Fix Cashu long-message guard bypass

Co-authored-by: jack <jackjackbits@users.noreply.github.com>

.github/workflows/swift-tests.yml

@@ -21,10 +21,6 @@ jobs:
             path: localPackages/BitLogger
           - name: BitFoundation
             path: localPackages/BitFoundation
-          - name: Noise
-            path: localPackages/Noise
-          - name: Nostr
-            path: localPackages/Nostr
 
     steps:
       - name: Checkout code

Package.swift

@@ -17,10 +17,8 @@ let package = Package(
     ],
     dependencies:[
         .package(path: "localPackages/Arti"),
-        .package(path: "localPackages/Noise"),
         .package(path: "localPackages/BitFoundation"),
         .package(path: "localPackages/BitLogger"),
-        .package(path: "localPackages/Nostr"),
         .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1", exact: "0.21.1")
     ],
     targets: [
@@ -30,8 +28,6 @@ let package = Package(
                 .product(name: "P256K", package: "swift-secp256k1"),
                 .product(name: "BitFoundation", package: "BitFoundation"),
                 .product(name: "BitLogger", package: "BitLogger"),
-                .product(name: "Noise", package: "Noise"),
-                .product(name: "Nostr", package: "Nostr"),
                 .product(name: "Tor", package: "Arti")
             ],
             path: "bitchat",
@@ -52,8 +48,7 @@ let package = Package(
             name: "bitchatTests",
             dependencies: [
                 "bitchat",
-                .product(name: "BitFoundation", package: "BitFoundation"),
-                .product(name: "Nostr", package: "Nostr")
+                .product(name: "BitFoundation", package: "BitFoundation")
             ],
             path: "bitchatTests",
             exclude: [
@@ -61,7 +56,8 @@ let package = Package(
                 "README.md"
             ],
             resources: [
-                .process("Localization")
+                .process("Localization"),
+                .process("Noise")
             ]
         )
     ]

bitchat.xcodeproj/project.pbxproj

@@ -10,10 +10,6 @@
 		17901751FD8010AFC8E750F2 /* bitchatShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 61F92EBA29C47C0FCC482F1F /* bitchatShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		3EE336D150427F736F32B56C /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = B1D9136AA0083366353BFA2F /* P256K */; };
 		885BBED78092484A5B069461 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 4EB6BA1B8464F1EA38F4E286 /* P256K */; };
-		A63163B62F80CB2500B8B128 /* Noise in Frameworks */ = {isa = PBXBuildFile; productRef = A63163B52F80CB2500B8B128 /* Noise */; };
-		A63163B82F80CB2D00B8B128 /* Noise in Frameworks */ = {isa = PBXBuildFile; productRef = A63163B72F80CB2D00B8B128 /* Noise */; };
-		A63180832F8103AB00B8B128 /* Nostr in Frameworks */ = {isa = PBXBuildFile; productRef = A63180822F8103AB00B8B128 /* Nostr */; };
-		A63180852F8103B600B8B128 /* Nostr in Frameworks */ = {isa = PBXBuildFile; productRef = A63180842F8103B600B8B128 /* Nostr */; };
 		A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9472F80953E001CF9B9 /* BitFoundation */; };
 		A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9492F809550001CF9B9 /* BitFoundation */; };
 		A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3E56F2E77036A0032EA8A /* BitLogger */; };
@@ -160,9 +156,7 @@
 			isa = PBXFrameworksBuildPhase;
 			files = (
 				A6E3E5722E7703760032EA8A /* BitLogger in Frameworks */,
-				A63163B82F80CB2D00B8B128 /* Noise in Frameworks */,
 				3EE336D150427F736F32B56C /* P256K in Frameworks */,
-				A63180852F8103B600B8B128 /* Nostr in Frameworks */,
 				A6E3EA812E7706A80032EA8A /* Tor in Frameworks */,
 				A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */,
 			);
@@ -171,9 +165,7 @@
 			isa = PBXFrameworksBuildPhase;
 			files = (
 				A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */,
-				A63163B62F80CB2500B8B128 /* Noise in Frameworks */,
 				885BBED78092484A5B069461 /* P256K in Frameworks */,
-				A63180832F8103AB00B8B128 /* Nostr in Frameworks */,
 				A6E3EA7F2E7706720032EA8A /* Tor in Frameworks */,
 				A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */,
 			);
@@ -236,8 +228,6 @@
 				A6E3E5712E7703760032EA8A /* BitLogger */,
 				A6E3EA802E7706A80032EA8A /* Tor */,
 				A6BCF9492F809550001CF9B9 /* BitFoundation */,
-				A63163B72F80CB2D00B8B128 /* Noise */,
-				A63180842F8103B600B8B128 /* Nostr */,
 			);
 			productName = bitchat_macOS;
 			productReference = 8F3A7C058C2C8E1A06C8CF8B /* bitchat.app */;
@@ -319,8 +309,6 @@
 				A6E3E56F2E77036A0032EA8A /* BitLogger */,
 				A6E3EA7E2E7706720032EA8A /* Tor */,
 				A6BCF9472F80953E001CF9B9 /* BitFoundation */,
-				A63163B52F80CB2500B8B128 /* Noise */,
-				A63180822F8103AB00B8B128 /* Nostr */,
 			);
 			productName = bitchat_iOS;
 			productReference = 96D0D41CA19EE5A772AA8434 /* bitchat.app */;
@@ -363,8 +351,6 @@
 				A6E3E56E2E77036A0032EA8A /* XCLocalSwiftPackageReference "localPackages/BitLogger" */,
 				A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Arti" */,
 				A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */,
-				A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */,
-				A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */,
 			);
 			preferredProjectObjectVersion = 90;
 			projectDirPath = "";
@@ -930,14 +916,6 @@
 /* End XCConfigurationList section */
 
 /* Begin XCLocalSwiftPackageReference section */
-		A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */ = {
-			isa = XCLocalSwiftPackageReference;
-			relativePath = localPackages/Noise;
-		};
-		A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */ = {
-			isa = XCLocalSwiftPackageReference;
-			relativePath = localPackages/Nostr;
-		};
 		A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = localPackages/BitFoundation;
@@ -969,24 +947,6 @@
 			package = B8C407587481BBB190741C93 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
 			productName = P256K;
 		};
-		A63163B52F80CB2500B8B128 /* Noise */ = {
-			isa = XCSwiftPackageProductDependency;
-			productName = Noise;
-		};
-		A63163B72F80CB2D00B8B128 /* Noise */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = A63163B42F80CB2500B8B128 /* XCLocalSwiftPackageReference "localPackages/Noise" */;
-			productName = Noise;
-		};
-		A63180822F8103AB00B8B128 /* Nostr */ = {
-			isa = XCSwiftPackageProductDependency;
-			productName = Nostr;
-		};
-		A63180842F8103B600B8B128 /* Nostr */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = A63180812F8103AB00B8B128 /* XCLocalSwiftPackageReference "localPackages/Nostr" */;
-			productName = Nostr;
-		};
 		A6BCF9472F80953E001CF9B9 /* BitFoundation */ = {
 			isa = XCSwiftPackageProductDependency;
 			productName = BitFoundation;

bitchat/App/AppArchitecture.swift

@@ -0,0 +1,363 @@
+import BitFoundation
+import Combine
+import Foundation
+
+enum SharedContentKind: String, Sendable, Equatable {
+    case text
+    case url
+}
+
+enum RuntimeScenePhase: String, Sendable, Equatable {
+    case active
+    case inactive
+    case background
+}
+
+enum TorLifecycleEvent: String, Sendable, Equatable {
+    case willStart
+    case willRestart
+    case didBecomeReady
+    case preferenceChanged
+}
+
+enum AppEvent: Sendable, Equatable {
+    case launched
+    case startupCompleted
+    case scenePhaseChanged(RuntimeScenePhase)
+    case openedURL(String)
+    case sharedContentAccepted(SharedContentKind)
+    case notificationOpened(peerID: PeerID?)
+    case deepLinkOpened(String)
+    case torLifecycleChanged(TorLifecycleEvent)
+    case nostrRelayConnectionChanged(Bool)
+    case terminationRequested
+}
+
+actor AppEventStream {
+    private var continuations: [UUID: AsyncStream<AppEvent>.Continuation] = [:]
+
+    func stream() -> AsyncStream<AppEvent> {
+        let id = UUID()
+        return AsyncStream { continuation in
+            continuations[id] = continuation
+            continuation.onTermination = { [id] _ in
+                Task {
+                    await self.removeContinuation(id)
+                }
+            }
+        }
+    }
+
+    func emit(_ event: AppEvent) {
+        for continuation in continuations.values {
+            continuation.yield(event)
+        }
+    }
+
+    func finish() {
+        for continuation in continuations.values {
+            continuation.finish()
+        }
+        continuations.removeAll()
+    }
+
+    private func removeContinuation(_ id: UUID) {
+        continuations.removeValue(forKey: id)
+    }
+}
+
+struct PeerHandle: Sendable, Identifiable {
+    let id: String
+    let routingPeerID: PeerID
+    let displayName: String?
+    let noisePublicKeyHex: String?
+    let nostrPublicKey: String?
+}
+
+extension PeerHandle: Equatable {
+    static func == (lhs: PeerHandle, rhs: PeerHandle) -> Bool {
+        lhs.id == rhs.id
+    }
+}
+
+extension PeerHandle: Hashable {
+    func hash(into hasher: inout Hasher) {
+        hasher.combine(id)
+    }
+}
+
+enum ConversationID: Hashable, Sendable {
+    case mesh
+    case geohash(String)
+    case direct(PeerHandle)
+
+    init(channelID: ChannelID) {
+        switch channelID {
+        case .mesh:
+            self = .mesh
+        case .location(let channel):
+            self = .geohash(channel.geohash.lowercased())
+        }
+    }
+}
+
+@MainActor
+final class IdentityResolver {
+    private var handlesByRoutingPeerID: [PeerID: PeerHandle] = [:]
+    private var handlesByNoiseKey: [String: PeerHandle] = [:]
+    private var handlesByNostrKey: [String: PeerHandle] = [:]
+
+    func register(peers: [BitchatPeer]) {
+        for peer in peers {
+            _ = register(peer: peer)
+        }
+    }
+
+    @discardableResult
+    func register(peer: BitchatPeer) -> PeerHandle {
+        let handle = buildHandle(
+            routingPeerID: peer.peerID,
+            displayName: peer.displayName,
+            noisePublicKeyHex: peer.noisePublicKey.isEmpty ? nil : peer.noisePublicKey.hexEncodedString().lowercased(),
+            nostrPublicKey: normalizedNostrKey(peer.nostrPublicKey)
+        )
+        cache(handle)
+        return handle
+    }
+
+    func canonicalHandle(for peerID: PeerID, displayName: String? = nil) -> PeerHandle {
+        if let handle = handlesByRoutingPeerID[peerID] {
+            return handle
+        }
+
+        if peerID.isNoiseKeyHex, let handle = handlesByNoiseKey[peerID.bare] {
+            return handle
+        }
+
+        if (peerID.isGeoDM || peerID.isGeoChat), let handle = handlesByNostrKey[peerID.bare] {
+            return handle
+        }
+
+        let handle = buildHandle(
+            routingPeerID: peerID,
+            displayName: displayName,
+            noisePublicKeyHex: peerID.isNoiseKeyHex ? peerID.bare : nil,
+            nostrPublicKey: (peerID.isGeoDM || peerID.isGeoChat) ? peerID.bare : nil
+        )
+        cache(handle)
+        return handle
+    }
+
+    private func buildHandle(
+        routingPeerID: PeerID,
+        displayName: String?,
+        noisePublicKeyHex: String?,
+        nostrPublicKey: String?
+    ) -> PeerHandle {
+        let canonicalID: String
+        if let noisePublicKeyHex {
+            canonicalID = "noise:\(noisePublicKeyHex)"
+        } else if let nostrPublicKey {
+            canonicalID = "nostr:\(nostrPublicKey)"
+        } else {
+            canonicalID = "mesh:\(routingPeerID.id)"
+        }
+
+        let normalizedDisplayName: String?
+        if let displayName, !displayName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            normalizedDisplayName = displayName
+        } else {
+            normalizedDisplayName = nil
+        }
+
+        return PeerHandle(
+            id: canonicalID,
+            routingPeerID: routingPeerID,
+            displayName: normalizedDisplayName,
+            noisePublicKeyHex: noisePublicKeyHex,
+            nostrPublicKey: nostrPublicKey
+        )
+    }
+
+    private func normalizedNostrKey(_ nostrPublicKey: String?) -> String? {
+        guard let nostrPublicKey else { return nil }
+        let trimmed = nostrPublicKey.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        return trimmed.isEmpty ? nil : trimmed
+    }
+
+    private func cache(_ handle: PeerHandle) {
+        handlesByRoutingPeerID[handle.routingPeerID] = handle
+        if let noisePublicKeyHex = handle.noisePublicKeyHex {
+            handlesByNoiseKey[noisePublicKeyHex] = handle
+        }
+        if let nostrPublicKey = handle.nostrPublicKey {
+            handlesByNostrKey[nostrPublicKey] = handle
+        }
+    }
+}
+
+@MainActor
+final class ConversationStore: ObservableObject {
+    @Published private(set) var activeChannel: ChannelID = .mesh
+    @Published private(set) var selectedPrivatePeerID: PeerID?
+    @Published private(set) var selectedConversationID: ConversationID = .mesh
+    @Published private(set) var unreadConversations: Set<ConversationID> = []
+    @Published private(set) var messagesByConversation: [ConversationID: [BitchatMessage]] = [:]
+
+    private var directHandlesByConversation: [ConversationID: PeerHandle] = [:]
+
+    func setActiveChannel(_ channelID: ChannelID) {
+        activeChannel = channelID
+        if selectedPrivatePeerID == nil {
+            selectedConversationID = ConversationID(channelID: channelID)
+        }
+    }
+
+    func setSelectedPeerID(
+        _ peerID: PeerID?,
+        activeChannel: ChannelID,
+        identityResolver: IdentityResolver
+    ) {
+        self.activeChannel = activeChannel
+        selectedPrivatePeerID = peerID
+
+        if let peerID {
+            selectedConversationID = directConversationID(
+                for: peerID,
+                identityResolver: identityResolver
+            )
+        } else {
+            selectedConversationID = ConversationID(channelID: activeChannel)
+        }
+    }
+
+    func replaceMessages(_ messages: [BitchatMessage], for conversationID: ConversationID) {
+        messagesByConversation[conversationID] = normalized(messages)
+    }
+
+    func replaceMessages(_ messages: [BitchatMessage], for channelID: ChannelID) {
+        replaceMessages(messages, for: ConversationID(channelID: channelID))
+    }
+
+    func synchronizePublicConversation(_ messages: [BitchatMessage], activeChannel: ChannelID) {
+        setActiveChannel(activeChannel)
+        replaceMessages(messages, for: activeChannel)
+    }
+
+    func messages(for conversationID: ConversationID) -> [BitchatMessage] {
+        messagesByConversation[conversationID] ?? []
+    }
+
+    func directMessages(
+        for peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) -> [BitchatMessage] {
+        messages(for: directConversationID(for: peerID, identityResolver: identityResolver))
+    }
+
+    func directMessagesByPeerID() -> [PeerID: [BitchatMessage]] {
+        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
+
+        for (conversationID, handle) in directHandlesByConversation {
+            messagesByPeerID[handle.routingPeerID] = messages(for: conversationID)
+        }
+
+        return messagesByPeerID
+    }
+
+    func unreadDirectPeerIDs() -> Set<PeerID> {
+        unreadConversations.reduce(into: Set<PeerID>()) { result, conversationID in
+            guard case .direct(let handle) = conversationID else { return }
+            result.insert(directHandlesByConversation[conversationID]?.routingPeerID ?? handle.routingPeerID)
+        }
+    }
+
+    func synchronizeSelection(
+        activeChannel: ChannelID,
+        selectedPeerID: PeerID?,
+        identityResolver: IdentityResolver
+    ) {
+        setSelectedPeerID(
+            selectedPeerID,
+            activeChannel: activeChannel,
+            identityResolver: identityResolver
+        )
+    }
+
+    func synchronizePrivateChats(
+        _ privateChats: [PeerID: [BitchatMessage]],
+        unreadPeerIDs: Set<PeerID>,
+        identityResolver: IdentityResolver
+    ) {
+        var liveConversations = Set<ConversationID>()
+
+        for (peerID, messages) in privateChats {
+            let handle = identityResolver.canonicalHandle(for: peerID, displayName: messages.last?.sender)
+            let conversationID = ConversationID.direct(handle)
+            liveConversations.insert(conversationID)
+            directHandlesByConversation[conversationID] = handle
+            messagesByConversation[conversationID] = normalized(messages)
+        }
+
+        let staleDirectConversations = messagesByConversation.keys.filter { conversationID in
+            guard case .direct = conversationID else { return false }
+            return !liveConversations.contains(conversationID)
+        }
+
+        for conversationID in staleDirectConversations {
+            messagesByConversation.removeValue(forKey: conversationID)
+            unreadConversations.remove(conversationID)
+            directHandlesByConversation.removeValue(forKey: conversationID)
+        }
+
+        let publicUnread = unreadConversations.filter { conversationID in
+            switch conversationID {
+            case .mesh, .geohash:
+                return true
+            case .direct:
+                return false
+            }
+        }
+
+        unreadConversations = unreadPeerIDs.reduce(into: publicUnread) { result, peerID in
+            let handle = identityResolver.canonicalHandle(for: peerID)
+            result.insert(.direct(handle))
+        }
+    }
+
+    func markRead(_ conversationID: ConversationID) {
+        unreadConversations.remove(conversationID)
+    }
+
+    func markRead(
+        peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) {
+        markRead(directConversationID(for: peerID, identityResolver: identityResolver))
+    }
+
+    private func normalized(_ messages: [BitchatMessage]) -> [BitchatMessage] {
+        var uniqueMessages: [String: BitchatMessage] = [:]
+
+        for message in messages {
+            uniqueMessages[message.id] = message
+        }
+
+        return uniqueMessages.values.sorted { lhs, rhs in
+            if lhs.timestamp != rhs.timestamp {
+                return lhs.timestamp < rhs.timestamp
+            }
+            return lhs.id < rhs.id
+        }
+    }
+
+    private func directConversationID(
+        for peerID: PeerID,
+        identityResolver: IdentityResolver
+    ) -> ConversationID {
+        let handle = identityResolver.canonicalHandle(for: peerID)
+        let conversationID = ConversationID.direct(handle)
+        directHandlesByConversation[conversationID] = handle
+        return conversationID
+    }
+}

bitchat/App/AppChromeModel.swift

@@ -0,0 +1,100 @@
+import BitFoundation
+import Combine
+import CoreBluetooth
+import Foundation
+
+@MainActor
+final class AppChromeModel: ObservableObject {
+    @Published private(set) var hasUnreadPrivateMessages = false
+    @Published var nickname: String
+    @Published var showingFingerprintFor: PeerID?
+    @Published var isAppInfoPresented = false
+    @Published var isLocationChannelsSheetPresented = false
+    @Published var showBluetoothAlert = false
+    @Published var bluetoothAlertMessage = ""
+    @Published var bluetoothState: CBManagerState = .unknown
+    @Published var showScreenshotPrivacyWarning = false
+
+    private let chatViewModel: ChatViewModel
+    private var cancellables = Set<AnyCancellable>()
+
+    init(chatViewModel: ChatViewModel, privateInboxModel: PrivateInboxModel) {
+        self.chatViewModel = chatViewModel
+        self.nickname = chatViewModel.nickname
+
+        bind(privateInboxModel: privateInboxModel)
+    }
+
+    var shouldSuppressScreenshotNotification: Bool {
+        isLocationChannelsSheetPresented || isAppInfoPresented
+    }
+
+    func setNickname(_ nickname: String) {
+        self.nickname = nickname
+        if chatViewModel.nickname != nickname {
+            chatViewModel.nickname = nickname
+        }
+    }
+
+    func validateAndSaveNickname() {
+        chatViewModel.validateAndSaveNickname()
+        if nickname != chatViewModel.nickname {
+            nickname = chatViewModel.nickname
+        }
+    }
+
+    func openMostRelevantPrivateChat() {
+        chatViewModel.openMostRelevantPrivateChat()
+    }
+
+    func showFingerprint(for peerID: PeerID) {
+        showingFingerprintFor = peerID
+    }
+
+    func clearFingerprint() {
+        showingFingerprintFor = nil
+    }
+
+    func presentAppInfo() {
+        isAppInfoPresented = true
+    }
+
+    func triggerScreenshotPrivacyWarning() {
+        showScreenshotPrivacyWarning = true
+    }
+
+    func panicClearAllData() {
+        chatViewModel.panicClearAllData()
+    }
+
+    private func bind(privateInboxModel: PrivateInboxModel) {
+        privateInboxModel.$unreadPeerIDs
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] unreadPeerIDs in
+                self?.hasUnreadPrivateMessages = !unreadPeerIDs.isEmpty
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.$nickname
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] nickname in
+                guard let self, self.nickname != nickname else { return }
+                self.nickname = nickname
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.$showBluetoothAlert
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$showBluetoothAlert)
+
+        chatViewModel.$bluetoothAlertMessage
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$bluetoothAlertMessage)
+
+        chatViewModel.$bluetoothState
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$bluetoothState)
+
+        hasUnreadPrivateMessages = !privateInboxModel.unreadPeerIDs.isEmpty
+    }
+}

bitchat/App/AppRuntime.swift

@@ -0,0 +1,387 @@
+import BitFoundation
+import Combine
+import Foundation
+import SwiftUI
+import Tor
+import UserNotifications
+#if os(iOS)
+import UIKit
+#elseif os(macOS)
+import AppKit
+#endif
+
+@MainActor
+final class AppRuntime: ObservableObject {
+    let chatViewModel: ChatViewModel
+    let events = AppEventStream()
+    let conversationStore: ConversationStore
+    let peerIdentityStore: PeerIdentityStore
+    let locationPresenceStore: LocationPresenceStore
+    let publicChatModel: PublicChatModel
+    let privateInboxModel: PrivateInboxModel
+    let privateConversationModel: PrivateConversationModel
+    let verificationModel: VerificationModel
+    let conversationUIModel: ConversationUIModel
+    let locationChannelsModel: LocationChannelsModel
+    let peerListModel: PeerListModel
+    let appChromeModel: AppChromeModel
+
+    private let idBridge: NostrIdentityBridge
+    private var cancellables = Set<AnyCancellable>()
+    private var started = false
+    private var lastNostrRelayConnectedState = false
+    private var didHandleInitialNostrConnection = false
+
+    #if os(iOS)
+    private var didHandleInitialActive = false
+    private var didEnterBackground = false
+    #endif
+
+    init(
+        keychain: KeychainManagerProtocol = KeychainManager(),
+        idBridge: NostrIdentityBridge = NostrIdentityBridge()
+    ) {
+        self.idBridge = idBridge
+        let identityResolver = IdentityResolver()
+        let conversationStore = ConversationStore()
+        let peerIdentityStore = PeerIdentityStore()
+        let locationPresenceStore = LocationPresenceStore()
+        let locationManager = LocationChannelManager.shared
+        self.conversationStore = conversationStore
+        self.peerIdentityStore = peerIdentityStore
+        self.locationPresenceStore = locationPresenceStore
+        self.chatViewModel = ChatViewModel(
+            keychain: keychain,
+            idBridge: idBridge,
+            identityManager: SecureIdentityStateManager(keychain),
+            conversationStore: conversationStore,
+            identityResolver: identityResolver,
+            peerIdentityStore: peerIdentityStore,
+            locationPresenceStore: locationPresenceStore,
+            locationManager: locationManager
+        )
+        self.publicChatModel = PublicChatModel(conversationStore: conversationStore)
+        self.privateInboxModel = PrivateInboxModel(conversationStore: conversationStore)
+        self.locationChannelsModel = LocationChannelsModel(manager: locationManager)
+        self.privateConversationModel = PrivateConversationModel(
+            chatViewModel: self.chatViewModel,
+            conversationStore: conversationStore,
+            locationChannelsModel: self.locationChannelsModel,
+            peerIdentityStore: peerIdentityStore
+        )
+        self.verificationModel = VerificationModel(
+            chatViewModel: self.chatViewModel,
+            privateConversationModel: self.privateConversationModel,
+            peerIdentityStore: peerIdentityStore
+        )
+        self.conversationUIModel = ConversationUIModel(
+            chatViewModel: self.chatViewModel,
+            privateConversationModel: self.privateConversationModel,
+            conversationStore: conversationStore
+        )
+        self.peerListModel = PeerListModel(
+            chatViewModel: self.chatViewModel,
+            conversationStore: conversationStore,
+            locationChannelsModel: self.locationChannelsModel,
+            peerIdentityStore: peerIdentityStore,
+            locationPresenceStore: locationPresenceStore
+        )
+        self.appChromeModel = AppChromeModel(
+            chatViewModel: self.chatViewModel,
+            privateInboxModel: self.privateInboxModel
+        )
+
+        GeoRelayDirectory.shared.prefetchIfNeeded()
+        bindRuntimeObservers()
+        NotificationDelegate.shared.runtime = self
+    }
+
+    func start() {
+        guard !started else {
+            checkForSharedContent()
+            return
+        }
+
+        started = true
+        NotificationDelegate.shared.runtime = self
+        VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
+        announceInitialTorStatusIfNeeded()
+
+        Task(priority: .utility) { [weak self] in
+            guard let self else { return }
+            let nickname = await MainActor.run { self.chatViewModel.nickname }
+            let npub = await MainActor.run {
+                try? self.idBridge.getCurrentNostrIdentity()?.npub
+            }
+            await MainActor.run {
+                _ = VerificationService.shared.buildMyQRString(nickname: nickname, npub: npub)
+            }
+        }
+
+        NetworkActivationService.shared.start()
+        GeohashPresenceService.shared.start()
+        checkForSharedContent()
+
+        record(.launched)
+        record(.startupCompleted)
+    }
+
+    func handleOpenURL(_ url: URL) {
+        record(.openedURL(url.absoluteString))
+
+        if url.scheme == "bitchat", url.host == "share" {
+            checkForSharedContent()
+        }
+    }
+
+    func handleDidBecomeActiveNotification() {
+        chatViewModel.handleDidBecomeActive()
+        checkForSharedContent()
+    }
+
+    #if os(macOS)
+    func handleMacDidBecomeActiveNotification() {
+        record(.scenePhaseChanged(.active))
+        chatViewModel.handleDidBecomeActive()
+        checkForSharedContent()
+    }
+    #endif
+
+    #if os(iOS)
+    func handleScenePhaseChange(_ newPhase: ScenePhase) {
+        switch newPhase {
+        case .background:
+            record(.scenePhaseChanged(.background))
+            TorManager.shared.setAppForeground(false)
+            TorManager.shared.goDormantOnBackground()
+            chatViewModel.endGeohashSampling()
+            NostrRelayManager.shared.disconnect()
+            didEnterBackground = true
+
+        case .active:
+            record(.scenePhaseChanged(.active))
+            chatViewModel.meshService.startServices()
+            TorManager.shared.setAppForeground(true)
+            let shouldRefreshNostrConnections = didHandleInitialActive && didEnterBackground
+
+            if didHandleInitialActive && didEnterBackground {
+                if TorManager.shared.isAutoStartAllowed() && !TorManager.shared.isReady {
+                    TorManager.shared.ensureRunningOnForeground()
+                }
+            } else {
+                didHandleInitialActive = true
+            }
+
+            didEnterBackground = false
+
+            if shouldRefreshNostrConnections && TorManager.shared.isAutoStartAllowed() {
+                Task.detached {
+                    let _ = await TorManager.shared.awaitReady(timeout: 60)
+                    await MainActor.run {
+                        TorURLSession.shared.rebuild()
+                        NostrRelayManager.shared.resetAllConnections()
+                    }
+                }
+            }
+
+            chatViewModel.handleDidBecomeActive()
+            checkForSharedContent()
+
+        case .inactive:
+            record(.scenePhaseChanged(.inactive))
+
+        @unknown default:
+            break
+        }
+    }
+    #endif
+
+    func applicationWillTerminate() {
+        record(.terminationRequested)
+        chatViewModel.applicationWillTerminate()
+    }
+
+    func handleNotificationResponse(identifier: String, userInfo: [AnyHashable: Any]) {
+        if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
+            record(.notificationOpened(peerID: peerID))
+            chatViewModel.startPrivateChat(with: peerID)
+        }
+
+        if let deepLink = userInfo["deeplink"] as? String, let url = URL(string: deepLink) {
+            record(.deepLinkOpened(deepLink))
+            openExternalURL(url)
+        }
+    }
+
+    func presentationOptions(
+        forNotificationIdentifier identifier: String,
+        userInfo: [AnyHashable: Any]
+    ) async -> UNNotificationPresentationOptions {
+        if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
+            if conversationStore.selectedPrivatePeerID == peerID {
+                return []
+            }
+            return [.banner, .sound]
+        }
+
+        if identifier.hasPrefix("geo-activity-"),
+           let deepLink = userInfo["deeplink"] as? String,
+           let geohash = deepLink.components(separatedBy: "/").last,
+           case .location(let channel) = locationChannelsModel.selectedChannel,
+           channel.geohash == geohash {
+            return []
+        }
+
+        return [.banner, .sound]
+    }
+}
+
+private extension AppRuntime {
+    func bindRuntimeObservers() {
+        NostrRelayManager.shared.$isConnected
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] isConnected in
+                self?.handleNostrRelayConnectionChanged(isConnected)
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: .TorWillRestart)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.record(.torLifecycleChanged(.willRestart))
+                self?.chatViewModel.handleTorWillRestart()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: .TorDidBecomeReady)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.record(.torLifecycleChanged(.didBecomeReady))
+                self?.chatViewModel.handleTorDidBecomeReady()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: .TorWillStart)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.record(.torLifecycleChanged(.willStart))
+                self?.chatViewModel.handleTorWillStart()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: .TorUserPreferenceChanged)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] notification in
+                self?.record(.torLifecycleChanged(.preferenceChanged))
+                self?.chatViewModel.handleTorPreferenceChanged(notification)
+            }
+            .store(in: &cancellables)
+
+        #if os(iOS)
+        NotificationCenter.default.publisher(for: UIApplication.userDidTakeScreenshotNotification)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.handleScreenshotCaptured()
+            }
+            .store(in: &cancellables)
+        #endif
+    }
+
+    func checkForSharedContent() {
+        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID),
+              let sharedContent = userDefaults.string(forKey: "sharedContent"),
+              let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
+            return
+        }
+
+        guard Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds else {
+            return
+        }
+
+        let contentKind = SharedContentKind(rawValue: userDefaults.string(forKey: "sharedContentType") ?? "") ?? .text
+
+        userDefaults.removeObject(forKey: "sharedContent")
+        userDefaults.removeObject(forKey: "sharedContentType")
+        userDefaults.removeObject(forKey: "sharedContentDate")
+
+        switch contentKind {
+        case .url:
+            if let data = sharedContent.data(using: .utf8),
+               let urlData = try? JSONSerialization.jsonObject(with: data) as? [String: String],
+               let url = urlData["url"] {
+                chatViewModel.sendMessage(url)
+            } else {
+                chatViewModel.sendMessage(sharedContent)
+            }
+        case .text:
+            chatViewModel.sendMessage(sharedContent)
+        }
+
+        record(.sharedContentAccepted(contentKind))
+    }
+
+    func handleNostrRelayConnectionChanged(_ isConnected: Bool) {
+        record(.nostrRelayConnectionChanged(isConnected))
+
+        let becameConnected = isConnected && !lastNostrRelayConnectedState
+        lastNostrRelayConnectedState = isConnected
+
+        guard started, becameConnected else { return }
+
+        let isInitialConnection = !didHandleInitialNostrConnection
+        didHandleInitialNostrConnection = true
+
+        if !chatViewModel.nostrHandlersSetup {
+            chatViewModel.setupNostrMessageHandling()
+            chatViewModel.nostrHandlersSetup = true
+        }
+
+        guard !isInitialConnection else { return }
+
+        chatViewModel.resubscribeCurrentGeohash()
+        chatViewModel.geoChannelCoordinator?.refreshSampling()
+    }
+
+    func announceInitialTorStatusIfNeeded() {
+        if TorManager.shared.torEnforced &&
+            !chatViewModel.torStatusAnnounced &&
+            TorManager.shared.isAutoStartAllowed() {
+            chatViewModel.torStatusAnnounced = true
+            chatViewModel.addGeohashOnlySystemMessage(
+                String(localized: "system.tor.starting", comment: "System message when Tor is starting")
+            )
+        } else if !TorManager.shared.torEnforced && !chatViewModel.torStatusAnnounced {
+            chatViewModel.torStatusAnnounced = true
+            chatViewModel.addGeohashOnlySystemMessage(
+                String(localized: "system.tor.dev_bypass", comment: "System message when Tor bypass is enabled in development")
+            )
+        }
+    }
+
+    func handleScreenshotCaptured() {
+        if appChromeModel.isLocationChannelsSheetPresented {
+            appChromeModel.triggerScreenshotPrivacyWarning()
+            return
+        }
+
+        if appChromeModel.isAppInfoPresented {
+            return
+        }
+
+        chatViewModel.handleScreenshotCaptured()
+    }
+
+    func openExternalURL(_ url: URL) {
+        #if os(iOS)
+        UIApplication.shared.open(url)
+        #else
+        NSWorkspace.shared.open(url)
+        #endif
+    }
+
+    func record(_ event: AppEvent) {
+        Task {
+            await events.emit(event)
+        }
+    }
+}

bitchat/App/ConversationUIModel.swift

@@ -0,0 +1,183 @@
+import BitFoundation
+import Combine
+import SwiftUI
+#if os(iOS)
+import UIKit
+#endif
+
+@MainActor
+final class ConversationUIModel: ObservableObject {
+    @Published private(set) var showAutocomplete = false
+    @Published private(set) var autocompleteSuggestions: [String] = []
+    @Published private(set) var currentNickname: String
+    @Published private(set) var isBatchingPublic = false
+    @Published private(set) var canSendMediaInCurrentContext = true
+
+    private let chatViewModel: ChatViewModel
+    private let privateConversationModel: PrivateConversationModel
+    private let conversationStore: ConversationStore
+    private var activeChannel: ChannelID
+    private var cancellables = Set<AnyCancellable>()
+
+    init(
+        chatViewModel: ChatViewModel,
+        privateConversationModel: PrivateConversationModel,
+        conversationStore: ConversationStore
+    ) {
+        self.chatViewModel = chatViewModel
+        self.privateConversationModel = privateConversationModel
+        self.conversationStore = conversationStore
+        self.activeChannel = conversationStore.activeChannel
+        self.currentNickname = chatViewModel.nickname
+        self.isBatchingPublic = chatViewModel.isBatchingPublic
+        self.showAutocomplete = chatViewModel.showAutocomplete
+        self.autocompleteSuggestions = chatViewModel.autocompleteSuggestions
+        self.canSendMediaInCurrentContext = chatViewModel.canSendMediaInCurrentContext
+
+        bind()
+    }
+
+    func setCurrentColorScheme(_ colorScheme: ColorScheme) {
+        chatViewModel.currentColorScheme = colorScheme
+    }
+
+    func sendMessage(_ message: String) {
+        chatViewModel.sendMessage(message)
+    }
+
+    func clearCurrentConversation() {
+        chatViewModel.sendMessage("/clear")
+    }
+
+    func sendHug(to sender: String) {
+        chatViewModel.sendMessage("/hug @\(sender)")
+    }
+
+    func sendSlap(to sender: String) {
+        chatViewModel.sendMessage("/slap @\(sender)")
+    }
+
+    func block(peerID: PeerID?, displayName: String?) {
+        guard let displayName else { return }
+
+        if let peerID, peerID.isGeoChat,
+           let full = chatViewModel.fullNostrHex(forSenderPeerID: peerID) {
+            chatViewModel.blockGeohashUser(pubkeyHexLowercased: full, displayName: displayName)
+        } else {
+            chatViewModel.sendMessage("/block \(displayName)")
+        }
+    }
+
+    func updateAutocomplete(for text: String, cursorPosition: Int) {
+        chatViewModel.updateAutocomplete(for: text, cursorPosition: cursorPosition)
+    }
+
+    func completeNickname(_ nickname: String, in text: inout String) -> Int {
+        chatViewModel.completeNickname(nickname, in: &text)
+    }
+
+    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme)
+    }
+
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme)
+    }
+
+    func mediaAttachment(for message: BitchatMessage) -> BitchatMessage.Media? {
+        message.mediaAttachment(for: currentNickname)
+    }
+
+    func isSelfSender(peerID: PeerID?, displayName: String?) -> Bool {
+        chatViewModel.isSelfSender(peerID: peerID, displayName: displayName)
+    }
+
+    func isSentByCurrentUser(_ message: BitchatMessage) -> Bool {
+        message.sender == currentNickname || message.sender.hasPrefix(currentNickname + "#")
+    }
+
+    func isMediaMessageFromCurrentUser(_ message: BitchatMessage) -> Bool {
+        message.sender == currentNickname || message.senderPeerID == chatViewModel.meshService.myPeerID
+    }
+
+    func senderDisplayName(for peerID: PeerID, fallbackMessages: [BitchatMessage]) -> String? {
+        if peerID.isGeoDM || peerID.isGeoChat {
+            return chatViewModel.geohashDisplayName(for: peerID)
+        }
+        if let nickname = chatViewModel.meshService.peerNickname(peerID: peerID) {
+            return nickname
+        }
+        return fallbackMessages.last(where: { $0.senderPeerID == peerID && $0.sender != "system" })?.sender
+    }
+
+    #if os(iOS)
+    func processSelectedImage(_ image: UIImage?) {
+        chatViewModel.processThenSendImage(image)
+    }
+    #endif
+
+    func processSelectedImage(from url: URL?) {
+        #if os(macOS)
+        chatViewModel.processThenSendImage(from: url)
+        #endif
+    }
+
+    func sendVoiceNote(at url: URL) {
+        chatViewModel.sendVoiceNote(at: url)
+    }
+
+    func cancelMediaSend(messageID: String) {
+        chatViewModel.cancelMediaSend(messageID: messageID)
+    }
+
+    func deleteMediaMessage(messageID: String) {
+        chatViewModel.deleteMediaMessage(messageID: messageID)
+    }
+
+    private func bind() {
+        chatViewModel.$nickname
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$currentNickname)
+
+        chatViewModel.$showAutocomplete
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$showAutocomplete)
+
+        chatViewModel.$autocompleteSuggestions
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$autocompleteSuggestions)
+
+        chatViewModel.$isBatchingPublic
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$isBatchingPublic)
+
+        conversationStore.$activeChannel
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] channel in
+                self?.activeChannel = channel
+                self?.refreshComputedState()
+            }
+            .store(in: &cancellables)
+
+        privateConversationModel.$selectedPeerID
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshComputedState()
+            }
+            .store(in: &cancellables)
+    }
+
+    private func refreshComputedState() {
+        if let selectedPeerID = privateConversationModel.selectedPeerID {
+            canSendMediaInCurrentContext = !(selectedPeerID.isGeoDM || selectedPeerID.isGeoChat)
+            return
+        }
+
+        switch activeChannel {
+        case .mesh:
+            canSendMediaInCurrentContext = true
+        case .location:
+            canSendMediaInCurrentContext = false
+        }
+    }
+}

bitchat/App/LocationChannelsModel.swift

@@ -0,0 +1,176 @@
+import BitFoundation
+import Combine
+import Foundation
+
+@MainActor
+final class LocationChannelsModel: ObservableObject {
+    @Published private(set) var permissionState: LocationChannelManager.PermissionState
+    @Published private(set) var availableChannels: [GeohashChannel]
+    @Published private(set) var selectedChannel: ChannelID
+    @Published private(set) var teleported: Bool
+    @Published private(set) var bookmarks: [String]
+    @Published private(set) var bookmarkNames: [String: String]
+    @Published private(set) var locationNames: [GeohashChannelLevel: String]
+    @Published private(set) var userTorEnabled: Bool
+
+    private let manager: LocationChannelManager
+    private let network: NetworkActivationService
+    private var cancellables = Set<AnyCancellable>()
+
+    init(
+        manager: LocationChannelManager? = nil,
+        network: NetworkActivationService? = nil
+    ) {
+        let manager = manager ?? .shared
+        let network = network ?? .shared
+
+        self.manager = manager
+        self.network = network
+        self.permissionState = manager.permissionState
+        self.availableChannels = manager.availableChannels
+        self.selectedChannel = manager.selectedChannel
+        self.teleported = manager.teleported
+        self.bookmarks = manager.bookmarks
+        self.bookmarkNames = manager.bookmarkNames
+        self.locationNames = manager.locationNames
+        self.userTorEnabled = network.userTorEnabled
+
+        bind()
+    }
+
+    var currentBuildingGeohash: String? {
+        availableChannels.first(where: { $0.level == .building })?.geohash
+    }
+
+    func isSelected(_ channel: GeohashChannel) -> Bool {
+        guard case .location(let selected) = selectedChannel else { return false }
+        return selected == channel
+    }
+
+    func isBookmarked(_ geohash: String) -> Bool {
+        manager.isBookmarked(geohash)
+    }
+
+    func enableLocationChannels() {
+        manager.enableLocationChannels()
+    }
+
+    func refreshChannels() {
+        manager.refreshChannels()
+    }
+
+    func enableAndRefresh() {
+        manager.enableLocationChannels()
+        manager.refreshChannels()
+    }
+
+    func beginLiveRefresh() {
+        manager.beginLiveRefresh()
+    }
+
+    func endLiveRefresh() {
+        manager.endLiveRefresh()
+    }
+
+    func select(_ channel: ChannelID) {
+        manager.select(channel)
+    }
+
+    func markTeleported(for geohash: String, _ flag: Bool) {
+        manager.markTeleported(for: geohash, flag)
+    }
+
+    func toggleBookmark(_ geohash: String) {
+        manager.toggleBookmark(geohash)
+    }
+
+    func resolveBookmarkNameIfNeeded(for geohash: String) {
+        manager.resolveBookmarkNameIfNeeded(for: geohash)
+    }
+
+    func locationName(for level: GeohashChannelLevel) -> String? {
+        locationNames[level]
+    }
+
+    func setUserTorEnabled(_ enabled: Bool) {
+        network.setUserTorEnabled(enabled)
+    }
+
+    func refreshMeshChannelsIfNeeded() {
+        guard case .mesh = selectedChannel,
+              permissionState == .authorized,
+              availableChannels.isEmpty else {
+            return
+        }
+        refreshChannels()
+    }
+
+    func openLocationChannel(for geohash: String) {
+        let normalized = geohash.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
+        guard (2...12).contains(normalized.count),
+              normalized.allSatisfy({ allowed.contains($0) }) else {
+            return
+        }
+
+        let channel = GeohashChannel(level: level(forLength: normalized.count), geohash: normalized)
+        let isRegional = availableChannels.contains { $0.geohash == normalized }
+        if !isRegional && !availableChannels.isEmpty {
+            markTeleported(for: normalized, true)
+        }
+        select(.location(channel))
+    }
+
+    func teleport(to geohash: String) {
+        let normalized = geohash.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        let channel = GeohashChannel(level: level(forLength: normalized.count), geohash: normalized)
+        markTeleported(for: normalized, true)
+        select(.location(channel))
+    }
+
+    private func bind() {
+        manager.$permissionState
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$permissionState)
+
+        manager.$availableChannels
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$availableChannels)
+
+        manager.$selectedChannel
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$selectedChannel)
+
+        manager.$teleported
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$teleported)
+
+        manager.$bookmarks
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$bookmarks)
+
+        manager.$bookmarkNames
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$bookmarkNames)
+
+        manager.$locationNames
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$locationNames)
+
+        network.$userTorEnabled
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$userTorEnabled)
+    }
+
+    private func level(forLength length: Int) -> GeohashChannelLevel {
+        switch length {
+        case 0...2: return .region
+        case 3...4: return .province
+        case 5: return .city
+        case 6: return .neighborhood
+        case 7: return .block
+        case 8...12: return .building
+        default: return .block
+        }
+    }
+}

bitchat/App/LocationPresenceStore.swift

@@ -0,0 +1,51 @@
+import Combine
+import Foundation
+
+@MainActor
+final class LocationPresenceStore: ObservableObject {
+    @Published private(set) var currentGeohash: String?
+    @Published private(set) var geoNicknames: [String: String] = [:]
+    @Published private(set) var teleportedGeo: Set<String> = []
+
+    func setCurrentGeohash(_ geohash: String?) {
+        currentGeohash = geohash?.lowercased()
+    }
+
+    func setNickname(_ nickname: String, for pubkeyHex: String) {
+        geoNicknames[pubkeyHex.lowercased()] = nickname
+    }
+
+    func replaceGeoNicknames(_ nicknames: [String: String]) {
+        geoNicknames = Dictionary(
+            uniqueKeysWithValues: nicknames.map { key, value in
+                (key.lowercased(), value)
+            }
+        )
+    }
+
+    func clearGeoNicknames() {
+        geoNicknames.removeAll()
+    }
+
+    func markTeleported(_ pubkeyHex: String) {
+        teleportedGeo.insert(pubkeyHex.lowercased())
+    }
+
+    func clearTeleported(_ pubkeyHex: String) {
+        teleportedGeo.remove(pubkeyHex.lowercased())
+    }
+
+    func replaceTeleportedGeo(_ pubkeys: Set<String>) {
+        teleportedGeo = Set(pubkeys.map { $0.lowercased() })
+    }
+
+    func clearTeleportedGeo() {
+        teleportedGeo.removeAll()
+    }
+
+    func reset() {
+        currentGeohash = nil
+        geoNicknames.removeAll()
+        teleportedGeo.removeAll()
+    }
+}

bitchat/App/PeerIdentityStore.swift

@@ -0,0 +1,125 @@
+import BitFoundation
+import Combine
+import Foundation
+
+@MainActor
+final class PeerIdentityStore: ObservableObject {
+    @Published private(set) var encryptionStatuses: [PeerID: EncryptionStatus] = [:]
+    @Published private(set) var verifiedFingerprints: Set<String> = []
+
+    private(set) var peerFingerprintsByPeerID: [PeerID: String] = [:]
+    private(set) var selectedPrivateChatFingerprint: String?
+
+    private var stablePeerIDsByShortID: [PeerID: PeerID] = [:]
+    private var encryptionStatusCache: [PeerID: EncryptionStatus] = [:]
+
+    func stablePeerID(forShortID peerID: PeerID) -> PeerID? {
+        stablePeerIDsByShortID[peerID]
+    }
+
+    func shortPeerID(forStablePeerID stablePeerID: PeerID) -> PeerID? {
+        stablePeerIDsByShortID.first(where: { $0.value == stablePeerID })?.key
+    }
+
+    func setStablePeerID(_ stablePeerID: PeerID, forShortID peerID: PeerID) {
+        stablePeerIDsByShortID[peerID] = stablePeerID
+    }
+
+    func replaceStablePeerIDs(_ mappings: [PeerID: PeerID]) {
+        stablePeerIDsByShortID = mappings
+    }
+
+    func fingerprint(for peerID: PeerID) -> String? {
+        peerFingerprintsByPeerID[peerID]
+    }
+
+    func setFingerprint(_ fingerprint: String?, for peerID: PeerID) {
+        if let fingerprint {
+            peerFingerprintsByPeerID[peerID] = fingerprint
+        } else {
+            peerFingerprintsByPeerID.removeValue(forKey: peerID)
+        }
+    }
+
+    func replaceFingerprintMappings(_ mappings: [PeerID: String]) {
+        peerFingerprintsByPeerID = mappings
+    }
+
+    @discardableResult
+    func migrateFingerprintMapping(
+        from oldPeerID: PeerID,
+        to newPeerID: PeerID,
+        fallback: String? = nil
+    ) -> String? {
+        let fingerprint = peerFingerprintsByPeerID.removeValue(forKey: oldPeerID) ?? fallback
+        if let fingerprint {
+            peerFingerprintsByPeerID[newPeerID] = fingerprint
+            if selectedPrivateChatFingerprint == nil {
+                selectedPrivateChatFingerprint = fingerprint
+            }
+        }
+        return fingerprint
+    }
+
+    func setSelectedPrivateChatFingerprint(_ fingerprint: String?) {
+        selectedPrivateChatFingerprint = fingerprint
+    }
+
+    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
+        encryptionStatusCache[peerID]
+    }
+
+    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID) {
+        encryptionStatusCache[peerID] = status
+    }
+
+    func invalidateEncryptionCache(for peerID: PeerID? = nil) {
+        if let peerID {
+            encryptionStatusCache.removeValue(forKey: peerID)
+        } else {
+            encryptionStatusCache.removeAll()
+        }
+    }
+
+    func encryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
+        encryptionStatuses[peerID]
+    }
+
+    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID) {
+        if let status {
+            encryptionStatuses[peerID] = status
+        } else {
+            encryptionStatuses.removeValue(forKey: peerID)
+        }
+        invalidateEncryptionCache(for: peerID)
+    }
+
+    func replaceEncryptionStatuses(_ statuses: [PeerID: EncryptionStatus]) {
+        encryptionStatuses = statuses
+    }
+
+    func setVerifiedFingerprints(_ fingerprints: Set<String>) {
+        verifiedFingerprints = fingerprints
+    }
+
+    func setVerified(_ fingerprint: String, verified: Bool) {
+        if verified {
+            verifiedFingerprints.insert(fingerprint)
+        } else {
+            verifiedFingerprints.remove(fingerprint)
+        }
+    }
+
+    func isVerified(_ fingerprint: String) -> Bool {
+        verifiedFingerprints.contains(fingerprint)
+    }
+
+    func clearAll() {
+        encryptionStatuses.removeAll()
+        verifiedFingerprints.removeAll()
+        peerFingerprintsByPeerID.removeAll()
+        selectedPrivateChatFingerprint = nil
+        stablePeerIDsByShortID.removeAll()
+        encryptionStatusCache.removeAll()
+    }
+}

bitchat/App/PeerListModel.swift

@@ -0,0 +1,260 @@
+import BitFoundation
+import Combine
+import SwiftUI
+
+struct MeshPeerRow: Identifiable, Equatable {
+    let peerID: PeerID
+    let displayName: String
+    let isMe: Bool
+    let hasUnread: Bool
+    let isBlocked: Bool
+    let isFavorite: Bool
+    let isConnected: Bool
+    let isReachable: Bool
+    let isMutualFavorite: Bool
+    let encryptionStatus: EncryptionStatus
+    let showsVerifiedBadgeWhenOffline: Bool
+
+    var id: String { peerID.id }
+}
+
+struct GeohashPersonRow: Identifiable, Equatable {
+    let id: String
+    let displayName: String
+    let isMe: Bool
+    let isTeleported: Bool
+    let isBlocked: Bool
+}
+
+@MainActor
+final class PeerListModel: ObservableObject {
+    @Published private(set) var allPeers: [BitchatPeer] = []
+    @Published private(set) var meshRows: [MeshPeerRow] = []
+    @Published private(set) var geohashPeople: [GeohashPersonRow] = []
+    @Published private(set) var reachableMeshPeerCount = 0
+    @Published private(set) var connectedMeshPeerCount = 0
+    @Published private(set) var visibleGeohashPeerCount = 0
+    @Published private(set) var renderID = ""
+
+    private let chatViewModel: ChatViewModel
+    private let conversationStore: ConversationStore
+    private let locationChannelsModel: LocationChannelsModel
+    private let peerIdentityStore: PeerIdentityStore
+    private let locationPresenceStore: LocationPresenceStore
+    private var cancellables = Set<AnyCancellable>()
+
+    init(
+        chatViewModel: ChatViewModel,
+        conversationStore: ConversationStore,
+        locationChannelsModel: LocationChannelsModel? = nil,
+        peerIdentityStore: PeerIdentityStore? = nil,
+        locationPresenceStore: LocationPresenceStore? = nil
+    ) {
+        self.chatViewModel = chatViewModel
+        self.conversationStore = conversationStore
+        self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
+        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
+        self.locationPresenceStore = locationPresenceStore ?? chatViewModel.locationPresenceStore
+        self.allPeers = chatViewModel.allPeers
+
+        bind()
+        refresh()
+    }
+
+    func colorForMeshPeer(id peerID: PeerID, isDark: Bool) -> Color {
+        chatViewModel.colorForMeshPeer(id: peerID, isDark: isDark)
+    }
+
+    func colorForGeohashPerson(id: String, isDark: Bool) -> Color {
+        chatViewModel.colorForNostrPubkey(id, isDark: isDark)
+    }
+
+    func participantCount(for geohash: String) -> Int {
+        chatViewModel.geohashParticipantCount(for: geohash)
+    }
+
+    func startConversation(with peerID: PeerID) {
+        chatViewModel.startPrivateChat(with: peerID)
+    }
+
+    func toggleFavorite(peerID: PeerID) {
+        chatViewModel.toggleFavorite(peerID: peerID)
+    }
+
+    func openGeohashDirectMessage(with pubkeyHex: String) {
+        chatViewModel.startGeohashDM(withPubkeyHex: pubkeyHex)
+    }
+
+    func blockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
+        chatViewModel.blockGeohashUser(
+            pubkeyHexLowercased: pubkeyHexLowercased,
+            displayName: displayName
+        )
+    }
+
+    func unblockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
+        chatViewModel.unblockGeohashUser(
+            pubkeyHexLowercased: pubkeyHexLowercased,
+            displayName: displayName
+        )
+    }
+
+    private func bind() {
+        chatViewModel.$allPeers
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] peers in
+                self?.allPeers = peers
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.$nickname
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        locationPresenceStore.$teleportedGeo
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        conversationStore.$unreadConversations
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        peerIdentityStore.$encryptionStatuses
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        peerIdentityStore.$verifiedFingerprints
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: Notification.Name("peerStatusUpdated"))
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.participantTracker.$visiblePeople
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        locationChannelsModel.$selectedChannel
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        locationChannelsModel.$teleported
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+
+        locationChannelsModel.$availableChannels
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refresh()
+            }
+            .store(in: &cancellables)
+    }
+
+    private func refresh() {
+        let myPeerID = chatViewModel.meshService.myPeerID
+        let meshRows = allPeers.map { peer in
+            let isMe = peer.peerID == myPeerID
+            let verifiedBadge: Bool
+            if !isMe && !peer.isConnected,
+               let fingerprint = chatViewModel.getFingerprint(for: peer.peerID) {
+                verifiedBadge = peerIdentityStore.isVerified(fingerprint)
+            } else {
+                verifiedBadge = false
+            }
+
+            return MeshPeerRow(
+                peerID: peer.peerID,
+                displayName: isMe ? chatViewModel.nickname : peer.nickname,
+                isMe: isMe,
+                hasUnread: chatViewModel.hasUnreadMessages(for: peer.peerID),
+                isBlocked: !isMe && chatViewModel.isPeerBlocked(peer.peerID),
+                isFavorite: peer.favoriteStatus?.isFavorite ?? false,
+                isConnected: peer.isConnected,
+                isReachable: peer.isReachable,
+                isMutualFavorite: peer.isMutualFavorite,
+                encryptionStatus: chatViewModel.getEncryptionStatus(for: peer.peerID),
+                showsVerifiedBadgeWhenOffline: verifiedBadge
+            )
+        }
+
+        let meshCounts = meshRows.reduce(into: (reachable: 0, connected: 0)) { counts, row in
+            guard !row.isMe else { return }
+            if row.isConnected {
+                counts.connected += 1
+                counts.reachable += 1
+            } else if row.isReachable {
+                counts.reachable += 1
+            }
+        }
+
+        let geohashPeople = buildGeohashPeople()
+
+        self.meshRows = meshRows
+        reachableMeshPeerCount = meshCounts.reachable
+        connectedMeshPeerCount = meshCounts.connected
+        self.geohashPeople = geohashPeople
+        visibleGeohashPeerCount = geohashPeople.count
+        renderID = (
+            meshRows.map {
+                "\($0.id)-\($0.isConnected)-\($0.isReachable)-\($0.hasUnread)-\($0.isFavorite)-\($0.isBlocked)"
+            } +
+            geohashPeople.map {
+                "geo:\($0.id)-\($0.isTeleported)-\($0.isBlocked)-\($0.displayName)"
+            }
+        ).joined(separator: "|")
+    }
+
+    private func buildGeohashPeople() -> [GeohashPersonRow] {
+        let myHex = currentGeohashIdentityHex()
+        let teleportedSet = Set(locationPresenceStore.teleportedGeo.map { $0.lowercased() })
+
+        return chatViewModel.visibleGeohashPeople().map { person in
+            let isMe = person.id == myHex
+            return GeohashPersonRow(
+                id: person.id,
+                displayName: person.displayName,
+                isMe: isMe,
+                isTeleported: teleportedSet.contains(person.id.lowercased()) || (isMe && locationChannelsModel.teleported),
+                isBlocked: !isMe && chatViewModel.isGeohashUserBlocked(pubkeyHexLowercased: person.id)
+            )
+        }
+    }
+
+    private func currentGeohashIdentityHex() -> String? {
+        guard case .location(let channel) = locationChannelsModel.selectedChannel,
+              let identity = try? chatViewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else {
+            return nil
+        }
+
+        return identity.publicKeyHex.lowercased()
+    }
+}

bitchat/App/PrivateConversationModels.swift

@@ -0,0 +1,298 @@
+import BitFoundation
+import Combine
+import Foundation
+
+@MainActor
+final class PrivateInboxModel: ObservableObject {
+    @Published private(set) var selectedPeerID: PeerID?
+    @Published private(set) var unreadPeerIDs: Set<PeerID> = []
+    @Published private(set) var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
+
+    private let conversationStore: ConversationStore
+    private var cancellables = Set<AnyCancellable>()
+
+    init(conversationStore: ConversationStore) {
+        self.conversationStore = conversationStore
+
+        bind()
+        refreshMessages()
+    }
+
+    func messages(for peerID: PeerID?) -> [BitchatMessage] {
+        guard let peerID else { return [] }
+        return messagesByPeerID[peerID] ?? []
+    }
+
+    private func bind() {
+        conversationStore.$selectedPrivatePeerID
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] peerID in
+                self?.selectedPeerID = peerID
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+
+        conversationStore.$unreadConversations
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.unreadPeerIDs = self?.conversationStore.unreadDirectPeerIDs() ?? []
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+
+        conversationStore.$messagesByConversation
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+
+        selectedPeerID = conversationStore.selectedPrivatePeerID
+        unreadPeerIDs = conversationStore.unreadDirectPeerIDs()
+    }
+
+    private func refreshMessages() {
+        var nextMessagesByPeerID = conversationStore.directMessagesByPeerID()
+        var peerIDs = Set(nextMessagesByPeerID.keys)
+        peerIDs.formUnion(conversationStore.unreadDirectPeerIDs())
+        if let selectedPeerID = conversationStore.selectedPrivatePeerID {
+            peerIDs.insert(selectedPeerID)
+        }
+
+        for peerID in peerIDs where nextMessagesByPeerID[peerID] == nil {
+            nextMessagesByPeerID[peerID] = []
+        }
+
+        messagesByPeerID = nextMessagesByPeerID
+    }
+}
+
+enum PrivateConversationAvailability: Equatable {
+    case bluetoothConnected
+    case meshReachable
+    case nostrAvailable
+    case offline
+}
+
+struct PrivateConversationHeaderState: Equatable {
+    let conversationPeerID: PeerID
+    let headerPeerID: PeerID
+    let displayName: String
+    let availability: PrivateConversationAvailability
+    let isFavorite: Bool
+    let encryptionStatus: EncryptionStatus?
+
+    var supportsFavoriteToggle: Bool {
+        !conversationPeerID.isGeoDM
+    }
+}
+
+@MainActor
+final class PrivateConversationModel: ObservableObject {
+    @Published private(set) var selectedPeerID: PeerID?
+    @Published private(set) var selectedHeaderState: PrivateConversationHeaderState?
+
+    private let chatViewModel: ChatViewModel
+    private let conversationStore: ConversationStore
+    private let locationChannelsModel: LocationChannelsModel
+    private let peerIdentityStore: PeerIdentityStore
+    private var cancellables = Set<AnyCancellable>()
+
+    init(
+        chatViewModel: ChatViewModel,
+        conversationStore: ConversationStore,
+        locationChannelsModel: LocationChannelsModel? = nil,
+        peerIdentityStore: PeerIdentityStore? = nil
+    ) {
+        self.chatViewModel = chatViewModel
+        self.conversationStore = conversationStore
+        self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
+        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
+        let initialPeerID = conversationStore.selectedPrivatePeerID
+        self.selectedPeerID = initialPeerID
+        self.selectedHeaderState = initialPeerID.flatMap { peerID in
+            makeHeaderState(for: peerID)
+        }
+
+        bind()
+    }
+
+    func startConversation(with peerID: PeerID) {
+        chatViewModel.startPrivateChat(with: peerID)
+        refreshSelectedConversation()
+    }
+
+    func openConversation(for peerID: PeerID) {
+        if peerID.isGeoChat {
+            guard let full = chatViewModel.fullNostrHex(forSenderPeerID: peerID) else { return }
+            chatViewModel.startGeohashDM(withPubkeyHex: full)
+        } else {
+            chatViewModel.startPrivateChat(with: peerID)
+        }
+
+        refreshSelectedConversation()
+    }
+
+    func endConversation() {
+        chatViewModel.endPrivateChat()
+        refreshSelectedConversation()
+    }
+
+    func toggleFavorite(peerID: PeerID) {
+        chatViewModel.toggleFavorite(peerID: peerID)
+        refreshSelectedConversation()
+    }
+
+    func toggleFavoriteForSelectedConversation() {
+        guard let headerPeerID = selectedHeaderState?.headerPeerID else { return }
+        toggleFavorite(peerID: headerPeerID)
+    }
+
+    func markMessagesAsRead(from peerID: PeerID) {
+        chatViewModel.markPrivateMessagesAsRead(from: peerID)
+    }
+
+    private func bind() {
+        conversationStore.$selectedPrivatePeerID
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.$allPeers
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+
+        peerIdentityStore.$encryptionStatuses
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: .favoriteStatusChanged)
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+
+        NotificationCenter.default.publisher(for: Notification.Name("peerStatusUpdated"))
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+
+        locationChannelsModel.$selectedChannel
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshSelectedConversation()
+            }
+            .store(in: &cancellables)
+    }
+
+    private func refreshSelectedConversation() {
+        selectedPeerID = conversationStore.selectedPrivatePeerID
+        selectedHeaderState = selectedPeerID.flatMap { peerID in
+            makeHeaderState(for: peerID)
+        }
+    }
+
+    private func makeHeaderState(for conversationPeerID: PeerID) -> PrivateConversationHeaderState {
+        let headerPeerID = chatViewModel.getShortIDForNoiseKey(conversationPeerID)
+        let peer = chatViewModel.getPeer(byID: headerPeerID)
+        let displayName = resolveDisplayName(for: conversationPeerID, headerPeerID: headerPeerID, peer: peer)
+        let availability = resolveAvailability(for: headerPeerID, peer: peer)
+        let encryptionStatus: EncryptionStatus? = conversationPeerID.isGeoDM
+            ? nil
+            : chatViewModel.getEncryptionStatus(for: headerPeerID)
+
+        return PrivateConversationHeaderState(
+            conversationPeerID: conversationPeerID,
+            headerPeerID: headerPeerID,
+            displayName: displayName,
+            availability: availability,
+            isFavorite: chatViewModel.isFavorite(peerID: headerPeerID),
+            encryptionStatus: encryptionStatus
+        )
+    }
+
+    private func resolveDisplayName(
+        for conversationPeerID: PeerID,
+        headerPeerID: PeerID,
+        peer: BitchatPeer?
+    ) -> String {
+        if conversationPeerID.isGeoDM, case .location(let channel) = locationChannelsModel.selectedChannel {
+            return "#\(channel.geohash)/@\(chatViewModel.geohashDisplayName(for: conversationPeerID))"
+        }
+        if let displayName = peer?.displayName {
+            return displayName
+        }
+        if let nickname = chatViewModel.meshService.peerNickname(peerID: headerPeerID) {
+            return nickname
+        }
+        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(
+            for: Data(hexString: headerPeerID.id) ?? Data()
+        ), !favorite.peerNickname.isEmpty {
+            return favorite.peerNickname
+        }
+        if headerPeerID.id.count == 16 {
+            let candidates = chatViewModel.identityManager.getCryptoIdentitiesByPeerIDPrefix(headerPeerID)
+            if let identity = candidates.first,
+               let social = chatViewModel.identityManager.getSocialIdentity(for: identity.fingerprint) {
+                if let pet = social.localPetname, !pet.isEmpty {
+                    return pet
+                }
+                if !social.claimedNickname.isEmpty {
+                    return social.claimedNickname
+                }
+            }
+        } else if let noiseKey = headerPeerID.noiseKey {
+            let fingerprint = noiseKey.sha256Fingerprint()
+            if let social = chatViewModel.identityManager.getSocialIdentity(for: fingerprint) {
+                if let pet = social.localPetname, !pet.isEmpty {
+                    return pet
+                }
+                if !social.claimedNickname.isEmpty {
+                    return social.claimedNickname
+                }
+            }
+        }
+
+        return String(localized: "common.unknown", comment: "Fallback label for unknown peer")
+    }
+
+    private func resolveAvailability(for headerPeerID: PeerID, peer: BitchatPeer?) -> PrivateConversationAvailability {
+        if let connectionState = peer?.connectionState {
+            switch connectionState {
+            case .bluetoothConnected:
+                return .bluetoothConnected
+            case .meshReachable:
+                return .meshReachable
+            case .nostrAvailable:
+                return .nostrAvailable
+            case .offline:
+                return .offline
+            }
+        }
+
+        if chatViewModel.meshService.isPeerReachable(headerPeerID) {
+            return .meshReachable
+        }
+        if let noiseKey = Data(hexString: headerPeerID.id),
+           let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
+           favoriteStatus.isMutual {
+            return .nostrAvailable
+        }
+        if chatViewModel.meshService.isPeerConnected(headerPeerID) || chatViewModel.connectedPeers.contains(headerPeerID) {
+            return .bluetoothConnected
+        }
+
+        return .offline
+    }
+}

bitchat/App/PublicChatModel.swift

@@ -0,0 +1,41 @@
+import BitFoundation
+import Combine
+import SwiftUI
+
+@MainActor
+final class PublicChatModel: ObservableObject {
+    @Published private(set) var activeChannel: ChannelID
+    @Published private(set) var messages: [BitchatMessage] = []
+
+    private let conversationStore: ConversationStore
+    private var cancellables = Set<AnyCancellable>()
+
+    init(conversationStore: ConversationStore) {
+        self.activeChannel = conversationStore.activeChannel
+        self.conversationStore = conversationStore
+
+        bind()
+        refreshMessages()
+    }
+
+    private func bind() {
+        conversationStore.$activeChannel
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] channel in
+                self?.activeChannel = channel
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+
+        conversationStore.$messagesByConversation
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.refreshMessages()
+            }
+            .store(in: &cancellables)
+    }
+
+    private func refreshMessages() {
+        messages = conversationStore.messages(for: ConversationID(channelID: activeChannel))
+    }
+}

bitchat/App/VerificationModel.swift

@@ -0,0 +1,152 @@
+import BitFoundation
+import Combine
+import Foundation
+
+struct FingerprintPresentationState: Equatable {
+    let statusPeerID: PeerID
+    let peerNickname: String
+    let encryptionStatus: EncryptionStatus
+    let theirFingerprint: String?
+    let myFingerprint: String
+    let isVerified: Bool
+
+    var canToggleVerification: Bool {
+        encryptionStatus == .noiseSecured || encryptionStatus == .noiseVerified
+    }
+}
+
+enum VerificationScanOutcome: Equatable {
+    case requested(String)
+    case notFound
+    case invalid
+}
+
+@MainActor
+final class VerificationModel: ObservableObject {
+    @Published private(set) var currentNickname: String
+    @Published private(set) var selectedPeerID: PeerID?
+
+    private let chatViewModel: ChatViewModel
+    private let peerIdentityStore: PeerIdentityStore
+    private var cancellables = Set<AnyCancellable>()
+
+    init(
+        chatViewModel: ChatViewModel,
+        privateConversationModel: PrivateConversationModel,
+        peerIdentityStore: PeerIdentityStore? = nil
+    ) {
+        self.chatViewModel = chatViewModel
+        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
+        self.currentNickname = chatViewModel.nickname
+        self.selectedPeerID = privateConversationModel.selectedPeerID
+
+        bind(privateConversationModel: privateConversationModel)
+    }
+
+    func myQRString() -> String {
+        let npub = try? chatViewModel.idBridge.getCurrentNostrIdentity()?.npub
+        return VerificationService.shared.buildMyQRString(nickname: currentNickname, npub: npub) ?? ""
+    }
+
+    func beginQRVerification(with qr: VerificationService.VerificationQR) -> Bool {
+        chatViewModel.beginQRVerification(with: qr)
+    }
+
+    func verifyScannedPayload(_ payload: String) -> VerificationScanOutcome {
+        guard let qr = VerificationService.shared.verifyScannedQR(payload) else {
+            return .invalid
+        }
+
+        guard chatViewModel.beginQRVerification(with: qr) else {
+            return .notFound
+        }
+
+        return .requested(qr.nickname)
+    }
+
+    func verifyFingerprint(for peerID: PeerID) {
+        chatViewModel.verifyFingerprint(for: peerID)
+    }
+
+    func unverifyFingerprint(for peerID: PeerID) {
+        chatViewModel.unverifyFingerprint(for: peerID)
+    }
+
+    func isVerified(peerID: PeerID) -> Bool {
+        guard let fingerprint = chatViewModel.getFingerprint(for: peerID) else { return false }
+        return peerIdentityStore.isVerified(fingerprint)
+    }
+
+    func fingerprintPresentation(for peerID: PeerID) -> FingerprintPresentationState {
+        let statusPeerID = chatViewModel.getShortIDForNoiseKey(peerID)
+        let encryptionStatus = chatViewModel.getEncryptionStatus(for: statusPeerID)
+        let theirFingerprint = chatViewModel.getFingerprint(for: statusPeerID)
+        let peerNickname = resolveDisplayName(for: peerID, statusPeerID: statusPeerID)
+
+        return FingerprintPresentationState(
+            statusPeerID: statusPeerID,
+            peerNickname: peerNickname,
+            encryptionStatus: encryptionStatus,
+            theirFingerprint: theirFingerprint,
+            myFingerprint: chatViewModel.getMyFingerprint(),
+            isVerified: theirFingerprint.map { peerIdentityStore.isVerified($0) } ?? false
+        )
+    }
+
+    private func bind(privateConversationModel: PrivateConversationModel) {
+        chatViewModel.$nickname
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$currentNickname)
+
+        privateConversationModel.$selectedPeerID
+            .receive(on: DispatchQueue.main)
+            .assign(to: &$selectedPeerID)
+
+        peerIdentityStore.$encryptionStatuses
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.objectWillChange.send()
+            }
+            .store(in: &cancellables)
+
+        peerIdentityStore.$verifiedFingerprints
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.objectWillChange.send()
+            }
+            .store(in: &cancellables)
+
+        chatViewModel.$allPeers
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] _ in
+                self?.objectWillChange.send()
+            }
+            .store(in: &cancellables)
+    }
+
+    private func resolveDisplayName(for peerID: PeerID, statusPeerID: PeerID) -> String {
+        if let peer = chatViewModel.getPeer(byID: statusPeerID) {
+            return peer.displayName
+        }
+        if let name = chatViewModel.meshService.peerNickname(peerID: statusPeerID) {
+            return name
+        }
+        if let data = peerID.noiseKey {
+            if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: data),
+               !favorite.peerNickname.isEmpty {
+                return favorite.peerNickname
+            }
+            let fingerprint = data.sha256Fingerprint()
+            if let social = chatViewModel.identityManager.getSocialIdentity(for: fingerprint) {
+                if let pet = social.localPetname, !pet.isEmpty {
+                    return pet
+                }
+                if !social.claimedNickname.isEmpty {
+                    return social.claimedNickname
+                }
+            }
+        }
+
+        return String(localized: "common.unknown", comment: "Label for an unknown peer")
+    }
+}

bitchat/BitchatApp.swift

@@ -6,131 +6,55 @@
 // For more information, see <https://unlicense.org>
 //
 
-import Nostr
-import Tor
 import SwiftUI
-import BitFoundation
 import UserNotifications
 
 @main
 struct BitchatApp: App {
     static let bundleID = Bundle.main.bundleIdentifier ?? "chat.bitchat"
     static let groupID = "group.\(bundleID)"
-    
-    @StateObject private var chatViewModel: ChatViewModel
+
+    @StateObject private var runtime: AppRuntime
     #if os(iOS)
     @Environment(\.scenePhase) var scenePhase
     @UIApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
-    // Skip the very first .active-triggered Tor restart on cold launch
-    @State private var didHandleInitialActive: Bool = false
-    @State private var didEnterBackground: Bool = false
     #elseif os(macOS)
     @NSApplicationDelegateAdaptor(MacAppDelegate.self) var appDelegate
     #endif
-    
-    private let idBridge = NostrIdentityBridge(keychain: KeychainManager())
-    
+
     init() {
-        GeoRelayDirectory.setupShared(dependencies: .live())
-        NostrRelayManager.setupShared(dependencies: .live())
-        let keychain = KeychainManager()
-        let idBridge = self.idBridge
-        _chatViewModel = StateObject(
-            wrappedValue: ChatViewModel(
-                keychain: keychain,
-                idBridge: idBridge,
-                identityManager: SecureIdentityStateManager(keychain)
-            )
-        )
-        
+        _runtime = StateObject(wrappedValue: AppRuntime())
         UNUserNotificationCenter.current().delegate = NotificationDelegate.shared
-        // Warm up georelay directory and refresh if stale (once/day)
-        GeoRelayDirectory.shared.prefetchIfNeeded()
     }
-    
+
     var body: some Scene {
         WindowGroup {
             ContentView()
-                .environmentObject(chatViewModel)
+                .environmentObject(runtime.publicChatModel)
+                .environmentObject(runtime.privateInboxModel)
+                .environmentObject(runtime.privateConversationModel)
+                .environmentObject(runtime.verificationModel)
+                .environmentObject(runtime.conversationUIModel)
+                .environmentObject(runtime.locationChannelsModel)
+                .environmentObject(runtime.peerListModel)
+                .environmentObject(runtime.appChromeModel)
                 .onAppear {
-                    NotificationDelegate.shared.chatViewModel = chatViewModel
-                    // Inject live Noise service into VerificationService to avoid creating new BLE instances
-                    VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
-                    // Prewarm Nostr identity and QR to make first VERIFY sheet fast
-                    let nickname = chatViewModel.nickname
-                    DispatchQueue.global(qos: .utility).async {
-                        let npub = try? idBridge.getCurrentNostrIdentity()?.npub
-                        _ = VerificationService.shared.buildMyQRString(nickname: nickname, npub: npub)
-                    }
-
-                    appDelegate.chatViewModel = chatViewModel
-
-                    // Initialize network activation policy; will start Tor/Nostr only when allowed
-                    NetworkActivationService.shared.start()
-                    
-                    // Start presence service (will wait for Tor readiness)
-                    GeohashPresenceService.shared.start()
-
-                    // Check for shared content
-                    checkForSharedContent()
+                    appDelegate.runtime = runtime
+                    runtime.start()
                 }
                 .onOpenURL { url in
-                    handleURL(url)
+                    runtime.handleOpenURL(url)
                 }
                 #if os(iOS)
                 .onChange(of: scenePhase) { newPhase in
-                    switch newPhase {
-                    case .background:
-                        // Keep BLE mesh running in background; BLEService adapts scanning automatically
-                        // Always send Tor to dormant on background for a clean restart later.
-                        TorManager.shared.setAppForeground(false)
-                        TorManager.shared.goDormantOnBackground()
-                        // Stop geohash sampling while backgrounded
-                        Task { @MainActor in
-                            chatViewModel.endGeohashSampling()
-                        }
-                        // Proactively disconnect Nostr to avoid spurious socket errors while Tor is down
-                        NostrRelayManager.shared.disconnect()
-                        didEnterBackground = true
-                    case .active:
-                        // Restart services when becoming active
-                        chatViewModel.meshService.startServices()
-                        TorManager.shared.setAppForeground(true)
-                        // On initial cold launch, Tor was just started in onAppear.
-                        // Skip the deterministic restart the first time we become active.
-                        if didHandleInitialActive && didEnterBackground {
-                            if TorManager.shared.isAutoStartAllowed() && !TorManager.shared.isReady {
-                                TorManager.shared.ensureRunningOnForeground()
-                            }
-                        } else {
-                            didHandleInitialActive = true
-                        }
-                        didEnterBackground = false
-                        if TorManager.shared.isAutoStartAllowed() {
-                            Task.detached {
-                                let _ = await TorManager.shared.awaitReady(timeout: 60)
-                                await MainActor.run {
-                                    // Rebuild proxied sessions to bind to the live Tor after readiness
-                                    TorURLSession.shared.rebuild()
-                                    // Reconnect Nostr via fresh sessions; will gate until Tor 100%
-                                    NostrRelayManager.shared.resetAllConnections()
-                                }
-                            }
-                        }
-                        checkForSharedContent()
-                    case .inactive:
-                        break
-                    @unknown default:
-                        break
-                    }
+                    runtime.handleScenePhaseChange(newPhase)
                 }
                 .onReceive(NotificationCenter.default.publisher(for: UIApplication.didBecomeActiveNotification)) { _ in
-                    // Check for shared content when app becomes active
-                    checkForSharedContent()
+                    runtime.handleDidBecomeActiveNotification()
                 }
                 #elseif os(macOS)
                 .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
-                    // App became active
+                    runtime.handleMacDidBecomeActiveNotification()
                 }
                 #endif
         }
@@ -139,66 +63,18 @@ struct BitchatApp: App {
         .windowResizability(.contentSize)
         #endif
     }
-    
-    private func handleURL(_ url: URL) {
-        if url.scheme == "bitchat" && url.host == "share" {
-            // Handle shared content
-            checkForSharedContent()
-        }
-    }
-    
-    private func checkForSharedContent() {
-        // Check app group for shared content from extension
-        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID) else {
-            return
-        }
-        
-        guard let sharedContent = userDefaults.string(forKey: "sharedContent"),
-              let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
-            return
-        }
-        
-        // Only process if shared within configured window
-        if Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds {
-            let contentType = userDefaults.string(forKey: "sharedContentType") ?? "text"
-            
-            // Clear the shared content
-            userDefaults.removeObject(forKey: "sharedContent")
-            userDefaults.removeObject(forKey: "sharedContentType")
-            userDefaults.removeObject(forKey: "sharedContentDate")
-            // No need to force synchronize here
-            
-            // Send the shared content immediately on the main queue
-            DispatchQueue.main.async {
-                if contentType == "url" {
-                    // Try to parse as JSON first
-                    if let data = sharedContent.data(using: .utf8),
-                       let urlData = try? JSONSerialization.jsonObject(with: data) as? [String: String],
-                       let url = urlData["url"] {
-                        // Send plain URL
-                        self.chatViewModel.sendMessage(url)
-                    } else {
-                        // Fallback to simple URL
-                        self.chatViewModel.sendMessage(sharedContent)
-                    }
-                } else {
-                    self.chatViewModel.sendMessage(sharedContent)
-                }
-            }
-        }
-    }
 }
 
 #if os(iOS)
 final class AppDelegate: NSObject, UIApplicationDelegate {
-    weak var chatViewModel: ChatViewModel?
-    
+    weak var runtime: AppRuntime?
+
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
-        return true
+        true
     }
-    
+
     func applicationWillTerminate(_ application: UIApplication) {
-        chatViewModel?.applicationWillTerminate()
+        runtime?.applicationWillTerminate()
     }
 }
 #endif
@@ -207,79 +83,42 @@ final class AppDelegate: NSObject, UIApplicationDelegate {
 import AppKit
 
 final class MacAppDelegate: NSObject, NSApplicationDelegate {
-    weak var chatViewModel: ChatViewModel?
-    
+    weak var runtime: AppRuntime?
+
     func applicationWillTerminate(_ notification: Notification) {
-        chatViewModel?.applicationWillTerminate()
+        runtime?.applicationWillTerminate()
     }
-    
+
     func applicationShouldTerminateAfterLastWindowClosed(_ sender: NSApplication) -> Bool {
-        return true
+        true
     }
 }
 #endif
 
 final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
     static let shared = NotificationDelegate()
-    weak var chatViewModel: ChatViewModel?
-    
+    weak var runtime: AppRuntime?
+
     func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
         let identifier = response.notification.request.identifier
         let userInfo = response.notification.request.content.userInfo
-        
-        // Check if this is a private message notification
-        if identifier.hasPrefix("private-") {
-            // Get peer ID from userInfo
-            if let peerID = userInfo["peerID"] as? String {
-                DispatchQueue.main.async {
-                    self.chatViewModel?.startPrivateChat(with: PeerID(str: peerID))
-                }
-            }
+
+        Task { @MainActor in
+            self.runtime?.handleNotificationResponse(identifier: identifier, userInfo: userInfo)
         }
-        // Handle deeplink (e.g., geohash activity)
-        if let deep = userInfo["deeplink"] as? String, let url = URL(string: deep) {
-            #if os(iOS)
-            DispatchQueue.main.async { UIApplication.shared.open(url) }
-            #else
-            DispatchQueue.main.async { NSWorkspace.shared.open(url) }
-            #endif
-        }
-        
         completionHandler()
     }
-    
+
     func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
         let identifier = notification.request.identifier
         let userInfo = notification.request.content.userInfo
-        
-        // Check if this is a private message notification
-        if identifier.hasPrefix("private-") {
-            // Get peer ID from userInfo
-            if let peerID = userInfo["peerID"] as? String {
-                // Don't show notification if the private chat is already open
-                // Access main-actor-isolated property via Task
-                Task { @MainActor in
-                    if self.chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
-                        completionHandler([])
-                    } else {
-                        completionHandler([.banner, .sound])
-                    }
-                }
-                return
-            }
+
+        Task {
+            let options = await self.runtime?.presentationOptions(
+                forNotificationIdentifier: identifier,
+                userInfo: userInfo
+            ) ?? [.banner, .sound]
+            completionHandler(options)
         }
-        // Suppress geohash activity notification if we're already in that geohash channel
-        if identifier.hasPrefix("geo-activity-"),
-           let deep = userInfo["deeplink"] as? String,
-           let gh = deep.components(separatedBy: "/").last {
-            if case .location(let ch) = LocationChannelManager.shared.selectedChannel, ch.geohash == gh {
-                completionHandler([])
-                return
-            }
-        }
-        
-        // Show notification in all other cases
-        completionHandler([.banner, .sound])
     }
 }
-

bitchat/Features/media/ImageUtils.swift

@@ -15,30 +15,39 @@ enum ImageUtilsError: Error {
 enum ImageUtils {
     private static let compressionQuality: CGFloat = 0.82
     private static let targetImageBytes: Int = 45_000
+    private static let maxSourceImageBytes: Int = 10 * 1024 * 1024
 
-    static func processImage(at url: URL, maxDimension: CGFloat = 448) throws -> URL {
-        // Security H1: Check file size BEFORE reading into memory
-        let attrs = try FileManager.default.attributesOfItem(atPath: url.path)
-        guard let fileSize = attrs[.size] as? Int else {
-            throw ImageUtilsError.invalidImage
-        }
-        // Allow up to 10MB source images (will be scaled down)
-        guard fileSize <= 10 * 1024 * 1024 else {
-            throw ImageUtilsError.invalidImage
-        }
+    static func processImage(at url: URL, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
+        try validateImageSource(at: url)
 
         let data = try Data(contentsOf: url)
         #if os(iOS)
         guard let image = UIImage(data: data) else { throw ImageUtilsError.invalidImage }
-        return try processImage(image, maxDimension: maxDimension)
+        return try processImage(image, maxDimension: maxDimension, outputDirectory: outputDirectory)
         #else
         guard let image = NSImage(data: data) else { throw ImageUtilsError.invalidImage }
-        return try processImage(image, maxDimension: maxDimension)
+        return try processImage(image, maxDimension: maxDimension, outputDirectory: outputDirectory)
         #endif
     }
 
+    static func validateImageSource(at url: URL) throws {
+        // Security H1: Check file size BEFORE reading into memory.
+        let attrs = try FileManager.default.attributesOfItem(atPath: url.path)
+        guard let fileSize = attrs[.size] as? Int,
+              fileSize > 0,
+              fileSize <= maxSourceImageBytes else {
+            throw ImageUtilsError.invalidImage
+        }
+
+        let options = [kCGImageSourceShouldCache: false] as CFDictionary
+        guard let source = CGImageSourceCreateWithURL(url as CFURL, options),
+              CGImageSourceGetType(source) != nil else {
+            throw ImageUtilsError.invalidImage
+        }
+    }
+
     #if os(iOS)
-    static func processImage(_ image: UIImage, maxDimension: CGFloat = 448) throws -> URL {
+    static func processImage(_ image: UIImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
         return try autoreleasepool {
             // Scale the image first
             let scaled = scaledImage(image, maxDimension: maxDimension)
@@ -64,7 +73,7 @@ enum ImageUtils {
                 }
             }
 
-            let outputURL = try makeOutputURL()
+            let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
             try jpegData.write(to: outputURL, options: .atomic)
             return outputURL
         }
@@ -106,7 +115,7 @@ enum ImageUtils {
         return data as Data
     }
     #else
-    static func processImage(_ image: NSImage, maxDimension: CGFloat = 448) throws -> URL {
+    static func processImage(_ image: NSImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
         return try autoreleasepool {
             let scaled = scaledImage(image, maxDimension: maxDimension)
             guard let inputCG = scaled.cgImage(forProposedRect: nil, context: nil, hints: nil) else {
@@ -142,7 +151,7 @@ enum ImageUtils {
                     }
                 }
             }
-            let outputURL = try makeOutputURL()
+            let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
             try jpegData.write(to: outputURL, options: .atomic)
             return outputURL
         }
@@ -186,12 +195,17 @@ enum ImageUtils {
     }
     #endif
 
-    private static func makeOutputURL() throws -> URL {
+    private static func makeOutputURL(outputDirectory: URL? = nil) throws -> URL {
         let formatter = DateFormatter()
         formatter.dateFormat = "yyyyMMdd_HHmmss"
-        let fileName = "img_\(formatter.string(from: Date())).jpg"
+        let fileName = "img_\(formatter.string(from: Date()))_\(UUID().uuidString).jpg"
 
-        let directory = try applicationFilesDirectory().appendingPathComponent("images/outgoing", isDirectory: true)
+        let directory: URL
+        if let outputDirectory {
+            directory = outputDirectory
+        } else {
+            directory = try applicationFilesDirectory().appendingPathComponent("images/outgoing", isDirectory: true)
+        }
         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil)
         return directory.appendingPathComponent(fileName)
     }

bitchat/Identity/SecureIdentityStateManager.swift

@@ -202,8 +202,12 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
             let decryptedData = try AES.GCM.open(sealedBox, using: encryptionKey)
             cache = try JSONDecoder().decode(IdentityCache.self, from: decryptedData)
         } catch {
-            // Log error but continue with empty cache
-            SecureLogger.error(error, context: "Failed to load identity cache", category: .security)
+            cache = IdentityCache()
+            let deleted = keychain.deleteIdentityKey(forKey: cacheKey)
+            SecureLogger.warning(
+                "Discarded unreadable identity cache; starting fresh (deleted=\(deleted), error=\(error.localizedDescription))",
+                category: .security
+            )
         }
     }
     

bitchat/Models/BitchatMessage+Media.swift

@@ -6,6 +6,7 @@
 // For more information, see <https://unlicense.org>
 //
 
+import BitFoundation
 import Foundation
 
 extension BitchatMessage {

bitchat/Noise/NoiseProtocol.swift

@@ -533,7 +533,7 @@ final class NoiseSymmetricState {
 final class NoiseHandshakeState {
     private let role: NoiseRole
     private let pattern: NoisePattern
-    private let keychain: SecureMemoryCleaner
+    private let keychain: KeychainManagerProtocol
     private var symmetricState: NoiseSymmetricState
     
     // Keys
@@ -556,7 +556,7 @@ final class NoiseHandshakeState {
     init(
         role: NoiseRole,
         pattern: NoisePattern,
-        keychain: SecureMemoryCleaner,
+        keychain: KeychainManagerProtocol,
         localStaticKey: Curve25519.KeyAgreement.PrivateKey? = nil,
         remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil,
         prologue: Data = Data(),
@@ -924,7 +924,7 @@ extension NoisePattern {
 
 // MARK: - Errors
 
-public enum NoiseError: Error {
+enum NoiseError: Error {
     case uninitializedCipher
     case invalidCiphertext
     case handshakeComplete

bitchat/Noise/NoiseRateLimiter.swift

@@ -10,7 +10,7 @@ import BitLogger
 import BitFoundation
 import Foundation
 
-public final class NoiseRateLimiter {
+final class NoiseRateLimiter {
     private var handshakeTimestamps: [PeerID: [Date]] = [:]
     private var messageTimestamps: [PeerID: [Date]] = [:]
     
@@ -19,10 +19,8 @@ public final class NoiseRateLimiter {
     private var globalMessageTimestamps: [Date] = []
     
     private let queue = DispatchQueue(label: "chat.bitchat.noise.ratelimit", attributes: .concurrent)
-
-    public init() {}
-
-    public func allowHandshake(from peerID: PeerID) -> Bool {
+    
+    func allowHandshake(from peerID: PeerID) -> Bool {
         return queue.sync(flags: .barrier) {
             let now = Date()
             let oneMinuteAgo = now.addingTimeInterval(-60)
@@ -51,7 +49,7 @@ public final class NoiseRateLimiter {
         }
     }
     
-    public func allowMessage(from peerID: PeerID) -> Bool {
+    func allowMessage(from peerID: PeerID) -> Bool {
         return queue.sync(flags: .barrier) {
             let now = Date()
             let oneSecondAgo = now.addingTimeInterval(-1)
@@ -87,7 +85,7 @@ public final class NoiseRateLimiter {
         }
     }
 
-    public func resetAll() {
+    func resetAll() {
         queue.async(flags: .barrier) {
             self.handshakeTimestamps.removeAll()
             self.messageTimestamps.removeAll()

bitchat/Noise/NoiseSecurityConstants.swift

@@ -8,7 +8,7 @@
 
 import Foundation
 
-public enum NoiseSecurityConstants {
+enum NoiseSecurityConstants {
     // Maximum message size to prevent memory exhaustion
     static let maxMessageSize = 65535 // 64KB as per Noise spec
     
@@ -28,10 +28,10 @@ public enum NoiseSecurityConstants {
     static let maxSessionsPerPeer = 3
     
     // Rate limiting
-    public static let maxHandshakesPerMinute = 10
-    public static let maxMessagesPerSecond = 100
+    static let maxHandshakesPerMinute = 10
+    static let maxMessagesPerSecond = 100
     
     // Global rate limiting (across all peers)
-    public static let maxGlobalHandshakesPerMinute = 30
-    public static let maxGlobalMessagesPerSecond = 500
+    static let maxGlobalHandshakesPerMinute = 30
+    static let maxGlobalMessagesPerSecond = 500
 }

bitchat/Noise/NoiseSecurityError.swift

@@ -8,7 +8,7 @@
 
 import Foundation
 
-public enum NoiseSecurityError: Error {
+enum NoiseSecurityError: Error {
     case sessionExpired
     case sessionExhausted
     case messageTooLarge

bitchat/Noise/NoiseSecurityValidator.swift

@@ -8,15 +8,15 @@
 
 import Foundation
 
-public struct NoiseSecurityValidator {
+struct NoiseSecurityValidator {
     
     /// Validate message size
-    public static func validateMessageSize(_ data: Data) -> Bool {
+    static func validateMessageSize(_ data: Data) -> Bool {
         return data.count <= NoiseSecurityConstants.maxMessageSize
     }
     
     /// Validate handshake message size
-    public static func validateHandshakeMessageSize(_ data: Data) -> Bool {
+    static func validateHandshakeMessageSize(_ data: Data) -> Bool {
         return data.count <= NoiseSecurityConstants.maxHandshakeMessageSize
     }
 }

bitchat/Noise/NoiseSession.swift

@@ -11,10 +11,10 @@ import Foundation
 import CryptoKit
 import BitFoundation
 
-public class NoiseSession {
+class NoiseSession {
     let peerID: PeerID
     let role: NoiseRole
-    private let keychain: SecureMemoryCleaner
+    private let keychain: KeychainManagerProtocol
     private var state: NoiseSessionState = .uninitialized
     private var handshakeState: NoiseHandshakeState?
     private var sendCipher: NoiseCipherState?
@@ -34,7 +34,7 @@ public class NoiseSession {
     init(
         peerID: PeerID,
         role: NoiseRole,
-        keychain: SecureMemoryCleaner,
+        keychain: KeychainManagerProtocol,
         localStaticKey: Curve25519.KeyAgreement.PrivateKey,
         remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil
     ) {
@@ -182,7 +182,7 @@ public class NoiseSession {
         }
     }
     
-    public func isEstablished() -> Bool {
+    func isEstablished() -> Bool {
         return sessionQueue.sync {
             if case .established = state {
                 return true
@@ -217,8 +217,8 @@ public class NoiseSession {
             sentHandshakeMessages.removeAll()
             
             // Clear handshake hash
-            if handshakeHash != nil {
-                keychain.secureClear(&handshakeHash!)
+            if var hash = handshakeHash {
+                keychain.secureClear(&hash)
             }
             handshakeHash = nil
             

bitchat/Noise/NoiseSessionError.swift

@@ -6,7 +6,7 @@
 // For more information, see <https://unlicense.org>
 //
 
-public enum NoiseSessionError: Error, Equatable {
+enum NoiseSessionError: Error, Equatable {
     case invalidState
     case notEstablished
     case sessionNotFound

bitchat/Noise/NoiseSessionManager.swift

@@ -11,18 +11,18 @@ import CryptoKit
 import Foundation
 import BitFoundation
 
-public final class NoiseSessionManager {
+final class NoiseSessionManager {
     private var sessions: [PeerID: NoiseSession] = [:]
     private let localStaticKey: Curve25519.KeyAgreement.PrivateKey
-    private let keychain: SecureMemoryCleaner
+    private let keychain: KeychainManagerProtocol
     private let sessionFactory: (PeerID, NoiseRole) -> NoiseSession
     private let managerQueue = DispatchQueue(label: "chat.bitchat.noise.manager", attributes: .concurrent)
     
     // Callbacks
-    public var onSessionEstablished: ((PeerID, Curve25519.KeyAgreement.PublicKey) -> Void)?
+    var onSessionEstablished: ((PeerID, Curve25519.KeyAgreement.PublicKey) -> Void)?
     var onSessionFailed: ((PeerID, Error) -> Void)?
     
-    public init(localStaticKey: Curve25519.KeyAgreement.PrivateKey, keychain: SecureMemoryCleaner) {
+    init(localStaticKey: Curve25519.KeyAgreement.PrivateKey, keychain: KeychainManagerProtocol) {
         self.localStaticKey = localStaticKey
         self.keychain = keychain
         self.sessionFactory = { peerID, role in
@@ -38,7 +38,7 @@ public final class NoiseSessionManager {
     #if DEBUG
     init(
         localStaticKey: Curve25519.KeyAgreement.PrivateKey,
-        keychain: SecureMemoryCleaner,
+        keychain: KeychainManagerProtocol,
         sessionFactory: @escaping (PeerID, NoiseRole) -> NoiseSession
     ) {
         self.localStaticKey = localStaticKey
@@ -49,13 +49,13 @@ public final class NoiseSessionManager {
     
     // MARK: - Session Management
     
-    public func getSession(for peerID: PeerID) -> NoiseSession? {
+    func getSession(for peerID: PeerID) -> NoiseSession? {
         return managerQueue.sync {
             return sessions[peerID]
         }
     }
     
-    public func removeSession(for peerID: PeerID) {
+    func removeSession(for peerID: PeerID) {
         managerQueue.sync(flags: .barrier) {
             if let session = sessions.removeValue(forKey: peerID) {
                 session.reset() // Clear sensitive data before removing
@@ -63,7 +63,7 @@ public final class NoiseSessionManager {
         }
     }
 
-    public func removeAllSessions() {
+    func removeAllSessions() {
         managerQueue.sync(flags: .barrier) {
             for (_, session) in sessions {
                 session.reset()
@@ -74,7 +74,7 @@ public final class NoiseSessionManager {
     
     // MARK: - Handshake Helpers
     
-    public func initiateHandshake(with peerID: PeerID) throws -> Data {
+    func initiateHandshake(with peerID: PeerID) throws -> Data {
         return try managerQueue.sync(flags: .barrier) {
             // Check if we already have an established session
             if let existingSession = sessions[peerID], existingSession.isEstablished() {
@@ -103,7 +103,7 @@ public final class NoiseSessionManager {
         }
     }
     
-    public func handleIncomingHandshake(from peerID: PeerID, message: Data) throws -> Data? {
+    func handleIncomingHandshake(from peerID: PeerID, message: Data) throws -> Data? {
         // Process everything within the synchronized block to prevent race conditions
         return try managerQueue.sync(flags: .barrier) {
             var shouldCreateNew = false
@@ -173,7 +173,7 @@ public final class NoiseSessionManager {
     
     // MARK: - Encryption/Decryption
     
-    public func encrypt(_ plaintext: Data, for peerID: PeerID) throws -> Data {
+    func encrypt(_ plaintext: Data, for peerID: PeerID) throws -> Data {
         guard let session = getSession(for: peerID) else {
             throw NoiseSessionError.sessionNotFound
         }
@@ -181,7 +181,7 @@ public final class NoiseSessionManager {
         return try session.encrypt(plaintext)
     }
     
-    public func decrypt(_ ciphertext: Data, from peerID: PeerID) throws -> Data {
+    func decrypt(_ ciphertext: Data, from peerID: PeerID) throws -> Data {
         guard let session = getSession(for: peerID) else {
             throw NoiseSessionError.sessionNotFound
         }
@@ -191,13 +191,13 @@ public final class NoiseSessionManager {
     
     // MARK: - Key Management
     
-    public func getRemoteStaticKey(for peerID: PeerID) -> Curve25519.KeyAgreement.PublicKey? {
+    func getRemoteStaticKey(for peerID: PeerID) -> Curve25519.KeyAgreement.PublicKey? {
         return getSession(for: peerID)?.getRemoteStaticPublicKey()
     }
     
     // MARK: - Session Rekeying
     
-    public func getSessionsNeedingRekey() -> [(peerID: PeerID, needsRekey: Bool)] {
+    func getSessionsNeedingRekey() -> [(peerID: PeerID, needsRekey: Bool)] {
         return managerQueue.sync {
             var needingRekey: [(peerID: PeerID, needsRekey: Bool)] = []
             
@@ -213,7 +213,7 @@ public final class NoiseSessionManager {
         }
     }
     
-    public func initiateRekey(for peerID: PeerID) throws {
+    func initiateRekey(for peerID: PeerID) throws {
         // Remove old session
         removeSession(for: peerID)
         

bitchat/Nostr/Base64URLCoding.swift

@@ -0,0 +1,22 @@
+import Foundation
+
+enum Base64URLCoding {
+    static func encode(_ data: Data) -> String {
+        data.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    static func decode(_ string: String) -> Data? {
+        var base64 = string
+        let padding = (4 - (base64.count % 4)) % 4
+        if padding > 0 {
+            base64 += String(repeating: "=", count: padding)
+        }
+        base64 = base64
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        return Data(base64Encoded: base64)
+    }
+}

bitchat/Nostr/Bech32.swift

@@ -1,37 +1,38 @@
 import Foundation
 
 /// Bech32 encoding for Nostr (minimal implementation)
-public enum Bech32 {
+enum Bech32 {
     private static let charset = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
     private static let generator = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]
-
-    public static func encode(hrp: String, data: Data) throws -> String {
+    
+    static func encode(hrp: String, data: Data) throws -> String {
         let values = convertBits(from: 8, to: 5, pad: true, data: Array(data))
         let checksum = createChecksum(hrp: hrp, values: values)
         let combined = values + checksum
-
-        return hrp + "1" + combined.map {
+        
+        return hrp + "1" + combined.map { 
             let index = charset.index(charset.startIndex, offsetBy: Int($0))
             return String(charset[index])
         }.joined()
     }
-
-    public static func decode(_ bech32String: String) throws -> (hrp: String, data: Data) {
+    
+    static func decode(_ bech32String: String) throws -> (hrp: String, data: Data) {
+        // Find the last occurrence of '1'
         guard let separatorIndex = bech32String.lastIndex(of: "1") else {
             throw Bech32Error.invalidFormat
         }
-
+        
         let hrp = String(bech32String[..<separatorIndex])
-
+        
         // Validate HRP contains only ASCII characters
         for char in hrp {
             guard char.asciiValue != nil else {
                 throw Bech32Error.invalidCharacter
             }
         }
-
+        
         let dataString = String(bech32String[bech32String.index(after: separatorIndex)...])
-
+        
         // Convert characters to values
         var values = [UInt8]()
         for char in dataString {
@@ -40,84 +41,84 @@ public enum Bech32 {
             }
             values.append(UInt8(charset.distance(from: charset.startIndex, to: index)))
         }
-
+        
         // Verify checksum
         guard values.count >= 6 else {
             throw Bech32Error.invalidChecksum
         }
-
+        
         let payloadValues = Array(values.dropLast(6))
         let checksum = Array(values.suffix(6))
         let expectedChecksum = createChecksum(hrp: hrp, values: payloadValues)
-
+        
         guard checksum == expectedChecksum else {
             throw Bech32Error.invalidChecksum
         }
-
+        
         // Convert back to bytes
         let bytes = convertBits(from: 5, to: 8, pad: false, data: payloadValues)
         return (hrp: hrp, data: Data(bytes))
     }
-
+    
     enum Bech32Error: Error {
         case invalidFormat
         case invalidCharacter
         case invalidChecksum
     }
-
+    
     private static func convertBits(from: Int, to: Int, pad: Bool, data: [UInt8]) -> [UInt8] {
         var acc = 0
         var bits = 0
         var result = [UInt8]()
         let maxv = (1 << to) - 1
-
+        
         for value in data {
             acc = (acc << from) | Int(value)
             bits += from
-
+            
             while bits >= to {
                 bits -= to
                 result.append(UInt8((acc >> bits) & maxv))
             }
         }
-
+        
         if pad && bits > 0 {
             result.append(UInt8((acc << (to - bits)) & maxv))
         }
-
+        
         return result
     }
-
+    
     private static func createChecksum(hrp: String, values: [UInt8]) -> [UInt8] {
         let checksumValues = hrpExpand(hrp) + values + [0, 0, 0, 0, 0, 0]
         let polymod = polymod(checksumValues) ^ 1
         var checksum = [UInt8]()
-
+        
         for i in 0..<6 {
             checksum.append(UInt8((polymod >> (5 * (5 - i))) & 31))
         }
-
+        
         return checksum
     }
-
+    
     private static func hrpExpand(_ hrp: String) -> [UInt8] {
         var result = [UInt8]()
         for c in hrp {
             guard let asciiValue = c.asciiValue else {
-                return []
+                return [] // Return empty array for invalid input
             }
             result.append(UInt8(asciiValue >> 5))
         }
         result.append(0)
         for c in hrp {
             guard let asciiValue = c.asciiValue else {
-                return []
+                return [] // Return empty array for invalid input
             }
             result.append(UInt8(asciiValue & 31))
         }
         return result
     }
-
+    
     private static func polymod(_ values: [UInt8]) -> Int {
         var chk = 1
         for value in values {

bitchat/Nostr/GeoRelayDirectory.swift

@@ -1,72 +1,101 @@
 import BitLogger
 import Foundation
+import Tor
+#if os(iOS)
+import UIKit
+#elseif os(macOS)
+import AppKit
+#endif
 
-public struct GeoRelayDirectoryDependencies {
-    public var userDefaults: UserDefaults
-    public var notificationCenter: NotificationCenter
-    public var now: () -> Date
-    public var remoteURL: URL
-    public var fetchInterval: TimeInterval
-    public var refreshCheckInterval: TimeInterval
-    public var retryInitialSeconds: TimeInterval
-    public var retryMaxSeconds: TimeInterval
-    public var awaitTorReady: @Sendable () async -> Bool
-    public var makeFetchData: @MainActor @Sendable () -> (@Sendable (URLRequest) async throws -> Data)
-    public var readData: (URL) -> Data?
-    public var writeData: (Data, URL) throws -> Void
-    public var cacheURL: () -> URL?
-    public var bundledCSVURLs: () -> [URL]
-    public var currentDirectoryPath: () -> String?
-    public var retrySleep: (TimeInterval) async -> Void
-    public var torReadyNotificationName: Notification.Name?
-    public var activeNotificationName: Notification.Name?
-    public var autoStart: Bool
+/// Directory of online Nostr relays with approximate GPS locations, used for geohash routing.
+struct GeoRelayDirectoryDependencies {
+    var userDefaults: UserDefaults
+    var notificationCenter: NotificationCenter
+    var now: () -> Date
+    var remoteURL: URL
+    var fetchInterval: TimeInterval
+    var refreshCheckInterval: TimeInterval
+    var retryInitialSeconds: TimeInterval
+    var retryMaxSeconds: TimeInterval
+    var awaitTorReady: @Sendable () async -> Bool
+    var makeFetchData: @MainActor @Sendable () -> (@Sendable (URLRequest) async throws -> Data)
+    var readData: (URL) -> Data?
+    var writeData: (Data, URL) throws -> Void
+    var cacheURL: () -> URL?
+    var bundledCSVURLs: () -> [URL]
+    var currentDirectoryPath: () -> String?
+    var retrySleep: (TimeInterval) async -> Void
+    var activeNotificationName: Notification.Name?
+    var autoStart: Bool
+}
 
-    public init(
-        userDefaults: UserDefaults,
-        notificationCenter: NotificationCenter,
-        now: @escaping () -> Date,
-        remoteURL: URL,
-        fetchInterval: TimeInterval,
-        refreshCheckInterval: TimeInterval,
-        retryInitialSeconds: TimeInterval,
-        retryMaxSeconds: TimeInterval,
-        awaitTorReady: @Sendable @escaping () async -> Bool,
-        makeFetchData: @MainActor @Sendable @escaping () -> (@Sendable (URLRequest) async throws -> Data),
-        readData: @escaping (URL) -> Data?,
-        writeData: @escaping (Data, URL) throws -> Void,
-        cacheURL: @escaping () -> URL?,
-        bundledCSVURLs: @escaping () -> [URL],
-        currentDirectoryPath: @escaping () -> String?,
-        retrySleep: @escaping (TimeInterval) async -> Void,
-        torReadyNotificationName: Notification.Name?,
-        activeNotificationName: Notification.Name?,
-        autoStart: Bool
-    ) {
-        self.userDefaults = userDefaults
-        self.notificationCenter = notificationCenter
-        self.now = now
-        self.remoteURL = remoteURL
-        self.fetchInterval = fetchInterval
-        self.refreshCheckInterval = refreshCheckInterval
-        self.retryInitialSeconds = retryInitialSeconds
-        self.retryMaxSeconds = retryMaxSeconds
-        self.awaitTorReady = awaitTorReady
-        self.makeFetchData = makeFetchData
-        self.readData = readData
-        self.writeData = writeData
-        self.cacheURL = cacheURL
-        self.bundledCSVURLs = bundledCSVURLs
-        self.currentDirectoryPath = currentDirectoryPath
-        self.retrySleep = retrySleep
-        self.torReadyNotificationName = torReadyNotificationName
-        self.activeNotificationName = activeNotificationName
-        self.autoStart = autoStart
+private extension GeoRelayDirectoryDependencies {
+    @MainActor
+    static func live() -> Self {
+#if os(iOS)
+        let activeNotificationName: Notification.Name? = UIApplication.didBecomeActiveNotification
+#elseif os(macOS)
+        let activeNotificationName: Notification.Name? = NSApplication.didBecomeActiveNotification
+#else
+        let activeNotificationName: Notification.Name? = nil
+#endif
+
+        return Self(
+            userDefaults: .standard,
+            notificationCenter: .default,
+            now: Date.init,
+            remoteURL: URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!,
+            fetchInterval: TransportConfig.geoRelayFetchIntervalSeconds,
+            refreshCheckInterval: TransportConfig.geoRelayRefreshCheckIntervalSeconds,
+            retryInitialSeconds: TransportConfig.geoRelayRetryInitialSeconds,
+            retryMaxSeconds: TransportConfig.geoRelayRetryMaxSeconds,
+            awaitTorReady: { await TorManager.shared.awaitReady() },
+            makeFetchData: {
+                let session = TorURLSession.shared.session
+                return { request in
+                    let (data, _) = try await session.data(for: request)
+                    return data
+                }
+            },
+            readData: { try? Data(contentsOf: $0) },
+            writeData: { data, url in
+                try data.write(to: url, options: .atomic)
+            },
+            cacheURL: {
+                do {
+                    let base = try FileManager.default.url(
+                        for: .applicationSupportDirectory,
+                        in: .userDomainMask,
+                        appropriateFor: nil,
+                        create: true
+                    )
+                    let dir = base.appendingPathComponent("bitchat", isDirectory: true)
+                    try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+                    return dir.appendingPathComponent("georelays_cache.csv")
+                } catch {
+                    return nil
+                }
+            },
+            bundledCSVURLs: {
+                [
+                    Bundle.main.url(forResource: "nostr_relays", withExtension: "csv"),
+                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv"),
+                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv", subdirectory: "relays")
+                ].compactMap { $0 }
+            },
+            currentDirectoryPath: { FileManager.default.currentDirectoryPath },
+            retrySleep: { delay in
+                let nanoseconds = UInt64(delay * 1_000_000_000)
+                try? await Task.sleep(nanoseconds: nanoseconds)
+            },
+            activeNotificationName: activeNotificationName,
+            autoStart: true
+        )
     }
 }
 
 @MainActor
-public final class GeoRelayDirectory {
+final class GeoRelayDirectory {
     private final class CleanupState {
         let notificationCenter: NotificationCenter
         var observers: [NSObjectProtocol] = []
@@ -84,16 +113,10 @@ public final class GeoRelayDirectory {
         }
     }
 
-    public struct Entry: Hashable, Sendable {
-        public let host: String
-        public let lat: Double
-        public let lon: Double
-
-        public init(host: String, lat: Double, lon: Double) {
-            self.host = host
-            self.lat = lat
-            self.lon = lon
-        }
+    struct Entry: Hashable, Sendable {
+        let host: String
+        let lat: Double
+        let lon: Double
     }
 
     private enum DetachedFetchOutcome: Sendable {
@@ -103,13 +126,9 @@ public final class GeoRelayDirectory {
         case network(String)
     }
 
-    nonisolated(unsafe) public static var shared: GeoRelayDirectory!
+    static let shared = GeoRelayDirectory()
 
-    public static func setupShared(dependencies: GeoRelayDirectoryDependencies) {
-        shared = GeoRelayDirectory(dependencies: dependencies)
-    }
-
-    private(set) public var entries: [Entry] = []
+    private(set) var entries: [Entry] = []
     private let lastFetchKey = "georelay.lastFetchAt"
     private let dependencies: GeoRelayDirectoryDependencies
     private let cleanupState: CleanupState
@@ -117,7 +136,18 @@ public final class GeoRelayDirectory {
     private var retryAttempt: Int = 0
     private var isFetching: Bool = false
 
-    public init(dependencies: GeoRelayDirectoryDependencies) {
+    private init() {
+        self.dependencies = .live()
+        self.cleanupState = CleanupState(notificationCenter: dependencies.notificationCenter)
+        entries = loadLocalEntries()
+        if dependencies.autoStart {
+            registerObservers()
+            startRefreshTimer()
+            prefetchIfNeeded()
+        }
+    }
+
+    internal init(dependencies: GeoRelayDirectoryDependencies) {
         self.dependencies = dependencies
         self.cleanupState = CleanupState(notificationCenter: dependencies.notificationCenter)
         entries = loadLocalEntries()
@@ -129,13 +159,13 @@ public final class GeoRelayDirectory {
     }
 
     /// Returns up to `count` relay URLs (wss://) closest to the geohash center.
-    public func closestRelays(toGeohash geohash: String, count: Int = 5) -> [String] {
-        let center = decodeGeohashCenter(geohash)
+    func closestRelays(toGeohash geohash: String, count: Int = 5) -> [String] {
+        let center = Geohash.decodeCenter(geohash)
         return closestRelays(toLat: center.lat, lon: center.lon, count: count)
     }
 
     /// Returns up to `count` relay URLs (wss://) closest to the given coordinate.
-    public func closestRelays(toLat lat: Double, lon: Double, count: Int = 5) -> [String] {
+    func closestRelays(toLat lat: Double, lon: Double, count: Int = 5) -> [String] {
         guard !entries.isEmpty, count > 0 else { return [] }
 
         if entries.count <= count {
@@ -165,7 +195,7 @@ public final class GeoRelayDirectory {
     }
 
     // MARK: - Remote Fetch
-    public func prefetchIfNeeded(force: Bool = false) {
+    func prefetchIfNeeded(force: Bool = false) {
         guard !isFetching else { return }
 
         let now = dependencies.now()
@@ -175,6 +205,7 @@ public final class GeoRelayDirectory {
             guard now.timeIntervalSince(last) >= dependencies.fetchInterval else { return }
         } else if last != .distantPast,
                   now.timeIntervalSince(last) < dependencies.retryInitialSeconds {
+            // Skip forced fetches if we just refreshed moments ago.
             return
         }
 
@@ -312,6 +343,7 @@ public final class GeoRelayDirectory {
 
     // MARK: - Loading
     private func loadLocalEntries() -> [Entry] {
+        // Prefer cached file if present
         if let cache = dependencies.cacheURL(),
            let data = dependencies.readData(cache),
            let text = String(data: data, encoding: .utf8) {
@@ -319,6 +351,7 @@ public final class GeoRelayDirectory {
             if !arr.isEmpty { return arr }
         }
 
+        // Try bundled resource(s)
         let bundleCandidates = dependencies.bundledCSVURLs()
 
         for url in bundleCandidates {
@@ -329,6 +362,7 @@ public final class GeoRelayDirectory {
             }
         }
 
+        // Try filesystem path (development/test)
         if let cwd = dependencies.currentDirectoryPath(),
            let data = dependencies.readData(URL(fileURLWithPath: cwd).appendingPathComponent("relays/online_relays_gps.csv")),
            let text = String(data: data, encoding: .utf8) {
@@ -339,7 +373,7 @@ public final class GeoRelayDirectory {
         return []
     }
 
-    nonisolated public static func parseCSV(_ text: String) -> [Entry] {
+    nonisolated static func parseCSV(_ text: String) -> [Entry] {
         var result: Set<Entry> = []
         let lines = text.split(whereSeparator: { $0.isNewline })
         for (idx, raw) in lines.enumerated() {
@@ -347,12 +381,7 @@ public final class GeoRelayDirectory {
             if idx == 0 && line.lowercased().contains("relay url") { continue }
             let parts = line.split(separator: ",").map { $0.trimmed }
             guard parts.count >= 3 else { continue }
-            var host = parts[0]
-            host = host.replacingOccurrences(of: "https://", with: "")
-            host = host.replacingOccurrences(of: "http://", with: "")
-            host = host.replacingOccurrences(of: "wss://", with: "")
-            host = host.replacingOccurrences(of: "ws://", with: "")
-            host = host.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+            guard let host = NostrRelayURL.directoryAddress(parts[0]) else { continue }
             guard let lat = Double(parts[1]), let lon = Double(parts[2]) else { continue }
             result.insert(Entry(host: host, lat: lat, lon: lon))
         }
@@ -363,19 +392,17 @@ public final class GeoRelayDirectory {
     private func registerObservers() {
         let center = dependencies.notificationCenter
 
-        if let torReadyName = dependencies.torReadyNotificationName {
-            let torReady = center.addObserver(
-                forName: torReadyName,
-                object: nil,
-                queue: .main
-            ) { [weak self] _ in
-                guard let self else { return }
-                Task { @MainActor in
-                    self.prefetchIfNeeded(force: true)
-                }
+        let torReady = center.addObserver(
+            forName: .TorDidBecomeReady,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            guard let self else { return }
+            Task { @MainActor in
+                self.prefetchIfNeeded(force: true)
             }
-            cleanupState.observers.append(torReady)
         }
+        cleanupState.observers.append(torReady)
 
         if let activeNotificationName = dependencies.activeNotificationName {
             let didBecomeActive = center.addObserver(
@@ -407,49 +434,17 @@ public final class GeoRelayDirectory {
         RunLoop.main.add(timer, forMode: .common)
     }
 
-    public var debugRetryAttempt: Int { retryAttempt }
-    public var debugHasRetryTask: Bool { cleanupState.retryTask != nil }
-    public var debugObserverCount: Int { cleanupState.observers.count }
+    var debugRetryAttempt: Int { retryAttempt }
+    var debugHasRetryTask: Bool { cleanupState.retryTask != nil }
+    var debugObserverCount: Int { cleanupState.observers.count }
 }
 
 // MARK: - Distance
 private func haversineKm(_ lat1: Double, _ lon1: Double, _ lat2: Double, _ lon2: Double) -> Double {
-    let r = 6371.0
+    let r = 6371.0 // Earth radius in km
     let dLat = (lat2 - lat1) * .pi / 180
     let dLon = (lon2 - lon1) * .pi / 180
     let a = sin(dLat/2) * sin(dLat/2) + cos(lat1 * .pi/180) * cos(lat2 * .pi/180) * sin(dLon/2) * sin(dLon/2)
     let c = 2 * atan2(sqrt(a), sqrt(1 - a))
     return r * c
 }
-
-// MARK: - Geohash decode (inline to avoid external dependency)
-
-private let geohashBase32Map: [Character: Int] = {
-    let chars = Array("0123456789bcdefghjkmnpqrstuvwxyz")
-    var map: [Character: Int] = [:]
-    for (i, c) in chars.enumerated() { map[c] = i }
-    return map
-}()
-
-private func decodeGeohashCenter(_ geohash: String) -> (lat: Double, lon: Double) {
-    var latInterval: (Double, Double) = (-90.0, 90.0)
-    var lonInterval: (Double, Double) = (-180.0, 180.0)
-
-    var isEven = true
-    for ch in geohash.lowercased() {
-        guard let cd = geohashBase32Map[ch] else { continue }
-        for mask in [16, 8, 4, 2, 1] {
-            if isEven {
-                let mid = (lonInterval.0 + lonInterval.1) / 2
-                if (cd & mask) != 0 { lonInterval.0 = mid } else { lonInterval.1 = mid }
-            } else {
-                let mid = (latInterval.0 + latInterval.1) / 2
-                if (cd & mask) != 0 { latInterval.0 = mid } else { latInterval.1 = mid }
-            }
-            isEven.toggle()
-        }
-    }
-    let lat = (latInterval.0 + latInterval.1) / 2
-    let lon = (lonInterval.0 + lonInterval.1) / 2
-    return (lat, lon)
-}

bitchat/Nostr/NostrIdentity.swift

@@ -2,56 +2,59 @@ import Foundation
 import P256K
 
 /// Manages Nostr identity (secp256k1 keypair) for NIP-17 private messaging
-public struct NostrIdentity: Codable, Sendable {
-    public let privateKey: Data
-    public let publicKey: Data
-    public let npub: String // Bech32-encoded public key
-    public let createdAt: Date
-
-    public init(privateKey: Data, publicKey: Data, npub: String, createdAt: Date) {
+struct NostrIdentity: Codable {
+    let privateKey: Data
+    let publicKey: Data
+    let npub: String // Bech32-encoded public key
+    let createdAt: Date
+    
+    /// Memberwise initializer
+    init(privateKey: Data, publicKey: Data, npub: String, createdAt: Date) {
         self.privateKey = privateKey
         self.publicKey = publicKey
         self.npub = npub
         self.createdAt = createdAt
     }
-
+    
     /// Generate a new Nostr identity
-    public static func generate() throws -> NostrIdentity {
+    static func generate() throws -> NostrIdentity {
+        // Generate Schnorr key for Nostr
         let schnorrKey = try P256K.Schnorr.PrivateKey()
         let xOnlyPubkey = Data(schnorrKey.xonly.bytes)
         let npub = try Bech32.encode(hrp: "npub", data: xOnlyPubkey)
-
+        
         return NostrIdentity(
             privateKey: schnorrKey.dataRepresentation,
-            publicKey: xOnlyPubkey,
+            publicKey: xOnlyPubkey, // Store x-only public key
             npub: npub,
             createdAt: Date()
         )
     }
-
+    
     /// Initialize from existing private key data
-    public init(privateKeyData: Data) throws {
+    init(privateKeyData: Data) throws {
         let schnorrKey = try P256K.Schnorr.PrivateKey(dataRepresentation: privateKeyData)
         let xOnlyPubkey = Data(schnorrKey.xonly.bytes)
-
+        
         self.privateKey = privateKeyData
         self.publicKey = xOnlyPubkey
         self.npub = try Bech32.encode(hrp: "npub", data: xOnlyPubkey)
         self.createdAt = Date()
     }
-
+    
     /// Get signing key for event signatures
-    public func signingKey() throws -> P256K.Signing.PrivateKey {
+    func signingKey() throws -> P256K.Signing.PrivateKey {
         try P256K.Signing.PrivateKey(dataRepresentation: privateKey)
     }
-
+    
     /// Get Schnorr signing key for Nostr event signatures
-    public func schnorrSigningKey() throws -> P256K.Schnorr.PrivateKey {
+    func schnorrSigningKey() throws -> P256K.Schnorr.PrivateKey {
         try P256K.Schnorr.PrivateKey(dataRepresentation: privateKey)
     }
-
+    
     /// Get hex-encoded public key (for Nostr events)
-    public var publicKeyHex: String {
-        publicKey.hexEncodedString()
+    var publicKeyHex: String {
+        // Public key is already stored as x-only (32 bytes)
+        return publicKey.hexEncodedString()
     }
 }

bitchat/Nostr/NostrIdentityBridge.swift

@@ -1,54 +1,52 @@
+import BitFoundation
 import Foundation
 import CryptoKit
 
-/// Minimal keychain access required by NostrIdentityBridge.
-public protocol NostrKeychainStoring: Sendable {
-    func save(key: String, data: Data, service: String, accessible: CFString?)
-    func load(key: String, service: String) -> Data?
-}
-
 /// Bridge between Noise and Nostr identities
-public final class NostrIdentityBridge {
+final class NostrIdentityBridge {
     private let keychainService = "chat.bitchat.nostr"
     private let currentIdentityKey = "nostr-current-identity"
     private let deviceSeedKey = "nostr-device-seed"
-    private let deviceSeedCache: NSLock = NSLock()
-    private var _deviceSeedCacheValue: Data?
+    // In-memory cache to avoid transient keychain access issues
+    private var deviceSeedCache: Data?
     // Cache derived identities to avoid repeated crypto during view rendering
-    private var _derivedIdentityCache: [String: NostrIdentity] = [:]
+    private var derivedIdentityCache: [String: NostrIdentity] = [:]
     private let cacheLock = NSLock()
 
-    private let keychain: any NostrKeychainStoring
+    private let keychain: KeychainManagerProtocol
 
-    public init(keychain: any NostrKeychainStoring) {
+    init(keychain: KeychainManagerProtocol = KeychainManager()) {
         self.keychain = keychain
     }
-
+    
     /// Get or create the current Nostr identity
-    public func getCurrentNostrIdentity() throws -> NostrIdentity? {
+    func getCurrentNostrIdentity() throws -> NostrIdentity? {
+        // Check if we already have a Nostr identity
         if let existingData = keychain.load(key: currentIdentityKey, service: keychainService),
            let identity = try? JSONDecoder().decode(NostrIdentity.self, from: existingData) {
             return identity
         }
-
+        
+        // Generate new Nostr identity
         let nostrIdentity = try NostrIdentity.generate()
-
+        
+        // Store it
         let data = try JSONEncoder().encode(nostrIdentity)
         keychain.save(key: currentIdentityKey, data: data, service: keychainService, accessible: nil)
-
+        
         return nostrIdentity
     }
-
+    
     /// Associate a Nostr identity with a Noise public key (for favorites)
-    public func associateNostrIdentity(_ nostrPubkey: String, with noisePublicKey: Data) {
+    func associateNostrIdentity(_ nostrPubkey: String, with noisePublicKey: Data) {
         let key = "nostr-noise-\(noisePublicKey.base64EncodedString())"
         if let data = nostrPubkey.data(using: .utf8) {
             keychain.save(key: key, data: data, service: keychainService, accessible: nil)
         }
     }
-
+    
     /// Get Nostr public key associated with a Noise public key
-    public func getNostrPublicKey(for noisePublicKey: Data) -> String? {
+    func getNostrPublicKey(for noisePublicKey: Data) -> String? {
         let key = "nostr-noise-\(noisePublicKey.base64EncodedString())"
         guard let data = keychain.load(key: key, service: keychainService),
               let pubkey = String(data: data, encoding: .utf8) else {
@@ -56,9 +54,9 @@ public final class NostrIdentityBridge {
         }
         return pubkey
     }
-
+    
     /// Clear all Nostr identity associations and current identity
-    public func clearAllAssociations() {
+    func clearAllAssociations() {
         let query: [String: Any] = [
             kSecClass as String: kSecClassGenericPassword,
             kSecAttrService as String: keychainService,
@@ -79,45 +77,42 @@ public final class NostrIdentityBridge {
                 }
                 SecItemDelete(deleteQuery as CFDictionary)
             }
+        } else if status == errSecItemNotFound {
+            // nothing persisted; no action needed
         }
 
-        deviceSeedCache.lock()
-        _deviceSeedCacheValue = nil
-        deviceSeedCache.unlock()
+        deviceSeedCache = nil
     }
 
     // MARK: - Per-Geohash Identities (Location Channels)
 
+    /// Returns a stable device seed used to derive unlinkable per-geohash identities.
+    /// Stored only on device keychain.
     private func getOrCreateDeviceSeed() -> Data {
-        deviceSeedCache.lock()
-        if let cached = _deviceSeedCacheValue {
-            deviceSeedCache.unlock()
-            return cached
-        }
-        deviceSeedCache.unlock()
-
+        if let cached = deviceSeedCache { return cached }
         if let existing = keychain.load(key: deviceSeedKey, service: keychainService) {
+            // Migrate to AfterFirstUnlockThisDeviceOnly for stability during lock
             keychain.save(key: deviceSeedKey, data: existing, service: keychainService, accessible: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)
-            deviceSeedCache.lock()
-            _deviceSeedCacheValue = existing
-            deviceSeedCache.unlock()
+            deviceSeedCache = existing
             return existing
         }
         var seed = Data(count: 32)
         _ = seed.withUnsafeMutableBytes { ptr in
             SecRandomCopyBytes(kSecRandomDefault, 32, ptr.baseAddress!)
         }
+        // Ensure availability after first unlock to prevent unintended rotation when locked
         keychain.save(key: deviceSeedKey, data: seed, service: keychainService, accessible: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)
-        deviceSeedCache.lock()
-        _deviceSeedCacheValue = seed
-        deviceSeedCache.unlock()
+        deviceSeedCache = seed
         return seed
     }
 
     /// Derive a deterministic, unlinkable Nostr identity for a given geohash.
-    public func deriveIdentity(forGeohash geohash: String) throws -> NostrIdentity {
+    /// Uses HMAC-SHA256(deviceSeed, geohash) as private key material, with fallback rehashing
+    /// if the candidate is not a valid secp256k1 private key.
+    func deriveIdentity(forGeohash geohash: String) throws -> NostrIdentity {
+        // Check cache first to avoid repeated crypto + keychain I/O during view rendering
         cacheLock.lock()
-        if let cached = _derivedIdentityCache[geohash] {
+        if let cached = derivedIdentityCache[geohash] {
             cacheLock.unlock()
             return cached
         }
@@ -138,21 +133,24 @@ public final class NostrIdentityBridge {
             return Data(code)
         }
 
+        // Try a few iterations to ensure a valid key can be formed
         for i in 0..<10 {
             let keyData = candidateKey(iteration: UInt32(i))
             if let identity = try? NostrIdentity(privateKeyData: keyData) {
+                // Cache the result
                 cacheLock.lock()
-                _derivedIdentityCache[geohash] = identity
+                derivedIdentityCache[geohash] = identity
                 cacheLock.unlock()
                 return identity
             }
         }
-
+        // As a final fallback, hash the seed+msg and try again
         let fallback = (seed + msg).sha256Hash()
         let identity = try NostrIdentity(privateKeyData: fallback)
 
+        // Cache the result
         cacheLock.lock()
-        _derivedIdentityCache[geohash] = identity
+        derivedIdentityCache[geohash] = identity
         cacheLock.unlock()
 
         return identity

bitchat/Nostr/NostrLiveFactories.swift

@@ -1,118 +0,0 @@
-import Nostr
-import Combine
-import Foundation
-import Tor
-#if os(iOS)
-import UIKit
-#elseif os(macOS)
-import AppKit
-#endif
-
-// MARK: - GeoRelayDirectory Live Dependencies
-
-extension GeoRelayDirectoryDependencies {
-    @MainActor
-    static func live() -> Self {
-        #if os(iOS)
-        let activeNotificationName: Notification.Name? = UIApplication.didBecomeActiveNotification
-        #elseif os(macOS)
-        let activeNotificationName: Notification.Name? = NSApplication.didBecomeActiveNotification
-        #else
-        let activeNotificationName: Notification.Name? = nil
-        #endif
-
-        return Self(
-            userDefaults: .standard,
-            notificationCenter: .default,
-            now: Date.init,
-            remoteURL: URL(string: "https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv")!,
-            fetchInterval: TransportConfig.geoRelayFetchIntervalSeconds,
-            refreshCheckInterval: TransportConfig.geoRelayRefreshCheckIntervalSeconds,
-            retryInitialSeconds: TransportConfig.geoRelayRetryInitialSeconds,
-            retryMaxSeconds: TransportConfig.geoRelayRetryMaxSeconds,
-            awaitTorReady: { await TorManager.shared.awaitReady() },
-            makeFetchData: {
-                let session = TorURLSession.shared.session
-                return { request in
-                    let (data, _) = try await session.data(for: request)
-                    return data
-                }
-            },
-            readData: { try? Data(contentsOf: $0) },
-            writeData: { data, url in
-                try data.write(to: url, options: .atomic)
-            },
-            cacheURL: {
-                do {
-                    let base = try FileManager.default.url(
-                        for: .applicationSupportDirectory,
-                        in: .userDomainMask,
-                        appropriateFor: nil,
-                        create: true
-                    )
-                    let dir = base.appendingPathComponent("bitchat", isDirectory: true)
-                    try? FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
-                    return dir.appendingPathComponent("georelays_cache.csv")
-                } catch {
-                    return nil
-                }
-            },
-            bundledCSVURLs: {
-                [
-                    Bundle.main.url(forResource: "nostr_relays", withExtension: "csv"),
-                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv"),
-                    Bundle.main.url(forResource: "online_relays_gps", withExtension: "csv", subdirectory: "relays")
-                ].compactMap { $0 }
-            },
-            currentDirectoryPath: { FileManager.default.currentDirectoryPath },
-            retrySleep: { delay in
-                let nanoseconds = UInt64(delay * 1_000_000_000)
-                try? await Task.sleep(nanoseconds: nanoseconds)
-            },
-            torReadyNotificationName: .TorDidBecomeReady,
-            activeNotificationName: activeNotificationName,
-            autoStart: true
-        )
-    }
-}
-
-// MARK: - NostrRelayManager Live Dependencies
-
-extension NostrRelayManagerDependencies {
-    @MainActor
-    static func live() -> Self {
-        Self(
-            activationAllowed: { NetworkActivationService.shared.activationAllowed },
-            userTorEnabled: { NetworkActivationService.shared.userTorEnabled },
-            hasMutualFavorites: { !FavoritesPersistenceService.shared.mutualFavorites.isEmpty },
-            hasLocationPermission: { LocationChannelManager.shared.permissionState == .authorized },
-            mutualFavoritesPublisher: FavoritesPersistenceService.shared.$mutualFavorites.eraseToAnyPublisher(),
-            locationPermissionPublisher: LocationChannelManager.shared.$permissionState
-                .map { state -> LocationPermissionState in
-                    switch state {
-                    case .notDetermined:.notDetermined
-                    case .authorized:   .authorized
-                    case .denied:       .denied
-                    case .restricted:   .denied
-                    }
-                }
-                .eraseToAnyPublisher(),
-            torEnforced: { TorManager.shared.torEnforced },
-            torIsReady: { TorManager.shared.isReady },
-            torIsForeground: { TorManager.shared.isForeground() },
-            awaitTorReady: { completion in
-                Task.detached {
-                    let ready = await TorManager.shared.awaitReady()
-                    await MainActor.run {
-                        completion(ready)
-                    }
-                }
-            },
-            makeSession: { NostrRelayManager.makeURLSession(TorURLSession.shared.session) },
-            scheduleAfter: { delay, action in
-                DispatchQueue.main.asyncAfter(deadline: .now() + delay, execute: action)
-            },
-            now: Date.init
-        )
-    }
-}

bitchat/Nostr/NostrProtocol.swift

@@ -1,15 +1,17 @@
-import BitFoundation
 import BitLogger
 import Foundation
 import CryptoKit
 import P256K
 import Security
 
-/// NIP-17 Protocol Implementation for Private Direct Messages
-public struct NostrProtocol {
+// Note: This file depends on Data extension from BinaryEncodingUtils.swift
+// Make sure BinaryEncodingUtils.swift is included in the target
 
+/// NIP-17 Protocol Implementation for Private Direct Messages
+struct NostrProtocol {
+    
     /// Nostr event kinds
-    public enum EventKind: Int, Sendable {
+    enum EventKind: Int {
         case metadata = 0
         case textNote = 1
         case dm = 14 // NIP-17 DM rumor kind
@@ -18,71 +20,88 @@ public struct NostrProtocol {
         case ephemeralEvent = 20000
         case geohashPresence = 20001
     }
-
+    
     /// Create a NIP-17 private message
-    public static func createPrivateMessage(
+    static func createPrivateMessage(
         content: String,
         recipientPubkey: String,
         senderIdentity: NostrIdentity
     ) throws -> NostrEvent {
+        
+        // Creating private message
+        
+        // 1. Create the rumor (unsigned event)
         let rumor = NostrEvent(
             pubkey: senderIdentity.publicKeyHex,
             createdAt: Date(),
-            kind: .dm,
+            kind: .dm, // NIP-17: DM rumor kind 14
             tags: [],
             content: content
         )
-
+        
+        // 2. Create ephemeral key for this message
         let ephemeralKey = try P256K.Schnorr.PrivateKey()
-
+        // Created ephemeral key for seal
+        
+        // 3. Seal the rumor (encrypt to recipient)
         let sealedEvent = try createSeal(
             rumor: rumor,
             recipientPubkey: recipientPubkey,
             senderKey: ephemeralKey
         )
-
+        
+        // 4. Gift wrap the sealed event (encrypt to recipient again)
         let giftWrap = try createGiftWrap(
             seal: sealedEvent,
             recipientPubkey: recipientPubkey,
             senderKey: ephemeralKey
         )
-
+        
+        // Created gift wrap
+        
         return giftWrap
     }
-
+    
     /// Decrypt a received NIP-17 message
     /// Returns the content, sender pubkey, and the actual message timestamp (not the randomized gift wrap timestamp)
-    public static func decryptPrivateMessage(
+    static func decryptPrivateMessage(
         giftWrap: NostrEvent,
         recipientIdentity: NostrIdentity
     ) throws -> (content: String, senderPubkey: String, timestamp: Int) {
+        
+        // Starting decryption
+        
+        // 1. Unwrap the gift wrap
         let seal: NostrEvent
         do {
             seal = try unwrapGiftWrap(
                 giftWrap: giftWrap,
                 recipientKey: recipientIdentity.schnorrSigningKey()
             )
+            // Successfully unwrapped gift wrap
         } catch {
             SecureLogger.error("❌ Failed to unwrap gift wrap: \(error)", category: .session)
             throw error
         }
-
+        
+        // 2. Open the seal
         let rumor: NostrEvent
         do {
             rumor = try openSeal(
                 seal: seal,
                 recipientKey: recipientIdentity.schnorrSigningKey()
             )
+            // Successfully opened seal
         } catch {
             SecureLogger.error("❌ Failed to open seal: \(error)", category: .session)
             throw error
         }
-
+        
         return (content: rumor.content, senderPubkey: rumor.pubkey, timestamp: rumor.created_at)
     }
 
     /// Create a geohash-scoped ephemeral public message (kind 20000)
-    public static func createEphemeralGeohashEvent(
+    static func createEphemeralGeohashEvent(
         content: String,
         geohash: String,
         senderIdentity: NostrIdentity,
@@ -109,7 +128,7 @@ public struct NostrProtocol {
 
     /// Create a geohash presence heartbeat (kind 20001)
     /// Must contain empty content and NO nickname tag
-    public static func createGeohashPresenceEvent(
+    static func createGeohashPresenceEvent(
         geohash: String,
         senderIdentity: NostrIdentity
     ) throws -> NostrEvent {
@@ -126,7 +145,7 @@ public struct NostrProtocol {
     }
 
     /// Create a persistent location note (kind 1: text note) tagged to a street-level geohash.
-    public static func createGeohashTextNote(
+    static func createGeohashTextNote(
         content: String,
         geohash: String,
         senderIdentity: NostrIdentity,
@@ -146,21 +165,22 @@ public struct NostrProtocol {
         let schnorrKey = try senderIdentity.schnorrSigningKey()
         return try event.sign(with: schnorrKey)
     }
-
+    
     // MARK: - Private Methods
-
+    
     private static func createSeal(
         rumor: NostrEvent,
         recipientPubkey: String,
         senderKey: P256K.Schnorr.PrivateKey
     ) throws -> NostrEvent {
+        
         let rumorJSON = try rumor.jsonString()
         let encrypted = try encrypt(
             plaintext: rumorJSON,
             recipientPubkey: recipientPubkey,
             senderKey: senderKey
         )
-
+        
         let seal = NostrEvent(
             pubkey: Data(senderKey.xonly.bytes).hexEncodedString(),
             createdAt: randomizedTimestamp(),
@@ -168,111 +188,133 @@ public struct NostrProtocol {
             tags: [],
             content: encrypted
         )
-
+        
+        // Sign the seal with the sender's Schnorr private key
         return try seal.sign(with: senderKey)
     }
-
+    
     private static func createGiftWrap(
         seal: NostrEvent,
         recipientPubkey: String,
-        senderKey: P256K.Schnorr.PrivateKey
+        senderKey: P256K.Schnorr.PrivateKey  // This is the ephemeral key used for the seal
     ) throws -> NostrEvent {
+        
         let sealJSON = try seal.jsonString()
+        
+        // Create new ephemeral key for gift wrap
         let wrapKey = try P256K.Schnorr.PrivateKey()
-
+        // Creating gift wrap with ephemeral key
+        
+        // Encrypt the seal with the new ephemeral key (not the seal's key)
         let encrypted = try encrypt(
             plaintext: sealJSON,
             recipientPubkey: recipientPubkey,
-            senderKey: wrapKey
+            senderKey: wrapKey  // Use the gift wrap ephemeral key
         )
-
+        
         let giftWrap = NostrEvent(
             pubkey: Data(wrapKey.xonly.bytes).hexEncodedString(),
             createdAt: randomizedTimestamp(),
             kind: .giftWrap,
-            tags: [["p", recipientPubkey]],
+            tags: [["p", recipientPubkey]], // Tag recipient
             content: encrypted
         )
-
+        
+        // Sign the gift wrap with the wrap Schnorr private key
         return try giftWrap.sign(with: wrapKey)
     }
-
+    
     private static func unwrapGiftWrap(
         giftWrap: NostrEvent,
         recipientKey: P256K.Schnorr.PrivateKey
     ) throws -> NostrEvent {
+        
+        // Unwrapping gift wrap
+        
         let decrypted = try decrypt(
             ciphertext: giftWrap.content,
             senderPubkey: giftWrap.pubkey,
             recipientKey: recipientKey
         )
-
+        
         guard let data = decrypted.data(using: .utf8),
               let sealDict = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             throw NostrError.invalidEvent
         }
-
-        return try NostrEvent(from: sealDict)
+        
+        let seal = try NostrEvent(from: sealDict)
+        // Unwrapped seal
+        
+        return seal
     }
-
+    
     private static func openSeal(
         seal: NostrEvent,
         recipientKey: P256K.Schnorr.PrivateKey
     ) throws -> NostrEvent {
+        
         let decrypted = try decrypt(
             ciphertext: seal.content,
             senderPubkey: seal.pubkey,
             recipientKey: recipientKey
         )
-
+        
         guard let data = decrypted.data(using: .utf8),
               let rumorDict = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
             throw NostrError.invalidEvent
         }
-
+        
         return try NostrEvent(from: rumorDict)
     }
-
+    
     // MARK: - Encryption (NIP-44 v2)
-
+    
     private static func encrypt(
         plaintext: String,
         recipientPubkey: String,
         senderKey: P256K.Schnorr.PrivateKey
     ) throws -> String {
+        
         guard let recipientPubkeyData = Data(hexString: recipientPubkey) else {
             throw NostrError.invalidPublicKey
         }
-
+        
+        // Encrypting message (NIP-44 v2: XChaCha20-Poly1305, versioned)
+        
+        // Derive shared secret
         let sharedSecret = try deriveSharedSecret(
             privateKey: senderKey,
             publicKey: recipientPubkeyData
         )
+        // Derive NIP-44 v2 symmetric key (HKDF-SHA256 with label in info)
         let key = try deriveNIP44V2Key(from: sharedSecret)
-
+        
+        // 24-byte random nonce for XChaCha20-Poly1305
         var nonce24 = Data(count: 24)
         _ = nonce24.withUnsafeMutableBytes { ptr in
             SecRandomCopyBytes(kSecRandomDefault, 24, ptr.baseAddress!)
         }
-
+        
         let pt = Data(plaintext.utf8)
         let sealed = try XChaCha20Poly1305Compat.seal(plaintext: pt, key: key, nonce24: nonce24)
-
+        
+        // v2: base64url(nonce24 || ciphertext || tag)
         var combined = Data()
         combined.append(nonce24)
         combined.append(sealed.ciphertext)
         combined.append(sealed.tag)
-        return "v2:" + base64URLEncode(combined)
+        return "v2:" + Base64URLCoding.encode(combined)
     }
-
+    
     private static func decrypt(
         ciphertext: String,
         senderPubkey: String,
         recipientKey: P256K.Schnorr.PrivateKey
     ) throws -> String {
+        // Expect NIP-44 v2 format
         guard ciphertext.hasPrefix("v2:") else { throw NostrError.invalidCiphertext }
         let encoded = String(ciphertext.dropFirst(3))
-        guard let data = base64URLDecode(encoded),
+        guard let data = Base64URLCoding.decode(encoded),
               data.count > (24 + 16),
               let senderPubkeyData = Data(hexString: senderPubkey) else {
             throw NostrError.invalidCiphertext
@@ -283,6 +325,7 @@ public struct NostrProtocol {
         let tag = rest.suffix(16)
         let ct = rest.dropLast(16)
 
+        // Try decryption with even-Y then odd-Y when sender pubkey is x-only
         func attemptDecrypt(using pubKeyData: Data) throws -> Data {
             let ss = try deriveSharedSecret(privateKey: recipientKey, publicKey: pubKeyData)
             let key = try deriveNIP44V2Key(from: ss)
@@ -294,6 +337,7 @@ public struct NostrProtocol {
             )
         }
 
+        // If 32 bytes (x-only) try both parities, otherwise single try
         if senderPubkeyData.count == 32 {
             let even = Data([0x02]) + senderPubkeyData
             if let pt = try? attemptDecrypt(using: even) {
@@ -307,23 +351,32 @@ public struct NostrProtocol {
             return String(data: pt, encoding: .utf8) ?? ""
         }
     }
-
+    
     private static func deriveSharedSecret(
         privateKey: P256K.Schnorr.PrivateKey,
         publicKey: Data
     ) throws -> Data {
+        // Deriving shared secret
+        
+        // Convert Schnorr private key to KeyAgreement private key
         let keyAgreementPrivateKey = try P256K.KeyAgreement.PrivateKey(
             dataRepresentation: privateKey.dataRepresentation
         )
-
+        
+        // Create KeyAgreement public key from the public key data
+        // For ECDH, we need the full 33-byte compressed public key (with 0x02 or 0x03 prefix)
         var fullPublicKey = Data()
-        if publicKey.count == 32 {
+        if publicKey.count == 32 { // X-only key, need to add prefix
+            // For x-only keys in Nostr/Bitcoin, we need to try both possible Y coordinates
+            // First try with even Y (0x02 prefix)
             fullPublicKey.append(0x02)
             fullPublicKey.append(publicKey)
+            // Trying with even Y coordinate
         } else {
             fullPublicKey = publicKey
         }
-
+        
+        // Try to create public key, if it fails with even Y, try odd Y
         let keyAgreementPublicKey: P256K.KeyAgreement.PublicKey
         do {
             keyAgreementPublicKey = try P256K.KeyAgreement.PublicKey(
@@ -332,6 +385,8 @@ public struct NostrProtocol {
             )
         } catch {
             if publicKey.count == 32 {
+                // Try with odd Y (0x03 prefix)
+                // Even Y failed, trying odd Y
                 fullPublicKey = Data()
                 fullPublicKey.append(0x03)
                 fullPublicKey.append(publicKey)
@@ -343,32 +398,85 @@ public struct NostrProtocol {
                 throw error
             }
         }
-
+        
+        // Perform ECDH
         let sharedSecret = try keyAgreementPrivateKey.sharedSecretFromKeyAgreement(
             with: keyAgreementPublicKey,
             format: .compressed
         )
-
-        return sharedSecret.withUnsafeBytes { Data($0) }
+        
+        // Convert SharedSecret to Data
+        let sharedSecretData = sharedSecret.withUnsafeBytes { Data($0) }
+        // ECDH shared secret derived
+        
+        // Return raw ECDH shared secret; HKDF is applied by deriveNIP44V2Key
+        return sharedSecretData
     }
-
+    
+    // Direct version that doesn't try to add prefixes
+    private static func deriveSharedSecretDirect(
+        privateKey: P256K.Schnorr.PrivateKey,
+        publicKey: Data
+    ) throws -> Data {
+        // Direct shared secret calculation
+        
+        // Convert Schnorr private key to KeyAgreement private key
+        let keyAgreementPrivateKey = try P256K.KeyAgreement.PrivateKey(
+            dataRepresentation: privateKey.dataRepresentation
+        )
+        
+        // Use the public key as-is (should already have prefix)
+        let keyAgreementPublicKey = try P256K.KeyAgreement.PublicKey(
+            dataRepresentation: publicKey,
+            format: .compressed
+        )
+        
+        // Perform ECDH
+        let sharedSecret = try keyAgreementPrivateKey.sharedSecretFromKeyAgreement(
+            with: keyAgreementPublicKey,
+            format: .compressed
+        )
+        
+        // Convert SharedSecret to Data
+        let sharedSecretData = sharedSecret.withUnsafeBytes { Data($0) }
+        
+        // Return raw ECDH shared secret; HKDF is applied by deriveNIP44V2Key
+        return sharedSecretData
+    }
+    
     private static func randomizedTimestamp() -> Date {
-        let offset = TimeInterval.random(in: -900...900)
-        return Date().addingTimeInterval(offset)
+        // Add random offset to current time for privacy
+        // This prevents timing correlation attacks while the actual message timestamp
+        // is preserved in the encrypted rumor
+        let offset = TimeInterval.random(in: -900...900) // +/- 15 minutes
+        let now = Date()
+        let randomized = now.addingTimeInterval(offset)
+        
+        // Log with explicit UTC and local time for debugging
+        let formatter = DateFormatter()
+        //
+        formatter.dateFormat = "yyyy-MM-dd HH:mm:ss"
+        formatter.timeZone = TimeZone(abbreviation: "UTC")
+        
+        formatter.timeZone = TimeZone.current
+        
+        // Timestamp randomized for privacy
+        
+        return randomized
     }
 }
 
 /// Nostr Event structure
-public struct NostrEvent: Codable, Sendable {
-    public var id: String
-    public let pubkey: String
-    public let created_at: Int
-    public let kind: Int
-    public let tags: [[String]]
-    public let content: String
-    public var sig: String?
-
-    public init(
+struct NostrEvent: Codable {
+    var id: String
+    let pubkey: String
+    let created_at: Int
+    let kind: Int
+    let tags: [[String]]
+    let content: String
+    var sig: String?
+    
+    init(
         pubkey: String,
         createdAt: Date,
         kind: NostrProtocol.EventKind,
@@ -381,10 +489,10 @@ public struct NostrEvent: Codable, Sendable {
         self.tags = tags
         self.content = content
         self.sig = nil
-        self.id = ""
+        self.id = "" // Will be set during signing
     }
-
-    public init(from dict: [String: Any]) throws {
+    
+    init(from dict: [String: Any]) throws {
         guard let pubkey = dict["pubkey"] as? String,
               let createdAt = dict["created_at"] as? Int,
               let kind = dict["kind"] as? Int,
@@ -392,7 +500,7 @@ public struct NostrEvent: Codable, Sendable {
               let content = dict["content"] as? String else {
             throw NostrError.invalidEvent
         }
-
+        
         self.id = dict["id"] as? String ?? ""
         self.pubkey = pubkey
         self.created_at = createdAt
@@ -401,19 +509,20 @@ public struct NostrEvent: Codable, Sendable {
         self.content = content
         self.sig = dict["sig"] as? String
     }
-
-    public func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
+    
+    func sign(with key: P256K.Schnorr.PrivateKey) throws -> NostrEvent {
         let (eventId, eventIdHash) = try calculateEventId()
-
+        
+        // Sign with Schnorr (BIP-340)
         var messageBytes = [UInt8](eventIdHash)
         var auxRand = [UInt8](repeating: 0, count: 32)
         _ = auxRand.withUnsafeMutableBytes { ptr in
             SecRandomCopyBytes(kSecRandomDefault, 32, ptr.baseAddress!)
         }
         let schnorrSignature = try key.signature(message: &messageBytes, auxiliaryRand: &auxRand)
-
+        
         let signatureHex = schnorrSignature.dataRepresentation.hexEncodedString()
-
+        
         var signed = self
         signed.id = eventId
         signed.sig = signatureHex
@@ -422,7 +531,7 @@ public struct NostrEvent: Codable, Sendable {
 
     /// Validate that the event ID and Schnorr signature match the content and pubkey.
     /// Returns false when the signature is missing, malformed, or does not verify.
-    public func isValidSignature() -> Bool {
+    func isValidSignature() -> Bool {
         guard let sig = sig,
               let sigData = Data(hexString: sig),
               let pubData = Data(hexString: pubkey),
@@ -439,7 +548,7 @@ public struct NostrEvent: Codable, Sendable {
         let xonly = P256K.Schnorr.XonlyKey(dataRepresentation: pubData)
         return xonly.isValid(signature, for: &messageBytes)
     }
-
+    
     private func calculateEventId() throws -> (String, Data) {
         let serialized = [
             0,
@@ -449,12 +558,12 @@ public struct NostrEvent: Codable, Sendable {
             tags,
             content
         ] as [Any]
-
+        
         let data = try JSONSerialization.data(withJSONObject: serialized, options: [.withoutEscapingSlashes])
         return (data.sha256Fingerprint(), data.sha256Hash())
     }
-
-    public func jsonString() throws -> String {
+    
+    func jsonString() throws -> String {
         let encoder = JSONEncoder()
         encoder.outputFormatting = [.withoutEscapingSlashes]
         let data = try encoder.encode(self)
@@ -462,7 +571,7 @@ public struct NostrEvent: Codable, Sendable {
     }
 }
 
-public enum NostrError: Error, Sendable {
+enum NostrError: Error {
     case invalidPublicKey
     case invalidPrivateKey
     case invalidEvent
@@ -471,24 +580,9 @@ public enum NostrError: Error, Sendable {
     case encryptionFailed
 }
 
-// MARK: - NIP-44 v2 helpers (XChaCha20-Poly1305 + base64url)
+// MARK: - NIP-44 v2 helpers (XChaCha20-Poly1305)
 
 private extension NostrProtocol {
-    static func base64URLEncode(_ data: Data) -> String {
-        return data.base64EncodedString()
-            .replacingOccurrences(of: "+", with: "-")
-            .replacingOccurrences(of: "/", with: "_")
-            .replacingOccurrences(of: "=", with: "")
-    }
-
-    static func base64URLDecode(_ s: String) -> Data? {
-        var str = s
-        let pad = (4 - (str.count % 4)) % 4
-        if pad > 0 { str += String(repeating: "=", count: pad) }
-        str = str.replacingOccurrences(of: "-", with: "+").replacingOccurrences(of: "_", with: "/")
-        return Data(base64Encoded: str)
-    }
-
     static func deriveNIP44V2Key(from sharedSecretData: Data) throws -> Data {
         let derivedKey = HKDF<CryptoKit.SHA256>.deriveKey(
             inputKeyMaterial: SymmetricKey(data: sharedSecretData),

bitchat/Nostr/NostrRelayURL.swift

@@ -0,0 +1,51 @@
+import Foundation
+
+enum NostrRelayURL {
+    static func normalized(_ rawValue: String, defaultScheme: String? = nil) -> String? {
+        var value = rawValue.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !value.isEmpty else { return nil }
+
+        if !value.contains("://"), let defaultScheme {
+            value = "\(defaultScheme)://\(value)"
+        }
+
+        guard var components = URLComponents(string: value),
+              let rawScheme = components.scheme?.lowercased(),
+              let rawHost = components.host?.lowercased(),
+              !rawHost.isEmpty else {
+            return nil
+        }
+
+        switch rawScheme {
+        case "wss", "https":
+            components.scheme = "wss"
+            if components.port == 443 {
+                components.port = nil
+            }
+        case "ws", "http":
+            components.scheme = "ws"
+            if components.port == 80 {
+                components.port = nil
+            }
+        default:
+            return nil
+        }
+
+        components.host = rawHost
+        if components.path == "/" {
+            components.path = ""
+        }
+        components.fragment = nil
+
+        return components.string
+    }
+
+    static func directoryAddress(_ rawValue: String) -> String? {
+        guard var normalized = normalized(rawValue, defaultScheme: "wss") else { return nil }
+        for prefix in ["wss://", "ws://"] where normalized.hasPrefix(prefix) {
+            normalized.removeFirst(prefix.count)
+            break
+        }
+        return normalized
+    }
+}

bitchat/Nostr/XChaCha20Poly1305Compat.swift

@@ -6,6 +6,7 @@ import CryptoKit
 /// as per XChaCha20 construction.
 enum XChaCha20Poly1305Compat {
 
+    /// Errors that can occur during XChaCha20-Poly1305 operations
     enum Error: Swift.Error {
         case invalidKeyLength(expected: Int, got: Int)
         case invalidNonceLength(expected: Int, got: Int)
@@ -58,6 +59,7 @@ enum XChaCha20Poly1305Compat {
     }
 
     private static func hchacha20(key: Data, nonce16: Data) throws -> Data {
+        // HChaCha20 based on the original ChaCha20 core with a 16-byte nonce.
         guard key.count == 32 else {
             throw Error.invalidKeyLength(expected: 32, got: key.count)
         }
@@ -68,22 +70,28 @@ enum XChaCha20Poly1305Compat {
         // Constants "expand 32-byte k"
         var state: [UInt32] = [
             0x61707865, 0x3320646e, 0x79622d32, 0x6b206574,
+            // key (8 words)
             key.loadLEWord(0), key.loadLEWord(4), key.loadLEWord(8), key.loadLEWord(12),
             key.loadLEWord(16), key.loadLEWord(20), key.loadLEWord(24), key.loadLEWord(28),
+            // nonce (4 words)
             nonce16.loadLEWord(0), nonce16.loadLEWord(4), nonce16.loadLEWord(8), nonce16.loadLEWord(12)
         ]
 
+        // 20 rounds (10 double rounds)
         for _ in 0..<10 {
+            // Column rounds
             quarterRound(&state, 0, 4, 8, 12)
             quarterRound(&state, 1, 5, 9, 13)
             quarterRound(&state, 2, 6, 10, 14)
             quarterRound(&state, 3, 7, 11, 15)
+            // Diagonal rounds
             quarterRound(&state, 0, 5, 10, 15)
             quarterRound(&state, 1, 6, 11, 12)
             quarterRound(&state, 2, 7, 8, 13)
             quarterRound(&state, 3, 4, 9, 14)
         }
 
+        // Output subkey: state[0..3] and state[12..15]
         var out = Data(count: 32)
         out.storeLEWord(state[0], at: 0)
         out.storeLEWord(state[1], at: 4)
@@ -124,3 +132,4 @@ private extension Data {
         replaceSubrange(offset..<(offset+4), with: bytes)
     }
 }
+

bitchat/Protocols/BitchatFilePacket.swift

@@ -7,6 +7,7 @@
 //
 
 import Foundation
+import BitFoundation
 import BitLogger
 
 /// TLV payload for Bluetooth mesh file transfers (voice notes, images, generic files).

bitchat/Protocols/BitchatProtocol.swift

@@ -62,40 +62,6 @@ import Foundation
 import CoreBluetooth
 import BitFoundation
 
-// MARK: - Message Types
-
-/// Simplified BitChat protocol message types.
-/// Reduced from 24 types to just 6 essential ones.
-/// All private communication metadata (receipts, status) is embedded in noiseEncrypted payloads.
-enum MessageType: UInt8 {
-    // Public messages (unencrypted)
-    case announce = 0x01        // "I'm here" with nickname
-    case message = 0x02         // Public chat message  
-    case leave = 0x03           // "I'm leaving"
-    case requestSync = 0x21     // GCS filter-based sync request (local-only)
-    
-    // Noise encryption
-    case noiseHandshake = 0x10  // Handshake (init or response determined by payload)
-    case noiseEncrypted = 0x11  // All encrypted payloads (messages, receipts, etc.)
-    
-    // Fragmentation (simplified)
-    case fragment = 0x20        // Single fragment type for large messages
-    case fileTransfer = 0x22    // Binary file/audio/image payloads
-    
-    var description: String {
-        switch self {
-        case .announce: return "announce"
-        case .message: return "message"
-        case .leave: return "leave"
-        case .requestSync: return "requestSync"
-        case .noiseHandshake: return "noiseHandshake"
-        case .noiseEncrypted: return "noiseEncrypted"
-        case .fragment: return "fragment"
-        case .fileTransfer: return "fileTransfer"
-        }
-    }
-}
-
 // MARK: - Noise Payload Types
 
 /// Types of payloads embedded within noiseEncrypted messages.
@@ -132,35 +98,6 @@ enum LazyHandshakeState {
     case failed(Error)         // Handshake failed
 }
 
-// MARK: - Delivery Status
-
-// Delivery status for messages
-enum DeliveryStatus: Codable, Equatable, Hashable {
-    case sending
-    case sent  // Left our device
-    case delivered(to: String, at: Date)  // Confirmed by recipient
-    case read(by: String, at: Date)  // Seen by recipient
-    case failed(reason: String)
-    case partiallyDelivered(reached: Int, total: Int)  // For rooms
-    
-    var displayText: String {
-        switch self {
-        case .sending:
-            return "Sending..."
-        case .sent:
-            return "Sent"
-        case .delivered(let nickname, _):
-            return "Delivered to \(nickname)"
-        case .read(let nickname, _):
-            return "Read by \(nickname)"
-        case .failed(let reason):
-            return "Failed: \(reason)"
-        case .partiallyDelivered(let reached, let total):
-            return "Delivered to \(reached)/\(total)"
-        }
-    }
-}
-
 // MARK: - Delegate Protocol
 
 protocol BitchatDelegate: AnyObject {

bitchat/Services/BLE/BLEAnnounceHandlingPolicy.swift

@@ -0,0 +1,116 @@
+import BitFoundation
+import Foundation
+
+struct BLEAnnouncePreflightAcceptance {
+    let announcement: AnnouncementPacket
+    let derivedPeerID: PeerID
+}
+
+enum BLEAnnouncePreflightRejection: Equatable {
+    case malformed
+    case senderMismatch(derivedPeerID: PeerID)
+    case selfAnnounce
+    case stale(ageSeconds: Double)
+}
+
+enum BLEAnnouncePreflightDecision {
+    case accept(BLEAnnouncePreflightAcceptance)
+    case reject(BLEAnnouncePreflightRejection)
+}
+
+enum BLEAnnouncePreflightPolicy {
+    static func evaluate(
+        packet: BitchatPacket,
+        from peerID: PeerID,
+        localPeerID: PeerID,
+        now: Date
+    ) -> BLEAnnouncePreflightDecision {
+        guard let announcement = AnnouncementPacket.decode(from: packet.payload) else {
+            return .reject(.malformed)
+        }
+
+        let derivedPeerID = PeerID(publicKey: announcement.noisePublicKey)
+        guard derivedPeerID == peerID else {
+            return .reject(.senderMismatch(derivedPeerID: derivedPeerID))
+        }
+
+        guard peerID != localPeerID else {
+            return .reject(.selfAnnounce)
+        }
+
+        guard !BLEPacketFreshnessPolicy.isStale(timestampMilliseconds: packet.timestamp, now: now) else {
+            return .reject(.stale(ageSeconds: BLEPacketFreshnessPolicy.ageSeconds(
+                timestampMilliseconds: packet.timestamp,
+                now: now
+            )))
+        }
+
+        return .accept(BLEAnnouncePreflightAcceptance(
+            announcement: announcement,
+            derivedPeerID: derivedPeerID
+        ))
+    }
+}
+
+enum BLEAnnounceTrustRejection: Equatable {
+    case missingSignature
+    case invalidSignature
+    case keyMismatch
+}
+
+enum BLEAnnounceTrustDecision: Equatable {
+    case verified
+    case reject(BLEAnnounceTrustRejection)
+
+    var isVerified: Bool {
+        self == .verified
+    }
+}
+
+enum BLEAnnounceTrustPolicy {
+    static func evaluate(
+        hasSignature: Bool,
+        signatureValid: Bool,
+        existingNoisePublicKey: Data?,
+        announcedNoisePublicKey: Data
+    ) -> BLEAnnounceTrustDecision {
+        if let existingNoisePublicKey, existingNoisePublicKey != announcedNoisePublicKey {
+            return .reject(.keyMismatch)
+        }
+
+        guard hasSignature else {
+            return .reject(.missingSignature)
+        }
+
+        guard signatureValid else {
+            return .reject(.invalidSignature)
+        }
+
+        return .verified
+    }
+}
+
+struct BLEAnnounceResponsePlan: Equatable {
+    let shouldNotifyPeerConnected: Bool
+    let shouldScheduleInitialSync: Bool
+    let shouldSendAnnounceBack: Bool
+    let shouldScheduleAfterglow: Bool
+}
+
+enum BLEAnnounceResponsePolicy {
+    static func plan(
+        isDirectAnnounce: Bool,
+        isNewPeer: Bool,
+        isReconnectedPeer: Bool,
+        shouldSendAnnounceBack: Bool
+    ) -> BLEAnnounceResponsePlan {
+        let shouldNotifyPeerConnected = isDirectAnnounce && (isNewPeer || isReconnectedPeer)
+
+        return BLEAnnounceResponsePlan(
+            shouldNotifyPeerConnected: shouldNotifyPeerConnected,
+            shouldScheduleInitialSync: shouldNotifyPeerConnected,
+            shouldSendAnnounceBack: shouldSendAnnounceBack,
+            shouldScheduleAfterglow: isNewPeer
+        )
+    }
+}

bitchat/Services/BLE/BLEAnnounceThrottle.swift

@@ -0,0 +1,31 @@
+import Foundation
+
+struct BLEAnnounceThrottle {
+    private var lastSent: Date
+    private let normalMinimumInterval: TimeInterval
+    private let forcedMinimumInterval: TimeInterval
+
+    init(
+        lastSent: Date = .distantPast,
+        normalMinimumInterval: TimeInterval = TransportConfig.bleAnnounceMinInterval,
+        forcedMinimumInterval: TimeInterval = TransportConfig.bleForceAnnounceMinIntervalSeconds
+    ) {
+        self.lastSent = lastSent
+        self.normalMinimumInterval = normalMinimumInterval
+        self.forcedMinimumInterval = forcedMinimumInterval
+    }
+
+    func elapsed(since now: Date) -> TimeInterval {
+        now.timeIntervalSince(lastSent)
+    }
+
+    mutating func shouldSend(force: Bool, now: Date) -> Bool {
+        let minimumInterval = force ? forcedMinimumInterval : normalMinimumInterval
+        guard elapsed(since: now) >= minimumInterval else {
+            return false
+        }
+
+        lastSent = now
+        return true
+    }
+}

bitchat/Services/BLE/BLEConnectionScheduler.swift

@@ -0,0 +1,271 @@
+import Foundation
+
+struct BLEConnectionCandidate<Peripheral> {
+    let peripheral: Peripheral
+    let peripheralID: String
+    let rssi: Int
+    let name: String
+    let isConnectable: Bool
+    let discoveredAt: Date
+}
+
+struct BLEExistingConnectionState {
+    let isConnecting: Bool
+    let isConnected: Bool
+    let lastConnectionAttempt: Date?
+}
+
+enum BLEPeripheralConnectionState {
+    case disconnected
+    case connecting
+    case connected
+}
+
+enum BLEDiscoveryDecision: Equatable {
+    case ignore
+    case queued
+    case scheduleRetry(after: TimeInterval)
+    case cancelStaleConnection
+    case connectNow
+}
+
+enum BLEConnectionQueueDecision<Peripheral> {
+    case none
+    case retryAfter(TimeInterval)
+    case connect(BLEConnectionCandidate<Peripheral>)
+}
+
+final class BLEConnectionScheduler<Peripheral> {
+    private let maxCentralLinks: Int
+    private let connectRateLimitInterval: TimeInterval
+    private let candidateCap: Int
+    private let weakLinkCooldownSeconds: TimeInterval
+    private let weakLinkRSSICutoff: Int
+    private let recentTimeoutWindowSeconds: TimeInterval
+    private let recentTimeoutCountThreshold: Int
+
+    private var lastGlobalConnectAttempt: Date = .distantPast
+    private var candidates: [BLEConnectionCandidate<Peripheral>] = []
+    private var failureCounts: [String: Int] = [:]
+    private var recentConnectTimeouts: [String: Date] = [:]
+    private var lastIsolatedAt: Date?
+
+    private let initialDynamicRSSIThreshold: Int
+    private(set) var dynamicRSSIThreshold: Int
+
+    var candidateCount: Int {
+        candidates.count
+    }
+
+    init(
+        maxCentralLinks: Int = TransportConfig.bleMaxCentralLinks,
+        connectRateLimitInterval: TimeInterval = TransportConfig.bleConnectRateLimitInterval,
+        candidateCap: Int = TransportConfig.bleConnectionCandidatesMax,
+        weakLinkCooldownSeconds: TimeInterval = TransportConfig.bleWeakLinkCooldownSeconds,
+        weakLinkRSSICutoff: Int = TransportConfig.bleWeakLinkRSSICutoff,
+        recentTimeoutWindowSeconds: TimeInterval = TransportConfig.bleRecentTimeoutWindowSeconds,
+        recentTimeoutCountThreshold: Int = TransportConfig.bleRecentTimeoutCountThreshold,
+        dynamicRSSIThreshold: Int = TransportConfig.bleDynamicRSSIThresholdDefault
+    ) {
+        self.maxCentralLinks = maxCentralLinks
+        self.connectRateLimitInterval = connectRateLimitInterval
+        self.candidateCap = candidateCap
+        self.weakLinkCooldownSeconds = weakLinkCooldownSeconds
+        self.weakLinkRSSICutoff = weakLinkRSSICutoff
+        self.recentTimeoutWindowSeconds = recentTimeoutWindowSeconds
+        self.recentTimeoutCountThreshold = recentTimeoutCountThreshold
+        self.initialDynamicRSSIThreshold = dynamicRSSIThreshold
+        self.dynamicRSSIThreshold = dynamicRSSIThreshold
+    }
+
+    func handleDiscovery(
+        _ candidate: BLEConnectionCandidate<Peripheral>,
+        connectedOrConnectingCount: Int,
+        existingState: BLEExistingConnectionState?,
+        peripheralState: BLEPeripheralConnectionState,
+        now: Date
+    ) -> BLEDiscoveryDecision {
+        guard candidate.isConnectable else { return .ignore }
+
+        if candidate.rssi <= dynamicRSSIThreshold {
+            enqueue(candidate)
+            return .queued
+        }
+
+        if connectedOrConnectingCount >= maxCentralLinks {
+            enqueue(candidate)
+            return .queued
+        }
+
+        if let retryDelay = rateLimitRetryDelay(now: now) {
+            enqueue(candidate)
+            return .scheduleRetry(after: retryDelay)
+        }
+
+        if let existingState {
+            if existingState.isConnected || existingState.isConnecting {
+                return .ignore
+            }
+
+            if let lastAttempt = existingState.lastConnectionAttempt,
+               now.timeIntervalSince(lastAttempt) < 2.0 {
+                return .ignore
+            }
+        }
+
+        if let lastTimeout = recentConnectTimeouts[candidate.peripheralID],
+           now.timeIntervalSince(lastTimeout) < 15 {
+            return .ignore
+        }
+
+        switch peripheralState {
+        case .disconnected:
+            return .connectNow
+        case .connecting, .connected:
+            return .cancelStaleConnection
+        }
+    }
+
+    func enqueue(_ candidate: BLEConnectionCandidate<Peripheral>) {
+        if let existingIndex = candidates.firstIndex(where: { $0.peripheralID == candidate.peripheralID }) {
+            candidates[existingIndex] = candidate
+        } else {
+            candidates.append(candidate)
+        }
+
+        candidates.sort {
+            if $0.rssi != $1.rssi { return $0.rssi > $1.rssi }
+            return $0.discoveredAt < $1.discoveredAt
+        }
+        if candidates.count > candidateCap {
+            candidates.removeLast(candidates.count - candidateCap)
+        }
+    }
+
+    func nextCandidate(
+        connectedOrConnectingCount: Int,
+        isAlreadyConnectingOrConnected: (String) -> Bool,
+        now: Date
+    ) -> BLEConnectionQueueDecision<Peripheral> {
+        guard connectedOrConnectingCount < maxCentralLinks else { return .none }
+
+        if let retryDelay = rateLimitRetryDelay(now: now) {
+            return .retryAfter(retryDelay)
+        }
+
+        while !candidates.isEmpty {
+            candidates.sort { score($0, now: now) > score($1, now: now) }
+            let candidate = candidates.removeFirst()
+            guard candidate.isConnectable else { continue }
+
+            if let delay = weakLinkRetryDelay(for: candidate, now: now) {
+                enqueue(candidate)
+                return .retryAfter(delay)
+            }
+
+            if isAlreadyConnectingOrConnected(candidate.peripheralID) {
+                continue
+            }
+
+            return .connect(candidate)
+        }
+
+        return .none
+    }
+
+    func recordConnectionAttempt(at now: Date) {
+        lastGlobalConnectAttempt = now
+    }
+
+    func recordConnectionSuccess(peripheralID: String) {
+        failureCounts[peripheralID] = 0
+        recentConnectTimeouts.removeValue(forKey: peripheralID)
+    }
+
+    func recordConnectionFailure(peripheralID: String) {
+        failureCounts[peripheralID, default: 0] += 1
+    }
+
+    func recordDisconnectError(peripheralID: String, at now: Date) {
+        recentConnectTimeouts[peripheralID] = now
+    }
+
+    func recordConnectionTimeout(peripheralID: String, at now: Date) {
+        recentConnectTimeouts[peripheralID] = now
+        recordConnectionFailure(peripheralID: peripheralID)
+    }
+
+    func pruneConnectionTimeouts(before cutoff: Date) {
+        recentConnectTimeouts = recentConnectTimeouts.filter { $0.value >= cutoff }
+    }
+
+    func reset() {
+        lastGlobalConnectAttempt = .distantPast
+        candidates.removeAll()
+        failureCounts.removeAll()
+        recentConnectTimeouts.removeAll()
+        lastIsolatedAt = nil
+        dynamicRSSIThreshold = initialDynamicRSSIThreshold
+    }
+
+    @discardableResult
+    func updateRSSIThreshold(
+        connectedCount: Int,
+        connectedOrConnectingLinkCount: Int,
+        now: Date
+    ) -> Int {
+        if connectedCount == 0 {
+            if lastIsolatedAt == nil { lastIsolatedAt = now }
+            let isolatedAt = lastIsolatedAt ?? now
+            let elapsed = now.timeIntervalSince(isolatedAt)
+            dynamicRSSIThreshold = elapsed > TransportConfig.bleIsolationRelaxThresholdSeconds
+                ? TransportConfig.bleRSSIIsolatedRelaxed
+                : TransportConfig.bleRSSIIsolatedBase
+            return dynamicRSSIThreshold
+        }
+
+        lastIsolatedAt = nil
+        var threshold = TransportConfig.bleDynamicRSSIThresholdDefault
+        if connectedOrConnectingLinkCount >= maxCentralLinks || candidates.count >= candidateCap {
+            threshold = TransportConfig.bleRSSIConnectedThreshold
+        }
+
+        let recentTimeouts = recentConnectTimeouts.filter {
+            now.timeIntervalSince($0.value) < recentTimeoutWindowSeconds
+        }.count
+        if recentTimeouts >= recentTimeoutCountThreshold {
+            threshold = max(threshold, TransportConfig.bleRSSIHighTimeoutThreshold)
+        }
+
+        dynamicRSSIThreshold = threshold
+        return threshold
+    }
+
+    private func rateLimitRetryDelay(now: Date) -> TimeInterval? {
+        let elapsed = now.timeIntervalSince(lastGlobalConnectAttempt)
+        guard elapsed < connectRateLimitInterval else { return nil }
+        return connectRateLimitInterval - elapsed + 0.05
+    }
+
+    private func weakLinkRetryDelay(
+        for candidate: BLEConnectionCandidate<Peripheral>,
+        now: Date
+    ) -> TimeInterval? {
+        guard let lastTimeout = recentConnectTimeouts[candidate.peripheralID] else { return nil }
+        let elapsed = now.timeIntervalSince(lastTimeout)
+        guard elapsed < weakLinkCooldownSeconds && candidate.rssi <= weakLinkRSSICutoff else { return nil }
+        let remaining = weakLinkCooldownSeconds - elapsed
+        return min(max(2.0, remaining), 15.0)
+    }
+
+    private func score(_ candidate: BLEConnectionCandidate<Peripheral>, now: Date) -> Int {
+        let failures = failureCounts[candidate.peripheralID] ?? 0
+        let penalty = min(20, 1 << min(4, failures))
+        let timeoutBias = recentConnectTimeouts[candidate.peripheralID].map {
+            now.timeIntervalSince($0) < 60 ? 10 : 0
+        } ?? 0
+        let base = (candidate.isConnectable ? 1000 : 0) + (candidate.rssi + 100) * 2
+        let recency = -Int(now.timeIntervalSince(candidate.discoveredAt) * 10)
+        return base + recency - penalty - timeoutBias
+    }
+}

bitchat/Services/BLE/BLEDirectedRelaySpool.swift

@@ -0,0 +1,71 @@
+import BitFoundation
+import Foundation
+
+struct BLEDirectedRelaySpoolEntry {
+    let recipient: PeerID
+    let packet: BitchatPacket
+}
+
+struct BLEDirectedRelaySpool {
+    private struct StoredPacket {
+        let packet: BitchatPacket
+        let enqueuedAt: Date
+    }
+
+    private var packetsByRecipient: [PeerID: [String: StoredPacket]] = [:]
+
+    var isEmpty: Bool {
+        packetsByRecipient.isEmpty
+    }
+
+    var count: Int {
+        packetsByRecipient.values.reduce(0) { $0 + $1.count }
+    }
+
+    @discardableResult
+    mutating func enqueue(
+        packet: BitchatPacket,
+        recipient: PeerID,
+        messageID: String,
+        enqueuedAt: Date
+    ) -> Bool {
+        var packets = packetsByRecipient[recipient] ?? [:]
+        guard packets[messageID] == nil else {
+            return false
+        }
+
+        packets[messageID] = StoredPacket(packet: packet, enqueuedAt: enqueuedAt)
+        packetsByRecipient[recipient] = packets
+        return true
+    }
+
+    mutating func drainUnexpired(now: Date, window: TimeInterval) -> [BLEDirectedRelaySpoolEntry] {
+        var entries: [BLEDirectedRelaySpoolEntry] = []
+
+        for (recipient, packets) in packetsByRecipient {
+            for stored in packets.values where now.timeIntervalSince(stored.enqueuedAt) <= window {
+                entries.append(BLEDirectedRelaySpoolEntry(recipient: recipient, packet: stored.packet))
+            }
+        }
+
+        packetsByRecipient.removeAll()
+        return entries
+    }
+
+    mutating func pruneExpired(now: Date, window: TimeInterval) {
+        guard !packetsByRecipient.isEmpty else { return }
+
+        var pruned: [PeerID: [String: StoredPacket]] = [:]
+        for (recipient, packets) in packetsByRecipient {
+            let freshPackets = packets.filter { now.timeIntervalSince($0.value.enqueuedAt) <= window }
+            if !freshPackets.isEmpty {
+                pruned[recipient] = freshPackets
+            }
+        }
+        packetsByRecipient = pruned
+    }
+
+    mutating func removeAll() {
+        packetsByRecipient.removeAll()
+    }
+}

bitchat/Services/BLE/BLEFanoutSelector.swift

@@ -0,0 +1,109 @@
+import BitFoundation
+import CryptoKit
+import Foundation
+
+struct BLEFanoutSelection: Equatable {
+    let peripheralIDs: Set<String>
+    let centralIDs: Set<String>
+}
+
+enum BLEFanoutSelector {
+    static func selectLinks(
+        peripheralIDs: [String],
+        centralIDs: [String],
+        ingressLink: BLEIngressLinkID?,
+        excludedLinks: Set<BLEIngressLinkID> = [],
+        directedPeerHint: PeerID?,
+        packetType: UInt8,
+        messageID: String
+    ) -> BLEFanoutSelection {
+        let allowed = allowedLinks(
+            peripheralIDs: peripheralIDs,
+            centralIDs: centralIDs,
+            ingressLink: ingressLink,
+            excludedLinks: excludedLinks
+        )
+
+        guard shouldSubset(packetType: packetType, directedPeerHint: directedPeerHint) else {
+            return BLEFanoutSelection(
+                peripheralIDs: Set(allowed.peripheralIDs),
+                centralIDs: Set(allowed.centralIDs)
+            )
+        }
+
+        return BLEFanoutSelection(
+            peripheralIDs: deterministicSubset(
+                ids: allowed.peripheralIDs,
+                k: subsetSize(for: allowed.peripheralIDs.count),
+                seed: messageID
+            ),
+            centralIDs: deterministicSubset(
+                ids: allowed.centralIDs,
+                k: subsetSize(for: allowed.centralIDs.count),
+                seed: messageID
+            )
+        )
+    }
+
+    private static func allowedLinks(
+        peripheralIDs: [String],
+        centralIDs: [String],
+        ingressLink: BLEIngressLinkID?,
+        excludedLinks: Set<BLEIngressLinkID>
+    ) -> (peripheralIDs: [String], centralIDs: [String]) {
+        var allowedPeripheralIDs = peripheralIDs
+        var allowedCentralIDs = centralIDs
+        var blockedLinks = excludedLinks
+
+        if let ingressLink {
+            blockedLinks.insert(ingressLink)
+        }
+
+        allowedPeripheralIDs.removeAll { blockedLinks.contains(.peripheral($0)) }
+        allowedCentralIDs.removeAll { blockedLinks.contains(.central($0)) }
+
+        return (allowedPeripheralIDs, allowedCentralIDs)
+    }
+
+    private static func shouldSubset(packetType: UInt8, directedPeerHint: PeerID?) -> Bool {
+        directedPeerHint == nil
+            && packetType != MessageType.fragment.rawValue
+            && packetType != MessageType.announce.rawValue
+            && packetType != MessageType.requestSync.rawValue
+    }
+
+    private static func subsetSize(for count: Int) -> Int {
+        guard count > 0 else { return 0 }
+        if count <= 2 { return count }
+
+        var value = count - 1
+        var bits = 0
+        while value > 0 {
+            value >>= 1
+            bits += 1
+        }
+        return min(count, max(1, bits + 1))
+    }
+
+    private static func deterministicSubset(ids: [String], k: Int, seed: String) -> Set<String> {
+        guard k > 0 && ids.count > k else { return Set(ids) }
+
+        var scored: [(score: [UInt8], id: String)] = []
+        for id in ids {
+            let data = (seed + "::" + id).data(using: .utf8) ?? Data()
+            let digest = Array(SHA256.hash(data: data))
+            scored.append((digest, id))
+        }
+
+        scored.sort { lhs, rhs in
+            for index in 0..<min(lhs.score.count, rhs.score.count) {
+                if lhs.score[index] != rhs.score[index] {
+                    return lhs.score[index] < rhs.score[index]
+                }
+            }
+            return lhs.id < rhs.id
+        }
+
+        return Set(scored.prefix(k).map(\.id))
+    }
+}

bitchat/Services/BLE/BLEFileTransferPolicy.swift

@@ -0,0 +1,71 @@
+import BitFoundation
+import Foundation
+
+struct BLEFileTransferDeliveryPlan: Equatable {
+    let isPrivateMessage: Bool
+    let shouldTrackForSync: Bool
+}
+
+enum BLEFileTransferPolicy {
+    static func isSelfEcho(packet: BitchatPacket, from peerID: PeerID, localPeerID: PeerID) -> Bool {
+        peerID == localPeerID && packet.ttl != 0
+    }
+
+    static func deliveryPlan(packet: BitchatPacket, localPeerID: PeerID) -> BLEFileTransferDeliveryPlan? {
+        guard let recipientID = packet.recipientID else {
+            return BLEFileTransferDeliveryPlan(isPrivateMessage: false, shouldTrackForSync: true)
+        }
+
+        let isBroadcast = recipientID.allSatisfy { $0 == 0xFF }
+        if isBroadcast {
+            return BLEFileTransferDeliveryPlan(isPrivateMessage: false, shouldTrackForSync: true)
+        }
+
+        guard PeerID(hexData: recipientID) == localPeerID else {
+            return nil
+        }
+
+        return BLEFileTransferDeliveryPlan(isPrivateMessage: true, shouldTrackForSync: false)
+    }
+}
+
+struct BLEIncomingFileAcceptance {
+    let filePacket: BitchatFilePacket
+    let mime: MimeType
+}
+
+enum BLEIncomingFileRejection: Error, Equatable {
+    case malformedPayload
+    case payloadTooLarge(bytes: Int)
+    case unsupportedMime(mimeType: String?, bytes: Int)
+    case magicMismatch(mime: MimeType, bytes: Int, prefixHex: String)
+}
+
+enum BLEIncomingFileValidator {
+    static func validate(payload: Data) -> Result<BLEIncomingFileAcceptance, BLEIncomingFileRejection> {
+        guard let filePacket = BitchatFilePacket.decode(payload) else {
+            return .failure(.malformedPayload)
+        }
+
+        guard FileTransferLimits.isValidPayload(filePacket.content.count) else {
+            return .failure(.payloadTooLarge(bytes: filePacket.content.count))
+        }
+
+        guard let mime = MimeType(filePacket.mimeType), mime.isAllowed else {
+            return .failure(.unsupportedMime(
+                mimeType: filePacket.mimeType,
+                bytes: filePacket.content.count
+            ))
+        }
+
+        guard mime.matches(data: filePacket.content) else {
+            return .failure(.magicMismatch(
+                mime: mime,
+                bytes: filePacket.content.count,
+                prefixHex: filePacket.content.prefix(20).map { String(format: "%02x", $0) }.joined(separator: " ")
+            ))
+        }
+
+        return .success(BLEIncomingFileAcceptance(filePacket: filePacket, mime: mime))
+    }
+}

bitchat/Services/BLE/BLEFragmentAssemblyBuffer.swift

@@ -0,0 +1,153 @@
+import BitFoundation
+import Foundation
+
+struct BLEFragmentKey: Hashable, Equatable {
+    let sender: UInt64
+    let id: UInt64
+}
+
+struct BLEFragmentHeader: Equatable {
+    let key: BLEFragmentKey
+    let index: Int
+    let total: Int
+    let originalType: UInt8
+    let fragmentData: Data
+    let isBroadcastFragment: Bool
+
+    var idLogString: String {
+        String(format: "%016llx", key.id)
+    }
+
+    init?(packet: BitchatPacket) {
+        // Minimum header: 8 bytes ID + 2 index + 2 total + 1 type.
+        guard packet.payload.count >= 13 else { return nil }
+
+        var senderU64: UInt64 = 0
+        for byte in packet.senderID.prefix(8) {
+            senderU64 = (senderU64 << 8) | UInt64(byte)
+        }
+
+        var fragmentU64: UInt64 = 0
+        for byte in packet.payload.prefix(8) {
+            fragmentU64 = (fragmentU64 << 8) | UInt64(byte)
+        }
+
+        let index = Int((UInt16(packet.payload[8]) << 8) | UInt16(packet.payload[9]))
+        let total = Int((UInt16(packet.payload[10]) << 8) | UInt16(packet.payload[11]))
+
+        guard total > 0 && total <= 10_000 && index >= 0 && index < total else {
+            return nil
+        }
+
+        let isBroadcastFragment: Bool = {
+            guard let recipient = packet.recipientID else { return true }
+            return recipient.count == 8 && recipient.allSatisfy { $0 == 0xFF }
+        }()
+
+        self.key = BLEFragmentKey(sender: senderU64, id: fragmentU64)
+        self.index = index
+        self.total = total
+        self.originalType = packet.payload[12]
+        self.fragmentData = Data(packet.payload.suffix(from: 13))
+        self.isBroadcastFragment = isBroadcastFragment
+    }
+}
+
+struct BLEFragmentAssemblyBuffer {
+    enum AppendResult: Equatable {
+        case stored(header: BLEFragmentHeader, started: Bool)
+        case complete(header: BLEFragmentHeader, reassembledData: Data, started: Bool)
+        case oversized(header: BLEFragmentHeader, projectedSize: Int, limit: Int, started: Bool)
+    }
+
+    private struct Metadata {
+        let type: UInt8
+        let total: Int
+        let timestamp: Date
+    }
+
+    private var fragmentsByKey: [BLEFragmentKey: [Int: Data]] = [:]
+    private var metadataByKey: [BLEFragmentKey: Metadata] = [:]
+
+    mutating func removeAll() {
+        fragmentsByKey.removeAll()
+        metadataByKey.removeAll()
+    }
+
+    @discardableResult
+    mutating func removeExpired(before cutoff: Date) -> Int {
+        let expiredKeys = metadataByKey
+            .filter { $0.value.timestamp < cutoff }
+            .map(\.key)
+
+        for key in expiredKeys {
+            fragmentsByKey.removeValue(forKey: key)
+            metadataByKey.removeValue(forKey: key)
+        }
+
+        return expiredKeys.count
+    }
+
+    mutating func append(
+        _ header: BLEFragmentHeader,
+        maxInFlightAssemblies: Int,
+        now: Date = Date()
+    ) -> AppendResult {
+        let started = startAssemblyIfNeeded(for: header, maxInFlightAssemblies: maxInFlightAssemblies, now: now)
+
+        let currentSize = fragmentsByKey[header.key]?.values.reduce(0) { $0 + $1.count } ?? 0
+        let limit = Self.assemblyLimit(for: header.originalType)
+        let projectedSize = currentSize + header.fragmentData.count
+
+        guard projectedSize <= limit else {
+            fragmentsByKey.removeValue(forKey: header.key)
+            metadataByKey.removeValue(forKey: header.key)
+            return .oversized(header: header, projectedSize: projectedSize, limit: limit, started: started)
+        }
+
+        fragmentsByKey[header.key]?[header.index] = header.fragmentData
+
+        guard let fragments = fragmentsByKey[header.key],
+              fragments.count == header.total else {
+            return .stored(header: header, started: started)
+        }
+
+        let reassembled = (0..<header.total).reduce(into: Data()) { data, index in
+            if let fragment = fragments[index] {
+                data.append(fragment)
+            }
+        }
+
+        fragmentsByKey.removeValue(forKey: header.key)
+        metadataByKey.removeValue(forKey: header.key)
+
+        return .complete(header: header, reassembledData: reassembled, started: started)
+    }
+
+    private mutating func startAssemblyIfNeeded(
+        for header: BLEFragmentHeader,
+        maxInFlightAssemblies: Int,
+        now: Date
+    ) -> Bool {
+        guard fragmentsByKey[header.key] == nil else { return false }
+
+        if fragmentsByKey.count >= maxInFlightAssemblies,
+           let oldest = metadataByKey.min(by: { $0.value.timestamp < $1.value.timestamp })?.key {
+            fragmentsByKey.removeValue(forKey: oldest)
+            metadataByKey.removeValue(forKey: oldest)
+        }
+
+        fragmentsByKey[header.key] = [:]
+        metadataByKey[header.key] = Metadata(type: header.originalType, total: header.total, timestamp: now)
+        return true
+    }
+
+    private static func assemblyLimit(for originalType: UInt8) -> Int {
+        if originalType == MessageType.fileTransfer.rawValue {
+            // Allow headroom for TLV metadata and binary framing overhead.
+            return FileTransferLimits.maxFramedFileBytes
+        }
+
+        return FileTransferLimits.maxPayloadBytes
+    }
+}

bitchat/Services/BLE/BLEInboundWriteBuffer.swift

@@ -0,0 +1,70 @@
+import BitFoundation
+import Foundation
+
+struct BLEInboundWriteChunk: Equatable {
+    let offset: Int
+    let data: Data
+}
+
+struct BLEInboundWriteAppendMetadata: Equatable {
+    let accumulatedBytes: Int
+    let appendedBytes: Int
+    let offsets: [Int]
+    let packetType: UInt8?
+}
+
+struct BLEInboundWriteBuffer {
+    enum AppendResult {
+        case decoded(packet: BitchatPacket, metadata: BLEInboundWriteAppendMetadata)
+        case waiting(metadata: BLEInboundWriteAppendMetadata)
+        case oversized(metadata: BLEInboundWriteAppendMetadata)
+    }
+
+    private var buffersByCentralID: [String: Data] = [:]
+
+    mutating func removeAll() {
+        buffersByCentralID.removeAll()
+    }
+
+    mutating func append(
+        chunks: [BLEInboundWriteChunk],
+        for centralID: String,
+        capBytes: Int
+    ) -> AppendResult {
+        var combined = buffersByCentralID[centralID] ?? Data()
+        var appendedBytes = 0
+        var offsets: [Int] = []
+
+        for chunk in chunks where !chunk.data.isEmpty {
+            offsets.append(chunk.offset)
+            let end = chunk.offset + chunk.data.count
+
+            if combined.count < end {
+                combined.append(Data(repeating: 0, count: end - combined.count))
+            }
+
+            combined.replaceSubrange(chunk.offset..<end, with: chunk.data)
+            appendedBytes += chunk.data.count
+        }
+
+        let metadata = BLEInboundWriteAppendMetadata(
+            accumulatedBytes: combined.count,
+            appendedBytes: appendedBytes,
+            offsets: offsets,
+            packetType: combined.count >= 2 ? combined[1] : nil
+        )
+
+        if let packet = BinaryProtocol.decode(combined) {
+            buffersByCentralID.removeValue(forKey: centralID)
+            return .decoded(packet: packet, metadata: metadata)
+        }
+
+        guard combined.count <= capBytes else {
+            buffersByCentralID.removeValue(forKey: centralID)
+            return .oversized(metadata: metadata)
+        }
+
+        buffersByCentralID[centralID] = combined
+        return .waiting(metadata: metadata)
+    }
+}

bitchat/Services/BLE/BLEIncomingFileStore.swift

@@ -0,0 +1,168 @@
+import BitLogger
+import BitFoundation
+import Foundation
+
+struct BLEIncomingFileStore {
+    private static let quotaBytes: Int64 = 100 * 1024 * 1024
+
+    private let fileManager: FileManager
+    private let baseDirectory: URL?
+    private let dateProvider: () -> Date
+
+    init(fileManager: FileManager = .default, baseDirectory: URL? = nil, dateProvider: @escaping () -> Date = Date.init) {
+        self.fileManager = fileManager
+        self.baseDirectory = baseDirectory
+        self.dateProvider = dateProvider
+    }
+
+    func save(
+        data: Data,
+        preferredName: String?,
+        subdirectory: String,
+        fallbackExtension: String?,
+        defaultPrefix: String
+    ) -> URL? {
+        do {
+            let base = try filesDirectory().appendingPathComponent(subdirectory, isDirectory: true)
+            try fileManager.createDirectory(at: base, withIntermediateDirectories: true, attributes: nil)
+            let sanitized = sanitizedFileName(
+                preferredName,
+                defaultName: "\(defaultPrefix)_\(Self.timestampString(from: dateProvider()))",
+                fallbackExtension: fallbackExtension
+            )
+            let destination = uniqueFileURL(in: base, fileName: sanitized)
+            try data.write(to: destination, options: .atomic)
+            return destination
+        } catch {
+            SecureLogger.error("❌ Failed to persist incoming media: \(error)", category: .session)
+            return nil
+        }
+    }
+
+    func enforceQuota(reservingBytes: Int) {
+        do {
+            let base = try filesDirectory()
+            let incomingDirs = [
+                base.appendingPathComponent("voicenotes/incoming", isDirectory: true),
+                base.appendingPathComponent("images/incoming", isDirectory: true),
+                base.appendingPathComponent("files/incoming", isDirectory: true)
+            ]
+            var allFiles: [(url: URL, size: Int64, modified: Date)] = []
+
+            for dir in incomingDirs where fileManager.fileExists(atPath: dir.path) {
+                guard let contents = try? fileManager.contentsOfDirectory(
+                    at: dir,
+                    includingPropertiesForKeys: [.fileSizeKey, .contentModificationDateKey],
+                    options: [.skipsHiddenFiles]
+                ) else { continue }
+
+                for fileURL in contents {
+                    guard let attrs = try? fileURL.resourceValues(forKeys: [.fileSizeKey, .contentModificationDateKey]),
+                          let size = attrs.fileSize,
+                          let modified = attrs.contentModificationDate else { continue }
+                    allFiles.append((url: fileURL, size: Int64(size), modified: modified))
+                }
+            }
+
+            let currentUsage = allFiles.reduce(0) { $0 + $1.size }
+            let targetUsage = Self.quotaBytes - Int64(reservingBytes)
+            guard currentUsage > targetUsage else { return }
+
+            let needToFree = currentUsage - targetUsage
+            var freedSpace: Int64 = 0
+            for file in allFiles.sorted(by: { $0.modified < $1.modified }) {
+                guard freedSpace < needToFree else { break }
+                do {
+                    try fileManager.removeItem(at: file.url)
+                    freedSpace += file.size
+                    SecureLogger.debug("🗑️ BCH-01-002: Deleted old incoming file to free space: \(file.url.lastPathComponent)", category: .security)
+                } catch {
+                    SecureLogger.warning("⚠️ Failed to delete old file for quota: \(error)", category: .security)
+                }
+            }
+
+            if freedSpace > 0 {
+                SecureLogger.info("📊 BCH-01-002: Freed \(ByteCountFormatter.string(fromByteCount: freedSpace, countStyle: .file)) to stay within incoming files quota", category: .security)
+            }
+        } catch {
+            SecureLogger.warning("⚠️ Could not enforce storage quota: \(error)", category: .security)
+        }
+    }
+
+    private func filesDirectory() throws -> URL {
+        let root = try baseDirectory ?? fileManager.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        )
+        let filesDir = root.appendingPathComponent("files", isDirectory: true)
+        try fileManager.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
+        return filesDir
+    }
+
+    private func sanitizedFileName(_ name: String?, defaultName: String, fallbackExtension: String?) -> String {
+        var candidate = (name ?? "")
+            .replacingOccurrences(of: "\0", with: "")
+            .precomposedStringWithCanonicalMapping
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "\\", with: "_")
+
+        let invalid = CharacterSet(charactersIn: "<>:\"|?*\0").union(.controlCharacters)
+        candidate = candidate.components(separatedBy: invalid).joined(separator: "_").trimmed
+        if candidate.isEmpty { candidate = defaultName }
+        if candidate.hasPrefix(".") { candidate = "_" + candidate }
+
+        if candidate.count > 120 {
+            let ext = (candidate as NSString).pathExtension
+            let base = (candidate as NSString).deletingPathExtension
+            candidate = ext.isEmpty
+                ? String(candidate.prefix(120))
+                : String(base.prefix(max(10, 120 - ext.count - 1))) + "." + ext
+        }
+
+        if let fallbackExtension, (candidate as NSString).pathExtension.isEmpty {
+            candidate += ".\(fallbackExtension)"
+        }
+
+        return candidate.isEmpty ? defaultName : candidate
+    }
+
+    private func uniqueFileURL(in directory: URL, fileName: String) -> URL {
+        let directoryPath = directory.standardizedFileURL.path
+        func isInsideDirectory(_ url: URL) -> Bool {
+            url.standardizedFileURL.path.hasPrefix(directoryPath + "/")
+        }
+
+        var candidate = directory.appendingPathComponent(fileName)
+        guard isInsideDirectory(candidate) else {
+            SecureLogger.warning("⚠️ Path traversal blocked: \(fileName)", category: .security)
+            return directory.appendingPathComponent("blocked_\(UUID().uuidString)")
+        }
+
+        if !fileManager.fileExists(atPath: candidate.path) {
+            return candidate
+        }
+
+        let baseName = (fileName as NSString).deletingPathExtension
+        let ext = (fileName as NSString).pathExtension
+        for counter in 1..<100 {
+            let newName = ext.isEmpty ? "\(baseName) (\(counter))" : "\(baseName) (\(counter)).\(ext)"
+            candidate = directory.appendingPathComponent(newName)
+            guard isInsideDirectory(candidate) else {
+                return directory.appendingPathComponent("blocked_\(UUID().uuidString)")
+            }
+            if !fileManager.fileExists(atPath: candidate.path) {
+                return candidate
+            }
+        }
+
+        return directory.appendingPathComponent("\(baseName)_\(UUID().uuidString).\(ext.isEmpty ? "dat" : ext)")
+    }
+
+    private static func timestampString(from date: Date) -> String {
+        let formatter = DateFormatter()
+        formatter.dateFormat = "yyyyMMdd_HHmmss"
+        return formatter.string(from: date)
+    }
+}

bitchat/Services/BLE/BLEIngressLinkRegistry.swift

@@ -0,0 +1,108 @@
+import BitFoundation
+import Foundation
+
+enum BLEIngressLinkID: Hashable, Equatable {
+    case peripheral(String)
+    case central(String)
+}
+
+struct BLEIngressPacketContext: Equatable {
+    let receivedFromPeerID: PeerID
+    let validationPeerID: PeerID
+}
+
+struct BLEIngressLinkRecord: Equatable {
+    let link: BLEIngressLinkID
+    let peerID: PeerID
+    let timestamp: Date
+}
+
+enum BLEIngressRejection: Error, Equatable {
+    case selfLoopback(packetType: UInt8)
+    case directSenderMismatch(boundPeerID: PeerID, claimedSenderID: PeerID)
+}
+
+struct BLEIngressLinkRegistry {
+    private var ingressByMessageID: [String: BLEIngressLinkRecord] = [:]
+
+    var isEmpty: Bool {
+        ingressByMessageID.isEmpty
+    }
+
+    mutating func removeAll() {
+        ingressByMessageID.removeAll()
+    }
+
+    func record(for packet: BitchatPacket) -> BLEIngressLinkRecord? {
+        ingressByMessageID[Self.messageID(for: packet)]
+    }
+
+    func link(for packet: BitchatPacket) -> BLEIngressLinkID? {
+        record(for: packet)?.link
+    }
+
+    func peerID(for packet: BitchatPacket) -> PeerID? {
+        record(for: packet)?.peerID
+    }
+
+    mutating func recordIfNew(
+        _ packet: BitchatPacket,
+        link: BLEIngressLinkID,
+        peerID: PeerID,
+        now: Date = Date(),
+        lifetime: TimeInterval
+    ) -> Bool {
+        let messageID = Self.messageID(for: packet)
+        if let existing = ingressByMessageID[messageID],
+           now.timeIntervalSince(existing.timestamp) <= lifetime {
+            return false
+        }
+
+        ingressByMessageID[messageID] = BLEIngressLinkRecord(link: link, peerID: peerID, timestamp: now)
+        return true
+    }
+
+    mutating func prune(before cutoff: Date) {
+        ingressByMessageID = ingressByMessageID.filter { $0.value.timestamp >= cutoff }
+    }
+
+    static func packetContext(
+        for packet: BitchatPacket,
+        claimedSenderID: PeerID,
+        boundPeerID: PeerID?,
+        localPeerID: PeerID,
+        directAnnounceTTL: UInt8
+    ) -> Result<BLEIngressPacketContext, BLEIngressRejection> {
+        if claimedSenderID == localPeerID,
+           !isSelfAuthoredSyncResponse(packet) {
+            return .failure(.selfLoopback(packetType: packet.type))
+        }
+
+        if let boundPeerID,
+           boundPeerID != claimedSenderID,
+           requiresDirectSenderBinding(packet, directAnnounceTTL: directAnnounceTTL) {
+            return .failure(.directSenderMismatch(boundPeerID: boundPeerID, claimedSenderID: claimedSenderID))
+        }
+
+        let receivedFromPeerID = boundPeerID ?? claimedSenderID
+        let validationPeerID = packet.isRSR ? receivedFromPeerID : claimedSenderID
+        return .success(BLEIngressPacketContext(
+            receivedFromPeerID: receivedFromPeerID,
+            validationPeerID: validationPeerID
+        ))
+    }
+
+    static func messageID(for packet: BitchatPacket) -> String {
+        let senderID = packet.senderID.hexEncodedString()
+        let digestPrefix = packet.payload.sha256Hash().prefix(4).hexEncodedString()
+        return "\(senderID)-\(packet.timestamp)-\(packet.type)-\(digestPrefix)"
+    }
+
+    private static func requiresDirectSenderBinding(_ packet: BitchatPacket, directAnnounceTTL: UInt8) -> Bool {
+        packet.type == MessageType.announce.rawValue && packet.ttl == directAnnounceTTL
+    }
+
+    private static func isSelfAuthoredSyncResponse(_ packet: BitchatPacket) -> Bool {
+        packet.isRSR && packet.ttl == 0
+    }
+}

bitchat/Services/BLE/BLEIngressPacketGuard.swift

@@ -0,0 +1,76 @@
+import BitFoundation
+import Foundation
+
+enum BLEIngressPacketGuard {
+    enum Rejection: Error, Equatable {
+        case selfLoopback(packetType: UInt8)
+        case directSenderMismatch(boundPeerID: PeerID, claimedSenderID: PeerID)
+        case invalidRSR(peerID: PeerID)
+        case timestampSkew(peerID: PeerID, skewMs: UInt64, maxSkewMs: UInt64)
+    }
+
+    static func evaluate(
+        packet: BitchatPacket,
+        claimedSenderID: PeerID,
+        boundPeerID: PeerID?,
+        localPeerID: PeerID,
+        directAnnounceTTL: UInt8,
+        nowMs: UInt64 = UInt64(Date().timeIntervalSince1970 * 1000),
+        maxTimestampSkewMs: UInt64 = 120_000,
+        isValidSyncResponse: (PeerID) -> Bool
+    ) -> Result<BLEIngressPacketContext, Rejection> {
+        let contextResult = BLEIngressLinkRegistry.packetContext(
+            for: packet,
+            claimedSenderID: claimedSenderID,
+            boundPeerID: boundPeerID,
+            localPeerID: localPeerID,
+            directAnnounceTTL: directAnnounceTTL
+        )
+
+        let context: BLEIngressPacketContext
+        switch contextResult {
+        case .success(let acceptedContext):
+            context = acceptedContext
+        case .failure(.selfLoopback(let packetType)):
+            return .failure(.selfLoopback(packetType: packetType))
+        case .failure(.directSenderMismatch(let boundPeerID, let claimedSenderID)):
+            return .failure(.directSenderMismatch(boundPeerID: boundPeerID, claimedSenderID: claimedSenderID))
+        }
+
+        switch validatePayload(
+            packet,
+            from: context.validationPeerID,
+            nowMs: nowMs,
+            maxTimestampSkewMs: maxTimestampSkewMs,
+            isValidSyncResponse: isValidSyncResponse
+        ) {
+        case .success:
+            return .success(context)
+        case .failure(let rejection):
+            return .failure(rejection)
+        }
+    }
+
+    static func validatePayload(
+        _ packet: BitchatPacket,
+        from peerID: PeerID,
+        nowMs: UInt64 = UInt64(Date().timeIntervalSince1970 * 1000),
+        maxTimestampSkewMs: UInt64 = 120_000,
+        isValidSyncResponse: (PeerID) -> Bool
+    ) -> Result<Void, Rejection> {
+        if packet.isRSR {
+            guard isValidSyncResponse(peerID) else {
+                return .failure(.invalidRSR(peerID: peerID))
+            }
+            return .success(())
+        }
+
+        let packetTime = packet.timestamp
+        let skew = packetTime > nowMs ? packetTime - nowMs : nowMs - packetTime
+        guard skew <= maxTimestampSkewMs else {
+            return .failure(.timestampSkew(peerID: peerID, skewMs: skew, maxSkewMs: maxTimestampSkewMs))
+        }
+
+        return .success(())
+    }
+}

bitchat/Services/BLE/BLELinkStateStore.swift

@@ -0,0 +1,196 @@
+import BitFoundation
+import CoreBluetooth
+import Foundation
+
+struct BLEPeripheralLinkState {
+    let peripheral: CBPeripheral
+    var characteristic: CBCharacteristic?
+    var peerID: PeerID?
+    var isConnecting: Bool
+    var isConnected: Bool
+    var lastConnectionAttempt: Date?
+    var assembler: NotificationStreamAssembler
+}
+
+struct BLEDirectLinkState: Equatable {
+    let hasPeripheral: Bool
+    let hasCentral: Bool
+}
+
+struct BLESubscribedCentralSnapshot {
+    let centrals: [CBCentral]
+    let peerIDsByCentralUUID: [String: PeerID]
+
+    func central(for peerID: PeerID) -> CBCentral? {
+        centrals.first { peerIDsByCentralUUID[$0.identifier.uuidString] == peerID }
+    }
+}
+
+final class BLELinkStateStore {
+    private(set) var peripherals: [String: BLEPeripheralLinkState] = [:]
+    private(set) var peerToPeripheralUUID: [PeerID: String] = [:]
+    private(set) var subscribedCentrals: [CBCentral] = []
+    private(set) var centralToPeerID: [String: PeerID] = [:]
+
+    var peripheralStates: [BLEPeripheralLinkState] {
+        Array(peripherals.values)
+    }
+
+    var subscribedCentralSnapshot: BLESubscribedCentralSnapshot {
+        BLESubscribedCentralSnapshot(
+            centrals: subscribedCentrals,
+            peerIDsByCentralUUID: centralToPeerID
+        )
+    }
+
+    var subscribedCentralCount: Int {
+        subscribedCentrals.count
+    }
+
+    var connectedOrConnectingPeripheralCount: Int {
+        peripherals.values.filter { $0.isConnected || $0.isConnecting }.count
+    }
+
+    func state(forPeripheralID peripheralID: String) -> BLEPeripheralLinkState? {
+        peripherals[peripheralID]
+    }
+
+    func setPeripheralState(_ state: BLEPeripheralLinkState, for peripheralID: String) {
+        peripherals[peripheralID] = state
+    }
+
+    @discardableResult
+    func updatePeripheral(
+        _ peripheralID: String,
+        _ update: (inout BLEPeripheralLinkState) -> Void
+    ) -> BLEPeripheralLinkState? {
+        guard var state = peripherals[peripheralID] else { return nil }
+        update(&state)
+        peripherals[peripheralID] = state
+        return state
+    }
+
+    func beginConnecting(to peripheral: CBPeripheral, at date: Date) {
+        setPeripheralState(
+            BLEPeripheralLinkState(
+                peripheral: peripheral,
+                characteristic: nil,
+                peerID: nil,
+                isConnecting: true,
+                isConnected: false,
+                lastConnectionAttempt: date,
+                assembler: NotificationStreamAssembler()
+            ),
+            for: peripheral.identifier.uuidString
+        )
+    }
+
+    func markConnected(_ peripheral: CBPeripheral) {
+        let peripheralID = peripheral.identifier.uuidString
+        if updatePeripheral(peripheralID, {
+            $0.isConnecting = false
+            $0.isConnected = true
+        }) == nil {
+            setPeripheralState(
+                BLEPeripheralLinkState(
+                    peripheral: peripheral,
+                    characteristic: nil,
+                    peerID: nil,
+                    isConnecting: false,
+                    isConnected: true,
+                    lastConnectionAttempt: nil,
+                    assembler: NotificationStreamAssembler()
+                ),
+                for: peripheralID
+            )
+        }
+    }
+
+    func updateCharacteristic(_ characteristic: CBCharacteristic, forPeripheralID peripheralID: String) {
+        updatePeripheral(peripheralID) {
+            $0.characteristic = characteristic
+        }
+    }
+
+    func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? {
+        peerToPeripheralUUID[peerID].flatMap { peripherals[$0] }
+    }
+
+    func directLinkState(for peerID: PeerID) -> BLEDirectLinkState {
+        let peripheralUUID = peerToPeripheralUUID[peerID]
+        let hasPeripheral = peripheralUUID.flatMap { peripherals[$0]?.isConnected } ?? false
+        let hasCentral = centralToPeerID.values.contains(peerID)
+        return BLEDirectLinkState(hasPeripheral: hasPeripheral, hasCentral: hasCentral)
+    }
+
+    func links(to peerID: PeerID?) -> Set<BLEIngressLinkID> {
+        guard let peerID else { return [] }
+
+        var links: Set<BLEIngressLinkID> = []
+        if let peripheralUUID = peerToPeripheralUUID[peerID] {
+            links.insert(.peripheral(peripheralUUID))
+        }
+        for (centralUUID, mappedPeerID) in centralToPeerID where mappedPeerID == peerID {
+            links.insert(.central(centralUUID))
+        }
+        return links
+    }
+
+    func peerID(forPeripheralID peripheralID: String) -> PeerID? {
+        peripherals[peripheralID]?.peerID
+    }
+
+    func peerID(forCentralUUID centralUUID: String) -> PeerID? {
+        centralToPeerID[centralUUID]
+    }
+
+    func addSubscribedCentral(_ central: CBCentral) {
+        guard !subscribedCentrals.contains(central) else { return }
+        subscribedCentrals.append(central)
+    }
+
+    func removeSubscribedCentral(_ central: CBCentral) -> PeerID? {
+        let centralUUID = central.identifier.uuidString
+        subscribedCentrals.removeAll { $0.identifier == central.identifier }
+        return centralToPeerID.removeValue(forKey: centralUUID)
+    }
+
+    func bindCentral(_ centralUUID: String, to peerID: PeerID) {
+        centralToPeerID[centralUUID] = peerID
+    }
+
+    func bindPeripheral(_ peripheralUUID: String, to peerID: PeerID) {
+        if updatePeripheral(peripheralUUID, { $0.peerID = peerID }) != nil {
+            peerToPeripheralUUID[peerID] = peripheralUUID
+        }
+    }
+
+    func removePeripheral(_ peripheralID: String) -> PeerID? {
+        let peerID = peripherals.removeValue(forKey: peripheralID)?.peerID
+        if let peerID {
+            peerToPeripheralUUID.removeValue(forKey: peerID)
+        }
+        return peerID
+    }
+
+    func clearPeripherals() -> [PeerID] {
+        let peerIDs = peripherals.compactMap { $0.value.peerID }
+        peripherals.removeAll()
+        peerToPeripheralUUID.removeAll()
+        return peerIDs
+    }
+
+    func clearCentrals() -> [PeerID] {
+        let peerIDs = Array(centralToPeerID.values)
+        subscribedCentrals.removeAll()
+        centralToPeerID.removeAll()
+        return peerIDs
+    }
+
+    func clearAll() {
+        peripherals.removeAll()
+        peerToPeripheralUUID.removeAll()
+        subscribedCentrals.removeAll()
+        centralToPeerID.removeAll()
+    }
+}

bitchat/Services/BLE/BLELogRateLimiter.swift

@@ -0,0 +1,33 @@
+import Foundation
+
+final class BLELogRateLimiter {
+    private let defaultMinimumInterval: TimeInterval
+    private let queue = DispatchQueue(label: "chat.bitchat.ble.log-rate-limiter")
+    private var lastLogTimeByKey: [String: Date] = [:]
+
+    init(defaultMinimumInterval: TimeInterval) {
+        self.defaultMinimumInterval = defaultMinimumInterval
+    }
+
+    func shouldLog(
+        key: String,
+        now: Date = Date(),
+        minimumInterval: TimeInterval? = nil
+    ) -> Bool {
+        queue.sync {
+            let interval = minimumInterval ?? defaultMinimumInterval
+            if let lastLogTime = lastLogTimeByKey[key],
+               now.timeIntervalSince(lastLogTime) < interval {
+                return false
+            }
+            lastLogTimeByKey[key] = now
+            return true
+        }
+    }
+
+    func removeAll() {
+        queue.sync {
+            lastLogTimeByKey.removeAll()
+        }
+    }
+}

bitchat/Services/BLE/BLEMaintenancePolicy.swift

@@ -0,0 +1,62 @@
+import Foundation
+
+struct BLEMaintenancePlan: Equatable {
+    let shouldSendAnnounce: Bool
+    let shouldEnsureAdvertising: Bool
+    let shouldRunCleanup: Bool
+    let shouldFlushDirectedSpool: Bool
+    let shouldResetCounter: Bool
+}
+
+enum BLEMaintenancePolicy {
+    static func plan(
+        cycle: Int,
+        connectedCount: Int,
+        peerRegistryIsEmpty: Bool,
+        elapsedSinceLastAnnounce: TimeInterval,
+        hasRecentTraffic: Bool,
+        connectedAnnounceJitterOffset: TimeInterval? = nil,
+        highDegreeThreshold: Int = TransportConfig.bleHighDegreeThreshold
+    ) -> BLEMaintenancePlan {
+        BLEMaintenancePlan(
+            shouldSendAnnounce: shouldSendAnnounce(
+                connectedCount: connectedCount,
+                elapsedSinceLastAnnounce: elapsedSinceLastAnnounce,
+                hasRecentTraffic: hasRecentTraffic,
+                connectedAnnounceJitterOffset: connectedAnnounceJitterOffset,
+                highDegreeThreshold: highDegreeThreshold
+            ),
+            shouldEnsureAdvertising: peerRegistryIsEmpty,
+            shouldRunCleanup: cycle.isMultiple(of: 3),
+            shouldFlushDirectedSpool: !cycle.isMultiple(of: 2),
+            shouldResetCounter: cycle >= 6
+        )
+    }
+
+    static func shouldSendAnnounce(
+        connectedCount: Int,
+        elapsedSinceLastAnnounce: TimeInterval,
+        hasRecentTraffic: Bool,
+        connectedAnnounceJitterOffset: TimeInterval? = nil,
+        highDegreeThreshold: Int = TransportConfig.bleHighDegreeThreshold
+    ) -> Bool {
+        if hasRecentTraffic && elapsedSinceLastAnnounce >= 10.0 {
+            return true
+        }
+
+        guard connectedCount > 0 else {
+            return elapsedSinceLastAnnounce >= TransportConfig.bleAnnounceIntervalSeconds
+        }
+
+        let highDegree = connectedCount >= highDegreeThreshold
+        let base = highDegree ?
+            TransportConfig.bleConnectedAnnounceBaseSecondsDense :
+            TransportConfig.bleConnectedAnnounceBaseSecondsSparse
+        let jitter = highDegree ?
+            TransportConfig.bleConnectedAnnounceJitterDense :
+            TransportConfig.bleConnectedAnnounceJitterSparse
+        let jitterOffset = connectedAnnounceJitterOffset ?? Double.random(in: -jitter...jitter)
+
+        return elapsedSinceLastAnnounce >= base + jitterOffset
+    }
+}

bitchat/Services/BLE/BLENoisePayloadFactory.swift

@@ -0,0 +1,25 @@
+import Foundation
+
+enum BLENoisePayloadFactory {
+    static func privateMessage(content: String, messageID: String) -> Data? {
+        guard let payload = PrivateMessagePacket(messageID: messageID, content: content).encode() else {
+            return nil
+        }
+
+        return typedPayload(.privateMessage, payload: payload)
+    }
+
+    static func readReceipt(originalMessageID: String) -> Data {
+        typedPayload(.readReceipt, payload: Data(originalMessageID.utf8))
+    }
+
+    static func delivered(messageID: String) -> Data {
+        typedPayload(.delivered, payload: Data(messageID.utf8))
+    }
+
+    static func typedPayload(_ type: NoisePayloadType, payload: Data) -> Data {
+        var typed = Data([type.rawValue])
+        typed.append(payload)
+        return typed
+    }
+}

bitchat/Services/BLE/BLENoiseSessionQueues.swift

@@ -0,0 +1,46 @@
+import BitFoundation
+import Foundation
+
+struct BLEPendingPrivateMessage: Equatable {
+    let content: String
+    let messageID: String
+}
+
+struct BLENoiseSessionQueues {
+    private var privateMessagesByPeerID: [PeerID: [BLEPendingPrivateMessage]] = [:]
+    private var typedPayloadsByPeerID: [PeerID: [Data]] = [:]
+
+    var isEmpty: Bool {
+        privateMessagesByPeerID.isEmpty && typedPayloadsByPeerID.isEmpty
+    }
+
+    mutating func removeAll() {
+        privateMessagesByPeerID.removeAll()
+        typedPayloadsByPeerID.removeAll()
+    }
+
+    mutating func appendPrivateMessage(content: String, messageID: String, for peerID: PeerID) {
+        privateMessagesByPeerID[peerID, default: []].append(BLEPendingPrivateMessage(content: content, messageID: messageID))
+    }
+
+    mutating func takePrivateMessages(for peerID: PeerID) -> [BLEPendingPrivateMessage] {
+        let messages = privateMessagesByPeerID[peerID] ?? []
+        privateMessagesByPeerID.removeValue(forKey: peerID)
+        return messages
+    }
+
+    mutating func prependPrivateMessages(_ messages: [BLEPendingPrivateMessage], for peerID: PeerID) {
+        guard !messages.isEmpty else { return }
+        privateMessagesByPeerID[peerID, default: []].insert(contentsOf: messages, at: 0)
+    }
+
+    mutating func appendTypedPayload(_ payload: Data, for peerID: PeerID) {
+        typedPayloadsByPeerID[peerID, default: []].append(payload)
+    }
+
+    mutating func takeTypedPayloads(for peerID: PeerID) -> [Data] {
+        let payloads = typedPayloadsByPeerID[peerID] ?? []
+        typedPayloadsByPeerID.removeValue(forKey: peerID)
+        return payloads
+    }
+}

bitchat/Services/BLE/BLEOutboundFragmentPlanner.swift

@@ -0,0 +1,137 @@
+import BitFoundation
+import Foundation
+
+struct BLEOutboundFragmentPlan {
+    let fragmentPackets: [BitchatPacket]
+    let fragmentVersion: UInt8
+    let chunkSize: Int
+    let spacingMs: Int
+
+    var totalFragments: Int {
+        fragmentPackets.count
+    }
+
+    var shouldPauseScanning: Bool {
+        totalFragments > 4
+    }
+}
+
+enum BLEOutboundFragmentPlanner {
+    private static let minimumChunkSize = 64
+    private static let fragmentIDLength = 8
+
+    static func makePlan(
+        for request: BLEOutboundFragmentTransferRequest,
+        defaultChunkSize: Int,
+        bleMaxMTU: Int,
+        fragmentID: Data = randomFragmentID()
+    ) -> BLEOutboundFragmentPlan? {
+        guard fragmentID.count == fragmentIDLength,
+              let fullData = request.packet.toBinaryData(padding: request.pad) else {
+            return nil
+        }
+
+        let sizing = sizingPolicy(
+            for: request.packet,
+            requestedMaxChunk: request.maxChunk,
+            defaultChunkSize: defaultChunkSize,
+            bleMaxMTU: bleMaxMTU
+        )
+
+        let chunks = stride(from: 0, to: fullData.count, by: sizing.chunkSize).map { offset in
+            Data(fullData[offset..<min(offset + sizing.chunkSize, fullData.count)])
+        }
+
+        guard !chunks.isEmpty else { return nil }
+
+        let fragmentRecipient: Data? = {
+            if let directedPeer = request.directedPeer {
+                return Data(hexString: directedPeer.id)
+            }
+            return request.packet.recipientID
+        }()
+
+        let fragmentPackets = chunks.enumerated().map { index, chunk in
+            makeFragmentPacket(
+                original: request.packet,
+                fragmentID: fragmentID,
+                index: index,
+                total: chunks.count,
+                fragmentData: chunk,
+                fragmentRecipient: fragmentRecipient,
+                fragmentVersion: sizing.fragmentVersion
+            )
+        }
+
+        return BLEOutboundFragmentPlan(
+            fragmentPackets: fragmentPackets,
+            fragmentVersion: sizing.fragmentVersion,
+            chunkSize: sizing.chunkSize,
+            spacingMs: spacingMs(for: request)
+        )
+    }
+
+    private static func sizingPolicy(
+        for packet: BitchatPacket,
+        requestedMaxChunk: Int?,
+        defaultChunkSize: Int,
+        bleMaxMTU: Int
+    ) -> (fragmentVersion: UInt8, chunkSize: Int) {
+        var fragmentVersion: UInt8 = 1
+        var calculatedChunk = defaultChunkSize
+
+        if let route = packet.route, !route.isEmpty {
+            fragmentVersion = 2
+            let routeSize = 1 + (route.count * 8)
+            let overhead = 16 + 8 + 8 + routeSize + 13 + 16
+            calculatedChunk = max(minimumChunkSize, bleMaxMTU - overhead)
+        }
+
+        return (
+            fragmentVersion: fragmentVersion,
+            chunkSize: max(minimumChunkSize, requestedMaxChunk ?? calculatedChunk)
+        )
+    }
+
+    private static func makeFragmentPacket(
+        original packet: BitchatPacket,
+        fragmentID: Data,
+        index: Int,
+        total: Int,
+        fragmentData: Data,
+        fragmentRecipient: Data?,
+        fragmentVersion: UInt8
+    ) -> BitchatPacket {
+        var payload = Data()
+        payload.append(fragmentID)
+        payload.append(contentsOf: withUnsafeBytes(of: UInt16(index).bigEndian) { Data($0) })
+        payload.append(contentsOf: withUnsafeBytes(of: UInt16(total).bigEndian) { Data($0) })
+        payload.append(packet.type)
+        payload.append(fragmentData)
+
+        return BitchatPacket(
+            type: MessageType.fragment.rawValue,
+            senderID: packet.senderID,
+            recipientID: fragmentRecipient,
+            timestamp: packet.timestamp,
+            payload: payload,
+            signature: nil,
+            ttl: packet.ttl,
+            version: fragmentVersion,
+            route: packet.route,
+            isRSR: packet.isRSR
+        )
+    }
+
+    private static func spacingMs(for request: BLEOutboundFragmentTransferRequest) -> Int {
+        if request.directedPeer != nil || request.packet.recipientID != nil {
+            return TransportConfig.bleFragmentSpacingDirectedMs
+        }
+
+        return TransportConfig.bleFragmentSpacingMs
+    }
+
+    private static func randomFragmentID() -> Data {
+        Data((0..<fragmentIDLength).map { _ in UInt8.random(in: 0...255) })
+    }
+}

bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift

@@ -0,0 +1,181 @@
+import BitFoundation
+import Foundation
+
+struct BLEOutboundFragmentTransferRequest {
+    let packet: BitchatPacket
+    let pad: Bool
+    let maxChunk: Int?
+    let directedPeer: PeerID?
+    let transferId: String?
+
+    var resolvedTransferId: String? {
+        guard packet.type == MessageType.fileTransfer.rawValue else { return nil }
+        return transferId ?? packet.payload.sha256Hex()
+    }
+}
+
+struct BLEOutboundFragmentTransferScheduler {
+    enum QueuePosition {
+        case front
+        case back
+    }
+
+    enum SubmitResult {
+        case start(request: BLEOutboundFragmentTransferRequest, reservedTransferId: String?)
+        case queued(request: BLEOutboundFragmentTransferRequest, transferId: String?, position: QueuePosition)
+    }
+
+    enum CancelResult {
+        case active(transferId: String, workItems: [DispatchWorkItem])
+        case pending(transferId: String)
+        case missing
+    }
+
+    enum SentResult: Equatable {
+        case progress(sentFragments: Int, totalFragments: Int)
+        case complete(sentFragments: Int, totalFragments: Int)
+        case missing
+    }
+
+    private struct ActiveTransferState {
+        let totalFragments: Int
+        var sentFragments: Int
+        var workItems: [DispatchWorkItem]
+    }
+
+    private var activeTransfers: [String: ActiveTransferState] = [:]
+    private var pendingTransfers: [BLEOutboundFragmentTransferRequest] = []
+
+    var activeCount: Int {
+        activeTransfers.count
+    }
+
+    var pendingCount: Int {
+        pendingTransfers.count
+    }
+
+    mutating func removeAll() -> [(id: String, workItems: [DispatchWorkItem])] {
+        let active = activeTransfers.map { ($0.key, $0.value.workItems) }
+        activeTransfers.removeAll()
+        pendingTransfers.removeAll()
+        return active
+    }
+
+    mutating func submit(
+        _ request: BLEOutboundFragmentTransferRequest,
+        maxConcurrentTransfers: Int
+    ) -> SubmitResult {
+        guard let transferId = request.resolvedTransferId else {
+            return .start(request: request, reservedTransferId: nil)
+        }
+
+        guard activeTransfers.count < maxConcurrentTransfers else {
+            pendingTransfers.append(request)
+            return .queued(request: request, transferId: transferId, position: .back)
+        }
+
+        guard activeTransfers[transferId] == nil else {
+            pendingTransfers.insert(request, at: 0)
+            return .queued(request: request, transferId: transferId, position: .front)
+        }
+
+        activeTransfers[transferId] = ActiveTransferState(totalFragments: 0, sentFragments: 0, workItems: [])
+        return .start(request: request, reservedTransferId: transferId)
+    }
+
+    mutating func activateReservedTransfer(
+        id transferId: String,
+        totalFragments: Int,
+        workItems: [DispatchWorkItem]
+    ) -> Bool {
+        guard activeTransfers[transferId] != nil else { return false }
+        activeTransfers[transferId] = ActiveTransferState(
+            totalFragments: totalFragments,
+            sentFragments: 0,
+            workItems: workItems
+        )
+        return true
+    }
+
+    mutating func updateWorkItems(_ workItems: [DispatchWorkItem], for transferId: String) -> Bool {
+        guard var state = activeTransfers[transferId] else { return false }
+        state.workItems = workItems
+        activeTransfers[transferId] = state
+        return true
+    }
+
+    mutating func releaseReservation(_ transferId: String) -> [DispatchWorkItem]? {
+        activeTransfers.removeValue(forKey: transferId)?.workItems
+    }
+
+    func isActive(_ transferId: String) -> Bool {
+        activeTransfers[transferId] != nil
+    }
+
+    mutating func cancelTransfer(_ transferId: String) -> CancelResult {
+        if let active = activeTransfers.removeValue(forKey: transferId) {
+            return .active(transferId: transferId, workItems: active.workItems)
+        }
+
+        if let pendingIndex = pendingTransfers.firstIndex(where: { $0.resolvedTransferId == transferId || $0.transferId == transferId }) {
+            pendingTransfers.remove(at: pendingIndex)
+            return .pending(transferId: transferId)
+        }
+
+        return .missing
+    }
+
+    mutating func markFragmentSent(transferId: String) -> SentResult {
+        guard var state = activeTransfers[transferId] else { return .missing }
+
+        state.sentFragments = min(state.sentFragments + 1, state.totalFragments)
+        let isComplete = state.sentFragments >= state.totalFragments
+
+        if isComplete {
+            activeTransfers.removeValue(forKey: transferId)
+            return .complete(sentFragments: state.sentFragments, totalFragments: state.totalFragments)
+        }
+
+        activeTransfers[transferId] = state
+        return .progress(sentFragments: state.sentFragments, totalFragments: state.totalFragments)
+    }
+
+    mutating func reservePendingStarts(maxConcurrentTransfers: Int) -> [SubmitResult] {
+        var availableSlots = max(0, maxConcurrentTransfers - activeTransfers.count)
+        guard availableSlots > 0, !pendingTransfers.isEmpty else { return [] }
+
+        var results: [SubmitResult] = []
+        var blockedFront: [BLEOutboundFragmentTransferRequest] = []
+
+        while availableSlots > 0, !pendingTransfers.isEmpty {
+            let request = pendingTransfers.removeFirst()
+            availableSlots -= 1
+
+            guard let transferId = request.resolvedTransferId else {
+                results.append(.start(request: request, reservedTransferId: nil))
+                continue
+            }
+
+            guard activeTransfers.count < maxConcurrentTransfers else {
+                pendingTransfers.insert(request, at: 0)
+                results.append(.queued(request: request, transferId: transferId, position: .front))
+                break
+            }
+
+            guard activeTransfers[transferId] == nil else {
+                blockedFront.append(request)
+                results.append(.queued(request: request, transferId: transferId, position: .front))
+                continue
+            }
+
+            activeTransfers[transferId] = ActiveTransferState(totalFragments: 0, sentFragments: 0, workItems: [])
+            results.append(.start(request: request, reservedTransferId: transferId))
+        }
+
+        if !blockedFront.isEmpty {
+            pendingTransfers.insert(contentsOf: blockedFront, at: 0)
+        }
+
+        return results
+    }
+}

bitchat/Services/BLE/BLEOutboundLinkPlanner.swift

@@ -0,0 +1,87 @@
+import BitFoundation
+import Foundation
+
+struct BLEOutboundLinkPlan: Equatable {
+    let directedPeerHint: PeerID?
+    let fragmentChunkSize: Int?
+    let selectedLinks: BLEFanoutSelection
+    let shouldSpoolDirectedPacket: Bool
+}
+
+enum BLEOutboundLinkPlanner {
+    static func plan(
+        packet: BitchatPacket,
+        dataCount: Int,
+        peripheralIDs: [String],
+        peripheralWriteLimits: [Int],
+        centralIDs: [String],
+        centralNotifyLimits: [Int],
+        ingressRecord: BLEIngressLinkRecord?,
+        excludedLinks: Set<BLEIngressLinkID>,
+        directedOnlyPeer: PeerID?
+    ) -> BLEOutboundLinkPlan {
+        if let minLimit = minimumLinkLimit(
+            peripheralWriteLimits: peripheralWriteLimits,
+            centralNotifyLimits: centralNotifyLimits
+        ), packet.type != MessageType.fragment.rawValue,
+           dataCount > minLimit {
+            return BLEOutboundLinkPlan(
+                directedPeerHint: directedPeerHint(for: packet, explicitPeer: directedOnlyPeer),
+                fragmentChunkSize: BLEOutboundPacketPolicy.fragmentChunkSize(forLinkLimit: minLimit),
+                selectedLinks: BLEFanoutSelection(peripheralIDs: [], centralIDs: []),
+                shouldSpoolDirectedPacket: false
+            )
+        }
+
+        let directedPeerHint = directedPeerHint(for: packet, explicitPeer: directedOnlyPeer)
+        let selectedLinks = BLEFanoutSelector.selectLinks(
+            peripheralIDs: peripheralIDs,
+            centralIDs: centralIDs,
+            ingressLink: ingressRecord?.link,
+            excludedLinks: excludedLinks,
+            directedPeerHint: directedPeerHint,
+            packetType: packet.type,
+            messageID: BLEOutboundPacketPolicy.messageID(for: packet)
+        )
+
+        return BLEOutboundLinkPlan(
+            directedPeerHint: directedPeerHint,
+            fragmentChunkSize: nil,
+            selectedLinks: selectedLinks,
+            shouldSpoolDirectedPacket: shouldSpoolDirectedPacket(
+                directedPeerHint: directedPeerHint,
+                selectedLinks: selectedLinks,
+                packetType: packet.type
+            )
+        )
+    }
+
+    static func directedPeerHint(for packet: BitchatPacket, explicitPeer: PeerID?) -> PeerID? {
+        if let explicitPeer { return explicitPeer }
+        if let recipient = PeerID(str: packet.recipientID?.hexEncodedString()), !recipient.isEmpty {
+            return recipient
+        }
+        return nil
+    }
+
+    static func minimumLinkLimit(peripheralWriteLimits: [Int], centralNotifyLimits: [Int]) -> Int? {
+        [peripheralWriteLimits.min(), centralNotifyLimits.min()]
+            .compactMap { $0 }
+            .min()
+    }
+
+    static func shouldSpoolDirectedPacket(
+        directedPeerHint: PeerID?,
+        selectedLinks: BLEFanoutSelection,
+        packetType: UInt8
+    ) -> Bool {
+        guard directedPeerHint != nil,
+              selectedLinks.peripheralIDs.isEmpty,
+              selectedLinks.centralIDs.isEmpty else {
+            return false
+        }
+
+        return packetType == MessageType.noiseEncrypted.rawValue ||
+            packetType == MessageType.noiseHandshake.rawValue
+    }
+}

bitchat/Services/BLE/BLEOutboundNotificationBuffer.swift

@@ -0,0 +1,47 @@
+import Foundation
+
+struct BLEPendingNotification<Target> {
+    let data: Data
+    let targets: [Target]?
+}
+
+struct BLEOutboundNotificationBuffer<Target> {
+    enum EnqueueResult {
+        case enqueued(count: Int)
+        case full(count: Int)
+    }
+
+    private var notifications: [BLEPendingNotification<Target>] = []
+
+    var count: Int {
+        notifications.count
+    }
+
+    var isEmpty: Bool {
+        notifications.isEmpty
+    }
+
+    mutating func removeAll() {
+        notifications.removeAll()
+    }
+
+    mutating func enqueue(data: Data, targets: [Target]?, capCount: Int) -> EnqueueResult {
+        guard notifications.count < capCount else {
+            return .full(count: notifications.count)
+        }
+
+        notifications.append(BLEPendingNotification(data: data, targets: targets))
+        return .enqueued(count: notifications.count)
+    }
+
+    mutating func takeAll() -> [BLEPendingNotification<Target>] {
+        let pending = notifications
+        notifications.removeAll()
+        return pending
+    }
+
+    mutating func prepend(_ pending: [BLEPendingNotification<Target>]) {
+        guard !pending.isEmpty else { return }
+        notifications.insert(contentsOf: pending, at: 0)
+    }
+}

bitchat/Services/BLE/BLEOutboundPacketPolicy.swift

@@ -0,0 +1,43 @@
+import BitFoundation
+import Foundation
+
+enum BLEOutboundPacketPolicy {
+    private static let fragmentFrameOverhead = 13 + 8 + 8 + 13
+
+    static func messageID(for packet: BitchatPacket) -> String {
+        BLEIngressLinkRegistry.messageID(for: packet)
+    }
+
+    static func padsBLEFrame(for packetType: UInt8) -> Bool {
+        switch MessageType(rawValue: packetType) {
+        case .noiseEncrypted, .noiseHandshake:
+            return true
+        case .none, .announce, .message, .leave, .requestSync, .fragment, .fileTransfer:
+            return false
+        }
+    }
+
+    static func priority(for packet: BitchatPacket, data: Data) -> BLEOutboundWritePriority {
+        guard let messageType = MessageType(rawValue: packet.type) else { return .low }
+        switch messageType {
+        case .fragment:
+            return .fragment(totalFragments: fragmentTotalCount(from: packet.payload))
+        case .fileTransfer:
+            return .fileTransfer
+        default:
+            return .high
+        }
+    }
+
+    static func fragmentChunkSize(forLinkLimit limit: Int) -> Int {
+        max(64, limit - fragmentFrameOverhead)
+    }
+
+    private static func fragmentTotalCount(from payload: Data) -> Int {
+        guard payload.count >= 12 else { return Int(UInt16.max) }
+        let totalHigh = Int(payload[10])
+        let totalLow = Int(payload[11])
+        let total = (totalHigh << 8) | totalLow
+        return max(total, 1)
+    }
+}

bitchat/Services/BLE/BLEOutboundWriteBuffer.swift

@@ -0,0 +1,83 @@
+import Foundation
+
+struct BLEOutboundWritePriority: Comparable {
+    let level: Int
+    let suborder: Int
+
+    static let high = BLEOutboundWritePriority(level: 0, suborder: 0)
+
+    static func fragment(totalFragments: Int) -> BLEOutboundWritePriority {
+        BLEOutboundWritePriority(level: 1, suborder: max(1, min(totalFragments, Int(UInt16.max))))
+    }
+
+    static let fileTransfer = BLEOutboundWritePriority(level: 2, suborder: Int.max - 1)
+    static let low = BLEOutboundWritePriority(level: 2, suborder: Int.max)
+
+    static func < (lhs: BLEOutboundWritePriority, rhs: BLEOutboundWritePriority) -> Bool {
+        if lhs.level != rhs.level { return lhs.level < rhs.level }
+        return lhs.suborder < rhs.suborder
+    }
+}
+
+struct BLEPendingWrite {
+    let priority: BLEOutboundWritePriority
+    let data: Data
+}
+
+struct BLEOutboundWriteBuffer {
+    enum EnqueueResult {
+        case enqueued(trimmedBytes: Int, remainingBytes: Int)
+        case oversized(bytes: Int)
+    }
+
+    private var writesByPeripheralID: [String: [BLEPendingWrite]] = [:]
+
+    var peripheralIDs: [String] {
+        Array(writesByPeripheralID.keys)
+    }
+
+    mutating func removeAll() {
+        writesByPeripheralID.removeAll()
+    }
+
+    mutating func enqueue(
+        data: Data,
+        for peripheralID: String,
+        priority: BLEOutboundWritePriority,
+        capBytes: Int
+    ) -> EnqueueResult {
+        guard data.count <= capBytes else {
+            return .oversized(bytes: data.count)
+        }
+
+        var queue = writesByPeripheralID[peripheralID] ?? []
+        let item = BLEPendingWrite(priority: priority, data: data)
+        let insertIndex = queue.firstIndex { item.priority < $0.priority } ?? queue.count
+        queue.insert(item, at: insertIndex)
+
+        var total = queue.reduce(0) { $0 + $1.data.count }
+        var trimmedBytes = 0
+
+        while total > capBytes && !queue.isEmpty {
+            let removed = queue.removeLast()
+            trimmedBytes += removed.data.count
+            total -= removed.data.count
+        }
+
+        writesByPeripheralID[peripheralID] = queue.isEmpty ? nil : queue
+        return .enqueued(trimmedBytes: trimmedBytes, remainingBytes: total)
+    }
+
+    mutating func takeAll(for peripheralID: String) -> [BLEPendingWrite] {
+        let items = writesByPeripheralID[peripheralID] ?? []
+        writesByPeripheralID[peripheralID] = nil
+        return items
+    }
+
+    mutating func prepend(_ items: [BLEPendingWrite], for peripheralID: String) {
+        guard !items.isEmpty else { return }
+        var existing = writesByPeripheralID[peripheralID] ?? []
+        existing.insert(contentsOf: items, at: 0)
+        writesByPeripheralID[peripheralID] = existing
+    }
+}

bitchat/Services/BLE/BLEPacketFreshnessPolicy.swift

@@ -0,0 +1,27 @@
+import Foundation
+
+enum BLEPacketFreshnessPolicy {
+    static let defaultMaxAgeSeconds: TimeInterval = 900
+
+    static func isBroadcastRecipient(_ recipientID: Data?) -> Bool {
+        guard let recipientID else { return true }
+        return recipientID.count == 8 && recipientID.allSatisfy { $0 == 0xFF }
+    }
+
+    static func isStale(
+        timestampMilliseconds: UInt64,
+        now: Date,
+        maxAgeSeconds: TimeInterval = defaultMaxAgeSeconds
+    ) -> Bool {
+        let nowMilliseconds = UInt64(now.timeIntervalSince1970 * 1000)
+        let maxAgeMilliseconds = UInt64(maxAgeSeconds * 1000)
+        guard nowMilliseconds >= maxAgeMilliseconds else { return false }
+        return timestampMilliseconds < nowMilliseconds - maxAgeMilliseconds
+    }
+
+    static func ageSeconds(timestampMilliseconds: UInt64, now: Date) -> Double {
+        let nowMilliseconds = UInt64(now.timeIntervalSince1970 * 1000)
+        guard nowMilliseconds >= timestampMilliseconds else { return 0 }
+        return Double(nowMilliseconds - timestampMilliseconds) / 1000.0
+    }
+}

bitchat/Services/BLE/BLEPeerEventDebouncer.swift

@@ -0,0 +1,25 @@
+import BitFoundation
+import Foundation
+
+struct BLEPeerEventDebouncer {
+    private var lastEmitByPeer: [PeerID: Date] = [:]
+
+    var count: Int {
+        lastEmitByPeer.count
+    }
+
+    @discardableResult
+    mutating func shouldEmit(peerID: PeerID, now: Date, minimumInterval: TimeInterval) -> Bool {
+        if let lastEmit = lastEmitByPeer[peerID],
+           now.timeIntervalSince(lastEmit) < minimumInterval {
+            return false
+        }
+
+        lastEmitByPeer[peerID] = now
+        return true
+    }
+
+    mutating func removeAll() {
+        lastEmitByPeer.removeAll()
+    }
+}

bitchat/Services/BLE/BLEPeerPublishCoalescer.swift

@@ -0,0 +1,43 @@
+import Foundation
+
+enum BLEPeerPublishDecision: Equatable {
+    case publishNow
+    case schedule(delay: TimeInterval)
+    case skip
+}
+
+struct BLEPeerPublishCoalescer {
+    private var lastPublishAt: Date
+    private var publishPending: Bool
+    private let minimumInterval: TimeInterval
+
+    init(
+        lastPublishAt: Date = .distantPast,
+        publishPending: Bool = false,
+        minimumInterval: TimeInterval = 0.1
+    ) {
+        self.lastPublishAt = lastPublishAt
+        self.publishPending = publishPending
+        self.minimumInterval = minimumInterval
+    }
+
+    mutating func requestPublish(now: Date) -> BLEPeerPublishDecision {
+        let elapsed = now.timeIntervalSince(lastPublishAt)
+        if elapsed >= minimumInterval {
+            lastPublishAt = now
+            return .publishNow
+        }
+
+        guard !publishPending else {
+            return .skip
+        }
+
+        publishPending = true
+        return .schedule(delay: minimumInterval - elapsed)
+    }
+
+    mutating func scheduledPublishFired(now: Date) {
+        lastPublishAt = now
+        publishPending = false
+    }
+}

bitchat/Services/BLE/BLEPeerRegistry.swift

@@ -0,0 +1,211 @@
+import BitFoundation
+import Foundation
+
+struct BLEPeerInfo: Equatable {
+    let peerID: PeerID
+    var nickname: String
+    var isConnected: Bool
+    var noisePublicKey: Data?
+    var signingPublicKey: Data?
+    var isVerifiedNickname: Bool
+    var lastSeen: Date
+}
+
+struct BLEPeerAnnounceUpdate: Equatable {
+    let isNewPeer: Bool
+    let wasDisconnected: Bool
+    let previousNickname: String?
+}
+
+struct BLEPeerLinkPresence: Equatable {
+    var hasPeripheral: Bool
+    var hasCentral: Bool
+}
+
+struct BLERemovedPeer: Equatable {
+    let peerID: PeerID
+    let nickname: String
+}
+
+struct BLEPeerConnectivityChanges: Equatable {
+    var disconnectedPeerIDs: [PeerID] = []
+    var removedPeers: [BLERemovedPeer] = []
+}
+
+struct BLEPeerRegistry {
+    private var peers: [PeerID: BLEPeerInfo] = [:]
+
+    var isEmpty: Bool {
+        peers.isEmpty
+    }
+
+    var count: Int {
+        peers.count
+    }
+
+    var peerIDs: [PeerID] {
+        Array(peers.keys)
+    }
+
+    var connectedCount: Int {
+        peers.values.filter(\.isConnected).count
+    }
+
+    var connectedPeerIDs: [PeerID] {
+        peers.values.compactMap { $0.isConnected ? $0.peerID : nil }
+    }
+
+    var connectedRoutingData: [Data] {
+        peers.values.filter(\.isConnected).compactMap { $0.peerID.routingData }
+    }
+
+    var snapshotByID: [PeerID: BLEPeerInfo] {
+        peers
+    }
+
+    mutating func removeAll() {
+        peers.removeAll()
+    }
+
+    func info(for peerID: PeerID) -> BLEPeerInfo? {
+        peers[peerID]
+    }
+
+    mutating func upsert(_ info: BLEPeerInfo) {
+        peers[info.peerID] = info
+    }
+
+    @discardableResult
+    mutating func remove(_ peerID: PeerID) -> BLEPeerInfo? {
+        peers.removeValue(forKey: peerID)
+    }
+
+    func isConnected(_ peerID: PeerID) -> Bool {
+        peers[peerID.toShort()]?.isConnected ?? false
+    }
+
+    func isReachable(_ peerID: PeerID, now: Date) -> Bool {
+        let shortID = peerID.toShort()
+        let meshAttached = connectedCount > 0
+        guard let info = peers[shortID] else { return false }
+        if info.isConnected { return true }
+        guard meshAttached else { return false }
+
+        let retention: TimeInterval = info.isVerifiedNickname
+            ? TransportConfig.bleReachabilityRetentionVerifiedSeconds
+            : TransportConfig.bleReachabilityRetentionUnverifiedSeconds
+        return now.timeIntervalSince(info.lastSeen) <= retention
+    }
+
+    func nickname(for peerID: PeerID, connectedOnly: Bool) -> String? {
+        guard let peer = peers[peerID] else { return nil }
+        if connectedOnly && !peer.isConnected { return nil }
+        return peer.nickname
+    }
+
+    func fingerprint(for peerID: PeerID) -> String? {
+        peers[peerID]?.noisePublicKey?.sha256Fingerprint()
+    }
+
+    func displayNicknames(selfNickname: String) -> [PeerID: String] {
+        let connected = peers.filter { $0.value.isConnected }
+        let tuples = connected.map { ($0.key, $0.value.nickname, true) }
+        return PeerDisplayNameResolver.resolve(tuples, selfNickname: selfNickname)
+    }
+
+    func transportSnapshots(selfNickname: String) -> [TransportPeerSnapshot] {
+        let snapshot = Array(peers.values)
+        let resolvedNames = PeerDisplayNameResolver.resolve(
+            snapshot.map { ($0.peerID, $0.nickname, $0.isConnected) },
+            selfNickname: selfNickname
+        )
+        return snapshot.map { info in
+            TransportPeerSnapshot(
+                peerID: info.peerID,
+                nickname: resolvedNames[info.peerID] ?? info.nickname,
+                isConnected: info.isConnected,
+                noisePublicKey: info.noisePublicKey,
+                lastSeen: info.lastSeen
+            )
+        }
+    }
+
+    func collisionResolvedNickname(for peerID: PeerID, selfNickname: String) -> String? {
+        guard let info = peers[peerID], info.isVerifiedNickname else { return nil }
+        let hasCollision = peers.values.contains {
+            $0.isConnected && $0.nickname == info.nickname && $0.peerID != peerID
+        } || selfNickname == info.nickname
+        return hasCollision ? info.nickname + "#" + String(peerID.id.prefix(4)) : info.nickname
+    }
+
+    mutating func markDisconnected(_ peerID: PeerID) {
+        guard var info = peers[peerID] else { return }
+        info.isConnected = false
+        peers[peerID] = info
+    }
+
+    mutating func updateLastSeen(_ peerID: PeerID, at date: Date) {
+        guard var peer = peers[peerID] else { return }
+        peer.lastSeen = date
+        peers[peerID] = peer
+    }
+
+    mutating func upsertVerifiedAnnounce(
+        peerID: PeerID,
+        nickname: String,
+        noisePublicKey: Data,
+        signingPublicKey: Data?,
+        isConnected: Bool,
+        now: Date
+    ) -> BLEPeerAnnounceUpdate {
+        let existing = peers[peerID]
+        let update = BLEPeerAnnounceUpdate(
+            isNewPeer: existing == nil,
+            wasDisconnected: existing?.isConnected == false,
+            previousNickname: existing?.nickname
+        )
+
+        peers[peerID] = BLEPeerInfo(
+            peerID: existing?.peerID ?? peerID,
+            nickname: nickname,
+            isConnected: isConnected,
+            noisePublicKey: noisePublicKey,
+            signingPublicKey: signingPublicKey,
+            isVerifiedNickname: true,
+            lastSeen: now
+        )
+
+        return update
+    }
+
+    mutating func reconcileConnectivity(
+        now: Date,
+        linkStates: [PeerID: BLEPeerLinkPresence]
+    ) -> BLEPeerConnectivityChanges {
+        var changes = BLEPeerConnectivityChanges()
+
+        for (peerID, peer) in Array(peers) {
+            let age = now.timeIntervalSince(peer.lastSeen)
+            let retention: TimeInterval = peer.isVerifiedNickname
+                ? TransportConfig.bleReachabilityRetentionVerifiedSeconds
+                : TransportConfig.bleReachabilityRetentionUnverifiedSeconds
+
+            if peer.isConnected && age > TransportConfig.blePeerInactivityTimeoutSeconds {
+                let state = linkStates[peerID] ?? BLEPeerLinkPresence(hasPeripheral: false, hasCentral: false)
+                if !state.hasPeripheral && !state.hasCentral {
+                    var updated = peer
+                    updated.isConnected = false
+                    peers[peerID] = updated
+                    changes.disconnectedPeerIDs.append(peerID)
+                }
+            }
+
+            if !peer.isConnected && age > retention {
+                peers.removeValue(forKey: peerID)
+                changes.removedPeers.append(BLERemovedPeer(peerID: peerID, nickname: peer.nickname))
+            }
+        }
+
+        return changes
+    }
+}

bitchat/Services/BLE/BLEPeerSenderDisplayName.swift

@@ -0,0 +1,60 @@
+import BitFoundation
+import Foundation
+
+enum BLEPeerSenderDisplayName {
+    static func resolveKnownPeer(
+        peerID: PeerID,
+        localPeerID: PeerID,
+        localNickname: String,
+        peers: [PeerID: BLEPeerInfo],
+        allowConnectedUnverified: Bool
+    ) -> String? {
+        if peerID == localPeerID {
+            return localNickname
+        }
+
+        guard let info = peers[peerID] else { return nil }
+
+        if info.isVerifiedNickname {
+            return collisionResolvedName(
+                displayName: info.nickname,
+                collisionNickname: info.nickname,
+                peerID: peerID,
+                localNickname: localNickname,
+                peers: peers
+            )
+        }
+
+        if allowConnectedUnverified, info.isConnected {
+            let displayName = info.nickname.isEmpty ? anonymousNickname(for: peerID) : info.nickname
+            return collisionResolvedName(
+                displayName: displayName,
+                collisionNickname: info.nickname,
+                peerID: peerID,
+                localNickname: localNickname,
+                peers: peers
+            )
+        }
+
+        return nil
+    }
+
+    static func anonymousNickname(for peerID: PeerID) -> String {
+        "anon" + String(peerID.id.prefix(4))
+    }
+
+    private static func collisionResolvedName(
+        displayName: String,
+        collisionNickname: String,
+        peerID: PeerID,
+        localNickname: String,
+        peers: [PeerID: BLEPeerInfo]
+    ) -> String {
+        let hasCollision = peers.values.contains {
+            $0.isConnected && $0.nickname == collisionNickname && $0.peerID != peerID
+        } || localNickname == collisionNickname
+
+        guard hasCollision else { return displayName }
+        return displayName + "#" + String(peerID.id.prefix(4))
+    }
+}

bitchat/Services/BLE/BLEPublicMessagePolicy.swift

@@ -0,0 +1,42 @@
+import BitFoundation
+import Foundation
+
+struct BLEPublicMessageAcceptance: Equatable {
+    let shouldTrackForSync: Bool
+}
+
+enum BLEPublicMessageRejection: Equatable {
+    case selfEcho
+    case staleBroadcast(ageSeconds: Double)
+}
+
+enum BLEPublicMessageDecision: Equatable {
+    case accept(BLEPublicMessageAcceptance)
+    case reject(BLEPublicMessageRejection)
+}
+
+enum BLEPublicMessagePolicy {
+    static func evaluate(
+        packet: BitchatPacket,
+        from peerID: PeerID,
+        localPeerID: PeerID,
+        now: Date
+    ) -> BLEPublicMessageDecision {
+        if peerID == localPeerID && packet.ttl != 0 {
+            return .reject(.selfEcho)
+        }
+
+        let isBroadcast = BLEPacketFreshnessPolicy.isBroadcastRecipient(packet.recipientID)
+        if isBroadcast,
+           BLEPacketFreshnessPolicy.isStale(timestampMilliseconds: packet.timestamp, now: now) {
+            return .reject(.staleBroadcast(ageSeconds: BLEPacketFreshnessPolicy.ageSeconds(
+                timestampMilliseconds: packet.timestamp,
+                now: now
+            )))
+        }
+
+        return .accept(BLEPublicMessageAcceptance(
+            shouldTrackForSync: isBroadcast && packet.type == MessageType.message.rawValue
+        ))
+    }
+}

bitchat/Services/BLE/BLEReceivePipeline.swift

@@ -0,0 +1,84 @@
+import BitFoundation
+import Foundation
+
+struct BLEReceivedPacketContext: Equatable {
+    let senderID: PeerID
+    let messageID: String
+    let messageType: MessageType?
+    let shouldDeduplicate: Bool
+    let logsHandlingDetails: Bool
+}
+
+struct BLEReceivePipeline {
+    static func context(for packet: BitchatPacket, localPeerID: PeerID) -> BLEReceivedPacketContext {
+        let senderID = PeerID(hexData: packet.senderID)
+        let messageID = "\(senderID)-\(packet.timestamp)-\(packet.type)"
+        let messageType = MessageType(rawValue: packet.type)
+        let allowSelfSyncReplay = packet.ttl == 0 && senderID == localPeerID
+        let shouldDeduplicate = messageType != .fragment && !allowSelfSyncReplay
+
+        return BLEReceivedPacketContext(
+            senderID: senderID,
+            messageID: messageID,
+            messageType: messageType,
+            shouldDeduplicate: shouldDeduplicate,
+            logsHandlingDetails: messageType != .announce
+        )
+    }
+
+    static func shouldCancelScheduledRelayForDuplicate(connectedPeerCount: Int) -> Bool {
+        connectedPeerCount > 2
+    }
+
+    static func relayDecision(
+        for packet: BitchatPacket,
+        senderID: PeerID,
+        localPeerID: PeerID,
+        degree: Int,
+        highDegreeThreshold: Int
+    ) -> RelayDecision {
+        RelayController.decide(
+            ttl: packet.ttl,
+            senderIsSelf: senderID == localPeerID,
+            recipientIsSelf: PeerID(hexData: packet.recipientID) == localPeerID,
+            isEncrypted: packet.type == MessageType.noiseEncrypted.rawValue,
+            isDirectedEncrypted: packet.type == MessageType.noiseEncrypted.rawValue && packet.recipientID != nil,
+            isFragment: packet.type == MessageType.fragment.rawValue,
+            isDirectedFragment: packet.type == MessageType.fragment.rawValue && packet.recipientID != nil,
+            isHandshake: packet.type == MessageType.noiseHandshake.rawValue,
+            isAnnounce: packet.type == MessageType.announce.rawValue,
+            degree: degree,
+            highDegreeThreshold: highDegreeThreshold
+        )
+    }
+}
+
+struct BLERecentTrafficTracker: Equatable {
+    private var packetTimestamps: [Date] = []
+
+    var count: Int {
+        packetTimestamps.count
+    }
+
+    mutating func removeAll() {
+        packetTimestamps.removeAll()
+    }
+
+    mutating func recordPacket(at now: Date) {
+        packetTimestamps.append(now)
+        prune(at: now)
+    }
+
+    func hasTraffic(within seconds: TimeInterval, now: Date) -> Bool {
+        let cutoff = now.addingTimeInterval(-seconds)
+        return packetTimestamps.contains { $0 >= cutoff }
+    }
+
+    private mutating func prune(at now: Date) {
+        let cutoff = now.addingTimeInterval(-TransportConfig.bleRecentPacketWindowSeconds)
+        if packetTimestamps.count > TransportConfig.bleRecentPacketWindowMaxCount {
+            packetTimestamps.removeFirst(packetTimestamps.count - TransportConfig.bleRecentPacketWindowMaxCount)
+        }
+        packetTimestamps.removeAll { $0 < cutoff }
+    }
+}

bitchat/Services/BLE/BLERouteForwardingPolicy.swift

@@ -0,0 +1,93 @@
+import BitFoundation
+import Foundation
+
+struct BLERouteForwardingPlan {
+    let shouldSuppressFloodRelay: Bool
+    let forwardPacket: BitchatPacket?
+    let nextHop: PeerID?
+
+    static let allowFloodRelay = BLERouteForwardingPlan(
+        shouldSuppressFloodRelay: false,
+        forwardPacket: nil,
+        nextHop: nil
+    )
+
+    static let suppressFloodRelay = BLERouteForwardingPlan(
+        shouldSuppressFloodRelay: true,
+        forwardPacket: nil,
+        nextHop: nil
+    )
+
+    static func forward(_ packet: BitchatPacket, to nextHop: PeerID) -> BLERouteForwardingPlan {
+        BLERouteForwardingPlan(
+            shouldSuppressFloodRelay: true,
+            forwardPacket: packet,
+            nextHop: nextHop
+        )
+    }
+}
+
+struct BLERouteForwardingPolicy {
+    static func plan(
+        for packet: BitchatPacket,
+        localPeerID: PeerID,
+        localRoutingData: Data?,
+        routingPeer: (Data) -> PeerID?,
+        isPeerConnected: (PeerID) -> Bool
+    ) -> BLERouteForwardingPlan {
+        if PeerID(hexData: packet.recipientID) == localPeerID {
+            return .suppressFloodRelay
+        }
+
+        guard let route = packet.route, !route.isEmpty else {
+            return .allowFloodRelay
+        }
+
+        guard packet.ttl > 1 else {
+            return .suppressFloodRelay
+        }
+
+        guard let localRoutingData else {
+            return .allowFloodRelay
+        }
+
+        guard let localIndex = route.firstIndex(of: localRoutingData) else {
+            return forward(packet, toRouteData: route[0], routingPeer: routingPeer, isPeerConnected: isPeerConnected)
+        }
+
+        if localIndex == route.count - 1 {
+            guard let destinationPeer = PeerID(hexData: packet.recipientID),
+                  isPeerConnected(destinationPeer) else {
+                return .allowFloodRelay
+            }
+            return .forward(relayed(packet), to: destinationPeer)
+        }
+
+        return forward(
+            packet,
+            toRouteData: route[localIndex + 1],
+            routingPeer: routingPeer,
+            isPeerConnected: isPeerConnected
+        )
+    }
+
+    private static func forward(
+        _ packet: BitchatPacket,
+        toRouteData routeData: Data,
+        routingPeer: (Data) -> PeerID?,
+        isPeerConnected: (PeerID) -> Bool
+    ) -> BLERouteForwardingPlan {
+        guard let nextPeer = routingPeer(routeData),
+              isPeerConnected(nextPeer) else {
+            return .allowFloodRelay
+        }
+
+        return .forward(relayed(packet), to: nextPeer)
+    }
+
+    private static func relayed(_ packet: BitchatPacket) -> BitchatPacket {
+        var relayPacket = packet
+        relayPacket.ttl = packet.ttl - 1
+        return relayPacket
+    }
+}

bitchat/Services/BLE/BLEScanDutyPolicy.swift

@@ -0,0 +1,35 @@
+import Foundation
+
+enum BLEScanDutyPlan: Equatable {
+    case continuous
+    case dutyCycle(onDuration: TimeInterval, offDuration: TimeInterval)
+}
+
+enum BLEScanDutyPolicy {
+    static func plan(
+        dutyEnabled: Bool,
+        appIsActive: Bool,
+        connectedCount: Int,
+        hasRecentTraffic: Bool,
+        highDegreeThreshold: Int = TransportConfig.bleHighDegreeThreshold
+    ) -> BLEScanDutyPlan {
+        let forceContinuousScan = connectedCount <= 2 || hasRecentTraffic
+        let shouldDutyCycle = dutyEnabled && appIsActive && connectedCount > 0 && !forceContinuousScan
+
+        guard shouldDutyCycle else {
+            return .continuous
+        }
+
+        if connectedCount >= highDegreeThreshold {
+            return .dutyCycle(
+                onDuration: TransportConfig.bleDutyOnDurationDense,
+                offDuration: TransportConfig.bleDutyOffDurationDense
+            )
+        }
+
+        return .dutyCycle(
+            onDuration: TransportConfig.bleDutyOnDuration,
+            offDuration: TransportConfig.bleDutyOffDuration
+        )
+    }
+}

bitchat/Services/BLE/BLEScheduledRelayStore.swift

@@ -0,0 +1,43 @@
+import Foundation
+
+struct BLEScheduledRelayStore {
+    private var relays: [String: DispatchWorkItem] = [:]
+
+    var count: Int {
+        relays.count
+    }
+
+    var isEmpty: Bool {
+        relays.isEmpty
+    }
+
+    mutating func schedule(_ workItem: DispatchWorkItem, messageID: String) {
+        relays[messageID] = workItem
+    }
+
+    @discardableResult
+    mutating func remove(messageID: String) -> DispatchWorkItem? {
+        relays.removeValue(forKey: messageID)
+    }
+
+    @discardableResult
+    mutating func cancel(messageID: String) -> Bool {
+        guard let workItem = relays.removeValue(forKey: messageID) else {
+            return false
+        }
+
+        workItem.cancel()
+        return true
+    }
+
+    mutating func cancelAll() {
+        relays.values.forEach { $0.cancel() }
+        relays.removeAll()
+    }
+
+    mutating func removeAllIfOverCapacity(_ maxCount: Int) {
+        if relays.count > maxCount {
+            relays.removeAll()
+        }
+    }
+}

bitchat/Services/BLE/BLESelfBroadcastTracker.swift

@@ -0,0 +1,40 @@
+import BitFoundation
+import Foundation
+
+struct BLESelfBroadcastTracker {
+    private struct Entry {
+        let messageID: String
+        let sentAt: Date
+    }
+
+    private var entriesByDedupID: [String: Entry] = [:]
+
+    var isEmpty: Bool {
+        entriesByDedupID.isEmpty
+    }
+
+    var count: Int {
+        entriesByDedupID.count
+    }
+
+    mutating func record(messageID: String, packet: BitchatPacket, sentAt: Date) {
+        entriesByDedupID[Self.dedupID(for: packet)] = Entry(messageID: messageID, sentAt: sentAt)
+    }
+
+    mutating func takeMessageID(for packet: BitchatPacket) -> String? {
+        entriesByDedupID.removeValue(forKey: Self.dedupID(for: packet))?.messageID
+    }
+
+    mutating func prune(before cutoff: Date) {
+        guard !entriesByDedupID.isEmpty else { return }
+        entriesByDedupID = entriesByDedupID.filter { cutoff <= $0.value.sentAt }
+    }
+
+    mutating func removeAll() {
+        entriesByDedupID.removeAll()
+    }
+
+    static func dedupID(for packet: BitchatPacket) -> String {
+        "\(packet.senderID.hexEncodedString())-\(packet.timestamp)-\(packet.type)"
+    }
+}

bitchat/Services/BLE/BLESubscriptionAnnounceLimiter.swift

@@ -0,0 +1,71 @@
+import Foundation
+
+enum BLESubscriptionAnnounceDecision: Equatable {
+    case allowed
+    case rateLimited(backoffSeconds: TimeInterval, attemptCount: Int, suppressAnnounce: Bool)
+}
+
+struct BLESubscriptionAnnounceLimiter {
+    private struct State {
+        var lastAnnounceTime: Date
+        var attemptCount: Int
+        var currentBackoffSeconds: TimeInterval
+    }
+
+    private var states: [String: State] = [:]
+
+    var trackedCentralCount: Int {
+        states.count
+    }
+
+    mutating func removeAll() {
+        states.removeAll()
+    }
+
+    mutating func decision(for centralID: String, now: Date) -> BLESubscriptionAnnounceDecision {
+        pruneStaleEntries(now: now)
+
+        guard let existing = states[centralID] else {
+            recordAllowedAttempt(for: centralID, now: now)
+            return .allowed
+        }
+
+        let timeSinceLastAnnounce = now.timeIntervalSince(existing.lastAnnounceTime)
+        guard timeSinceLastAnnounce < existing.currentBackoffSeconds else {
+            recordAllowedAttempt(for: centralID, now: now)
+            return .allowed
+        }
+
+        let newAttemptCount = existing.attemptCount + 1
+        let newBackoff = min(
+            existing.currentBackoffSeconds * TransportConfig.bleSubscriptionRateLimitBackoffFactor,
+            TransportConfig.bleSubscriptionRateLimitMaxBackoffSeconds
+        )
+        states[centralID] = State(
+            lastAnnounceTime: now,
+            attemptCount: newAttemptCount,
+            currentBackoffSeconds: newBackoff
+        )
+
+        return .rateLimited(
+            backoffSeconds: existing.currentBackoffSeconds,
+            attemptCount: existing.attemptCount,
+            suppressAnnounce: newAttemptCount >= TransportConfig.bleSubscriptionRateLimitMaxAttempts
+        )
+    }
+
+    private mutating func recordAllowedAttempt(for centralID: String, now: Date) {
+        states[centralID] = State(
+            lastAnnounceTime: now,
+            attemptCount: 1,
+            currentBackoffSeconds: TransportConfig.bleSubscriptionRateLimitMinSeconds
+        )
+    }
+
+    private mutating func pruneStaleEntries(now: Date) {
+        let windowSeconds = TransportConfig.bleSubscriptionRateLimitWindowSeconds
+        states = states.filter { _, state in
+            now.timeIntervalSince(state.lastAnnounceTime) < windowSeconds
+        }
+    }
+}

bitchat/Services/CommandProcessor.swift

@@ -6,7 +6,6 @@
 // This is free and unencumbered software released into the public domain.
 //
 
-import Nostr
 import Foundation
 import BitFoundation
 
@@ -29,6 +28,7 @@ struct CommandGeoParticipant {
 protocol CommandContextProvider: AnyObject {
     // MARK: - State Properties
     var nickname: String { get }
+    var activeChannel: ChannelID { get }
     var selectedPrivateChatPeer: PeerID? { get }
     var blockedUsers: Set<String> { get }
     var privateChats: [PeerID: [BitchatMessage]] { get set }
@@ -76,7 +76,7 @@ final class CommandProcessor {
         
         // Geohash context: disable favoriting in public geohash or GeoDM
         let inGeoPublic: Bool = {
-            switch LocationChannelManager.shared.selectedChannel {
+            switch contextProvider?.activeChannel ?? .mesh {
             case .mesh: return false
             case .location: return true
             }
@@ -136,7 +136,7 @@ final class CommandProcessor {
     
     private func handleWho() -> CommandResult {
         // Show geohash participants when in a geohash channel; otherwise mesh peers
-        switch LocationChannelManager.shared.selectedChannel {
+        switch contextProvider?.activeChannel ?? .mesh {
         case .location(let ch):
             // Geohash context: show visible geohash participants (exclude self)
             guard let vm = contextProvider else { return .success(message: "nobody around") }

bitchat/Services/GeohashPresenceService.swift

@@ -8,7 +8,6 @@
 // This is free and unencumbered software released into the public domain.
 //
 
-import Nostr
 import Foundation
 import Combine
 import BitLogger
@@ -75,7 +74,7 @@ final class GeohashPresenceService: ObservableObject {
     ]
 
     private init() {
-        let idBridge = NostrIdentityBridge(keychain: KeychainManager())
+        let idBridge = NostrIdentityBridge()
         self.availableChannelsProvider = { LocationStateManager.shared.availableChannels }
         self.locationChanges = LocationStateManager.shared.$availableChannels.eraseToAnyPublisher()
         self.torReadyPublisher = NotificationCenter.default.publisher(for: .TorDidBecomeReady)

bitchat/Services/KeychainManager.swift

@@ -7,78 +7,10 @@
 //
 
 import BitLogger
-import protocol Nostr.NostrKeychainStoring
-import protocol Noise.SecureMemoryCleaner
+import BitFoundation
 import Foundation
 import Security
 
-// MARK: - Keychain Error Types
-// BCH-01-009: Proper error classification to distinguish expected states from critical failures
-
-/// Result of a keychain read operation with proper error classification
-enum KeychainReadResult {
-    case success(Data)
-    case itemNotFound        // Expected: key doesn't exist yet
-    case accessDenied        // Critical: app lacks keychain access
-    case deviceLocked        // Recoverable: device is locked
-    case authenticationFailed // Recoverable: biometric/passcode failed
-    case otherError(OSStatus) // Unexpected error
-
-    var isRecoverableError: Bool {
-        switch self {
-        case .deviceLocked, .authenticationFailed:
-            return true
-        default:
-            return false
-        }
-    }
-}
-
-/// Result of a keychain save operation with proper error classification
-enum KeychainSaveResult {
-    case success
-    case duplicateItem       // Can retry with update
-    case accessDenied        // Critical: app lacks keychain access
-    case deviceLocked        // Recoverable: device is locked
-    case storageFull         // Critical: no space available
-    case otherError(OSStatus)
-
-    var isRecoverableError: Bool {
-        switch self {
-        case .duplicateItem, .deviceLocked:
-            return true
-        default:
-            return false
-        }
-    }
-}
-
-protocol KeychainManagerProtocol: SecureMemoryCleaner, NostrKeychainStoring {
-    func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool
-    func getIdentityKey(forKey key: String) -> Data?
-    func deleteIdentityKey(forKey key: String) -> Bool
-    func deleteAllKeychainData() -> Bool
-
-    func secureClear(_ data: inout Data)
-    func secureClear(_ string: inout String)
-
-    func verifyIdentityKeyExists() -> Bool
-
-    // BCH-01-009: Methods with proper error classification
-    /// Get identity key with detailed result for error handling
-    func getIdentityKeyWithResult(forKey key: String) -> KeychainReadResult
-    /// Save identity key with detailed result for error handling
-    func saveIdentityKeyWithResult(_ keyData: Data, forKey key: String) -> KeychainSaveResult
-
-    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
-    /// Save data with a custom service name
-    func save(key: String, data: Data, service: String, accessible: CFString?)
-    /// Load data from a custom service
-    func load(key: String, service: String) -> Data?
-    /// Delete data from a custom service
-    func delete(key: String, service: String)
-}
-
 final class KeychainManager: KeychainManagerProtocol {
     // Use consistent service name for all keychain items
     private let service = BitchatApp.bundleID

bitchat/Services/LocationNotesManager.swift

@@ -1,5 +1,4 @@
 import BitLogger
-import Nostr
 import Foundation
 
 /// Dependencies for location notes, allowing tests to stub relay/identity behavior.
@@ -16,7 +15,7 @@ struct LocationNotesDependencies {
     var deriveIdentity: (_ geohash: String) throws -> NostrIdentity
     var now: () -> Date
     
-    private static let idBridge = NostrIdentityBridge(keychain: KeychainManager())
+    private static let idBridge = NostrIdentityBridge()
 
     static let live = LocationNotesDependencies(
         relayLookup: { geohash, count in

bitchat/Services/MessageFormattingEngine.swift

@@ -255,9 +255,8 @@ final class MessageFormattingEngine {
         isSelf: Bool,
         isMentioned: Bool
     ) -> AttributedString {
-        // For very long content without special tokens, use plain formatting
-        let containsCashu = containsCashuToken(content)
-        if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashu {
+        // For very long content, use plain formatting to avoid expensive regex and detector work.
+        if content.isOversizedForRichFormatting() {
             return formatPlainContent(content, baseColor: baseColor, isSelf: isSelf)
         }
 

bitchat/Services/NetworkActivationService.swift

@@ -1,4 +1,3 @@
-import Nostr
 import Foundation
 import BitLogger
 import Combine

bitchat/Services/NoiseEncryptionService.swift

@@ -84,7 +84,6 @@
 
 import BitLogger
 import BitFoundation
-import Noise
 import Foundation
 import CryptoKit
 

bitchat/Services/NostrTransport.swift

@@ -1,6 +1,5 @@
 import BitLogger
 import BitFoundation
-import Nostr
 import Foundation
 import Combine
 
@@ -107,6 +106,7 @@ final class NostrTransport: Transport, @unchecked Sendable {
     // MARK: - Transport Protocol Conformance
 
     weak var delegate: BitchatDelegate?
+    weak var eventDelegate: TransportEventDelegate?
     weak var peerEventsDelegate: TransportPeerEventsDelegate?
 
     var peerSnapshotPublisher: AnyPublisher<[TransportPeerSnapshot], Never> {
@@ -174,9 +174,9 @@ final class NostrTransport: Transport, @unchecked Sendable {
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
         // Enqueue and process with throttling to avoid relay rate limits
         // Use barrier to synchronize access to readQueue
-        queue.async(flags: .barrier) { [weak self] in
-            self?.readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
-            self?.processReadQueueIfNeeded()
+        queue.async(flags: .barrier) {
+            self.readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
+            self.processReadQueueIfNeeded()
         }
     }
 

bitchat/Services/NotificationStreamAssembler.swift

@@ -7,6 +7,7 @@
 //
 
 import BitLogger
+import BitFoundation
 import Foundation
 
 struct NotificationStreamAssembler {
@@ -20,6 +21,19 @@ struct NotificationStreamAssembler {
         pendingFrameExpectedLength = 0
     }
 
+    private mutating func discardLeadingPaddingIfPresent() -> Bool {
+        guard let first = buffer.first else { return false }
+        guard first != 1 && first != 2 else { return false }
+        let paddingLength = Int(first)
+        guard paddingLength > 0, paddingLength <= buffer.count else { return false }
+        guard buffer.prefix(paddingLength).allSatisfy({ $0 == first }) else { return false }
+
+        buffer.removeFirst(paddingLength)
+        pendingFrameStartedAt = nil
+        pendingFrameExpectedLength = 0
+        return true
+    }
+
     mutating func append(_ chunk: Data) -> (frames: [Data], droppedPrefixes: [UInt8], reset: Bool) {
         guard !chunk.isEmpty else { return ([], [], false) }
 
@@ -41,6 +55,9 @@ struct NotificationStreamAssembler {
         while buffer.count >= minimumFramePrefix {
             guard let version = buffer.first else { break }
             guard version == 1 || version == 2 else {
+                if discardLeadingPaddingIfPresent() {
+                    continue
+                }
                 dropped.append(buffer.removeFirst())
                 pendingFrameStartedAt = nil
                 pendingFrameExpectedLength = 0
@@ -132,6 +149,11 @@ struct NotificationStreamAssembler {
             let frame = Data(buffer.prefix(frameLength))
             frames.append(frame)
             buffer.removeFirst(frameLength)
+            _ = discardLeadingPaddingIfPresent()
+        }
+
+        if discardLeadingPaddingIfPresent() {
+            return (frames, dropped, didReset)
         }
 
         if !buffer.isEmpty, buffer.allSatisfy({ $0 == 0 }) {

bitchat/Services/RelayController.swift

@@ -11,6 +11,7 @@ struct RelayDecision {
 struct RelayController {
     static func decide(ttl: UInt8,
                        senderIsSelf: Bool,
+                       recipientIsSelf: Bool = false,
                        isEncrypted: Bool,
                        isDirectedEncrypted: Bool,
                        isFragment: Bool,
@@ -22,7 +23,7 @@ struct RelayController {
         let ttlCap = min(ttl, TransportConfig.messageTTLDefault)
 
         // Suppress obvious non-relays
-        if ttlCap <= 1 || senderIsSelf {
+        if ttlCap <= 1 || senderIsSelf || recipientIsSelf {
             return RelayDecision(shouldRelay: false, newTTL: ttlCap, delayMs: 0)
         }
 

bitchat/Services/Transport.swift

@@ -1,6 +1,7 @@
 import BitFoundation
 import Foundation
 import Combine
+import CoreBluetooth
 
 /// Abstract transport interface used by ChatViewModel and services.
 /// BLEService implements this protocol; a future Nostr transport can too.
@@ -12,9 +13,27 @@ struct TransportPeerSnapshot: Equatable, Hashable {
     let lastSeen: Date
 }
 
+enum TransportEvent: @unchecked Sendable {
+    case messageReceived(BitchatMessage)
+    case publicMessageReceived(peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?)
+    case noisePayloadReceived(peerID: PeerID, type: NoisePayloadType, payload: Data, timestamp: Date)
+    case peerConnected(PeerID)
+    case peerDisconnected(PeerID)
+    case peerListUpdated([PeerID])
+    case peerSnapshotsUpdated([TransportPeerSnapshot])
+    case messageDeliveryStatusUpdated(messageID: String, status: DeliveryStatus)
+    case bluetoothStateUpdated(CBManagerState)
+}
+
+protocol TransportEventDelegate: AnyObject {
+    @MainActor func didReceiveTransportEvent(_ event: TransportEvent)
+}
+
 protocol Transport: AnyObject {
     // Event sink
     var delegate: BitchatDelegate? { get set }
+    // Typed event sink for transport-domain events. Prefer this over BitchatDelegate for new code.
+    var eventDelegate: TransportEventDelegate? { get set }
     // Peer events (preferred over publishers for UI)
     var peerEventsDelegate: TransportPeerEventsDelegate? { get set }
     
@@ -84,4 +103,36 @@ protocol TransportPeerEventsDelegate: AnyObject {
     @MainActor func didUpdatePeerSnapshots(_ peers: [TransportPeerSnapshot])
 }
 
+extension BitchatDelegate {
+    @MainActor
+    func receiveTransportEvent(_ event: TransportEvent) {
+        switch event {
+        case .messageReceived(let message):
+            didReceiveMessage(message)
+        case let .publicMessageReceived(peerID, nickname, content, timestamp, messageID):
+            didReceivePublicMessage(
+                from: peerID,
+                nickname: nickname,
+                content: content,
+                timestamp: timestamp,
+                messageID: messageID
+            )
+        case let .noisePayloadReceived(peerID, type, payload, timestamp):
+            didReceiveNoisePayload(from: peerID, type: type, payload: payload, timestamp: timestamp)
+        case .peerConnected(let peerID):
+            didConnectToPeer(peerID)
+        case .peerDisconnected(let peerID):
+            didDisconnectFromPeer(peerID)
+        case .peerListUpdated(let peers):
+            didUpdatePeerList(peers)
+        case .peerSnapshotsUpdated:
+            break
+        case let .messageDeliveryStatusUpdated(messageID, status):
+            didUpdateMessageDeliveryStatus(messageID, status: status)
+        case .bluetoothStateUpdated(let state):
+            didUpdateBluetoothState(state)
+        }
+    }
+}
+
 extension BLEService: Transport {}

bitchat/Services/TransportConfig.swift

@@ -133,9 +133,6 @@ enum TransportConfig {
     static let nostrShortKeyDisplayLength: Int = 8
     static let nostrConvKeyPrefixLength: Int = 16
 
-    // Compression
-    static let compressionThresholdBytes: Int = 100
-
     // Message deduplication
     static let messageDedupMaxAgeSeconds: TimeInterval = 300
     static let messageDedupMaxCount: Int = 1000

bitchat/Services/UnifiedPeerService.swift

@@ -8,7 +8,6 @@
 
 import BitLogger
 import BitFoundation
-import Nostr
 import Foundation
 import Combine
 import SwiftUI

bitchat/Sync/GossipSyncManager.swift

@@ -128,17 +128,15 @@ final class GossipSyncManager {
     func scheduleInitialSyncToPeer(_ peerID: PeerID, delaySeconds: TimeInterval = 5.0) {
         queue.asyncAfter(deadline: .now() + delaySeconds) { [weak self] in
             guard let self = self else { return }
-            self.sendRequestSync(to: peerID, types: .publicMessages)
+
+            var types: SyncTypeFlags = .publicMessages
             if self.config.fragmentCapacity > 0 && self.config.fragmentSyncIntervalSeconds > 0 {
-                self.queue.asyncAfter(deadline: .now() + 0.5) { [weak self] in
-                    self?.sendRequestSync(to: peerID, types: .fragment)
-                }
+                types.formUnion(.fragment)
             }
             if self.config.fileTransferCapacity > 0 && self.config.fileTransferSyncIntervalSeconds > 0 {
-                self.queue.asyncAfter(deadline: .now() + 1.0) { [weak self] in
-                    self?.sendRequestSync(to: peerID, types: .fileTransfer)
-                }
+                types.formUnion(.fileTransfer)
             }
+            self.sendRequestSync(to: peerID, types: types)
         }
     }
 
@@ -393,13 +391,18 @@ final class GossipSyncManager {
         cleanupStaleAnnouncementsIfNeeded(now: now)
         requestSyncManager.cleanup() // Cleanup expired sync requests
         
+        var dueTypes: SyncTypeFlags = []
         for index in syncSchedules.indices {
             guard syncSchedules[index].interval > 0 else { continue }
             if syncSchedules[index].lastSent == .distantPast || now.timeIntervalSince(syncSchedules[index].lastSent) >= syncSchedules[index].interval {
                 syncSchedules[index].lastSent = now
-                sendPeriodicSync(for: syncSchedules[index].types)
+                dueTypes.formUnion(syncSchedules[index].types)
             }
         }
+
+        if !dueTypes.isEmpty {
+            sendPeriodicSync(for: dueTypes)
+        }
     }
 
     private func cleanupStaleAnnouncementsIfNeeded(now: Date) {

bitchat/Sync/PacketIdUtil.swift

@@ -1,3 +1,4 @@
+import struct BitFoundation.BitchatPacket
 import Foundation
 import CryptoKit
 

bitchat/Sync/SyncTypeFlags.swift

@@ -1,3 +1,4 @@
+import BitFoundation
 import Foundation
 
 /// Bitfield describing which message types are covered by a REQUEST_SYNC round.

bitchat/ViewModels/ChatBluetoothAlertPolicy.swift

@@ -0,0 +1,35 @@
+import CoreBluetooth
+import Foundation
+
+struct ChatBluetoothAlertUpdate: Equatable {
+    let isPresented: Bool
+    let message: String?
+}
+
+enum ChatBluetoothAlertPolicy {
+    static func update(for state: CBManagerState) -> ChatBluetoothAlertUpdate {
+        switch state {
+        case .poweredOff:
+            ChatBluetoothAlertUpdate(
+                isPresented: true,
+                message: String(localized: "content.alert.bluetooth_required.off", comment: "Message shown when Bluetooth is turned off")
+            )
+        case .unauthorized:
+            ChatBluetoothAlertUpdate(
+                isPresented: true,
+                message: String(localized: "content.alert.bluetooth_required.permission", comment: "Message shown when Bluetooth permission is missing")
+            )
+        case .unsupported:
+            ChatBluetoothAlertUpdate(
+                isPresented: true,
+                message: String(localized: "content.alert.bluetooth_required.unsupported", comment: "Message shown when the device lacks Bluetooth support")
+            )
+        case .poweredOn:
+            ChatBluetoothAlertUpdate(isPresented: false, message: "")
+        case .unknown, .resetting:
+            ChatBluetoothAlertUpdate(isPresented: false, message: nil)
+        @unknown default:
+            ChatBluetoothAlertUpdate(isPresented: false, message: nil)
+        }
+    }
+}

bitchat/ViewModels/ChatComposerCoordinator.swift

@@ -0,0 +1,92 @@
+import BitFoundation
+import Foundation
+
+@MainActor
+final class ChatComposerCoordinator {
+    private unowned let viewModel: ChatViewModel
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    func updateAutocomplete(for text: String, cursorPosition: Int) {
+        let peerCandidates = autocompleteCandidates()
+        let (suggestions, range) = viewModel.autocompleteService.getSuggestions(
+            for: text,
+            peers: peerCandidates,
+            cursorPosition: cursorPosition
+        )
+
+        if !suggestions.isEmpty {
+            viewModel.autocompleteSuggestions = suggestions
+            viewModel.autocompleteRange = range
+            viewModel.showAutocomplete = true
+            viewModel.selectedAutocompleteIndex = 0
+        } else {
+            viewModel.autocompleteSuggestions = []
+            viewModel.autocompleteRange = nil
+            viewModel.showAutocomplete = false
+            viewModel.selectedAutocompleteIndex = 0
+        }
+    }
+
+    func completeNickname(_ nickname: String, in text: inout String) -> Int {
+        guard let range = viewModel.autocompleteRange else { return text.count }
+
+        text = viewModel.autocompleteService.applySuggestion(nickname, to: text, range: range)
+
+        viewModel.showAutocomplete = false
+        viewModel.autocompleteSuggestions = []
+        viewModel.autocompleteRange = nil
+        viewModel.selectedAutocompleteIndex = 0
+
+        return range.location + nickname.count + (nickname.hasPrefix("@") ? 1 : 2)
+    }
+
+    func parseMentions(from content: String) -> [String] {
+        let regex = ChatViewModel.Patterns.mention
+        let nsContent = content as NSString
+        let matches = regex.matches(
+            in: content,
+            options: [],
+            range: NSRange(location: 0, length: nsContent.length)
+        )
+
+        let peerNicknames = viewModel.meshService.getPeerNicknames()
+        var validTokens = Set(peerNicknames.values)
+        validTokens.insert(viewModel.nickname)
+        validTokens.insert(viewModel.nickname + "#" + String(viewModel.meshService.myPeerID.id.prefix(4)))
+
+        var mentions: [String] = []
+        for match in matches {
+            guard let range = Range(match.range(at: 1), in: content) else { continue }
+            let mentionedName = String(content[range])
+            if validTokens.contains(mentionedName) {
+                mentions.append(mentionedName)
+            }
+        }
+
+        return Array(Set(mentions))
+    }
+}
+
+private extension ChatComposerCoordinator {
+    func autocompleteCandidates() -> [String] {
+        switch viewModel.activeChannel {
+        case .mesh:
+            let values = viewModel.meshService.getPeerNicknames().values
+            return Array(values.filter { $0 != viewModel.meshService.myNickname })
+
+        case .location(let channel):
+            var tokens = Set<String>()
+            for (pubkey, nick) in viewModel.geoNicknames {
+                tokens.insert("\(nick)#\(pubkey.suffix(4))")
+            }
+            if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                let myToken = viewModel.nickname + "#" + String(identity.publicKeyHex.suffix(4))
+                tokens.remove(myToken)
+            }
+            return Array(tokens)
+        }
+    }
+}

bitchat/ViewModels/ChatDeliveryCoordinator.swift

@@ -0,0 +1,107 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+final class ChatDeliveryCoordinator {
+    private unowned let viewModel: ChatViewModel
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    @MainActor
+    func cleanupOldReadReceipts() {
+        guard !viewModel.isStartupPhase, !viewModel.privateChats.isEmpty else {
+            return
+        }
+
+        let validMessageIDs = Set(
+            viewModel.privateChats.values.flatMap { messages in
+                messages.map(\.id)
+            }
+        )
+
+        let oldCount = viewModel.sentReadReceipts.count
+        viewModel.sentReadReceipts = viewModel.sentReadReceipts.intersection(validMessageIDs)
+
+        let removedCount = oldCount - viewModel.sentReadReceipts.count
+        if removedCount > 0 {
+            SecureLogger.debug("🧹 Cleaned up \(removedCount) old read receipts", category: .session)
+        }
+    }
+
+    @MainActor
+    func didReceiveReadReceipt(_ receipt: ReadReceipt) {
+        updateMessageDeliveryStatus(
+            receipt.originalMessageID,
+            status: .read(by: receipt.readerNickname, at: receipt.timestamp)
+        )
+    }
+
+    @MainActor
+    func didUpdateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) {
+        updateMessageDeliveryStatus(messageID, status: status)
+    }
+
+    @MainActor
+    func deliveryStatus(for messageID: String) -> DeliveryStatus? {
+        if let message = viewModel.messages.first(where: { $0.id == messageID }) {
+            return message.deliveryStatus
+        }
+
+        for messages in viewModel.privateChats.values {
+            if let message = messages.first(where: { $0.id == messageID }) {
+                return message.deliveryStatus
+            }
+        }
+
+        return nil
+    }
+
+    @MainActor
+    @discardableResult
+    func updateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) -> Bool {
+        var didUpdateStatus = false
+
+        if let index = viewModel.messages.firstIndex(where: { $0.id == messageID }) {
+            let currentStatus = viewModel.messages[index].deliveryStatus
+            if !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) {
+                viewModel.messages[index].deliveryStatus = status
+                didUpdateStatus = true
+            }
+        }
+
+        var privateChats = viewModel.privateChats
+        for (peerID, chatMessages) in privateChats {
+            guard let index = chatMessages.firstIndex(where: { $0.id == messageID }) else { continue }
+
+            let currentStatus = chatMessages[index].deliveryStatus
+            guard !shouldSkipUpdate(currentStatus: currentStatus, newStatus: status) else { continue }
+
+            let updatedMessages = chatMessages
+            updatedMessages[index].deliveryStatus = status
+            privateChats[peerID] = updatedMessages
+            didUpdateStatus = true
+        }
+
+        if didUpdateStatus {
+            viewModel.privateChats = privateChats
+            viewModel.objectWillChange.send()
+        }
+
+        return didUpdateStatus
+    }
+}
+
+private extension ChatDeliveryCoordinator {
+    func shouldSkipUpdate(currentStatus: DeliveryStatus?, newStatus: DeliveryStatus) -> Bool {
+        guard let currentStatus else { return false }
+
+        switch (currentStatus, newStatus) {
+        case (.read, .delivered), (.read, .sent):
+            return true
+        default:
+            return false
+        }
+    }
+}

bitchat/ViewModels/ChatFavoriteTogglePolicy.swift

@@ -0,0 +1,67 @@
+import Foundation
+
+struct ChatFavoriteStatusSnapshot: Equatable {
+    let peerNickname: String
+    let peerNostrPublicKey: String?
+    let isFavorite: Bool
+    let theyFavoritedUs: Bool
+
+    init(
+        peerNickname: String,
+        peerNostrPublicKey: String?,
+        isFavorite: Bool,
+        theyFavoritedUs: Bool
+    ) {
+        self.peerNickname = peerNickname
+        self.peerNostrPublicKey = peerNostrPublicKey
+        self.isFavorite = isFavorite
+        self.theyFavoritedUs = theyFavoritedUs
+    }
+
+    init(_ relationship: FavoritesPersistenceService.FavoriteRelationship) {
+        self.peerNickname = relationship.peerNickname
+        self.peerNostrPublicKey = relationship.peerNostrPublicKey
+        self.isFavorite = relationship.isFavorite
+        self.theyFavoritedUs = relationship.theyFavoritedUs
+    }
+}
+
+enum ChatFavoritePersistenceAction: Equatable {
+    case add(nickname: String, nostrKey: String?)
+    case remove
+}
+
+enum ChatFavoriteNotificationDecision: Equatable {
+    case none
+    case send(isFavorite: Bool)
+}
+
+struct ChatFavoriteTogglePlan: Equatable {
+    let persistenceAction: ChatFavoritePersistenceAction
+    let notification: ChatFavoriteNotificationDecision
+}
+
+enum ChatFavoriteTogglePolicy {
+    static func plan(
+        currentStatus: ChatFavoriteStatusSnapshot?,
+        fallbackNickname: String?,
+        bridgedNostrKey: String?
+    ) -> ChatFavoriteTogglePlan {
+        let wasFavorite = currentStatus?.isFavorite ?? false
+
+        if wasFavorite {
+            return ChatFavoriteTogglePlan(
+                persistenceAction: .remove,
+                notification: .send(isFavorite: false)
+            )
+        }
+
+        return ChatFavoriteTogglePlan(
+            persistenceAction: .add(
+                nickname: currentStatus?.peerNickname ?? fallbackNickname ?? "Unknown",
+                nostrKey: currentStatus?.peerNostrPublicKey ?? bridgedNostrKey
+            ),
+            notification: currentStatus?.theyFavoritedUs == true ? .send(isFavorite: true) : .none
+        )
+    }
+}

bitchat/ViewModels/ChatLifecycleCoordinator.swift

@@ -0,0 +1,260 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+@MainActor
+final class ChatLifecycleCoordinator {
+    private unowned let viewModel: ChatViewModel
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    func handleDidBecomeActive() {
+        if let bleService = viewModel.meshService as? BLEService {
+            let currentState = bleService.getCurrentBluetoothState()
+            viewModel.updateBluetoothState(currentState)
+        }
+
+        guard let peerID = viewModel.selectedPrivateChatPeer else { return }
+
+        markPrivateMessagesAsRead(from: peerID)
+
+        let viewModel = self.viewModel
+        DispatchQueue.main.asyncAfter(deadline: .now() + TransportConfig.uiAnimationMediumSeconds) { [weak viewModel] in
+            Task { @MainActor in
+                viewModel?.markPrivateMessagesAsRead(from: peerID)
+            }
+        }
+    }
+
+    func handleScreenshotCaptured() {
+        let screenshotMessage = "* \(viewModel.nickname) took a screenshot *"
+
+        if let peerID = viewModel.selectedPrivateChatPeer {
+            sendPrivateScreenshotNotificationIfPossible(
+                screenshotMessage,
+                to: peerID
+            )
+            appendPrivateScreenshotNotice(for: peerID)
+            return
+        }
+
+        switch viewModel.activeChannel {
+        case .mesh:
+            viewModel.meshService.sendMessage(
+                screenshotMessage,
+                mentions: [],
+                messageID: UUID().uuidString,
+                timestamp: Date()
+            )
+
+        case .location(let channel):
+            sendPublicGeohashScreenshotMessage(
+                screenshotMessage,
+                channel: channel
+            )
+        }
+
+        viewModel.addSystemMessage("you took a screenshot")
+    }
+
+    func saveIdentityState() {
+        viewModel.identityManager.forceSave()
+        _ = viewModel.keychain.verifyIdentityKeyExists()
+    }
+
+    func applicationWillTerminate() {
+        viewModel.meshService.stopServices()
+        saveIdentityState()
+    }
+
+    func markPrivateMessagesAsRead(from peerID: PeerID) {
+        viewModel.privateChatManager.markAsRead(from: peerID)
+        viewModel.synchronizePrivateConversationStore()
+
+        if peerID.isGeoDM,
+           let recipientHex = viewModel.nostrKeyMapping[peerID],
+           case .location(let channel) = viewModel.activeChannel,
+           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            let messages = viewModel.privateChats[peerID] ?? []
+            for message in messages where message.senderPeerID == peerID && !message.isRelay {
+                guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
+
+                SecureLogger.debug(
+                    "GeoDM: sending READ for mid=\(message.id.prefix(8))… to=\(recipientHex.prefix(8))…",
+                    category: .session
+                )
+                let nostrTransport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                nostrTransport.senderPeerID = viewModel.meshService.myPeerID
+                nostrTransport.sendReadReceiptGeohash(
+                    message.id,
+                    toRecipientHex: recipientHex,
+                    from: identity
+                )
+                viewModel.sentReadReceipts.insert(message.id)
+            }
+            return
+        }
+
+        var noiseKeyHex: PeerID?
+        var peerNostrPubkey: String?
+
+        if let noiseKey = Data(hexString: peerID.id),
+           let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey) {
+            noiseKeyHex = peerID
+            peerNostrPubkey = favoriteStatus.peerNostrPublicKey
+        } else if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+            noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
+            let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: peer.noisePublicKey)
+            peerNostrPubkey = favoriteStatus?.peerNostrPublicKey
+
+            if let noiseKeyHex, viewModel.unreadPrivateMessages.contains(noiseKeyHex) {
+                viewModel.unreadPrivateMessages.remove(noiseKeyHex)
+            }
+        }
+
+        guard peerNostrPubkey != nil else { return }
+
+        for message in getPrivateChatMessages(for: peerID) {
+            guard (message.senderPeerID == peerID || message.senderPeerID == noiseKeyHex) && !message.isRelay else {
+                continue
+            }
+
+            guard !viewModel.sentReadReceipts.contains(message.id) else { continue }
+
+            let receipt = ReadReceipt(
+                originalMessageID: message.id,
+                readerID: viewModel.meshService.myPeerID,
+                readerNickname: viewModel.nickname
+            )
+            let recipientPeerID = peerID.isHex
+                ? peerID
+                : (viewModel.unifiedPeerService.getPeer(by: peerID)?.peerID ?? peerID)
+
+            viewModel.messageRouter.sendReadReceipt(receipt, to: recipientPeerID)
+            viewModel.sentReadReceipts.insert(message.id)
+        }
+    }
+
+    func getMessages(for peerID: PeerID?) -> [BitchatMessage] {
+        guard let peerID else { return viewModel.messages }
+        return getPrivateChatMessages(for: peerID)
+    }
+
+    func getPrivateChatMessages(for peerID: PeerID) -> [BitchatMessage] {
+        var combined: [BitchatMessage] = []
+
+        if let ephemeralMessages = viewModel.privateChats[peerID] {
+            combined.append(contentsOf: ephemeralMessages)
+        }
+
+        if let peer = viewModel.unifiedPeerService.getPeer(by: peerID) {
+            let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
+            if noiseKeyHex != peerID, let stableMessages = viewModel.privateChats[noiseKeyHex] {
+                combined.append(contentsOf: stableMessages)
+            }
+        }
+
+        var bestByID: [String: BitchatMessage] = [:]
+        for message in combined {
+            if let existing = bestByID[message.id] {
+                let existingRank = deliveryStatusRank(existing.deliveryStatus)
+                let candidateRank = deliveryStatusRank(message.deliveryStatus)
+                if candidateRank > existingRank || (candidateRank == existingRank && message.timestamp > existing.timestamp) {
+                    bestByID[message.id] = message
+                }
+            } else {
+                bestByID[message.id] = message
+            }
+        }
+
+        return bestByID.values.sorted { $0.timestamp < $1.timestamp }
+    }
+}
+
+private extension ChatLifecycleCoordinator {
+    func sendPrivateScreenshotNotificationIfPossible(_ message: String, to peerID: PeerID) {
+        guard let peerNickname = viewModel.meshService.peerNickname(peerID: peerID) else { return }
+
+        let sessionState = viewModel.meshService.getNoiseSessionState(for: peerID)
+        switch sessionState {
+        case .established:
+            viewModel.messageRouter.sendPrivate(
+                message,
+                to: peerID,
+                recipientNickname: peerNickname,
+                messageID: UUID().uuidString
+            )
+
+        case .none, .failed, .handshakeQueued, .handshaking:
+            SecureLogger.debug(
+                "Skipping screenshot notification to \(peerID) - no established session",
+                category: .security
+            )
+        }
+    }
+
+    func appendPrivateScreenshotNotice(for peerID: PeerID) {
+        let notice = BitchatMessage(
+            sender: "system",
+            content: "you took a screenshot",
+            timestamp: Date(),
+            isRelay: false,
+            originalSender: nil,
+            isPrivate: true,
+            recipientNickname: viewModel.meshService.peerNickname(peerID: peerID),
+            senderPeerID: viewModel.meshService.myPeerID
+        )
+
+        var chats = viewModel.privateChats
+        if chats[peerID] == nil {
+            chats[peerID] = []
+        }
+        chats[peerID]?.append(notice)
+        viewModel.privateChats = chats
+    }
+
+    func sendPublicGeohashScreenshotMessage(_ message: String, channel: GeohashChannel) {
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+
+            do {
+                let identity = try viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash)
+                let event = try NostrProtocol.createEphemeralGeohashEvent(
+                    content: message,
+                    geohash: channel.geohash,
+                    senderIdentity: identity,
+                    nickname: viewModel.nickname,
+                    teleported: viewModel.locationManager.teleported
+                )
+
+                let targetRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
+                if targetRelays.isEmpty {
+                    SecureLogger.warning("Geo: no geohash relays available for \(channel.geohash); not sending", category: .session)
+                } else {
+                    NostrRelayManager.shared.sendEvent(event, to: targetRelays)
+                }
+
+                viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+            } catch {
+                SecureLogger.error("❌ Failed to send geohash screenshot message: \(error)", category: .session)
+                viewModel.addSystemMessage(
+                    String(localized: "system.location.send_failed", comment: "System message when a location channel send fails")
+                )
+            }
+        }
+    }
+
+    func deliveryStatusRank(_ status: DeliveryStatus?) -> Int {
+        guard let status else { return 0 }
+        switch status {
+        case .failed: return 1
+        case .sending: return 2
+        case .sent: return 3
+        case .partiallyDelivered: return 4
+        case .delivered: return 5
+        case .read: return 6
+        }
+    }
+}

bitchat/ViewModels/ChatMediaPreparation.swift

@@ -0,0 +1,57 @@
+import BitFoundation
+import Foundation
+
+enum ChatMediaPreparationError: Error, Equatable {
+    case encodingFailed
+    case voiceNoteTooLarge(bytes: Int)
+    case imageTooLarge(bytes: Int)
+}
+
+struct ChatPreparedImage {
+    let outputURL: URL
+    let packet: BitchatFilePacket
+}
+
+enum ChatMediaPreparation {
+    static func prepareVoiceNotePacket(at url: URL) throws -> BitchatFilePacket {
+        let attributes = try FileManager.default.attributesOfItem(atPath: url.path)
+        guard let fileSize = attributes[.size] as? Int else {
+            throw ChatMediaPreparationError.voiceNoteTooLarge(bytes: 0)
+        }
+        guard fileSize <= FileTransferLimits.maxVoiceNoteBytes else {
+            throw ChatMediaPreparationError.voiceNoteTooLarge(bytes: fileSize)
+        }
+
+        let data = try Data(contentsOf: url)
+        let packet = BitchatFilePacket(
+            fileName: url.lastPathComponent,
+            fileSize: UInt64(data.count),
+            mimeType: "audio/mp4",
+            content: data
+        )
+        guard packet.encode() != nil else { throw ChatMediaPreparationError.encodingFailed }
+        return packet
+    }
+
+    static func prepareImagePacket(from sourceURL: URL) throws -> ChatPreparedImage {
+        let outputURL = try ImageUtils.processImage(at: sourceURL)
+        do {
+            let data = try Data(contentsOf: outputURL)
+            guard data.count <= FileTransferLimits.maxImageBytes else {
+                throw ChatMediaPreparationError.imageTooLarge(bytes: data.count)
+            }
+
+            let packet = BitchatFilePacket(
+                fileName: outputURL.lastPathComponent,
+                fileSize: UInt64(data.count),
+                mimeType: "image/jpeg",
+                content: data
+            )
+            guard packet.encode() != nil else { throw ChatMediaPreparationError.encodingFailed }
+            return ChatPreparedImage(outputURL: outputURL, packet: packet)
+        } catch {
+            try? FileManager.default.removeItem(at: outputURL)
+            throw error
+        }
+    }
+}

bitchat/ViewModels/ChatMediaTransferCoordinator.swift

@@ -0,0 +1,297 @@
+import BitFoundation
+import BitLogger
+import Foundation
+
+#if os(iOS)
+import UIKit
+#endif
+
+@MainActor
+final class ChatMediaTransferCoordinator {
+    private unowned let viewModel: ChatViewModel
+
+    private(set) var transferIdToMessageIDs: [String: [String]] = [:]
+    private(set) var messageIDToTransferId: [String: String] = [:]
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    func sendVoiceNote(at url: URL) {
+        guard viewModel.canSendMediaInCurrentContext else {
+            SecureLogger.info("Voice note blocked outside mesh/private context", category: .session)
+            try? FileManager.default.removeItem(at: url)
+            viewModel.addSystemMessage("Voice notes are only available in mesh chats.")
+            return
+        }
+
+        let targetPeer = viewModel.selectedPrivateChatPeer
+        let message = enqueueMediaMessage(
+            content: "\(MimeType.Category.audio.messagePrefix)\(url.lastPathComponent)",
+            targetPeer: targetPeer
+        )
+        let messageID = message.id
+        let transferId = makeTransferID(messageID: messageID)
+
+        Task.detached(priority: .userInitiated) { [weak self] in
+            guard let self else { return }
+            do {
+                let packet = try ChatMediaPreparation.prepareVoiceNotePacket(at: url)
+
+                await MainActor.run {
+                    self.registerTransfer(transferId: transferId, messageID: messageID)
+                    if let peerID = targetPeer {
+                        self.viewModel.meshService.sendFilePrivate(packet, to: peerID, transferId: transferId)
+                    } else {
+                        self.viewModel.meshService.sendFileBroadcast(packet, transferId: transferId)
+                    }
+                }
+            } catch ChatMediaPreparationError.voiceNoteTooLarge(let size) {
+                SecureLogger.warning("Voice note exceeds size limit (\(size) bytes)", category: .session)
+                try? FileManager.default.removeItem(at: url)
+                await MainActor.run {
+                    self.handleMediaSendFailure(messageID: messageID, reason: "Voice note too large")
+                }
+            } catch {
+                SecureLogger.error("Voice note send failed: \(error)", category: .session)
+                await MainActor.run {
+                    self.handleMediaSendFailure(messageID: messageID, reason: "Failed to send voice note")
+                }
+            }
+        }
+    }
+
+    #if os(iOS)
+    func processThenSendImage(_ image: UIImage?) {
+        guard let image else { return }
+        Task.detached { [weak self] in
+            guard let self else { return }
+            do {
+                let processedURL = try ImageUtils.processImage(image)
+                await MainActor.run {
+                    self.sendImage(from: processedURL)
+                }
+            } catch {
+                SecureLogger.error("Image processing failed: \(error)", category: .session)
+            }
+        }
+    }
+    #elseif os(macOS)
+    func processThenSendImage(from url: URL?) {
+        guard let url else { return }
+        Task.detached { [weak self] in
+            guard let self else { return }
+            do {
+                let processedURL = try ImageUtils.processImage(at: url)
+                await MainActor.run {
+                    self.sendImage(from: processedURL)
+                }
+            } catch {
+                SecureLogger.error("Image processing failed: \(error)", category: .session)
+            }
+        }
+    }
+    #endif
+
+    func sendImage(from sourceURL: URL, cleanup: (() -> Void)? = nil) {
+        guard viewModel.canSendMediaInCurrentContext else {
+            SecureLogger.info("Image send blocked outside mesh/private context", category: .session)
+            cleanup?()
+            viewModel.addSystemMessage("Images are only available in mesh chats.")
+            return
+        }
+
+        let targetPeer = viewModel.selectedPrivateChatPeer
+
+        do {
+            try ImageUtils.validateImageSource(at: sourceURL)
+        } catch {
+            SecureLogger.error("Image send preparation failed: \(error)", category: .session)
+            viewModel.addSystemMessage("Failed to prepare image for sending.")
+            return
+        }
+
+        Task.detached(priority: .userInitiated) { [weak self] in
+            guard let self else { return }
+            do {
+                let prepared = try ChatMediaPreparation.prepareImagePacket(from: sourceURL)
+
+                await MainActor.run {
+                    let message = self.enqueueMediaMessage(
+                        content: "\(MimeType.Category.image.messagePrefix)\(prepared.outputURL.lastPathComponent)",
+                        targetPeer: targetPeer
+                    )
+                    let messageID = message.id
+                    let transferId = self.makeTransferID(messageID: messageID)
+                    self.registerTransfer(transferId: transferId, messageID: messageID)
+                    if let peerID = targetPeer {
+                        self.viewModel.meshService.sendFilePrivate(prepared.packet, to: peerID, transferId: transferId)
+                    } else {
+                        self.viewModel.meshService.sendFileBroadcast(prepared.packet, transferId: transferId)
+                    }
+                }
+            } catch ChatMediaPreparationError.imageTooLarge(let size) {
+                SecureLogger.warning("Processed image exceeds size limit (\(size) bytes)", category: .session)
+                await MainActor.run {
+                    self.viewModel.addSystemMessage("Image is too large to send.")
+                }
+            } catch {
+                SecureLogger.error("Image send preparation failed: \(error)", category: .session)
+                await MainActor.run {
+                    self.viewModel.addSystemMessage("Failed to prepare image for sending.")
+                }
+            }
+        }
+    }
+
+    func enqueueMediaMessage(content: String, targetPeer: PeerID?) -> BitchatMessage {
+        let timestamp = Date()
+        let message: BitchatMessage
+
+        if let peerID = targetPeer {
+            message = BitchatMessage(
+                sender: viewModel.nickname,
+                content: content,
+                timestamp: timestamp,
+                isRelay: false,
+                originalSender: nil,
+                isPrivate: true,
+                recipientNickname: viewModel.nicknameForPeer(peerID),
+                senderPeerID: viewModel.meshService.myPeerID,
+                deliveryStatus: .sending
+            )
+            var chats = viewModel.privateChats
+            chats[peerID, default: []].append(message)
+            viewModel.privateChats = chats
+            viewModel.trimMessagesIfNeeded()
+        } else {
+            let (displayName, senderPeerID) = viewModel.currentPublicSender()
+            message = BitchatMessage(
+                sender: displayName,
+                content: content,
+                timestamp: timestamp,
+                isRelay: false,
+                originalSender: nil,
+                isPrivate: false,
+                recipientNickname: nil,
+                senderPeerID: senderPeerID,
+                deliveryStatus: .sending
+            )
+            viewModel.timelineStore.append(message, to: viewModel.activeChannel)
+            viewModel.refreshVisibleMessages(from: viewModel.activeChannel)
+            viewModel.trimMessagesIfNeeded()
+        }
+
+        let key = viewModel.deduplicationService.normalizedContentKey(message.content)
+        viewModel.deduplicationService.recordContentKey(key, timestamp: timestamp)
+        viewModel.objectWillChange.send()
+        return message
+    }
+
+    func registerTransfer(transferId: String, messageID: String) {
+        transferIdToMessageIDs[transferId, default: []].append(messageID)
+        messageIDToTransferId[messageID] = transferId
+    }
+
+    func makeTransferID(messageID: String) -> String {
+        "\(messageID)-\(UUID().uuidString)"
+    }
+
+    func clearTransferMapping(for messageID: String) {
+        guard let transferId = messageIDToTransferId.removeValue(forKey: messageID) else { return }
+        guard var queue = transferIdToMessageIDs[transferId] else { return }
+
+        if !queue.isEmpty {
+            if queue.first == messageID {
+                queue.removeFirst()
+            } else if let index = queue.firstIndex(of: messageID) {
+                queue.remove(at: index)
+            }
+        }
+
+        transferIdToMessageIDs[transferId] = queue.isEmpty ? nil : queue
+    }
+
+    func handleMediaSendFailure(messageID: String, reason: String) {
+        viewModel.updateMessageDeliveryStatus(messageID, status: .failed(reason: reason))
+        clearTransferMapping(for: messageID)
+    }
+
+    func handleTransferEvent(_ event: TransferProgressManager.Event) {
+        switch event {
+        case .started(let id, let total):
+            guard let messageID = transferIdToMessageIDs[id]?.first else { return }
+            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: 0, total: total))
+        case .updated(let id, let sent, let total):
+            guard let messageID = transferIdToMessageIDs[id]?.first else { return }
+            viewModel.updateMessageDeliveryStatus(messageID, status: .partiallyDelivered(reached: sent, total: total))
+        case .completed(let id, _):
+            guard let messageID = transferIdToMessageIDs[id]?.first else { return }
+            viewModel.updateMessageDeliveryStatus(messageID, status: .sent)
+            clearTransferMapping(for: messageID)
+        case .cancelled(let id, _, _):
+            guard let messageID = transferIdToMessageIDs[id]?.first else { return }
+            clearTransferMapping(for: messageID)
+            viewModel.removeMessage(withID: messageID, cleanupFile: true)
+        }
+    }
+
+    func cleanupLocalFile(forMessage message: BitchatMessage) {
+        let categories: [MimeType.Category] = [.audio, .image, .file]
+        guard let category = categories.first(where: { message.content.hasPrefix($0.messagePrefix) }),
+              let rawFilename = String(message.content.dropFirst(category.messagePrefix.count)).trimmedOrNilIfEmpty,
+              let base = try? applicationFilesDirectory(),
+              let safeFilename = (rawFilename as NSString).lastPathComponent.nilIfEmpty,
+              safeFilename != ".",
+              safeFilename != ".." else {
+            return
+        }
+
+        let subdirs = categories.flatMap { ["\($0.mediaDir)/outgoing", "\($0.mediaDir)/incoming"] }
+        for subdir in subdirs {
+            let target = base.appendingPathComponent(subdir, isDirectory: true).appendingPathComponent(safeFilename)
+            guard target.path.hasPrefix(base.path) else { continue }
+
+            do {
+                try FileManager.default.removeItem(at: target)
+            } catch CocoaError.fileNoSuchFile {
+                continue
+            } catch {
+                SecureLogger.error("Failed to cleanup \(safeFilename): \(error)", category: .session)
+            }
+        }
+    }
+
+    func cancelMediaSend(messageID: String) {
+        if let transferId = messageIDToTransferId[messageID],
+           let active = transferIdToMessageIDs[transferId]?.first,
+           active == messageID {
+            viewModel.meshService.cancelTransfer(transferId)
+        }
+        clearTransferMapping(for: messageID)
+        viewModel.removeMessage(withID: messageID, cleanupFile: true)
+    }
+
+    func deleteMediaMessage(messageID: String) {
+        clearTransferMapping(for: messageID)
+        viewModel.removeMessage(withID: messageID, cleanupFile: true)
+    }
+}
+
+private extension ChatMediaTransferCoordinator {
+    func applicationFilesDirectory() throws -> URL {
+        let base = try FileManager.default.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        )
+        let filesDirectory = base.appendingPathComponent("files", isDirectory: true)
+        try FileManager.default.createDirectory(
+            at: filesDirectory,
+            withIntermediateDirectories: true,
+            attributes: nil
+        )
+        return filesDirectory
+    }
+}

bitchat/ViewModels/ChatMessageFormatter.swift

@@ -0,0 +1,498 @@
+import BitFoundation
+import Foundation
+import SwiftUI
+
+@MainActor
+final class ChatMessageFormatter {
+    typealias Patterns = MessageFormattingEngine.Patterns
+
+    private unowned let viewModel: ChatViewModel
+    private let meshPalette = MinimalDistancePalette(config: .mesh)
+    private let nostrPalette = MinimalDistancePalette(config: .nostr)
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    func formatMessageAsText(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        let isSelf: Bool = {
+            if let spid = message.senderPeerID {
+                if case .location(let channel) = viewModel.activeChannel, spid.isGeoChat {
+                    let myGeo: NostrIdentity? = {
+                        if let cached = viewModel.cachedGeohashIdentity, cached.geohash == channel.geohash {
+                            return cached.identity
+                        }
+                        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                            viewModel.cachedGeohashIdentity = (channel.geohash, identity)
+                            return identity
+                        }
+                        return nil
+                    }()
+                    if let myGeo {
+                        return spid == PeerID(nostr: myGeo.publicKeyHex)
+                    }
+                }
+                return spid == viewModel.meshService.myPeerID
+            }
+            if message.sender == viewModel.nickname { return true }
+            if message.sender.hasPrefix(viewModel.nickname + "#") { return true }
+            return false
+        }()
+
+        let isDark = colorScheme == .dark
+        if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf) {
+            return cachedText
+        }
+
+        var result = AttributedString()
+        let baseColor: Color = isSelf ? .orange : peerColor(for: message, isDark: isDark)
+
+        if message.sender != "system" {
+            let (baseName, suffix) = message.sender.splitSuffix()
+            var senderStyle = AttributeContainer()
+            senderStyle.foregroundColor = baseColor
+            let fontWeight: Font.Weight = isSelf ? .bold : .medium
+            senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: .monospaced)
+            if let spid = message.senderPeerID,
+               let url = URL(string: "bitchat://user/\(spid.toPercentEncoded())") {
+                senderStyle.link = url
+            }
+
+            result.append(AttributedString("<@").mergingAttributes(senderStyle))
+            result.append(AttributedString(baseName).mergingAttributes(senderStyle))
+            if !suffix.isEmpty {
+                var suffixStyle = senderStyle
+                suffixStyle.foregroundColor = baseColor.opacity(0.6)
+                result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
+            }
+            result.append(AttributedString("> ").mergingAttributes(senderStyle))
+
+            let content = message.content
+            let nsContent = content as NSString
+            let nsLen = nsContent.length
+            if content.isOversizedForRichFormatting() {
+                var plainStyle = AttributeContainer()
+                plainStyle.foregroundColor = baseColor
+                plainStyle.font = isSelf
+                    ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                    : .bitchatSystem(size: 14, design: .monospaced)
+                result.append(AttributedString(content).mergingAttributes(plainStyle))
+            } else {
+                let hashtagRegex = Patterns.hashtag
+                let mentionRegex = Patterns.mention
+                let cashuRegex = Patterns.cashu
+                let bolt11Regex = Patterns.bolt11
+                let lnurlRegex = Patterns.lnurl
+                let lightningSchemeRegex = Patterns.lightningScheme
+                let detector = Patterns.linkDetector
+                let hasMentionsHint = content.contains("@")
+                let hasHashtagsHint = content.contains("#")
+                let hasURLHint = content.contains("://") || content.contains("www.") || content.contains("http")
+                let hasLightningHint = content.lowercased().contains("ln") || content.lowercased().contains("lightning:")
+                let hasCashuHint = content.lowercased().contains("cashu")
+
+                let hashtagMatches = hasHashtagsHint
+                    ? hashtagRegex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+                let mentionMatches = hasMentionsHint
+                    ? mentionRegex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+                let urlMatches = hasURLHint
+                    ? (detector?.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen)) ?? [])
+                    : []
+                let cashuMatches = hasCashuHint
+                    ? cashuRegex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+                let lightningMatches = hasLightningHint
+                    ? lightningSchemeRegex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+                let bolt11Matches = hasLightningHint
+                    ? bolt11Regex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+                let lnurlMatches = hasLightningHint
+                    ? lnurlRegex.matches(in: content, options: [], range: NSRange(location: 0, length: nsLen))
+                    : []
+
+                let mentionRanges = mentionMatches.map { $0.range(at: 0) }
+                func overlapsMention(_ range: NSRange) -> Bool {
+                    for mentionRange in mentionRanges where NSIntersectionRange(range, mentionRange).length > 0 {
+                        return true
+                    }
+                    return false
+                }
+
+                func attachedToMention(_ range: NSRange) -> Bool {
+                    if let swiftRange = Range(range, in: content), swiftRange.lowerBound > content.startIndex {
+                        var index = content.index(before: swiftRange.lowerBound)
+                        while true {
+                            let character = content[index]
+                            if character.isWhitespace || character.isNewline { break }
+                            if character == "@" { return true }
+                            if index == content.startIndex { break }
+                            index = content.index(before: index)
+                        }
+                    }
+                    return false
+                }
+
+                func isStandaloneHashtag(_ range: NSRange) -> Bool {
+                    guard let swiftRange = Range(range, in: content) else { return false }
+                    if swiftRange.lowerBound == content.startIndex { return true }
+                    let previous = content.index(before: swiftRange.lowerBound)
+                    return content[previous].isWhitespace || content[previous].isNewline
+                }
+
+                var allMatches: [(range: NSRange, type: String)] = []
+                for match in hashtagMatches
+                where !overlapsMention(match.range(at: 0))
+                    && !attachedToMention(match.range(at: 0))
+                    && isStandaloneHashtag(match.range(at: 0)) {
+                    allMatches.append((match.range(at: 0), "hashtag"))
+                }
+                for match in mentionMatches {
+                    allMatches.append((match.range(at: 0), "mention"))
+                }
+                for match in urlMatches where !overlapsMention(match.range) {
+                    allMatches.append((match.range, "url"))
+                }
+                for match in cashuMatches where !overlapsMention(match.range(at: 0)) {
+                    allMatches.append((match.range(at: 0), "cashu"))
+                }
+                for match in lightningMatches where !overlapsMention(match.range(at: 0)) {
+                    allMatches.append((match.range(at: 0), "lightning"))
+                }
+
+                let occupied = urlMatches.map(\.range) + lightningMatches.map { $0.range(at: 0) }
+                func overlapsOccupied(_ range: NSRange) -> Bool {
+                    for occupiedRange in occupied where NSIntersectionRange(range, occupiedRange).length > 0 {
+                        return true
+                    }
+                    return false
+                }
+
+                for match in bolt11Matches
+                where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
+                    allMatches.append((match.range(at: 0), "bolt11"))
+                }
+                for match in lnurlMatches
+                where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
+                    allMatches.append((match.range(at: 0), "lnurl"))
+                }
+                allMatches.sort { $0.range.location < $1.range.location }
+
+                var lastEnd = content.startIndex
+                let isMentioned = message.mentions?.contains(viewModel.nickname) ?? false
+
+                for (range, type) in allMatches {
+                    guard let swiftRange = Range(range, in: content) else { continue }
+
+                    if lastEnd < swiftRange.lowerBound {
+                        let beforeText = String(content[lastEnd..<swiftRange.lowerBound])
+                        if !beforeText.isEmpty {
+                            var beforeStyle = AttributeContainer()
+                            beforeStyle.foregroundColor = baseColor
+                            beforeStyle.font = isSelf
+                                ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                                : .bitchatSystem(size: 14, design: .monospaced)
+                            if isMentioned {
+                                beforeStyle.font = beforeStyle.font?.bold()
+                            }
+                            result.append(AttributedString(beforeText).mergingAttributes(beforeStyle))
+                        }
+                    }
+
+                    let matchText = String(content[swiftRange])
+                    if type == "mention" {
+                        let (mentionBase, mentionSuffix) = matchText.splitSuffix()
+                        let mySuffix: String? = {
+                            if case .location(let channel) = viewModel.activeChannel,
+                               let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                                return String(identity.publicKeyHex.suffix(4))
+                            }
+                            return String(viewModel.meshService.myPeerID.id.prefix(4))
+                        }()
+                        let isMentionToMe: Bool = {
+                            if mentionBase == viewModel.nickname {
+                                if let mySuffix, !mentionSuffix.isEmpty {
+                                    return mentionSuffix == "#\(mySuffix)"
+                                }
+                                return mentionSuffix.isEmpty
+                            }
+                            return false
+                        }()
+
+                        var mentionStyle = AttributeContainer()
+                        mentionStyle.font = .bitchatSystem(
+                            size: 14,
+                            weight: isSelf ? .bold : .semibold,
+                            design: .monospaced
+                        )
+                        let mentionColor: Color = isMentionToMe ? .orange : baseColor
+                        mentionStyle.foregroundColor = mentionColor
+                        let at = "@"
+                        result.append(AttributedString("\(at)").mergingAttributes(mentionStyle))
+                        result.append(AttributedString(mentionBase).mergingAttributes(mentionStyle))
+                        if !mentionSuffix.isEmpty {
+                            var lightStyle = mentionStyle
+                            lightStyle.foregroundColor = mentionColor.opacity(0.6)
+                            result.append(AttributedString(mentionSuffix).mergingAttributes(lightStyle))
+                        }
+                    } else if type == "hashtag" {
+                        let token = String(matchText.dropFirst()).lowercased()
+                        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
+                        let isGeohash = (2...12).contains(token.count) && token.allSatisfy { allowed.contains($0) }
+                        let attachedToMentionToken: Bool = {
+                            if swiftRange.lowerBound > content.startIndex {
+                                var index = content.index(before: swiftRange.lowerBound)
+                                while true {
+                                    let character = content[index]
+                                    if character.isWhitespace || character.isNewline { break }
+                                    if character == "@" { return true }
+                                    if index == content.startIndex { break }
+                                    index = content.index(before: index)
+                                }
+                            }
+                            return false
+                        }()
+                        let standalone: Bool = {
+                            if swiftRange.lowerBound == content.startIndex { return true }
+                            let previous = content.index(before: swiftRange.lowerBound)
+                            return content[previous].isWhitespace || content[previous].isNewline
+                        }()
+
+                        var tagStyle = AttributeContainer()
+                        tagStyle.font = isSelf
+                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                            : .bitchatSystem(size: 14, design: .monospaced)
+                        tagStyle.foregroundColor = baseColor
+                        if isGeohash && !attachedToMentionToken && standalone,
+                           let url = URL(string: "bitchat://geohash/\(token)") {
+                            tagStyle.link = url
+                            tagStyle.underlineStyle = .single
+                        }
+                        result.append(AttributedString(matchText).mergingAttributes(tagStyle))
+                    } else if type == "cashu" || type == "lightning" || type == "bolt11" || type == "lnurl" {
+                        var spacer = AttributeContainer()
+                        spacer.foregroundColor = baseColor
+                        spacer.font = isSelf
+                            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                            : .bitchatSystem(size: 14, design: .monospaced)
+                        result.append(AttributedString(" ").mergingAttributes(spacer))
+                    } else {
+                        var matchStyle = AttributeContainer()
+                        matchStyle.font = .bitchatSystem(
+                            size: 14,
+                            weight: isSelf ? .bold : .semibold,
+                            design: .monospaced
+                        )
+                        if type == "url" {
+                            matchStyle.foregroundColor = isSelf ? .orange : .blue
+                            matchStyle.underlineStyle = .single
+                            if let url = URL(string: matchText) {
+                                matchStyle.link = url
+                            }
+                        }
+                        result.append(AttributedString(matchText).mergingAttributes(matchStyle))
+                    }
+
+                    if lastEnd < swiftRange.upperBound {
+                        lastEnd = swiftRange.upperBound
+                    }
+                }
+
+                if lastEnd < content.endIndex {
+                    let remainingText = String(content[lastEnd...])
+                    var remainingStyle = AttributeContainer()
+                    remainingStyle.foregroundColor = baseColor
+                    remainingStyle.font = isSelf
+                        ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
+                        : .bitchatSystem(size: 14, design: .monospaced)
+                    if isMentioned {
+                        remainingStyle.font = remainingStyle.font?.bold()
+                    }
+                    result.append(AttributedString(remainingText).mergingAttributes(remainingStyle))
+                }
+            }
+
+            let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
+            var timestampStyle = AttributeContainer()
+            timestampStyle.foregroundColor = Color.gray.opacity(0.7)
+            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
+            result.append(timestamp.mergingAttributes(timestampStyle))
+        } else {
+            var contentStyle = AttributeContainer()
+            contentStyle.foregroundColor = Color.gray
+            let content = AttributedString("* \(message.content) *")
+            contentStyle.font = .bitchatSystem(size: 12, design: .monospaced).italic()
+            result.append(content.mergingAttributes(contentStyle))
+
+            let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
+            var timestampStyle = AttributeContainer()
+            timestampStyle.foregroundColor = Color.gray.opacity(0.5)
+            timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
+            result.append(timestamp.mergingAttributes(timestampStyle))
+        }
+
+        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf)
+        return result
+    }
+
+    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme) -> AttributedString {
+        let isSelf: Bool = {
+            if let spid = message.senderPeerID {
+                if case .location(let channel) = viewModel.activeChannel, spid.id.hasPrefix("nostr:"),
+                   let myGeo = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                    return spid == PeerID(nostr: myGeo.publicKeyHex)
+                }
+                return spid == viewModel.meshService.myPeerID
+            }
+            if message.sender == viewModel.nickname { return true }
+            if message.sender.hasPrefix(viewModel.nickname + "#") { return true }
+            return false
+        }()
+
+        let isDark = colorScheme == .dark
+        let baseColor: Color = isSelf ? .orange : peerColor(for: message, isDark: isDark)
+
+        if message.sender == "system" {
+            var style = AttributeContainer()
+            style.foregroundColor = baseColor
+            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
+            return AttributedString(message.sender).mergingAttributes(style)
+        }
+
+        var result = AttributedString()
+        let (baseName, suffix) = message.sender.splitSuffix()
+        var senderStyle = AttributeContainer()
+        senderStyle.foregroundColor = baseColor
+        senderStyle.font = .bitchatSystem(size: 14, weight: isSelf ? .bold : .medium, design: .monospaced)
+        if let spid = message.senderPeerID,
+           let url = URL(string: "bitchat://user/\(spid.id.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) ?? spid.id)") {
+            senderStyle.link = url
+        }
+
+        result.append(AttributedString("<@").mergingAttributes(senderStyle))
+        result.append(AttributedString(baseName).mergingAttributes(senderStyle))
+        if !suffix.isEmpty {
+            var suffixStyle = senderStyle
+            suffixStyle.foregroundColor = baseColor.opacity(0.6)
+            result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
+        }
+        result.append(AttributedString("> ").mergingAttributes(senderStyle))
+        return result
+    }
+
+    func isSelfMessage(_ message: BitchatMessage) -> Bool {
+        if let spid = message.senderPeerID {
+            if case .location(let channel) = viewModel.activeChannel, spid.isGeoChat {
+                let myGeo: NostrIdentity? = {
+                    if let cached = viewModel.cachedGeohashIdentity, cached.geohash == channel.geohash {
+                        return cached.identity
+                    }
+                    if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+                        viewModel.cachedGeohashIdentity = (channel.geohash, identity)
+                        return identity
+                    }
+                    return nil
+                }()
+                if let myGeo {
+                    return spid == PeerID(nostr: myGeo.publicKeyHex)
+                }
+            }
+            return spid == viewModel.meshService.myPeerID
+        }
+        if message.sender == viewModel.nickname { return true }
+        if message.sender.hasPrefix(viewModel.nickname + "#") { return true }
+        return false
+    }
+
+    func senderColor(for message: BitchatMessage, isDark: Bool) -> Color {
+        peerColor(for: message, isDark: isDark)
+    }
+
+    func peerURL(for peerID: PeerID) -> URL? {
+        URL(string: "bitchat://user/\(peerID.toPercentEncoded())")
+    }
+
+    func colorForNostrPubkey(_ pubkeyHexLowercased: String, isDark: Bool) -> Color {
+        getNostrPaletteColor(for: pubkeyHexLowercased.lowercased(), isDark: isDark)
+    }
+
+    func colorForMeshPeer(id peerID: PeerID, isDark: Bool) -> Color {
+        getPeerPaletteColor(for: peerID, isDark: isDark)
+    }
+}
+
+private extension ChatMessageFormatter {
+    func peerColor(for message: BitchatMessage, isDark: Bool) -> Color {
+        if let spid = message.senderPeerID {
+            if spid.isGeoChat || spid.isGeoDM {
+                let full = viewModel.nostrKeyMapping[spid]?.lowercased() ?? spid.bare.lowercased()
+                return getNostrPaletteColor(for: full, isDark: isDark)
+            } else if spid.id.count == 16 {
+                return getPeerPaletteColor(for: spid, isDark: isDark)
+            } else {
+                return getPeerPaletteColor(for: PeerID(str: spid.id.lowercased()), isDark: isDark)
+            }
+        }
+        return Color(peerSeed: message.sender.lowercased(), isDark: isDark)
+    }
+
+    func meshSeed(for peerID: PeerID) -> String {
+        if let full = viewModel.cachedStablePeerID(for: peerID)?.id.lowercased() {
+            return "noise:" + full
+        }
+        return peerID.id.lowercased()
+    }
+
+    func getPeerPaletteColor(for peerID: PeerID, isDark: Bool) -> Color {
+        if peerID == viewModel.meshService.myPeerID {
+            return .orange
+        }
+
+        meshPalette.ensurePalette(for: currentMeshPaletteSeeds())
+        if let color = meshPalette.color(for: peerID.id, isDark: isDark) {
+            return color
+        }
+        return Color(peerSeed: meshSeed(for: peerID), isDark: isDark)
+    }
+
+    func currentMeshPaletteSeeds() -> [String: String] {
+        let myID = viewModel.meshService.myPeerID
+        var seeds: [String: String] = [:]
+        for peer in viewModel.allPeers where peer.peerID != myID {
+            seeds[peer.peerID.id] = meshSeed(for: peer.peerID)
+        }
+        return seeds
+    }
+
+    func getNostrPaletteColor(for pubkeyHexLowercased: String, isDark: Bool) -> Color {
+        let myHex = currentGeohashIdentityHex()
+        if let myHex, pubkeyHexLowercased == myHex {
+            return .orange
+        }
+
+        nostrPalette.ensurePalette(for: currentNostrPaletteSeeds(excluding: myHex))
+        if let color = nostrPalette.color(for: pubkeyHexLowercased, isDark: isDark) {
+            return color
+        }
+        return Color(peerSeed: "nostr:" + pubkeyHexLowercased, isDark: isDark)
+    }
+
+    func currentNostrPaletteSeeds(excluding myHex: String?) -> [String: String] {
+        var seeds: [String: String] = [:]
+        let excluded = myHex ?? ""
+        for person in viewModel.visibleGeohashPeople() where person.id != excluded {
+            seeds[person.id] = "nostr:" + person.id
+        }
+        return seeds
+    }
+
+    func currentGeohashIdentityHex() -> String? {
+        if case .location(let channel) = viewModel.activeChannel,
+           let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            return identity.publicKeyHex.lowercased()
+        }
+        return nil
+    }
+}

bitchat/ViewModels/ChatNostrCoordinator.swift

@@ -0,0 +1,858 @@
+import BitFoundation
+import BitLogger
+import Foundation
+import SwiftUI
+import Tor
+
+final class ChatNostrCoordinator {
+    private unowned let viewModel: ChatViewModel
+
+    init(viewModel: ChatViewModel) {
+        self.viewModel = viewModel
+    }
+
+    @MainActor
+    func resubscribeCurrentGeohash() {
+        guard case .location(let channel) = viewModel.activeChannel else { return }
+        guard let subID = viewModel.geoSubscriptionID else {
+            switchLocationChannel(to: viewModel.activeChannel)
+            return
+        }
+
+        viewModel.participantTracker.startRefreshTimer()
+        NostrRelayManager.shared.unsubscribe(id: subID)
+        let filter = NostrFilter.geohashEphemeral(
+            channel.geohash,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
+            limit: TransportConfig.nostrGeohashInitialLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: channel.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.subscribeNostrEvent(event)
+            }
+        }
+
+        if let dmSub = viewModel.geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub)
+            viewModel.geoDmSubscriptionID = nil
+        }
+
+        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            let dmSub = "geo-dm-\(channel.geohash)"
+            viewModel.geoDmSubscriptionID = dmSub
+            let dmFilter = NostrFilter.giftWrapsFor(
+                pubkey: identity.publicKeyHex,
+                since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+            )
+            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+                Task { @MainActor [weak self] in
+                    self?.subscribeGiftWrap(giftWrap, id: identity)
+                }
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue),
+              !viewModel.deduplicationService.hasProcessedNostrEvent(event.id)
+        else {
+            return
+        }
+
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+
+        if let gh = viewModel.currentGeohash,
+           let myGeoIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            let nick = nickTag[1].trimmed
+            viewModel.locationPresenceStore.setNickname(nick, for: event.pubkey)
+        }
+
+        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+
+        let hasTeleportTag = event.tags.contains { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        }
+
+        if hasTeleportTag {
+            let key = event.pubkey.lowercased()
+            let isSelf: Bool = {
+                if let gh = viewModel.currentGeohash,
+                   let myIdentity = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+                    return myIdentity.publicKeyHex.lowercased() == key
+                }
+                return false
+            }()
+            if !isSelf {
+                Task { @MainActor [weak viewModel] in
+                    viewModel?.locationPresenceStore.markTeleported(key)
+                }
+            }
+        }
+
+        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content.trimmed
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let timestamp = min(rawTs, Date())
+        let mentions = viewModel.parseMentions(from: content)
+        let message = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: timestamp,
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            let isBlocked = viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
+            viewModel.handlePublicMessage(message)
+            if !isBlocked {
+                viewModel.checkForMentions(message)
+                viewModel.sendHapticFeedback(for: message)
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        guard !viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
+            giftWrap: giftWrap,
+            recipientIdentity: id
+        ),
+        let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+        packet.type == MessageType.noiseEncrypted.rawValue,
+        let noisePayload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+
+        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+        let convKey = PeerID(nostr_: senderPubkey)
+        viewModel.nostrKeyMapping[convKey] = senderPubkey
+
+        switch noisePayload.type {
+        case .privateMessage:
+            viewModel.handlePrivateMessage(
+                noisePayload,
+                senderPubkey: senderPubkey,
+                convKey: convKey,
+                id: id,
+                messageTimestamp: messageTimestamp
+            )
+        case .delivered:
+            viewModel.handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            viewModel.handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
+        case .verifyChallenge, .verifyResponse:
+            break
+        }
+    }
+
+    @MainActor
+    func switchLocationChannel(to channel: ChannelID) {
+        viewModel.publicMessagePipeline.reset()
+        viewModel.activeChannel = channel
+        viewModel.publicMessagePipeline.updateActiveChannel(channel)
+
+        viewModel.deduplicationService.clearNostrCaches()
+        switch channel {
+        case .mesh:
+            viewModel.refreshVisibleMessages(from: .mesh)
+            let emptyMesh = viewModel.messages.filter { $0.content.trimmed.isEmpty }.count
+            if emptyMesh > 0 {
+                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
+            }
+            viewModel.participantTracker.stopRefreshTimer()
+            viewModel.participantTracker.setActiveGeohash(nil)
+            viewModel.locationPresenceStore.clearTeleportedGeo()
+
+        case .location:
+            viewModel.refreshVisibleMessages(from: channel)
+        }
+
+        if case .location = channel {
+            for content in viewModel.timelineStore.drainPendingGeohashSystemMessages() {
+                viewModel.addPublicSystemMessage(content)
+            }
+        }
+
+        if let sub = viewModel.geoSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: sub)
+            viewModel.geoSubscriptionID = nil
+        }
+        if let dmSub = viewModel.geoDmSubscriptionID {
+            NostrRelayManager.shared.unsubscribe(id: dmSub)
+            viewModel.geoDmSubscriptionID = nil
+        }
+        viewModel.currentGeohash = nil
+        viewModel.participantTracker.setActiveGeohash(nil)
+        viewModel.locationPresenceStore.clearGeoNicknames()
+
+        guard case .location(let channel) = channel else { return }
+        viewModel.currentGeohash = channel.geohash
+        viewModel.participantTracker.setActiveGeohash(channel.geohash)
+
+        if let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) {
+            viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+            let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
+            let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
+            let key = identity.publicKeyHex.lowercased()
+            if viewModel.locationManager.teleported && hasRegional && !inRegional {
+                viewModel.locationPresenceStore.markTeleported(key)
+                SecureLogger.info(
+                    "GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    category: .session
+                )
+            } else {
+                viewModel.locationPresenceStore.clearTeleported(key)
+            }
+        }
+
+        let subID = "geo-\(channel.geohash)"
+        viewModel.geoSubscriptionID = subID
+        viewModel.participantTracker.startRefreshTimer()
+        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
+        let filter = NostrFilter.geohashEphemeral(channel.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: channel.geohash, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.handleNostrEvent(event)
+            }
+        }
+
+        subscribeToGeoChat(channel)
+    }
+
+    @MainActor
+    func handleNostrEvent(_ event: NostrEvent) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
+        else {
+            return
+        }
+
+        if viewModel.deduplicationService.hasProcessedNostrEvent(event.id) { return }
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+
+        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
+        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
+
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
+            return
+        }
+
+        let hasTeleportTag = event.tags.contains { tag in
+            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
+        }
+
+        let isSelf: Bool = {
+            if let gh = viewModel.currentGeohash,
+               let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh) {
+                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
+            }
+            return false
+        }()
+
+        if hasTeleportTag, !isSelf {
+            let key = event.pubkey.lowercased()
+            Task { @MainActor [weak viewModel] in
+                guard let viewModel else { return }
+                viewModel.locationPresenceStore.markTeleported(key)
+                SecureLogger.info(
+                    "GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                    category: .session
+                )
+            }
+        }
+
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey)
+
+        if isSelf {
+            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            if Date().timeIntervalSince(eventTime) < 15 {
+                return
+            }
+        }
+
+        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
+            viewModel.locationPresenceStore.setNickname(nickTag[1].trimmed, for: event.pubkey)
+        }
+
+        viewModel.nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
+        viewModel.nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
+
+        if event.kind == NostrProtocol.EventKind.geohashPresence.rawValue {
+            return
+        }
+
+        let senderName = viewModel.displayNameForNostrPubkey(event.pubkey)
+        let content = event.content
+
+        if let teleTag = event.tags.first(where: { $0.first == "t" }),
+           teleTag.count >= 2,
+           teleTag[1] == "teleport",
+           content.trimmed.isEmpty {
+            return
+        }
+
+        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        let mentions = viewModel.parseMentions(from: content)
+        let message = BitchatMessage(
+            id: event.id,
+            sender: senderName,
+            content: content,
+            timestamp: min(rawTs, Date()),
+            isRelay: false,
+            senderPeerID: PeerID(nostr: event.pubkey),
+            mentions: mentions.isEmpty ? nil : mentions
+        )
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            viewModel.handlePublicMessage(message)
+            viewModel.checkForMentions(message)
+            viewModel.sendHapticFeedback(for: message)
+        }
+    }
+
+    @MainActor
+    func subscribeToGeoChat(_ channel: GeohashChannel) {
+        guard let identity = try? viewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else { return }
+
+        let dmSub = "geo-dm-\(channel.geohash)"
+        viewModel.geoDmSubscriptionID = dmSub
+        if TorManager.shared.isReady {
+            SecureLogger.debug("GeoDM: subscribing DMs pub=\(identity.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
+        }
+        let dmFilter = NostrFilter.giftWrapsFor(
+            pubkey: identity.publicKeyHex,
+            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+        )
+        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
+            Task { @MainActor [weak self] in
+                self?.handleGiftWrap(giftWrap, id: identity)
+            }
+        }
+    }
+
+    @MainActor
+    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
+        guard giftWrap.isValidSignature() else { return }
+        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
+            return
+        }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(
+            giftWrap: giftWrap,
+            recipientIdentity: id
+        ) else {
+            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
+            return
+        }
+
+        SecureLogger.debug(
+            "GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...",
+            category: .session
+        )
+
+        guard let packet = Self.decodeEmbeddedBitChatPacket(from: content),
+              packet.type == MessageType.noiseEncrypted.rawValue,
+              let payload = NoisePayload.decode(packet.payload)
+        else {
+            return
+        }
+
+        let convKey = PeerID(nostr_: senderPubkey)
+        viewModel.nostrKeyMapping[convKey] = senderPubkey
+
+        switch payload.type {
+        case .privateMessage:
+            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
+            viewModel.handlePrivateMessage(
+                payload,
+                senderPubkey: senderPubkey,
+                convKey: convKey,
+                id: id,
+                messageTimestamp: messageTimestamp
+            )
+        case .delivered:
+            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
+        case .readReceipt:
+            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
+        case .verifyChallenge, .verifyResponse:
+            break
+        }
+    }
+
+    @MainActor
+    func sendGeohash(context: ChatViewModel.GeoOutgoingContext) {
+        let channel = context.channel
+        let event = context.event
+        let identity = context.identity
+
+        let targetRelays = GeoRelayDirectory.shared.closestRelays(
+            toGeohash: channel.geohash,
+            count: TransportConfig.nostrGeoRelayCount
+        )
+
+        if targetRelays.isEmpty {
+            SecureLogger.warning("Geo: no geohash relays available for \(channel.geohash); not sending", category: .session)
+        } else {
+            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
+        }
+
+        viewModel.participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
+        viewModel.nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
+        SecureLogger.debug(
+            "GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)",
+            category: .session
+        )
+
+        let hasRegional = !viewModel.locationManager.availableChannels.isEmpty
+        let inRegional = viewModel.locationManager.availableChannels.contains { $0.geohash == channel.geohash }
+        if context.teleported && hasRegional && !inRegional {
+            let key = identity.publicKeyHex.lowercased()
+            viewModel.locationPresenceStore.markTeleported(key)
+            SecureLogger.info(
+                "GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(viewModel.locationPresenceStore.teleportedGeo.count)",
+                category: .session
+            )
+        }
+
+        viewModel.deduplicationService.recordNostrEvent(event.id)
+    }
+
+    @MainActor
+    func beginGeohashSampling(for geohashes: [String]) {
+        if !TorManager.shared.isForeground() {
+            endGeohashSampling()
+            return
+        }
+
+        let desired = Set(geohashes)
+        let current = Set(viewModel.geoSamplingSubs.values)
+        let toAdd = desired.subtracting(current)
+        let toRemove = current.subtracting(desired)
+
+        for (subID, gh) in viewModel.geoSamplingSubs where toRemove.contains(gh) {
+            NostrRelayManager.shared.unsubscribe(id: subID)
+            viewModel.geoSamplingSubs.removeValue(forKey: subID)
+        }
+
+        for gh in toAdd {
+            subscribe(gh)
+        }
+    }
+
+    @MainActor
+    func subscribe(_ gh: String) {
+        let subID = "geo-sample-\(gh)"
+        viewModel.geoSamplingSubs[subID] = gh
+        let filter = NostrFilter.geohashEphemeral(
+            gh,
+            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
+            limit: TransportConfig.nostrGeohashSampleLimit
+        )
+        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
+        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.subscribeNostrEvent(event, gh: gh)
+            }
+        }
+    }
+
+    @MainActor
+    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
+        guard event.isValidSignature() else { return }
+        guard (event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue
+            || event.kind == NostrProtocol.EventKind.geohashPresence.rawValue)
+        else {
+            return
+        }
+
+        let existingCount = viewModel.participantTracker.participantCount(for: gh)
+        viewModel.participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
+
+        guard let content = event.content.trimmedOrNilIfEmpty else { return }
+        if viewModel.identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
+        if let my = try? viewModel.idBridge.deriveIdentity(forGeohash: gh),
+           my.publicKeyHex.lowercased() == event.pubkey.lowercased() {
+            return
+        }
+        guard existingCount == 0 else { return }
+
+        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+        if Date().timeIntervalSince(eventTime) > 30 { return }
+
+        #if os(iOS)
+        guard UIApplication.shared.applicationState == .active else { return }
+        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        #elseif os(macOS)
+        guard NSApplication.shared.isActive else { return }
+        if case .location(let channel) = viewModel.activeChannel, channel.geohash == gh { return }
+        #endif
+
+        cooldownPerGeohash(gh, content: content, event: event)
+    }
+
+    @MainActor
+    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
+        let now = Date()
+        let last = viewModel.lastGeoNotificationAt[gh] ?? .distantPast
+        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
+
+        let preview: String = {
+            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
+            if content.count <= maxLen { return content }
+            let idx = content.index(content.startIndex, offsetBy: maxLen)
+            return String(content[..<idx]) + "…"
+        }()
+
+        Task { @MainActor [weak viewModel] in
+            guard let viewModel else { return }
+            viewModel.lastGeoNotificationAt[gh] = now
+            let senderSuffix = String(event.pubkey.suffix(4))
+            let nick = viewModel.geoNicknames[event.pubkey.lowercased()]
+            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
+
+            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
+            let ts = min(rawTs, Date())
+            let mentions = viewModel.parseMentions(from: content)
+            let message = BitchatMessage(
+                id: event.id,
+                sender: senderName,
+                content: content,
+                timestamp: ts,
+                isRelay: false,
+                senderPeerID: PeerID(nostr: event.pubkey),
+                mentions: mentions.isEmpty ? nil : mentions
+            )
+            if viewModel.timelineStore.appendIfAbsent(message, toGeohash: gh) {
+                viewModel.synchronizePublicConversationStore(forGeohash: gh)
+                NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
+            }
+        }
+    }
+
+    @MainActor
+    func endGeohashSampling() {
+        for subID in viewModel.geoSamplingSubs.keys {
+            NostrRelayManager.shared.unsubscribe(id: subID)
+        }
+        viewModel.geoSamplingSubs.removeAll()
+    }
+
+    @MainActor
+    func setupNostrMessageHandling() {
+        guard let currentIdentity = try? viewModel.idBridge.getCurrentNostrIdentity() else {
+            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
+            return
+        }
+
+        SecureLogger.debug(
+            "🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...",
+            category: .session
+        )
+
+        let filter = NostrFilter.giftWrapsFor(
+            pubkey: currentIdentity.publicKeyHex,
+            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)
+        )
+
+        viewModel.nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
+            Task { @MainActor [weak self] in
+                self?.handleNostrMessage(event)
+            }
+        }
+    }
+
+    @MainActor
+    func handleNostrMessage(_ giftWrap: NostrEvent) {
+        if viewModel.deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
+        viewModel.deduplicationService.recordNostrEvent(giftWrap.id)
+
+        Task.detached(priority: .userInitiated) { [weak self] in
+            await self?.processNostrMessage(giftWrap)
+        }
+    }
+
+    func processNostrMessage(_ giftWrap: NostrEvent) async {
+        guard giftWrap.isValidSignature() else { return }
+        let currentIdentity: NostrIdentity? = await MainActor.run {
+            try? viewModel.idBridge.getCurrentNostrIdentity()
+        }
+        guard let currentIdentity else { return }
+
+        do {
+            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
+                giftWrap: giftWrap,
+                recipientIdentity: currentIdentity
+            )
+
+            if content.hasPrefix("verify:") {
+                return
+            }
+
+            if content.hasPrefix("bitchat1:") {
+                let packet: BitchatPacket? = await MainActor.run {
+                    Self.decodeEmbeddedBitChatPacket(from: content)
+                }
+                guard let packet else {
+                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
+                    return
+                }
+
+                let actualSenderNoiseKey: Data? = await MainActor.run {
+                    self.findNoiseKey(for: senderPubkey)
+                }
+                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
+
+                if packet.type == MessageType.noiseEncrypted.rawValue,
+                   let payload = NoisePayload.decode(packet.payload) {
+                    let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
+                    await MainActor.run {
+                        viewModel.nostrKeyMapping[targetPeerID] = senderPubkey
+
+                        switch payload.type {
+                        case .privateMessage:
+                            viewModel.handlePrivateMessage(
+                                payload,
+                                senderPubkey: senderPubkey,
+                                convKey: targetPeerID,
+                                id: currentIdentity,
+                                messageTimestamp: messageTimestamp
+                            )
+                        case .delivered:
+                            viewModel.handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .readReceipt:
+                            viewModel.handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
+                        case .verifyChallenge, .verifyResponse:
+                            break
+                        }
+                    }
+                }
+            } else {
+                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
+            }
+        } catch {
+            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
+        }
+    }
+
+    @MainActor
+    func findNoiseKey(for nostrPubkey: String) -> Data? {
+        let favorites = FavoritesPersistenceService.shared.favorites.values
+        var npubToMatch = nostrPubkey
+
+        if !nostrPubkey.hasPrefix("npub") {
+            if let pubkeyData = Data(hexString: nostrPubkey),
+               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
+                npubToMatch = encoded
+            } else {
+                SecureLogger.warning(
+                    "⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...",
+                    category: .session
+                )
+            }
+        }
+
+        for relationship in favorites {
+            if let storedNostrKey = relationship.peerNostrPublicKey {
+                if storedNostrKey == npubToMatch {
+                    return relationship.peerNoisePublicKey
+                }
+                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
+                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
+                    return relationship.peerNoisePublicKey
+                }
+            }
+        }
+
+        SecureLogger.debug(
+            "⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)",
+            category: .session
+        )
+        return nil
+    }
+
+    @MainActor
+    func sendDeliveryAckViaNostrEmbedded(
+        _ message: BitchatMessage,
+        wasReadBefore: Bool,
+        senderPubkey: String,
+        key: Data?
+    ) {
+        if let _ = key {
+            if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                transport.senderPeerID = viewModel.meshService.myPeerID
+                transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+            }
+        } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+            let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+            transport.senderPeerID = viewModel.meshService.myPeerID
+            transport.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: identity)
+            SecureLogger.debug(
+                "Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
+                category: .session
+            )
+        }
+
+        if !wasReadBefore && viewModel.selectedPrivateChatPeer == message.senderPeerID {
+            if let _ = key {
+                if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                    let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                    transport.senderPeerID = viewModel.meshService.myPeerID
+                    transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+                }
+            } else if let identity = try? viewModel.idBridge.getCurrentNostrIdentity() {
+                let transport = NostrTransport(keychain: viewModel.keychain, idBridge: viewModel.idBridge)
+                transport.senderPeerID = viewModel.meshService.myPeerID
+                transport.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: identity)
+                SecureLogger.debug(
+                    "Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…",
+                    category: .session
+                )
+            }
+        }
+    }
+
+    @MainActor
+    func handleFavoriteNotification(content: String, from nostrPubkey: String) {
+        guard let senderNoiseKey = findNoiseKey(for: nostrPubkey) else { return }
+
+        let isFavorite = content.contains("FAVORITE:TRUE")
+        let senderNickname = content.components(separatedBy: "|").last ?? "Unknown"
+
+        if isFavorite {
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: nostrPubkey,
+                peerNickname: senderNickname
+            )
+        }
+
+        var extractedNostrPubkey: String?
+        if let range = content.range(of: "NPUB:") {
+            let suffix = content[range.upperBound...]
+            let parts = suffix.components(separatedBy: "|")
+            if let key = parts.first {
+                extractedNostrPubkey = String(key)
+            }
+        } else if content.contains(":") {
+            let parts = content.components(separatedBy: ":")
+            if parts.count >= 3 {
+                extractedNostrPubkey = String(parts[2])
+            }
+        }
+
+        SecureLogger.info("📝 Received favorite notification from \(senderNickname): \(isFavorite)", category: .session)
+
+        if isFavorite && extractedNostrPubkey != nil {
+            SecureLogger.info(
+                "💾 Storing Nostr key association for \(senderNickname): \(extractedNostrPubkey!.prefix(16))...",
+                category: .session
+            )
+            FavoritesPersistenceService.shared.addFavorite(
+                peerNoisePublicKey: senderNoiseKey,
+                peerNostrPublicKey: extractedNostrPubkey,
+                peerNickname: senderNickname
+            )
+        }
+
+        NotificationService.shared.sendLocalNotification(
+            title: isFavorite ? "New Favorite" : "Favorite Removed",
+            body: "\(senderNickname) \(isFavorite ? "favorited" : "unfavorited") you",
+            identifier: "fav-\(UUID().uuidString)"
+        )
+    }
+
+    @MainActor
+    func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
+        guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
+              relationship.peerNostrPublicKey != nil else {
+            SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
+            return
+        }
+
+        let peerID = PeerID(hexData: noisePublicKey)
+        viewModel.messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+    }
+
+    @MainActor
+    func nostrPubkeyForDisplayName(_ name: String) -> String? {
+        for person in viewModel.visibleGeohashPeople() where person.displayName == name {
+            return person.id
+        }
+        for (pub, nick) in viewModel.geoNicknames where nick == name {
+            return pub
+        }
+        return nil
+    }
+
+    @MainActor
+    func startGeohashDM(withPubkeyHex hex: String) {
+        let convKey = PeerID(nostr_: hex)
+        viewModel.nostrKeyMapping[convKey] = hex
+        viewModel.startPrivateChat(with: convKey)
+    }
+
+    @MainActor
+    func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
+        viewModel.nostrKeyMapping[senderID]
+    }
+
+    @MainActor
+    func geohashDisplayName(for convKey: PeerID) -> String {
+        guard let full = viewModel.nostrKeyMapping[convKey] else {
+            return convKey.bare
+        }
+        return viewModel.displayNameForNostrPubkey(full)
+    }
+}
+
+private extension ChatNostrCoordinator {
+    @MainActor
+    static func decodeEmbeddedBitChatPacket(from content: String) -> BitchatPacket? {
+        guard content.hasPrefix("bitchat1:") else { return nil }
+        let encoded = String(content.dropFirst("bitchat1:".count))
+        let maxBytes = FileTransferLimits.maxFramedFileBytes
+        let maxEncoded = ((maxBytes + 2) / 3) * 4
+        guard encoded.count <= maxEncoded else { return nil }
+        guard let packetData = Base64URLCoding.decode(encoded),
+              packetData.count <= maxBytes
+        else {
+            return nil
+        }
+        return BitchatPacket.from(packetData)
+    }
+}