSION_PRE_RELEASE )
+      |0x0L )
 
 # ifdef  __cplusplus
 }

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/params.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -157,6 +157,9 @@ OSSL_PARAM *OSSL_PARAM_dup(const OSSL_PARAM *p);
 OSSL_PARAM *OSSL_PARAM_merge(const OSSL_PARAM *p1, const OSSL_PARAM *p2);
 void OSSL_PARAM_free(OSSL_PARAM *p);
 
+int OSSL_PARAM_set_octet_string_or_ptr(OSSL_PARAM *p, const void *val,
+                                       size_t len);
+
 # ifdef  __cplusplus
 }
 # endif

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pem.h

@@ -57,6 +57,7 @@ extern "C" {
 # define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY"
 # define PEM_STRING_PARAMETERS   "PARAMETERS"
 # define PEM_STRING_CMS          "CMS"
+# define PEM_STRING_SM2PRIVATEKEY "SM2 PRIVATE KEY"
 # define PEM_STRING_SM2PARAMETERS "SM2 PARAMETERS"
 # define PEM_STRING_ACERT        "ATTRIBUTE CERTIFICATE"
 

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pkcs12.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/pkcs12.h.in
  *
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -44,8 +44,14 @@ extern "C" {
 
 # define PKCS12_MAC_KEY_LENGTH 20
 
-/* The macro is expected to be used only internally. Kept for backwards compatibility. */
-# define PKCS12_SALT_LEN 8
+/*
+ * The macro is expected to be used only internally. Kept for
+ * backwards compatibility. NIST requires 16, previous value was
+ * 8. Allow to override this at compile time.
+ */
+# ifndef PKCS12_SALT_LEN
+#  define PKCS12_SALT_LEN 16
+# endif
 
 /* It's not clear if these are actually needed... */
 # define PKCS12_key_gen PKCS12_key_gen_utf8
@@ -77,7 +83,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS12_SAFEBAG, PKCS12_SAFEBAG, PKCS12_SAFEBAG)
 #define sk_PKCS12_SAFEBAG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr))
 #define sk_PKCS12_SAFEBAG_pop(sk) ((PKCS12_SAFEBAG *)OPENSSL_sk_pop(ossl_check_PKCS12_SAFEBAG_sk_type(sk)))
 #define sk_PKCS12_SAFEBAG_shift(sk) ((PKCS12_SAFEBAG *)OPENSSL_sk_shift(ossl_check_PKCS12_SAFEBAG_sk_type(sk)))
-#define sk_PKCS12_SAFEBAG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS12_SAFEBAG_sk_type(sk),ossl_check_PKCS12_SAFEBAG_freefunc_type(freefunc))
+#define sk_PKCS12_SAFEBAG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_freefunc_type(freefunc))
 #define sk_PKCS12_SAFEBAG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr), (idx))
 #define sk_PKCS12_SAFEBAG_set(sk, idx, ptr) ((PKCS12_SAFEBAG *)OPENSSL_sk_set(ossl_check_PKCS12_SAFEBAG_sk_type(sk), (idx), ossl_check_PKCS12_SAFEBAG_type(ptr)))
 #define sk_PKCS12_SAFEBAG_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pkcs7.h

@@ -81,7 +81,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7_SIGNER_INFO, PKCS7_SIGNER_INFO, PKCS7_SIGNER_
 #define sk_PKCS7_SIGNER_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr))
 #define sk_PKCS7_SIGNER_INFO_pop(sk) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_pop(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk)))
 #define sk_PKCS7_SIGNER_INFO_shift(sk) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_shift(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk)))
-#define sk_PKCS7_SIGNER_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk),ossl_check_PKCS7_SIGNER_INFO_freefunc_type(freefunc))
+#define sk_PKCS7_SIGNER_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_freefunc_type(freefunc))
 #define sk_PKCS7_SIGNER_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr), (idx))
 #define sk_PKCS7_SIGNER_INFO_set(sk, idx, ptr) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_set(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), (idx), ossl_check_PKCS7_SIGNER_INFO_type(ptr)))
 #define sk_PKCS7_SIGNER_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr))
@@ -117,7 +117,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7_RECIP_INFO, PKCS7_RECIP_INFO, PKCS7_RECIP_INF
 #define sk_PKCS7_RECIP_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr))
 #define sk_PKCS7_RECIP_INFO_pop(sk) ((PKCS7_RECIP_INFO *)OPENSSL_sk_pop(ossl_check_PKCS7_RECIP_INFO_sk_type(sk)))
 #define sk_PKCS7_RECIP_INFO_shift(sk) ((PKCS7_RECIP_INFO *)OPENSSL_sk_shift(ossl_check_PKCS7_RECIP_INFO_sk_type(sk)))
-#define sk_PKCS7_RECIP_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_RECIP_INFO_sk_type(sk),ossl_check_PKCS7_RECIP_INFO_freefunc_type(freefunc))
+#define sk_PKCS7_RECIP_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_freefunc_type(freefunc))
 #define sk_PKCS7_RECIP_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr), (idx))
 #define sk_PKCS7_RECIP_INFO_set(sk, idx, ptr) ((PKCS7_RECIP_INFO *)OPENSSL_sk_set(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), (idx), ossl_check_PKCS7_RECIP_INFO_type(ptr)))
 #define sk_PKCS7_RECIP_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr))
@@ -232,7 +232,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7, PKCS7, PKCS7)
 #define sk_PKCS7_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr))
 #define sk_PKCS7_pop(sk) ((PKCS7 *)OPENSSL_sk_pop(ossl_check_PKCS7_sk_type(sk)))
 #define sk_PKCS7_shift(sk) ((PKCS7 *)OPENSSL_sk_shift(ossl_check_PKCS7_sk_type(sk)))
-#define sk_PKCS7_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_sk_type(sk),ossl_check_PKCS7_freefunc_type(freefunc))
+#define sk_PKCS7_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_freefunc_type(freefunc))
 #define sk_PKCS7_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr), (idx))
 #define sk_PKCS7_set(sk, idx, ptr) ((PKCS7 *)OPENSSL_sk_set(ossl_check_PKCS7_sk_type(sk), (idx), ossl_check_PKCS7_type(ptr)))
 #define sk_PKCS7_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/proverr.h

@@ -49,6 +49,7 @@
 # define PROV_R_FINAL_CALL_OUT_OF_ORDER                   237
 # define PROV_R_FIPS_MODULE_CONDITIONAL_ERROR             227
 # define PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE          224
+# define PROV_R_FIPS_MODULE_IMPORT_PCT_ERROR              253
 # define PROV_R_FIPS_MODULE_IN_ERROR_STATE                225
 # define PROV_R_GENERATE_ERROR                            191
 # define PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE       165
@@ -133,6 +134,7 @@
 # define PROV_R_PATH_MUST_BE_ABSOLUTE                     219
 # define PROV_R_PERSONALISATION_STRING_TOO_LONG           195
 # define PROV_R_PSS_SALTLEN_TOO_SMALL                     172
+# define PROV_R_REPEATED_PARAMETER                        252
 # define PROV_R_REQUEST_TOO_LARGE_FOR_DRBG                196
 # define PROV_R_REQUIRE_CTR_MODE_CIPHER                   206
 # define PROV_R_RESEED_ERROR                              197

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/safestack.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/safestack.h.in
  *
- * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -36,6 +36,11 @@ extern "C" {
     typedef int (*sk_##t1##_compfunc)(const t3 * const *a, const t3 *const *b); \
     typedef void (*sk_##t1##_freefunc)(t3 *a); \
     typedef t3 * (*sk_##t1##_copyfunc)(const t3 *a); \
+    static ossl_inline void sk_##t1##_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) \
+    { \
+        sk_##t1##_freefunc freefunc = (sk_##t1##_freefunc) freefunc_arg; \
+        freefunc((t3 *)ptr); \
+    } \
     static ossl_unused ossl_inline t2 *ossl_check_##t1##_type(t2 *ptr) \
     { \
         return ptr; \
@@ -66,6 +71,11 @@ extern "C" {
     typedef int (*sk_##t1##_compfunc)(const t3 * const *a, const t3 *const *b); \
     typedef void (*sk_##t1##_freefunc)(t3 *a); \
     typedef t3 * (*sk_##t1##_copyfunc)(const t3 *a); \
+    static ossl_inline void sk_##t1##_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) \
+    { \
+        sk_##t1##_freefunc freefunc = (sk_##t1##_freefunc) freefunc_arg;\
+        freefunc((t3 *)ptr);\
+    } \
     static ossl_unused ossl_inline int sk_##t1##_num(const STACK_OF(t1) *sk) \
     { \
         return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \
@@ -76,7 +86,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new(sk_##t1##_compfunc compare) \
     { \
-        return (STACK_OF(t1) *)OPENSSL_sk_new((OPENSSL_sk_compfunc)compare); \
+        OPENSSL_STACK *ret = OPENSSL_sk_new((OPENSSL_sk_compfunc)compare); \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        return (STACK_OF(t1) *)OPENSSL_sk_set_thunks(ret, f_thunk); \
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new_null(void) \
     { \
@@ -84,7 +98,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new_reserve(sk_##t1##_compfunc compare, int n) \
     { \
-        return (STACK_OF(t1) *)OPENSSL_sk_new_reserve((OPENSSL_sk_compfunc)compare, n); \
+        OPENSSL_STACK *ret = OPENSSL_sk_new_reserve((OPENSSL_sk_compfunc)compare, n); \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        return (STACK_OF(t1) *)OPENSSL_sk_set_thunks(ret, f_thunk); \
     } \
     static ossl_unused ossl_inline int sk_##t1##_reserve(STACK_OF(t1) *sk, int n) \
     { \
@@ -125,6 +143,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline void sk_##t1##_pop_free(STACK_OF(t1) *sk, sk_##t1##_freefunc freefunc) \
     { \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        sk = (STACK_OF(t1) *)OPENSSL_sk_set_thunks((OPENSSL_STACK *)sk, f_thunk); \
+        \
         OPENSSL_sk_pop_free((OPENSSL_STACK *)sk, (OPENSSL_sk_freefunc)freefunc); \
     } \
     static ossl_unused ossl_inline int sk_##t1##_insert(STACK_OF(t1) *sk, t2 *ptr, int idx) \
@@ -217,7 +240,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_STRING, char, char)
 #define sk_OPENSSL_STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr))
 #define sk_OPENSSL_STRING_pop(sk) ((char *)OPENSSL_sk_pop(ossl_check_OPENSSL_STRING_sk_type(sk)))
 #define sk_OPENSSL_STRING_shift(sk) ((char *)OPENSSL_sk_shift(ossl_check_OPENSSL_STRING_sk_type(sk)))
-#define sk_OPENSSL_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_STRING_sk_type(sk),ossl_check_OPENSSL_STRING_freefunc_type(freefunc))
+#define sk_OPENSSL_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_freefunc_type(freefunc))
 #define sk_OPENSSL_STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr), (idx))
 #define sk_OPENSSL_STRING_set(sk, idx, ptr) ((char *)OPENSSL_sk_set(ossl_check_OPENSSL_STRING_sk_type(sk), (idx), ossl_check_OPENSSL_STRING_type(ptr)))
 #define sk_OPENSSL_STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr))
@@ -243,7 +266,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_CSTRING, const char, char)
 #define sk_OPENSSL_CSTRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr))
 #define sk_OPENSSL_CSTRING_pop(sk) ((const char *)OPENSSL_sk_pop(ossl_check_OPENSSL_CSTRING_sk_type(sk)))
 #define sk_OPENSSL_CSTRING_shift(sk) ((const char *)OPENSSL_sk_shift(ossl_check_OPENSSL_CSTRING_sk_type(sk)))
-#define sk_OPENSSL_CSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_CSTRING_sk_type(sk),ossl_check_OPENSSL_CSTRING_freefunc_type(freefunc))
+#define sk_OPENSSL_CSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_freefunc_type(freefunc))
 #define sk_OPENSSL_CSTRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr), (idx))
 #define sk_OPENSSL_CSTRING_set(sk, idx, ptr) ((const char *)OPENSSL_sk_set(ossl_check_OPENSSL_CSTRING_sk_type(sk), (idx), ossl_check_OPENSSL_CSTRING_type(ptr)))
 #define sk_OPENSSL_CSTRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr))
@@ -277,7 +300,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_BLOCK, void, void)
 #define sk_OPENSSL_BLOCK_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr))
 #define sk_OPENSSL_BLOCK_pop(sk) ((void *)OPENSSL_sk_pop(ossl_check_OPENSSL_BLOCK_sk_type(sk)))
 #define sk_OPENSSL_BLOCK_shift(sk) ((void *)OPENSSL_sk_shift(ossl_check_OPENSSL_BLOCK_sk_type(sk)))
-#define sk_OPENSSL_BLOCK_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_BLOCK_sk_type(sk),ossl_check_OPENSSL_BLOCK_freefunc_type(freefunc))
+#define sk_OPENSSL_BLOCK_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_freefunc_type(freefunc))
 #define sk_OPENSSL_BLOCK_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr), (idx))
 #define sk_OPENSSL_BLOCK_set(sk, idx, ptr) ((void *)OPENSSL_sk_set(ossl_check_OPENSSL_BLOCK_sk_type(sk), (idx), ossl_check_OPENSSL_BLOCK_type(ptr)))
 #define sk_OPENSSL_BLOCK_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/self_test.h

@@ -31,6 +31,7 @@ extern "C" {
 # define OSSL_SELF_TEST_TYPE_CRNG               "Continuous_RNG_Test"
 # define OSSL_SELF_TEST_TYPE_PCT                "Conditional_PCT"
 # define OSSL_SELF_TEST_TYPE_PCT_KAT            "Conditional_KAT"
+# define OSSL_SELF_TEST_TYPE_PCT_IMPORT         "Import_PCT"
 # define OSSL_SELF_TEST_TYPE_KAT_INTEGRITY      "KAT_Integrity"
 # define OSSL_SELF_TEST_TYPE_KAT_CIPHER         "KAT_Cipher"
 # define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER    "KAT_AsymmetricCipher"
@@ -50,6 +51,7 @@ extern "C" {
 # define OSSL_SELF_TEST_DESC_PCT_RSA_PKCS1  "RSA"
 # define OSSL_SELF_TEST_DESC_PCT_ECDSA      "ECDSA"
 # define OSSL_SELF_TEST_DESC_PCT_EDDSA      "EDDSA"
+# define OSSL_SELF_TEST_DESC_PCT_DH         "DH"
 # define OSSL_SELF_TEST_DESC_PCT_DSA        "DSA"
 # define OSSL_SELF_TEST_DESC_PCT_ML_DSA     "ML-DSA"
 # define OSSL_SELF_TEST_DESC_PCT_ML_KEM     "ML-KEM"
@@ -65,7 +67,9 @@ extern "C" {
 # define OSSL_SELF_TEST_DESC_SIGN_DSA       "DSA"
 # define OSSL_SELF_TEST_DESC_SIGN_RSA       "RSA"
 # define OSSL_SELF_TEST_DESC_SIGN_ECDSA     "ECDSA"
+# define OSSL_SELF_TEST_DESC_SIGN_DetECDSA  "DetECDSA"
 # define OSSL_SELF_TEST_DESC_SIGN_EDDSA     "EDDSA"
+# define OSSL_SELF_TEST_DESC_SIGN_LMS       "LMS"
 # define OSSL_SELF_TEST_DESC_SIGN_ML_DSA    "ML-DSA"
 # define OSSL_SELF_TEST_DESC_SIGN_SLH_DSA   "SLH-DSA"
 # define OSSL_SELF_TEST_DESC_KEM            "KEM"

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/srp.h

@@ -59,7 +59,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_gN_cache, SRP_gN_cache, SRP_gN_cache)
 #define sk_SRP_gN_cache_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr))
 #define sk_SRP_gN_cache_pop(sk) ((SRP_gN_cache *)OPENSSL_sk_pop(ossl_check_SRP_gN_cache_sk_type(sk)))
 #define sk_SRP_gN_cache_shift(sk) ((SRP_gN_cache *)OPENSSL_sk_shift(ossl_check_SRP_gN_cache_sk_type(sk)))
-#define sk_SRP_gN_cache_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_cache_sk_type(sk),ossl_check_SRP_gN_cache_freefunc_type(freefunc))
+#define sk_SRP_gN_cache_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_freefunc_type(freefunc))
 #define sk_SRP_gN_cache_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr), (idx))
 #define sk_SRP_gN_cache_set(sk, idx, ptr) ((SRP_gN_cache *)OPENSSL_sk_set(ossl_check_SRP_gN_cache_sk_type(sk), (idx), ossl_check_SRP_gN_cache_type(ptr)))
 #define sk_SRP_gN_cache_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr))
@@ -99,7 +99,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_user_pwd, SRP_user_pwd, SRP_user_pwd)
 #define sk_SRP_user_pwd_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr))
 #define sk_SRP_user_pwd_pop(sk) ((SRP_user_pwd *)OPENSSL_sk_pop(ossl_check_SRP_user_pwd_sk_type(sk)))
 #define sk_SRP_user_pwd_shift(sk) ((SRP_user_pwd *)OPENSSL_sk_shift(ossl_check_SRP_user_pwd_sk_type(sk)))
-#define sk_SRP_user_pwd_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_user_pwd_sk_type(sk),ossl_check_SRP_user_pwd_freefunc_type(freefunc))
+#define sk_SRP_user_pwd_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_freefunc_type(freefunc))
 #define sk_SRP_user_pwd_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr), (idx))
 #define sk_SRP_user_pwd_set(sk, idx, ptr) ((SRP_user_pwd *)OPENSSL_sk_set(ossl_check_SRP_user_pwd_sk_type(sk), (idx), ossl_check_SRP_user_pwd_type(ptr)))
 #define sk_SRP_user_pwd_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr))
@@ -158,7 +158,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_gN, SRP_gN, SRP_gN)
 #define sk_SRP_gN_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr))
 #define sk_SRP_gN_pop(sk) ((SRP_gN *)OPENSSL_sk_pop(ossl_check_SRP_gN_sk_type(sk)))
 #define sk_SRP_gN_shift(sk) ((SRP_gN *)OPENSSL_sk_shift(ossl_check_SRP_gN_sk_type(sk)))
-#define sk_SRP_gN_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_sk_type(sk),ossl_check_SRP_gN_freefunc_type(freefunc))
+#define sk_SRP_gN_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_freefunc_type(freefunc))
 #define sk_SRP_gN_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr), (idx))
 #define sk_SRP_gN_set(sk, idx, ptr) ((SRP_gN *)OPENSSL_sk_set(ossl_check_SRP_gN_sk_type(sk), (idx), ossl_check_SRP_gN_type(ptr)))
 #define sk_SRP_gN_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ssl.h

@@ -258,7 +258,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRTP_PROTECTION_PROFILE, SRTP_PROTECTION_PROFILE, S
 #define sk_SRTP_PROTECTION_PROFILE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr))
 #define sk_SRTP_PROTECTION_PROFILE_pop(sk) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_pop(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk)))
 #define sk_SRTP_PROTECTION_PROFILE_shift(sk) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_shift(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk)))
-#define sk_SRTP_PROTECTION_PROFILE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk),ossl_check_SRTP_PROTECTION_PROFILE_freefunc_type(freefunc))
+#define sk_SRTP_PROTECTION_PROFILE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_freefunc_type(freefunc))
 #define sk_SRTP_PROTECTION_PROFILE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr), (idx))
 #define sk_SRTP_PROTECTION_PROFILE_set(sk, idx, ptr) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_set(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), (idx), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr)))
 #define sk_SRTP_PROTECTION_PROFILE_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr))
@@ -401,13 +401,16 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
 # define SSL_OP_ENABLE_MIDDLEBOX_COMPAT                  SSL_OP_BIT(20)
     /*
      * Prioritize Chacha20Poly1305 when client does.
-     * Modifies SSL_OP_CIPHER_SERVER_PREFERENCE
+     * Modifies SSL_OP_SERVER_PREFERENCE
      */
 # define SSL_OP_PRIORITIZE_CHACHA                        SSL_OP_BIT(21)
     /*
-     * Set on servers to choose the cipher according to server's preferences.
+     * Set on servers to choose cipher, curve or group according to server's
+     * preferences.
      */
-# define SSL_OP_CIPHER_SERVER_PREFERENCE                 SSL_OP_BIT(22)
+# define SSL_OP_SERVER_PREFERENCE                        SSL_OP_BIT(22)
+    /* Equivalent definition for backwards compatibility: */
+# define SSL_OP_CIPHER_SERVER_PREFERENCE SSL_OP_SERVER_PREFERENCE
     /*
      * If set, a server will allow a client to issue an SSLv3.0 version
      * number as latest version supported in the premaster secret, even when
@@ -446,8 +449,8 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
 # define SSL_OP_NO_RX_CERTIFICATE_COMPRESSION            SSL_OP_BIT(33)
     /* Enable KTLS TX zerocopy on Linux */
 # define SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE         SSL_OP_BIT(34)
-
-#define SSL_OP_PREFER_NO_DHE_KEX                         SSL_OP_BIT(35)
+# define SSL_OP_PREFER_NO_DHE_KEX                        SSL_OP_BIT(35)
+# define SSL_OP_LEGACY_EC_POINT_FORMATS                  SSL_OP_BIT(36)
 
 /*
  * Option "collections."
@@ -824,7 +827,7 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
 # endif
 
 __owur int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
-                                 const unsigned char *in, unsigned int inlen,
+                                 const unsigned char *server, unsigned int server_len,
                                  const unsigned char *client,
                                  unsigned int client_len);
 
@@ -1010,7 +1013,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SSL_CIPHER, const SSL_CIPHER, SSL_CIPHER)
 #define sk_SSL_CIPHER_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr))
 #define sk_SSL_CIPHER_pop(sk) ((const SSL_CIPHER *)OPENSSL_sk_pop(ossl_check_SSL_CIPHER_sk_type(sk)))
 #define sk_SSL_CIPHER_shift(sk) ((const SSL_CIPHER *)OPENSSL_sk_shift(ossl_check_SSL_CIPHER_sk_type(sk)))
-#define sk_SSL_CIPHER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_CIPHER_sk_type(sk),ossl_check_SSL_CIPHER_freefunc_type(freefunc))
+#define sk_SSL_CIPHER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_freefunc_type(freefunc))
 #define sk_SSL_CIPHER_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr), (idx))
 #define sk_SSL_CIPHER_set(sk, idx, ptr) ((const SSL_CIPHER *)OPENSSL_sk_set(ossl_check_SSL_CIPHER_sk_type(sk), (idx), ossl_check_SSL_CIPHER_type(ptr)))
 #define sk_SSL_CIPHER_find(sk, ptr) OPENSSL_sk_find(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr))
@@ -1386,6 +1389,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_CTRL_GET0_IMPLEMENTED_GROUPS        139
 # define SSL_CTRL_GET_SIGNATURE_NAME             140
 # define SSL_CTRL_GET_PEER_SIGNATURE_NAME        141
+# define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP_EX        142
+# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP_EX        143
 # define SSL_CERT_SET_FIRST                      1
 # define SSL_CERT_SET_NEXT                       2
 # define SSL_CERT_SET_SERVER                     3
@@ -2404,6 +2409,8 @@ __owur SSL *SSL_new_stream(SSL *s, uint64_t flags);
 __owur int SSL_set_incoming_stream_policy(SSL *s, int policy, uint64_t aec);
 
 #define SSL_ACCEPT_STREAM_NO_BLOCK      (1U << 0)
+#define SSL_ACCEPT_STREAM_UNI           (1U << 1)
+#define SSL_ACCEPT_STREAM_BIDI          (1U << 2)
 __owur SSL *SSL_accept_stream(SSL *s, uint64_t flags);
 __owur size_t SSL_get_accept_stream_queue_len(SSL *s);
 

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/stack.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -24,6 +24,7 @@ typedef struct stack_st OPENSSL_STACK; /* Use STACK_OF(...) instead */
 
 typedef int (*OPENSSL_sk_compfunc)(const void *, const void *);
 typedef void (*OPENSSL_sk_freefunc)(void *);
+typedef void (*OPENSSL_sk_freefunc_thunk)(OPENSSL_sk_freefunc, void *);
 typedef void *(*OPENSSL_sk_copyfunc)(const void *);
 
 int OPENSSL_sk_num(const OPENSSL_STACK *);
@@ -34,9 +35,10 @@ void *OPENSSL_sk_set(OPENSSL_STACK *st, int i, const void *data);
 OPENSSL_STACK *OPENSSL_sk_new(OPENSSL_sk_compfunc cmp);
 OPENSSL_STACK *OPENSSL_sk_new_null(void);
 OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n);
+OPENSSL_STACK *OPENSSL_sk_set_thunks(OPENSSL_STACK *st, OPENSSL_sk_freefunc_thunk f_thunk);
 int OPENSSL_sk_reserve(OPENSSL_STACK *st, int n);
 void OPENSSL_sk_free(OPENSSL_STACK *);
-void OPENSSL_sk_pop_free(OPENSSL_STACK *st, void (*func) (void *));
+void OPENSSL_sk_pop_free(OPENSSL_STACK *st, OPENSSL_sk_freefunc func);
 OPENSSL_STACK *OPENSSL_sk_deep_copy(const OPENSSL_STACK *,
                                     OPENSSL_sk_copyfunc c,
                                     OPENSSL_sk_freefunc f);