Merge branch 'main' into update-tor-0.4.8.19

Justfile

@@ -47,7 +47,7 @@ patch-for-macos: backup
 # Build the macOS app
 build: #check generate
     @echo "Building BitChat for macOS..."
-    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
+    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat_macOS" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
 
 # Run the macOS app
 run: build

Package.swift

@@ -34,8 +34,7 @@ let package = Package(
                 "Assets.xcassets",
                 "bitchat.entitlements",
                 "bitchat-macOS.entitlements",
-                "LaunchScreen.storyboard",
-                "ViewModels/Extensions/README.md"
+                "LaunchScreen.storyboard"
             ],
             resources: [
                 .process("Localizable.xcstrings")
@@ -50,8 +49,7 @@ let package = Package(
                 "README.md"
             ],
             resources: [
-                .process("Localization"),
-                .process("Noise")
+                .process("Localization")
             ]
         )
     ]

bitchat.xcodeproj/project.pbxproj

@@ -95,24 +95,6 @@
 			);
 			target = 57CA17A36A2532A6CFF367BB /* bitchatShareExtension */;
 		};
-		C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */ = {
-			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
-			membershipExceptions = (
-				Info.plist,
-				Localization/PrimaryLocalizationKeys.json,
-				README.md,
-			);
-			target = 47FF23248747DD7CB666CB91 /* bitchatTests_macOS */;
-		};
-		C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */ = {
-			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
-			membershipExceptions = (
-				Info.plist,
-				Localization/PrimaryLocalizationKeys.json,
-				README.md,
-			);
-			target = 6CB97DF2EA57234CB3E563B8 /* bitchatTests_iOS */;
-		};
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
@@ -136,10 +118,6 @@
 		};
 		A6E32D412E762EAE0032EA8A /* bitchatTests */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
-			exceptions = (
-				C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */,
-				C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */,
-			);
 			path = bitchatTests;
 			sourceTree = "<group>";
 		};
@@ -235,7 +213,6 @@
 			buildConfigurationList = 1C27B5BA3DB46DDF0DBFEF62 /* Build configuration list for PBXNativeTarget "bitchatTests_macOS" */;
 			buildPhases = (
 				5C22AA7B9ACC5A861445C769 /* Sources */,
-				C5E027A42ECCDFD700BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -268,7 +245,6 @@
 			buildConfigurationList = 38C4AF6313E5037F25CEF30B /* Build configuration list for PBXNativeTarget "bitchatTests_iOS" */;
 			buildPhases = (
 				865C8403EF02C089369A9FCB /* Sources */,
-				C5E027A72ECCDFE200BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -367,16 +343,6 @@
 				E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */,
 			);
 		};
-		C5E027A42ECCDFD700BD6012 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			files = (
-			);
-		};
-		C5E027A72ECCDFE200BD6012 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			files = (
-			);
-		};
 		CD6E8F32BC38357473954F97 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			files = (

bitchat/BitchatApp.swift

@@ -53,10 +53,9 @@ struct BitchatApp: App {
                     // Inject live Noise service into VerificationService to avoid creating new BLE instances
                     VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
                     // Prewarm Nostr identity and QR to make first VERIFY sheet fast
-                    let nickname = chatViewModel.nickname
                     DispatchQueue.global(qos: .utility).async {
                         let npub = try? idBridge.getCurrentNostrIdentity()?.npub
-                        _ = VerificationService.shared.buildMyQRString(nickname: nickname, npub: npub)
+                        _ = VerificationService.shared.buildMyQRString(nickname: chatViewModel.nickname, npub: npub)
                     }
 
                     appDelegate.chatViewModel = chatViewModel
@@ -249,15 +248,10 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
             // Get peer ID from userInfo
             if let peerID = userInfo["peerID"] as? String {
                 // Don't show notification if the private chat is already open
-                // Access main-actor-isolated property via Task
-                Task { @MainActor in
-                    if self.chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
-                        completionHandler([])
-                    } else {
-                        completionHandler([.banner, .sound])
-                    }
+                if chatViewModel?.selectedPrivateChatPeer == PeerID(str: peerID) {
+                    completionHandler([])
+                    return
                 }
-                return
             }
         }
         // Suppress geohash activity notification if we're already in that geohash channel

bitchat/Features/voice/VoiceRecorder.swift

@@ -58,20 +58,11 @@ final class VoiceRecorder: NSObject, AVAudioRecorderDelegate {
             guard session.recordPermission == .granted else {
                 throw RecorderError.microphoneAccessDenied
             }
-            #if targetEnvironment(simulator)
-            // allowBluetoothHFP is not available on iOS Simulator
-            try session.setCategory(
-                .playAndRecord,
-                mode: .default,
-                options: [.defaultToSpeaker, .allowBluetoothA2DP]
-            )
-            #else
             try session.setCategory(
                 .playAndRecord,
                 mode: .default,
                 options: [.defaultToSpeaker, .allowBluetoothA2DP, .allowBluetoothHFP]
             )
-            #endif
             try session.setActive(true, options: .notifyOthersOnDeactivation)
             #endif
             #if os(macOS)

bitchat/Noise/NoiseProtocol.swift

@@ -222,7 +222,7 @@ final class NoiseCipherState {
         guard combinedPayload.count >= Self.NONCE_SIZE_BYTES else {
             return nil
         }
-        
+
         // Extract 4-byte nonce (big-endian)
         let nonceData = combinedPayload.prefix(Self.NONCE_SIZE_BYTES)
         let extractedNonce = nonceData.withUnsafeBytes { (bytes: UnsafeRawBufferPointer) -> UInt64 in
@@ -233,18 +233,18 @@ final class NoiseCipherState {
             }
             return result
         }
-        
+
         // Extract ciphertext (remaining bytes)
         let ciphertext = combinedPayload.dropFirst(Self.NONCE_SIZE_BYTES)
-        
+
         return (nonce: extractedNonce, ciphertext: Data(ciphertext))
     }
-    
+
     /// Convert nonce to 4-byte array (big-endian)
     private func nonceToBytes(_ nonce: UInt64) -> Data {
         var bytes = Data(count: Self.NONCE_SIZE_BYTES)
         withUnsafeBytes(of: nonce.bigEndian) { ptr in
-            // Copy only the last 4 bytes from the 8-byte UInt64
+            // Copy only the last 4 bytes from the 8-byte UInt64 
             let sourceBytes = ptr.bindMemory(to: UInt8.self)
             bytes.replaceSubrange(0..<Self.NONCE_SIZE_BYTES, with: sourceBytes.suffix(Self.NONCE_SIZE_BYTES))
         }
@@ -273,7 +273,7 @@ final class NoiseCipherState {
         let sealedBox = try ChaChaPoly.seal(plaintext, using: key, nonce: ChaChaPoly.Nonce(data: nonceData), authenticating: associatedData)
         // increment local nonce
         nonce += 1
-        
+               
         // Create combined payload: <nonce><ciphertext>
         let combinedPayload: Data
         if (useExtractedNonce) {
@@ -287,7 +287,7 @@ final class NoiseCipherState {
         if currentNonce > Self.HIGH_NONCE_WARNING_THRESHOLD {
             SecureLogger.warning("High nonce value detected: \(currentNonce) - consider rekeying", category: .encryption)
         }
-        
+                
         return combinedPayload
     }
     
@@ -316,7 +316,7 @@ final class NoiseCipherState {
                 SecureLogger.debug("Replay attack detected: nonce \(extractedNonce) rejected")
                 throw NoiseError.replayDetected
             }
-            
+
             // Split ciphertext and tag
             encryptedData = actualCiphertext.prefix(actualCiphertext.count - 16)
             tag = actualCiphertext.suffix(16)
@@ -451,13 +451,13 @@ final class NoiseSymmetricState {
         }
     }
     
-    func split(useExtractedNonce: Bool) -> (NoiseCipherState, NoiseCipherState) {
+    func split() -> (NoiseCipherState, NoiseCipherState) {
         let output = hkdf(chainingKey: chainingKey, inputKeyMaterial: Data(), numOutputs: 2)
         let tempKey1 = SymmetricKey(data: output[0])
         let tempKey2 = SymmetricKey(data: output[1])
         
-        let c1 = NoiseCipherState(key: tempKey1, useExtractedNonce: useExtractedNonce)
-        let c2 = NoiseCipherState(key: tempKey2, useExtractedNonce: useExtractedNonce)
+        let c1 = NoiseCipherState(key: tempKey1, useExtractedNonce: true)
+        let c2 = NoiseCipherState(key: tempKey2, useExtractedNonce: true)
         
         return (c1, c2)
     }
@@ -507,24 +507,16 @@ final class NoiseHandshakeState {
     private var messagePatterns: [[NoiseMessagePattern]] = []
     private var currentPattern = 0
     
-    // Test support: predetermined ephemeral keys for test vectors
-    private var predeterminedEphemeralKey: Curve25519.KeyAgreement.PrivateKey?
-    private var prologueData: Data
-    
     init(
         role: NoiseRole,
         pattern: NoisePattern,
         keychain: KeychainManagerProtocol,
         localStaticKey: Curve25519.KeyAgreement.PrivateKey? = nil,
-        remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil,
-        prologue: Data = Data(),
-        predeterminedEphemeralKey: Curve25519.KeyAgreement.PrivateKey? = nil
+        remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil
     ) {
         self.role = role
         self.pattern = pattern
         self.keychain = keychain
-        self.prologueData = prologue
-        self.predeterminedEphemeralKey = predeterminedEphemeralKey
         
         // Initialize static keys
         if let localKey = localStaticKey {
@@ -545,8 +537,8 @@ final class NoiseHandshakeState {
     }
     
     private func mixPreMessageKeys() {
-        // Mix prologue
-        symmetricState.mixHash(self.prologueData)
+        // Mix prologue (empty for XX pattern normally)
+        symmetricState.mixHash(Data()) // Empty prologue for XX pattern
         // For XX pattern, no pre-message keys
         // For IK/NK patterns, we'd mix the responder's static key here
         switch pattern {
@@ -564,20 +556,15 @@ final class NoiseHandshakeState {
         guard currentPattern < messagePatterns.count else {
             throw NoiseError.handshakeComplete
         }
-        
+                
         var messageBuffer = Data()
         let patterns = messagePatterns[currentPattern]
         
         for pattern in patterns {
             switch pattern {
             case .e:
-                // Generate ephemeral key (or use predetermined key for tests)
-                if let predetermined = predeterminedEphemeralKey {
-                    localEphemeralPrivate = predetermined
-                    predeterminedEphemeralKey = nil
-                } else {
-                    localEphemeralPrivate = Curve25519.KeyAgreement.PrivateKey()
-                }
+                // Generate ephemeral key
+                localEphemeralPrivate = Curve25519.KeyAgreement.PrivateKey()
                 localEphemeralPublic = localEphemeralPrivate!.publicKey
                 messageBuffer.append(localEphemeralPublic!.rawRepresentation)
                 symmetricState.mixHash(localEphemeralPublic!.rawRepresentation)
@@ -610,20 +597,14 @@ final class NoiseHandshakeState {
                         throw NoiseError.missingKeys
                     }
                     let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteStatic)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                 } else {
                     guard let localStatic = localStaticPrivate,
                           let remoteEphemeral = remoteEphemeralPublic else {
                         throw NoiseError.missingKeys
                     }
                     let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                 }
                 
             case .se:
@@ -634,20 +615,14 @@ final class NoiseHandshakeState {
                         throw NoiseError.missingKeys
                     }
                     let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                 } else {
                     guard let localEphemeral = localEphemeralPrivate,
                           let remoteStatic = remoteStaticPublic else {
                         throw NoiseError.missingKeys
                     }
                     let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteStatic)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                 }
                 
             case .ss:
@@ -677,7 +652,7 @@ final class NoiseHandshakeState {
         guard currentPattern < messagePatterns.count else {
             throw NoiseError.handshakeComplete
         }
-        
+                
         var buffer = message
         let patterns = messagePatterns[currentPattern]
         
@@ -736,11 +711,8 @@ final class NoiseHandshakeState {
                 throw NoiseError.missingKeys
             }
             let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-            var sharedData = shared.withUnsafeBytes { Data($0) }
-            symmetricState.mixKey(sharedData)
-            // Clear sensitive shared secret
-            keychain.secureClear(&sharedData)
-
+            symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
+            
         case .es:
             if role == .initiator {
                 guard let localEphemeral = localEphemeralPrivate,
@@ -793,11 +765,8 @@ final class NoiseHandshakeState {
                 throw NoiseError.missingKeys
             }
             let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteStatic)
-            var sharedData = shared.withUnsafeBytes { Data($0) }
-            symmetricState.mixKey(sharedData)
-            // Clear sensitive shared secret
-            keychain.secureClear(&sharedData)
-
+            symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
+            
         case .e, .s:
             break
         }
@@ -807,12 +776,12 @@ final class NoiseHandshakeState {
         return currentPattern >= messagePatterns.count
     }
     
-    func getTransportCiphers(useExtractedNonce: Bool) throws -> (send: NoiseCipherState, receive: NoiseCipherState) {
+    func getTransportCiphers() throws -> (send: NoiseCipherState, receive: NoiseCipherState) {
         guard isHandshakeComplete() else {
             throw NoiseError.handshakeNotComplete
         }
         
-        let (c1, c2) = symmetricState.split(useExtractedNonce: useExtractedNonce)
+        let (c1, c2) = symmetricState.split()
         
         // Initiator uses c1 for sending, c2 for receiving
         // Responder uses c2 for sending, c1 for receiving

bitchat/Noise/NoiseSession.swift

@@ -103,7 +103,7 @@ class NoiseSession {
             // Check if handshake is complete
             if handshake.isHandshakeComplete() {
                 // Get transport ciphers
-                let (send, receive) = try handshake.getTransportCiphers(useExtractedNonce: true)
+                let (send, receive) = try handshake.getTransportCiphers()
                 sendCipher = send
                 receiveCipher = receive
                 
@@ -129,7 +129,7 @@ class NoiseSession {
                 // Check if handshake is complete after writing
                 if handshake.isHandshakeComplete() {
                     // Get transport ciphers
-                    let (send, receive) = try handshake.getTransportCiphers(useExtractedNonce: true)
+                    let (send, receive) = try handshake.getTransportCiphers()
                     sendCipher = send
                     receiveCipher = receive
                     

bitchat/Nostr/KeychainHelper.swift

@@ -0,0 +1,50 @@
+import Foundation
+
+protocol KeychainHelperProtocol {
+    func save(key: String, data: Data, service: String, accessible: CFString?)
+    func load(key: String, service: String) -> Data?
+    func delete(key: String, service: String)
+}
+
+/// Keychain helper for secure storage
+struct KeychainHelper: KeychainHelperProtocol {
+    func save(key: String, data: Data, service: String, accessible: CFString? = nil) {
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+            kSecValueData as String: data
+        ]
+        if let accessible = accessible {
+            query[kSecAttrAccessible as String] = accessible
+        }
+        
+        SecItemDelete(query as CFDictionary)
+        SecItemAdd(query as CFDictionary, nil)
+    }
+    
+    func load(key: String, service: String) -> Data? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+            kSecReturnData as String: true
+        ]
+        
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        
+        guard status == errSecSuccess else { return nil }
+        return result as? Data
+    }
+    
+    func delete(key: String, service: String) {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key
+        ]
+        
+        SecItemDelete(query as CFDictionary)
+    }
+}

bitchat/Nostr/NostrIdentityBridge.swift

@@ -12,9 +12,9 @@ final class NostrIdentityBridge {
     private var derivedIdentityCache: [String: NostrIdentity] = [:]
     private let cacheLock = NSLock()
 
-    private let keychain: KeychainManagerProtocol
+    private let keychain: KeychainHelperProtocol
 
-    init(keychain: KeychainManagerProtocol = KeychainManager()) {
+    init(keychain: KeychainHelperProtocol = KeychainHelper()) {
         self.keychain = keychain
     }
     

bitchat/Nostr/XChaCha20Poly1305Compat.swift

@@ -5,27 +5,16 @@ import CryptoKit
 /// Implements HChaCha20 to derive a subkey and reduces the 24-byte nonce to a 12-byte nonce
 /// as per XChaCha20 construction.
 enum XChaCha20Poly1305Compat {
-
-    /// Errors that can occur during XChaCha20-Poly1305 operations
-    enum Error: Swift.Error {
-        case invalidKeyLength(expected: Int, got: Int)
-        case invalidNonceLength(expected: Int, got: Int)
-    }
-
     struct SealBox {
         let ciphertext: Data
         let tag: Data
     }
 
     static func seal(plaintext: Data, key: Data, nonce24: Data, aad: Data? = nil) throws -> SealBox {
-        guard key.count == 32 else {
-            throw Error.invalidKeyLength(expected: 32, got: key.count)
-        }
-        guard nonce24.count == 24 else {
-            throw Error.invalidNonceLength(expected: 24, got: nonce24.count)
-        }
+        precondition(key.count == 32, "XChaCha20 key must be 32 bytes")
+        precondition(nonce24.count == 24, "XChaCha20 nonce must be 24 bytes")
 
-        let subkey = try hchacha20(key: key, nonce16: Data(nonce24.prefix(16)))
+        let subkey = hchacha20(key: key, nonce16: nonce24.prefix(16))
         let nonce12 = derive12ByteNonce(from24: nonce24)
         let chachaKey = SymmetricKey(data: subkey)
         let nonce = try ChaChaPoly.Nonce(data: nonce12)
@@ -34,14 +23,10 @@ enum XChaCha20Poly1305Compat {
     }
 
     static func open(ciphertext: Data, tag: Data, key: Data, nonce24: Data, aad: Data? = nil) throws -> Data {
-        guard key.count == 32 else {
-            throw Error.invalidKeyLength(expected: 32, got: key.count)
-        }
-        guard nonce24.count == 24 else {
-            throw Error.invalidNonceLength(expected: 24, got: nonce24.count)
-        }
+        precondition(key.count == 32, "XChaCha20 key must be 32 bytes")
+        precondition(nonce24.count == 24, "XChaCha20 nonce must be 24 bytes")
 
-        let subkey = try hchacha20(key: key, nonce16: Data(nonce24.prefix(16)))
+        let subkey = hchacha20(key: key, nonce16: nonce24.prefix(16))
         let nonce12 = derive12ByteNonce(from24: nonce24)
         let chachaKey = SymmetricKey(data: subkey)
         let box = try ChaChaPoly.SealedBox(nonce: ChaChaPoly.Nonce(data: nonce12), ciphertext: ciphertext, tag: tag)
@@ -58,14 +43,10 @@ enum XChaCha20Poly1305Compat {
         return out
     }
 
-    private static func hchacha20(key: Data, nonce16: Data) throws -> Data {
+    private static func hchacha20(key: Data, nonce16: Data) -> Data {
         // HChaCha20 based on the original ChaCha20 core with a 16-byte nonce.
-        guard key.count == 32 else {
-            throw Error.invalidKeyLength(expected: 32, got: key.count)
-        }
-        guard nonce16.count == 16 else {
-            throw Error.invalidNonceLength(expected: 16, got: nonce16.count)
-        }
+        precondition(key.count == 32)
+        precondition(nonce16.count == 16)
 
         // Constants "expand 32-byte k"
         var state: [UInt32] = [

bitchat/Protocols/BinaryEncodingUtils.swift

@@ -23,42 +23,20 @@ extension Data {
         return digest.map { String(format: "%02x", $0) }.joined()
     }
     
-    /// Initialize Data from a hex string.
-    /// - Parameter hexString: A hex string, optionally prefixed with "0x" or "0X".
-    ///   Whitespace is trimmed. Must have even length after prefix removal.
-    /// - Returns: nil if the string has odd length or contains invalid hex characters.
     init?(hexString: String) {
-        var hex = hexString.trimmingCharacters(in: .whitespaces)
-
-        // Remove optional 0x prefix
-        if hex.hasPrefix("0x") || hex.hasPrefix("0X") {
-            hex = String(hex.dropFirst(2))
-        }
-
-        // Reject odd-length strings
-        guard hex.count % 2 == 0 else {
-            return nil
-        }
-
-        // Reject empty strings
-        guard !hex.isEmpty else {
-            self = Data()
-            return
-        }
-
-        let len = hex.count / 2
+        let len = hexString.count / 2
         var data = Data(capacity: len)
-        var index = hex.startIndex
-
+        var index = hexString.startIndex
+        
         for _ in 0..<len {
-            let nextIndex = hex.index(index, offsetBy: 2)
-            guard let byte = UInt8(String(hex[index..<nextIndex]), radix: 16) else {
+            let nextIndex = hexString.index(index, offsetBy: 2)
+            guard let byte = UInt8(String(hexString[index..<nextIndex]), radix: 16) else {
                 return nil
             }
             data.append(byte)
             index = nextIndex
         }
-
+        
         self = data
     }
 }

bitchat/Services/BLE/BLEService.swift

@@ -521,11 +521,8 @@ final class BLEService: NSObject {
             }
         }
         
-        // Give leave message a moment to send (cooperative delay allows BLE callbacks to fire)
-        let deadline = Date().addingTimeInterval(TransportConfig.bleThreadSleepWriteShortDelaySeconds)
-        while Date() < deadline {
-            RunLoop.current.run(until: Date().addingTimeInterval(0.01))
-        }
+        // Give leave message a moment to send
+        Thread.sleep(forTimeInterval: TransportConfig.bleThreadSleepWriteShortDelaySeconds)
         
         // Clear pending notifications
         collectionsQueue.sync(flags: .barrier) {

bitchat/Services/CommandProcessor.swift

@@ -15,66 +15,18 @@ enum CommandResult {
     case handled  // Command handled, no message needed
 }
 
-/// Simple struct for geo participant info used by CommandProcessor
-struct CommandGeoParticipant {
-    let id: String        // pubkey hex (lowercased)
-    let displayName: String
-}
-
-/// Protocol defining what CommandProcessor needs from its context.
-/// This breaks the circular dependency between CommandProcessor and ChatViewModel.
-@MainActor
-protocol CommandContextProvider: AnyObject {
-    // MARK: - State Properties
-    var nickname: String { get }
-    var selectedPrivateChatPeer: PeerID? { get }
-    var blockedUsers: Set<String> { get }
-    var privateChats: [PeerID: [BitchatMessage]] { get set }
-    var idBridge: NostrIdentityBridge { get }
-
-    // MARK: - Peer Lookup
-    func getPeerIDForNickname(_ nickname: String) -> PeerID?
-    func getVisibleGeoParticipants() -> [CommandGeoParticipant]
-    func nostrPubkeyForDisplayName(_ displayName: String) -> String?
-
-    // MARK: - Chat Actions
-    func startPrivateChat(with peerID: PeerID)
-    func sendPrivateMessage(_ content: String, to peerID: PeerID)
-    func clearCurrentPublicTimeline()
-    func sendPublicRaw(_ content: String)
-
-    // MARK: - System Messages
-    func addLocalPrivateSystemMessage(_ content: String, to peerID: PeerID)
-    func addPublicSystemMessage(_ content: String)
-
-    // MARK: - Favorites
-    func toggleFavorite(peerID: PeerID)
-    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool)
-}
-
 /// Processes chat commands in a focused, efficient way
 @MainActor
 final class CommandProcessor {
-    weak var contextProvider: CommandContextProvider?
+    weak var chatViewModel: ChatViewModel?
     weak var meshService: Transport?
     private let identityManager: SecureIdentityStateManagerProtocol
-
-    /// Backward-compatible property for existing code
-    weak var chatViewModel: CommandContextProvider? {
-        get { contextProvider }
-        set { contextProvider = newValue }
-    }
-
-    init(contextProvider: CommandContextProvider? = nil, meshService: Transport? = nil, identityManager: SecureIdentityStateManagerProtocol) {
-        self.contextProvider = contextProvider
+    
+    init(chatViewModel: ChatViewModel? = nil, meshService: Transport? = nil, identityManager: SecureIdentityStateManagerProtocol) {
+        self.chatViewModel = chatViewModel
         self.meshService = meshService
         self.identityManager = identityManager
     }
-
-    /// Backward-compatible initializer
-    convenience init(chatViewModel: ChatViewModel? = nil, meshService: Transport? = nil, identityManager: SecureIdentityStateManagerProtocol) {
-        self.init(contextProvider: chatViewModel, meshService: meshService, identityManager: identityManager)
-    }
     
     /// Process a command string
     @MainActor
@@ -90,7 +42,7 @@ final class CommandProcessor {
             case .location: return true
             }
         }()
-        let inGeoDM = contextProvider?.selectedPrivateChatPeer?.isGeoDM == true
+        let inGeoDM = chatViewModel?.selectedPrivateChatPeer?.isGeoDM == true
 
         switch cmd {
         case "/m", "/msg":
@@ -129,15 +81,15 @@ final class CommandProcessor {
         let targetName = String(parts[0])
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
         
-        guard let peerID = contextProvider?.getPeerIDForNickname(nickname) else {
+        guard let peerID = chatViewModel?.getPeerIDForNickname(nickname) else {
             return .error(message: "'\(nickname)' not found")
         }
-
-        contextProvider?.startPrivateChat(with: peerID)
-
+        
+        chatViewModel?.startPrivateChat(with: peerID)
+        
         if parts.count > 1 {
             let message = String(parts[1])
-            contextProvider?.sendPrivateMessage(message, to: peerID)
+            chatViewModel?.sendPrivateMessage(message, to: peerID)
         }
         
         return .success(message: "started private chat with \(nickname)")
@@ -148,9 +100,9 @@ final class CommandProcessor {
         switch LocationChannelManager.shared.selectedChannel {
         case .location(let ch):
             // Geohash context: show visible geohash participants (exclude self)
-            guard let vm = contextProvider else { return .success(message: "nobody around") }
-            let myHex = (try? vm.idBridge.deriveIdentity(forGeohash: ch.geohash))?.publicKeyHex.lowercased()
-            let people = vm.getVisibleGeoParticipants().filter { person in
+            guard let vm = chatViewModel else { return .success(message: "nobody around") }
+            let myHex = (try? chatViewModel?.idBridge.deriveIdentity(forGeohash: ch.geohash))?.publicKeyHex.lowercased()
+            let people = vm.visibleGeohashPeople().filter { person in
                 if let me = myHex { return person.id.lowercased() != me }
                 return true
             }
@@ -168,10 +120,10 @@ final class CommandProcessor {
     }
     
     private func handleClear() -> CommandResult {
-        if let peerID = contextProvider?.selectedPrivateChatPeer {
-            contextProvider?.privateChats[peerID]?.removeAll()
+        if let peerID = chatViewModel?.selectedPrivateChatPeer {
+            chatViewModel?.privateChats[peerID]?.removeAll()
         } else {
-            contextProvider?.clearCurrentPublicTimeline()
+            chatViewModel?.clearCurrentPublicTimeline()
         }
         return .handled
     }
@@ -184,14 +136,14 @@ final class CommandProcessor {
         
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
         
-        guard let targetPeerID = contextProvider?.getPeerIDForNickname(nickname),
-              let myNickname = contextProvider?.nickname else {
+        guard let targetPeerID = chatViewModel?.getPeerIDForNickname(nickname),
+              let myNickname = chatViewModel?.nickname else {
             return .error(message: "cannot \(command) \(nickname): not found")
         }
         
         let emoteContent = "* \(emoji) \(myNickname) \(action) \(nickname)\(suffix) *"
         
-        if contextProvider?.selectedPrivateChatPeer != nil {
+        if chatViewModel?.selectedPrivateChatPeer != nil {
             // In private chat
             if let peerNickname = meshService?.peerNickname(peerID: targetPeerID) {
                 let personalMessage = "* \(emoji) \(myNickname) \(action) you\(suffix) *"
@@ -207,13 +159,13 @@ final class CommandProcessor {
                     }
                 }()
                 let localText = "\(emoji) you \(pastAction) \(nickname)\(suffix)"
-                contextProvider?.addLocalPrivateSystemMessage(localText, to: targetPeerID)
+                chatViewModel?.addLocalPrivateSystemMessage(localText, to: targetPeerID)
             }
         } else {
             // In public chat: send to active public channel (mesh or geohash)
-            contextProvider?.sendPublicRaw(emoteContent)
+            chatViewModel?.sendPublicRaw(emoteContent)
             let publicEcho = "\(emoji) \(myNickname) \(action) \(nickname)\(suffix)"
-            contextProvider?.addPublicSystemMessage(publicEcho)
+            chatViewModel?.addPublicSystemMessage(publicEcho)
         }
         
         return .handled
@@ -224,7 +176,7 @@ final class CommandProcessor {
         
         if targetName.isEmpty {
             // List blocked users (mesh) and geohash (Nostr) blocks
-            let meshBlocked = contextProvider?.blockedUsers ?? []
+            let meshBlocked = chatViewModel?.blockedUsers ?? []
             var blockedNicknames: [String] = []
             if let peers = meshService?.getPeerNicknames() {
                 for (peerID, nickname) in peers {
@@ -238,8 +190,8 @@ final class CommandProcessor {
             // Geohash blocked names (prefer visible display names; fallback to #suffix)
             let geoBlocked = Array(identityManager.getBlockedNostrPubkeys())
             var geoNames: [String] = []
-            if let vm = contextProvider {
-                let visible = vm.getVisibleGeoParticipants()
+            if let vm = chatViewModel {
+                let visible = vm.visibleGeohashPeople()
                 let visibleIndex = Dictionary(uniqueKeysWithValues: visible.map { ($0.id.lowercased(), $0.displayName) })
                 for pk in geoBlocked {
                     if let name = visibleIndex[pk.lowercased()] {
@@ -258,7 +210,7 @@ final class CommandProcessor {
         
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
         
-        if let peerID = contextProvider?.getPeerIDForNickname(nickname),
+        if let peerID = chatViewModel?.getPeerIDForNickname(nickname),
            let fingerprint = meshService?.getFingerprint(for: peerID) {
             if identityManager.isBlocked(fingerprint: fingerprint) {
                 return .success(message: "\(nickname) is already blocked")
@@ -283,7 +235,7 @@ final class CommandProcessor {
             return .success(message: "blocked \(nickname). you will no longer receive messages from them")
         }
         // Mesh lookup failed; try geohash (Nostr) participant by display name
-        if let pub = contextProvider?.nostrPubkeyForDisplayName(nickname) {
+        if let pub = chatViewModel?.nostrPubkeyForDisplayName(nickname) {
             if identityManager.isNostrBlocked(pubkeyHexLowercased: pub) {
                 return .success(message: "\(nickname) is already blocked")
             }
@@ -302,7 +254,7 @@ final class CommandProcessor {
         
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
         
-        if let peerID = contextProvider?.getPeerIDForNickname(nickname),
+        if let peerID = chatViewModel?.getPeerIDForNickname(nickname),
            let fingerprint = meshService?.getFingerprint(for: peerID) {
             if !identityManager.isBlocked(fingerprint: fingerprint) {
                 return .success(message: "\(nickname) is not blocked")
@@ -311,7 +263,7 @@ final class CommandProcessor {
             return .success(message: "unblocked \(nickname)")
         }
         // Try geohash unblock
-        if let pub = contextProvider?.nostrPubkeyForDisplayName(nickname) {
+        if let pub = chatViewModel?.nostrPubkeyForDisplayName(nickname) {
             if !identityManager.isNostrBlocked(pubkeyHexLowercased: pub) {
                 return .success(message: "\(nickname) is not blocked")
             }
@@ -329,7 +281,7 @@ final class CommandProcessor {
         
         let nickname = targetName.hasPrefix("@") ? String(targetName.dropFirst()) : targetName
         
-        guard let peerID = contextProvider?.getPeerIDForNickname(nickname),
+        guard let peerID = chatViewModel?.getPeerIDForNickname(nickname),
               let noisePublicKey = Data(hexString: peerID.id) else {
             return .error(message: "can't find peer: \(nickname)")
         }
@@ -342,15 +294,15 @@ final class CommandProcessor {
                 peerNickname: nickname
             )
             
-            contextProvider?.toggleFavorite(peerID: peerID)
-            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: true)
+            chatViewModel?.toggleFavorite(peerID: peerID)
+            chatViewModel?.sendFavoriteNotification(to: peerID, isFavorite: true)
             
             return .success(message: "added \(nickname) to favorites")
         } else {
             FavoritesPersistenceService.shared.removeFavorite(peerNoisePublicKey: noisePublicKey)
             
-            contextProvider?.toggleFavorite(peerID: peerID)
-            contextProvider?.sendFavoriteNotification(to: peerID, isFavorite: false)
+            chatViewModel?.toggleFavorite(peerID: peerID)
+            chatViewModel?.sendFavoriteNotification(to: peerID, isFavorite: false)
             
             return .success(message: "removed \(nickname) from favorites")
         }

bitchat/Services/FavoritesPersistenceService.swift

@@ -26,7 +26,7 @@ final class FavoritesPersistenceService: ObservableObject {
 
     private static let storageKey = "chat.bitchat.favorites"
     private static let keychainService = "chat.bitchat.favorites"
-    private let keychain: KeychainManagerProtocol
+    private let keychain: KeychainHelperProtocol
     
     @Published private(set) var favorites: [Data: FavoriteRelationship] = [:] // Noise pubkey -> relationship
     @Published private(set) var mutualFavorites: Set<Data> = []
@@ -35,8 +35,8 @@ final class FavoritesPersistenceService: ObservableObject {
     private var cancellables = Set<AnyCancellable>()
     
     static let shared = FavoritesPersistenceService()
-
-    init(keychain: KeychainManagerProtocol = KeychainManager()) {
+    
+    init(keychain: KeychainHelperProtocol = KeychainHelper()) {
         self.keychain = keychain
         loadFavorites()
         

bitchat/Services/GeohashBookmarksStore.swift

@@ -0,0 +1,219 @@
+import Foundation
+import Combine
+#if os(iOS) || os(macOS)
+import CoreLocation
+#endif
+
+/// Stores a user-maintained list of bookmarked geohash channels.
+/// - Persistence: UserDefaults (JSON string array)
+/// - Semantics: geohashes are normalized to lowercase base32 and de-duplicated
+final class GeohashBookmarksStore: ObservableObject {
+    static let shared = GeohashBookmarksStore()
+
+    @Published private(set) var bookmarks: [String] = []
+    @Published private(set) var bookmarkNames: [String: String] = [:] // geohash -> friendly name
+
+    private let storeKey = "locationChannel.bookmarks"
+    private let namesStoreKey = "locationChannel.bookmarkNames"
+    private var membership: Set<String> = []
+    #if os(iOS) || os(macOS)
+    private let geocoder = CLGeocoder()
+    private var resolving: Set<String> = []
+    #endif
+    
+    private let storage: UserDefaults
+
+    init(storage: UserDefaults = .standard) {
+        self.storage = storage
+        load()
+    }
+
+    // MARK: - Public API
+    func isBookmarked(_ geohash: String) -> Bool {
+        return membership.contains(Self.normalize(geohash))
+    }
+
+    func toggle(_ geohash: String) {
+        let gh = Self.normalize(geohash)
+        if membership.contains(gh) {
+            remove(gh)
+        } else {
+            add(gh)
+        }
+    }
+
+    func add(_ geohash: String) {
+        let gh = Self.normalize(geohash)
+        guard !gh.isEmpty else { return }
+        guard !membership.contains(gh) else { return }
+        bookmarks.insert(gh, at: 0)
+        membership.insert(gh)
+        persist()
+        // Resolve and persist a friendly name once when added
+        resolveNameIfNeeded(for: gh)
+    }
+
+    func remove(_ geohash: String) {
+        let gh = Self.normalize(geohash)
+        guard membership.contains(gh) else { return }
+        if let idx = bookmarks.firstIndex(of: gh) { bookmarks.remove(at: idx) }
+        membership.remove(gh)
+        // Clean up stored name to avoid stale cache growth
+        if bookmarkNames.removeValue(forKey: gh) != nil {
+            persistNames()
+        }
+        persist()
+    }
+
+    // MARK: - Persistence
+    private func load() {
+        guard let data = storage.data(forKey: storeKey) else { return }
+        if let arr = try? JSONDecoder().decode([String].self, from: data) {
+            // Sanitize, normalize, dedupe while preserving order (first occurrence wins)
+            var seen = Set<String>()
+            var list: [String] = []
+            for raw in arr {
+                let gh = Self.normalize(raw)
+                guard !gh.isEmpty else { continue }
+                if !seen.contains(gh) {
+                    seen.insert(gh)
+                    list.append(gh)
+                }
+            }
+            bookmarks = list
+            membership = seen
+        }
+        // Load any saved names
+        if let namesData = storage.data(forKey: namesStoreKey),
+           let dict = try? JSONDecoder().decode([String: String].self, from: namesData) {
+            bookmarkNames = dict
+        }
+    }
+
+    private func persist() {
+        if let data = try? JSONEncoder().encode(bookmarks) {
+            storage.set(data, forKey: storeKey)
+        }
+    }
+
+    private func persistNames() {
+        if let data = try? JSONEncoder().encode(bookmarkNames) {
+            storage.set(data, forKey: namesStoreKey)
+        }
+    }
+
+    // MARK: - Helpers
+    private static func normalize(_ s: String) -> String {
+        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
+        return s
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+            .lowercased()
+            .replacingOccurrences(of: "#", with: "")
+            .filter { allowed.contains($0) }
+    }
+
+    // MARK: - Name Resolution
+    /// Attempt to resolve and persist a friendly place name for a bookmarked geohash.
+    func resolveNameIfNeeded(for geohash: String) {
+        let gh = Self.normalize(geohash)
+        guard !gh.isEmpty else { return }
+        if bookmarkNames[gh] != nil { return }
+        #if os(iOS) || os(macOS)
+        if resolving.contains(gh) { return }
+        resolving.insert(gh)
+        // For very coarse geohashes, sample multiple points to capture multiple admin areas
+        if gh.count <= 2 {
+            let b = Geohash.decodeBounds(gh)
+            let pts: [CLLocation] = [
+                CLLocation(latitude: (b.latMin + b.latMax) / 2, longitude: (b.lonMin + b.lonMax) / 2), // center
+                CLLocation(latitude: b.latMin, longitude: b.lonMin),
+                CLLocation(latitude: b.latMin, longitude: b.lonMax),
+                CLLocation(latitude: b.latMax, longitude: b.lonMin),
+                CLLocation(latitude: b.latMax, longitude: b.lonMax)
+            ]
+            resolveCompositeAdminName(geohash: gh, points: pts)
+        } else {
+            let center = Geohash.decodeCenter(gh)
+            let loc = CLLocation(latitude: center.lat, longitude: center.lon)
+            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
+                guard let self = self else { return }
+                defer { self.resolving.remove(gh) }
+                if let pm = placemarks?.first {
+                    let name = Self.nameForGeohashLength(gh.count, from: pm)
+                    if let name = name, !name.isEmpty {
+                        DispatchQueue.main.async {
+                            self.bookmarkNames[gh] = name
+                            self.persistNames()
+                        }
+                    }
+                }
+            }
+        }
+        #endif
+    }
+
+    #if os(iOS) || os(macOS)
+    private func resolveCompositeAdminName(geohash gh: String, points: [CLLocation]) {
+        var uniqueAdmins = OrderedSet<String>()
+        var idx = 0
+        func step() {
+            if idx >= points.count {
+                // Compose up to 2 names joined by ' and '
+                let finalName: String? = {
+                    let names = uniqueAdmins.array
+                    if names.count >= 2 { return names[0] + " and " + names[1] }
+                    return names.first
+                }()
+                if let finalName = finalName, !finalName.isEmpty {
+                    DispatchQueue.main.async {
+                        self.bookmarkNames[gh] = finalName
+                        self.persistNames()
+                    }
+                }
+                self.resolving.remove(gh)
+                return
+            }
+            let loc = points[idx]
+            idx += 1
+            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
+                guard self != nil else { return }
+                if let pm = placemarks?.first {
+                    if let admin = pm.administrativeArea, !admin.isEmpty {
+                        uniqueAdmins.insert(admin)
+                    } else if let country = pm.country, !country.isEmpty {
+                        uniqueAdmins.insert(country)
+                    }
+                }
+                // Proceed to next point
+                step()
+            }
+        }
+        step()
+    }
+
+    // Minimal ordered-set for stable joining
+    private struct OrderedSet<Element: Hashable> {
+        private var set: Set<Element> = []
+        private(set) var array: [Element] = []
+        mutating func insert(_ element: Element) {
+            if set.insert(element).inserted { array.append(element) }
+        }
+    }
+
+    private static func nameForGeohashLength(_ len: Int, from pm: CLPlacemark) -> String? {
+        switch len {
+        case 0...2:
+            // Prefer administrative area if available at this coarse level
+            return pm.administrativeArea ?? pm.country
+        case 3...4:
+            return pm.administrativeArea ?? pm.subAdministrativeArea ?? pm.country
+        case 5:
+            return pm.locality ?? pm.subAdministrativeArea ?? pm.administrativeArea
+        case 6...7:
+            return pm.subLocality ?? pm.locality ?? pm.administrativeArea
+        default:
+            return pm.subLocality ?? pm.locality ?? pm.administrativeArea ?? pm.country
+        }
+    }
+    #endif
+}

bitchat/Services/GeohashParticipantTracker.swift

@@ -1,159 +0,0 @@
-//
-// GeohashParticipantTracker.swift
-// bitchat
-//
-// Tracks participants in geohash-based location channels.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Foundation
-
-/// Represents a participant in a geohash channel
-public struct GeoPerson: Identifiable, Equatable, Sendable {
-    public let id: String        // pubkey hex (lowercased)
-    public let displayName: String
-    public let lastSeen: Date
-
-    public init(id: String, displayName: String, lastSeen: Date) {
-        self.id = id
-        self.displayName = displayName
-        self.lastSeen = lastSeen
-    }
-}
-
-/// Protocol for resolving display names and checking block status
-@MainActor
-public protocol GeohashParticipantContext: AnyObject {
-    /// Returns display name for a Nostr pubkey (e.g., "alice#a1b2" or "anon#c3d4")
-    func displayNameForPubkey(_ pubkeyHex: String) -> String
-    /// Returns true if the pubkey is blocked
-    func isBlocked(_ pubkeyHexLowercased: String) -> Bool
-}
-
-/// Tracks participants across multiple geohash channels
-@MainActor
-public final class GeohashParticipantTracker: ObservableObject {
-
-    /// Activity cutoff duration (defaults to 5 minutes)
-    public let activityCutoff: TimeInterval
-
-    /// Per-geohash participant map: [geohash: [pubkeyHex: lastSeen]]
-    private var participants: [String: [String: Date]] = [:]
-
-    /// Currently visible people for the active geohash
-    @Published public private(set) var visiblePeople: [GeoPerson] = []
-
-    /// The currently active geohash (if any)
-    private var activeGeohash: String?
-
-    /// Context for display name resolution and block checking
-    private weak var context: GeohashParticipantContext?
-
-    /// Timer for periodic refresh
-    private var refreshTimer: Timer?
-
-    public init(activityCutoff: TimeInterval = -300) { // default 5 minutes
-        self.activityCutoff = activityCutoff
-    }
-
-    /// Configure with a context provider
-    public func configure(context: GeohashParticipantContext) {
-        self.context = context
-    }
-
-    /// Set the currently active geohash
-    public func setActiveGeohash(_ geohash: String?) {
-        activeGeohash = geohash
-        if geohash == nil {
-            visiblePeople = []
-        } else {
-            refresh()
-        }
-    }
-
-    /// Record activity from a participant in the current active geohash
-    public func recordParticipant(pubkeyHex: String) {
-        guard let gh = activeGeohash else { return }
-        recordParticipant(pubkeyHex: pubkeyHex, geohash: gh)
-    }
-
-    /// Record activity from a participant in a specific geohash
-    public func recordParticipant(pubkeyHex: String, geohash: String) {
-        let key = pubkeyHex.lowercased()
-        var map = participants[geohash] ?? [:]
-        map[key] = Date()
-        participants[geohash] = map
-
-        // Only refresh visible list if this geohash is currently active
-        if activeGeohash == geohash {
-            refresh()
-        }
-    }
-
-    /// Remove a participant from all geohashes (used when blocking)
-    public func removeParticipant(pubkeyHex: String) {
-        let key = pubkeyHex.lowercased()
-        for (gh, var map) in participants {
-            map.removeValue(forKey: key)
-            participants[gh] = map
-        }
-        refresh()
-    }
-
-    /// Get participant count for a specific geohash
-    public func participantCount(for geohash: String) -> Int {
-        let cutoff = Date().addingTimeInterval(activityCutoff)
-        let map = participants[geohash] ?? [:]
-        return map.values.filter { $0 >= cutoff }.count
-    }
-
-    /// Get the visible people list for the active geohash (read-only query)
-    public func getVisiblePeople() -> [GeoPerson] {
-        guard let gh = activeGeohash, let context = context else { return [] }
-        let cutoff = Date().addingTimeInterval(activityCutoff)
-        let map = (participants[gh] ?? [:])
-            .filter { $0.value >= cutoff }
-            .filter { !context.isBlocked($0.key) }
-
-        return map
-            .map { (pub, seen) in
-                GeoPerson(id: pub, displayName: context.displayNameForPubkey(pub), lastSeen: seen)
-            }
-            .sorted { $0.lastSeen > $1.lastSeen }
-    }
-
-    /// Refresh the visible people list
-    public func refresh() {
-        visiblePeople = getVisiblePeople()
-    }
-
-    /// Start the periodic refresh timer
-    public func startRefreshTimer(interval: TimeInterval = 30.0) {
-        stopRefreshTimer()
-        refreshTimer = Timer.scheduledTimer(withTimeInterval: interval, repeats: true) { [weak self] _ in
-            Task { @MainActor in
-                self?.refresh()
-            }
-        }
-    }
-
-    /// Stop the periodic refresh timer
-    public func stopRefreshTimer() {
-        refreshTimer?.invalidate()
-        refreshTimer = nil
-    }
-
-    /// Clear all participant data
-    public func clear() {
-        participants.removeAll()
-        visiblePeople = []
-    }
-
-    /// Clear participant data for a specific geohash
-    public func clear(geohash: String) {
-        participants.removeValue(forKey: geohash)
-        if activeGeohash == geohash {
-            visiblePeople = []
-        }
-    }
-}

bitchat/Services/KeychainManager.swift

@@ -15,19 +15,11 @@ protocol KeychainManagerProtocol {
     func getIdentityKey(forKey key: String) -> Data?
     func deleteIdentityKey(forKey key: String) -> Bool
     func deleteAllKeychainData() -> Bool
-
+    
     func secureClear(_ data: inout Data)
     func secureClear(_ string: inout String)
-
+    
     func verifyIdentityKeyExists() -> Bool
-
-    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
-    /// Save data with a custom service name
-    func save(key: String, data: Data, service: String, accessible: CFString?)
-    /// Load data from a custom service
-    func load(key: String, service: String) -> Data?
-    /// Delete data from a custom service
-    func delete(key: String, service: String)
 }
 
 final class KeychainManager: KeychainManagerProtocol {
@@ -317,54 +309,9 @@ final class KeychainManager: KeychainManagerProtocol {
     }
     
     // MARK: - Debug
-
+    
     func verifyIdentityKeyExists() -> Bool {
         let key = "identity_noiseStaticKey"
         return retrieveData(forKey: key) != nil
     }
-
-    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
-
-    /// Save data with a custom service name
-    func save(key: String, data: Data, service customService: String, accessible: CFString?) {
-        var query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: customService,
-            kSecAttrAccount as String: key,
-            kSecValueData as String: data
-        ]
-        if let accessible = accessible {
-            query[kSecAttrAccessible as String] = accessible
-        }
-
-        SecItemDelete(query as CFDictionary)
-        SecItemAdd(query as CFDictionary, nil)
-    }
-
-    /// Load data from a custom service
-    func load(key: String, service customService: String) -> Data? {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: customService,
-            kSecAttrAccount as String: key,
-            kSecReturnData as String: true
-        ]
-
-        var result: AnyObject?
-        let status = SecItemCopyMatching(query as CFDictionary, &result)
-
-        guard status == errSecSuccess else { return nil }
-        return result as? Data
-    }
-
-    /// Delete data from a custom service
-    func delete(key: String, service customService: String) {
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrService as String: customService,
-            kSecAttrAccount as String: key
-        ]
-
-        SecItemDelete(query as CFDictionary)
-    }
 }

bitchat/Services/LocationChannelManager.swift

@@ -0,0 +1,306 @@
+import BitLogger
+import Foundation
+import Combine
+
+#if os(iOS) || os(macOS)
+import CoreLocation
+
+/// Manages location permissions, one-shot location retrieval, and computing geohash channels.
+/// Not main-actor isolated to satisfy CLLocationManagerDelegate in Swift 6; state updates hop to MainActor.
+final class LocationChannelManager: NSObject, CLLocationManagerDelegate, ObservableObject {
+    static let shared = LocationChannelManager()
+
+    enum PermissionState: Equatable {
+        case notDetermined
+        case denied
+        case restricted
+        case authorized
+    }
+
+    private let cl = CLLocationManager()
+    private let geocoder = CLGeocoder()
+    private var lastLocation: CLLocation?
+    private var refreshTimer: Timer?
+    private let userDefaultsKey = "locationChannel.selected"
+    private let teleportedStoreKey = "locationChannel.teleportedSet"
+    private var isGeocoding: Bool = false
+
+    // Published state for UI bindings
+    @Published private(set) var permissionState: PermissionState = .notDetermined
+    @Published private(set) var availableChannels: [GeohashChannel] = []
+    @Published private(set) var selectedChannel: ChannelID = .mesh
+    // True when the current location channel was selected via manual teleport
+    @Published var teleported: Bool = false
+    @Published private(set) var locationNames: [GeohashChannelLevel: String] = [:]
+
+    // Persisted set of geohashes that were selected via teleport
+    private var teleportedSet: Set<String> = []
+
+    private override init() {
+        super.init()
+        cl.delegate = self
+        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters // meters; we're not tracking continuously
+        // Load selection
+        if let data = UserDefaults.standard.data(forKey: userDefaultsKey),
+           let channel = try? JSONDecoder().decode(ChannelID.self, from: data) {
+            selectedChannel = channel
+        }
+        // Load persisted teleported set
+        if let data = UserDefaults.standard.data(forKey: teleportedStoreKey),
+           let arr = try? JSONDecoder().decode([String].self, from: data) {
+            teleportedSet = Set(arr)
+        }
+        // Do not eagerly mark teleported on startup; wait for location to compute regional set.
+        // This avoids showing teleported for in-region channels during cold start.
+        let status: CLAuthorizationStatus
+        if #available(iOS 14.0, macOS 11.0, *) {
+            status = cl.authorizationStatus
+        } else {
+            status = CLLocationManager.authorizationStatus()
+        }
+        updatePermissionState(from: status)
+        // If we don't have location authorization at startup, fall back to persisted teleport state
+        switch status {
+        case .authorizedAlways, .authorizedWhenInUse, .authorized:
+            break // will compute from location
+        case .notDetermined, .restricted, .denied:
+            fallthrough
+        @unknown default:
+            if case .location(let ch) = selectedChannel {
+                teleported = teleportedSet.contains(ch.geohash)
+            }
+        }
+    }
+
+    // MARK: - Public API
+    func enableLocationChannels() {
+        let status: CLAuthorizationStatus
+        if #available(iOS 14.0, macOS 11.0, *) {
+            status = cl.authorizationStatus
+        } else {
+            status = CLLocationManager.authorizationStatus()
+        }
+        switch status {
+        case .notDetermined:
+            cl.requestWhenInUseAuthorization()
+        case .restricted:
+            Task { @MainActor in self.permissionState = .restricted }
+        case .denied:
+            Task { @MainActor in self.permissionState = .denied }
+        case .authorizedAlways, .authorizedWhenInUse, .authorized:
+            Task { @MainActor in self.permissionState = .authorized }
+            requestOneShotLocation()
+        @unknown default:
+            Task { @MainActor in self.permissionState = .restricted }
+        }
+    }
+
+    func refreshChannels() {
+        if permissionState == .authorized {
+            requestOneShotLocation()
+        }
+    }
+
+    /// Begin continuous, distance-filtered updates while the channel sheet is visible.
+    /// Uses a 21m filter (configurable) to only refresh on meaningful movement.
+    func beginLiveRefresh(interval: TimeInterval = TransportConfig.locationLiveRefreshInterval) {
+        guard permissionState == .authorized else { return }
+        // Stop any previous polling timer
+        refreshTimer?.invalidate()
+        refreshTimer = nil
+        // Tighten accuracy and distance filter for live view
+        cl.desiredAccuracy = kCLLocationAccuracyNearestTenMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterLiveMeters
+        // Start continuous updates
+        cl.startUpdatingLocation()
+        // Request an immediate fix to populate UI without waiting for movement
+        requestOneShotLocation()
+    }
+
+    /// Stop continuous refreshes when selector UI is dismissed.
+    func endLiveRefresh() {
+        refreshTimer?.invalidate()
+        refreshTimer = nil
+        cl.stopUpdatingLocation()
+        // Restore more relaxed defaults for background/idle state
+        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
+        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
+    }
+
+    func select(_ channel: ChannelID) {
+        Task { @MainActor in
+            self.selectedChannel = channel
+            if let data = try? JSONEncoder().encode(channel) {
+                UserDefaults.standard.set(data, forKey: self.userDefaultsKey)
+            }
+            // Update teleported flag based on persisted state for immediate UI behavior
+            switch channel {
+            case .mesh:
+                self.teleported = false
+            case .location(let ch):
+                // If this geohash is in our current regional set, do NOT mark teleported.
+                let inRegional = self.availableChannels.contains { $0.geohash == ch.geohash }
+                if inRegional {
+                    self.teleported = false
+                    // Clear persisted teleport for this geohash to keep future selections clean
+                    if self.teleportedSet.contains(ch.geohash) {
+                        self.teleportedSet.remove(ch.geohash)
+                        if let data = try? JSONEncoder().encode(Array(self.teleportedSet)) {
+                            UserDefaults.standard.set(data, forKey: self.teleportedStoreKey)
+                        }
+                    }
+                } else {
+                    // Fall back to persisted mark (set by deep link or manual teleport)
+                    self.teleported = self.teleportedSet.contains(ch.geohash)
+                }
+            }
+        }
+    }
+
+    // Mark or unmark a geohash as teleported in persistence and update current flag if relevant
+    func markTeleported(for geohash: String, _ flag: Bool) {
+        if flag { teleportedSet.insert(geohash) } else { teleportedSet.remove(geohash) }
+        if let data = try? JSONEncoder().encode(Array(teleportedSet)) {
+            UserDefaults.standard.set(data, forKey: teleportedStoreKey)
+        }
+        if case .location(let ch) = selectedChannel, ch.geohash == geohash {
+            Task { @MainActor in self.teleported = flag }
+        }
+    }
+
+    // MARK: - CoreLocation
+    private func requestOneShotLocation() {
+        cl.requestLocation()
+    }
+
+    // iOS < 14
+    func locationManager(_ manager: CLLocationManager, didChangeAuthorization status: CLAuthorizationStatus) {
+        updatePermissionState(from: status)
+        if case .authorized = permissionState {
+            requestOneShotLocation()
+        }
+    }
+
+    // iOS 14+ / macOS 11+
+    @available(iOS 14.0, macOS 11.0, *)
+    func locationManagerDidChangeAuthorization(_ manager: CLLocationManager) {
+        updatePermissionState(from: manager.authorizationStatus)
+        if case .authorized = permissionState {
+            requestOneShotLocation()
+        }
+    }
+
+    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
+        guard let loc = locations.last else { return }
+        lastLocation = loc
+        computeChannels(from: loc.coordinate)
+        reverseGeocodeIfNeeded(location: loc)
+    }
+
+    func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
+        // Surface as denied/restricted if relevant; otherwise keep previous state
+        SecureLogger.error("LocationChannelManager: location error: \(error.localizedDescription)", category: .session)
+    }
+
+    // MARK: - Helpers
+    private func updatePermissionState(from status: CLAuthorizationStatus) {
+        let newState: PermissionState
+        switch status {
+        case .notDetermined: newState = .notDetermined
+        case .restricted: newState = .restricted
+        case .denied: newState = .denied
+        case .authorizedAlways, .authorizedWhenInUse, .authorized: newState = .authorized
+        @unknown default: newState = .restricted
+        }
+        Task { @MainActor in self.permissionState = newState }
+    }
+
+    private func computeChannels(from coord: CLLocationCoordinate2D) {
+        let levels = GeohashChannelLevel.allCases
+        var result: [GeohashChannel] = []
+        for level in levels {
+            let gh = Geohash.encode(latitude: coord.latitude, longitude: coord.longitude, precision: level.precision)
+            result.append(GeohashChannel(level: level, geohash: gh))
+        }
+        Task { @MainActor in
+            self.availableChannels = result
+            // Recompute teleported status based on whether the selected geohash is in our regional set
+            switch self.selectedChannel {
+            case .mesh:
+                self.teleported = false
+            case .location(let ch):
+                // Membership check using freshly computed regional channels; avoids precision/rename drift
+                let inRegional = result.contains { $0.geohash == ch.geohash }
+                if inRegional {
+                    self.teleported = false
+                    // Clear persisted teleport flag if present
+                    if self.teleportedSet.contains(ch.geohash) {
+                        self.teleportedSet.remove(ch.geohash)
+                        if let data = try? JSONEncoder().encode(Array(self.teleportedSet)) {
+                            UserDefaults.standard.set(data, forKey: self.teleportedStoreKey)
+                        }
+                    }
+                } else {
+                    self.teleported = true
+                }
+            }
+        }
+    }
+
+    private func reverseGeocodeIfNeeded(location: CLLocation) {
+        // Always cancel previous to keep latest fresh while user moves
+        geocoder.cancelGeocode()
+        isGeocoding = true
+        geocoder.reverseGeocodeLocation(location) { [weak self] placemarks, error in
+            guard let self = self else { return }
+            self.isGeocoding = false
+            if let pm = placemarks?.first {
+                let names = self.namesByLevel(from: pm)
+                Task { @MainActor in self.locationNames = names }
+            }
+        }
+    }
+
+    private func namesByLevel(from pm: CLPlacemark) -> [GeohashChannelLevel: String] {
+        var dict: [GeohashChannelLevel: String] = [:]
+        // Region (country)
+        if let country = pm.country, !country.isEmpty {
+            dict[.region] = country
+        }
+        // Province (state/province or county)
+        if let admin = pm.administrativeArea, !admin.isEmpty {
+            dict[.province] = admin
+        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
+            dict[.province] = subAdmin
+        }
+        // City (locality)
+        if let locality = pm.locality, !locality.isEmpty {
+            dict[.city] = locality
+        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
+            dict[.city] = subAdmin
+        } else if let admin = pm.administrativeArea, !admin.isEmpty {
+            dict[.city] = admin
+        }
+        // Neighborhood
+        if let subLocality = pm.subLocality, !subLocality.isEmpty {
+            dict[.neighborhood] = subLocality
+        } else if let locality = pm.locality, !locality.isEmpty {
+            dict[.neighborhood] = locality
+        }
+        // Block: reuse neighborhood/locality granularity
+        if let subLocality = pm.subLocality, !subLocality.isEmpty {
+            dict[.block] = subLocality
+        } else if let locality = pm.locality, !locality.isEmpty {
+            dict[.block] = locality
+        }
+        // Building: prefer place name/street/venue when available
+        if let name = pm.name, !name.isEmpty {
+            dict[.building] = name
+        } else if let thoroughfare = pm.thoroughfare, !thoroughfare.isEmpty {
+            dict[.building] = thoroughfare
+        }
+        return dict
+    }
+}
+#endif

bitchat/Services/LocationStateManager.swift

@@ -1,545 +0,0 @@
-import BitLogger
-import Foundation
-import Combine
-
-#if os(iOS) || os(macOS)
-import CoreLocation
-
-/// Unified manager for location-based channel state including:
-/// - CoreLocation permissions and one-shot location retrieval
-/// - Geohash channel computation from coordinates
-/// - Channel selection and teleport state
-/// - Bookmark persistence and friendly name resolution
-///
-/// Consolidates LocationChannelManager + GeohashBookmarksStore into a single source of truth.
-final class LocationStateManager: NSObject, CLLocationManagerDelegate, ObservableObject {
-    static let shared = LocationStateManager()
-
-    // MARK: - Permission State
-
-    enum PermissionState: Equatable {
-        case notDetermined
-        case denied
-        case restricted
-        case authorized
-    }
-
-    // MARK: - Private Properties (CoreLocation)
-
-    private let cl = CLLocationManager()
-    private let geocoder = CLGeocoder()
-    private var lastLocation: CLLocation?
-    private var refreshTimer: Timer?
-    private var isGeocoding: Bool = false
-
-    // MARK: - Persistence Keys
-
-    private let selectedChannelKey = "locationChannel.selected"
-    private let teleportedStoreKey = "locationChannel.teleportedSet"
-    private let bookmarksKey = "locationChannel.bookmarks"
-    private let bookmarkNamesKey = "locationChannel.bookmarkNames"
-
-    // MARK: - Published State (Channel)
-
-    @Published private(set) var permissionState: PermissionState = .notDetermined
-    @Published private(set) var availableChannels: [GeohashChannel] = []
-    @Published private(set) var selectedChannel: ChannelID = .mesh
-    @Published var teleported: Bool = false
-    @Published private(set) var locationNames: [GeohashChannelLevel: String] = [:]
-
-    // MARK: - Published State (Bookmarks)
-
-    @Published private(set) var bookmarks: [String] = []
-    @Published private(set) var bookmarkNames: [String: String] = [:]
-
-    // MARK: - Private State
-
-    private var teleportedSet: Set<String> = []
-    private var bookmarkMembership: Set<String> = []
-    private var resolvingNames: Set<String> = []
-    private let storage: UserDefaults
-
-    /// Returns true if running in test environment
-    private static var isRunningTests: Bool {
-        let env = ProcessInfo.processInfo.environment
-        return NSClassFromString("XCTestCase") != nil ||
-               env["XCTestConfigurationFilePath"] != nil ||
-               env["XCTestBundlePath"] != nil ||
-               env["GITHUB_ACTIONS"] != nil ||
-               env["CI"] != nil
-    }
-
-    // MARK: - Initialization
-
-    private override init() {
-        self.storage = .standard
-        super.init()
-
-        // Skip CoreLocation setup in test environments
-        guard !Self.isRunningTests else {
-            loadPersistedState()
-            return
-        }
-
-        cl.delegate = self
-        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
-
-        loadPersistedState()
-        initializePermissionState()
-    }
-
-    /// Internal initializer for testing with custom storage
-    init(storage: UserDefaults) {
-        self.storage = storage
-        super.init()
-        loadPersistedState()
-    }
-
-    private func loadPersistedState() {
-        // Load selected channel
-        if let data = storage.data(forKey: selectedChannelKey),
-           let channel = try? JSONDecoder().decode(ChannelID.self, from: data) {
-            selectedChannel = channel
-        }
-
-        // Load teleported set
-        if let data = storage.data(forKey: teleportedStoreKey),
-           let arr = try? JSONDecoder().decode([String].self, from: data) {
-            teleportedSet = Set(arr)
-        }
-
-        // Load bookmarks
-        if let data = storage.data(forKey: bookmarksKey),
-           let arr = try? JSONDecoder().decode([String].self, from: data) {
-            var seen = Set<String>()
-            var list: [String] = []
-            for raw in arr {
-                let gh = Self.normalizeGeohash(raw)
-                guard !gh.isEmpty, !seen.contains(gh) else { continue }
-                seen.insert(gh)
-                list.append(gh)
-            }
-            bookmarks = list
-            bookmarkMembership = seen
-        }
-
-        // Load bookmark names
-        if let data = storage.data(forKey: bookmarkNamesKey),
-           let dict = try? JSONDecoder().decode([String: String].self, from: data) {
-            bookmarkNames = dict
-        }
-    }
-
-    private func initializePermissionState() {
-        let status: CLAuthorizationStatus
-        if #available(iOS 14.0, macOS 11.0, *) {
-            status = cl.authorizationStatus
-        } else {
-            status = CLLocationManager.authorizationStatus()
-        }
-        updatePermissionState(from: status)
-
-        // Fall back to persisted teleport state if no location authorization
-        switch status {
-        case .authorizedAlways, .authorizedWhenInUse, .authorized:
-            break
-        case .notDetermined, .restricted, .denied:
-            fallthrough
-        @unknown default:
-            if case .location(let ch) = selectedChannel {
-                teleported = teleportedSet.contains(ch.geohash)
-            }
-        }
-    }
-
-    // MARK: - Public API (Permissions & Location)
-
-    func enableLocationChannels() {
-        let status: CLAuthorizationStatus
-        if #available(iOS 14.0, macOS 11.0, *) {
-            status = cl.authorizationStatus
-        } else {
-            status = CLLocationManager.authorizationStatus()
-        }
-        switch status {
-        case .notDetermined:
-            cl.requestWhenInUseAuthorization()
-        case .restricted:
-            Task { @MainActor in self.permissionState = .restricted }
-        case .denied:
-            Task { @MainActor in self.permissionState = .denied }
-        case .authorizedAlways, .authorizedWhenInUse, .authorized:
-            Task { @MainActor in self.permissionState = .authorized }
-            requestOneShotLocation()
-        @unknown default:
-            Task { @MainActor in self.permissionState = .restricted }
-        }
-    }
-
-    func refreshChannels() {
-        if permissionState == .authorized {
-            requestOneShotLocation()
-        }
-    }
-
-    func beginLiveRefresh(interval: TimeInterval = TransportConfig.locationLiveRefreshInterval) {
-        guard permissionState == .authorized else { return }
-        refreshTimer?.invalidate()
-        refreshTimer = nil
-        cl.desiredAccuracy = kCLLocationAccuracyNearestTenMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterLiveMeters
-        cl.startUpdatingLocation()
-        requestOneShotLocation()
-    }
-
-    func endLiveRefresh() {
-        refreshTimer?.invalidate()
-        refreshTimer = nil
-        cl.stopUpdatingLocation()
-        cl.desiredAccuracy = kCLLocationAccuracyHundredMeters
-        cl.distanceFilter = TransportConfig.locationDistanceFilterMeters
-    }
-
-    // MARK: - Public API (Channel Selection)
-
-    func select(_ channel: ChannelID) {
-        Task { @MainActor in
-            self.selectedChannel = channel
-            if let data = try? JSONEncoder().encode(channel) {
-                self.storage.set(data, forKey: self.selectedChannelKey)
-            }
-
-            switch channel {
-            case .mesh:
-                self.teleported = false
-            case .location(let ch):
-                let inRegional = self.availableChannels.contains { $0.geohash == ch.geohash }
-                if inRegional {
-                    self.teleported = false
-                    if self.teleportedSet.contains(ch.geohash) {
-                        self.teleportedSet.remove(ch.geohash)
-                        self.persistTeleportedSet()
-                    }
-                } else {
-                    self.teleported = self.teleportedSet.contains(ch.geohash)
-                }
-            }
-        }
-    }
-
-    func markTeleported(for geohash: String, _ flag: Bool) {
-        if flag {
-            teleportedSet.insert(geohash)
-        } else {
-            teleportedSet.remove(geohash)
-        }
-        persistTeleportedSet()
-        if case .location(let ch) = selectedChannel, ch.geohash == geohash {
-            Task { @MainActor in self.teleported = flag }
-        }
-    }
-
-    // MARK: - Public API (Bookmarks)
-
-    func isBookmarked(_ geohash: String) -> Bool {
-        bookmarkMembership.contains(Self.normalizeGeohash(geohash))
-    }
-
-    func toggleBookmark(_ geohash: String) {
-        let gh = Self.normalizeGeohash(geohash)
-        if bookmarkMembership.contains(gh) {
-            removeBookmark(gh)
-        } else {
-            addBookmark(gh)
-        }
-    }
-
-    func addBookmark(_ geohash: String) {
-        let gh = Self.normalizeGeohash(geohash)
-        guard !gh.isEmpty, !bookmarkMembership.contains(gh) else { return }
-        bookmarks.insert(gh, at: 0)
-        bookmarkMembership.insert(gh)
-        persistBookmarks()
-        resolveBookmarkNameIfNeeded(for: gh)
-    }
-
-    func removeBookmark(_ geohash: String) {
-        let gh = Self.normalizeGeohash(geohash)
-        guard bookmarkMembership.contains(gh) else { return }
-        if let idx = bookmarks.firstIndex(of: gh) {
-            bookmarks.remove(at: idx)
-        }
-        bookmarkMembership.remove(gh)
-        if bookmarkNames.removeValue(forKey: gh) != nil {
-            persistBookmarkNames()
-        }
-        persistBookmarks()
-    }
-
-    // MARK: - CLLocationManagerDelegate
-
-    private func requestOneShotLocation() {
-        cl.requestLocation()
-    }
-
-    func locationManager(_ manager: CLLocationManager, didChangeAuthorization status: CLAuthorizationStatus) {
-        updatePermissionState(from: status)
-        if case .authorized = permissionState {
-            requestOneShotLocation()
-        }
-    }
-
-    @available(iOS 14.0, macOS 11.0, *)
-    func locationManagerDidChangeAuthorization(_ manager: CLLocationManager) {
-        updatePermissionState(from: manager.authorizationStatus)
-        if case .authorized = permissionState {
-            requestOneShotLocation()
-        }
-    }
-
-    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
-        guard let loc = locations.last else { return }
-        lastLocation = loc
-        computeChannels(from: loc.coordinate)
-        reverseGeocodeLocation(loc)
-    }
-
-    func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
-        SecureLogger.error("LocationStateManager: location error: \(error.localizedDescription)", category: .session)
-    }
-
-    // MARK: - Private Helpers (Permission)
-
-    private func updatePermissionState(from status: CLAuthorizationStatus) {
-        let newState: PermissionState
-        switch status {
-        case .notDetermined: newState = .notDetermined
-        case .restricted: newState = .restricted
-        case .denied: newState = .denied
-        case .authorizedAlways, .authorizedWhenInUse, .authorized: newState = .authorized
-        @unknown default: newState = .restricted
-        }
-        Task { @MainActor in self.permissionState = newState }
-    }
-
-    // MARK: - Private Helpers (Channel Computation)
-
-    private func computeChannels(from coord: CLLocationCoordinate2D) {
-        let levels = GeohashChannelLevel.allCases
-        var result: [GeohashChannel] = []
-        for level in levels {
-            let gh = Geohash.encode(latitude: coord.latitude, longitude: coord.longitude, precision: level.precision)
-            result.append(GeohashChannel(level: level, geohash: gh))
-        }
-        Task { @MainActor in
-            self.availableChannels = result
-            switch self.selectedChannel {
-            case .mesh:
-                self.teleported = false
-            case .location(let ch):
-                let inRegional = result.contains { $0.geohash == ch.geohash }
-                if inRegional {
-                    self.teleported = false
-                    if self.teleportedSet.contains(ch.geohash) {
-                        self.teleportedSet.remove(ch.geohash)
-                        self.persistTeleportedSet()
-                    }
-                } else {
-                    self.teleported = true
-                }
-            }
-        }
-    }
-
-    // MARK: - Private Helpers (Geocoding)
-
-    private func reverseGeocodeLocation(_ location: CLLocation) {
-        geocoder.cancelGeocode()
-        isGeocoding = true
-        geocoder.reverseGeocodeLocation(location) { [weak self] placemarks, _ in
-            guard let self = self else { return }
-            self.isGeocoding = false
-            if let pm = placemarks?.first {
-                let names = self.locationNamesByLevel(from: pm)
-                Task { @MainActor in self.locationNames = names }
-            }
-        }
-    }
-
-    private func locationNamesByLevel(from pm: CLPlacemark) -> [GeohashChannelLevel: String] {
-        var dict: [GeohashChannelLevel: String] = [:]
-        if let country = pm.country, !country.isEmpty {
-            dict[.region] = country
-        }
-        if let admin = pm.administrativeArea, !admin.isEmpty {
-            dict[.province] = admin
-        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
-            dict[.province] = subAdmin
-        }
-        if let locality = pm.locality, !locality.isEmpty {
-            dict[.city] = locality
-        } else if let subAdmin = pm.subAdministrativeArea, !subAdmin.isEmpty {
-            dict[.city] = subAdmin
-        } else if let admin = pm.administrativeArea, !admin.isEmpty {
-            dict[.city] = admin
-        }
-        if let subLocality = pm.subLocality, !subLocality.isEmpty {
-            dict[.neighborhood] = subLocality
-        } else if let locality = pm.locality, !locality.isEmpty {
-            dict[.neighborhood] = locality
-        }
-        if let subLocality = pm.subLocality, !subLocality.isEmpty {
-            dict[.block] = subLocality
-        } else if let locality = pm.locality, !locality.isEmpty {
-            dict[.block] = locality
-        }
-        if let name = pm.name, !name.isEmpty {
-            dict[.building] = name
-        } else if let thoroughfare = pm.thoroughfare, !thoroughfare.isEmpty {
-            dict[.building] = thoroughfare
-        }
-        return dict
-    }
-
-    func resolveBookmarkNameIfNeeded(for geohash: String) {
-        let gh = Self.normalizeGeohash(geohash)
-        guard !gh.isEmpty, bookmarkNames[gh] == nil, !resolvingNames.contains(gh) else { return }
-        resolvingNames.insert(gh)
-
-        if gh.count <= 2 {
-            let b = Geohash.decodeBounds(gh)
-            let pts: [CLLocation] = [
-                CLLocation(latitude: (b.latMin + b.latMax) / 2, longitude: (b.lonMin + b.lonMax) / 2),
-                CLLocation(latitude: b.latMin, longitude: b.lonMin),
-                CLLocation(latitude: b.latMin, longitude: b.lonMax),
-                CLLocation(latitude: b.latMax, longitude: b.lonMin),
-                CLLocation(latitude: b.latMax, longitude: b.lonMax)
-            ]
-            resolveCompositeAdminName(geohash: gh, points: pts)
-        } else {
-            let center = Geohash.decodeCenter(gh)
-            let loc = CLLocation(latitude: center.lat, longitude: center.lon)
-            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
-                guard let self = self else { return }
-                defer { self.resolvingNames.remove(gh) }
-                if let pm = placemarks?.first,
-                   let name = Self.nameForGeohashLength(gh.count, from: pm),
-                   !name.isEmpty {
-                    DispatchQueue.main.async {
-                        self.bookmarkNames[gh] = name
-                        self.persistBookmarkNames()
-                    }
-                }
-            }
-        }
-    }
-
-    private func resolveCompositeAdminName(geohash gh: String, points: [CLLocation]) {
-        var uniqueAdmins: [String] = []
-        var seenAdmins = Set<String>()
-        var idx = 0
-
-        func step() {
-            if idx >= points.count {
-                let finalName: String? = {
-                    if uniqueAdmins.count >= 2 { return uniqueAdmins[0] + " and " + uniqueAdmins[1] }
-                    return uniqueAdmins.first
-                }()
-                if let finalName = finalName, !finalName.isEmpty {
-                    DispatchQueue.main.async {
-                        self.bookmarkNames[gh] = finalName
-                        self.persistBookmarkNames()
-                    }
-                }
-                self.resolvingNames.remove(gh)
-                return
-            }
-            let loc = points[idx]
-            idx += 1
-            geocoder.reverseGeocodeLocation(loc) { [weak self] placemarks, _ in
-                guard self != nil else { return }
-                if let pm = placemarks?.first {
-                    if let admin = pm.administrativeArea, !admin.isEmpty, !seenAdmins.contains(admin) {
-                        seenAdmins.insert(admin)
-                        uniqueAdmins.append(admin)
-                    } else if let country = pm.country, !country.isEmpty, !seenAdmins.contains(country) {
-                        seenAdmins.insert(country)
-                        uniqueAdmins.append(country)
-                    }
-                }
-                step()
-            }
-        }
-        step()
-    }
-
-    private static func nameForGeohashLength(_ len: Int, from pm: CLPlacemark) -> String? {
-        switch len {
-        case 0...2:
-            return pm.administrativeArea ?? pm.country
-        case 3...4:
-            return pm.administrativeArea ?? pm.subAdministrativeArea ?? pm.country
-        case 5:
-            return pm.locality ?? pm.subAdministrativeArea ?? pm.administrativeArea
-        case 6...7:
-            return pm.subLocality ?? pm.locality ?? pm.administrativeArea
-        default:
-            return pm.subLocality ?? pm.locality ?? pm.administrativeArea ?? pm.country
-        }
-    }
-
-    // MARK: - Private Helpers (Persistence)
-
-    private func persistTeleportedSet() {
-        if let data = try? JSONEncoder().encode(Array(teleportedSet)) {
-            storage.set(data, forKey: teleportedStoreKey)
-        }
-    }
-
-    private func persistBookmarks() {
-        if let data = try? JSONEncoder().encode(bookmarks) {
-            storage.set(data, forKey: bookmarksKey)
-        }
-    }
-
-    private func persistBookmarkNames() {
-        if let data = try? JSONEncoder().encode(bookmarkNames) {
-            storage.set(data, forKey: bookmarkNamesKey)
-        }
-    }
-
-    private static func normalizeGeohash(_ s: String) -> String {
-        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
-        return s
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-            .replacingOccurrences(of: "#", with: "")
-            .filter { allowed.contains($0) }
-    }
-}
-
-// MARK: - Backward Compatibility Typealiases
-
-typealias LocationChannelManager = LocationStateManager
-typealias GeohashBookmarksStore = LocationStateManager
-
-// MARK: - Backward Compatibility Extensions
-
-extension LocationStateManager {
-    /// Backward compatibility: toggle bookmark (was GeohashBookmarksStore.toggle)
-    func toggle(_ geohash: String) {
-        toggleBookmark(geohash)
-    }
-
-    /// Backward compatibility: add bookmark (was GeohashBookmarksStore.add)
-    func add(_ geohash: String) {
-        addBookmark(geohash)
-    }
-
-    /// Backward compatibility: remove bookmark (was GeohashBookmarksStore.remove)
-    func remove(_ geohash: String) {
-        removeBookmark(geohash)
-    }
-}
-#endif

bitchat/Services/MessageDeduplicationService.swift

@@ -1,278 +0,0 @@
-//
-// MessageDeduplicationService.swift
-// bitchat
-//
-// Handles message deduplication using LRU caches.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Foundation
-
-// MARK: - LRU Deduplication Cache
-
-/// Generic LRU (Least Recently Used) cache for deduplication.
-/// Uses an efficient O(1) lookup with periodic compaction.
-/// Thread-safe via @MainActor - all callers are already on main actor.
-@MainActor
-final class LRUDeduplicationCache<Value> {
-    private var map: [String: Value] = [:]
-    private var order: [String] = []
-    private var head: Int = 0
-    private let capacity: Int
-
-    /// Creates a new LRU cache with the specified capacity.
-    /// - Parameter capacity: Maximum number of entries before eviction
-    init(capacity: Int) {
-        precondition(capacity > 0, "LRU cache capacity must be positive")
-        self.capacity = capacity
-    }
-
-    /// Number of active entries in the cache
-    var count: Int {
-        order.count - head
-    }
-
-    /// Checks if a key exists in the cache
-    func contains(_ key: String) -> Bool {
-        map[key] != nil
-    }
-
-    /// Gets the value for a key, or nil if not present
-    func value(for key: String) -> Value? {
-        map[key]
-    }
-
-    /// Records a key-value pair, updating if exists or inserting if new
-    func record(_ key: String, value: Value) {
-        if map[key] == nil {
-            order.append(key)
-        }
-        map[key] = value
-        trimIfNeeded()
-    }
-
-    /// Removes a specific key from the cache
-    func remove(_ key: String) {
-        map.removeValue(forKey: key)
-        // Note: key remains in order array but will be skipped during eviction
-    }
-
-    /// Clears all entries from the cache
-    func clear() {
-        map.removeAll()
-        order.removeAll()
-        head = 0
-    }
-
-    // MARK: - Private
-
-    private func trimIfNeeded() {
-        let activeCount = order.count - head
-        guard activeCount > capacity else { return }
-
-        let overflow = activeCount - capacity
-        for _ in 0..<overflow {
-            guard let victim = popOldest() else { break }
-            map.removeValue(forKey: victim)
-        }
-    }
-
-    private func popOldest() -> String? {
-        // Skip keys that were already removed from map
-        while head < order.count {
-            let key = order[head]
-            head += 1
-
-            // Periodically compact the backing storage
-            if head >= 32 && head * 2 >= order.count {
-                order.removeFirst(head)
-                head = 0
-            }
-
-            // Only return if key is still in map
-            if map[key] != nil {
-                return key
-            }
-        }
-        return nil
-    }
-}
-
-// MARK: - Content Normalizer
-
-/// Normalizes message content for near-duplicate detection.
-enum ContentNormalizer {
-
-    /// Regex to simplify HTTP URLs by stripping query strings and fragments
-    private static let simplifyHTTPURL: NSRegularExpression = {
-        try! NSRegularExpression(
-            pattern: "https?://[^\\s?#]+(?:[?#][^\\s]*)?",
-            options: [.caseInsensitive]
-        )
-    }()
-
-    /// Normalizes content for deduplication comparison.
-    /// - Parameters:
-    ///   - content: The raw message content
-    ///   - prefixLength: Maximum characters to consider (default from TransportConfig)
-    /// - Returns: A hash-based key for comparison
-    static func normalizedKey(
-        _ content: String,
-        prefixLength: Int = TransportConfig.contentKeyPrefixLength
-    ) -> String {
-        // Lowercase for case-insensitive comparison
-        let lowered = content.lowercased()
-        let ns = lowered as NSString
-        let range = NSRange(location: 0, length: ns.length)
-
-        // Simplify URLs by stripping query/fragment
-        var simplified = ""
-        var last = 0
-        for match in simplifyHTTPURL.matches(in: lowered, options: [], range: range) {
-            if match.range.location > last {
-                simplified += ns.substring(with: NSRange(location: last, length: match.range.location - last))
-            }
-            let url = ns.substring(with: match.range)
-            if let queryIndex = url.firstIndex(where: { $0 == "?" || $0 == "#" }) {
-                simplified += String(url[..<queryIndex])
-            } else {
-                simplified += url
-            }
-            last = match.range.location + match.range.length
-        }
-        if last < ns.length {
-            simplified += ns.substring(with: NSRange(location: last, length: ns.length - last))
-        }
-
-        // Trim and collapse whitespace
-        let trimmed = simplified.trimmingCharacters(in: .whitespacesAndNewlines)
-        let collapsed = trimmed.replacingOccurrences(of: "\\s+", with: " ", options: .regularExpression)
-
-        // Take prefix and hash
-        let prefix = String(collapsed.prefix(prefixLength))
-        let hash = prefix.djb2()
-        return String(format: "h:%016llx", hash)
-    }
-}
-
-// MARK: - Message Deduplication Service
-
-/// Service that manages message deduplication using LRU caches.
-/// Provides separate caches for content-based dedup and Nostr event ID dedup.
-/// Thread-safe via @MainActor - all callers are already on main actor.
-@MainActor
-final class MessageDeduplicationService {
-
-    /// Cache for content-based near-duplicate detection
-    private let contentCache: LRUDeduplicationCache<Date>
-
-    /// Cache for Nostr event ID deduplication
-    private let nostrEventCache: LRUDeduplicationCache<Bool>
-
-    /// Cache for Nostr ACK deduplication (messageId:ackType:senderPubkey format)
-    private let nostrAckCache: LRUDeduplicationCache<Bool>
-
-    /// Creates a new deduplication service with specified capacities.
-    /// - Parameters:
-    ///   - contentCapacity: Max entries for content cache
-    ///   - nostrEventCapacity: Max entries for Nostr event cache
-    init(
-        contentCapacity: Int = TransportConfig.contentLRUCap,
-        nostrEventCapacity: Int = TransportConfig.uiProcessedNostrEventsCap
-    ) {
-        self.contentCache = LRUDeduplicationCache(capacity: contentCapacity)
-        self.nostrEventCache = LRUDeduplicationCache(capacity: nostrEventCapacity)
-        self.nostrAckCache = LRUDeduplicationCache(capacity: nostrEventCapacity)
-    }
-
-    // MARK: - Content Deduplication
-
-    /// Records content with its timestamp for near-duplicate detection.
-    /// - Parameters:
-    ///   - content: The message content
-    ///   - timestamp: When the content was received
-    func recordContent(_ content: String, timestamp: Date) {
-        let key = ContentNormalizer.normalizedKey(content)
-        contentCache.record(key, value: timestamp)
-    }
-
-    /// Records a pre-normalized content key with its timestamp.
-    /// - Parameters:
-    ///   - key: The normalized content key
-    ///   - timestamp: When the content was received
-    func recordContentKey(_ key: String, timestamp: Date) {
-        contentCache.record(key, value: timestamp)
-    }
-
-    /// Gets the timestamp for previously seen content.
-    /// - Parameter content: The message content
-    /// - Returns: The timestamp when first seen, or nil if not seen
-    func contentTimestamp(for content: String) -> Date? {
-        let key = ContentNormalizer.normalizedKey(content)
-        return contentCache.value(for: key)
-    }
-
-    /// Gets the timestamp for a pre-normalized content key.
-    /// - Parameter key: The normalized content key
-    /// - Returns: The timestamp when first seen, or nil if not seen
-    func contentTimestamp(forKey key: String) -> Date? {
-        contentCache.value(for: key)
-    }
-
-    /// Normalizes content to a deduplication key.
-    /// - Parameter content: The raw content
-    /// - Returns: A normalized hash key
-    func normalizedContentKey(_ content: String) -> String {
-        ContentNormalizer.normalizedKey(content)
-    }
-
-    // MARK: - Nostr Event Deduplication
-
-    /// Checks if a Nostr event has already been processed.
-    /// - Parameter eventId: The event ID
-    /// - Returns: true if already processed
-    func hasProcessedNostrEvent(_ eventId: String) -> Bool {
-        nostrEventCache.contains(eventId)
-    }
-
-    /// Records a Nostr event as processed.
-    /// - Parameter eventId: The event ID
-    func recordNostrEvent(_ eventId: String) {
-        nostrEventCache.record(eventId, value: true)
-    }
-
-    // MARK: - Nostr ACK Deduplication
-
-    /// Checks if a Nostr ACK has already been processed.
-    /// - Parameter ackKey: The ACK key in format "messageId:ackType:senderPubkey"
-    /// - Returns: true if already processed
-    func hasProcessedNostrAck(_ ackKey: String) -> Bool {
-        nostrAckCache.contains(ackKey)
-    }
-
-    /// Records a Nostr ACK as processed.
-    /// - Parameter ackKey: The ACK key in format "messageId:ackType:senderPubkey"
-    func recordNostrAck(_ ackKey: String) {
-        nostrAckCache.record(ackKey, value: true)
-    }
-
-    /// Creates an ACK key from components.
-    static func ackKey(messageId: String, ackType: String, senderPubkey: String) -> String {
-        "\(messageId):\(ackType):\(senderPubkey)"
-    }
-
-    // MARK: - Clear
-
-    /// Clears all caches
-    func clearAll() {
-        contentCache.clear()
-        nostrEventCache.clear()
-        nostrAckCache.clear()
-    }
-
-    /// Clears only the Nostr caches (events and ACKs)
-    func clearNostrCaches() {
-        nostrEventCache.clear()
-        nostrAckCache.clear()
-    }
-}

bitchat/Services/MessageFormattingEngine.swift

@@ -1,471 +0,0 @@
-//
-// MessageFormattingEngine.swift
-// bitchat
-//
-// Handles message text formatting, including mentions, hashtags, URLs, and tokens.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Foundation
-import SwiftUI
-
-// MARK: - Formatting Context Protocol
-
-/// Protocol defining the context needed for message formatting.
-/// Implemented by ChatViewModel to provide runtime state.
-@MainActor
-protocol MessageFormattingContext: AnyObject {
-    /// The user's current nickname
-    var nickname: String { get }
-
-    /// Determines if a message was sent by the current user
-    func isSelfMessage(_ message: BitchatMessage) -> Bool
-
-    /// Gets the color for a message's sender
-    func senderColor(for message: BitchatMessage, isDark: Bool) -> Color
-
-    /// Resolves a peer ID to a clickable URL
-    func peerURL(for peerID: PeerID) -> URL?
-}
-
-// MARK: - Formatting Engine
-
-/// Handles rich text formatting for chat messages.
-/// Extracts mentions, hashtags, URLs, Lightning invoices, and Cashu tokens.
-final class MessageFormattingEngine {
-
-    // MARK: - Precompiled Regexes
-
-    /// Precompiled regex patterns for message content parsing
-    enum Patterns {
-        static let hashtag: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "#([a-zA-Z0-9_]+)", options: [])
-        }()
-
-        static let mention: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)", options: [])
-        }()
-
-        static let cashu: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: [])
-        }()
-
-        static let bolt11: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "(?i)\\bln(bc|tb|bcrt)[0-9][a-z0-9]{50,}\\b", options: [])
-        }()
-
-        static let lnurl: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "(?i)\\blnurl1[a-z0-9]{20,}\\b", options: [])
-        }()
-
-        static let lightningScheme: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "(?i)\\blightning:[^\\s]+", options: [])
-        }()
-
-        static let linkDetector: NSDataDetector? = {
-            try? NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue)
-        }()
-
-        static let quickCashuPresence: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: [])
-        }()
-
-        static let simplifyHTTPURL: NSRegularExpression = {
-            try! NSRegularExpression(pattern: "https?://[^\\s?#]+(?:[?#][^\\s]*)?", options: [.caseInsensitive])
-        }()
-    }
-
-    // MARK: - Match Types
-
-    /// Types of matches found in message content
-    enum MatchType: String {
-        case hashtag
-        case mention
-        case url
-        case cashu
-        case lightning
-        case bolt11
-        case lnurl
-    }
-
-    /// A match found in message content
-    struct ContentMatch {
-        let range: NSRange
-        let type: MatchType
-    }
-
-    // MARK: - Public API
-
-    /// Formats a message with rich text styling
-    @MainActor
-    static func formatMessage(
-        _ message: BitchatMessage,
-        context: MessageFormattingContext,
-        colorScheme: ColorScheme
-    ) -> AttributedString {
-        let isDark = colorScheme == .dark
-        let isSelf = context.isSelfMessage(message)
-
-        // Check cache first
-        if let cached = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf) {
-            return cached
-        }
-
-        var result = AttributedString()
-        let baseColor: Color = isSelf ? .orange : context.senderColor(for: message, isDark: isDark)
-
-        // Format system messages differently
-        if message.sender == "system" {
-            result = formatSystemMessage(message, isDark: isDark)
-        } else {
-            // Format sender header
-            result = formatSenderHeader(
-                message: message,
-                baseColor: baseColor,
-                isSelf: isSelf,
-                context: context
-            )
-
-            // Format content
-            let contentResult = formatContent(
-                message.content,
-                baseColor: baseColor,
-                isSelf: isSelf,
-                isMentioned: message.mentions?.contains(context.nickname) ?? false
-            )
-            result.append(contentResult)
-
-            // Add timestamp
-            result.append(formatTimestamp(message.formattedTimestamp))
-        }
-
-        // Cache the result
-        message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf)
-
-        return result
-    }
-
-    /// Formats just the message header (sender portion)
-    @MainActor
-    static func formatHeader(
-        _ message: BitchatMessage,
-        context: MessageFormattingContext,
-        colorScheme: ColorScheme
-    ) -> AttributedString {
-        let isDark = colorScheme == .dark
-        let isSelf = context.isSelfMessage(message)
-        let baseColor: Color = isSelf ? .orange : context.senderColor(for: message, isDark: isDark)
-
-        if message.sender == "system" {
-            var style = AttributeContainer()
-            style.foregroundColor = baseColor
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
-            return AttributedString(message.sender).mergingAttributes(style)
-        }
-
-        return formatSenderHeader(
-            message: message,
-            baseColor: baseColor,
-            isSelf: isSelf,
-            context: context
-        )
-    }
-
-    /// Extracts mentions from message content
-    static func extractMentions(from content: String) -> [String] {
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = Patterns.mention.matches(in: content, options: [], range: range)
-
-        return matches.compactMap { match -> String? in
-            guard match.numberOfRanges > 1 else { return nil }
-            let captureRange = match.range(at: 1)
-            guard let swiftRange = Range(captureRange, in: content) else { return nil }
-            return String(content[swiftRange])
-        }
-    }
-
-    /// Checks if content contains a Cashu token
-    static func containsCashuToken(_ content: String) -> Bool {
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        return Patterns.quickCashuPresence.numberOfMatches(in: content, options: [], range: range) > 0
-    }
-
-    // MARK: - Private Helpers
-
-    private static func formatSystemMessage(_ message: BitchatMessage, isDark: Bool) -> AttributedString {
-        var result = AttributedString()
-
-        let content = AttributedString("* \(message.content) *")
-        var contentStyle = AttributeContainer()
-        contentStyle.foregroundColor = Color.gray
-        contentStyle.font = .bitchatSystem(size: 12, design: .monospaced).italic()
-        result.append(content.mergingAttributes(contentStyle))
-
-        // Add timestamp
-        let timestamp = AttributedString(" [\(message.formattedTimestamp)]")
-        var timestampStyle = AttributeContainer()
-        timestampStyle.foregroundColor = Color.gray.opacity(0.5)
-        timestampStyle.font = .bitchatSystem(size: 10, design: .monospaced)
-        result.append(timestamp.mergingAttributes(timestampStyle))
-
-        return result
-    }
-
-    @MainActor
-    private static func formatSenderHeader(
-        message: BitchatMessage,
-        baseColor: Color,
-        isSelf: Bool,
-        context: MessageFormattingContext
-    ) -> AttributedString {
-        var result = AttributedString()
-
-        let (baseName, suffix) = message.sender.splitSuffix()
-        var senderStyle = AttributeContainer()
-        senderStyle.foregroundColor = baseColor
-        let fontWeight: Font.Weight = isSelf ? .bold : .medium
-        senderStyle.font = .bitchatSystem(size: 14, weight: fontWeight, design: .monospaced)
-
-        // Make sender clickable
-        if let spid = message.senderPeerID, let url = context.peerURL(for: spid) {
-            senderStyle.link = url
-        }
-
-        // Build: "<@baseName#suffix> "
-        result.append(AttributedString("<@").mergingAttributes(senderStyle))
-        result.append(AttributedString(baseName).mergingAttributes(senderStyle))
-
-        if !suffix.isEmpty {
-            var suffixStyle = senderStyle
-            suffixStyle.foregroundColor = baseColor.opacity(0.6)
-            result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
-        }
-
-        result.append(AttributedString("> ").mergingAttributes(senderStyle))
-
-        return result
-    }
-
-    private static func formatContent(
-        _ content: String,
-        baseColor: Color,
-        isSelf: Bool,
-        isMentioned: Bool
-    ) -> AttributedString {
-        // For very long content without special tokens, use plain formatting
-        let containsCashu = containsCashuToken(content)
-        if (content.count > 4000 || content.hasVeryLongToken(threshold: 1024)) && !containsCashu {
-            return formatPlainContent(content, baseColor: baseColor, isSelf: isSelf)
-        }
-
-        // Find all matches
-        let matches = findAllMatches(in: content)
-
-        // Build formatted content
-        var result = AttributedString()
-        var lastEnd = content.startIndex
-
-        for match in matches {
-            guard let swiftRange = Range(match.range, in: content) else { continue }
-
-            // Add text before match
-            if lastEnd < swiftRange.lowerBound {
-                let beforeText = String(content[lastEnd..<swiftRange.lowerBound])
-                result.append(formatPlainText(beforeText, baseColor: baseColor, isSelf: isSelf, isMentioned: isMentioned))
-            }
-
-            // Add styled match
-            let matchText = String(content[swiftRange])
-            result.append(formatMatch(matchText, type: match.type, baseColor: baseColor, isSelf: isSelf))
-
-            lastEnd = swiftRange.upperBound
-        }
-
-        // Add remaining text
-        if lastEnd < content.endIndex {
-            let remainingText = String(content[lastEnd...])
-            result.append(formatPlainText(remainingText, baseColor: baseColor, isSelf: isSelf, isMentioned: isMentioned))
-        }
-
-        return result
-    }
-
-    private static func findAllMatches(in content: String) -> [ContentMatch] {
-        let nsContent = content as NSString
-        let nsLen = nsContent.length
-        let fullRange = NSRange(location: 0, length: nsLen)
-
-        // Quick hints to avoid unnecessary regex work
-        let hasMentions = content.contains("@")
-        let hasHashtags = content.contains("#")
-        let hasURLs = content.contains("://") || content.contains("www.") || content.contains("http")
-        let hasLightning = content.lowercased().contains("ln") || content.lowercased().contains("lightning:")
-        let hasCashu = content.lowercased().contains("cashu")
-
-        // Collect matches
-        let mentionMatches = hasMentions ? Patterns.mention.matches(in: content, options: [], range: fullRange) : []
-        let hashtagMatches = hasHashtags ? Patterns.hashtag.matches(in: content, options: [], range: fullRange) : []
-        let urlMatches = hasURLs ? (Patterns.linkDetector?.matches(in: content, options: [], range: fullRange) ?? []) : []
-        let cashuMatches = hasCashu ? Patterns.cashu.matches(in: content, options: [], range: fullRange) : []
-        let lightningMatches = hasLightning ? Patterns.lightningScheme.matches(in: content, options: [], range: fullRange) : []
-        let bolt11Matches = hasLightning ? Patterns.bolt11.matches(in: content, options: [], range: fullRange) : []
-        let lnurlMatches = hasLightning ? Patterns.lnurl.matches(in: content, options: [], range: fullRange) : []
-
-        // Build mention ranges for overlap checking
-        let mentionRanges = mentionMatches.map { $0.range(at: 0) }
-
-        func overlapsMention(_ r: NSRange) -> Bool {
-            mentionRanges.contains { NSIntersectionRange(r, $0).length > 0 }
-        }
-
-        func isStandaloneHashtag(_ r: NSRange) -> Bool {
-            guard let swiftRange = Range(r, in: content) else { return false }
-            if swiftRange.lowerBound == content.startIndex { return true }
-            let prev = content.index(before: swiftRange.lowerBound)
-            return content[prev].isWhitespace || content[prev].isNewline
-        }
-
-        func attachedToMention(_ r: NSRange) -> Bool {
-            guard let swiftRange = Range(r, in: content), swiftRange.lowerBound > content.startIndex else { return false }
-            var i = content.index(before: swiftRange.lowerBound)
-            while true {
-                let ch = content[i]
-                if ch.isWhitespace || ch.isNewline { break }
-                if ch == "@" { return true }
-                if i == content.startIndex { break }
-                i = content.index(before: i)
-            }
-            return false
-        }
-
-        var allMatches: [ContentMatch] = []
-
-        // Add hashtags (excluding those attached to mentions)
-        for match in hashtagMatches {
-            let range = match.range(at: 0)
-            if !overlapsMention(range) && !attachedToMention(range) && isStandaloneHashtag(range) {
-                allMatches.append(ContentMatch(range: range, type: .hashtag))
-            }
-        }
-
-        // Add mentions
-        for match in mentionMatches {
-            allMatches.append(ContentMatch(range: match.range(at: 0), type: .mention))
-        }
-
-        // Add URLs
-        for match in urlMatches where !overlapsMention(match.range) {
-            allMatches.append(ContentMatch(range: match.range, type: .url))
-        }
-
-        // Add Cashu tokens
-        for match in cashuMatches where !overlapsMention(match.range(at: 0)) {
-            allMatches.append(ContentMatch(range: match.range(at: 0), type: .cashu))
-        }
-
-        // Add Lightning scheme URLs
-        for match in lightningMatches where !overlapsMention(match.range(at: 0)) {
-            allMatches.append(ContentMatch(range: match.range(at: 0), type: .lightning))
-        }
-
-        // Add bolt11/lnurl (avoiding overlaps with lightning scheme and URLs)
-        let occupied = urlMatches.map { $0.range } + lightningMatches.map { $0.range(at: 0) }
-        func overlapsOccupied(_ r: NSRange) -> Bool {
-            occupied.contains { NSIntersectionRange(r, $0).length > 0 }
-        }
-
-        for match in bolt11Matches where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
-            allMatches.append(ContentMatch(range: match.range(at: 0), type: .bolt11))
-        }
-
-        for match in lnurlMatches where !overlapsMention(match.range(at: 0)) && !overlapsOccupied(match.range(at: 0)) {
-            allMatches.append(ContentMatch(range: match.range(at: 0), type: .lnurl))
-        }
-
-        // Sort by position
-        return allMatches.sorted { $0.range.location < $1.range.location }
-    }
-
-    private static func formatPlainContent(_ content: String, baseColor: Color, isSelf: Bool) -> AttributedString {
-        var style = AttributeContainer()
-        style.foregroundColor = baseColor
-        style.font = isSelf
-            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-            : .bitchatSystem(size: 14, design: .monospaced)
-        return AttributedString(content).mergingAttributes(style)
-    }
-
-    private static func formatPlainText(_ text: String, baseColor: Color, isSelf: Bool, isMentioned: Bool) -> AttributedString {
-        guard !text.isEmpty else { return AttributedString() }
-
-        var style = AttributeContainer()
-        style.foregroundColor = baseColor
-        style.font = isSelf
-            ? .bitchatSystem(size: 14, weight: .bold, design: .monospaced)
-            : .bitchatSystem(size: 14, design: .monospaced)
-
-        if isMentioned {
-            style.font = style.font?.bold()
-        }
-
-        return AttributedString(text).mergingAttributes(style)
-    }
-
-    private static func formatMatch(_ text: String, type: MatchType, baseColor: Color, isSelf: Bool) -> AttributedString {
-        var style = AttributeContainer()
-
-        switch type {
-        case .mention:
-            // Split optional '#abcd' suffix
-            let (baseName, suffix) = text.splitSuffix()
-            var result = AttributedString()
-
-            var mentionStyle = AttributeContainer()
-            mentionStyle.foregroundColor = .blue
-            mentionStyle.font = .bitchatSystem(size: 14, weight: .semibold, design: .monospaced)
-            result.append(AttributedString(baseName).mergingAttributes(mentionStyle))
-
-            if !suffix.isEmpty {
-                var suffixStyle = mentionStyle
-                suffixStyle.foregroundColor = Color.gray.opacity(0.7)
-                result.append(AttributedString(suffix).mergingAttributes(suffixStyle))
-            }
-
-            return result
-
-        case .hashtag:
-            style.foregroundColor = .purple
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
-
-        case .url:
-            style.foregroundColor = .blue
-            style.font = .bitchatSystem(size: 14, design: .monospaced)
-            style.underlineStyle = .single
-            if let url = URL(string: text) {
-                style.link = url
-            }
-
-        case .cashu:
-            style.foregroundColor = .green
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
-            style.backgroundColor = Color.green.opacity(0.1)
-
-        case .lightning, .bolt11, .lnurl:
-            style.foregroundColor = .yellow
-            style.font = .bitchatSystem(size: 14, weight: .medium, design: .monospaced)
-            style.backgroundColor = Color.yellow.opacity(0.1)
-        }
-
-        return AttributedString(text).mergingAttributes(style)
-    }
-
-    private static func formatTimestamp(_ timestamp: String) -> AttributedString {
-        let text = AttributedString(" [\(timestamp)]")
-        var style = AttributeContainer()
-        style.foregroundColor = Color.gray.opacity(0.5)
-        style.font = .bitchatSystem(size: 10, design: .monospaced)
-        return text.mergingAttributes(style)
-    }
-}

bitchat/Services/MessageRouter.swift

@@ -1,14 +1,17 @@
 import BitLogger
 import Foundation
 
-/// Routes messages using available transports (Mesh, Nostr, etc.)
+/// Routes messages between BLE and Nostr transports
 @MainActor
 final class MessageRouter {
-    private let transports: [Transport]
+    private let mesh: Transport
+    private let nostr: NostrTransport
     private var outbox: [PeerID: [(content: String, nickname: String, messageID: String)]] = [:] // peerID -> queued messages
 
-    init(transports: [Transport]) {
-        self.transports = transports
+    init(mesh: Transport, nostr: NostrTransport) {
+        self.mesh = mesh
+        self.nostr = nostr
+        self.nostr.senderPeerID = mesh.myPeerID
 
         // Observe favorites changes to learn Nostr mapping and flush queued messages
         NotificationCenter.default.addObserver(
@@ -35,70 +38,88 @@ final class MessageRouter {
     }
 
     func sendPrivate(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        // Try to find a reachable transport
-        if let transport = transports.first(where: { $0.isPeerReachable(peerID) }) {
-            SecureLogger.debug("Routing PM via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            transport.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
+        let reachableMesh = mesh.isPeerReachable(peerID)
+        if reachableMesh {
+            SecureLogger.debug("Routing PM via mesh (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            // BLEService will initiate a handshake if needed and queue the message
+            mesh.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
+        } else if canSendViaNostr(peerID: peerID) {
+            SecureLogger.debug("Routing PM via Nostr to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            nostr.sendPrivateMessage(content, to: peerID, recipientNickname: recipientNickname, messageID: messageID)
         } else {
-            // Queue for later
+            // Queue for later (when mesh connects or Nostr mapping appears)
             if outbox[peerID] == nil { outbox[peerID] = [] }
             outbox[peerID]?.append((content, recipientNickname, messageID))
-            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no reachable transport) id=\(messageID.prefix(8))…", category: .session)
+            SecureLogger.debug("Queued PM for \(peerID.id.prefix(8))… (no mesh, no Nostr mapping) id=\(messageID.prefix(8))…", category: .session)
         }
     }
 
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        if let transport = transports.first(where: { $0.isPeerReachable(peerID) }) {
-            SecureLogger.debug("Routing READ ack via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
-            transport.sendReadReceipt(receipt, to: peerID)
-        } else if !transports.isEmpty {
-            // Fallback to last transport (usually Nostr) if neither is explicitly reachable?
-            // Or better: just try the first one that supports it?
-            // Existing logic preferred mesh, then nostr.
-            // If neither reachable, existing logic queued it (via mesh usually) or sent via nostr.
-            // Let's stick to "try reachable". If none, maybe pick the first one to queue?
-            // Actually, for READ receipts, we might want to just fire-and-forget on the "best effort" transport.
-            // But let's stick to the reachable check.
-            SecureLogger.debug("No reachable transport for READ ack to \(peerID.id.prefix(8))…", category: .session)
+        // Prefer mesh for reachable peers; BLE will queue if handshake is needed
+        if mesh.isPeerReachable(peerID) {
+            SecureLogger.debug("Routing READ ack via mesh (reachable) to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
+            mesh.sendReadReceipt(receipt, to: peerID)
+        } else {
+            SecureLogger.debug("Routing READ ack via Nostr to \(peerID.id.prefix(8))… id=\(receipt.originalMessageID.prefix(8))…", category: .session)
+            nostr.sendReadReceipt(receipt, to: peerID)
         }
     }
 
     func sendDeliveryAck(_ messageID: String, to peerID: PeerID) {
-        if let transport = transports.first(where: { $0.isPeerReachable(peerID) }) {
-            SecureLogger.debug("Routing DELIVERED ack via \(type(of: transport)) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-            transport.sendDeliveryAck(for: messageID, to: peerID)
+        if mesh.isPeerReachable(peerID) {
+            SecureLogger.debug("Routing DELIVERED ack via mesh (reachable) to \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+            mesh.sendDeliveryAck(for: messageID, to: peerID)
+        } else {
+            nostr.sendDeliveryAck(for: messageID, to: peerID)
         }
     }
 
     func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
-        if let transport = transports.first(where: { $0.isPeerConnected(peerID) }) {
-            transport.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
-        } else if let transport = transports.first(where: { $0.isPeerReachable(peerID) }) {
-             transport.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
+        // Route via mesh when connected; else use Nostr
+        if mesh.isPeerConnected(peerID) {
+            mesh.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
         } else {
-            // Fallback: try all? or just the last one?
-            // Old logic: if mesh connected, mesh. Else nostr.
-            // Note: NostrTransport.isPeerReachable now returns true if mapped.
-            // If not mapped, we can't send via Nostr anyway.
+            nostr.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
         }
     }
 
     // MARK: - Outbox Management
+    private func canSendViaNostr(peerID: PeerID) -> Bool {
+        // Two forms are supported:
+        // - 64-hex Noise public key (32 bytes)
+        // - 16-hex short peer ID (derived from Noise pubkey)
+        if let noiseKey = peerID.noiseKey {
+            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
+               fav.peerNostrPublicKey != nil {
+                return true
+            }
+        } else if peerID.isShort {
+            if let fav = FavoritesPersistenceService.shared.getFavoriteStatus(forPeerID: peerID),
+               fav.peerNostrPublicKey != nil {
+                return true
+            }
+        }
+        return false
+    }
 
     func flushOutbox(for peerID: PeerID) {
         guard let queued = outbox[peerID], !queued.isEmpty else { return }
         SecureLogger.debug("Flushing outbox for \(peerID.id.prefix(8))… count=\(queued.count)", category: .session)
         var remaining: [(content: String, nickname: String, messageID: String)] = []
-        
+        // Prefer mesh if connected; else try Nostr if mapping exists
         for (content, nickname, messageID) in queued {
-            if let transport = transports.first(where: { $0.isPeerReachable(peerID) }) {
-                SecureLogger.debug("Outbox -> \(type(of: transport)) for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
-                transport.sendPrivateMessage(content, to: peerID, recipientNickname: nickname, messageID: messageID)
+            if mesh.isPeerReachable(peerID) {
+                SecureLogger.debug("Outbox -> mesh for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+                mesh.sendPrivateMessage(content, to: peerID, recipientNickname: nickname, messageID: messageID)
+            } else if canSendViaNostr(peerID: peerID) {
+                SecureLogger.debug("Outbox -> Nostr for \(peerID.id.prefix(8))… id=\(messageID.prefix(8))…", category: .session)
+                nostr.sendPrivateMessage(content, to: peerID, recipientNickname: nickname, messageID: messageID)
             } else {
+                // Keep unsent items queued
                 remaining.append((content, nickname, messageID))
             }
         }
-        
+        // Persist only items we could not send
         if remaining.isEmpty {
             outbox.removeValue(forKey: peerID)
         } else {

bitchat/Services/NostrTransport.swift

@@ -3,7 +3,7 @@ import Foundation
 import Combine
 
 // Minimal Nostr transport conforming to Transport for offline sending
-final class NostrTransport: Transport, @unchecked Sendable {
+final class NostrTransport: Transport {
     // Provide BLE short peer ID for BitChat embedding
     var senderPeerID = PeerID(str: "")
 
@@ -18,49 +18,9 @@ final class NostrTransport: Transport, @unchecked Sendable {
     private let keychain: KeychainManagerProtocol
     private let idBridge: NostrIdentityBridge
 
-    // Reachability Cache (thread-safe)
-    private var reachablePeers: Set<PeerID> = []
-    private let queue = DispatchQueue(label: "nostr.transport.state", attributes: .concurrent)
-
-    @MainActor
     init(keychain: KeychainManagerProtocol, idBridge: NostrIdentityBridge) {
         self.keychain = keychain
         self.idBridge = idBridge
-        
-        setupObservers()
-        
-        // Synchronously warm the cache to avoid startup race
-        let favorites = FavoritesPersistenceService.shared.favorites
-        let reachable = favorites.values
-            .filter { $0.peerNostrPublicKey != nil }
-            .map { PeerID(publicKey: $0.peerNoisePublicKey) }
-            
-        queue.sync(flags: .barrier) {
-            self.reachablePeers = Set(reachable)
-        }
-    }
-
-    private func setupObservers() {
-        NotificationCenter.default.addObserver(
-            forName: .favoriteStatusChanged,
-            object: nil,
-            queue: nil
-        ) { [weak self] _ in
-            self?.refreshReachablePeers()
-        }
-    }
-
-    private func refreshReachablePeers() {
-        Task { @MainActor in
-            let favorites = FavoritesPersistenceService.shared.favorites
-            let reachable = favorites.values
-                .filter { $0.peerNostrPublicKey != nil }
-                .map { PeerID(publicKey: $0.peerNoisePublicKey) }
-            
-            self.queue.async(flags: .barrier) { [weak self] in
-                self?.reachablePeers = Set(reachable)
-            }
-        }
     }
 
     // MARK: - Transport Protocol Conformance
@@ -82,19 +42,7 @@ final class NostrTransport: Transport, @unchecked Sendable {
     func emergencyDisconnectAll() { /* no-op */ }
 
     func isPeerConnected(_ peerID: PeerID) -> Bool { false }
-    
-    func isPeerReachable(_ peerID: PeerID) -> Bool {
-        queue.sync {
-            // Check if exact match
-            if reachablePeers.contains(peerID) { return true }
-            // Check for short ID match
-            if peerID.isShort {
-                return reachablePeers.contains(where: { $0.toShort() == peerID })
-            }
-            return false
-        }
-    }
-    
+    func isPeerReachable(_ peerID: PeerID) -> Bool { false }
     func peerNickname(peerID: PeerID) -> String? { nil }
     func getPeerNicknames() -> [PeerID : String] { [:] }
 
@@ -149,11 +97,8 @@ final class NostrTransport: Transport, @unchecked Sendable {
 
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
         // Enqueue and process with throttling to avoid relay rate limits
-        // Use barrier to synchronize access to readQueue
-        queue.async(flags: .barrier) { [weak self] in
-            self?.readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
-            self?.processReadQueueIfNeeded()
-        }
+        readQueue.append(QueuedRead(receipt: receipt, peerID: peerID))
+        processReadQueueIfNeeded()
     }
 
     func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
@@ -168,10 +113,7 @@ final class NostrTransport: Transport, @unchecked Sendable {
                 let (hrp, data) = try Bech32.decode(recipientNpub)
                 guard hrp == "npub" else { return }
                 recipientHex = data.hexEncodedString()
-            } catch {
-                SecureLogger.error("NostrTransport: failed to decode recipient npub for favorite notification: \(error.localizedDescription)", category: .session)
-                return
-            }
+            } catch { return }
             guard let embedded = NostrEmbeddedBitChat.encodePMForNostr(content: content, messageID: UUID().uuidString, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed favorite notification", category: .session)
                 return
@@ -196,10 +138,7 @@ final class NostrTransport: Transport, @unchecked Sendable {
                 let (hrp, data) = try Bech32.decode(recipientNpub)
                 guard hrp == "npub" else { return }
                 recipientHex = data.hexEncodedString()
-            } catch {
-                SecureLogger.error("NostrTransport: failed to decode recipient npub for delivery ack: \(error.localizedDescription)", category: .session)
-                return
-            }
+            } catch { return }
             guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .delivered, messageID: messageID, recipientPeerID: peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed DELIVERED ack", category: .session)
                 return
@@ -263,17 +202,16 @@ extension NostrTransport {
 // MARK: - Private Helpers
 
 extension NostrTransport {
-    /// Must be called within a barrier on `queue`
     private func processReadQueueIfNeeded() {
         guard !isSendingReadAcks else { return }
         guard !readQueue.isEmpty else { return }
         isSendingReadAcks = true
-        let item = readQueue.removeFirst()
-        sendReadAckItem(item)
+        sendNextReadAck()
     }
 
-    /// Sends a single read ack item (called after extraction from queue within barrier)
-    private func sendReadAckItem(_ item: QueuedRead) {
+    private func sendNextReadAck() {
+        guard !readQueue.isEmpty else { isSendingReadAcks = false; return }
+        let item = readQueue.removeFirst()
         Task { @MainActor in
             guard let recipientNpub = resolveRecipientNpub(for: item.peerID) else { scheduleNextReadAck(); return }
             guard let senderIdentity = try? idBridge.getCurrentNostrIdentity() else { scheduleNextReadAck(); return }
@@ -284,11 +222,7 @@ extension NostrTransport {
                 let (hrp, data) = try Bech32.decode(recipientNpub)
                 guard hrp == "npub" else { scheduleNextReadAck(); return }
                 recipientHex = data.hexEncodedString()
-            } catch {
-                SecureLogger.error("NostrTransport: failed to decode recipient npub for read ack: \(error.localizedDescription)", category: .session)
-                scheduleNextReadAck()
-                return
-            }
+            } catch { scheduleNextReadAck(); return }
             guard let ack = NostrEmbeddedBitChat.encodeAckForNostr(type: .readReceipt, messageID: item.receipt.originalMessageID, recipientPeerID: item.peerID, senderPeerID: senderPeerID) else {
                 SecureLogger.error("NostrTransport: failed to embed READ ack", category: .session)
                 scheduleNextReadAck(); return
@@ -305,10 +239,9 @@ extension NostrTransport {
 
     private func scheduleNextReadAck() {
         DispatchQueue.main.asyncAfter(deadline: .now() + readAckInterval) { [weak self] in
-            self?.queue.async(flags: .barrier) { [weak self] in
-                self?.isSendingReadAcks = false
-                self?.processReadQueueIfNeeded()
-            }
+            guard let self = self else { return }
+            self.isSendingReadAcks = false
+            self.processReadQueueIfNeeded()
         }
     }
 

bitchat/Services/NotificationService.swift

@@ -16,21 +16,10 @@ import AppKit
 
 final class NotificationService {
     static let shared = NotificationService()
-
-    /// Returns true if running in test environment (XCTest, Swift Testing, or CI)
-    private var isRunningTests: Bool {
-        let env = ProcessInfo.processInfo.environment
-        return NSClassFromString("XCTestCase") != nil ||
-               env["XCTestConfigurationFilePath"] != nil ||
-               env["XCTestBundlePath"] != nil ||
-               env["GITHUB_ACTIONS"] != nil ||
-               env["CI"] != nil
-    }
-
+    
     private init() {}
-
+    
     func requestAuthorization() {
-        guard !isRunningTests else { return }
         UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .sound, .badge]) { granted, error in
             if granted {
                 // Permission granted
@@ -47,7 +36,6 @@ final class NotificationService {
         userInfo: [String: Any]? = nil,
         interruptionLevel: UNNotificationInterruptionLevel = .active
     ) {
-        guard !isRunningTests else { return }
         let content = UNMutableNotificationContent()
         content.title = title
         content.body = body

bitchat/Services/PrivateChatManager.swift

@@ -15,174 +15,20 @@ final class PrivateChatManager: ObservableObject {
     @Published var privateChats: [PeerID: [BitchatMessage]] = [:]
     @Published var selectedPeer: PeerID? = nil
     @Published var unreadMessages: Set<PeerID> = []
-
+    
     private var selectedPeerFingerprint: String? = nil
     var sentReadReceipts: Set<String> = []  // Made accessible for ChatViewModel
-
+    
     weak var meshService: Transport?
     // Route acks/receipts via MessageRouter (chooses mesh or Nostr)
     weak var messageRouter: MessageRouter?
-    // Peer service for looking up peer info during consolidation
-    weak var unifiedPeerService: UnifiedPeerService?
-
+    
     init(meshService: Transport? = nil) {
         self.meshService = meshService
     }
 
     // Cap for messages stored per private chat
     private let privateChatCap = TransportConfig.privateChatCap
-
-    // MARK: - Message Consolidation
-
-    /// Consolidates messages from different peer ID representations into a single chat.
-    /// This ensures messages from stable Noise keys and temporary Nostr peer IDs are merged.
-    /// - Parameters:
-    ///   - peerID: The target peer ID to consolidate messages into
-    ///   - peerNickname: The peer's display name (lowercased for matching)
-    ///   - persistedReadReceipts: The persisted read receipts set from ChatViewModel (UserDefaults-backed)
-    /// - Returns: True if any unread messages were found during consolidation
-    @MainActor
-    func consolidateMessages(for peerID: PeerID, peerNickname: String, persistedReadReceipts: Set<String>) -> Bool {
-        guard let meshService = meshService else { return false }
-        var hasUnreadMessages = false
-
-        // 1. Consolidate from stable Noise key (64-char hex)
-        if let peer = unifiedPeerService?.getPeer(by: peerID) {
-            let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
-
-            if noiseKeyHex != peerID, let nostrMessages = privateChats[noiseKeyHex], !nostrMessages.isEmpty {
-                if privateChats[peerID] == nil {
-                    privateChats[peerID] = []
-                }
-
-                let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
-                for message in nostrMessages {
-                    if !existingMessageIds.contains(message.id) {
-                        // Update senderPeerID for correct read receipts
-                        let updatedMessage = BitchatMessage(
-                            id: message.id,
-                            sender: message.sender,
-                            content: message.content,
-                            timestamp: message.timestamp,
-                            isRelay: message.isRelay,
-                            originalSender: message.originalSender,
-                            isPrivate: message.isPrivate,
-                            recipientNickname: message.recipientNickname,
-                            senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
-                            mentions: message.mentions,
-                            deliveryStatus: message.deliveryStatus
-                        )
-                        privateChats[peerID]?.append(updatedMessage)
-
-                        // Check for recent unread messages (< 60s, not sent by us, not already read)
-                        // Use persistedReadReceipts to correctly identify already-read messages after app restart
-                        if message.senderPeerID != meshService.myPeerID {
-                            let messageAge = Date().timeIntervalSince(message.timestamp)
-                            if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
-                                hasUnreadMessages = true
-                            }
-                        }
-                    }
-                }
-
-                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
-
-                if hasUnreadMessages {
-                    unreadMessages.insert(peerID)
-                } else if unreadMessages.contains(noiseKeyHex) {
-                    unreadMessages.remove(noiseKeyHex)
-                }
-
-                privateChats.removeValue(forKey: noiseKeyHex)
-            }
-        }
-
-        // 2. Consolidate from temporary Nostr peer IDs (nostr_* prefixed)
-        let normalizedNickname = peerNickname.lowercased()
-        var tempPeerIDsToConsolidate: [PeerID] = []
-
-        for (storedPeerID, messages) in privateChats {
-            if storedPeerID.isGeoDM && storedPeerID != peerID {
-                let nicknamesMatch = messages.allSatisfy { $0.sender.lowercased() == normalizedNickname }
-                if nicknamesMatch && !messages.isEmpty {
-                    tempPeerIDsToConsolidate.append(storedPeerID)
-                }
-            }
-        }
-
-        if !tempPeerIDsToConsolidate.isEmpty {
-            if privateChats[peerID] == nil {
-                privateChats[peerID] = []
-            }
-
-            let existingMessageIds = Set(privateChats[peerID]?.map { $0.id } ?? [])
-            var consolidatedCount = 0
-            var hadUnreadTemp = false
-
-            for tempPeerID in tempPeerIDsToConsolidate {
-                if unreadMessages.contains(tempPeerID) {
-                    hadUnreadTemp = true
-                }
-
-                if let tempMessages = privateChats[tempPeerID] {
-                    for message in tempMessages {
-                        if !existingMessageIds.contains(message.id) {
-                            let updatedMessage = BitchatMessage(
-                                id: message.id,
-                                sender: message.sender,
-                                content: message.content,
-                                timestamp: message.timestamp,
-                                isRelay: message.isRelay,
-                                originalSender: message.originalSender,
-                                isPrivate: message.isPrivate,
-                                recipientNickname: message.recipientNickname,
-                                senderPeerID: peerID,
-                                mentions: message.mentions,
-                                deliveryStatus: message.deliveryStatus
-                            )
-                            privateChats[peerID]?.append(updatedMessage)
-                            consolidatedCount += 1
-                        }
-                    }
-                    privateChats.removeValue(forKey: tempPeerID)
-                    unreadMessages.remove(tempPeerID)
-                }
-            }
-
-            if hadUnreadTemp {
-                unreadMessages.insert(peerID)
-                hasUnreadMessages = true
-                SecureLogger.debug("📬 Transferred unread status from temp peer IDs to \(peerID)", category: .session)
-            }
-
-            if consolidatedCount > 0 {
-                privateChats[peerID]?.sort { $0.timestamp < $1.timestamp }
-                SecureLogger.info("📥 Consolidated \(consolidatedCount) Nostr messages from temporary peer IDs to \(peerNickname)", category: .session)
-            }
-        }
-
-        return hasUnreadMessages
-    }
-
-    /// Syncs the read receipt tracking between manager and view model for sent messages
-    @MainActor
-    func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set<String>) {
-        guard let messages = privateChats[peerID] else { return }
-
-        for message in messages {
-            if message.sender == nickname {
-                if let status = message.deliveryStatus {
-                    switch status {
-                    case .read, .delivered:
-                        externalReceipts.insert(message.id)
-                        sentReadReceipts.insert(message.id)
-                    case .failed, .partiallyDelivered, .sending, .sent:
-                        break
-                    }
-                }
-            }
-        }
-    }
     
     /// Start a private chat with a peer
     func startChat(with peerID: PeerID) {

bitchat/Utils/MessageDeduplicator.swift

@@ -2,112 +2,66 @@ import Foundation
 
 // MARK: - Message Deduplicator (shared)
 
-/// Thread-safe deduplicator with LRU eviction and time-based expiry.
-/// Used for both message ID deduplication (network layer) and content key deduplication (UI layer).
 final class MessageDeduplicator {
-    private struct Entry: Equatable {
-        let id: String
+    private struct Entry {
+        let messageID: String
         let timestamp: Date
     }
 
     private var entries: [Entry] = []
     private var head: Int = 0
-    private var lookup: [String: Date] = [:]  // id -> timestamp for O(1) lookup
+    private var lookup = Set<String>()
     private let lock = NSLock()
-    private let maxAge: TimeInterval
-    private let maxCount: Int
+    private let maxAge: TimeInterval = TransportConfig.messageDedupMaxAgeSeconds  // 5 minutes
+    private let maxCount = TransportConfig.messageDedupMaxCount
 
-    /// Initialize with default config from TransportConfig
-    convenience init() {
-        self.init(
-            maxAge: TransportConfig.messageDedupMaxAgeSeconds,
-            maxCount: TransportConfig.messageDedupMaxCount
-        )
-    }
-
-    /// Initialize with custom config for content deduplication
-    init(maxAge: TimeInterval, maxCount: Int) {
-        self.maxAge = maxAge
-        self.maxCount = maxCount
-    }
-
-    /// Check if message is duplicate and add if not.
-    /// - Parameter id: The message identifier to check.
-    /// - Returns: `true` if the message was already seen, `false` otherwise.
-    func isDuplicate(_ id: String) -> Bool {
+    /// Check if message is duplicate and add if not
+    func isDuplicate(_ messageID: String) -> Bool {
         lock.lock()
         defer { lock.unlock() }
 
-        let now = Date()
-        cleanupOldEntries(before: now.addingTimeInterval(-maxAge))
+        cleanupOldEntries()
 
-        if lookup[id] != nil {
+        if lookup.contains(messageID) {
             return true
         }
 
-        entries.append(Entry(id: id, timestamp: now))
-        lookup[id] = now
-        trimIfNeeded()
+        entries.append(Entry(messageID: messageID, timestamp: Date()))
+        lookup.insert(messageID)
+
+        // Soft-cap and advance head by a chunk to avoid O(n) shifting
+        if (entries.count - head) > maxCount {
+            let removeCount = min(100, entries.count - head)
+            for i in head..<(head + removeCount) {
+                lookup.remove(entries[i].messageID)
+            }
+            head += removeCount
+            // Periodically compact to reclaim memory
+            if head > entries.count / 2 {
+                entries.removeFirst(head)
+                head = 0
+            }
+        }
 
         return false
     }
 
-    /// Record an ID with a specific timestamp (for content key tracking)
-    func record(_ id: String, timestamp: Date) {
-        lock.lock()
-        defer { lock.unlock() }
-
-        if lookup[id] == nil {
-            entries.append(Entry(id: id, timestamp: timestamp))
-        }
-        lookup[id] = timestamp
-        trimIfNeeded()
-    }
-
     /// Add an ID without checking (for announce-back tracking)
-    func markProcessed(_ id: String) {
+    func markProcessed(_ messageID: String) {
         lock.lock()
         defer { lock.unlock() }
 
-        if lookup[id] == nil {
-            let now = Date()
-            entries.append(Entry(id: id, timestamp: now))
-            lookup[id] = now
+        if !lookup.contains(messageID) {
+            entries.append(Entry(messageID: messageID, timestamp: Date()))
+            lookup.insert(messageID)
         }
     }
 
     /// Check if ID exists without adding
-    func contains(_ id: String) -> Bool {
+    func contains(_ messageID: String) -> Bool {
         lock.lock()
         defer { lock.unlock() }
-        return lookup[id] != nil
-    }
-
-    /// Get timestamp for an ID (for content deduplication time-window checks)
-    func timestampFor(_ id: String) -> Date? {
-        lock.lock()
-        defer { lock.unlock() }
-        return lookup[id]
-    }
-
-    private func trimIfNeeded() {
-        let activeCount = entries.count - head
-        guard activeCount > maxCount else { return }
-
-        // Remove down to 75% of maxCount for better amortization
-        let targetCount = (maxCount * 3) / 4
-        let removeCount = activeCount - targetCount
-
-        for i in head..<(head + removeCount) {
-            lookup.removeValue(forKey: entries[i].id)
-        }
-        head += removeCount
-
-        // Compact when head exceeds half the array to reclaim memory
-        if head > entries.count / 2 {
-            entries.removeFirst(head)
-            head = 0
-        }
+        return lookup.contains(messageID)
     }
 
     /// Clear all entries
@@ -120,25 +74,24 @@ final class MessageDeduplicator {
         lookup.removeAll()
     }
 
-    /// Periodic cleanup of expired entries and memory optimization.
+    /// Periodic cleanup
     func cleanup() {
         lock.lock()
         defer { lock.unlock() }
 
-        cleanupOldEntries(before: Date().addingTimeInterval(-maxAge))
+        cleanupOldEntries()
 
-        // Shrink capacity if significantly oversized
-        if entries.capacity > maxCount * 2 && entries.count < maxCount {
+        if entries.capacity > maxCount * 2 {
             entries.reserveCapacity(maxCount)
         }
     }
 
-    private func cleanupOldEntries(before cutoff: Date) {
+    private func cleanupOldEntries() {
+        let cutoff = Date().addingTimeInterval(-maxAge)
         while head < entries.count, entries[head].timestamp < cutoff {
-            lookup.removeValue(forKey: entries[head].id)
+            lookup.remove(entries[head].messageID)
             head += 1
         }
-        // Compact when head exceeds half the array
         if head > 0 && head > entries.count / 2 {
             entries.removeFirst(head)
             head = 0

bitchat/ViewModels/Extensions/ChatViewModel+Nostr.swift

@@ -1,814 +0,0 @@
-//
-// ChatViewModel+Nostr.swift
-// bitchat
-//
-// Geohash and Nostr logic for ChatViewModel
-//
-
-import Foundation
-import Combine
-import BitLogger
-import SwiftUI
-import Tor
-
-extension ChatViewModel {
-
-    // MARK: - Geohash Subscription
-
-    // Resubscribe to the active geohash channel without clearing timeline
-    @MainActor
-    func resubscribeCurrentGeohash() {
-        guard case .location(let ch) = activeChannel else { return }
-        guard let subID = geoSubscriptionID else {
-            // No existing subscription; set it up
-            switchLocationChannel(to: activeChannel)
-            return
-        }
-        // Ensure participant decay timer is running
-        participantTracker.startRefreshTimer()
-        // Unsubscribe + resubscribe
-        NostrRelayManager.shared.unsubscribe(id: subID)
-        let filter = NostrFilter.geohashEphemeral(
-            ch.geohash,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds),
-            limit: TransportConfig.nostrGeohashInitialLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: ch.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            self?.subscribeNostrEvent(event)
-        }
-        // Resubscribe geohash DMs for this identity
-        if let dmSub = geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub); geoDmSubscriptionID = nil
-        }
-        
-        if let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) {
-            let dmSub = "geo-dm-\(ch.geohash)"
-            geoDmSubscriptionID = dmSub
-            let dmFilter = NostrFilter.giftWrapsFor(pubkey: id.publicKeyHex, since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds))
-            NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-                self?.subscribeGiftWrap(giftWrap, id: id)
-            }
-        }
-    }
-    
-    func subscribeNostrEvent(_ event: NostrEvent) {
-        guard event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue,
-              !deduplicationService.hasProcessedNostrEvent(event.id)
-        else {
-            return
-        }
-
-        deduplicationService.recordNostrEvent(event.id)
-        
-        if let gh = currentGeohash,
-           let myGeoIdentity = try? idBridge.deriveIdentity(forGeohash: gh),
-           myGeoIdentity.publicKeyHex.lowercased() == event.pubkey.lowercased() {
-            // Skip very recent self-echo from relay, but allow older events (e.g., after app restart)
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-        
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            let nick = nickTag[1].trimmingCharacters(in: .whitespacesAndNewlines)
-            geoNicknames[event.pubkey.lowercased()] = nick
-        }
-        
-        // Store mapping for geohash sender IDs used in messages (ensures consistent colors)
-        nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
-
-        // Update participants last-seen for this pubkey
-        participantTracker.recordParticipant(pubkeyHex: event.pubkey)
-        
-        // Track teleported tag (only our format ["t","teleport"]) for icon state
-        let hasTeleportTag = event.tags.contains(where: { tag in
-            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
-        })
-        
-        if hasTeleportTag {
-            let key = event.pubkey.lowercased()
-            // Do not mark our own key from historical events; rely on manager.teleported for self
-            let isSelf: Bool = {
-                if let gh = currentGeohash, let my = try? idBridge.deriveIdentity(forGeohash: gh) {
-                    return my.publicKeyHex.lowercased() == key
-                }
-                return false
-            }()
-            if !isSelf {
-                Task { @MainActor in
-                    teleportedGeo = teleportedGeo.union([key])
-                }
-            }
-        }
-        
-        let senderName = displayNameForNostrPubkey(event.pubkey)
-        let content = event.content.trimmingCharacters(in: .whitespacesAndNewlines)
-        
-        // Clamp future timestamps to now to avoid future-dated messages skewing order
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let timestamp = min(rawTs, Date())
-        let mentions = parseMentions(from: content)
-        let msg = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: timestamp,
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-        Task { @MainActor in
-            handlePublicMessage(msg)
-            checkForMentions(msg)
-            sendHapticFeedback(for: msg)
-        }
-    }
-    
-    func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        guard !deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
-        deduplicationService.recordNostrEvent(giftWrap.id)
-        
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(giftWrap: giftWrap, recipientIdentity: id),
-              content.hasPrefix("bitchat1:"),
-              let packetData = Self.base64URLDecode(String(content.dropFirst("bitchat1:".count))),
-              let packet = BitchatPacket.from(packetData),
-              packet.type == MessageType.noiseEncrypted.rawValue,
-              let noisePayload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-        
-        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-        let convKey = PeerID(nostr_: senderPubkey)
-        nostrKeyMapping[convKey] = senderPubkey
-        
-        switch noisePayload.type {
-        case .privateMessage:
-            handlePrivateMessage(noisePayload, senderPubkey: senderPubkey, convKey: convKey, id: id, messageTimestamp: messageTimestamp)
-        case .delivered:
-            handleDelivered(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            handleReadReceipt(noisePayload, senderPubkey: senderPubkey, convKey: convKey)
-        case .verifyChallenge, .verifyResponse:
-            // QR verification payloads over Nostr are not supported; ignore in geohash DMs
-            break
-        }
-    }
-
-    // MARK: - Geohash Channel Handling
-
-    @MainActor
-    func switchLocationChannel(to channel: ChannelID) {
-        // Reset pending public batches to avoid cross-channel bleed
-        publicMessagePipeline.reset()
-        
-        activeChannel = channel
-        publicMessagePipeline.updateActiveChannel(channel)
-        
-        // Reset deduplication set and optionally hydrate timeline for mesh
-        deduplicationService.clearNostrCaches()
-        switch channel {
-        case .mesh:
-            refreshVisibleMessages(from: .mesh)
-            // Debug: log if any empty messages are present
-            let emptyMesh = messages.filter { $0.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty }.count
-            if emptyMesh > 0 {
-                SecureLogger.debug("RenderGuard: mesh timeline contains \(emptyMesh) empty messages", category: .session)
-            }
-            participantTracker.stopRefreshTimer()
-            participantTracker.setActiveGeohash(nil)
-            teleportedGeo.removeAll()
-        case .location:
-            refreshVisibleMessages(from: channel)
-        }
-        // If switching to a location channel, flush any pending geohash-only system messages
-        if case .location = channel {
-            for content in timelineStore.drainPendingGeohashSystemMessages() {
-                addPublicSystemMessage(content)
-            }
-        }
-        // Unsubscribe previous
-        if let sub = geoSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: sub)
-            geoSubscriptionID = nil
-        }
-        if let dmSub = geoDmSubscriptionID {
-            NostrRelayManager.shared.unsubscribe(id: dmSub)
-            geoDmSubscriptionID = nil
-        }
-        currentGeohash = nil
-        participantTracker.setActiveGeohash(nil)
-        // Reset nickname cache for geochat participants
-        geoNicknames.removeAll()
-
-        guard case .location(let ch) = channel else { return }
-        currentGeohash = ch.geohash
-        participantTracker.setActiveGeohash(ch.geohash)
-        
-        // Ensure self appears immediately in the people list; mark teleported state only when truly teleported
-        if let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) {
-            participantTracker.recordParticipant(pubkeyHex: id.publicKeyHex)
-            let hasRegional = !LocationChannelManager.shared.availableChannels.isEmpty
-            let inRegional = LocationChannelManager.shared.availableChannels.contains { $0.geohash == ch.geohash }
-            let key = id.publicKeyHex.lowercased()
-            if LocationChannelManager.shared.teleported && hasRegional && !inRegional {
-                teleportedGeo = teleportedGeo.union([key])
-                SecureLogger.info("GeoTeleport: channel switch mark self teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
-            } else {
-                teleportedGeo.remove(key)
-            }
-        }
-        
-        let subID = "geo-\(ch.geohash)"
-        geoSubscriptionID = subID
-        participantTracker.startRefreshTimer()
-        let ts = Date().addingTimeInterval(-TransportConfig.nostrGeohashInitialLookbackSeconds)
-        let filter = NostrFilter.geohashEphemeral(ch.geohash, since: ts, limit: TransportConfig.nostrGeohashInitialLimit)
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: ch.geohash, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            self?.handleNostrEvent(event)
-        }
-
-        subscribeToGeoChat(ch)
-    }
-    
-    func handleNostrEvent(_ event: NostrEvent) {
-        // Only handle ephemeral kind 20000 with matching tag
-        guard event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue else { return }
-        
-        // Deduplicate
-        if deduplicationService.hasProcessedNostrEvent(event.id) { return }
-        deduplicationService.recordNostrEvent(event.id)
-        
-        // Log incoming tags for diagnostics
-        let tagSummary = event.tags.map { "[" + $0.joined(separator: ",") + "]" }.joined(separator: ",")
-        SecureLogger.debug("GeoTeleport: recv pub=\(event.pubkey.prefix(8))… tags=\(tagSummary)", category: .session)
-        
-        // Track teleport tag for participants – only our format ["t", "teleport"]
-        let hasTeleportTag: Bool = event.tags.contains { tag in
-            tag.count >= 2 && tag[0].lowercased() == "t" && tag[1].lowercased() == "teleport"
-        }
-        
-        let isSelf: Bool = {
-            if let gh = currentGeohash, let my = try? idBridge.deriveIdentity(forGeohash: gh) {
-                return my.publicKeyHex.lowercased() == event.pubkey.lowercased()
-            }
-            return false
-        }()
-
-        if hasTeleportTag {
-            // Avoid marking our own key from historical events; rely on manager.teleported for self
-            if !isSelf {
-                let key = event.pubkey.lowercased()
-                Task { @MainActor in
-                    teleportedGeo = teleportedGeo.union([key])
-                    SecureLogger.info("GeoTeleport: mark peer teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
-                }
-            }
-        }
-        
-        // Skip only very recent self-echo from relay; include older self events for hydration
-        if isSelf {
-            let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            if Date().timeIntervalSince(eventTime) < 15 {
-                return
-            }
-        }
-        
-        // Cache nickname from tag if present
-        if let nickTag = event.tags.first(where: { $0.first == "n" }), nickTag.count >= 2 {
-            let nick = nickTag[1].trimmingCharacters(in: .whitespacesAndNewlines)
-            geoNicknames[event.pubkey.lowercased()] = nick
-        }
-        
-        // If this pubkey is blocked, skip mapping, participants, and timeline
-        if identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey) {
-            return
-        }
-        
-        // Store mapping for geohash DM initiation
-        nostrKeyMapping[PeerID(nostr_: event.pubkey)] = event.pubkey
-        nostrKeyMapping[PeerID(nostr: event.pubkey)] = event.pubkey
-        
-        // Update participants last-seen for this pubkey
-        participantTracker.recordParticipant(pubkeyHex: event.pubkey)
-        
-        let senderName = displayNameForNostrPubkey(event.pubkey)
-        let content = event.content
-        
-        // If this is a teleport presence event (no content), don't add to timeline
-        if let teleTag = event.tags.first(where: { $0.first == "t" }), teleTag.count >= 2, (teleTag[1] == "teleport"),
-           content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
-            return
-        }
-        
-        // Clamp future timestamps
-        let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        let mentions = parseMentions(from: content)
-        let msg = BitchatMessage(
-            id: event.id,
-            sender: senderName,
-            content: content,
-            timestamp: min(rawTs, Date()),
-            isRelay: false,
-            senderPeerID: PeerID(nostr: event.pubkey),
-            mentions: mentions.isEmpty ? nil : mentions
-        )
-        
-        Task { @MainActor in
-            handlePublicMessage(msg)
-            checkForMentions(msg)
-            sendHapticFeedback(for: msg)
-        }
-    }
-    
-    @MainActor
-    func subscribeToGeoChat(_ ch: GeohashChannel) {
-        guard let id = try? idBridge.deriveIdentity(forGeohash: ch.geohash) else { return }
-        
-        let dmSub = "geo-dm-\(ch.geohash)"
-        geoDmSubscriptionID = dmSub
-        // pared back logging: subscribe debug only
-        // Log GeoDM subscribe only when Tor is ready to avoid early noise
-        if TorManager.shared.isReady {
-            SecureLogger.debug("GeoDM: subscribing DMs pub=\(id.publicKeyHex.prefix(8))… sub=\(dmSub)", category: .session)
-        }
-        let dmFilter = NostrFilter.giftWrapsFor(pubkey: id.publicKeyHex, since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds))
-        NostrRelayManager.shared.subscribe(filter: dmFilter, id: dmSub) { [weak self] giftWrap in
-            self?.handleGiftWrap(giftWrap, id: id)
-        }
-    }
-    
-    func handleGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
-        if deduplicationService.hasProcessedNostrEvent(giftWrap.id) {
-            return
-        }
-        deduplicationService.recordNostrEvent(giftWrap.id)
-        
-        // Decrypt with per-geohash identity
-        guard let (content, senderPubkey, rumorTs) = try? NostrProtocol.decryptPrivateMessage(giftWrap: giftWrap, recipientIdentity: id) else {
-            SecureLogger.warning("GeoDM: failed decrypt giftWrap id=\(giftWrap.id.prefix(8))…", category: .session)
-            return
-        }
-        
-        SecureLogger.debug("GeoDM: decrypted gift-wrap id=\(giftWrap.id.prefix(16))... from=\(senderPubkey.prefix(8))...", category: .session)
-        
-        guard content.hasPrefix("bitchat1:"),
-              let packetData = Self.base64URLDecode(String(content.dropFirst("bitchat1:".count))),
-              let packet = BitchatPacket.from(packetData),
-              packet.type == MessageType.noiseEncrypted.rawValue,
-              let payload = NoisePayload.decode(packet.payload)
-        else {
-            return
-        }
-        
-        let convKey = PeerID(nostr_: senderPubkey)
-        nostrKeyMapping[convKey] = senderPubkey
-        
-        switch payload.type {
-        case .privateMessage:
-            let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTs))
-            handlePrivateMessage(payload, senderPubkey: senderPubkey, convKey: convKey, id: id, messageTimestamp: messageTimestamp)
-        case .delivered:
-            handleDelivered(payload, senderPubkey: senderPubkey, convKey: convKey)
-        case .readReceipt:
-            handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: convKey)
-        
-        // Explicitly list other cases so we get compile-time check if a new case is added in the future
-        case .verifyChallenge, .verifyResponse:
-            break
-        }
-    }
-
-    @MainActor
-    func sendGeohash(context: GeoOutgoingContext) {
-        let ch = context.channel
-        let event = context.event
-        let identity = context.identity
-
-        let targetRelays = GeoRelayDirectory.shared.closestRelays(
-            toGeohash: ch.geohash,
-            count: TransportConfig.nostrGeoRelayCount
-        )
-
-        if targetRelays.isEmpty {
-            SecureLogger.warning("Geo: no geohash relays available for \(ch.geohash); not sending", category: .session)
-        } else {
-            NostrRelayManager.shared.sendEvent(event, to: targetRelays)
-        }
-
-        // Track ourselves as active participant
-        participantTracker.recordParticipant(pubkeyHex: identity.publicKeyHex)
-        nostrKeyMapping[PeerID(nostr: identity.publicKeyHex)] = identity.publicKeyHex
-        SecureLogger.debug("GeoTeleport: sent geo message pub=\(identity.publicKeyHex.prefix(8))… teleported=\(context.teleported)", category: .session)
-
-        // If we tagged this as teleported, also mark our pubkey in teleportedGeo for UI
-        // Only when not in our regional set (and regional list is known)
-        let hasRegional = !LocationChannelManager.shared.availableChannels.isEmpty
-        let inRegional = LocationChannelManager.shared.availableChannels.contains { $0.geohash == ch.geohash }
-
-        if context.teleported && hasRegional && !inRegional {
-            let key = identity.publicKeyHex.lowercased()
-            teleportedGeo = teleportedGeo.union([key])
-            SecureLogger.info("GeoTeleport: mark self teleported key=\(key.prefix(8))… total=\(teleportedGeo.count)", category: .session)
-        }
-
-        deduplicationService.recordNostrEvent(event.id)
-    }
-
-    // MARK: - Sampling
-
-    /// Begin sampling multiple geohashes (used by channel sheet) without changing active channel.
-    @MainActor
-    func beginGeohashSampling(for geohashes: [String]) {
-        // Disable sampling when app is backgrounded (Tor is stopped there)
-        if !TorManager.shared.isForeground() {
-            endGeohashSampling()
-            return
-        }
-        // Determine which to add and which to remove
-        let desired = Set(geohashes)
-        let current = Set(geoSamplingSubs.values)
-        let toAdd = desired.subtracting(current)
-        let toRemove = current.subtracting(desired)
-
-        for (subID, gh) in geoSamplingSubs where toRemove.contains(gh) {
-            NostrRelayManager.shared.unsubscribe(id: subID)
-            geoSamplingSubs.removeValue(forKey: subID)
-        }
-
-        for gh in toAdd {
-            subscribe(gh)
-        }
-    }
-    
-    @MainActor
-    func subscribe(_ gh: String) {
-        let subID = "geo-sample-\(gh)"
-        geoSamplingSubs[subID] = gh
-        let filter = NostrFilter.geohashEphemeral(
-            gh,
-            since: Date().addingTimeInterval(-TransportConfig.nostrGeohashSampleLookbackSeconds),
-            limit: TransportConfig.nostrGeohashSampleLimit
-        )
-        let subRelays = GeoRelayDirectory.shared.closestRelays(toGeohash: gh, count: 5)
-        NostrRelayManager.shared.subscribe(filter: filter, id: subID, relayUrls: subRelays) { [weak self] event in
-            self?.subscribeNostrEvent(event, gh: gh)
-        }
-    }
-    
-    func subscribeNostrEvent(_ event: NostrEvent, gh: String) {
-        guard event.kind == NostrProtocol.EventKind.ephemeralEvent.rawValue else { return }
-
-        // Compute current participant count (5-minute window) BEFORE updating with this event
-        let existingCount = participantTracker.participantCount(for: gh)
-
-        // Update participants for this specific geohash
-        participantTracker.recordParticipant(pubkeyHex: event.pubkey, geohash: gh)
-        
-        // Notify only on rising-edge: previously zero people, now someone sends a chat
-        let content = event.content.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard !content.isEmpty else { return }
-        
-        // Respect geohash blocks
-        if identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased()) { return }
-        
-        // Skip self identity for this geohash
-        if let my = try? idBridge.deriveIdentity(forGeohash: gh), my.publicKeyHex.lowercased() == event.pubkey.lowercased() { return }
-        
-        // Only trigger when there were zero participants in this geohash recently
-        guard existingCount == 0 else { return }
-        
-        // Avoid notifications for old sampled events when launching or (re)subscribing
-        let eventTime = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-        if Date().timeIntervalSince(eventTime) > 30 { return }
-        
-        // Foreground-only notifications: app must be active, and not already viewing this geohash
-        #if os(iOS)
-        guard UIApplication.shared.applicationState == .active else { return }
-        if case .location(let ch) = activeChannel, ch.geohash == gh { return }
-        #elseif os(macOS)
-        guard NSApplication.shared.isActive else { return }
-        if case .location(let ch) = activeChannel, ch.geohash == gh { return }
-        #endif
-        
-        cooldownPerGeohash(gh, content: content, event: event)
-    }
-    
-    func cooldownPerGeohash(_ gh: String, content: String, event: NostrEvent) {
-        let now = Date()
-        let last = lastGeoNotificationAt[gh] ?? .distantPast
-        if now.timeIntervalSince(last) < TransportConfig.uiGeoNotifyCooldownSeconds { return }
-        
-        // Compose a short preview
-        let preview: String = {
-            let maxLen = TransportConfig.uiGeoNotifySnippetMaxLen
-            if content.count <= maxLen { return content }
-            let idx = content.index(content.startIndex, offsetBy: maxLen)
-            return String(content[..<idx]) + "…"
-        }()
-
-        Task { @MainActor in
-            lastGeoNotificationAt[gh] = now
-            // Pre-populate the target geohash timeline so the triggering message appears when user opens it
-            let senderSuffix = String(event.pubkey.suffix(4))
-            let nick = geoNicknames[event.pubkey.lowercased()]
-            let senderName = (nick?.isEmpty == false ? nick! : "anon") + "#" + senderSuffix
-            
-            // Clamp future timestamps
-            let rawTs = Date(timeIntervalSince1970: TimeInterval(event.created_at))
-            let ts = min(rawTs, Date())
-            let mentions = self.parseMentions(from: content)
-            let msg = BitchatMessage(
-                id: event.id,
-                sender: senderName,
-                content: content,
-                timestamp: ts,
-                isRelay: false,
-                senderPeerID: PeerID(nostr: event.pubkey),
-                mentions: mentions.isEmpty ? nil : mentions
-            )
-            if timelineStore.appendIfAbsent(msg, toGeohash: gh) {
-                NotificationService.shared.sendGeohashActivityNotification(geohash: gh, bodyPreview: preview)
-            }
-        }
-    }
-
-    /// Stop sampling all extra geohashes.
-    @MainActor
-    func endGeohashSampling() {
-        for subID in geoSamplingSubs.keys { NostrRelayManager.shared.unsubscribe(id: subID) }
-        geoSamplingSubs.removeAll()
-    }
-
-    // MARK: - Nostr DM Handling
-
-    func setupNostrMessageHandling() {
-        guard let currentIdentity = try? idBridge.getCurrentNostrIdentity() else {
-            SecureLogger.warning("⚠️ No Nostr identity available for message handling", category: .session)
-            return
-        }
-        
-        SecureLogger.debug("🔑 Setting up Nostr subscription for pubkey: \(currentIdentity.publicKeyHex.prefix(16))...", category: .session)
-        
-        // Subscribe to Nostr messages
-        let filter = NostrFilter.giftWrapsFor(
-            pubkey: currentIdentity.publicKeyHex,
-            since: Date().addingTimeInterval(-TransportConfig.nostrDMSubscribeLookbackSeconds)  // Last 24 hours
-        )
-        
-        nostrRelayManager?.subscribe(filter: filter, id: "chat-messages") { [weak self] event in
-            self?.handleNostrMessage(event)
-        }
-    }
-    
-    func handleNostrMessage(_ giftWrap: NostrEvent) {
-        // Deduplicate messages by ID
-        if deduplicationService.hasProcessedNostrEvent(giftWrap.id) { return }
-        deduplicationService.recordNostrEvent(giftWrap.id)
-        
-        // Ensure we're on a background queue for decryption
-        Task.detached(priority: .userInitiated) { [weak self] in
-            await self?.processNostrMessage(giftWrap)
-        }
-    }
-    
-    func processNostrMessage(_ giftWrap: NostrEvent) async {
-        guard let currentIdentity = try? idBridge.getCurrentNostrIdentity() else { return }
-        
-        do {
-            let (content, senderPubkey, rumorTimestamp) = try NostrProtocol.decryptPrivateMessage(
-                giftWrap: giftWrap,
-                recipientIdentity: currentIdentity
-            )
-            
-            // Handle verification payloads first
-            if content.hasPrefix("verify:") {
-                // Ignore verification payloads arriving via Nostr path for now
-                // Verification should ideally happen over mesh for security binding
-                return
-            }
-            
-            // Check if it's a BitChat packet embedded in the content (bitchat1:...)
-            if content.hasPrefix("bitchat1:") {
-                guard let packetData = Self.base64URLDecode(String(content.dropFirst("bitchat1:".count))),
-                      let packet = BitchatPacket.from(packetData) else {
-                    SecureLogger.error("Failed to decode embedded BitChat packet from Nostr DM", category: .session)
-                    return
-                }
-                
-                // Map sender by Nostr pubkey to Noise key when possible
-                let actualSenderNoiseKey = findNoiseKey(for: senderPubkey)
-                
-                // Stable target ID if we know Noise key; otherwise temporary Nostr-based peer
-                let targetPeerID = PeerID(str: actualSenderNoiseKey?.hexEncodedString()) ?? PeerID(nostr_: senderPubkey)
-                
-                if packet.type == MessageType.noiseEncrypted.rawValue {
-                    if let payload = NoisePayload.decode(packet.payload) {
-                        let messageTimestamp = Date(timeIntervalSince1970: TimeInterval(rumorTimestamp))
-                        // Store Nostr mapping
-                        await MainActor.run {
-                            nostrKeyMapping[targetPeerID] = senderPubkey
-                            
-                            // Handle packet types
-                            switch payload.type {
-                            case .privateMessage:
-                                handlePrivateMessage(payload, senderPubkey: senderPubkey, convKey: targetPeerID, id: currentIdentity, messageTimestamp: messageTimestamp)
-                            case .delivered:
-                                handleDelivered(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                            case .readReceipt:
-                                handleReadReceipt(payload, senderPubkey: senderPubkey, convKey: targetPeerID)
-                            case .verifyChallenge, .verifyResponse:
-                                break
-                            }
-                        }
-                    }
-                }
-            } else {
-                SecureLogger.debug("Ignoring non-embedded Nostr DM content", category: .session)
-            }
-        } catch {
-            SecureLogger.error("Failed to decrypt Nostr message: \(error)", category: .session)
-        }
-    }
-
-    func findNoiseKey(for nostrPubkey: String) -> Data? {
-        // Check favorites for this Nostr key
-        let favorites = FavoritesPersistenceService.shared.favorites.values
-        var npubToMatch = nostrPubkey
-        
-        // Convert hex to npub if needed for comparison
-        if !nostrPubkey.hasPrefix("npub") {
-            if let pubkeyData = Data(hexString: nostrPubkey),
-               let encoded = try? Bech32.encode(hrp: "npub", data: pubkeyData) {
-                npubToMatch = encoded
-            } else {
-                SecureLogger.warning("⚠️ Invalid hex public key format or encoding failed: \(nostrPubkey.prefix(16))...", category: .session)
-            }
-        }
-        
-        for relationship in favorites {
-            // Search through favorites for matching Nostr pubkey
-            if let storedNostrKey = relationship.peerNostrPublicKey {
-                // Compare against stored key (could be hex or npub)
-                if storedNostrKey == npubToMatch {
-                    // SecureLogger.debug("✅ Found Noise key for Nostr sender (npub match)", category: .session)
-                    return relationship.peerNoisePublicKey
-                }
-                
-                // Also try comparing raw hex if stored key is hex
-                if !storedNostrKey.hasPrefix("npub") && storedNostrKey == nostrPubkey {
-                    SecureLogger.debug("✅ Found Noise key for Nostr sender (hex match)", category: .session)
-                    return relationship.peerNoisePublicKey
-                }
-            }
-        }
-        
-        SecureLogger.debug("⚠️ No matching Noise key found for Nostr pubkey: \(nostrPubkey.prefix(16))... (tried npub: \(npubToMatch.prefix(16))...)", category: .session)
-        return nil
-    }
-
-    func sendDeliveryAckViaNostrEmbedded(_ message: BitchatMessage, wasReadBefore: Bool, senderPubkey: String, key: Data?) {
-        // If we have a Noise key, try to route securely if possible, otherwise fallback to direct
-        if let _ = key {
-             // Ideally we would use MessageRouter here, but for simplicity in this direct callback:
-             // check if we have an identity
-             if let id = try? idBridge.getCurrentNostrIdentity() {
-                 let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
-                 nt.senderPeerID = meshService.myPeerID
-                 nt.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: id)
-             }
-        } else if let id = try? idBridge.getCurrentNostrIdentity() {
-            // Fallback: no Noise mapping yet — send directly to sender's Nostr pubkey
-            let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
-            nt.senderPeerID = meshService.myPeerID
-            nt.sendDeliveryAckGeohash(for: message.id, toRecipientHex: senderPubkey, from: id)
-            SecureLogger.debug("Sent DELIVERED ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…", category: .session)
-        }
-        
-        // Same for READ receipt if viewing
-        if !wasReadBefore && selectedPrivateChatPeer == message.senderPeerID {
-             if let _ = key {
-                 if let id = try? idBridge.getCurrentNostrIdentity() {
-                     let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
-                     nt.senderPeerID = meshService.myPeerID
-                     nt.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: id)
-                 }
-             } else if let id = try? idBridge.getCurrentNostrIdentity() {
-                 let nt = NostrTransport(keychain: keychain, idBridge: idBridge)
-                 nt.senderPeerID = meshService.myPeerID
-                 nt.sendReadReceiptGeohash(message.id, toRecipientHex: senderPubkey, from: id)
-                 SecureLogger.debug("Viewing chat; sent READ ack directly to Nostr pub=\(senderPubkey.prefix(8))… for mid=\(message.id.prefix(8))…", category: .session)
-             }
-        }
-    }
-
-    func handleFavoriteNotification(content: String, from nostrPubkey: String) {
-        // Try to find Noise key associated with this Nostr pubkey
-        guard let senderNoiseKey = findNoiseKey(for: nostrPubkey) else { return }
-        
-        let isFavorite = content.contains("FAVORITE:TRUE")
-        let senderNickname = content.components(separatedBy: "|").last ?? "Unknown"
-        
-        // Update favorite status
-        if isFavorite {
-            FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: senderNoiseKey,
-                peerNostrPublicKey: nostrPubkey,
-                peerNickname: senderNickname
-            )
-        } else {
-            // Only remove if we don't have it set locally
-            // Logic handled by persistence service usually, here we just update remote state
-            // Actually for now we just process the notification
-        }
-        
-        // Extract Nostr public key if included
-        var extractedNostrPubkey: String? = nil
-        if let range = content.range(of: "NPUB:") {
-            let suffix = content[range.upperBound...]
-            let parts = suffix.components(separatedBy: "|")
-            if let key = parts.first {
-                extractedNostrPubkey = String(key)
-            }
-        } else if content.contains(":") {
-             // Fallback: simple format FAVORITE:TRUE:npub...
-             let parts = content.components(separatedBy: ":")
-             if parts.count >= 3 {
-                 extractedNostrPubkey = String(parts[2])
-             }
-        }
-        
-        SecureLogger.info("📝 Received favorite notification from \(senderNickname): \(isFavorite)", category: .session)
-        
-        // If they favorited us and provided their Nostr key, ensure it's stored
-        if isFavorite && extractedNostrPubkey != nil {
-            SecureLogger.info("💾 Storing Nostr key association for \(senderNickname): \(extractedNostrPubkey!.prefix(16))...", category: .session)
-             FavoritesPersistenceService.shared.addFavorite(
-                peerNoisePublicKey: senderNoiseKey,
-                peerNostrPublicKey: extractedNostrPubkey,
-                peerNickname: senderNickname
-            )
-        }
-        
-        // Show notification
-        NotificationService.shared.sendLocalNotification(
-            title: isFavorite ? "New Favorite" : "Favorite Removed",
-            body: "\(senderNickname) \(isFavorite ? "favorited" : "unfavorited") you",
-            identifier: "fav-\(UUID().uuidString)"
-        )
-    }
-
-    func sendFavoriteNotificationViaNostr(noisePublicKey: Data, isFavorite: Bool) {
-        // Find peer Nostr key
-        guard let relationship = FavoritesPersistenceService.shared.getFavoriteStatus(for: noisePublicKey),
-              relationship.peerNostrPublicKey != nil else {
-            SecureLogger.warning("⚠️ Cannot send favorite notification - no Nostr key for peer", category: .session)
-            return
-        }
-        
-        let peerID = PeerID(hexData: noisePublicKey)
-        
-        // Route via message router
-        messageRouter.sendFavoriteNotification(to: peerID, isFavorite: isFavorite)
-    }
-
-    // MARK: - Geohash Nickname Resolution (for /block in geohash)
-
-    func nostrPubkeyForDisplayName(_ name: String) -> String? {
-        // Look up current visible geohash participants for an exact displayName match
-        for p in visibleGeohashPeople() {
-            if p.displayName == name {
-                return p.id
-            }
-        }
-        // Also check nickname cache directly
-        for (pub, nick) in geoNicknames {
-            if nick == name { return pub }
-        }
-        return nil
-    }
-    
-    func startGeohashDM(withPubkeyHex hex: String) {
-        let convKey = PeerID(nostr_: hex)
-        nostrKeyMapping[convKey] = hex
-        startPrivateChat(with: convKey)
-    }
-    
-    func fullNostrHex(forSenderPeerID senderID: PeerID) -> String? {
-        return nostrKeyMapping[senderID]
-    }
-    
-    func geohashDisplayName(for convKey: PeerID) -> String {
-        guard let full = nostrKeyMapping[convKey] else {
-            return convKey.bare
-        }
-        return displayNameForNostrPubkey(full)
-    }
-}

bitchat/ViewModels/Extensions/ChatViewModel+Tor.swift

@@ -1,64 +0,0 @@
-//
-// ChatViewModel+Tor.swift
-// bitchat
-//
-// Tor lifecycle handling for ChatViewModel
-//
-
-import Foundation
-import Combine
-import Tor
-
-extension ChatViewModel {
-    
-    // MARK: - Tor notifications
-    
-    @objc func handleTorWillStart() {
-        Task { @MainActor in
-            if !self.torStatusAnnounced && TorManager.shared.torEnforced {
-                self.torStatusAnnounced = true
-                // Post only in geohash channels (queue if not active)
-                self.addGeohashOnlySystemMessage(
-                    String(localized: "system.tor.starting", comment: "System message when Tor is starting")
-                )
-            }
-        }
-    }
-    
-    @objc func handleTorWillRestart() {
-        Task { @MainActor in
-            self.torRestartPending = true
-            // Post only in geohash channels (queue if not active)
-            self.addGeohashOnlySystemMessage(
-                String(localized: "system.tor.restarting", comment: "System message when Tor is restarting")
-            )
-        }
-    }
-
-    @objc func handleTorDidBecomeReady() {
-        Task { @MainActor in
-            // Only announce "restarted" if we actually restarted this session
-            if self.torRestartPending {
-                // Post only in geohash channels (queue if not active)
-                self.addGeohashOnlySystemMessage(
-                    String(localized: "system.tor.restarted", comment: "System message when Tor has restarted")
-                )
-                self.torRestartPending = false
-            } else if TorManager.shared.torEnforced && !self.torInitialReadyAnnounced {
-                // Initial start completed
-                self.addGeohashOnlySystemMessage(
-                    String(localized: "system.tor.started", comment: "System message when Tor has started")
-                )
-                self.torInitialReadyAnnounced = true
-            }
-        }
-    }
-
-    @objc func handleTorPreferenceChanged(_ notification: Notification) {
-        Task { @MainActor in
-            self.torStatusAnnounced = false
-            self.torInitialReadyAnnounced = false
-            self.torRestartPending = false
-        }
-    }
-}

bitchat/ViewModels/Extensions/README.md

@@ -1,9 +0,0 @@
-# ChatViewModel Extensions
-
-This directory contains extensions to `ChatViewModel` to modularize its functionality.
-
-- `ChatViewModel+Tor.swift`: Handles Tor lifecycle events and notifications.
-- `ChatViewModel+PrivateChat.swift`: Manages private chat logic, media transfers (images, voice notes), and file handling.
-- `ChatViewModel+Nostr.swift`: Contains all logic related to Nostr integration, Geohash channels, and Nostr identity management.
-
-The main `ChatViewModel.swift` retains core state, initialization, and coordination logic.

bitchat/Views/ContentView.swift

@@ -189,7 +189,6 @@ struct ContentView: View {
         }
         .sheet(isPresented: $showAppInfo) {
             AppInfoView()
-                .environmentObject(viewModel)
                 .onAppear { viewModel.isAppInfoPresented = true }
                 .onDisappear { viewModel.isAppInfoPresented = false }
         }
@@ -199,7 +198,6 @@ struct ContentView: View {
         )) {
             if let peerID = viewModel.showingFingerprintFor {
                 FingerprintView(viewModel: viewModel, peerID: peerID)
-                    .environmentObject(viewModel)
             }
         }
 #if os(iOS)
@@ -227,7 +225,6 @@ struct ContentView: View {
                     }
                 }
             }
-            .environmentObject(viewModel)
             .ignoresSafeArea()
         }
 #endif
@@ -256,7 +253,6 @@ struct ContentView: View {
                     }
                 }
             }
-            .environmentObject(viewModel)
         }
 #endif
         .sheet(isPresented: Binding(
@@ -265,7 +261,6 @@ struct ContentView: View {
         )) {
             if let url = imagePreviewURL {
                 ImagePreviewView(url: url)
-                    .environmentObject(viewModel)
             }
         }
         .alert("Recording Error", isPresented: $showRecordingAlert, actions: {
@@ -470,17 +465,17 @@ struct ContentView: View {
                     } else {
                         // Schedule a delayed scroll
                         scrollThrottleTimer?.invalidate()
-                        scrollThrottleTimer = Timer.scheduledTimer(withTimeInterval: TransportConfig.uiScrollThrottleSeconds, repeats: false) { [weak viewModel] _ in
-                            Task { @MainActor in
-                                lastScrollTime = Date()
-                                let contextKey: String = {
-                                    switch locationManager.selectedChannel {
-                                    case .mesh: return "mesh"
-                                    case .location(let ch): return "geo:\(ch.geohash)"
-                                    }
-                                }()
-                                let count = windowCountPublic
-                                let target = viewModel?.messages.suffix(count).last.map { "\(contextKey)|\($0.id)" }
+                        scrollThrottleTimer = Timer.scheduledTimer(withTimeInterval: TransportConfig.uiScrollThrottleSeconds, repeats: false) { _ in
+                            lastScrollTime = Date()
+                        let contextKey: String = {
+                            switch locationManager.selectedChannel {
+                            case .mesh: return "mesh"
+                            case .location(let ch): return "geo:\(ch.geohash)"
+                            }
+                        }()
+                            let count = windowCountPublic
+                            let target = viewModel.messages.suffix(count).last.map { "\(contextKey)|\($0.id)" }
+                            DispatchQueue.main.async {
                                 if let target = target { proxy.scrollTo(target, anchor: .bottom) }
                             }
                         }
@@ -648,11 +643,9 @@ struct ContentView: View {
                 .frame(maxWidth: .infinity, alignment: .leading)
                 .onChange(of: messageText) { newValue in
                     autocompleteDebounceTimer?.invalidate()
-                    autocompleteDebounceTimer = Timer.scheduledTimer(withTimeInterval: 0.15, repeats: false) { [weak viewModel] _ in
+                    autocompleteDebounceTimer = Timer.scheduledTimer(withTimeInterval: 0.15, repeats: false) { _ in
                         let cursorPosition = newValue.count
-                        Task { @MainActor in
-                            viewModel?.updateAutocomplete(for: newValue, cursorPosition: cursorPosition)
-                        }
+                        viewModel.updateAutocomplete(for: newValue, cursorPosition: cursorPosition)
                     }
                 }
 
@@ -830,7 +823,6 @@ struct ContentView: View {
                     }
                 }
             }
-            .environmentObject(viewModel)
             .ignoresSafeArea()
         }
         #endif
@@ -851,7 +843,6 @@ struct ContentView: View {
                     }
                 }
             }
-            .environmentObject(viewModel)
         }
         #endif
     }
@@ -1389,7 +1380,6 @@ struct ContentView: View {
         .padding(.horizontal, 12)
         .sheet(isPresented: $showLocationChannelsSheet) {
             LocationChannelsSheet(isPresented: $showLocationChannelsSheet)
-                .environmentObject(viewModel)
                 .onAppear { viewModel.isLocationChannelsSheetPresented = true }
                 .onDisappear { viewModel.isLocationChannelsSheetPresented = false }
         }

bitchat/Views/LocationChannelsSheet.swift

@@ -357,7 +357,7 @@ struct LocationChannelsSheet: View {
                         isPresented = false
                     }
                     .padding(.vertical, 6)
-                    .onAppear { bookmarks.resolveBookmarkNameIfNeeded(for: gh) }
+                    .onAppear { bookmarks.resolveNameIfNeeded(for: gh) }
 
                     if index < entries.count - 1 {
                         sectionDivider

bitchat/_PreviewHelpers/PreviewKeychainManager.swift

@@ -10,51 +10,32 @@ import Foundation
 
 final class PreviewKeychainManager: KeychainManagerProtocol {
     private var storage: [String: Data] = [:]
-    private var serviceStorage: [String: [String: Data]] = [:]
     init() {}
-
+    
     func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
         storage[key] = keyData
         return true
     }
-
+    
     func getIdentityKey(forKey key: String) -> Data? {
         storage[key]
     }
-
+    
     func deleteIdentityKey(forKey key: String) -> Bool {
         storage.removeValue(forKey: key)
         return true
     }
-
+    
     func deleteAllKeychainData() -> Bool {
         storage.removeAll()
-        serviceStorage.removeAll()
         return true
     }
-
+    
     func secureClear(_ data: inout Data) {}
-
+    
     func secureClear(_ string: inout String) {}
-
+    
     func verifyIdentityKeyExists() -> Bool {
         storage["identity_noiseStaticKey"] != nil
     }
-
-    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
-
-    func save(key: String, data: Data, service: String, accessible: CFString?) {
-        if serviceStorage[service] == nil {
-            serviceStorage[service] = [:]
-        }
-        serviceStorage[service]?[key] = data
-    }
-
-    func load(key: String, service: String) -> Data? {
-        serviceStorage[service]?[key]
-    }
-
-    func delete(key: String, service: String) {
-        serviceStorage[service]?.removeValue(forKey: key)
-    }
 }

bitchatTests/ChatViewModelExtensionsTests.swift

@@ -1,285 +0,0 @@
-//
-// ChatViewModelExtensionsTests.swift
-// bitchatTests
-//
-// Tests for ChatViewModel extensions (PrivateChat, Nostr, Tor).
-//
-
-import Testing
-import Foundation
-import Combine
-@testable import bitchat
-
-// MARK: - Test Helpers
-
-@MainActor
-private func makeTestableViewModel() -> (viewModel: ChatViewModel, transport: MockTransport) {
-    let keychain = MockKeychain()
-    let keychainHelper = MockKeychainHelper()
-    let idBridge = NostrIdentityBridge(keychain: keychainHelper)
-    let identityManager = MockIdentityManager(keychain)
-    let transport = MockTransport()
-
-    let viewModel = ChatViewModel(
-        keychain: keychain,
-        idBridge: idBridge,
-        identityManager: identityManager,
-        transport: transport
-    )
-
-    return (viewModel, transport)
-}
-
-// MARK: - Private Chat Extension Tests
-
-struct ChatViewModelPrivateChatExtensionTests {
-
-    @Test @MainActor
-    func sendPrivateMessage_mesh_storesAndSends() async {
-        let (viewModel, transport) = makeTestableViewModel()
-        // Use valid hex string for PeerID (32 bytes = 64 hex chars for Noise key usually, or just valid hex)
-        let validHex = "0102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f10"
-        let peerID = PeerID(str: validHex)
-        
-        // Simulate connection
-        transport.connectedPeers.insert(peerID)
-        transport.peerNicknames[peerID] = "MeshUser"
-        
-        viewModel.sendPrivateMessage("Hello Mesh", to: peerID)
-        
-        // Verify transport was called
-        // Note: MockTransport stores sent messages
-        // Since sendPrivateMessage delegates to MessageRouter which delegates to Transport...
-        // We need to ensure MessageRouter is using our MockTransport.
-        // ChatViewModel init sets up MessageRouter with the passed transport.
-        
-        // Wait for async processing
-        try? await Task.sleep(nanoseconds: 100_000_000)
-        
-        // Verify message stored locally
-        #expect(viewModel.privateChats[peerID]?.count == 1)
-        #expect(viewModel.privateChats[peerID]?.first?.content == "Hello Mesh")
-        
-        // Verify message sent to transport (MockTransport captures sendPrivateMessage)
-        // MockTransport.sendPrivateMessage is what MessageRouter calls for connected peers
-        // Check MockTransport implementation... it might need update or verification
-    }
-    
-    @Test @MainActor
-    func handlePrivateMessage_storesMessage() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let peerID = PeerID(str: "SENDER_001")
-        
-        let message = BitchatMessage(
-            id: "msg-1",
-            sender: "Sender",
-            content: "Private Content",
-            timestamp: Date(),
-            isRelay: false,
-            originalSender: nil,
-            isPrivate: true,
-            recipientNickname: "Me",
-            senderPeerID: peerID
-        )
-        
-        // Simulate receiving a private message via the handlePrivateMessage extension method
-        viewModel.handlePrivateMessage(message)
-        
-        // Verify stored
-        #expect(viewModel.privateChats[peerID]?.count == 1)
-        #expect(viewModel.privateChats[peerID]?.first?.content == "Private Content")
-        
-        // Verify notification trigger (unread count should increase if not viewing)
-        #expect(viewModel.unreadPrivateMessages.contains(peerID))
-    }
-    
-    @Test @MainActor
-    func handlePrivateMessage_deduplicates() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let peerID = PeerID(str: "SENDER_001")
-        
-        let message = BitchatMessage(
-            id: "msg-1",
-            sender: "Sender",
-            content: "Content",
-            timestamp: Date(),
-            isRelay: false,
-            isPrivate: true,
-            senderPeerID: peerID
-        )
-        
-        viewModel.handlePrivateMessage(message)
-        viewModel.handlePrivateMessage(message) // Duplicate
-        
-        #expect(viewModel.privateChats[peerID]?.count == 1)
-    }
-    
-    @Test @MainActor
-    func handlePrivateMessage_sendsReadReceipt_whenViewing() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let peerID = PeerID(str: "SENDER_001")
-        
-        // Set as currently viewing
-        viewModel.selectedPrivateChatPeer = peerID
-        
-        let message = BitchatMessage(
-            id: "msg-1",
-            sender: "Sender",
-            content: "Content",
-            timestamp: Date(),
-            isRelay: false,
-            isPrivate: true,
-            senderPeerID: peerID
-        )
-        
-        viewModel.handlePrivateMessage(message)
-        
-        // Should NOT be marked unread
-        #expect(!viewModel.unreadPrivateMessages.contains(peerID))
-    }
-    
-    @Test @MainActor
-    func migratePrivateChats_consolidatesHistory_onFingerprintMatch() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let oldPeerID = PeerID(str: "OLD_PEER")
-        let newPeerID = PeerID(str: "NEW_PEER")
-        let fingerprint = "fp_123"
-        
-        // Setup old chat
-        let oldMessage = BitchatMessage(
-            id: "msg-old",
-            sender: "User",
-            content: "Old message",
-            timestamp: Date(),
-            isRelay: false,
-            isPrivate: true,
-            senderPeerID: oldPeerID
-        )
-        viewModel.privateChats[oldPeerID] = [oldMessage]
-        viewModel.peerIDToPublicKeyFingerprint[oldPeerID] = fingerprint
-        
-        // Setup new peer fingerprint
-        viewModel.peerIDToPublicKeyFingerprint[newPeerID] = fingerprint
-        
-        // Trigger migration
-        viewModel.migratePrivateChatsIfNeeded(for: newPeerID, senderNickname: "User")
-        
-        // Verify migration
-        #expect(viewModel.privateChats[newPeerID]?.count == 1)
-        #expect(viewModel.privateChats[newPeerID]?.first?.content == "Old message")
-        #expect(viewModel.privateChats[oldPeerID] == nil) // Old chat removed
-    }
-    
-    @Test @MainActor
-    func isMessageBlocked_filtersBlockedUsers() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let blockedPeerID = PeerID(str: "BLOCKED_PEER")
-        
-        // Block the peer
-        // MockIdentityManager stores state based on fingerprint
-        // We need to map peerID to a fingerprint
-        viewModel.peerIDToPublicKeyFingerprint[blockedPeerID] = "fp_blocked"
-        viewModel.identityManager.setBlocked("fp_blocked", isBlocked: true)
-        
-        // Also ensure UnifiedPeerService can resolve the fingerprint.
-        // UnifiedPeerService uses its own cache or delegates to meshService/Peer list.
-        // Since we are mocking, we can't easily inject into UnifiedPeerService's internal cache.
-        // However, ChatViewModel's isMessageBlocked uses:
-        // 1. isPeerBlocked(peerID) -> unifiedPeerService.isBlocked(peerID) -> getFingerprint -> identityManager.isBlocked
-        
-        // We need UnifiedPeerService.getFingerprint(for: blockedPeerID) to return "fp_blocked"
-        // UnifiedPeerService tries: cache -> meshService -> getPeer
-        
-        // Option 1: Mock the transport (meshService) to return the fingerprint
-        // (viewModel.transport is MockTransport, but UnifiedPeerService holds a reference to it)
-        // Check if MockTransport has `getFingerprint`
-        
-        // If not, we might need to rely on the fallback: ChatViewModel.isMessageBlocked also checks Nostr blocks.
-        
-        // Let's assume MockTransport needs `getFingerprint` implementation or update it.
-        // For now, let's try to verify if `MockTransport` supports `getFingerprint`.
-        
-        // Actually, let's just use the Nostr block path which is simpler and also tested here.
-        // "Check geohash (Nostr) blocks using mapping to full pubkey"
-        
-        let hexPubkey = "0000000000000000000000000000000000000000000000000000000000000001"
-        viewModel.nostrKeyMapping[blockedPeerID] = hexPubkey
-        viewModel.identityManager.setNostrBlocked(hexPubkey, isBlocked: true)
-        
-        // Force isGeoChat/isGeoDM check to be true by setting prefix?
-        // Or ensure the logic covers it.
-        // The logic is:
-        // if peerID.isGeoChat || peerID.isGeoDM { check nostr }
-        // We need a peerID that looks like geo.
-        
-        let geoPeerID = PeerID(nostr_: hexPubkey)
-        viewModel.nostrKeyMapping[geoPeerID] = hexPubkey
-        
-        let geoMessage = BitchatMessage(
-            id: "msg-geo-blocked",
-            sender: "BlockedGeoUser",
-            content: "Spam",
-            timestamp: Date(),
-            isRelay: false,
-            isPrivate: true,
-            senderPeerID: geoPeerID
-        )
-        
-        #expect(viewModel.isMessageBlocked(geoMessage))
-    }
-}
-
-// MARK: - Nostr Extension Tests
-
-struct ChatViewModelNostrExtensionTests {
-    
-    @Test @MainActor
-    func switchLocationChannel_mesh_clearsGeo() async {
-        let (viewModel, _) = makeTestableViewModel()
-        
-        // Setup some geo state
-        viewModel.switchLocationChannel(to: .location(GeohashChannel(level: .city, geohash: "u4pruydq")))
-        #expect(viewModel.currentGeohash == "u4pruydq")
-        
-        // Switch to mesh
-        viewModel.switchLocationChannel(to: .mesh)
-        
-        #expect(viewModel.activeChannel == .mesh)
-        #expect(viewModel.currentGeohash == nil)
-    }
-    
-    @Test @MainActor
-    func subscribeNostrEvent_addsToTimeline_ifMatchesGeohash() async {
-        let (viewModel, _) = makeTestableViewModel()
-        let geohash = "u4pruydq"
-        
-        viewModel.switchLocationChannel(to: .location(GeohashChannel(level: .city, geohash: geohash)))
-        
-        var event = NostrEvent(
-            pubkey: "pub1",
-            createdAt: Date(),
-            kind: .ephemeralEvent,
-            tags: [["g", geohash]],
-            content: "Hello Geo"
-        )
-        event.id = "evt1"
-        event.sig = "sig"
-        
-        viewModel.handleNostrEvent(event)
-        
-        // Allow async processing
-        try? await Task.sleep(nanoseconds: 100_000_000)
-        
-        // Check timeline
-        // This depends on `handlePublicMessage` being called and updating `messages`
-        // Since `handlePublicMessage` delegates to `timelineStore` and updates `messages`...
-        // And we are in the correct channel...
-        
-        // However, `handleNostrEvent` in the extension now calls `handlePublicMessage`.
-        // Let's verify if the message appears.
-        // Note: `handleNostrEvent` logic was refactored.
-        // The new logic in `ChatViewModel+Nostr.swift` calls `handlePublicMessage`.
-        
-        // We need to ensure `deduplicationService` doesn't block it (new instance, so empty).
-    }
-}

bitchatTests/ChatViewModelTests.swift

@@ -1,330 +0,0 @@
-//
-// ChatViewModelTests.swift
-// bitchatTests
-//
-// Tests for ChatViewModel using MockTransport for isolation.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Testing
-import Foundation
-@testable import bitchat
-
-// MARK: - Test Helpers
-
-/// Creates a ChatViewModel with mock dependencies for testing
-@MainActor
-private func makeTestableViewModel() -> (viewModel: ChatViewModel, transport: MockTransport) {
-    let keychain = MockKeychain()
-    let keychainHelper = MockKeychainHelper()
-    let idBridge = NostrIdentityBridge(keychain: keychainHelper)
-    let identityManager = MockIdentityManager(keychain)
-    let transport = MockTransport()
-
-    let viewModel = ChatViewModel(
-        keychain: keychain,
-        idBridge: idBridge,
-        identityManager: identityManager,
-        transport: transport
-    )
-
-    return (viewModel, transport)
-}
-
-// MARK: - Initialization Tests
-
-struct ChatViewModelInitializationTests {
-
-    @Test @MainActor
-    func initialization_setsDelegate() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        // The viewModel should set itself as the transport delegate
-        #expect(transport.delegate === viewModel)
-    }
-
-    @Test @MainActor
-    func initialization_startsServices() async {
-        let (_, transport) = makeTestableViewModel()
-
-        // Services should be started during init
-        #expect(transport.startServicesCallCount == 1)
-    }
-
-    @Test @MainActor
-    func initialization_hasEmptyMessageList() async {
-        let (viewModel, _) = makeTestableViewModel()
-
-        // Initial messages may include system messages, but should be limited
-        #expect(viewModel.messages.count < 10)
-    }
-
-    @Test @MainActor
-    func initialization_setsNickname() async {
-        let (_, transport) = makeTestableViewModel()
-
-        // Nickname should be set during init
-        #expect(!transport.myNickname.isEmpty)
-    }
-}
-
-// MARK: - Message Sending Tests
-
-struct ChatViewModelSendingTests {
-
-    @Test @MainActor
-    func sendMessage_delegatesToTransport() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        viewModel.sendMessage("Hello World")
-
-        #expect(transport.sentMessages.count == 1)
-        #expect(transport.sentMessages.first?.content == "Hello World")
-    }
-
-    @Test @MainActor
-    func sendMessage_emptyContent_ignored() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        viewModel.sendMessage("")
-        viewModel.sendMessage("   ")
-        viewModel.sendMessage("\n\t")
-
-        #expect(transport.sentMessages.isEmpty)
-    }
-
-    @Test @MainActor
-    func sendMessage_withMentions_sendsContent() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        viewModel.sendMessage("Hello @alice")
-
-        #expect(transport.sentMessages.count == 1)
-        #expect(transport.sentMessages.first?.content == "Hello @alice")
-    }
-
-    @Test @MainActor
-    func sendMessage_command_notSentToTransport() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        viewModel.sendMessage("/help")
-
-        // Commands are processed locally, not sent to transport
-        #expect(transport.sentMessages.isEmpty)
-    }
-}
-
-// MARK: - Message Receiving Tests
-
-struct ChatViewModelReceivingTests {
-
-    @Test @MainActor
-    func didReceiveMessage_callsDelegate() async {
-        let (_, transport) = makeTestableViewModel()
-
-        let message = BitchatMessage(
-            id: "msg-001",
-            sender: "Alice",
-            content: "Hello from Alice",
-            timestamp: Date(),
-            isRelay: false,
-            originalSender: nil,
-            isPrivate: false,
-            recipientNickname: nil,
-            senderPeerID: PeerID(str: "PEER001"),
-            mentions: nil
-        )
-
-        transport.simulateIncomingMessage(message)
-
-        // Give time for Task and pipeline processing
-        try? await Task.sleep(nanoseconds: 200_000_000)
-
-        // Message may or may not appear due to rate limiting/pipeline batching
-        // The important thing is no crash and delegate was called
-        #expect(transport.delegate != nil)
-    }
-
-    @Test @MainActor
-    func didReceivePublicMessage_addsToTimeline() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        transport.simulateIncomingPublicMessage(
-            from: PeerID(str: "PEER002"),
-            nickname: "Bob",
-            content: "Public hello from Bob",
-            timestamp: Date(),
-            messageID: "pub-001"
-        )
-
-        // Give time for async Task and pipeline processing
-        try? await Task.sleep(nanoseconds: 500_000_000)
-
-        #expect(viewModel.messages.contains { $0.content == "Public hello from Bob" })
-    }
-}
-
-// MARK: - Peer Connection Tests
-
-struct ChatViewModelPeerTests {
-
-    @Test @MainActor
-    func didConnectToPeer_notifiesDelegate() async {
-        let (_, transport) = makeTestableViewModel()
-        let peerID = PeerID(str: "NEWPEER")
-
-        transport.simulateConnect(peerID, nickname: "NewUser")
-
-        #expect(transport.connectedPeers.contains(peerID))
-    }
-
-    @Test @MainActor
-    func didDisconnectFromPeer_notifiesDelegate() async {
-        let (_, transport) = makeTestableViewModel()
-        let peerID = PeerID(str: "OLDPEER")
-
-        transport.simulateConnect(peerID, nickname: "OldUser")
-        transport.simulateDisconnect(peerID)
-
-        #expect(!transport.connectedPeers.contains(peerID))
-    }
-
-    @Test @MainActor
-    func isPeerConnected_delegatesToTransport() async {
-        let (_, transport) = makeTestableViewModel()
-        let peerID = PeerID(str: "TESTPEER")
-
-        // Not connected initially
-        #expect(!transport.isPeerConnected(peerID))
-
-        transport.connectedPeers.insert(peerID)
-
-        #expect(transport.isPeerConnected(peerID))
-    }
-}
-
-// MARK: - Deduplication Integration Tests
-//
-// Note: Detailed deduplication logic is tested in MessageDeduplicationServiceTests.
-// These tests verify that ChatViewModel has a deduplication service configured.
-
-struct ChatViewModelDeduplicationTests {
-
-    @Test @MainActor
-    func deduplicationService_isConfigured() async {
-        let (viewModel, _) = makeTestableViewModel()
-
-        // Verify the deduplication service is available and functional
-        // by checking that we can record and query content
-        let testContent = "Test dedup content \(UUID().uuidString)"
-        let testDate = Date()
-
-        viewModel.deduplicationService.recordContent(testContent, timestamp: testDate)
-
-        let retrieved = viewModel.deduplicationService.contentTimestamp(for: testContent)
-        #expect(retrieved == testDate)
-    }
-
-    @Test @MainActor
-    func deduplicationService_normalizedKey_consistent() async {
-        let (viewModel, _) = makeTestableViewModel()
-
-        let content = "Hello World"
-        let key1 = viewModel.deduplicationService.normalizedContentKey(content)
-        let key2 = viewModel.deduplicationService.normalizedContentKey(content)
-
-        #expect(key1 == key2)
-    }
-}
-
-// MARK: - Private Chat Tests
-
-struct ChatViewModelPrivateChatTests {
-
-    @Test @MainActor
-    func sendPrivateMessage_delegatesToTransport() async {
-        let (viewModel, transport) = makeTestableViewModel()
-        let recipientID = PeerID(str: "RECIPIENT")
-
-        // Set up connected peer for routing
-        transport.connectedPeers.insert(recipientID)
-        transport.peerNicknames[recipientID] = "Recipient"
-
-        viewModel.sendPrivateMessage("Secret message", to: recipientID)
-
-        // The message routing depends on connection state and other factors
-        // At minimum, it should not crash
-        #expect(true) // If we get here without crash, the test passes
-    }
-}
-
-// MARK: - Bluetooth State Tests
-
-struct ChatViewModelBluetoothTests {
-
-    @Test @MainActor
-    func didUpdateBluetoothState_poweredOn_noAlert() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        transport.simulateBluetoothStateChange(.poweredOn)
-
-        // Give time for async processing
-        try? await Task.sleep(nanoseconds: 100_000_000)
-
-        #expect(!viewModel.showBluetoothAlert)
-    }
-
-    @Test @MainActor
-    func didUpdateBluetoothState_poweredOff_showsAlert() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        transport.simulateBluetoothStateChange(.poweredOff)
-
-        // Give time for async processing
-        try? await Task.sleep(nanoseconds: 100_000_000)
-
-        #expect(viewModel.showBluetoothAlert)
-    }
-
-    @Test @MainActor
-    func didUpdateBluetoothState_unauthorized_showsAlert() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        transport.simulateBluetoothStateChange(.unauthorized)
-
-        // Give time for async processing
-        try? await Task.sleep(nanoseconds: 100_000_000)
-
-        #expect(viewModel.showBluetoothAlert)
-    }
-}
-
-// MARK: - Panic Clear Tests
-
-struct ChatViewModelPanicTests {
-
-    @Test @MainActor
-    func panicClearAllData_delegatesToTransport() async {
-        let (viewModel, transport) = makeTestableViewModel()
-
-        // Set up some state
-        transport.connectedPeers.insert(PeerID(str: "PEER1"))
-
-        viewModel.panicClearAllData()
-
-        // After panic, emergency disconnect should be called
-        #expect(transport.emergencyDisconnectCallCount == 1)
-    }
-}
-
-// MARK: - Service Lifecycle Tests
-
-struct ChatViewModelLifecycleTests {
-
-    @Test @MainActor
-    func startServices_calledOnInit() async {
-        let (_, transport) = makeTestableViewModel()
-
-        #expect(transport.startServicesCallCount == 1)
-    }
-}

bitchatTests/Fragmentation/FragmentationTests.swift

@@ -32,28 +32,29 @@ struct FragmentationTests {
         )
         let capture = CaptureDelegate()
         ble.delegate = capture
-
+        
         // Construct a big packet (3KB) from a remote sender (not our own ID)
         let remoteShortID = PeerID(str: "1122334455667788")
         let original = makeLargePublicPacket(senderShortHex: remoteShortID, size: 3_000)
-
+        
         // Use a small fragment size to ensure multiple pieces
         let fragments = fragmentPacket(original, fragmentSize: 400)
-
+        
         // Shuffle fragments to simulate out-of-order arrival
         let shuffled = fragments.shuffled()
-
-        // Send fragments sequentially with small delays (no fire-and-forget Tasks)
+        
+        // Inject fragments spaced out to avoid concurrent mutation inside BLEService
         for (i, fragment) in shuffled.enumerated() {
-            if i > 0 {
-                try await Task.sleep(for: .milliseconds(5))
+            let delay = 5 * Double(i) * 0.001
+            Task {
+                try await sleep(delay)
+                ble._test_handlePacket(fragment, fromPeerID: remoteShortID)
             }
-            ble._test_handlePacket(fragment, fromPeerID: remoteShortID)
         }
-
-        // Wait for delegate callback with proper timeout
-        try await capture.waitForPublicMessages(count: 1, timeout: .seconds(2))
-
+        
+        // Allow async processing
+        try await sleep(0.5)
+        
         #expect(capture.publicMessages.count == 1)
         #expect(capture.publicMessages.first?.content.count == 3_000)
     }
@@ -67,26 +68,26 @@ struct FragmentationTests {
         )
         let capture = CaptureDelegate()
         ble.delegate = capture
-
+        
         let remoteShortID = PeerID(str: "A1B2C3D4E5F60708")
         let original = makeLargePublicPacket(senderShortHex: remoteShortID, size: 2048)
         var frags = fragmentPacket(original, fragmentSize: 300)
-
+        
         // Duplicate one fragment
         if let dup = frags.first {
             frags.insert(dup, at: 1)
         }
-
-        // Send fragments sequentially with small delays (no fire-and-forget Tasks)
+        
         for (i, fragment) in frags.enumerated() {
-            if i > 0 {
-                try await Task.sleep(for: .milliseconds(5))
+            let delay = 5 * Double(i) * 0.001
+            Task {
+                try await sleep(delay)
+                ble._test_handlePacket(fragment, fromPeerID: remoteShortID)
             }
-            ble._test_handlePacket(fragment, fromPeerID: remoteShortID)
         }
-
-        // Wait for delegate callback with proper timeout
-        try await capture.waitForPublicMessages(count: 1, timeout: .seconds(2))
+        
+        // Allow async processing
+        try await sleep(0.5)
 
         #expect(capture.publicMessages.count == 1)
         #expect(capture.publicMessages.first?.content.count == 2048)
@@ -195,128 +196,12 @@ struct FragmentationTests {
 }
 
 extension FragmentationTests {
-    /// Thread-safe delegate that supports awaiting message delivery
-    private final class CaptureDelegate: BitchatDelegate, @unchecked Sendable {
-        private let lock = NSLock()
-        private var _publicMessages: [(peerID: PeerID, nickname: String, content: String)] = []
-        private var _receivedMessages: [BitchatMessage] = []
-        private var publicMessageContinuation: CheckedContinuation<Void, Never>?
-        private var receivedMessageContinuation: CheckedContinuation<Void, Never>?
-        private var expectedPublicMessageCount: Int = 0
-        private var expectedReceivedMessageCount: Int = 0
-
-        var publicMessages: [(peerID: PeerID, nickname: String, content: String)] {
-            lock.lock()
-            defer { lock.unlock() }
-            return _publicMessages
-        }
-
-        var receivedMessages: [BitchatMessage] {
-            lock.lock()
-            defer { lock.unlock() }
-            return _receivedMessages
-        }
-
+    private final class CaptureDelegate: BitchatDelegate {
+        var publicMessages: [(peerID: PeerID, nickname: String, content: String)] = []
+        var receivedMessages: [BitchatMessage] = []
         func didReceiveMessage(_ message: BitchatMessage) {
-            lock.lock()
-            _receivedMessages.append(message)
-            let count = _receivedMessages.count
-            let expected = expectedReceivedMessageCount
-            let continuation = receivedMessageContinuation
-            lock.unlock()
-
-            if count >= expected, let cont = continuation {
-                lock.lock()
-                receivedMessageContinuation = nil
-                lock.unlock()
-                cont.resume()
-            }
+            receivedMessages.append(message)
         }
-
-        func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {
-            lock.lock()
-            _publicMessages.append((peerID, nickname, content))
-            let count = _publicMessages.count
-            let expected = expectedPublicMessageCount
-            let continuation = publicMessageContinuation
-            lock.unlock()
-
-            if count >= expected, let cont = continuation {
-                lock.lock()
-                publicMessageContinuation = nil
-                lock.unlock()
-                cont.resume()
-            }
-        }
-
-        /// Waits for the specified number of public messages to be received
-        func waitForPublicMessages(count: Int, timeout: Duration = .seconds(2)) async throws {
-            lock.lock()
-            if _publicMessages.count >= count {
-                lock.unlock()
-                return
-            }
-            expectedPublicMessageCount = count
-            lock.unlock()
-
-            try await withThrowingTaskGroup(of: Void.self) { group in
-                group.addTask {
-                    await withCheckedContinuation { continuation in
-                        self.lock.lock()
-                        // Recheck count after acquiring lock to avoid race condition
-                        // where message arrives between initial check and continuation install
-                        if self._publicMessages.count >= count {
-                            self.lock.unlock()
-                            continuation.resume()
-                            return
-                        }
-                        self.publicMessageContinuation = continuation
-                        self.lock.unlock()
-                    }
-                }
-                group.addTask {
-                    try await Task.sleep(for: timeout)
-                    throw CancellationError()
-                }
-                try await group.next()
-                group.cancelAll()
-            }
-        }
-
-        /// Waits for the specified number of received messages
-        func waitForReceivedMessages(count: Int, timeout: Duration = .seconds(2)) async throws {
-            lock.lock()
-            if _receivedMessages.count >= count {
-                lock.unlock()
-                return
-            }
-            expectedReceivedMessageCount = count
-            lock.unlock()
-
-            try await withThrowingTaskGroup(of: Void.self) { group in
-                group.addTask {
-                    await withCheckedContinuation { continuation in
-                        self.lock.lock()
-                        // Recheck count after acquiring lock to avoid race condition
-                        // where message arrives between initial check and continuation install
-                        if self._receivedMessages.count >= count {
-                            self.lock.unlock()
-                            continuation.resume()
-                            return
-                        }
-                        self.receivedMessageContinuation = continuation
-                        self.lock.unlock()
-                    }
-                }
-                group.addTask {
-                    try await Task.sleep(for: timeout)
-                    throw CancellationError()
-                }
-                try await group.next()
-                group.cancelAll()
-            }
-        }
-
         func didConnectToPeer(_ peerID: PeerID) {}
         func didDisconnectFromPeer(_ peerID: PeerID) {}
         func didUpdatePeerList(_ peers: [PeerID]) {}
@@ -324,6 +209,9 @@ extension FragmentationTests {
         func didUpdateMessageDeliveryStatus(_ messageID: String, status: DeliveryStatus) {}
         func didReceiveNoisePayload(from peerID: PeerID, type: NoisePayloadType, payload: Data, timestamp: Date) {}
         func didUpdateBluetoothState(_ state: CBManagerState) {}
+        func didReceivePublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date, messageID: String?) {
+            publicMessages.append((peerID, nickname, content))
+        }
         func didReceiveRegionalPublicMessage(from peerID: PeerID, nickname: String, content: String, timestamp: Date) {}
     }
 

bitchatTests/GeohashParticipantTrackerTests.swift

@@ -1,293 +0,0 @@
-//
-// GeohashParticipantTrackerTests.swift
-// bitchatTests
-//
-// Tests for GeohashParticipantTracker.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Testing
-import Foundation
-@testable import bitchat
-
-/// Mock context for testing
-@MainActor
-final class MockParticipantContext: GeohashParticipantContext {
-    var blockedPubkeys: Set<String> = []
-    var nicknameMap: [String: String] = [:]
-    var selfPubkey: String?
-
-    func displayNameForPubkey(_ pubkeyHex: String) -> String {
-        let suffix = String(pubkeyHex.suffix(4))
-        if let self = selfPubkey, pubkeyHex.lowercased() == self.lowercased() {
-            return "me#\(suffix)"
-        }
-        if let nick = nicknameMap[pubkeyHex.lowercased()] {
-            return "\(nick)#\(suffix)"
-        }
-        return "anon#\(suffix)"
-    }
-
-    func isBlocked(_ pubkeyHexLowercased: String) -> Bool {
-        blockedPubkeys.contains(pubkeyHexLowercased.lowercased())
-    }
-}
-
-@MainActor
-struct GeohashParticipantTrackerTests {
-
-    // MARK: - Basic Recording Tests
-
-    @Test func recordParticipant_addsToActiveGeohash() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "deadbeef1234")
-
-        #expect(tracker.participantCount(for: "abc123") == 1)
-    }
-
-    @Test func recordParticipant_noActiveGeohash_noOp() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        // No active geohash set
-
-        tracker.recordParticipant(pubkeyHex: "deadbeef1234")
-
-        // Should not throw or crash
-        #expect(tracker.participantCount(for: "abc123") == 0)
-    }
-
-    @Test func recordParticipant_specificGeohash() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "geo1")
-        tracker.recordParticipant(pubkeyHex: "pubkey2", geohash: "geo2")
-
-        #expect(tracker.participantCount(for: "geo1") == 1)
-        #expect(tracker.participantCount(for: "geo2") == 1)
-    }
-
-    @Test func recordParticipant_updatesLastSeen() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-        // Small delay and record again
-        try? await Task.sleep(nanoseconds: 10_000_000) // 10ms
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-
-        // Should still count as 1 participant (updated, not duplicated)
-        #expect(tracker.participantCount(for: "abc123") == 1)
-    }
-
-    @Test func recordParticipant_lowercasesPubkey() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "DEADBEEF")
-        tracker.recordParticipant(pubkeyHex: "deadbeef")
-
-        // Should be treated as same participant
-        #expect(tracker.participantCount(for: "abc123") == 1)
-    }
-
-    // MARK: - Visible People Tests
-
-    @Test func getVisiblePeople_returnsActiveGeohashParticipants() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-        tracker.recordParticipant(pubkeyHex: "pubkey2")
-
-        let people = tracker.getVisiblePeople()
-        #expect(people.count == 2)
-    }
-
-    @Test func getVisiblePeople_excludesBlockedParticipants() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        context.blockedPubkeys = ["pubkey2"]
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-        tracker.recordParticipant(pubkeyHex: "pubkey2")
-
-        let people = tracker.getVisiblePeople()
-        #expect(people.count == 1)
-        #expect(people.first?.id == "pubkey1")
-    }
-
-    @Test func getVisiblePeople_usesDisplayNameFromContext() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        context.nicknameMap = ["pubkey1234": "alice"]
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1234")
-
-        let people = tracker.getVisiblePeople()
-        #expect(people.count == 1)
-        #expect(people.first?.displayName == "alice#1234")
-    }
-
-    @Test func getVisiblePeople_sortedByLastSeen() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "older")
-        try? await Task.sleep(nanoseconds: 10_000_000) // 10ms
-        tracker.recordParticipant(pubkeyHex: "newer")
-
-        let people = tracker.getVisiblePeople()
-        #expect(people.count == 2)
-        #expect(people.first?.id == "newer")
-        #expect(people.last?.id == "older")
-    }
-
-    @Test func getVisiblePeople_emptyWhenNoActiveGeohash() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "abc123")
-
-        let people = tracker.getVisiblePeople()
-        #expect(people.isEmpty)
-    }
-
-    // MARK: - Activity Cutoff Tests
-
-    @Test func participantCount_excludesExpiredEntries() async {
-        // Use a very short cutoff for testing
-        let tracker = GeohashParticipantTracker(activityCutoff: -0.05) // 50ms cutoff
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-
-        // Should be counted immediately
-        #expect(tracker.participantCount(for: "abc123") == 1)
-
-        // Wait for expiry
-        try? await Task.sleep(nanoseconds: 100_000_000) // 100ms
-
-        // Should be expired now
-        #expect(tracker.participantCount(for: "abc123") == 0)
-    }
-
-    // MARK: - Remove Participant Tests
-
-    @Test func removeParticipant_removesFromAllGeohashes() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "geo1")
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "geo2")
-        tracker.recordParticipant(pubkeyHex: "pubkey2", geohash: "geo1")
-
-        tracker.removeParticipant(pubkeyHex: "pubkey1")
-
-        #expect(tracker.participantCount(for: "geo1") == 1)
-        #expect(tracker.participantCount(for: "geo2") == 0)
-    }
-
-    // MARK: - Clear Tests
-
-    @Test func clear_removesAllData() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-        tracker.recordParticipant(pubkeyHex: "pubkey2", geohash: "other")
-
-        tracker.clear()
-
-        #expect(tracker.participantCount(for: "abc123") == 0)
-        #expect(tracker.participantCount(for: "other") == 0)
-        #expect(tracker.visiblePeople.isEmpty)
-    }
-
-    @Test func clearGeohash_removesOnlySpecificGeohash() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "geo1")
-        tracker.recordParticipant(pubkeyHex: "pubkey2", geohash: "geo2")
-
-        tracker.clear(geohash: "geo1")
-
-        #expect(tracker.participantCount(for: "geo1") == 0)
-        #expect(tracker.participantCount(for: "geo2") == 1)
-    }
-
-    // MARK: - Set Active Geohash Tests
-
-    @Test func setActiveGeohash_clearsVisiblePeopleWhenNil() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-        tracker.setActiveGeohash("abc123")
-        tracker.recordParticipant(pubkeyHex: "pubkey1")
-
-        #expect(!tracker.visiblePeople.isEmpty)
-
-        tracker.setActiveGeohash(nil)
-
-        #expect(tracker.visiblePeople.isEmpty)
-    }
-
-    @Test func setActiveGeohash_refreshesVisiblePeople() async {
-        let tracker = GeohashParticipantTracker()
-        let context = MockParticipantContext()
-        tracker.configure(context: context)
-
-        // Pre-populate a geohash
-        tracker.recordParticipant(pubkeyHex: "pubkey1", geohash: "abc123")
-
-        // Set it as active
-        tracker.setActiveGeohash("abc123")
-
-        #expect(tracker.visiblePeople.count == 1)
-    }
-
-    // MARK: - GeoPerson Tests
-
-    @Test func geoPerson_identifiable() async {
-        let person1 = GeoPerson(id: "abc", displayName: "alice", lastSeen: Date())
-        let person2 = GeoPerson(id: "abc", displayName: "alice", lastSeen: Date())
-        let person3 = GeoPerson(id: "xyz", displayName: "bob", lastSeen: Date())
-
-        #expect(person1.id == person2.id)
-        #expect(person1.id != person3.id)
-    }
-
-    @Test func geoPerson_equatable() async {
-        let date = Date()
-        let person1 = GeoPerson(id: "abc", displayName: "alice", lastSeen: date)
-        let person2 = GeoPerson(id: "abc", displayName: "alice", lastSeen: date)
-
-        #expect(person1 == person2)
-    }
-}

bitchatTests/MessageDeduplicationServiceTests.swift

@@ -1,604 +0,0 @@
-//
-// MessageDeduplicationServiceTests.swift
-// bitchatTests
-//
-// Tests for MessageDeduplicationService, LRUDeduplicationCache, and ContentNormalizer.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Testing
-import Foundation
-@testable import bitchat
-
-// MARK: - LRU Deduplication Cache Tests
-
-@Suite("LRU Deduplication Cache")
-@MainActor
-struct LRUDeduplicationCacheTests {
-
-    // MARK: - Basic Operations
-
-    @Test func emptyCache_containsReturnsFalse() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        #expect(!cache.contains("key"))
-        #expect(cache.value(for: "key") == nil)
-        #expect(cache.count == 0)
-    }
-
-    @Test func record_addsEntry() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        cache.record("key1", value: 42)
-
-        #expect(cache.contains("key1"))
-        #expect(cache.value(for: "key1") == 42)
-        #expect(cache.count == 1)
-    }
-
-    @Test func record_updatesExistingEntry() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        cache.record("key1", value: 42)
-        cache.record("key1", value: 100)
-
-        #expect(cache.value(for: "key1") == 100)
-        #expect(cache.count == 1) // Should not increase count
-    }
-
-    @Test func record_multipleEntries() {
-        let cache = LRUDeduplicationCache<String>(capacity: 10)
-        cache.record("a", value: "alpha")
-        cache.record("b", value: "beta")
-        cache.record("c", value: "gamma")
-
-        #expect(cache.count == 3)
-        #expect(cache.value(for: "a") == "alpha")
-        #expect(cache.value(for: "b") == "beta")
-        #expect(cache.value(for: "c") == "gamma")
-    }
-
-    @Test func remove_removesEntry() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        cache.record("key1", value: 42)
-        cache.record("key2", value: 100)
-
-        cache.remove("key1")
-
-        #expect(!cache.contains("key1"))
-        #expect(cache.contains("key2"))
-    }
-
-    @Test func clear_removesAllEntries() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        cache.record("a", value: 1)
-        cache.record("b", value: 2)
-        cache.record("c", value: 3)
-
-        cache.clear()
-
-        #expect(cache.count == 0)
-        #expect(!cache.contains("a"))
-        #expect(!cache.contains("b"))
-        #expect(!cache.contains("c"))
-    }
-
-    // MARK: - Eviction Tests
-
-    @Test func eviction_removesOldestWhenOverCapacity() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 3)
-        cache.record("a", value: 1)
-        cache.record("b", value: 2)
-        cache.record("c", value: 3)
-        cache.record("d", value: 4) // Should evict "a"
-
-        #expect(cache.count == 3)
-        #expect(!cache.contains("a")) // Evicted
-        #expect(cache.contains("b"))
-        #expect(cache.contains("c"))
-        #expect(cache.contains("d"))
-    }
-
-    @Test func eviction_maintainsCapacity() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 2)
-
-        for i in 0..<100 {
-            cache.record("key\(i)", value: i)
-        }
-
-        #expect(cache.count == 2)
-        // Most recent entries should be present
-        #expect(cache.contains("key99"))
-        #expect(cache.contains("key98"))
-        // Older entries should be evicted
-        #expect(!cache.contains("key0"))
-        #expect(!cache.contains("key50"))
-    }
-
-    @Test func eviction_capacityOfOne() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 1)
-        cache.record("a", value: 1)
-        cache.record("b", value: 2)
-
-        #expect(cache.count == 1)
-        #expect(!cache.contains("a"))
-        #expect(cache.contains("b"))
-    }
-
-    @Test func eviction_skipsRemovedKeys() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 3)
-        cache.record("a", value: 1)
-        cache.record("b", value: 2)
-        cache.record("c", value: 3)
-
-        // Remove "a" manually
-        cache.remove("a")
-
-        // Add new entry - should evict "b" (next oldest still in map)
-        cache.record("d", value: 4)
-
-        // Cache should have b, c, d (a was removed)
-        // Actually after eviction it should have c, d and maybe b depending on implementation
-        #expect(!cache.contains("a"))
-        #expect(cache.count <= 3)
-    }
-
-    // MARK: - Edge Cases
-
-    @Test func emptyKey_works() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        cache.record("", value: 42)
-
-        #expect(cache.contains(""))
-        #expect(cache.value(for: "") == 42)
-    }
-
-    @Test func largeCapacity_works() {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10000)
-
-        for i in 0..<5000 {
-            cache.record("key\(i)", value: i)
-        }
-
-        #expect(cache.count == 5000)
-        #expect(cache.contains("key0"))
-        #expect(cache.contains("key4999"))
-    }
-}
-
-// MARK: - Content Normalizer Tests
-
-struct ContentNormalizerTests {
-
-    @Test func normalizedKey_basicContent() {
-        let key1 = ContentNormalizer.normalizedKey("Hello World")
-        let key2 = ContentNormalizer.normalizedKey("Hello World")
-        #expect(key1 == key2)
-    }
-
-    @Test func normalizedKey_caseInsensitive() {
-        let key1 = ContentNormalizer.normalizedKey("Hello World")
-        let key2 = ContentNormalizer.normalizedKey("hello world")
-        let key3 = ContentNormalizer.normalizedKey("HELLO WORLD")
-        #expect(key1 == key2)
-        #expect(key2 == key3)
-    }
-
-    @Test func normalizedKey_whitespaceCollapsed() {
-        let key1 = ContentNormalizer.normalizedKey("Hello World")
-        let key2 = ContentNormalizer.normalizedKey("Hello    World")
-        let key3 = ContentNormalizer.normalizedKey("Hello\t\nWorld")
-        #expect(key1 == key2)
-        #expect(key2 == key3)
-    }
-
-    @Test func normalizedKey_trimmed() {
-        let key1 = ContentNormalizer.normalizedKey("Hello")
-        let key2 = ContentNormalizer.normalizedKey("  Hello  ")
-        let key3 = ContentNormalizer.normalizedKey("\nHello\n")
-        #expect(key1 == key2)
-        #expect(key2 == key3)
-    }
-
-    @Test func normalizedKey_urlQueryStripped() {
-        let key1 = ContentNormalizer.normalizedKey("Check https://example.com/page")
-        let key2 = ContentNormalizer.normalizedKey("Check https://example.com/page?query=value")
-        let key3 = ContentNormalizer.normalizedKey("Check https://example.com/page#anchor")
-        #expect(key1 == key2)
-        #expect(key2 == key3)
-    }
-
-    @Test func normalizedKey_httpAndHttpsDistinct() {
-        // URL scheme is preserved
-        let key1 = ContentNormalizer.normalizedKey("http://example.com/page")
-        let key2 = ContentNormalizer.normalizedKey("https://example.com/page")
-        #expect(key1 != key2)
-    }
-
-    @Test func normalizedKey_differentContent() {
-        let key1 = ContentNormalizer.normalizedKey("Hello")
-        let key2 = ContentNormalizer.normalizedKey("Goodbye")
-        #expect(key1 != key2)
-    }
-
-    @Test func normalizedKey_returnsHashFormat() {
-        let key = ContentNormalizer.normalizedKey("Test content")
-        #expect(key.hasPrefix("h:"))
-        #expect(key.count == 18) // "h:" + 16 hex chars
-    }
-
-    @Test func normalizedKey_emptyContent() {
-        let key = ContentNormalizer.normalizedKey("")
-        #expect(key.hasPrefix("h:"))
-    }
-
-    @Test func normalizedKey_longContentTruncated() {
-        let longContent = String(repeating: "a", count: 10000)
-        let key1 = ContentNormalizer.normalizedKey(longContent)
-        let key2 = ContentNormalizer.normalizedKey(longContent + "extra")
-
-        // Both should be the same since content is truncated before hashing
-        #expect(key1 == key2)
-    }
-
-    @Test func normalizedKey_prefixLengthRespected() {
-        let content = "Short"
-        let key1 = ContentNormalizer.normalizedKey(content, prefixLength: 3)
-        let key2 = ContentNormalizer.normalizedKey(content, prefixLength: 100)
-
-        // Different prefix lengths may produce different keys
-        // "sho" vs "short"
-        #expect(key1 != key2)
-    }
-
-    @Test func normalizedKey_urlsInMiddleOfContent() {
-        let content1 = "Check out https://example.com/path?query=1 for more info"
-        let content2 = "Check out https://example.com/path for more info"
-        let key1 = ContentNormalizer.normalizedKey(content1)
-        let key2 = ContentNormalizer.normalizedKey(content2)
-        #expect(key1 == key2)
-    }
-
-    @Test func normalizedKey_multipleUrls() {
-        let content1 = "Links: https://a.com?x=1 and http://b.com#y"
-        let content2 = "Links: https://a.com and http://b.com"
-        let key1 = ContentNormalizer.normalizedKey(content1)
-        let key2 = ContentNormalizer.normalizedKey(content2)
-        #expect(key1 == key2)
-    }
-}
-
-// MARK: - Message Deduplication Service Tests
-
-@Suite("Message Deduplication Service")
-@MainActor
-struct MessageDeduplicationServiceTests {
-
-    // MARK: - Content Deduplication
-
-    @Test func recordContent_storesTimestamp() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-
-        service.recordContent("Hello World", timestamp: now)
-
-        let retrieved = service.contentTimestamp(for: "Hello World")
-        #expect(retrieved == now)
-    }
-
-    @Test func recordContent_updatesTimestamp() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let early = Date(timeIntervalSince1970: 1000)
-        let late = Date(timeIntervalSince1970: 2000)
-
-        service.recordContent("Hello World", timestamp: early)
-        service.recordContent("Hello World", timestamp: late)
-
-        let retrieved = service.contentTimestamp(for: "Hello World")
-        #expect(retrieved == late)
-    }
-
-    @Test func contentTimestamp_nilForUnseen() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-
-        let timestamp = service.contentTimestamp(for: "Never seen")
-        #expect(timestamp == nil)
-    }
-
-    @Test func recordContentKey_directKeyAccess() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-        let key = service.normalizedContentKey("Test")
-
-        service.recordContentKey(key, timestamp: now)
-
-        #expect(service.contentTimestamp(forKey: key) == now)
-    }
-
-    @Test func normalizedContentKey_consistentWithNormalizer() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let content = "Hello World"
-
-        let serviceKey = service.normalizedContentKey(content)
-        let normalizerKey = ContentNormalizer.normalizedKey(content)
-
-        #expect(serviceKey == normalizerKey)
-    }
-
-    // MARK: - Nostr Event Deduplication
-
-    @Test func recordNostrEvent_marksAsProcessed() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-
-        #expect(!service.hasProcessedNostrEvent("event123"))
-
-        service.recordNostrEvent("event123")
-
-        #expect(service.hasProcessedNostrEvent("event123"))
-    }
-
-    @Test func hasProcessedNostrEvent_falseForUnseen() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-
-        #expect(!service.hasProcessedNostrEvent("never-seen"))
-    }
-
-    @Test func nostrEvent_multipleEvents() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-
-        service.recordNostrEvent("event1")
-        service.recordNostrEvent("event2")
-        service.recordNostrEvent("event3")
-
-        #expect(service.hasProcessedNostrEvent("event1"))
-        #expect(service.hasProcessedNostrEvent("event2"))
-        #expect(service.hasProcessedNostrEvent("event3"))
-        #expect(!service.hasProcessedNostrEvent("event4"))
-    }
-
-    // MARK: - Nostr ACK Deduplication
-
-    @Test func recordNostrAck_marksAsProcessed() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let ackKey = MessageDeduplicationService.ackKey(
-            messageId: "msg123",
-            ackType: "delivered",
-            senderPubkey: "pubkey456"
-        )
-
-        #expect(!service.hasProcessedNostrAck(ackKey))
-
-        service.recordNostrAck(ackKey)
-
-        #expect(service.hasProcessedNostrAck(ackKey))
-    }
-
-    @Test func ackKey_format() {
-        let key = MessageDeduplicationService.ackKey(
-            messageId: "msg",
-            ackType: "read",
-            senderPubkey: "pub"
-        )
-        #expect(key == "msg:read:pub")
-    }
-
-    @Test func ackKey_differentComponents() {
-        let key1 = MessageDeduplicationService.ackKey(messageId: "a", ackType: "delivered", senderPubkey: "x")
-        let key2 = MessageDeduplicationService.ackKey(messageId: "a", ackType: "read", senderPubkey: "x")
-        let key3 = MessageDeduplicationService.ackKey(messageId: "b", ackType: "delivered", senderPubkey: "x")
-
-        #expect(key1 != key2) // Different ackType
-        #expect(key1 != key3) // Different messageId
-    }
-
-    // MARK: - Clear Operations
-
-    @Test func clearAll_clearsEverything() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-
-        service.recordContent("Hello", timestamp: now)
-        service.recordNostrEvent("event1")
-        service.recordNostrAck("ack1")
-
-        service.clearAll()
-
-        #expect(service.contentTimestamp(for: "Hello") == nil)
-        #expect(!service.hasProcessedNostrEvent("event1"))
-        #expect(!service.hasProcessedNostrAck("ack1"))
-    }
-
-    @Test func clearNostrCaches_preservesContent() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-
-        service.recordContent("Hello", timestamp: now)
-        service.recordNostrEvent("event1")
-        service.recordNostrAck("ack1")
-
-        service.clearNostrCaches()
-
-        #expect(service.contentTimestamp(for: "Hello") == now) // Preserved
-        #expect(!service.hasProcessedNostrEvent("event1")) // Cleared
-        #expect(!service.hasProcessedNostrAck("ack1")) // Cleared
-    }
-
-    // MARK: - Capacity Tests
-
-    @Test func contentCache_respectsCapacity() {
-        let service = MessageDeduplicationService(contentCapacity: 3, nostrEventCapacity: 100)
-
-        service.recordContent("a", timestamp: Date())
-        service.recordContent("b", timestamp: Date())
-        service.recordContent("c", timestamp: Date())
-        service.recordContent("d", timestamp: Date())
-
-        // "a" should have been evicted
-        #expect(service.contentTimestamp(for: "a") == nil)
-        #expect(service.contentTimestamp(for: "d") != nil)
-    }
-
-    @Test func nostrEventCache_respectsCapacity() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 3)
-
-        service.recordNostrEvent("e1")
-        service.recordNostrEvent("e2")
-        service.recordNostrEvent("e3")
-        service.recordNostrEvent("e4")
-
-        // "e1" should have been evicted
-        #expect(!service.hasProcessedNostrEvent("e1"))
-        #expect(service.hasProcessedNostrEvent("e4"))
-    }
-
-    // MARK: - Integration Tests
-
-    @Test func realWorldDeduplication_similarMessages() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-
-        // Record original message
-        service.recordContent("Check out https://example.com/page?ref=abc", timestamp: now)
-
-        // Same URL with different query params should match
-        let timestamp = service.contentTimestamp(for: "Check out https://example.com/page?ref=xyz")
-        #expect(timestamp == now)
-    }
-
-    @Test func realWorldDeduplication_caseVariations() {
-        let service = MessageDeduplicationService(contentCapacity: 100, nostrEventCapacity: 100)
-        let now = Date()
-
-        service.recordContent("HELLO WORLD", timestamp: now)
-
-        #expect(service.contentTimestamp(for: "hello world") == now)
-        #expect(service.contentTimestamp(for: "Hello World") == now)
-    }
-
-    // MARK: - Thread Safety Tests (via @MainActor enforcement)
-
-    @Test("Concurrent content recording is safe via MainActor")
-    func concurrentContentRecording() async {
-        let service = MessageDeduplicationService(contentCapacity: 1000, nostrEventCapacity: 1000)
-        let iterations = 100
-
-        // All operations run on MainActor due to @MainActor annotation
-        // This test verifies the pattern works correctly
-        await withTaskGroup(of: Void.self) { group in
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    service.recordContent("Message \(i)", timestamp: Date())
-                }
-            }
-        }
-
-        // Verify some entries were recorded
-        #expect(service.contentTimestamp(for: "Message 0") != nil)
-        #expect(service.contentTimestamp(for: "Message 99") != nil)
-    }
-
-    @Test("Concurrent Nostr event recording is safe via MainActor")
-    func concurrentNostrEventRecording() async {
-        let service = MessageDeduplicationService(contentCapacity: 1000, nostrEventCapacity: 1000)
-        let iterations = 100
-
-        await withTaskGroup(of: Void.self) { group in
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    service.recordNostrEvent("event_\(i)")
-                }
-            }
-        }
-
-        // Verify events were recorded
-        #expect(service.hasProcessedNostrEvent("event_0"))
-        #expect(service.hasProcessedNostrEvent("event_99"))
-    }
-
-    @Test("Mixed concurrent operations are safe via MainActor")
-    func concurrentMixedOperations() async {
-        let service = MessageDeduplicationService(contentCapacity: 1000, nostrEventCapacity: 1000)
-        let iterations = 50
-
-        await withTaskGroup(of: Void.self) { group in
-            // Content recording tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    service.recordContent("Content \(i)", timestamp: Date())
-                }
-            }
-
-            // Event recording tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    service.recordNostrEvent("event_\(i)")
-                }
-            }
-
-            // ACK recording tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    service.recordNostrAck("ack_\(i)")
-                }
-            }
-
-            // Read tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    _ = service.contentTimestamp(for: "Content \(i)")
-                    _ = service.hasProcessedNostrEvent("event_\(i)")
-                    _ = service.hasProcessedNostrAck("ack_\(i)")
-                }
-            }
-        }
-
-        // If we reach here without crashes, the test passes
-    }
-}
-
-// MARK: - LRU Cache Thread Safety Tests
-
-@Suite("LRU Cache Thread Safety")
-@MainActor
-struct LRUCacheThreadSafetyTests {
-
-    @Test("Concurrent cache access is safe via MainActor")
-    func concurrentCacheAccess() async {
-        let cache = LRUDeduplicationCache<Int>(capacity: 500)
-        let iterations = 100
-
-        await withTaskGroup(of: Void.self) { group in
-            // Write tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    cache.record("key_\(i)", value: i)
-                }
-            }
-
-            // Read tasks
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    _ = cache.contains("key_\(i)")
-                    _ = cache.value(for: "key_\(i)")
-                }
-            }
-        }
-
-        // Verify cache is in consistent state
-        #expect(cache.count <= 500) // Respects capacity
-    }
-
-    @Test("Cache eviction under concurrent load is safe")
-    func cacheEvictionUnderLoad() async {
-        let cache = LRUDeduplicationCache<Int>(capacity: 10)
-        let iterations = 100
-
-        await withTaskGroup(of: Void.self) { group in
-            for i in 0..<iterations {
-                group.addTask { @MainActor in
-                    cache.record("key_\(i)", value: i)
-                }
-            }
-        }
-
-        // Cache should maintain its capacity constraint
-        #expect(cache.count == 10)
-    }
-}

bitchatTests/MessageFormattingEngineTests.swift

@@ -1,223 +0,0 @@
-//
-// MessageFormattingEngineTests.swift
-// bitchatTests
-//
-// Tests for MessageFormattingEngine regex patterns and utility functions.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Testing
-import Foundation
-import SwiftUI
-@testable import bitchat
-
-struct MessageFormattingEngineTests {
-
-    // MARK: - Mention Extraction Tests
-
-    @Test func extractMentions_singleMention() {
-        let content = "Hello @alice how are you?"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions == ["alice"])
-    }
-
-    @Test func extractMentions_multipleMentions() {
-        let content = "@alice and @bob are chatting with @charlie"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions.count == 3)
-        #expect(mentions.contains("alice"))
-        #expect(mentions.contains("bob"))
-        #expect(mentions.contains("charlie"))
-    }
-
-    @Test func extractMentions_mentionWithSuffix() {
-        let content = "Hey @alice#a1b2 check this out"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions == ["alice#a1b2"])
-    }
-
-    @Test func extractMentions_noMentions() {
-        let content = "Just a regular message with no mentions"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions.isEmpty)
-    }
-
-    @Test func extractMentions_unicodeNickname() {
-        let content = "Hello @日本語 and @émile"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions.count == 2)
-        #expect(mentions.contains("日本語"))
-        #expect(mentions.contains("émile"))
-    }
-
-    @Test func extractMentions_mentionWithUnderscore() {
-        let content = "Thanks @user_name_123"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        #expect(mentions == ["user_name_123"])
-    }
-
-    @Test func extractMentions_emailNotCaptured() {
-        // Email addresses should not be captured as mentions
-        let content = "Contact me at test@example.com"
-        let mentions = MessageFormattingEngine.extractMentions(from: content)
-        // The regex will capture "example" after @ in email - this is expected behavior
-        // as the regex doesn't distinguish email addresses
-        #expect(mentions.count == 1)
-    }
-
-    // MARK: - Cashu Token Detection Tests
-
-    @Test func containsCashuToken_validTokenA() {
-        let content = "Here's a token: cashuAeyJwcm9vZnMiOiJIZWxsbyBXb3JsZCEgVGhpcyBpcyBhIHRlc3QgdG9rZW4i"
-        #expect(MessageFormattingEngine.containsCashuToken(content))
-    }
-
-    @Test func containsCashuToken_validTokenB() {
-        let content = "Payment: cashuBeyJwcm9vZnMiOiJIZWxsbyBXb3JsZCEgVGhpcyBpcyBhIHRlc3QgdG9rZW4i"
-        #expect(MessageFormattingEngine.containsCashuToken(content))
-    }
-
-    @Test func containsCashuToken_noToken() {
-        let content = "Just a regular message about cashews"
-        #expect(!MessageFormattingEngine.containsCashuToken(content))
-    }
-
-    @Test func containsCashuToken_tooShort() {
-        let content = "Invalid: cashuAshort"
-        #expect(!MessageFormattingEngine.containsCashuToken(content))
-    }
-
-    // MARK: - Regex Pattern Tests
-
-    @Test func hashtagPattern_standaloneHashtag() {
-        let content = "#bitcoin is great"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.hashtag.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    @Test func hashtagPattern_multipleHashtags() {
-        let content = "#bitcoin #lightning #nostr"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.hashtag.matches(in: content, options: [], range: range)
-        #expect(matches.count == 3)
-    }
-
-    @Test func hashtagPattern_hashInMiddleOfWord() {
-        let content = "test#notahashtag"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.hashtag.matches(in: content, options: [], range: range)
-        // This will match because the regex doesn't check for word boundaries
-        #expect(matches.count == 1)
-    }
-
-    @Test func bolt11Pattern_mainnet() {
-        let content = "Pay this: lnbc10u1pjexampleinvoice0000000000000000000000000000000000000000000"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.bolt11.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    @Test func bolt11Pattern_testnet() {
-        let content = "Test: lntb10u1pjexampleinvoice0000000000000000000000000000000000000000000"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.bolt11.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    @Test func lnurlPattern_valid() {
-        let content = "LNURL: lnurl1dp68gurn8ghj7um9wfmxjcm99e3k7mf0v9cxj0m385ekvcenxc6r2c35xvukxefcv5mkvv34x5ekzd3ev56nyd3hxqurzepexejxxepnxscrvwfnv9nxzcn9xq6xyefhvgcxxcmyxymnserx"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.lnurl.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    @Test func lightningSchemePattern_valid() {
-        let content = "Click: lightning:lnbc10u1example"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.lightningScheme.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    @Test func cashuPattern_valid() {
-        let content = "Token: cashuAeyJwcm9vZnMiOlt7ImlkIjoiMDAwMDAwMDAwMDAwMDAwMCJ9XX0="
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.cashu.matches(in: content, options: [], range: range)
-        #expect(matches.count == 1)
-    }
-
-    // MARK: - URL Detection Tests
-
-    @Test func linkDetector_httpURL() {
-        let content = "Check out http://example.com"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.linkDetector?.matches(in: content, options: [], range: range) ?? []
-        #expect(matches.count == 1)
-    }
-
-    @Test func linkDetector_httpsURL() {
-        let content = "Visit https://example.com/path?query=value"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.linkDetector?.matches(in: content, options: [], range: range) ?? []
-        #expect(matches.count == 1)
-    }
-
-    @Test func linkDetector_multipleURLs() {
-        let content = "See https://a.com and http://b.com"
-        let nsContent = content as NSString
-        let range = NSRange(location: 0, length: nsContent.length)
-        let matches = MessageFormattingEngine.Patterns.linkDetector?.matches(in: content, options: [], range: range) ?? []
-        #expect(matches.count == 2)
-    }
-
-    // MARK: - String Extension Tests
-
-    @Test func splitSuffix_withSuffix() {
-        let name = "alice#a1b2"
-        let (base, suffix) = name.splitSuffix()
-        #expect(base == "alice")
-        #expect(suffix == "#a1b2")
-    }
-
-    @Test func splitSuffix_withoutSuffix() {
-        let name = "alice"
-        let (base, suffix) = name.splitSuffix()
-        #expect(base == "alice")
-        #expect(suffix == "")
-    }
-
-    @Test func splitSuffix_withAtPrefix() {
-        let name = "@alice#a1b2"
-        let (base, suffix) = name.splitSuffix()
-        #expect(base == "alice")
-        #expect(suffix == "#a1b2")
-    }
-
-    @Test func hasVeryLongToken_noLongToken() {
-        let content = "Short words only here"
-        #expect(!content.hasVeryLongToken(threshold: 50))
-    }
-
-    @Test func hasVeryLongToken_withLongToken() {
-        let longToken = String(repeating: "a", count: 100)
-        let content = "Here is a \(longToken) token"
-        #expect(content.hasVeryLongToken(threshold: 50))
-    }
-
-    @Test func hasVeryLongToken_exactThreshold() {
-        let exactToken = String(repeating: "a", count: 50)
-        let content = "Token: \(exactToken)"
-        // Exactly at threshold DOES trigger (uses >= comparison)
-        #expect(content.hasVeryLongToken(threshold: 50))
-    }
-}

bitchatTests/Mocks/MockIdentityManager.swift

@@ -11,8 +11,6 @@ import Foundation
 
 final class MockIdentityManager: SecureIdentityStateManagerProtocol {
     private let keychain: KeychainManagerProtocol
-    private var blockedFingerprints: Set<String> = []
-    private var blockedNostrPubkeys: Set<String> = []
     
     init(_ keychain: KeychainManagerProtocol) {
         self.keychain = keychain
@@ -47,31 +45,19 @@ final class MockIdentityManager: SecureIdentityStateManagerProtocol {
     }
     
     func isBlocked(fingerprint: String) -> Bool {
-        blockedFingerprints.contains(fingerprint)
+        false
     }
     
-    func setBlocked(_ fingerprint: String, isBlocked: Bool) {
-        if isBlocked {
-            blockedFingerprints.insert(fingerprint)
-        } else {
-            blockedFingerprints.remove(fingerprint)
-        }
-    }
+    func setBlocked(_ fingerprint: String, isBlocked: Bool) {}
     
     func isNostrBlocked(pubkeyHexLowercased: String) -> Bool {
-        blockedNostrPubkeys.contains(pubkeyHexLowercased)
+        true
     }
     
-    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {
-        if isBlocked {
-            blockedNostrPubkeys.insert(pubkeyHexLowercased)
-        } else {
-            blockedNostrPubkeys.remove(pubkeyHexLowercased)
-        }
-    }
+    func setNostrBlocked(_ pubkeyHexLowercased: String, isBlocked: Bool) {}
     
     func getBlockedNostrPubkeys() -> Set<String> {
-        blockedNostrPubkeys
+        Set()
     }
     
     func registerEphemeralSession(peerID: PeerID, handshakeState: HandshakeState) {}

bitchatTests/Mocks/MockKeychain.swift

@@ -11,144 +11,54 @@ import Foundation
 
 final class MockKeychain: KeychainManagerProtocol {
     private var storage: [String: Data] = [:]
-    private var serviceStorage: [String: [String: Data]] = [:]
-
+    
     func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
         storage[key] = keyData
         return true
     }
-
+    
     func getIdentityKey(forKey key: String) -> Data? {
         storage[key]
     }
-
+    
     func deleteIdentityKey(forKey key: String) -> Bool {
         storage.removeValue(forKey: key)
         return true
     }
-
+    
     func deleteAllKeychainData() -> Bool {
         storage.removeAll()
-        serviceStorage.removeAll()
         return true
     }
-
+    
     func secureClear(_ data: inout Data) {
+        //
         data = Data()
     }
-
+    
     func secureClear(_ string: inout String) {
         string = ""
     }
-
+    
     func verifyIdentityKeyExists() -> Bool {
         storage["identity_noiseStaticKey"] != nil
     }
-
-    // MARK: - Generic Data Storage (consolidated from KeychainHelper)
-
-    func save(key: String, data: Data, service: String, accessible: CFString?) {
-        if serviceStorage[service] == nil {
-            serviceStorage[service] = [:]
-        }
-        serviceStorage[service]?[key] = data
-    }
-
-    func load(key: String, service: String) -> Data? {
-        serviceStorage[service]?[key]
-    }
-
-    func delete(key: String, service: String) {
-        serviceStorage[service]?.removeValue(forKey: key)
-    }
 }
 
-/// Typealias for backwards compatibility with tests using MockKeychainHelper
-typealias MockKeychainHelper = MockKeychain
-
-/// Mock keychain that tracks secureClear calls for testing DH secret clearing
-final class TrackingMockKeychain: KeychainManagerProtocol {
-    private var storage: [String: Data] = [:]
-    private var serviceStorage: [String: [String: Data]] = [:]
-
-    /// Thread-safe counter for secureClear calls
-    private let lock = NSLock()
-    private var _secureClearDataCallCount = 0
-    private var _secureClearStringCallCount = 0
-
-    var secureClearDataCallCount: Int {
-        lock.lock()
-        defer { lock.unlock() }
-        return _secureClearDataCallCount
-    }
-
-    var secureClearStringCallCount: Int {
-        lock.lock()
-        defer { lock.unlock() }
-        return _secureClearStringCallCount
-    }
-
-    var totalSecureClearCallCount: Int {
-        return secureClearDataCallCount + secureClearStringCallCount
-    }
-
-    func resetCounts() {
-        lock.lock()
-        defer { lock.unlock() }
-        _secureClearDataCallCount = 0
-        _secureClearStringCallCount = 0
-    }
-
-    func saveIdentityKey(_ keyData: Data, forKey key: String) -> Bool {
-        storage[key] = keyData
-        return true
-    }
-
-    func getIdentityKey(forKey key: String) -> Data? {
-        storage[key]
-    }
-
-    func deleteIdentityKey(forKey key: String) -> Bool {
-        storage.removeValue(forKey: key)
-        return true
-    }
-
-    func deleteAllKeychainData() -> Bool {
-        storage.removeAll()
-        serviceStorage.removeAll()
-        return true
-    }
-
-    func secureClear(_ data: inout Data) {
-        lock.lock()
-        _secureClearDataCallCount += 1
-        lock.unlock()
-        data = Data()
-    }
-
-    func secureClear(_ string: inout String) {
-        lock.lock()
-        _secureClearStringCallCount += 1
-        lock.unlock()
-        string = ""
-    }
-
-    func verifyIdentityKeyExists() -> Bool {
-        storage["identity_noiseStaticKey"] != nil
-    }
-
+final class MockKeychainHelper: KeychainHelperProtocol {
+    private typealias Service = String
+    private typealias Key = String
+    private var storage: [Service: [Key: Data]] = [:]
+    
     func save(key: String, data: Data, service: String, accessible: CFString?) {
-        if serviceStorage[service] == nil {
-            serviceStorage[service] = [:]
-        }
-        serviceStorage[service]?[key] = data
+        storage[service]?[key] = data
     }
-
+    
     func load(key: String, service: String) -> Data? {
-        serviceStorage[service]?[key]
+        storage[service]?[key]
     }
-
+    
     func delete(key: String, service: String) {
-        serviceStorage[service]?.removeValue(forKey: key)
+        storage[service]?.removeValue(forKey: key)
     }
 }

bitchatTests/Mocks/MockTransport.swift

@@ -1,228 +0,0 @@
-//
-// MockTransport.swift
-// bitchatTests
-//
-// Mock Transport implementation for unit testing ChatViewModel.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Foundation
-import Combine
-import CoreBluetooth
-@testable import bitchat
-
-/// Mock Transport implementation for testing ChatViewModel in isolation.
-/// Records all method calls and allows test code to verify interactions.
-final class MockTransport: Transport {
-
-    // MARK: - Protocol Properties
-
-    weak var delegate: BitchatDelegate?
-    weak var peerEventsDelegate: TransportPeerEventsDelegate?
-
-    var myPeerID: PeerID = PeerID(str: "TESTPEER")
-    var myNickname: String = "TestUser"
-
-    private let peerSnapshotSubject = CurrentValueSubject<[TransportPeerSnapshot], Never>([])
-    var peerSnapshotPublisher: AnyPublisher<[TransportPeerSnapshot], Never> {
-        peerSnapshotSubject.eraseToAnyPublisher()
-    }
-
-    // MARK: - Recording Properties (for test assertions)
-
-    private(set) var sentMessages: [(content: String, mentions: [String], messageID: String?, timestamp: Date?)] = []
-    private(set) var sentPrivateMessages: [(content: String, peerID: PeerID, recipientNickname: String, messageID: String)] = []
-    private(set) var sentReadReceipts: [(receipt: ReadReceipt, peerID: PeerID)] = []
-    private(set) var sentDeliveryAcks: [(messageID: String, peerID: PeerID)] = []
-    private(set) var sentFavoriteNotifications: [(peerID: PeerID, isFavorite: Bool)] = []
-    private(set) var sentVerifyChallenges: [(peerID: PeerID, noiseKeyHex: String, nonceA: Data)] = []
-    private(set) var sentVerifyResponses: [(peerID: PeerID, noiseKeyHex: String, nonceA: Data)] = []
-    private(set) var startServicesCallCount = 0
-    private(set) var stopServicesCallCount = 0
-    private(set) var emergencyDisconnectCallCount = 0
-    private(set) var broadcastAnnounceCallCount = 0
-    private(set) var triggeredHandshakes: [PeerID] = []
-
-    // MARK: - Configurable Mock State
-
-    var connectedPeers: Set<PeerID> = []
-    var reachablePeers: Set<PeerID> = []
-    var peerNicknames: [PeerID: String] = [:]
-    var peerFingerprints: [PeerID: String] = [:]
-    var peerNoiseStates: [PeerID: LazyHandshakeState] = [:]
-    private let mockKeychain = MockKeychain()
-
-    // MARK: - Transport Protocol Implementation
-
-    func currentPeerSnapshots() -> [TransportPeerSnapshot] {
-        peerSnapshotSubject.value
-    }
-
-    func setNickname(_ nickname: String) {
-        myNickname = nickname
-    }
-
-    func startServices() {
-        startServicesCallCount += 1
-    }
-
-    func stopServices() {
-        stopServicesCallCount += 1
-    }
-
-    func emergencyDisconnectAll() {
-        emergencyDisconnectCallCount += 1
-        connectedPeers.removeAll()
-        reachablePeers.removeAll()
-    }
-
-    func isPeerConnected(_ peerID: PeerID) -> Bool {
-        connectedPeers.contains(peerID)
-    }
-
-    func isPeerReachable(_ peerID: PeerID) -> Bool {
-        reachablePeers.contains(peerID) || connectedPeers.contains(peerID)
-    }
-
-    func peerNickname(peerID: PeerID) -> String? {
-        peerNicknames[peerID]
-    }
-
-    func getPeerNicknames() -> [PeerID: String] {
-        peerNicknames
-    }
-
-    func getFingerprint(for peerID: PeerID) -> String? {
-        peerFingerprints[peerID]
-    }
-
-    func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState {
-        peerNoiseStates[peerID] ?? .none
-    }
-
-    func triggerHandshake(with peerID: PeerID) {
-        triggeredHandshakes.append(peerID)
-    }
-
-    func getNoiseService() -> NoiseEncryptionService {
-        NoiseEncryptionService(keychain: mockKeychain)
-    }
-
-    // MARK: - Messaging
-
-    func sendMessage(_ content: String, mentions: [String]) {
-        sentMessages.append((content, mentions, nil, nil))
-    }
-
-    func sendMessage(_ content: String, mentions: [String], messageID: String, timestamp: Date) {
-        sentMessages.append((content, mentions, messageID, timestamp))
-    }
-
-    func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {
-        sentPrivateMessages.append((content, peerID, recipientNickname, messageID))
-    }
-
-    func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {
-        sentReadReceipts.append((receipt, peerID))
-    }
-
-    func sendFavoriteNotification(to peerID: PeerID, isFavorite: Bool) {
-        sentFavoriteNotifications.append((peerID, isFavorite))
-    }
-
-    func sendBroadcastAnnounce() {
-        broadcastAnnounceCallCount += 1
-    }
-
-    func sendDeliveryAck(for messageID: String, to peerID: PeerID) {
-        sentDeliveryAcks.append((messageID, peerID))
-    }
-
-    func sendFileBroadcast(_ packet: BitchatFilePacket, transferId: String) {
-        // Not tracked for current tests
-    }
-
-    func sendFilePrivate(_ packet: BitchatFilePacket, to peerID: PeerID, transferId: String) {
-        // Not tracked for current tests
-    }
-
-    func cancelTransfer(_ transferId: String) {
-        // Not tracked for current tests
-    }
-
-    func sendVerifyChallenge(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
-        sentVerifyChallenges.append((peerID, noiseKeyHex, nonceA))
-    }
-
-    func sendVerifyResponse(to peerID: PeerID, noiseKeyHex: String, nonceA: Data) {
-        sentVerifyResponses.append((peerID, noiseKeyHex, nonceA))
-    }
-
-    // MARK: - Test Helpers
-
-    /// Clears all recorded method calls for fresh assertions
-    func resetRecordings() {
-        sentMessages.removeAll()
-        sentPrivateMessages.removeAll()
-        sentReadReceipts.removeAll()
-        sentDeliveryAcks.removeAll()
-        sentFavoriteNotifications.removeAll()
-        sentVerifyChallenges.removeAll()
-        sentVerifyResponses.removeAll()
-        startServicesCallCount = 0
-        stopServicesCallCount = 0
-        emergencyDisconnectCallCount = 0
-        broadcastAnnounceCallCount = 0
-        triggeredHandshakes.removeAll()
-    }
-
-    /// Simulates a peer connecting
-    func simulateConnect(_ peerID: PeerID, nickname: String? = nil) {
-        connectedPeers.insert(peerID)
-        if let nickname = nickname {
-            peerNicknames[peerID] = nickname
-        }
-        delegate?.didConnectToPeer(peerID)
-        delegate?.didUpdatePeerList(Array(connectedPeers))
-    }
-
-    /// Simulates a peer disconnecting
-    func simulateDisconnect(_ peerID: PeerID) {
-        connectedPeers.remove(peerID)
-        peerNicknames.removeValue(forKey: peerID)
-        delegate?.didDisconnectFromPeer(peerID)
-        delegate?.didUpdatePeerList(Array(connectedPeers))
-    }
-
-    /// Simulates receiving a message
-    func simulateIncomingMessage(_ message: BitchatMessage) {
-        delegate?.didReceiveMessage(message)
-    }
-
-    /// Simulates receiving a public message
-    func simulateIncomingPublicMessage(
-        from peerID: PeerID,
-        nickname: String,
-        content: String,
-        timestamp: Date = Date(),
-        messageID: String? = nil
-    ) {
-        delegate?.didReceivePublicMessage(
-            from: peerID,
-            nickname: nickname,
-            content: content,
-            timestamp: timestamp,
-            messageID: messageID
-        )
-    }
-
-    /// Simulates Bluetooth state change
-    func simulateBluetoothStateChange(_ state: CBManagerState) {
-        delegate?.didUpdateBluetoothState(state)
-    }
-
-    /// Updates the peer snapshot publisher
-    func updatePeerSnapshots(_ snapshots: [TransportPeerSnapshot]) {
-        peerSnapshotSubject.send(snapshots)
-    }
-}

bitchatTests/Noise/NoiseProtocolTests.swift

@@ -6,53 +6,11 @@
 // For more information, see <https://unlicense.org>
 //
 
+import Testing
 import CryptoKit
 import Foundation
-import Testing
-
 @testable import bitchat
 
-// MARK: - Test Vector Support
-
-struct NoiseTestVector: Codable {
-    let protocol_name: String
-    let init_prologue: String
-    let init_static: String
-    let init_ephemeral: String
-    let init_psks: [String]?
-    let resp_prologue: String
-    let resp_static: String
-    let resp_ephemeral: String
-    let resp_psks: [String]?
-    let handshake_hash: String?
-    let messages: [TestMessage]
-    
-    struct TestMessage: Codable {
-        let payload: String
-        let ciphertext: String
-    }
-}
-
-extension Data {
-    init?(hex: String) {
-        let cleaned = hex.replacingOccurrences(of: " ", with: "")
-        guard cleaned.count % 2 == 0 else { return nil }
-        var data = Data(capacity: cleaned.count / 2)
-        var index = cleaned.startIndex
-        while index < cleaned.endIndex {
-            let nextIndex = cleaned.index(index, offsetBy: 2)
-            guard let byte = UInt8(cleaned[index..<nextIndex], radix: 16) else { return nil }
-            data.append(byte)
-            index = nextIndex
-        }
-        self = data
-    }
-    
-    func hexString() -> String {
-        map { String(format: "%02x", $0) }.joined()
-    }
-}
-
 struct NoiseProtocolTests {
     
     private let aliceKey = Curve25519.KeyAgreement.PrivateKey()
@@ -103,7 +61,7 @@ struct NoiseProtocolTests {
         
         // Bob processes message 3 and completes handshake
         let finalMessage = try bobSession.processHandshakeMessage(message3!)
-        #expect(finalMessage == nil)  // No more messages needed
+        #expect(finalMessage == nil) // No more messages needed
         #expect(bobSession.getState() == .established)
         
         // Verify both sessions are established
@@ -111,12 +69,8 @@ struct NoiseProtocolTests {
         #expect(bobSession.isEstablished())
         
         // Verify they have each other's static keys
-        #expect(
-            aliceSession.getRemoteStaticPublicKey()?.rawRepresentation
-            == bobKey.publicKey.rawRepresentation)
-        #expect(
-            bobSession.getRemoteStaticPublicKey()?.rawRepresentation
-            == aliceKey.publicKey.rawRepresentation)
+        #expect(aliceSession.getRemoteStaticPublicKey()?.rawRepresentation == bobKey.publicKey.rawRepresentation)
+        #expect(bobSession.getRemoteStaticPublicKey()?.rawRepresentation == aliceKey.publicKey.rawRepresentation)
     }
     
     @Test func handshakeStateValidation() throws {
@@ -144,7 +98,7 @@ struct NoiseProtocolTests {
         // Alice encrypts
         let ciphertext = try aliceSession.encrypt(plaintext)
         #expect(ciphertext != plaintext)
-        #expect(ciphertext.count > plaintext.count)  // Should have overhead
+        #expect(ciphertext.count > plaintext.count) // Should have overhead
         
         // Bob decrypts
         let decrypted = try bobSession.decrypt(ciphertext)
@@ -196,16 +150,16 @@ struct NoiseProtocolTests {
     
     @Test func sessionManagerBasicOperations() throws {
         let manager = NoiseSessionManager(localStaticKey: aliceKey, keychain: mockKeychain)
-        
+
         #expect(manager.getSession(for: alicePeerID) == nil)
-        
+
         _ = try manager.initiateHandshake(with: alicePeerID)
         #expect(manager.getSession(for: alicePeerID) != nil)
-        
+
         // Get session
         let retrieved = manager.getSession(for: alicePeerID)
         #expect(retrieved != nil)
-        
+
         // Remove session
         manager.removeSession(for: alicePeerID)
         #expect(manager.getSession(for: alicePeerID) == nil)
@@ -236,13 +190,11 @@ struct NoiseProtocolTests {
         #expect(message2 != nil)
         
         // Continue handshake
-        let message3 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: message2!)
+        let message3 = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: message2!)
         #expect(message3 != nil)
         
         // Complete handshake
-        let finalMessage = try bobManager.handleIncomingHandshake(
-            from: bobPeerID, message: message3!)
+        let finalMessage = try bobManager.handleIncomingHandshake(from: bobPeerID, message: message3!)
         #expect(finalMessage == nil)
         
         // Both should have established sessions
@@ -306,19 +258,11 @@ struct NoiseProtocolTests {
     
     @Test func sessionIsolation() throws {
         // Create two separate session pairs
-        let aliceSession1 = NoiseSession(
-            peerID: PeerID(str: "peer1"), role: .initiator, keychain: mockKeychain,
-            localStaticKey: aliceKey)
-        let bobSession1 = NoiseSession(
-            peerID: PeerID(str: "alice1"), role: .responder, keychain: mockKeychain,
-            localStaticKey: bobKey)
+        let aliceSession1 = NoiseSession(peerID: PeerID(str: "peer1"), role: .initiator, keychain: mockKeychain, localStaticKey: aliceKey)
+        let bobSession1 = NoiseSession(peerID: PeerID(str: "alice1"), role: .responder, keychain: mockKeychain, localStaticKey: bobKey)
         
-        let aliceSession2 = NoiseSession(
-            peerID: PeerID(str: "peer2"), role: .initiator, keychain: mockKeychain,
-            localStaticKey: aliceKey)
-        let bobSession2 = NoiseSession(
-            peerID: PeerID(str: "alice2"), role: .responder, keychain: mockKeychain,
-            localStaticKey: bobKey)
+        let aliceSession2 = NoiseSession(peerID: PeerID(str: "peer2"), role: .initiator, keychain: mockKeychain, localStaticKey: aliceKey)
+        let bobSession2 = NoiseSession(peerID: PeerID(str: "alice2"), role: .responder, keychain: mockKeychain, localStaticKey: bobKey)
         
         // Establish both pairs
         try performHandshake(initiator: aliceSession1, responder: bobSession1)
@@ -361,20 +305,17 @@ struct NoiseProtocolTests {
         _ = try aliceManager.decrypt(message2, from: alicePeerID)
         
         // Simulate Bob restart by creating new manager with same key
-        let bobManagerRestarted = NoiseSessionManager(
-            localStaticKey: bobKey, keychain: mockKeychain)
+        let bobManagerRestarted = NoiseSessionManager(localStaticKey: bobKey, keychain: mockKeychain)
         
         // Bob initiates new handshake after restart
         let newHandshake1 = try bobManagerRestarted.initiateHandshake(with: bobPeerID)
         
         // Alice should accept the new handshake (clearing old session)
-        let newHandshake2 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: newHandshake1)
+        let newHandshake2 = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: newHandshake1)
         #expect(newHandshake2 != nil)
         
         // Complete the new handshake
-        let newHandshake3 = try bobManagerRestarted.handleIncomingHandshake(
-            from: bobPeerID, message: newHandshake2!)
+        let newHandshake3 = try bobManagerRestarted.handleIncomingHandshake(from: bobPeerID, message: newHandshake2!)
         #expect(newHandshake3 != nil)
         _ = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: newHandshake3!)
         
@@ -387,10 +328,8 @@ struct NoiseProtocolTests {
     
     @Test func nonceDesynchronizationRecovery() throws {
         // Create two sessions
-        let aliceSession = NoiseSession(
-            peerID: alicePeerID, role: .initiator, keychain: mockKeychain, localStaticKey: aliceKey)
-        let bobSession = NoiseSession(
-            peerID: bobPeerID, role: .responder, keychain: mockKeychain, localStaticKey: bobKey)
+        let aliceSession = NoiseSession(peerID: alicePeerID, role: .initiator, keychain: mockKeychain, localStaticKey: aliceKey)
+        let bobSession = NoiseSession(peerID: bobPeerID, role: .responder, keychain: mockKeychain, localStaticKey: bobKey)
         
         // Establish sessions
         try performHandshake(initiator: aliceSession, responder: bobSession)
@@ -422,8 +361,7 @@ struct NoiseProtocolTests {
         
         let messageCount = 100
         
-        try await confirmation("All messages encrypted and decrypted", expectedCount: messageCount)
-        { completion in
+        try await confirmation("All messages encrypted and decrypted", expectedCount: messageCount) { completion in
             var encryptedMessages: [Int: Data] = [:]
             // Encrypt messages sequentially to avoid nonce races in manager
             for i in 0..<messageCount {
@@ -474,7 +412,7 @@ struct NoiseProtocolTests {
         
         // Create a corrupted message
         var encrypted = try aliceManager.encrypt("Test".data(using: .utf8)!, for: alicePeerID)
-        encrypted[10] ^= 0xFF  // Corrupt the data
+        encrypted[10] ^= 0xFF // Corrupt the data
         
         // Decryption should fail
         if #available(macOS 14.4, iOS 17.4, *) {
@@ -516,13 +454,11 @@ struct NoiseProtocolTests {
         let newHandshake1 = try aliceManager.initiateHandshake(with: alicePeerID)
         
         // Bob should accept the new handshake even though he has a valid session
-        let newHandshake2 = try bobManager.handleIncomingHandshake(
-            from: bobPeerID, message: newHandshake1)
+        let newHandshake2 = try bobManager.handleIncomingHandshake(from: bobPeerID, message: newHandshake1)
         #expect(newHandshake2 != nil, "Bob should accept handshake despite having valid session")
         
         // Complete the handshake
-        let newHandshake3 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: newHandshake2!)
+        let newHandshake3 = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: newHandshake2!)
         #expect(newHandshake3 != nil)
         _ = try bobManager.handleIncomingHandshake(from: bobPeerID, message: newHandshake3!)
         
@@ -553,8 +489,7 @@ struct NoiseProtocolTests {
         }
         
         // With nonce carried in packet, decryption should not throw here
-        let desyncMessage = try aliceManager.encrypt(
-            "This now succeeds".data(using: .utf8)!, for: alicePeerID)
+        let desyncMessage = try aliceManager.encrypt("This now succeeds".data(using: .utf8)!, for: alicePeerID)
         #expect(throws: Never.self) {
             try bobManager.decrypt(desyncMessage, from: bobPeerID)
         }
@@ -564,13 +499,11 @@ struct NoiseProtocolTests {
         let rehandshake1 = try bobManager.initiateHandshake(with: bobPeerID)
         
         // Alice should accept despite having a "valid" (but desynced) session
-        let rehandshake2 = try aliceManager.handleIncomingHandshake(
-            from: alicePeerID, message: rehandshake1)
+        let rehandshake2 = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: rehandshake1)
         #expect(rehandshake2 != nil, "Alice should accept handshake to fix desync")
         
         // Complete handshake
-        let rehandshake3 = try bobManager.handleIncomingHandshake(
-            from: bobPeerID, message: rehandshake2!)
+        let rehandshake3 = try bobManager.handleIncomingHandshake(from: bobPeerID, message: rehandshake2!)
         #expect(rehandshake3 != nil)
         _ = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: rehandshake3!)
         
@@ -581,18 +514,6 @@ struct NoiseProtocolTests {
         #expect(decryptedResync == testResynced)
     }
     
-    // MARK: - Test Vector Tests
-    
-    @Test func noiseTestVectors() throws {
-        // Load test vectors from bundle
-        let testVectors = try loadTestVectors()
-        
-        for (index, testVector) in testVectors.enumerated() {
-            print("Running test vector \(index + 1): \(testVector.protocol_name)")
-            try runTestVector(testVector)
-        }
-    }
-    
     // MARK: - Helper Methods
     
     private func performHandshake(initiator: NoiseSession, responder: NoiseSession) throws {
@@ -602,346 +523,10 @@ struct NoiseProtocolTests {
         _ = try responder.processHandshakeMessage(msg3)
     }
     
-    private func establishManagerSessions(
-        aliceManager: NoiseSessionManager, bobManager: NoiseSessionManager
-    ) throws {
+    private func establishManagerSessions(aliceManager: NoiseSessionManager, bobManager: NoiseSessionManager) throws {
         let msg1 = try aliceManager.initiateHandshake(with: alicePeerID)
         let msg2 = try bobManager.handleIncomingHandshake(from: bobPeerID, message: msg1)!
         let msg3 = try aliceManager.handleIncomingHandshake(from: alicePeerID, message: msg2)!
         _ = try bobManager.handleIncomingHandshake(from: bobPeerID, message: msg3)
     }
-    
-    private func loadTestVectors() throws -> [NoiseTestVector] {
-        // Try to load from test bundle
-        let testBundle = Bundle(for: MockKeychain.self)
-        guard let url = testBundle.url(forResource: "NoiseTestVectors", withExtension: "json")
-        else {
-            throw NSError(
-                domain: "NoiseTests", code: 1,
-                userInfo: [
-                    NSLocalizedDescriptionKey: "Could not find NoiseTestVectors.json in test bundle"
-                ])
-        }
-        
-        let data = try Data(contentsOf: url)
-        return try JSONDecoder().decode([NoiseTestVector].self, from: data)
-    }
-    
-    private func runTestVector(_ testVector: NoiseTestVector) throws {
-        // Parse test inputs
-        guard let initStatic = Data(hex: testVector.init_static),
-              let initEphemeral = Data(hex: testVector.init_ephemeral),
-              let respStatic = Data(hex: testVector.resp_static),
-              let respEphemeral = Data(hex: testVector.resp_ephemeral),
-              let prologue = Data(hex: testVector.init_prologue)
-        else {
-            throw NSError(
-                domain: "NoiseTests", code: 2,
-                userInfo: [NSLocalizedDescriptionKey: "Failed to parse test vector hex strings"])
-        }
-        
-        let expectedHash = testVector.handshake_hash.flatMap { Data(hex: $0) }
-        
-        // Create keys
-        guard
-            let initStaticKey = try? Curve25519.KeyAgreement.PrivateKey(
-                rawRepresentation: initStatic),
-            let initEphemeralKey = try? Curve25519.KeyAgreement.PrivateKey(
-                rawRepresentation: initEphemeral),
-            let respStaticKey = try? Curve25519.KeyAgreement.PrivateKey(
-                rawRepresentation: respStatic),
-            let respEphemeralKey = try? Curve25519.KeyAgreement.PrivateKey(
-                rawRepresentation: respEphemeral)
-        else {
-            throw NSError(
-                domain: "NoiseTests", code: 3,
-                userInfo: [NSLocalizedDescriptionKey: "Failed to create keys from test vectors"])
-        }
-        
-        let keychain = MockKeychain()
-        
-        // Create handshake states
-        let initiatorHandshake = NoiseHandshakeState(
-            role: .initiator,
-            pattern: .XX,
-            keychain: keychain,
-            localStaticKey: initStaticKey,
-            prologue: prologue,
-            predeterminedEphemeralKey: initEphemeralKey
-        )
-        
-        let responderHandshake = NoiseHandshakeState(
-            role: .responder,
-            pattern: .XX,
-            keychain: keychain,
-            localStaticKey: respStaticKey,
-            prologue: prologue,
-            predeterminedEphemeralKey: respEphemeralKey
-        )
-        
-        // For XX pattern, we have 3 handshake messages, then transport messages
-        // The test vector messages are ordered as: [msg1, msg2, msg3, transport1, transport2, ...]
-        
-        guard testVector.messages.count >= 3 else {
-            throw NSError(
-                domain: "NoiseTests", code: 5,
-                userInfo: [NSLocalizedDescriptionKey: "Test vector must have at least 3 messages for XX pattern"])
-        }
-        
-        // Message 1: Initiator -> Responder (e)
-        guard let payload1 = Data(hex: testVector.messages[0].payload),
-              let expectedCiphertext1 = Data(hex: testVector.messages[0].ciphertext) else {
-            throw NSError(
-                domain: "NoiseTests", code: 4,
-                userInfo: [NSLocalizedDescriptionKey: "Message 1: Failed to parse hex"])
-        }
-        
-        let msg1 = try initiatorHandshake.writeMessage(payload: payload1)
-        #expect(!msg1.isEmpty, "Message 1 should not be empty")
-        #expect(msg1 == expectedCiphertext1, "Message 1 ciphertext should match expected value. Got: \(msg1.hexString()), Expected: \(expectedCiphertext1.hexString())")
-        
-        let decrypted1 = try responderHandshake.readMessage(msg1)
-        #expect(decrypted1 == payload1, "Message 1: Decrypted payload should match original")
-        
-        // Message 2: Responder -> Initiator (e, ee, s, es)
-        guard let payload2 = Data(hex: testVector.messages[1].payload),
-              let expectedCiphertext2 = Data(hex: testVector.messages[1].ciphertext) else {
-            throw NSError(
-                domain: "NoiseTests", code: 4,
-                userInfo: [NSLocalizedDescriptionKey: "Message 2: Failed to parse hex"])
-        }
-        
-        let msg2 = try responderHandshake.writeMessage(payload: payload2)
-        #expect(!msg2.isEmpty, "Message 2 should not be empty")
-        #expect(msg2 == expectedCiphertext2, "Message 2 ciphertext should match expected value. Got: \(msg2.hexString()), Expected: \(expectedCiphertext2.hexString())")
-        
-        let decrypted2 = try initiatorHandshake.readMessage(msg2)
-        #expect(decrypted2 == payload2, "Message 2: Decrypted payload should match original")
-        
-        // Message 3: Initiator -> Responder (s, se)
-        guard let payload3 = Data(hex: testVector.messages[2].payload),
-              let expectedCiphertext3 = Data(hex: testVector.messages[2].ciphertext) else {
-            throw NSError(
-                domain: "NoiseTests", code: 4,
-                userInfo: [NSLocalizedDescriptionKey: "Message 3: Failed to parse hex"])
-        }
-        
-        let msg3 = try initiatorHandshake.writeMessage(payload: payload3)
-        #expect(!msg3.isEmpty, "Message 3 should not be empty")
-        #expect(msg3 == expectedCiphertext3, "Message 3 ciphertext should match expected value. Got: \(msg3.hexString()), Expected: \(expectedCiphertext3.hexString())")
-        
-        let decrypted3 = try responderHandshake.readMessage(msg3)
-        #expect(decrypted3 == payload3, "Message 3: Decrypted payload should match original")
-        
-        // Verify handshake hash
-        let initiatorHash = initiatorHandshake.getHandshakeHash()
-        let responderHash = responderHandshake.getHandshakeHash()
-        
-        #expect(initiatorHash == responderHash, "Initiator and responder hashes should match")
-        
-        if let expectedHash = expectedHash {
-            #expect(
-                initiatorHash == expectedHash,
-                "Handshake hash should match expected value from test vector. Got: \(initiatorHash.hexString()), Expected: \(expectedHash.hexString())")
-        }
-        
-        // Get transport ciphers
-        let (initSend, initRecv) = try initiatorHandshake.getTransportCiphers(useExtractedNonce: false)
-        let (respSend, respRecv) = try responderHandshake.getTransportCiphers(useExtractedNonce: false)
-
-        // Test transport messages (messages after the 3 handshake messages)
-        for index in 3..<testVector.messages.count {
-            let testMsg = testVector.messages[index]
-            guard let payload = Data(hex: testMsg.payload),
-                  let expectedCiphertext = Data(hex: testMsg.ciphertext) else {
-                throw NSError(
-                    domain: "NoiseTests", code: 4,
-                    userInfo: [
-                        NSLocalizedDescriptionKey:
-                            "Message \(index + 1): Failed to parse payload hex"
-                    ])
-            }
-            
-            // Alternate between responder and initiator sending
-            // Responder sends first transport message (since initiator sent last handshake message)
-            let (sender, receiver): (NoiseCipherState, NoiseCipherState)
-            let transportIndex = index - 3
-            if transportIndex % 2 == 0 {
-                // Even transport messages: responder sends
-                sender = respSend
-                receiver = initRecv
-            } else {
-                // Odd transport messages: initiator sends
-                sender = initSend
-                receiver = respRecv
-            }
-            
-            // Encrypt and validate ciphertext matches expected value
-            let ciphertext = try sender.encrypt(plaintext: payload)
-            #expect(
-                ciphertext == expectedCiphertext,
-                "Message \(index + 1) ciphertext should match expected value. Got: \(ciphertext.hexString()), Expected: \(expectedCiphertext.hexString())")
-
-            // Decrypt and validate payload
-            let decrypted = try receiver.decrypt(ciphertext: ciphertext)
-            #expect(
-                decrypted == payload,
-                "Message \(index + 1): Decrypted payload should match original")
-        }
-    }
-
-    // MARK: - DH Shared Secret Clearing Tests
-
-    @Test func secureClearCalledDuringHandshake() throws {
-        // Use TrackingMockKeychain to verify secureClear is called
-        let trackingKeychain = TrackingMockKeychain()
-
-        let aliceKey = Curve25519.KeyAgreement.PrivateKey()
-        let bobKey = Curve25519.KeyAgreement.PrivateKey()
-
-        let alice = NoiseSession(
-            peerID: PeerID(str: "alice-test"),
-            role: .initiator,
-            keychain: trackingKeychain,
-            localStaticKey: aliceKey
-        )
-
-        let bob = NoiseSession(
-            peerID: PeerID(str: "bob-test"),
-            role: .responder,
-            keychain: trackingKeychain,
-            localStaticKey: bobKey
-        )
-
-        // Perform handshake
-        let msg1 = try alice.startHandshake()
-        let msg2 = try bob.processHandshakeMessage(msg1)!
-        let msg3 = try alice.processHandshakeMessage(msg2)!
-        _ = try bob.processHandshakeMessage(msg3)
-
-        // In Noise XX pattern handshake:
-        // - Message 1 (initiator): e token only (no DH)
-        // - Message 2 (responder): e, ee, s, es tokens (2 DH operations: ee, es)
-        // - Message 3 (initiator): s, se tokens (1 DH operation: se)
-        // Total in writeMessage: 3 DH operations (ee, es, se)
-        //
-        // In readMessage (performDHOperation):
-        // - After msg1: no DH
-        // - After msg2: ee, es (2 DH operations)
-        // - After msg3: se (1 DH operation)
-        // Total in performDHOperation: 3 DH operations
-        //
-        // Grand total: 6 DH operations requiring secureClear
-        //
-        // Note: .ss pattern is only used in certain handshake patterns, not XX
-        let expectedMinimumCalls = 6
-        #expect(
-            trackingKeychain.secureClearDataCallCount >= expectedMinimumCalls,
-            "Expected at least \(expectedMinimumCalls) secureClear calls for DH secrets, got \(trackingKeychain.secureClearDataCallCount)"
-        )
-    }
-
-    @Test func encryptionWorksAfterSecureClear() throws {
-        // Verify that encryption/decryption still works correctly after adding secureClear
-        let trackingKeychain = TrackingMockKeychain()
-
-        let aliceKey = Curve25519.KeyAgreement.PrivateKey()
-        let bobKey = Curve25519.KeyAgreement.PrivateKey()
-
-        let alice = NoiseSession(
-            peerID: PeerID(str: "alice-test-enc"),
-            role: .initiator,
-            keychain: trackingKeychain,
-            localStaticKey: aliceKey
-        )
-
-        let bob = NoiseSession(
-            peerID: PeerID(str: "bob-test-enc"),
-            role: .responder,
-            keychain: trackingKeychain,
-            localStaticKey: bobKey
-        )
-
-        // Perform handshake
-        let msg1 = try alice.startHandshake()
-        let msg2 = try bob.processHandshakeMessage(msg1)!
-        let msg3 = try alice.processHandshakeMessage(msg2)!
-        _ = try bob.processHandshakeMessage(msg3)
-
-        // Verify both sessions are established
-        #expect(alice.isEstablished())
-        #expect(bob.isEstablished())
-
-        // Verify secureClear was called (basic sanity check)
-        #expect(trackingKeychain.secureClearDataCallCount > 0)
-
-        // Test encryption from Alice to Bob
-        let plaintext1 = "Hello from Alice after secureClear!".data(using: .utf8)!
-        let ciphertext1 = try alice.encrypt(plaintext1)
-        let decrypted1 = try bob.decrypt(ciphertext1)
-        #expect(decrypted1 == plaintext1)
-
-        // Test encryption from Bob to Alice
-        let plaintext2 = "Hello from Bob after secureClear!".data(using: .utf8)!
-        let ciphertext2 = try bob.encrypt(plaintext2)
-        let decrypted2 = try alice.decrypt(ciphertext2)
-        #expect(decrypted2 == plaintext2)
-
-        // Test multiple messages to verify cipher state is correct
-        for i in 1...10 {
-            let msg = "Message \(i) from Alice".data(using: .utf8)!
-            let cipher = try alice.encrypt(msg)
-            let dec = try bob.decrypt(cipher)
-            #expect(dec == msg)
-        }
-    }
-
-    @Test func secureClearCalledInBothWriteAndReadPaths() throws {
-        // Verify secureClear is called in both writeMessage and readMessage paths
-        // We do this by checking the count increases at each step
-
-        let aliceKeychain = TrackingMockKeychain()
-        let bobKeychain = TrackingMockKeychain()
-
-        let aliceKey = Curve25519.KeyAgreement.PrivateKey()
-        let bobKey = Curve25519.KeyAgreement.PrivateKey()
-
-        let alice = NoiseSession(
-            peerID: PeerID(str: "alice-paths"),
-            role: .initiator,
-            keychain: aliceKeychain,
-            localStaticKey: aliceKey
-        )
-
-        let bob = NoiseSession(
-            peerID: PeerID(str: "bob-paths"),
-            role: .responder,
-            keychain: bobKeychain,
-            localStaticKey: bobKey
-        )
-
-        // Message 1: Alice writes (e token only, no DH)
-        let msg1 = try alice.startHandshake()
-        let aliceCountAfterMsg1 = aliceKeychain.secureClearDataCallCount
-        // No DH in message 1 for initiator
-        #expect(aliceCountAfterMsg1 == 0, "No DH secrets in message 1 write")
-
-        // Bob reads message 1 (no DH) and writes message 2 (ee, es DH operations)
-        let msg2 = try bob.processHandshakeMessage(msg1)!
-        let bobCountAfterMsg2 = bobKeychain.secureClearDataCallCount
-        // Bob should have cleared secrets for: ee (read), es (read), ee (write), es (write)
-        #expect(bobCountAfterMsg2 >= 2, "Bob should clear DH secrets when processing/writing message 2")
-
-        // Alice reads message 2 (ee, es) and writes message 3 (se)
-        let msg3 = try alice.processHandshakeMessage(msg2)!
-        let aliceCountAfterMsg3 = aliceKeychain.secureClearDataCallCount
-        // Alice should have cleared: ee (read), es (read), se (write)
-        #expect(aliceCountAfterMsg3 >= 3, "Alice should clear DH secrets when processing/writing message 3")
-
-        // Bob reads message 3 (se)
-        _ = try bob.processHandshakeMessage(msg3)
-        let bobFinalCount = bobKeychain.secureClearDataCallCount
-        // Bob should have additionally cleared: se (read)
-        #expect(bobFinalCount > bobCountAfterMsg2, "Bob should clear DH secrets when processing message 3")
-    }
 }

bitchatTests/Noise/NoiseTestVectors.json

@@ -1,71 +0,0 @@
-[
-    {
-        "protocol_name": "Noise_XX_25519_ChaChaPoly_SHA256",
-        "init_prologue": "4a6f686e2047616c74",
-        "init_static": "e61ef9919cde45dd5f82166404bd08e38bceb5dfdfded0a34c8df7ed542214d1",
-        "init_ephemeral": "893e28b9dc6ca8d611ab664754b8ceb7bac5117349a4439a6b0569da977c464a",
-        "resp_prologue": "4a6f686e2047616c74",
-        "resp_static": "4a3acbfdb163dec651dfa3194dece676d437029c62a408b4c5ea9114246e4893",
-        "resp_ephemeral": "bbdb4cdbd309f1a1f2e1456967fe288cadd6f712d65dc7b7793d5e63da6b375b",
-        "handshake_hash": "c8e5f64e846193be2a834104c2a009868d6c9f3bd3c186299888b488b2f1f58e",
-        "messages": [
-            {
-                "payload": "4c756477696720766f6e204d69736573",
-                "ciphertext": "ca35def5ae56cec33dc2036731ab14896bc4c75dbb07a61f879f8e3afa4c79444c756477696720766f6e204d69736573"
-            },
-            {
-                "payload": "4d757272617920526f746862617264",
-                "ciphertext": "95ebc60d2b1fa672c1f46a8aa265ef51bfe38e7ccb39ec5be34069f14480884381cbad1f276e038c48378ffce2b65285e08d6b68aaa3629a5a8639392490e5b9bd5269c2f1e4f488ed8831161f19b7815528f8982ffe09be9b5c412f8a0db50f8814c7194e83f23dbd8d162c9326ad"
-            },
-            {
-                "payload": "462e20412e20486179656b",
-                "ciphertext": "c7195ffacac1307ff99046f219750fc47693e23c3cb08b89c2af808b444850a80ae475b9df0f169ae80a89be0865b57f58c9fea0d4ec82a286427402f113e4b6ae769a1d95941d49b25030"
-            },
-            {
-                "payload": "4361726c204d656e676572",
-                "ciphertext": "96763ed773f8e47bb3712f0e29b3060ffc956ffc146cee53d5e1df"
-            },
-            {
-                "payload": "4a65616e2d426170746973746520536179",
-                "ciphertext": "3e40f15f6f3a46ae446b253bf8b1d9ffb6ed9b174d272328ff91a7e2e5c79c07f5"
-            },
-            {
-                "payload": "457567656e2042f6686d20766f6e2042617765726b",
-                "ciphertext": "eb3f3515110702e047a6c9da4478b6ead94873c11c0f2d710ddb3f09fce024b3a58502ae3f"
-            }
-        ]
-    },
-    {
-        "protocol_name": "Noise_XX_25519_ChaChaPoly_SHA256",
-        "init_prologue": "5468657265206973206e6f20726967687420616e642077726f6e672e2054686572652773206f6e6c792066756e20616e6420626f72696e672e",
-        "init_psks": [],
-        "init_static": "7dec208517a3b81a2861d7a71266d5d6dc944c5a8816634a86fe63198a0148ee",
-        "init_ephemeral": "a32daf21e93c0131495ce1d903181fde81cc46937daaeb990bae7c992709421e",
-        "resp_prologue": "5468657265206973206e6f20726967687420616e642077726f6e672e2054686572652773206f6e6c792066756e20616e6420626f72696e672e",
-        "resp_psks": [],
-        "resp_static": "4d0aed5098e3b4ef20357e9f686ce66204c792b358da2e475017d6c485304881",
-        "resp_ephemeral": "4eece0f195d026db035ff987597c429d3ad3bcc2944df37d649528951b2a27c5",
-        "messages": [
-            {
-                "payload": "d03c489139e645d0711a3c9e810d776b46a84912463fafa87b884eebf242dc34",
-                "ciphertext": "f9fa868ba97ab8a2686deccfaad5a484ee10a5bb85e3d1dce015a84797f92818d03c489139e645d0711a3c9e810d776b46a84912463fafa87b884eebf242dc34"
-            },
-            {
-                "payload": "d8190a92f7dc0c93dbea9118ba8055751fb7c6590c416ffbd419964132b99a85",
-                "ciphertext": "8c4e6fdb7d09d501a86f7eca5c234522751706ed409182c05cdf5f827d4dae47b81c6c5f43b025692c24391eefee725c17d8cb0fbe3e4abb8aedf42c4fd2592d4ea48ac08989d6ae8b4adae08b2c34087c808c7aa55a63c02b0fab9e930612336bd43eaea04d3c670a0a146691aa9cc9d357872320dc735dbc48580cffb553db"
-            },
-            {
-                "payload": "77891b19dcb92ef7c055b672c4a5aa7fdf1c84146b8b303459022729473ce254",
-                "ciphertext": "933ca6b5ed60df3df66121f0ab49a09e49efa45c613a86a3cecbf4c535cef2f83f72b42837b18e3572f2fdc2b74c331e2368a545cef54bdca081678ab0e9dd5348122459e0c034c851984d88ce610963d43cde6cfe73a67fbd5a63e8bfca96d0"
-            },
-            {
-                "payload": "d7efdf988072881941db045a42882433817555128fbf5663e56081712ec7d212",
-                "ciphertext": "54ef0ff0629e1aaa7685a2806ab111cba76b52331f2642276736f415868eacb69ab2577f3bda0cbf72f879685f6ed25f"
-            },
-            {
-                "payload": "dd7bf01a588bafb52c6cfba952e5d8fe35cc2b3f92b4730ae2474615157345ce",
-                "ciphertext": "356be70f110306d5c699bb834bb9d58d909e325924dfbec972e406e6f294dc63e1daebefe8a62a334facc8048ab4ad66"
-            }
-        ]
-    }
-]

bitchatTests/Services/NostrTransportTests.swift

@@ -1,108 +0,0 @@
-//
-// NostrTransportTests.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-import Testing
-@testable import bitchat
-
-@Suite("NostrTransport Thread Safety Tests")
-struct NostrTransportTests {
-
-    @Test("Concurrent read receipt enqueue does not crash")
-    @MainActor
-    func concurrentReadReceiptEnqueue() async throws {
-        let keychain = MockKeychain()
-        let idBridge = NostrIdentityBridge(keychain: keychain)
-        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
-
-        // Create 100 concurrent read receipt submissions
-        let iterations = 100
-
-        await withTaskGroup(of: Void.self) { group in
-            for i in 0..<iterations {
-                group.addTask {
-                    let receipt = ReadReceipt(
-                        originalMessageID: UUID().uuidString,
-                        readerID: PeerID(str: String(format: "%016x", i)),
-                        readerNickname: "Reader\(i)"
-                    )
-                    let peerID = PeerID(str: String(format: "%016x", i))
-                    transport.sendReadReceipt(receipt, to: peerID)
-                }
-            }
-        }
-
-        // If we reach here without crashing, the test passes
-        // The concurrent enqueue operations completed without data races
-    }
-
-    @Test("Read queue processes under concurrent load")
-    @MainActor
-    func readQueueProcessingUnderLoad() async throws {
-        let keychain = MockKeychain()
-        let idBridge = NostrIdentityBridge(keychain: keychain)
-        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
-
-        // Rapidly enqueue many receipts from multiple concurrent sources
-        let iterations = 50
-
-        // First batch - rapid fire
-        for i in 0..<iterations {
-            let receipt = ReadReceipt(
-                originalMessageID: UUID().uuidString,
-                readerID: PeerID(str: String(format: "%016x", i)),
-                readerNickname: "Reader\(i)"
-            )
-            transport.sendReadReceipt(receipt, to: PeerID(str: String(format: "%016x", i)))
-        }
-
-        // Give some time for processing to start
-        try await Task.sleep(nanoseconds: 100_000_000) // 100ms
-
-        // Second batch - while first might be processing
-        await withTaskGroup(of: Void.self) { group in
-            for i in iterations..<(iterations * 2) {
-                group.addTask {
-                    let receipt = ReadReceipt(
-                        originalMessageID: UUID().uuidString,
-                        readerID: PeerID(str: String(format: "%016x", i)),
-                        readerNickname: "Reader\(i)"
-                    )
-                    transport.sendReadReceipt(receipt, to: PeerID(str: String(format: "%016x", i)))
-                }
-            }
-        }
-
-        // If we reach here without crashing or deadlocking, test passes
-    }
-
-    @Test("isPeerReachable is thread safe")
-    @MainActor
-    func isPeerReachableThreadSafety() async throws {
-        let keychain = MockKeychain()
-        let idBridge = NostrIdentityBridge(keychain: keychain)
-        let transport = NostrTransport(keychain: keychain, idBridge: idBridge)
-
-        let iterations = 100
-
-        // Concurrent reads on isPeerReachable
-        await withTaskGroup(of: Bool.self) { group in
-            for i in 0..<iterations {
-                group.addTask {
-                    let peerID = PeerID(str: String(format: "%016x", i))
-                    return transport.isPeerReachable(peerID)
-                }
-            }
-
-            // Collect results (all should be false since no favorites configured)
-            for await result in group {
-                #expect(result == false)
-            }
-        }
-    }
-}

bitchatTests/Utils/HexStringTests.swift

@@ -1,108 +0,0 @@
-//
-// HexStringTests.swift
-// bitchatTests
-//
-// Tests for Data(hexString:) hex parsing
-//
-
-import Testing
-import Foundation
-@testable import bitchat
-
-struct HexStringTests {
-
-    // MARK: - Valid Hex Strings
-
-    @Test func validHexString() {
-        let data = Data(hexString: "0102030405")
-        #expect(data == Data([0x01, 0x02, 0x03, 0x04, 0x05]))
-    }
-
-    @Test func validHexStringUppercase() {
-        let data = Data(hexString: "AABBCCDD")
-        #expect(data == Data([0xAA, 0xBB, 0xCC, 0xDD]))
-    }
-
-    @Test func validHexStringMixedCase() {
-        let data = Data(hexString: "aAbBcCdD")
-        #expect(data == Data([0xAA, 0xBB, 0xCC, 0xDD]))
-    }
-
-    @Test func validHexStringWith0xPrefix() {
-        let data = Data(hexString: "0x0102030405")
-        #expect(data == Data([0x01, 0x02, 0x03, 0x04, 0x05]))
-    }
-
-    @Test func validHexStringWith0XPrefix() {
-        let data = Data(hexString: "0XAABBCCDD")
-        #expect(data == Data([0xAA, 0xBB, 0xCC, 0xDD]))
-    }
-
-    @Test func validHexStringWithWhitespace() {
-        let data = Data(hexString: "  0102030405  ")
-        #expect(data == Data([0x01, 0x02, 0x03, 0x04, 0x05]))
-    }
-
-    @Test func validHexStringWith0xPrefixAndWhitespace() {
-        let data = Data(hexString: "  0x0102030405  ")
-        #expect(data == Data([0x01, 0x02, 0x03, 0x04, 0x05]))
-    }
-
-    @Test func emptyHexString() {
-        let data = Data(hexString: "")
-        #expect(data == Data())
-    }
-
-    @Test func emptyHexStringWithWhitespace() {
-        let data = Data(hexString: "   ")
-        #expect(data == Data())
-    }
-
-    @Test func emptyHexStringWith0xPrefix() {
-        let data = Data(hexString: "0x")
-        #expect(data == Data())
-    }
-
-    // MARK: - Invalid Hex Strings
-
-    @Test func oddLengthHexStringReturnsNil() {
-        let data = Data(hexString: "012")
-        #expect(data == nil)
-    }
-
-    @Test func oddLengthHexStringWith0xPrefixReturnsNil() {
-        let data = Data(hexString: "0x012")
-        #expect(data == nil)
-    }
-
-    @Test func invalidCharactersReturnNil() {
-        let data = Data(hexString: "GHIJ")
-        #expect(data == nil)
-    }
-
-    @Test func mixedValidAndInvalidCharactersReturnNil() {
-        let data = Data(hexString: "01GH")
-        #expect(data == nil)
-    }
-
-    @Test func specialCharactersReturnNil() {
-        let data = Data(hexString: "01-02")
-        #expect(data == nil)
-    }
-
-    // MARK: - Round Trip Tests
-
-    @Test func roundTripConversion() {
-        let original = Data([0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF])
-        let hexString = original.hexEncodedString()
-        let roundTripped = Data(hexString: hexString)
-        #expect(roundTripped == original)
-    }
-
-    @Test func roundTripConversionWith0xPrefix() {
-        let original = Data([0xDE, 0xAD, 0xBE, 0xEF])
-        let hexString = "0x" + original.hexEncodedString()
-        let roundTripped = Data(hexString: hexString)
-        #expect(roundTripped == original)
-    }
-}

bitchatTests/XChaCha20Poly1305CompatTests.swift

@@ -1,222 +0,0 @@
-//
-// XChaCha20Poly1305CompatTests.swift
-// bitchatTests
-//
-// Tests for XChaCha20-Poly1305 encryption with proper error handling.
-// This is free and unencumbered software released into the public domain.
-//
-
-import Testing
-import struct Foundation.Data
-@testable import bitchat
-
-struct XChaCha20Poly1305CompatTests {
-
-    @Test func sealAndOpenRoundtrip() throws {
-        let plaintext = "Hello, XChaCha20-Poly1305!".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        let sealed = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: nonce)
-        let decrypted = try XChaCha20Poly1305Compat.open(
-            ciphertext: sealed.ciphertext,
-            tag: sealed.tag,
-            key: key,
-            nonce24: nonce
-        )
-
-        #expect(decrypted == plaintext)
-    }
-
-    @Test func sealAndOpenWithAAD() throws {
-        let plaintext = "Secret message".data(using: .utf8)!
-        let key = Data(repeating: 0xAB, count: 32)
-        let nonce = Data(repeating: 0xCD, count: 24)
-        let aad = "additional authenticated data".data(using: .utf8)!
-
-        let sealed = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: nonce, aad: aad)
-        let decrypted = try XChaCha20Poly1305Compat.open(
-            ciphertext: sealed.ciphertext,
-            tag: sealed.tag,
-            key: key,
-            nonce24: nonce,
-            aad: aad
-        )
-
-        #expect(decrypted == plaintext)
-    }
-
-    @Test func sealProducesDifferentCiphertextWithDifferentNonces() throws {
-        let plaintext = "Same plaintext".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let nonce1 = Data(repeating: 0x01, count: 24)
-        let nonce2 = Data(repeating: 0x02, count: 24)
-
-        let sealed1 = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: nonce1)
-        let sealed2 = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: nonce2)
-
-        #expect(sealed1.ciphertext != sealed2.ciphertext)
-    }
-
-    @Test func sealThrowsOnShortKey() {
-        let plaintext = "Test".data(using: .utf8)!
-        let shortKey = Data(repeating: 0x42, count: 16)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: shortKey, nonce24: nonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func sealThrowsOnLongKey() {
-        let plaintext = "Test".data(using: .utf8)!
-        let longKey = Data(repeating: 0x42, count: 64)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: longKey, nonce24: nonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func sealThrowsOnEmptyKey() {
-        let plaintext = "Test".data(using: .utf8)!
-        let emptyKey = Data()
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: emptyKey, nonce24: nonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func openThrowsOnInvalidKeyLength() {
-        let ciphertext = Data(repeating: 0x00, count: 16)
-        let tag = Data(repeating: 0x00, count: 16)
-        let shortKey = Data(repeating: 0x42, count: 31)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.open(ciphertext: ciphertext, tag: tag, key: shortKey, nonce24: nonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func sealThrowsOnShortNonce() {
-        let plaintext = "Test".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let shortNonce = Data(repeating: 0x24, count: 12)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: shortNonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func sealThrowsOnLongNonce() {
-        let plaintext = "Test".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let longNonce = Data(repeating: 0x24, count: 32)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: longNonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func sealThrowsOnEmptyNonce() {
-        let plaintext = "Test".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let emptyNonce = Data()
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: emptyNonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func openThrowsOnInvalidNonceLength() {
-        let ciphertext = Data(repeating: 0x00, count: 16)
-        let tag = Data(repeating: 0x00, count: 16)
-        let key = Data(repeating: 0x42, count: 32)
-        let shortNonce = Data(repeating: 0x24, count: 23)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.open(ciphertext: ciphertext, tag: tag, key: key, nonce24: shortNonce)
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func openFailsWithWrongKey() throws {
-        let plaintext = "Secret".data(using: .utf8)!
-        let correctKey = Data(repeating: 0x42, count: 32)
-        let wrongKey = Data(repeating: 0x43, count: 32)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        let sealed = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: correctKey, nonce24: nonce)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.open(
-                ciphertext: sealed.ciphertext,
-                tag: sealed.tag,
-                key: wrongKey,
-                nonce24: nonce
-            )
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-
-    @Test func openFailsWithTamperedCiphertext() throws {
-        let plaintext = "Secret".data(using: .utf8)!
-        let key = Data(repeating: 0x42, count: 32)
-        let nonce = Data(repeating: 0x24, count: 24)
-
-        let sealed = try XChaCha20Poly1305Compat.seal(plaintext: plaintext, key: key, nonce24: nonce)
-
-        // Create tampered ciphertext by changing first byte
-        var tamperedBytes = [UInt8](sealed.ciphertext)
-        tamperedBytes[0] = tamperedBytes[0] ^ 0xFF
-        let tampered = Data(tamperedBytes)
-
-        var didThrow = false
-        do {
-            _ = try XChaCha20Poly1305Compat.open(
-                ciphertext: tampered,
-                tag: sealed.tag,
-                key: key,
-                nonce24: nonce
-            )
-        } catch {
-            didThrow = true
-        }
-        #expect(didThrow)
-    }
-}

localPackages/Tor/Frameworks/tor-nolzma.xcframework/Info.plist

@@ -8,7 +8,7 @@
 			<key>BinaryPath</key>
 			<string>tor-nolzma.framework/tor-nolzma</string>
 			<key>LibraryIdentifier</key>
-			<string>macos-arm64</string>
+			<string>ios-arm64</string>
 			<key>LibraryPath</key>
 			<string>tor-nolzma.framework</string>
 			<key>SupportedArchitectures</key>
@@ -16,7 +16,7 @@
 				<string>arm64</string>
 			</array>
 			<key>SupportedPlatform</key>
-			<string>macos</string>
+			<string>ios</string>
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
@@ -36,9 +36,9 @@
 		</dict>
 		<dict>
 			<key>BinaryPath</key>
-			<string>tor-nolzma.framework/tor-nolzma</string>
+			<string>tor-nolzma.framework/Versions/A/tor-nolzma</string>
 			<key>LibraryIdentifier</key>
-			<string>ios-arm64</string>
+			<string>macos-arm64</string>
 			<key>LibraryPath</key>
 			<string>tor-nolzma.framework</string>
 			<key>SupportedArchitectures</key>
@@ -46,7 +46,7 @@
 				<string>arm64</string>
 			</array>
 			<key>SupportedPlatform</key>
-			<string>ios</string>
+			<string>macos</string>
 		</dict>
 	</array>
 	<key>CFBundlePackageType</key>

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/app/config/or_options_st.h

@@ -203,6 +203,10 @@ struct or_options_t {
   /** Above this value, consider ourselves low on RAM. */
   uint64_t MaxMemInQueues_low_threshold;
 
+  uint64_t MaxHSDirCacheBytes;/**< If we have more memory than this allocated
+                                * for the hidden service directory cache,
+                                * run the HS cache OOM handler */
+
   /** @name port booleans
    *
    * Derived booleans: For server ports and ControlPort, true iff there is a

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/core/or/channelpadding.h

@@ -1,7 +1,7 @@
 /* Copyright (c) 2001 Matej Pfajfar.
  * Copyright (c) 2001-2004, Roger Dingledine.
  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2021, The Tor Project, Inc. */
+ * Copyright (c) 2007-2025, The Tor Project, Inc. */
 /* See LICENSE for licensing information */
 
 /**
@@ -39,4 +39,6 @@ int channelpadding_get_circuits_available_timeout(void);
 unsigned int channelpadding_get_channel_idle_timeout(const channel_t *, int);
 void channelpadding_new_consensus_params(const networkstatus_t *ns);
 
+void channelpadding_log_heartbeat(void);
+
 #endif /* !defined(TOR_CHANNELPADDING_H) */

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/core/or/edge_connection_st.h

@@ -88,6 +88,18 @@ struct edge_connection_t {
    * for this edge, used to compute advisory rates */
   uint64_t drain_start_usec;
 
+  /**
+   * Monotime timestamp of when we started the XOFF grace period for this edge.
+   *
+   * See the comments on `XOFF_GRACE_PERIOD_USEC` for an explanation on how
+   * this is used.
+   *
+   * A value of 0 is considered "unset". This isn't great, but we set this
+   * field as the output from `monotime_absolute_usec()` which should only ever
+   * be 0 within the first 1 microsecond of initializing the monotonic timer
+   * subsystem. */
+  uint64_t xoff_grace_period_start_usec;
+
   /**
    * Number of bytes written since we either emptied our buffers,
    * or sent an advisory drate rate. Can wrap, buf if so,

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/feature/hs/hs_cache.h

@@ -122,6 +122,7 @@ void hs_cache_client_intro_state_purge(void);
 
 bool hs_cache_client_new_auth_parse(const ed25519_public_key_t *service_pk);
 
+uint64_t hs_cache_get_max_bytes(void);
 size_t hs_cache_get_total_allocation(void);
 void hs_cache_decrement_allocation(size_t n);
 void hs_cache_increment_allocation(size_t n);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/lib/cc/orconfig.h

@@ -7,12 +7,12 @@
 /* All assert failures are fatal */
 /* #undef ALL_BUGS_ARE_FATAL */
 
-/* # for 0.4.8.17 Approximate date when this software was released. (Updated
+/* # for 0.4.8.19 Approximate date when this software was released. (Updated
    when the version changes.) */
-#define APPROX_RELEASE_DATE "2025-06-30"
+#define APPROX_RELEASE_DATE "2025-10-06"
 
 /* tor's build directory */
-#define BUILDDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define BUILDDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Compiler name */
 #define COMPILER /**/
@@ -24,10 +24,10 @@
 #define COMPILER_VERSION "17.0.0"
 
 /* tor's configuration directory */
-#define CONFDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
+#define CONFDIR "/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
 
 /* Flags passed to configure */
-#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CFLAGS=-Os -ffunction-sections -fdata-sections -miphonesimulator-version-min=12.0 CPPFLAGS= -Isrc/core -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 LDFLAGS=-lz  LZMA_CFLAGS=-I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/include LZMA_LIBS=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/lib/liblzma.a cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
+#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk -Os -ffunction-sections -fdata-sections CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk CPPFLAGS=-Isrc/core -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 -Os -ffunction-sections -fdata-sections LDFLAGS=-lz cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
 
 /* Enable smartlist debugging */
 /* #undef DEBUG_SMARTLIST */
@@ -720,7 +720,7 @@
 #define PACKAGE_NAME "tor"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "tor 0.4.8.17"
+#define PACKAGE_STRING "tor 0.4.8.19"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "tor"
@@ -729,7 +729,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "0.4.8.17"
+#define PACKAGE_VERSION "0.4.8.19"
 
 /* How to access the PC from a struct ucontext */
 /* #undef PC_FROM_UCONTEXT */
@@ -780,7 +780,7 @@
 #define SIZEOF___INT64 0
 
 /* tor's sourcedir directory */
-#define SRCDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define SRCDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Set to 1 if we can compile a simple stdatomic example. */
 #define STDATOMIC_WORKS 1
@@ -908,7 +908,7 @@
 #define USING_TWOS_COMPLEMENT 1
 
 /* Version number of package */
-#define VERSION "0.4.8.17"
+#define VERSION "0.4.8.19"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/lib/time/compat_time.h

@@ -1,6 +1,6 @@
 /* Copyright (c) 2003-2004, Roger Dingledine
  * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2021, The Tor Project, Inc. */
+ * Copyright (c) 2007-2025, The Tor Project, Inc. */
 /* See LICENSE for licensing information */
 
 /**
@@ -361,9 +361,9 @@ monotime_coarse_diff_msec32(const monotime_coarse_t *start,
 #endif /* SIZEOF_VOID_P == 8 */
 }
 
-#ifdef TOR_UNIT_TESTS
 void tor_sleep_msec(int msec);
 
+#ifdef TOR_UNIT_TESTS
 void monotime_enable_test_mocking(void);
 void monotime_disable_test_mocking(void);
 void monotime_set_mock_time_nsec(int64_t);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/asn1.h

@@ -144,7 +144,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_ALGOR, X509_ALGOR, X509_ALGOR)
 #define sk_X509_ALGOR_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr))
 #define sk_X509_ALGOR_pop(sk) ((X509_ALGOR *)OPENSSL_sk_pop(ossl_check_X509_ALGOR_sk_type(sk)))
 #define sk_X509_ALGOR_shift(sk) ((X509_ALGOR *)OPENSSL_sk_shift(ossl_check_X509_ALGOR_sk_type(sk)))
-#define sk_X509_ALGOR_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ALGOR_sk_type(sk),ossl_check_X509_ALGOR_freefunc_type(freefunc))
+#define sk_X509_ALGOR_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_freefunc_type(freefunc))
 #define sk_X509_ALGOR_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr), (idx))
 #define sk_X509_ALGOR_set(sk, idx, ptr) ((X509_ALGOR *)OPENSSL_sk_set(ossl_check_X509_ALGOR_sk_type(sk), (idx), ossl_check_X509_ALGOR_type(ptr)))
 #define sk_X509_ALGOR_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_ALGOR_sk_type(sk), ossl_check_X509_ALGOR_type(ptr))
@@ -246,7 +246,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_STRING_TABLE, ASN1_STRING_TABLE, ASN1_STRING_T
 #define sk_ASN1_STRING_TABLE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr))
 #define sk_ASN1_STRING_TABLE_pop(sk) ((ASN1_STRING_TABLE *)OPENSSL_sk_pop(ossl_check_ASN1_STRING_TABLE_sk_type(sk)))
 #define sk_ASN1_STRING_TABLE_shift(sk) ((ASN1_STRING_TABLE *)OPENSSL_sk_shift(ossl_check_ASN1_STRING_TABLE_sk_type(sk)))
-#define sk_ASN1_STRING_TABLE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_TABLE_sk_type(sk),ossl_check_ASN1_STRING_TABLE_freefunc_type(freefunc))
+#define sk_ASN1_STRING_TABLE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_freefunc_type(freefunc))
 #define sk_ASN1_STRING_TABLE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr), (idx))
 #define sk_ASN1_STRING_TABLE_set(sk, idx, ptr) ((ASN1_STRING_TABLE *)OPENSSL_sk_set(ossl_check_ASN1_STRING_TABLE_sk_type(sk), (idx), ossl_check_ASN1_STRING_TABLE_type(ptr)))
 #define sk_ASN1_STRING_TABLE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_type(ptr))
@@ -259,7 +259,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_STRING_TABLE, ASN1_STRING_TABLE, ASN1_STRING_T
 #define sk_ASN1_STRING_TABLE_set_cmp_func(sk, cmp) ((sk_ASN1_STRING_TABLE_compfunc)OPENSSL_sk_set_cmp_func(ossl_check_ASN1_STRING_TABLE_sk_type(sk), ossl_check_ASN1_STRING_TABLE_compfunc_type(cmp)))
 
 
-/* size limits: this stuff is taken straight from RFC2459 */
+/* size limits: this stuff is taken straight from RFC 5280 */
 
 # define ub_name                         32768
 # define ub_common_name                  64
@@ -567,7 +567,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_TYPE, ASN1_TYPE, ASN1_TYPE)
 #define sk_ASN1_TYPE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr))
 #define sk_ASN1_TYPE_pop(sk) ((ASN1_TYPE *)OPENSSL_sk_pop(ossl_check_ASN1_TYPE_sk_type(sk)))
 #define sk_ASN1_TYPE_shift(sk) ((ASN1_TYPE *)OPENSSL_sk_shift(ossl_check_ASN1_TYPE_sk_type(sk)))
-#define sk_ASN1_TYPE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_TYPE_sk_type(sk),ossl_check_ASN1_TYPE_freefunc_type(freefunc))
+#define sk_ASN1_TYPE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_freefunc_type(freefunc))
 #define sk_ASN1_TYPE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr), (idx))
 #define sk_ASN1_TYPE_set(sk, idx, ptr) ((ASN1_TYPE *)OPENSSL_sk_set(ossl_check_ASN1_TYPE_sk_type(sk), (idx), ossl_check_ASN1_TYPE_type(ptr)))
 #define sk_ASN1_TYPE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_TYPE_sk_type(sk), ossl_check_ASN1_TYPE_type(ptr))
@@ -647,7 +647,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_OBJECT, ASN1_OBJECT, ASN1_OBJECT)
 #define sk_ASN1_OBJECT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr))
 #define sk_ASN1_OBJECT_pop(sk) ((ASN1_OBJECT *)OPENSSL_sk_pop(ossl_check_ASN1_OBJECT_sk_type(sk)))
 #define sk_ASN1_OBJECT_shift(sk) ((ASN1_OBJECT *)OPENSSL_sk_shift(ossl_check_ASN1_OBJECT_sk_type(sk)))
-#define sk_ASN1_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_OBJECT_sk_type(sk),ossl_check_ASN1_OBJECT_freefunc_type(freefunc))
+#define sk_ASN1_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_freefunc_type(freefunc))
 #define sk_ASN1_OBJECT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr), (idx))
 #define sk_ASN1_OBJECT_set(sk, idx, ptr) ((ASN1_OBJECT *)OPENSSL_sk_set(ossl_check_ASN1_OBJECT_sk_type(sk), (idx), ossl_check_ASN1_OBJECT_type(ptr)))
 #define sk_ASN1_OBJECT_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_OBJECT_sk_type(sk), ossl_check_ASN1_OBJECT_type(ptr))
@@ -713,7 +713,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_INTEGER, ASN1_INTEGER, ASN1_INTEGER)
 #define sk_ASN1_INTEGER_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr))
 #define sk_ASN1_INTEGER_pop(sk) ((ASN1_INTEGER *)OPENSSL_sk_pop(ossl_check_ASN1_INTEGER_sk_type(sk)))
 #define sk_ASN1_INTEGER_shift(sk) ((ASN1_INTEGER *)OPENSSL_sk_shift(ossl_check_ASN1_INTEGER_sk_type(sk)))
-#define sk_ASN1_INTEGER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_INTEGER_sk_type(sk),ossl_check_ASN1_INTEGER_freefunc_type(freefunc))
+#define sk_ASN1_INTEGER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_freefunc_type(freefunc))
 #define sk_ASN1_INTEGER_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr), (idx))
 #define sk_ASN1_INTEGER_set(sk, idx, ptr) ((ASN1_INTEGER *)OPENSSL_sk_set(ossl_check_ASN1_INTEGER_sk_type(sk), (idx), ossl_check_ASN1_INTEGER_type(ptr)))
 #define sk_ASN1_INTEGER_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_INTEGER_sk_type(sk), ossl_check_ASN1_INTEGER_type(ptr))
@@ -775,7 +775,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_UTF8STRING, ASN1_UTF8STRING, ASN1_UTF8STRING)
 #define sk_ASN1_UTF8STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr))
 #define sk_ASN1_UTF8STRING_pop(sk) ((ASN1_UTF8STRING *)OPENSSL_sk_pop(ossl_check_ASN1_UTF8STRING_sk_type(sk)))
 #define sk_ASN1_UTF8STRING_shift(sk) ((ASN1_UTF8STRING *)OPENSSL_sk_shift(ossl_check_ASN1_UTF8STRING_sk_type(sk)))
-#define sk_ASN1_UTF8STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(sk),ossl_check_ASN1_UTF8STRING_freefunc_type(freefunc))
+#define sk_ASN1_UTF8STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_freefunc_type(freefunc))
 #define sk_ASN1_UTF8STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr), (idx))
 #define sk_ASN1_UTF8STRING_set(sk, idx, ptr) ((ASN1_UTF8STRING *)OPENSSL_sk_set(ossl_check_ASN1_UTF8STRING_sk_type(sk), (idx), ossl_check_ASN1_UTF8STRING_type(ptr)))
 #define sk_ASN1_UTF8STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_UTF8STRING_sk_type(sk), ossl_check_ASN1_UTF8STRING_type(ptr))
@@ -812,7 +812,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_GENERALSTRING, ASN1_GENERALSTRING, ASN1_GENERA
 #define sk_ASN1_GENERALSTRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr))
 #define sk_ASN1_GENERALSTRING_pop(sk) ((ASN1_GENERALSTRING *)OPENSSL_sk_pop(ossl_check_ASN1_GENERALSTRING_sk_type(sk)))
 #define sk_ASN1_GENERALSTRING_shift(sk) ((ASN1_GENERALSTRING *)OPENSSL_sk_shift(ossl_check_ASN1_GENERALSTRING_sk_type(sk)))
-#define sk_ASN1_GENERALSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_GENERALSTRING_sk_type(sk),ossl_check_ASN1_GENERALSTRING_freefunc_type(freefunc))
+#define sk_ASN1_GENERALSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_freefunc_type(freefunc))
 #define sk_ASN1_GENERALSTRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr), (idx))
 #define sk_ASN1_GENERALSTRING_set(sk, idx, ptr) ((ASN1_GENERALSTRING *)OPENSSL_sk_set(ossl_check_ASN1_GENERALSTRING_sk_type(sk), (idx), ossl_check_ASN1_GENERALSTRING_type(ptr)))
 #define sk_ASN1_GENERALSTRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_GENERALSTRING_sk_type(sk), ossl_check_ASN1_GENERALSTRING_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/asn1t.h

@@ -909,7 +909,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_VALUE, ASN1_VALUE, ASN1_VALUE)
 #define sk_ASN1_VALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr))
 #define sk_ASN1_VALUE_pop(sk) ((ASN1_VALUE *)OPENSSL_sk_pop(ossl_check_ASN1_VALUE_sk_type(sk)))
 #define sk_ASN1_VALUE_shift(sk) ((ASN1_VALUE *)OPENSSL_sk_shift(ossl_check_ASN1_VALUE_sk_type(sk)))
-#define sk_ASN1_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_VALUE_sk_type(sk),ossl_check_ASN1_VALUE_freefunc_type(freefunc))
+#define sk_ASN1_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_freefunc_type(freefunc))
 #define sk_ASN1_VALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr), (idx))
 #define sk_ASN1_VALUE_set(sk, idx, ptr) ((ASN1_VALUE *)OPENSSL_sk_set(ossl_check_ASN1_VALUE_sk_type(sk), (idx), ossl_check_ASN1_VALUE_type(ptr)))
 #define sk_ASN1_VALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_VALUE_sk_type(sk), ossl_check_ASN1_VALUE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/bio.h

@@ -348,7 +348,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(BIO, BIO, BIO)
 #define sk_BIO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr))
 #define sk_BIO_pop(sk) ((BIO *)OPENSSL_sk_pop(ossl_check_BIO_sk_type(sk)))
 #define sk_BIO_shift(sk) ((BIO *)OPENSSL_sk_shift(ossl_check_BIO_sk_type(sk)))
-#define sk_BIO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_BIO_sk_type(sk),ossl_check_BIO_freefunc_type(freefunc))
+#define sk_BIO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_BIO_sk_type(sk), ossl_check_BIO_freefunc_type(freefunc))
 #define sk_BIO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr), (idx))
 #define sk_BIO_set(sk, idx, ptr) ((BIO *)OPENSSL_sk_set(ossl_check_BIO_sk_type(sk), (idx), ossl_check_BIO_type(ptr)))
 #define sk_BIO_find(sk, ptr) OPENSSL_sk_find(ossl_check_BIO_sk_type(sk), ossl_check_BIO_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cmp.h

@@ -234,7 +234,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTSTATUS, OSSL_CMP_CERTSTATUS, OSSL_CMP_
 #define sk_OSSL_CMP_CERTSTATUS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr))
 #define sk_OSSL_CMP_CERTSTATUS_pop(sk) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk)))
 #define sk_OSSL_CMP_CERTSTATUS_shift(sk) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk)))
-#define sk_OSSL_CMP_CERTSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk),ossl_check_OSSL_CMP_CERTSTATUS_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTSTATUS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTSTATUS_set(sk, idx, ptr) ((OSSL_CMP_CERTSTATUS *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr)))
 #define sk_OSSL_CMP_CERTSTATUS_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CERTSTATUS_type(ptr))
@@ -263,7 +263,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_ITAV, OSSL_CMP_ITAV, OSSL_CMP_ITAV)
 #define sk_OSSL_CMP_ITAV_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr))
 #define sk_OSSL_CMP_ITAV_pop(sk) ((OSSL_CMP_ITAV *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_ITAV_sk_type(sk)))
 #define sk_OSSL_CMP_ITAV_shift(sk) ((OSSL_CMP_ITAV *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_ITAV_sk_type(sk)))
-#define sk_OSSL_CMP_ITAV_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(sk),ossl_check_OSSL_CMP_ITAV_freefunc_type(freefunc))
+#define sk_OSSL_CMP_ITAV_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_freefunc_type(freefunc))
 #define sk_OSSL_CMP_ITAV_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr), (idx))
 #define sk_OSSL_CMP_ITAV_set(sk, idx, ptr) ((OSSL_CMP_ITAV *)OPENSSL_sk_set(ossl_check_OSSL_CMP_ITAV_sk_type(sk), (idx), ossl_check_OSSL_CMP_ITAV_type(ptr)))
 #define sk_OSSL_CMP_ITAV_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_ITAV_sk_type(sk), ossl_check_OSSL_CMP_ITAV_type(ptr))
@@ -292,7 +292,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CRLSTATUS, OSSL_CMP_CRLSTATUS, OSSL_CMP_CR
 #define sk_OSSL_CMP_CRLSTATUS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr))
 #define sk_OSSL_CMP_CRLSTATUS_pop(sk) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk)))
 #define sk_OSSL_CMP_CRLSTATUS_shift(sk) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk)))
-#define sk_OSSL_CMP_CRLSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk),ossl_check_OSSL_CMP_CRLSTATUS_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CRLSTATUS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CRLSTATUS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr), (idx))
 #define sk_OSSL_CMP_CRLSTATUS_set(sk, idx, ptr) ((OSSL_CMP_CRLSTATUS *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), (idx), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr)))
 #define sk_OSSL_CMP_CRLSTATUS_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CRLSTATUS_sk_type(sk), ossl_check_OSSL_CMP_CRLSTATUS_type(ptr))
@@ -334,7 +334,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_PKISI, OSSL_CMP_PKISI, OSSL_CMP_PKISI)
 #define sk_OSSL_CMP_PKISI_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr))
 #define sk_OSSL_CMP_PKISI_pop(sk) ((OSSL_CMP_PKISI *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_PKISI_sk_type(sk)))
 #define sk_OSSL_CMP_PKISI_shift(sk) ((OSSL_CMP_PKISI *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_PKISI_sk_type(sk)))
-#define sk_OSSL_CMP_PKISI_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_PKISI_sk_type(sk),ossl_check_OSSL_CMP_PKISI_freefunc_type(freefunc))
+#define sk_OSSL_CMP_PKISI_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_freefunc_type(freefunc))
 #define sk_OSSL_CMP_PKISI_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr), (idx))
 #define sk_OSSL_CMP_PKISI_set(sk, idx, ptr) ((OSSL_CMP_PKISI *)OPENSSL_sk_set(ossl_check_OSSL_CMP_PKISI_sk_type(sk), (idx), ossl_check_OSSL_CMP_PKISI_type(ptr)))
 #define sk_OSSL_CMP_PKISI_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_PKISI_sk_type(sk), ossl_check_OSSL_CMP_PKISI_type(ptr))
@@ -362,7 +362,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTREPMESSAGE, OSSL_CMP_CERTREPMESSAGE, O
 #define sk_OSSL_CMP_CERTREPMESSAGE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr))
 #define sk_OSSL_CMP_CERTREPMESSAGE_pop(sk) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk)))
 #define sk_OSSL_CMP_CERTREPMESSAGE_shift(sk) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk)))
-#define sk_OSSL_CMP_CERTREPMESSAGE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk),ossl_check_OSSL_CMP_CERTREPMESSAGE_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTREPMESSAGE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTREPMESSAGE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTREPMESSAGE_set(sk, idx, ptr) ((OSSL_CMP_CERTREPMESSAGE *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr)))
 #define sk_OSSL_CMP_CERTREPMESSAGE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTREPMESSAGE_sk_type(sk), ossl_check_OSSL_CMP_CERTREPMESSAGE_type(ptr))
@@ -392,7 +392,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CMP_CERTRESPONSE, OSSL_CMP_CERTRESPONSE, OSSL_
 #define sk_OSSL_CMP_CERTRESPONSE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr))
 #define sk_OSSL_CMP_CERTRESPONSE_pop(sk) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_pop(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk)))
 #define sk_OSSL_CMP_CERTRESPONSE_shift(sk) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_shift(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk)))
-#define sk_OSSL_CMP_CERTRESPONSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk),ossl_check_OSSL_CMP_CERTRESPONSE_freefunc_type(freefunc))
+#define sk_OSSL_CMP_CERTRESPONSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_freefunc_type(freefunc))
 #define sk_OSSL_CMP_CERTRESPONSE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr), (idx))
 #define sk_OSSL_CMP_CERTRESPONSE_set(sk, idx, ptr) ((OSSL_CMP_CERTRESPONSE *)OPENSSL_sk_set(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), (idx), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr)))
 #define sk_OSSL_CMP_CERTRESPONSE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CMP_CERTRESPONSE_sk_type(sk), ossl_check_OSSL_CMP_CERTRESPONSE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cms.h

@@ -58,7 +58,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_SignerInfo, CMS_SignerInfo, CMS_SignerInfo)
 #define sk_CMS_SignerInfo_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr))
 #define sk_CMS_SignerInfo_pop(sk) ((CMS_SignerInfo *)OPENSSL_sk_pop(ossl_check_CMS_SignerInfo_sk_type(sk)))
 #define sk_CMS_SignerInfo_shift(sk) ((CMS_SignerInfo *)OPENSSL_sk_shift(ossl_check_CMS_SignerInfo_sk_type(sk)))
-#define sk_CMS_SignerInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_SignerInfo_sk_type(sk),ossl_check_CMS_SignerInfo_freefunc_type(freefunc))
+#define sk_CMS_SignerInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_freefunc_type(freefunc))
 #define sk_CMS_SignerInfo_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr), (idx))
 #define sk_CMS_SignerInfo_set(sk, idx, ptr) ((CMS_SignerInfo *)OPENSSL_sk_set(ossl_check_CMS_SignerInfo_sk_type(sk), (idx), ossl_check_CMS_SignerInfo_type(ptr)))
 #define sk_CMS_SignerInfo_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_SignerInfo_sk_type(sk), ossl_check_CMS_SignerInfo_type(ptr))
@@ -84,7 +84,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RecipientEncryptedKey, CMS_RecipientEncryptedKe
 #define sk_CMS_RecipientEncryptedKey_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr))
 #define sk_CMS_RecipientEncryptedKey_pop(sk) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_pop(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk)))
 #define sk_CMS_RecipientEncryptedKey_shift(sk) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_shift(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk)))
-#define sk_CMS_RecipientEncryptedKey_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk),ossl_check_CMS_RecipientEncryptedKey_freefunc_type(freefunc))
+#define sk_CMS_RecipientEncryptedKey_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_freefunc_type(freefunc))
 #define sk_CMS_RecipientEncryptedKey_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr), (idx))
 #define sk_CMS_RecipientEncryptedKey_set(sk, idx, ptr) ((CMS_RecipientEncryptedKey *)OPENSSL_sk_set(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), (idx), ossl_check_CMS_RecipientEncryptedKey_type(ptr)))
 #define sk_CMS_RecipientEncryptedKey_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RecipientEncryptedKey_sk_type(sk), ossl_check_CMS_RecipientEncryptedKey_type(ptr))
@@ -110,7 +110,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RecipientInfo, CMS_RecipientInfo, CMS_Recipient
 #define sk_CMS_RecipientInfo_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr))
 #define sk_CMS_RecipientInfo_pop(sk) ((CMS_RecipientInfo *)OPENSSL_sk_pop(ossl_check_CMS_RecipientInfo_sk_type(sk)))
 #define sk_CMS_RecipientInfo_shift(sk) ((CMS_RecipientInfo *)OPENSSL_sk_shift(ossl_check_CMS_RecipientInfo_sk_type(sk)))
-#define sk_CMS_RecipientInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientInfo_sk_type(sk),ossl_check_CMS_RecipientInfo_freefunc_type(freefunc))
+#define sk_CMS_RecipientInfo_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_freefunc_type(freefunc))
 #define sk_CMS_RecipientInfo_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr), (idx))
 #define sk_CMS_RecipientInfo_set(sk, idx, ptr) ((CMS_RecipientInfo *)OPENSSL_sk_set(ossl_check_CMS_RecipientInfo_sk_type(sk), (idx), ossl_check_CMS_RecipientInfo_type(ptr)))
 #define sk_CMS_RecipientInfo_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RecipientInfo_sk_type(sk), ossl_check_CMS_RecipientInfo_type(ptr))
@@ -136,7 +136,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CMS_RevocationInfoChoice, CMS_RevocationInfoChoice,
 #define sk_CMS_RevocationInfoChoice_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr))
 #define sk_CMS_RevocationInfoChoice_pop(sk) ((CMS_RevocationInfoChoice *)OPENSSL_sk_pop(ossl_check_CMS_RevocationInfoChoice_sk_type(sk)))
 #define sk_CMS_RevocationInfoChoice_shift(sk) ((CMS_RevocationInfoChoice *)OPENSSL_sk_shift(ossl_check_CMS_RevocationInfoChoice_sk_type(sk)))
-#define sk_CMS_RevocationInfoChoice_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RevocationInfoChoice_sk_type(sk),ossl_check_CMS_RevocationInfoChoice_freefunc_type(freefunc))
+#define sk_CMS_RevocationInfoChoice_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_freefunc_type(freefunc))
 #define sk_CMS_RevocationInfoChoice_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr), (idx))
 #define sk_CMS_RevocationInfoChoice_set(sk, idx, ptr) ((CMS_RevocationInfoChoice *)OPENSSL_sk_set(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), (idx), ossl_check_CMS_RevocationInfoChoice_type(ptr)))
 #define sk_CMS_RevocationInfoChoice_find(sk, ptr) OPENSSL_sk_find(ossl_check_CMS_RevocationInfoChoice_sk_type(sk), ossl_check_CMS_RevocationInfoChoice_type(ptr))
@@ -168,6 +168,7 @@ CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq)
 # define CMS_RECIPINFO_KEK               2
 # define CMS_RECIPINFO_PASS              3
 # define CMS_RECIPINFO_OTHER             4
+# define CMS_RECIPINFO_KEM               5
 
 /* S/MIME related flags */
 
@@ -499,6 +500,14 @@ int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms,
 int CMS_SharedInfo_encode(unsigned char **pder, X509_ALGOR *kekalg,
                           ASN1_OCTET_STRING *ukm, int keylen);
 
+int CMS_RecipientInfo_kemri_cert_cmp(CMS_RecipientInfo *ri, X509 *cert);
+int CMS_RecipientInfo_kemri_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk);
+EVP_CIPHER_CTX *CMS_RecipientInfo_kemri_get0_ctx(CMS_RecipientInfo *ri);
+X509_ALGOR *CMS_RecipientInfo_kemri_get0_kdf_alg(CMS_RecipientInfo *ri);
+int CMS_RecipientInfo_kemri_set_ukm(CMS_RecipientInfo *ri,
+                                    const unsigned char *ukm,
+                                    int ukmLength);
+
 /* Backward compatibility for spelling errors. */
 # define CMS_R_UNKNOWN_DIGEST_ALGORITM CMS_R_UNKNOWN_DIGEST_ALGORITHM
 # define CMS_R_UNSUPPORTED_RECPIENTINFO_TYPE \

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/cmserr.h

@@ -67,6 +67,7 @@
 #  define CMS_R_NOT_A_SIGNED_RECEIPT                       165
 #  define CMS_R_NOT_ENCRYPTED_DATA                         122
 #  define CMS_R_NOT_KEK                                    123
+#  define CMS_R_NOT_KEM                                    197
 #  define CMS_R_NOT_KEY_AGREEMENT                          181
 #  define CMS_R_NOT_KEY_TRANSPORT                          124
 #  define CMS_R_NOT_PWRI                                   177
@@ -106,10 +107,12 @@
 #  define CMS_R_UNKNOWN_CIPHER                             148
 #  define CMS_R_UNKNOWN_DIGEST_ALGORITHM                   149
 #  define CMS_R_UNKNOWN_ID                                 150
+#  define CMS_R_UNKNOWN_KDF_ALGORITHM                      198
 #  define CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM          151
 #  define CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM   194
 #  define CMS_R_UNSUPPORTED_CONTENT_TYPE                   152
 #  define CMS_R_UNSUPPORTED_ENCRYPTION_TYPE                192
+#  define CMS_R_UNSUPPORTED_KDF_ALGORITHM                  199
 #  define CMS_R_UNSUPPORTED_KEK_ALGORITHM                  153
 #  define CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM       179
 #  define CMS_R_UNSUPPORTED_LABEL_SOURCE                   193

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/comp.h

@@ -78,7 +78,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SSL_COMP, SSL_COMP, SSL_COMP)
 #define sk_SSL_COMP_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr))
 #define sk_SSL_COMP_pop(sk) ((SSL_COMP *)OPENSSL_sk_pop(ossl_check_SSL_COMP_sk_type(sk)))
 #define sk_SSL_COMP_shift(sk) ((SSL_COMP *)OPENSSL_sk_shift(ossl_check_SSL_COMP_sk_type(sk)))
-#define sk_SSL_COMP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_COMP_sk_type(sk),ossl_check_SSL_COMP_freefunc_type(freefunc))
+#define sk_SSL_COMP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_freefunc_type(freefunc))
 #define sk_SSL_COMP_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr), (idx))
 #define sk_SSL_COMP_set(sk, idx, ptr) ((SSL_COMP *)OPENSSL_sk_set(ossl_check_SSL_COMP_sk_type(sk), (idx), ossl_check_SSL_COMP_type(ptr)))
 #define sk_SSL_COMP_find(sk, ptr) OPENSSL_sk_find(ossl_check_SSL_COMP_sk_type(sk), ossl_check_SSL_COMP_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/conf.h

@@ -56,7 +56,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CONF_VALUE, CONF_VALUE, CONF_VALUE)
 #define sk_CONF_VALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr))
 #define sk_CONF_VALUE_pop(sk) ((CONF_VALUE *)OPENSSL_sk_pop(ossl_check_CONF_VALUE_sk_type(sk)))
 #define sk_CONF_VALUE_shift(sk) ((CONF_VALUE *)OPENSSL_sk_shift(ossl_check_CONF_VALUE_sk_type(sk)))
-#define sk_CONF_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CONF_VALUE_sk_type(sk),ossl_check_CONF_VALUE_freefunc_type(freefunc))
+#define sk_CONF_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_freefunc_type(freefunc))
 #define sk_CONF_VALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr), (idx))
 #define sk_CONF_VALUE_set(sk, idx, ptr) ((CONF_VALUE *)OPENSSL_sk_set(ossl_check_CONF_VALUE_sk_type(sk), (idx), ossl_check_CONF_VALUE_type(ptr)))
 #define sk_CONF_VALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_CONF_VALUE_sk_type(sk), ossl_check_CONF_VALUE_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/configuration.h

@@ -30,7 +30,7 @@ extern "C" {
 # ifndef OPENSSL_SYS_iOS
 #  define OPENSSL_SYS_iOS 1
 # endif
-# define OPENSSL_CONFIGURED_API 30500
+# define OPENSSL_CONFIGURED_API 30600
 # ifndef OPENSSL_RAND_SEED_OS
 #  define OPENSSL_RAND_SEED_OS
 # endif
@@ -43,6 +43,9 @@ extern "C" {
 # ifndef OPENSSL_NO_AFALGENG
 #  define OPENSSL_NO_AFALGENG
 # endif
+# ifndef OPENSSL_NO_ALLOCFAIL_TESTS
+#  define OPENSSL_NO_ALLOCFAIL_TESTS
+# endif
 # ifndef OPENSSL_NO_ASAN
 #  define OPENSSL_NO_ASAN
 # endif
@@ -121,6 +124,9 @@ extern "C" {
 # ifndef OPENSSL_NO_KTLS
 #  define OPENSSL_NO_KTLS
 # endif
+# ifndef OPENSSL_NO_LMS
+#  define OPENSSL_NO_LMS
+# endif
 # ifndef OPENSSL_NO_LOADERENG
 #  define OPENSSL_NO_LOADERENG
 # endif

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/core_dispatch.h

@@ -253,6 +253,10 @@ OSSL_CORE_MAKE_FUNC(int, provider_up_ref,
 OSSL_CORE_MAKE_FUNC(int, provider_free,
                     (const OSSL_CORE_HANDLE *prov, int deactivate))
 
+/* Additional error functions provided by the core */
+# define OSSL_FUNC_CORE_COUNT_TO_MARK          120
+OSSL_CORE_MAKE_FUNC(int, core_count_to_mark, (const OSSL_CORE_HANDLE *prov))
+
 /* Functions provided by the provider to the Core, reserved numbers 1024-1535 */
 # define OSSL_FUNC_PROVIDER_TEARDOWN           1024
 OSSL_CORE_MAKE_FUNC(void, provider_teardown, (void *provctx))
@@ -499,6 +503,52 @@ OSSL_CORE_MAKE_FUNC(int, mac_set_ctx_params,
                     (void *mctx, const OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(int, mac_init_skey, (void *mctx, void *key, const OSSL_PARAM params[]))
 
+/*-
+ * Symmetric key management
+ *
+ * The Key Management takes care of provider side of symmetric key objects, and
+ * includes essentially everything that manipulates the keys  themselves and
+ * their parameters.
+ *
+ * The key objects are commonly referred to as |keydata|, and it MUST be able
+ * to contain parameters if the key has any, and the secret key.
+ *
+ * Key objects are created with OSSL_FUNC_skeymgmt_import() (there is no
+ * dedicated memory allocation function), exported with
+ * OSSL_FUNC_skeymgmt_export() and destroyed with OSSL_FUNC_keymgmt_free().
+ *
+ */
+
+/* Key data subset selection - individual bits */
+# define OSSL_SKEYMGMT_SELECT_PARAMETERS      0x01
+# define OSSL_SKEYMGMT_SELECT_SECRET_KEY      0x02
+
+/* Key data subset selection - combinations */
+# define OSSL_SKEYMGMT_SELECT_ALL                \
+    (OSSL_SKEYMGMT_SELECT_PARAMETERS | OSSL_SKEYMGMT_SELECT_SECRET_KEY)
+
+# define OSSL_FUNC_SKEYMGMT_FREE                1
+# define OSSL_FUNC_SKEYMGMT_IMPORT              2
+# define OSSL_FUNC_SKEYMGMT_EXPORT              3
+# define OSSL_FUNC_SKEYMGMT_GENERATE            4
+# define OSSL_FUNC_SKEYMGMT_GET_KEY_ID          5
+# define OSSL_FUNC_SKEYMGMT_IMP_SETTABLE_PARAMS 6
+# define OSSL_FUNC_SKEYMGMT_GEN_SETTABLE_PARAMS 7
+
+OSSL_CORE_MAKE_FUNC(void, skeymgmt_free, (void *keydata))
+OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
+                    skeymgmt_imp_settable_params, (void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, skeymgmt_import, (void *provctx, int selection,
+                                              const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(int, skeymgmt_export,
+                    (void *keydata, int selection,
+                     OSSL_CALLBACK *param_cb, void *cbarg))
+OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
+                    skeymgmt_gen_settable_params, (void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, skeymgmt_generate, (void *provctx,
+                                                const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(const char *, skeymgmt_get_key_id, (void *keydata))
+
 /* KDFs and PRFs */
 
 # define OSSL_FUNC_KDF_NEWCTX                        1
@@ -512,6 +562,8 @@ OSSL_CORE_MAKE_FUNC(int, mac_init_skey, (void *mctx, void *key, const OSSL_PARAM
 # define OSSL_FUNC_KDF_GET_PARAMS                    9
 # define OSSL_FUNC_KDF_GET_CTX_PARAMS               10
 # define OSSL_FUNC_KDF_SET_CTX_PARAMS               11
+# define OSSL_FUNC_KDF_SET_SKEY                     12
+# define OSSL_FUNC_KDF_DERIVE_SKEY                  13
 
 OSSL_CORE_MAKE_FUNC(void *, kdf_newctx, (void *provctx))
 OSSL_CORE_MAKE_FUNC(void *, kdf_dupctx, (void *src))
@@ -529,6 +581,11 @@ OSSL_CORE_MAKE_FUNC(int, kdf_get_ctx_params,
                     (void *kctx, OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(int, kdf_set_ctx_params,
                     (void *kctx, const OSSL_PARAM params[]))
+OSSL_CORE_MAKE_FUNC(int, kdf_set_skey,
+                    (void *kctx, void *skeydata, const char *paramname))
+OSSL_CORE_MAKE_FUNC(void *, kdf_derive_skey, (void *ctx, const char *key_type, void *provctx,
+                                              OSSL_FUNC_skeymgmt_import_fn *import,
+                                              size_t keylen, const OSSL_PARAM params[]))
 
 /* RAND */
 
@@ -769,6 +826,7 @@ OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, keymgmt_export_types_ex,
 # define OSSL_FUNC_KEYEXCH_SETTABLE_CTX_PARAMS         8
 # define OSSL_FUNC_KEYEXCH_GET_CTX_PARAMS              9
 # define OSSL_FUNC_KEYEXCH_GETTABLE_CTX_PARAMS        10
+# define OSSL_FUNC_KEYEXCH_DERIVE_SKEY                11
 
 OSSL_CORE_MAKE_FUNC(void *, keyexch_newctx, (void *provctx))
 OSSL_CORE_MAKE_FUNC(int, keyexch_init, (void *ctx, void *provkey,
@@ -786,6 +844,9 @@ OSSL_CORE_MAKE_FUNC(int, keyexch_get_ctx_params, (void *ctx,
                                                      OSSL_PARAM params[]))
 OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, keyexch_gettable_ctx_params,
                     (void *ctx, void *provctx))
+OSSL_CORE_MAKE_FUNC(void *, keyexch_derive_skey, (void *ctx, const char *key_type, void *provctx,
+                                                  OSSL_FUNC_skeymgmt_import_fn *import,
+                                                  size_t keylen, const OSSL_PARAM params[]))
 
 /* Signature */
 
@@ -899,52 +960,6 @@ OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *, signature_settable_ctx_md_params,
                     (void *ctx))
 OSSL_CORE_MAKE_FUNC(const char **, signature_query_key_types, (void))
 
-/*-
- * Symmetric key management
- *
- * The Key Management takes care of provider side of symmetric key objects, and
- * includes essentially everything that manipulates the keys  themselves and
- * their parameters.
- *
- * The key objects are commonly referred to as |keydata|, and it MUST be able
- * to contain parameters if the key has any, and the secret key.
- *
- * Key objects are created with OSSL_FUNC_skeymgmt_import() (there is no
- * dedicated memory allocation function), exported with
- * OSSL_FUNC_skeymgmt_export() and destroyed with OSSL_FUNC_keymgmt_free().
- *
- */
-
-/* Key data subset selection - individual bits */
-# define OSSL_SKEYMGMT_SELECT_PARAMETERS      0x01
-# define OSSL_SKEYMGMT_SELECT_SECRET_KEY      0x02
-
-/* Key data subset selection - combinations */
-# define OSSL_SKEYMGMT_SELECT_ALL                \
-    (OSSL_SKEYMGMT_SELECT_PARAMETERS | OSSL_SKEYMGMT_SELECT_SECRET_KEY)
-
-# define OSSL_FUNC_SKEYMGMT_FREE                1
-# define OSSL_FUNC_SKEYMGMT_IMPORT              2
-# define OSSL_FUNC_SKEYMGMT_EXPORT              3
-# define OSSL_FUNC_SKEYMGMT_GENERATE            4
-# define OSSL_FUNC_SKEYMGMT_GET_KEY_ID          5
-# define OSSL_FUNC_SKEYMGMT_IMP_SETTABLE_PARAMS 6
-# define OSSL_FUNC_SKEYMGMT_GEN_SETTABLE_PARAMS 7
-
-OSSL_CORE_MAKE_FUNC(void, skeymgmt_free, (void *keydata))
-OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
-                    skeymgmt_imp_settable_params, (void *provctx))
-OSSL_CORE_MAKE_FUNC(void *, skeymgmt_import, (void *provctx, int selection,
-                                              const OSSL_PARAM params[]))
-OSSL_CORE_MAKE_FUNC(int, skeymgmt_export,
-                    (void *keydata, int selection,
-                     OSSL_CALLBACK *param_cb, void *cbarg))
-OSSL_CORE_MAKE_FUNC(const OSSL_PARAM *,
-                    skeymgmt_gen_settable_params, (void *provctx))
-OSSL_CORE_MAKE_FUNC(void *, skeymgmt_generate, (void *provctx,
-                                                const OSSL_PARAM params[]))
-OSSL_CORE_MAKE_FUNC(const char *, skeymgmt_get_key_id, (void *keydata))
-
 /* Asymmetric Ciphers */
 
 # define OSSL_FUNC_ASYM_CIPHER_NEWCTX                  1

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/core_names.h

@@ -65,6 +65,9 @@ extern "C" {
 
 /* Known KDF names */
 # define OSSL_KDF_NAME_HKDF           "HKDF"
+# define OSSL_KDF_NAME_HKDF_SHA256    "HKDF-SHA256"
+# define OSSL_KDF_NAME_HKDF_SHA384    "HKDF-SHA384"
+# define OSSL_KDF_NAME_HKDF_SHA512    "HKDF-SHA512"
 # define OSSL_KDF_NAME_TLS1_3_KDF     "TLS13-KDF"
 # define OSSL_KDF_NAME_PBKDF1         "PBKDF1"
 # define OSSL_KDF_NAME_PBKDF2         "PBKDF2"
@@ -124,6 +127,7 @@ extern "C" {
 # define OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR "fips-indicator"
 # define OSSL_ALG_PARAM_MAC "mac"
 # define OSSL_ALG_PARAM_PROPERTIES "properties"
+# define OSSL_ALG_PARAM_SECURITY_CATEGORY "security-category"
 # define OSSL_ASYM_CIPHER_PARAM_DIGEST OSSL_PKEY_PARAM_DIGEST
 # define OSSL_ASYM_CIPHER_PARAM_ENGINE OSSL_PKEY_PARAM_ENGINE
 # define OSSL_ASYM_CIPHER_PARAM_FIPS_APPROVED_INDICATOR OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR
@@ -164,6 +168,7 @@ extern "C" {
 # define OSSL_CAPABILITY_TLS_SIGALG_SECURITY_BITS "tls-sigalg-sec-bits"
 # define OSSL_CAPABILITY_TLS_SIGALG_SIG_NAME "tls-sigalg-sig-name"
 # define OSSL_CAPABILITY_TLS_SIGALG_SIG_OID "tls-sigalg-sig-oid"
+# define OSSL_CIPHER_HMAC_PARAM_MAC OSSL_CIPHER_PARAM_AEAD_TAG
 # define OSSL_CIPHER_PARAM_AEAD "aead"
 # define OSSL_CIPHER_PARAM_AEAD_IVLEN OSSL_CIPHER_PARAM_IVLEN
 # define OSSL_CIPHER_PARAM_AEAD_IV_GENERATED "iv-generated"
@@ -183,6 +188,7 @@ extern "C" {
 # define OSSL_CIPHER_PARAM_CTS_MODE "cts_mode"
 # define OSSL_CIPHER_PARAM_CUSTOM_IV "custom-iv"
 # define OSSL_CIPHER_PARAM_DECRYPT_ONLY "decrypt-only"
+# define OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC "encrypt-then-mac"
 # define OSSL_CIPHER_PARAM_FIPS_APPROVED_INDICATOR OSSL_ALG_PARAM_FIPS_APPROVED_INDICATOR
 # define OSSL_CIPHER_PARAM_FIPS_ENCRYPT_CHECK "encrypt-check"
 # define OSSL_CIPHER_PARAM_HAS_RAND_KEY "has-randkey"
@@ -356,6 +362,8 @@ extern "C" {
 # define OSSL_PKEY_PARAM_ALGORITHM_ID_PARAMS OSSL_ALG_PARAM_ALGORITHM_ID_PARAMS
 # define OSSL_PKEY_PARAM_BITS "bits"
 # define OSSL_PKEY_PARAM_CIPHER OSSL_ALG_PARAM_CIPHER
+# define OSSL_PKEY_PARAM_CMS_KEMRI_KDF_ALGORITHM "kemri-kdf-alg"
+# define OSSL_PKEY_PARAM_CMS_RI_TYPE "ri-type"
 # define OSSL_PKEY_PARAM_DEFAULT_DIGEST "default-digest"
 # define OSSL_PKEY_PARAM_DHKEM_IKM "dhkem-ikm"
 # define OSSL_PKEY_PARAM_DH_GENERATOR "safeprime-generator"
@@ -482,6 +490,7 @@ extern "C" {
 # define OSSL_PKEY_PARAM_RSA_TEST_XQ1 "xq1"
 # define OSSL_PKEY_PARAM_RSA_TEST_XQ2 "xq2"
 # define OSSL_PKEY_PARAM_SECURITY_BITS "security-bits"
+# define OSSL_PKEY_PARAM_SECURITY_CATEGORY OSSL_ALG_PARAM_SECURITY_CATEGORY
 # define OSSL_PKEY_PARAM_SLH_DSA_SEED "seed"
 # define OSSL_PKEY_PARAM_USE_COFACTOR_ECDH OSSL_PKEY_PARAM_USE_COFACTOR_FLAG
 # define OSSL_PKEY_PARAM_USE_COFACTOR_FLAG "use-cofactor-flag"

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/crmf.h

@@ -68,7 +68,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_MSG, OSSL_CRMF_MSG, OSSL_CRMF_MSG)
 #define sk_OSSL_CRMF_MSG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr))
 #define sk_OSSL_CRMF_MSG_pop(sk) ((OSSL_CRMF_MSG *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_MSG_sk_type(sk)))
 #define sk_OSSL_CRMF_MSG_shift(sk) ((OSSL_CRMF_MSG *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_MSG_sk_type(sk)))
-#define sk_OSSL_CRMF_MSG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_MSG_sk_type(sk),ossl_check_OSSL_CRMF_MSG_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_MSG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_MSG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr), (idx))
 #define sk_OSSL_CRMF_MSG_set(sk, idx, ptr) ((OSSL_CRMF_MSG *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_MSG_sk_type(sk), (idx), ossl_check_OSSL_CRMF_MSG_type(ptr)))
 #define sk_OSSL_CRMF_MSG_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_MSG_sk_type(sk), ossl_check_OSSL_CRMF_MSG_type(ptr))
@@ -98,7 +98,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_ATTRIBUTETYPEANDVALUE, OSSL_CRMF_ATTRIBUT
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop(sk) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk)))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_shift(sk) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk)))
-#define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk),ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr), (idx))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_set(sk, idx, ptr) ((OSSL_CRMF_ATTRIBUTETYPEANDVALUE *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), (idx), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr)))
 #define sk_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_sk_type(sk), ossl_check_OSSL_CRMF_ATTRIBUTETYPEANDVALUE_type(ptr))
@@ -133,7 +133,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_CRMF_CERTID, OSSL_CRMF_CERTID, OSSL_CRMF_CERTI
 #define sk_OSSL_CRMF_CERTID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr))
 #define sk_OSSL_CRMF_CERTID_pop(sk) ((OSSL_CRMF_CERTID *)OPENSSL_sk_pop(ossl_check_OSSL_CRMF_CERTID_sk_type(sk)))
 #define sk_OSSL_CRMF_CERTID_shift(sk) ((OSSL_CRMF_CERTID *)OPENSSL_sk_shift(ossl_check_OSSL_CRMF_CERTID_sk_type(sk)))
-#define sk_OSSL_CRMF_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_CERTID_sk_type(sk),ossl_check_OSSL_CRMF_CERTID_freefunc_type(freefunc))
+#define sk_OSSL_CRMF_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_freefunc_type(freefunc))
 #define sk_OSSL_CRMF_CERTID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr), (idx))
 #define sk_OSSL_CRMF_CERTID_set(sk, idx, ptr) ((OSSL_CRMF_CERTID *)OPENSSL_sk_set(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), (idx), ossl_check_OSSL_CRMF_CERTID_type(ptr)))
 #define sk_OSSL_CRMF_CERTID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_CRMF_CERTID_sk_type(sk), ossl_check_OSSL_CRMF_CERTID_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/crypto.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/crypto.h.in
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -99,36 +99,52 @@ int CRYPTO_atomic_store(uint64_t *dst, uint64_t val, CRYPTO_RWLOCK *lock);
 #define OPENSSL_malloc_init() while(0) continue
 
 # define OPENSSL_malloc(num) \
-        CRYPTO_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_zalloc(num) \
-        CRYPTO_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_malloc_array(num, size) \
+    CRYPTO_malloc_array(num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_calloc(num, size) \
+    CRYPTO_calloc(num, size, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_aligned_alloc(num, alignment, freeptr) \
-        CRYPTO_aligned_alloc(num, alignment, freeptr, \
-                             OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_aligned_alloc(num, alignment, freeptr, \
+                         OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_aligned_alloc_array(num, size, alignment, freeptr) \
+    CRYPTO_aligned_alloc_array(num, size, alignment, freeptr, \
+                               OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_realloc(addr, num) \
-        CRYPTO_realloc(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_realloc(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_clear_realloc(addr, old_num, num) \
-        CRYPTO_clear_realloc(addr, old_num, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_clear_realloc(addr, old_num, num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_realloc_array(addr, num, size) \
+    CRYPTO_realloc_array(addr, num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_clear_realloc_array(addr, old_num, num, size) \
+    CRYPTO_clear_realloc_array(addr, old_num, num, size, \
+                               OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_clear_free(addr, num) \
-        CRYPTO_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_free(addr) \
-        CRYPTO_free(addr, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_free(addr, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_memdup(str, s) \
-        CRYPTO_memdup((str), s, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_memdup((str), s, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_strdup(str) \
-        CRYPTO_strdup(str, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_strdup(str, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_strndup(str, n) \
-        CRYPTO_strndup(str, n, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_strndup(str, n, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_malloc(num) \
-        CRYPTO_secure_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_malloc(num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_zalloc(num) \
-        CRYPTO_secure_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_zalloc(num, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_secure_malloc_array(num, size) \
+    CRYPTO_secure_malloc_array(num, size, OPENSSL_FILE, OPENSSL_LINE)
+# define OPENSSL_secure_calloc(num, size) \
+    CRYPTO_secure_calloc(num, size, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_free(addr) \
-        CRYPTO_secure_free(addr, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_free(addr, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_clear_free(addr, num) \
-        CRYPTO_secure_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
+    CRYPTO_secure_clear_free(addr, num, OPENSSL_FILE, OPENSSL_LINE)
 # define OPENSSL_secure_actual_size(ptr) \
-        CRYPTO_secure_actual_size(ptr)
+    CRYPTO_secure_actual_size(ptr)
 
 size_t OPENSSL_strlcpy(char *dst, const char *src, size_t siz);
 size_t OPENSSL_strlcat(char *dst, const char *src, size_t siz);
@@ -209,7 +225,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(void, void, void)
 #define sk_void_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr))
 #define sk_void_pop(sk) ((void *)OPENSSL_sk_pop(ossl_check_void_sk_type(sk)))
 #define sk_void_shift(sk) ((void *)OPENSSL_sk_shift(ossl_check_void_sk_type(sk)))
-#define sk_void_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_void_sk_type(sk),ossl_check_void_freefunc_type(freefunc))
+#define sk_void_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_void_sk_type(sk), ossl_check_void_freefunc_type(freefunc))
 #define sk_void_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr), (idx))
 #define sk_void_set(sk, idx, ptr) ((void *)OPENSSL_sk_set(ossl_check_void_sk_type(sk), (idx), ossl_check_void_type(ptr)))
 #define sk_void_find(sk, ptr) OPENSSL_sk_find(ossl_check_void_sk_type(sk), ossl_check_void_type(ptr))
@@ -355,22 +371,37 @@ void CRYPTO_get_mem_functions(CRYPTO_malloc_fn *malloc_fn,
 
 OSSL_CRYPTO_ALLOC void *CRYPTO_malloc(size_t num, const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_zalloc(size_t num, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_malloc_array(size_t num, size_t size,
+                                            const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_calloc(size_t num, size_t size,
+                                      const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_aligned_alloc(size_t num, size_t align,
                                              void **freeptr, const char *file,
                                              int line);
-OSSL_CRYPTO_ALLOC void *CRYPTO_memdup(const void *str, size_t siz, const char *file, int line);
-OSSL_CRYPTO_ALLOC char *CRYPTO_strdup(const char *str, const char *file, int line);
-OSSL_CRYPTO_ALLOC char *CRYPTO_strndup(const char *str, size_t s, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_aligned_alloc_array(size_t num, size_t size,
+                                                   size_t align, void **freeptr,
+                                                   const char *file, int line);
+void *CRYPTO_memdup(const void *str, size_t siz, const char *file, int line);
+char *CRYPTO_strdup(const char *str, const char *file, int line);
+char *CRYPTO_strndup(const char *str, size_t s, const char *file, int line);
 void CRYPTO_free(void *ptr, const char *file, int line);
 void CRYPTO_clear_free(void *ptr, size_t num, const char *file, int line);
 void *CRYPTO_realloc(void *addr, size_t num, const char *file, int line);
 void *CRYPTO_clear_realloc(void *addr, size_t old_num, size_t num,
                            const char *file, int line);
+void *CRYPTO_realloc_array(void *addr, size_t num, size_t size,
+                           const char *file, int line);
+void *CRYPTO_clear_realloc_array(void *addr, size_t old_num, size_t num,
+                                 size_t size, const char *file, int line);
 
 int CRYPTO_secure_malloc_init(size_t sz, size_t minsize);
 int CRYPTO_secure_malloc_done(void);
 OSSL_CRYPTO_ALLOC void *CRYPTO_secure_malloc(size_t num, const char *file, int line);
 OSSL_CRYPTO_ALLOC void *CRYPTO_secure_zalloc(size_t num, const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_secure_malloc_array(size_t num, size_t size,
+                                                   const char *file, int line);
+OSSL_CRYPTO_ALLOC void *CRYPTO_secure_calloc(size_t num, size_t size,
+                                             const char *file, int line);
 void CRYPTO_secure_free(void *ptr, const char *file, int line);
 void CRYPTO_secure_clear_free(void *ptr, size_t num,
                               const char *file, int line);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ct.h

@@ -54,7 +54,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SCT, SCT, SCT)
 #define sk_SCT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
 #define sk_SCT_pop(sk) ((SCT *)OPENSSL_sk_pop(ossl_check_SCT_sk_type(sk)))
 #define sk_SCT_shift(sk) ((SCT *)OPENSSL_sk_shift(ossl_check_SCT_sk_type(sk)))
-#define sk_SCT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SCT_sk_type(sk),ossl_check_SCT_freefunc_type(freefunc))
+#define sk_SCT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SCT_sk_type(sk), ossl_check_SCT_freefunc_type(freefunc))
 #define sk_SCT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr), (idx))
 #define sk_SCT_set(sk, idx, ptr) ((SCT *)OPENSSL_sk_set(ossl_check_SCT_sk_type(sk), (idx), ossl_check_SCT_type(ptr)))
 #define sk_SCT_find(sk, ptr) OPENSSL_sk_find(ossl_check_SCT_sk_type(sk), ossl_check_SCT_type(ptr))
@@ -80,7 +80,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(CTLOG, CTLOG, CTLOG)
 #define sk_CTLOG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))
 #define sk_CTLOG_pop(sk) ((CTLOG *)OPENSSL_sk_pop(ossl_check_CTLOG_sk_type(sk)))
 #define sk_CTLOG_shift(sk) ((CTLOG *)OPENSSL_sk_shift(ossl_check_CTLOG_sk_type(sk)))
-#define sk_CTLOG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CTLOG_sk_type(sk),ossl_check_CTLOG_freefunc_type(freefunc))
+#define sk_CTLOG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_freefunc_type(freefunc))
 #define sk_CTLOG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr), (idx))
 #define sk_CTLOG_set(sk, idx, ptr) ((CTLOG *)OPENSSL_sk_set(ossl_check_CTLOG_sk_type(sk), (idx), ossl_check_CTLOG_type(ptr)))
 #define sk_CTLOG_find(sk, ptr) OPENSSL_sk_find(ossl_check_CTLOG_sk_type(sk), ossl_check_CTLOG_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ess.h

@@ -46,7 +46,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ESS_CERT_ID, ESS_CERT_ID, ESS_CERT_ID)
 #define sk_ESS_CERT_ID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr))
 #define sk_ESS_CERT_ID_pop(sk) ((ESS_CERT_ID *)OPENSSL_sk_pop(ossl_check_ESS_CERT_ID_sk_type(sk)))
 #define sk_ESS_CERT_ID_shift(sk) ((ESS_CERT_ID *)OPENSSL_sk_shift(ossl_check_ESS_CERT_ID_sk_type(sk)))
-#define sk_ESS_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_sk_type(sk),ossl_check_ESS_CERT_ID_freefunc_type(freefunc))
+#define sk_ESS_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_freefunc_type(freefunc))
 #define sk_ESS_CERT_ID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr), (idx))
 #define sk_ESS_CERT_ID_set(sk, idx, ptr) ((ESS_CERT_ID *)OPENSSL_sk_set(ossl_check_ESS_CERT_ID_sk_type(sk), (idx), ossl_check_ESS_CERT_ID_type(ptr)))
 #define sk_ESS_CERT_ID_find(sk, ptr) OPENSSL_sk_find(ossl_check_ESS_CERT_ID_sk_type(sk), ossl_check_ESS_CERT_ID_type(ptr))
@@ -78,7 +78,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ESS_CERT_ID_V2, ESS_CERT_ID_V2, ESS_CERT_ID_V2)
 #define sk_ESS_CERT_ID_V2_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr))
 #define sk_ESS_CERT_ID_V2_pop(sk) ((ESS_CERT_ID_V2 *)OPENSSL_sk_pop(ossl_check_ESS_CERT_ID_V2_sk_type(sk)))
 #define sk_ESS_CERT_ID_V2_shift(sk) ((ESS_CERT_ID_V2 *)OPENSSL_sk_shift(ossl_check_ESS_CERT_ID_V2_sk_type(sk)))
-#define sk_ESS_CERT_ID_V2_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_V2_sk_type(sk),ossl_check_ESS_CERT_ID_V2_freefunc_type(freefunc))
+#define sk_ESS_CERT_ID_V2_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_freefunc_type(freefunc))
 #define sk_ESS_CERT_ID_V2_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr), (idx))
 #define sk_ESS_CERT_ID_V2_set(sk, idx, ptr) ((ESS_CERT_ID_V2 *)OPENSSL_sk_set(ossl_check_ESS_CERT_ID_V2_sk_type(sk), (idx), ossl_check_ESS_CERT_ID_V2_type(ptr)))
 #define sk_ESS_CERT_ID_V2_find(sk, ptr) OPENSSL_sk_find(ossl_check_ESS_CERT_ID_V2_sk_type(sk), ossl_check_ESS_CERT_ID_V2_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/evp.h

@@ -376,6 +376,7 @@ OSSL_DEPRECATEDIN_3_0 int
 /* For supplementary wrap cipher support */
 # define         EVP_CIPH_FLAG_GET_WRAP_CIPHER   0x4000000
 # define         EVP_CIPH_FLAG_INVERSE_CIPHER    0x8000000
+# define         EVP_CIPH_FLAG_ENC_THEN_MAC      0x10000000
 
 /*
  * Cipher context flag to indicate we can handle wrap mode: if allowed in
@@ -518,33 +519,40 @@ typedef int (EVP_PBE_KEYGEN_EX) (EVP_CIPHER_CTX *ctx, const char *pass,
                                  int en_de, OSSL_LIB_CTX *libctx, const char *propq);
 
 # ifndef OPENSSL_NO_DEPRECATED_3_0
-#  define EVP_PKEY_assign_RSA(pkey,rsa) EVP_PKEY_assign((pkey),EVP_PKEY_RSA,\
+#  define EVP_PKEY_assign_RSA(pkey, rsa) EVP_PKEY_assign((pkey), EVP_PKEY_RSA, \
                                                          (rsa))
 # endif
 
-# ifndef OPENSSL_NO_DSA
-#  define EVP_PKEY_assign_DSA(pkey,dsa) EVP_PKEY_assign((pkey),EVP_PKEY_DSA,\
-                                        (dsa))
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+#  ifndef OPENSSL_NO_DSA
+#   define EVP_PKEY_assign_DSA(pkey, dsa) EVP_PKEY_assign((pkey), EVP_PKEY_DSA, \
+                                                          (dsa))
+#  endif
 # endif
 
 # if !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-#  define EVP_PKEY_assign_DH(pkey,dh) EVP_PKEY_assign((pkey),EVP_PKEY_DH,(dh))
+#  define EVP_PKEY_assign_DH(pkey, dh) EVP_PKEY_assign((pkey), EVP_PKEY_DH, (dh))
 # endif
 
 # ifndef OPENSSL_NO_DEPRECATED_3_0
 #  ifndef OPENSSL_NO_EC
-#   define EVP_PKEY_assign_EC_KEY(pkey,eckey) \
-        EVP_PKEY_assign((pkey), EVP_PKEY_EC, (eckey))
+#   define EVP_PKEY_assign_EC_KEY(pkey, eckey) EVP_PKEY_assign((pkey), \
+                                                               EVP_PKEY_EC, \
+                                                               (eckey))
 #  endif
 # endif
-# ifndef OPENSSL_NO_SIPHASH
-#  define EVP_PKEY_assign_SIPHASH(pkey,shkey) EVP_PKEY_assign((pkey),\
-                                        EVP_PKEY_SIPHASH,(shkey))
-# endif
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+#  ifndef OPENSSL_NO_SIPHASH
+#   define EVP_PKEY_assign_SIPHASH(pkey, shkey) EVP_PKEY_assign((pkey), \
+                                                                EVP_PKEY_SIPHASH, \
+                                                                (shkey))
+#  endif
 
-# ifndef OPENSSL_NO_POLY1305
-#  define EVP_PKEY_assign_POLY1305(pkey,polykey) EVP_PKEY_assign((pkey),\
-                                        EVP_PKEY_POLY1305,(polykey))
+#  ifndef OPENSSL_NO_POLY1305
+#   define EVP_PKEY_assign_POLY1305(pkey, polykey) EVP_PKEY_assign((pkey), \
+                                                                   EVP_PKEY_POLY1305, \
+                                                                   (polykey))
+#  endif
 # endif
 
 /* Add some extra combinations */
@@ -1370,6 +1378,7 @@ int EVP_PKEY_get_bits(const EVP_PKEY *pkey);
 # define EVP_PKEY_bits EVP_PKEY_get_bits
 int EVP_PKEY_get_security_bits(const EVP_PKEY *pkey);
 # define EVP_PKEY_security_bits EVP_PKEY_get_security_bits
+int EVP_PKEY_get_security_category(const EVP_PKEY *pkey);
 int EVP_PKEY_get_size(const EVP_PKEY *pkey);
 # define EVP_PKEY_size EVP_PKEY_get_size
 int EVP_PKEY_can_sign(const EVP_PKEY *pkey);
@@ -1457,6 +1466,7 @@ EVP_PKEY *d2i_AutoPrivateKey_ex(EVP_PKEY **a, const unsigned char **pp,
 EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp,
                              long length);
 int i2d_PrivateKey(const EVP_PKEY *a, unsigned char **pp);
+int i2d_PKCS8PrivateKey(const EVP_PKEY *a, unsigned char **pp);
 
 int i2d_KeyParams(const EVP_PKEY *a, unsigned char **pp);
 EVP_PKEY *d2i_KeyParams(int type, EVP_PKEY **a, const unsigned char **pp,
@@ -1615,25 +1625,30 @@ int EVP_PBE_get(int *ptype, int *ppbe_nid, size_t num);
 # define ASN1_PKEY_CTRL_GET1_TLS_ENCPT   0xa
 # define ASN1_PKEY_CTRL_CMS_IS_RI_TYPE_SUPPORTED 0xb
 
-int EVP_PKEY_asn1_get_count(void);
-const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx);
+# ifndef OPENSSL_NO_DEPRECATED_3_6
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_get_count(void);
+OSSL_DEPRECATEDIN_3_6 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_get0(int idx);
+OSSL_DEPRECATEDIN_3_6
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type);
+OSSL_DEPRECATEDIN_3_6
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
                                                    const char *str, int len);
-int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth);
-int EVP_PKEY_asn1_add_alias(int to, int from);
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6 int EVP_PKEY_asn1_add_alias(int to, int from);
+OSSL_DEPRECATEDIN_3_6
 int EVP_PKEY_asn1_get0_info(int *ppkey_id, int *pkey_base_id,
                             int *ppkey_flags, const char **pinfo,
                             const char **ppem_str,
                             const EVP_PKEY_ASN1_METHOD *ameth);
 
-const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
-EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
-                                        const char *pem_str,
-                                        const char *info);
-void EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst,
-                        const EVP_PKEY_ASN1_METHOD *src);
-void EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_get0_asn1(const EVP_PKEY *pkey);
+OSSL_DEPRECATEDIN_3_6 EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_new(int id, int flags,
+                                                              const char *pem_str,
+                                                              const char *info);
+OSSL_DEPRECATEDIN_3_6 void EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst,
+                                              const EVP_PKEY_ASN1_METHOD *src);
+OSSL_DEPRECATEDIN_3_6 void EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth);
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
                               int (*pub_decode) (EVP_PKEY *pk,
                                                  const X509_PUBKEY *pub),
@@ -1646,6 +1661,7 @@ void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
                                                 int indent, ASN1_PCTX *pctx),
                               int (*pkey_size) (const EVP_PKEY *pk),
                               int (*pkey_bits) (const EVP_PKEY *pk));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
                                int (*priv_decode) (EVP_PKEY *pk,
                                                    const PKCS8_PRIV_KEY_INFO
@@ -1656,6 +1672,7 @@ void EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
                                                   const EVP_PKEY *pkey,
                                                   int indent,
                                                   ASN1_PCTX *pctx));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
                              int (*param_decode) (EVP_PKEY *pkey,
                                                   const unsigned char **pder,
@@ -1672,11 +1689,14 @@ void EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
                                                  int indent,
                                                  ASN1_PCTX *pctx));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
                             void (*pkey_free) (EVP_PKEY *pkey));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*pkey_ctrl) (EVP_PKEY *pkey, int op,
                                               long arg1, void *arg2));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
                             int (*item_verify) (EVP_MD_CTX *ctx,
                                                 const ASN1_ITEM *it,
@@ -1691,41 +1711,51 @@ void EVP_PKEY_asn1_set_item(EVP_PKEY_ASN1_METHOD *ameth,
                                               X509_ALGOR *alg2,
                                               ASN1_BIT_STRING *sig));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_siginf(EVP_PKEY_ASN1_METHOD *ameth,
                               int (*siginf_set) (X509_SIG_INFO *siginf,
                                                  const X509_ALGOR *alg,
                                                  const ASN1_STRING *sig));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_check(EVP_PKEY_ASN1_METHOD *ameth,
                              int (*pkey_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_public_check(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*pkey_pub_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_param_check(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*pkey_param_check) (const EVP_PKEY *pk));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_set_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*set_priv_key) (EVP_PKEY *pk,
                                                          const unsigned char
                                                             *priv,
                                                          size_t len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_set_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*set_pub_key) (EVP_PKEY *pk,
                                                        const unsigned char *pub,
                                                        size_t len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_get_priv_key(EVP_PKEY_ASN1_METHOD *ameth,
                                     int (*get_priv_key) (const EVP_PKEY *pk,
                                                          unsigned char *priv,
                                                          size_t *len));
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_get_pub_key(EVP_PKEY_ASN1_METHOD *ameth,
                                    int (*get_pub_key) (const EVP_PKEY *pk,
                                                        unsigned char *pub,
                                                        size_t *len));
 
+OSSL_DEPRECATEDIN_3_6
 void EVP_PKEY_asn1_set_security_bits(EVP_PKEY_ASN1_METHOD *ameth,
                                      int (*pkey_security_bits) (const EVP_PKEY
                                                                 *pk));
+# endif /* OPENSSL_NO_DEPRECATED_3_6 */
 
 int EVP_PKEY_CTX_get_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD **md);
 int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md);
@@ -2037,6 +2067,9 @@ int EVP_PKEY_derive_set_peer_ex(EVP_PKEY_CTX *ctx, EVP_PKEY *peer,
                                 int validate_peer);
 int EVP_PKEY_derive_set_peer(EVP_PKEY_CTX *ctx, EVP_PKEY *peer);
 int EVP_PKEY_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen);
+EVP_SKEY *EVP_PKEY_derive_SKEY(EVP_PKEY_CTX *ctx, EVP_SKEYMGMT *mgmt,
+                               const char *key_type, const char *propquery,
+                               size_t keylen, const OSSL_PARAM params[]);
 
 int EVP_PKEY_encapsulate_init(EVP_PKEY_CTX *ctx, const OSSL_PARAM params[]);
 int EVP_PKEY_auth_encapsulate_init(EVP_PKEY_CTX *ctx, EVP_PKEY *authpriv,
@@ -2292,6 +2325,8 @@ EVP_SKEY *EVP_SKEY_generate(OSSL_LIB_CTX *libctx, const char *skeymgmtname,
 EVP_SKEY *EVP_SKEY_import_raw_key(OSSL_LIB_CTX *libctx, const char *skeymgmtname,
                                   unsigned char *key, size_t keylen,
                                   const char *propquery);
+EVP_SKEY *EVP_SKEY_import_SKEYMGMT(OSSL_LIB_CTX *libctx, EVP_SKEYMGMT *skeymgmt,
+                                   int selection, const OSSL_PARAM *params);
 int EVP_SKEY_get0_raw_key(const EVP_SKEY *skey, const unsigned char **key,
                           size_t *len);
 const char *EVP_SKEY_get0_key_id(const EVP_SKEY *skey);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/kdf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -43,6 +43,10 @@ void EVP_KDF_CTX_reset(EVP_KDF_CTX *ctx);
 size_t EVP_KDF_CTX_get_kdf_size(EVP_KDF_CTX *ctx);
 int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen,
                    const OSSL_PARAM params[]);
+int EVP_KDF_CTX_set_SKEY(EVP_KDF_CTX *ctx, EVP_SKEY *key, const char *paramname);
+EVP_SKEY *EVP_KDF_derive_SKEY(EVP_KDF_CTX *ctx, EVP_SKEYMGMT *mgmt,
+                              const char *key_type, const char *propquery,
+                              size_t keylen, const OSSL_PARAM params[]);
 int EVP_KDF_get_params(EVP_KDF *kdf, OSSL_PARAM params[]);
 int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]);
 int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/macros.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -169,6 +169,7 @@
  * 'no-deprecated'.
  */
 
+# undef OPENSSL_NO_DEPRECATED_3_6
 # undef OPENSSL_NO_DEPRECATED_3_4
 # undef OPENSSL_NO_DEPRECATED_3_1
 # undef OPENSSL_NO_DEPRECATED_3_0
@@ -179,6 +180,17 @@
 # undef OPENSSL_NO_DEPRECATED_1_0_0
 # undef OPENSSL_NO_DEPRECATED_0_9_8
 
+# if OPENSSL_API_LEVEL >= 30600
+#  ifndef OPENSSL_NO_DEPRECATED
+#   define OSSL_DEPRECATEDIN_3_6                OSSL_DEPRECATED(3.6)
+#   define OSSL_DEPRECATEDIN_3_6_FOR(msg)       OSSL_DEPRECATED_FOR(3.6, msg)
+#  else
+#   define OPENSSL_NO_DEPRECATED_3_6
+#  endif
+# else
+#  define OSSL_DEPRECATEDIN_3_6
+#  define OSSL_DEPRECATEDIN_3_6_FOR(msg)
+# endif
 # if OPENSSL_API_LEVEL >= 30500
 #  ifndef OPENSSL_NO_DEPRECATED
 #   define OSSL_DEPRECATEDIN_3_5                OSSL_DEPRECATED(3.5)

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/obj_mac.h

@@ -778,6 +778,10 @@
 #define NID_id_smime_cti                195
 #define OBJ_id_smime_cti                OBJ_SMIME,6L
 
+#define SN_id_smime_ori         "id-smime-ori"
+#define NID_id_smime_ori                1499
+#define OBJ_id_smime_ori                OBJ_SMIME,13L
+
 #define SN_id_smime_mod_cms             "id-smime-mod-cms"
 #define NID_id_smime_mod_cms            196
 #define OBJ_id_smime_mod_cms            OBJ_id_smime_mod,1L
@@ -1062,6 +1066,21 @@
 #define NID_id_alg_PWRI_KEK             893
 #define OBJ_id_alg_PWRI_KEK             OBJ_id_smime_alg,9L
 
+#define SN_HKDF_SHA256          "id-alg-hkdf-with-sha256"
+#define LN_HKDF_SHA256          "HKDF-SHA256"
+#define NID_HKDF_SHA256         1496
+#define OBJ_HKDF_SHA256         OBJ_id_smime_alg,28L
+
+#define SN_HKDF_SHA384          "id-alg-hkdf-with-sha384"
+#define LN_HKDF_SHA384          "HKDF-SHA384"
+#define NID_HKDF_SHA384         1497
+#define OBJ_HKDF_SHA384         OBJ_id_smime_alg,29L
+
+#define SN_HKDF_SHA512          "id-alg-hkdf-with-sha512"
+#define LN_HKDF_SHA512          "HKDF-SHA512"
+#define NID_HKDF_SHA512         1498
+#define OBJ_HKDF_SHA512         OBJ_id_smime_alg,30L
+
 #define SN_id_smime_cd_ldap             "id-smime-cd-ldap"
 #define NID_id_smime_cd_ldap            248
 #define OBJ_id_smime_cd_ldap            OBJ_id_smime_cd,1L
@@ -1098,6 +1117,10 @@
 #define NID_id_smime_cti_ets_proofOfCreation            256
 #define OBJ_id_smime_cti_ets_proofOfCreation            OBJ_id_smime_cti,6L
 
+#define SN_id_smime_ori_kem             "id-smime-ori-kem"
+#define NID_id_smime_ori_kem            1500
+#define OBJ_id_smime_ori_kem            OBJ_id_smime_ori,3L
+
 #define LN_friendlyName         "friendlyName"
 #define NID_friendlyName                156
 #define OBJ_friendlyName                OBJ_pkcs9,20L
@@ -5458,6 +5481,42 @@
 #define LN_chacha20             "chacha20"
 #define NID_chacha20            1019
 
+#define SN_aes_128_cbc_hmac_sha1_etm            "AES-128-CBC-HMAC-SHA1-ETM"
+#define LN_aes_128_cbc_hmac_sha1_etm            "aes-128-cbc-hmac-sha1-etm"
+#define NID_aes_128_cbc_hmac_sha1_etm           1487
+
+#define SN_aes_192_cbc_hmac_sha1_etm            "AES-192-CBC-HMAC-SHA1-ETM"
+#define LN_aes_192_cbc_hmac_sha1_etm            "aes-192-cbc-hmac-sha1-etm"
+#define NID_aes_192_cbc_hmac_sha1_etm           1488
+
+#define SN_aes_256_cbc_hmac_sha1_etm            "AES-256-CBC-HMAC-SHA1-ETM"
+#define LN_aes_256_cbc_hmac_sha1_etm            "aes-256-cbc-hmac-sha1-etm"
+#define NID_aes_256_cbc_hmac_sha1_etm           1489
+
+#define SN_aes_128_cbc_hmac_sha256_etm          "AES-128-CBC-HMAC-SHA256-ETM"
+#define LN_aes_128_cbc_hmac_sha256_etm          "aes-128-cbc-hmac-sha256-etm"
+#define NID_aes_128_cbc_hmac_sha256_etm         1490
+
+#define SN_aes_192_cbc_hmac_sha256_etm          "AES-192-CBC-HMAC-SHA256-ETM"
+#define LN_aes_192_cbc_hmac_sha256_etm          "aes-192-cbc-hmac-sha256-etm"
+#define NID_aes_192_cbc_hmac_sha256_etm         1491
+
+#define SN_aes_256_cbc_hmac_sha256_etm          "AES-256-CBC-HMAC-SHA256-ETM"
+#define LN_aes_256_cbc_hmac_sha256_etm          "aes-256-cbc-hmac-sha256-etm"
+#define NID_aes_256_cbc_hmac_sha256_etm         1492
+
+#define SN_aes_128_cbc_hmac_sha512_etm          "AES-128-CBC-HMAC-SHA512-ETM"
+#define LN_aes_128_cbc_hmac_sha512_etm          "aes-128-cbc-hmac-sha512-etm"
+#define NID_aes_128_cbc_hmac_sha512_etm         1493
+
+#define SN_aes_192_cbc_hmac_sha512_etm          "AES-192-CBC-HMAC-SHA512-ETM"
+#define LN_aes_192_cbc_hmac_sha512_etm          "aes-192-cbc-hmac-sha512-etm"
+#define NID_aes_192_cbc_hmac_sha512_etm         1494
+
+#define SN_aes_256_cbc_hmac_sha512_etm          "AES-256-CBC-HMAC-SHA512-ETM"
+#define LN_aes_256_cbc_hmac_sha512_etm          "aes-256-cbc-hmac-sha512-etm"
+#define NID_aes_256_cbc_hmac_sha512_etm         1495
+
 #define SN_dhpublicnumber               "dhpublicnumber"
 #define LN_dhpublicnumber               "X9.42 DH"
 #define NID_dhpublicnumber              920

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ocsp.h

@@ -107,7 +107,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_CERTID, OCSP_CERTID, OCSP_CERTID)
 #define sk_OCSP_CERTID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr))
 #define sk_OCSP_CERTID_pop(sk) ((OCSP_CERTID *)OPENSSL_sk_pop(ossl_check_OCSP_CERTID_sk_type(sk)))
 #define sk_OCSP_CERTID_shift(sk) ((OCSP_CERTID *)OPENSSL_sk_shift(ossl_check_OCSP_CERTID_sk_type(sk)))
-#define sk_OCSP_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_CERTID_sk_type(sk),ossl_check_OCSP_CERTID_freefunc_type(freefunc))
+#define sk_OCSP_CERTID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_freefunc_type(freefunc))
 #define sk_OCSP_CERTID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr), (idx))
 #define sk_OCSP_CERTID_set(sk, idx, ptr) ((OCSP_CERTID *)OPENSSL_sk_set(ossl_check_OCSP_CERTID_sk_type(sk), (idx), ossl_check_OCSP_CERTID_type(ptr)))
 #define sk_OCSP_CERTID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_CERTID_sk_type(sk), ossl_check_OCSP_CERTID_type(ptr))
@@ -133,7 +133,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_ONEREQ, OCSP_ONEREQ, OCSP_ONEREQ)
 #define sk_OCSP_ONEREQ_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr))
 #define sk_OCSP_ONEREQ_pop(sk) ((OCSP_ONEREQ *)OPENSSL_sk_pop(ossl_check_OCSP_ONEREQ_sk_type(sk)))
 #define sk_OCSP_ONEREQ_shift(sk) ((OCSP_ONEREQ *)OPENSSL_sk_shift(ossl_check_OCSP_ONEREQ_sk_type(sk)))
-#define sk_OCSP_ONEREQ_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_ONEREQ_sk_type(sk),ossl_check_OCSP_ONEREQ_freefunc_type(freefunc))
+#define sk_OCSP_ONEREQ_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_freefunc_type(freefunc))
 #define sk_OCSP_ONEREQ_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr), (idx))
 #define sk_OCSP_ONEREQ_set(sk, idx, ptr) ((OCSP_ONEREQ *)OPENSSL_sk_set(ossl_check_OCSP_ONEREQ_sk_type(sk), (idx), ossl_check_OCSP_ONEREQ_type(ptr)))
 #define sk_OCSP_ONEREQ_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_ONEREQ_sk_type(sk), ossl_check_OCSP_ONEREQ_type(ptr))
@@ -173,7 +173,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_RESPID, OCSP_RESPID, OCSP_RESPID)
 #define sk_OCSP_RESPID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr))
 #define sk_OCSP_RESPID_pop(sk) ((OCSP_RESPID *)OPENSSL_sk_pop(ossl_check_OCSP_RESPID_sk_type(sk)))
 #define sk_OCSP_RESPID_shift(sk) ((OCSP_RESPID *)OPENSSL_sk_shift(ossl_check_OCSP_RESPID_sk_type(sk)))
-#define sk_OCSP_RESPID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_RESPID_sk_type(sk),ossl_check_OCSP_RESPID_freefunc_type(freefunc))
+#define sk_OCSP_RESPID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_freefunc_type(freefunc))
 #define sk_OCSP_RESPID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr), (idx))
 #define sk_OCSP_RESPID_set(sk, idx, ptr) ((OCSP_RESPID *)OPENSSL_sk_set(ossl_check_OCSP_RESPID_sk_type(sk), (idx), ossl_check_OCSP_RESPID_type(ptr)))
 #define sk_OCSP_RESPID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_RESPID_sk_type(sk), ossl_check_OCSP_RESPID_type(ptr))
@@ -210,7 +210,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OCSP_SINGLERESP, OCSP_SINGLERESP, OCSP_SINGLERESP)
 #define sk_OCSP_SINGLERESP_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr))
 #define sk_OCSP_SINGLERESP_pop(sk) ((OCSP_SINGLERESP *)OPENSSL_sk_pop(ossl_check_OCSP_SINGLERESP_sk_type(sk)))
 #define sk_OCSP_SINGLERESP_shift(sk) ((OCSP_SINGLERESP *)OPENSSL_sk_shift(ossl_check_OCSP_SINGLERESP_sk_type(sk)))
-#define sk_OCSP_SINGLERESP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_SINGLERESP_sk_type(sk),ossl_check_OCSP_SINGLERESP_freefunc_type(freefunc))
+#define sk_OCSP_SINGLERESP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_freefunc_type(freefunc))
 #define sk_OCSP_SINGLERESP_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr), (idx))
 #define sk_OCSP_SINGLERESP_set(sk, idx, ptr) ((OCSP_SINGLERESP *)OPENSSL_sk_set(ossl_check_OCSP_SINGLERESP_sk_type(sk), (idx), ossl_check_OCSP_SINGLERESP_type(ptr)))
 #define sk_OCSP_SINGLERESP_find(sk, ptr) OPENSSL_sk_find(ossl_check_OCSP_SINGLERESP_sk_type(sk), ossl_check_OCSP_SINGLERESP_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/opensslv.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/opensslv.h.in
  *
- * Copyright 1999-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -28,8 +28,8 @@ extern "C" {
  * These macros express version number MAJOR.MINOR.PATCH exactly
  */
 # define OPENSSL_VERSION_MAJOR  3
-# define OPENSSL_VERSION_MINOR  5
-# define OPENSSL_VERSION_PATCH  1
+# define OPENSSL_VERSION_MINOR  6
+# define OPENSSL_VERSION_PATCH  0
 
 /*
  * Additional version information
@@ -74,33 +74,28 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.5.1"
-# define OPENSSL_FULL_VERSION_STR "3.5.1"
+# define OPENSSL_VERSION_STR "3.6.0"
+# define OPENSSL_FULL_VERSION_STR "3.6.0"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "1 Jul 2025"
+# define OPENSSL_RELEASE_DATE "1 Oct 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.5.1 1 Jul 2025"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.6.0 1 Oct 2025"
 
-/* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
-# ifdef OPENSSL_VERSION_PRE_RELEASE
-#  define _OPENSSL_VERSION_PRE_RELEASE 0x0L
-# else
-#  define _OPENSSL_VERSION_PRE_RELEASE 0xfL
-# endif
+/* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PP0L */
 # define OPENSSL_VERSION_NUMBER          \
     ( (OPENSSL_VERSION_MAJOR<<28)        \
       |(OPENSSL_VERSION_MINOR<<20)       \
       |(OPENSSL_VERSION_PATCH<<4)        \
-      |_OPENSSL_VERSION_PRE_RELEASE )
+      |0x0L )
 
 # ifdef  __cplusplus
 }

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/params.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -157,6 +157,9 @@ OSSL_PARAM *OSSL_PARAM_dup(const OSSL_PARAM *p);
 OSSL_PARAM *OSSL_PARAM_merge(const OSSL_PARAM *p1, const OSSL_PARAM *p2);
 void OSSL_PARAM_free(OSSL_PARAM *p);
 
+int OSSL_PARAM_set_octet_string_or_ptr(OSSL_PARAM *p, const void *val,
+                                       size_t len);
+
 # ifdef  __cplusplus
 }
 # endif

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pem.h

@@ -57,6 +57,7 @@ extern "C" {
 # define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY"
 # define PEM_STRING_PARAMETERS   "PARAMETERS"
 # define PEM_STRING_CMS          "CMS"
+# define PEM_STRING_SM2PRIVATEKEY "SM2 PRIVATE KEY"
 # define PEM_STRING_SM2PARAMETERS "SM2 PARAMETERS"
 # define PEM_STRING_ACERT        "ATTRIBUTE CERTIFICATE"
 

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pkcs12.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/pkcs12.h.in
  *
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -44,8 +44,14 @@ extern "C" {
 
 # define PKCS12_MAC_KEY_LENGTH 20
 
-/* The macro is expected to be used only internally. Kept for backwards compatibility. */
-# define PKCS12_SALT_LEN 8
+/*
+ * The macro is expected to be used only internally. Kept for
+ * backwards compatibility. NIST requires 16, previous value was
+ * 8. Allow to override this at compile time.
+ */
+# ifndef PKCS12_SALT_LEN
+#  define PKCS12_SALT_LEN 16
+# endif
 
 /* It's not clear if these are actually needed... */
 # define PKCS12_key_gen PKCS12_key_gen_utf8
@@ -77,7 +83,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS12_SAFEBAG, PKCS12_SAFEBAG, PKCS12_SAFEBAG)
 #define sk_PKCS12_SAFEBAG_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr))
 #define sk_PKCS12_SAFEBAG_pop(sk) ((PKCS12_SAFEBAG *)OPENSSL_sk_pop(ossl_check_PKCS12_SAFEBAG_sk_type(sk)))
 #define sk_PKCS12_SAFEBAG_shift(sk) ((PKCS12_SAFEBAG *)OPENSSL_sk_shift(ossl_check_PKCS12_SAFEBAG_sk_type(sk)))
-#define sk_PKCS12_SAFEBAG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS12_SAFEBAG_sk_type(sk),ossl_check_PKCS12_SAFEBAG_freefunc_type(freefunc))
+#define sk_PKCS12_SAFEBAG_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_freefunc_type(freefunc))
 #define sk_PKCS12_SAFEBAG_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr), (idx))
 #define sk_PKCS12_SAFEBAG_set(sk, idx, ptr) ((PKCS12_SAFEBAG *)OPENSSL_sk_set(ossl_check_PKCS12_SAFEBAG_sk_type(sk), (idx), ossl_check_PKCS12_SAFEBAG_type(ptr)))
 #define sk_PKCS12_SAFEBAG_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS12_SAFEBAG_sk_type(sk), ossl_check_PKCS12_SAFEBAG_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/pkcs7.h

@@ -81,7 +81,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7_SIGNER_INFO, PKCS7_SIGNER_INFO, PKCS7_SIGNER_
 #define sk_PKCS7_SIGNER_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr))
 #define sk_PKCS7_SIGNER_INFO_pop(sk) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_pop(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk)))
 #define sk_PKCS7_SIGNER_INFO_shift(sk) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_shift(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk)))
-#define sk_PKCS7_SIGNER_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk),ossl_check_PKCS7_SIGNER_INFO_freefunc_type(freefunc))
+#define sk_PKCS7_SIGNER_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_freefunc_type(freefunc))
 #define sk_PKCS7_SIGNER_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr), (idx))
 #define sk_PKCS7_SIGNER_INFO_set(sk, idx, ptr) ((PKCS7_SIGNER_INFO *)OPENSSL_sk_set(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), (idx), ossl_check_PKCS7_SIGNER_INFO_type(ptr)))
 #define sk_PKCS7_SIGNER_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_SIGNER_INFO_sk_type(sk), ossl_check_PKCS7_SIGNER_INFO_type(ptr))
@@ -117,7 +117,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7_RECIP_INFO, PKCS7_RECIP_INFO, PKCS7_RECIP_INF
 #define sk_PKCS7_RECIP_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr))
 #define sk_PKCS7_RECIP_INFO_pop(sk) ((PKCS7_RECIP_INFO *)OPENSSL_sk_pop(ossl_check_PKCS7_RECIP_INFO_sk_type(sk)))
 #define sk_PKCS7_RECIP_INFO_shift(sk) ((PKCS7_RECIP_INFO *)OPENSSL_sk_shift(ossl_check_PKCS7_RECIP_INFO_sk_type(sk)))
-#define sk_PKCS7_RECIP_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_RECIP_INFO_sk_type(sk),ossl_check_PKCS7_RECIP_INFO_freefunc_type(freefunc))
+#define sk_PKCS7_RECIP_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_freefunc_type(freefunc))
 #define sk_PKCS7_RECIP_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr), (idx))
 #define sk_PKCS7_RECIP_INFO_set(sk, idx, ptr) ((PKCS7_RECIP_INFO *)OPENSSL_sk_set(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), (idx), ossl_check_PKCS7_RECIP_INFO_type(ptr)))
 #define sk_PKCS7_RECIP_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_RECIP_INFO_sk_type(sk), ossl_check_PKCS7_RECIP_INFO_type(ptr))
@@ -232,7 +232,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PKCS7, PKCS7, PKCS7)
 #define sk_PKCS7_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr))
 #define sk_PKCS7_pop(sk) ((PKCS7 *)OPENSSL_sk_pop(ossl_check_PKCS7_sk_type(sk)))
 #define sk_PKCS7_shift(sk) ((PKCS7 *)OPENSSL_sk_shift(ossl_check_PKCS7_sk_type(sk)))
-#define sk_PKCS7_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_sk_type(sk),ossl_check_PKCS7_freefunc_type(freefunc))
+#define sk_PKCS7_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_freefunc_type(freefunc))
 #define sk_PKCS7_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr), (idx))
 #define sk_PKCS7_set(sk, idx, ptr) ((PKCS7 *)OPENSSL_sk_set(ossl_check_PKCS7_sk_type(sk), (idx), ossl_check_PKCS7_type(ptr)))
 #define sk_PKCS7_find(sk, ptr) OPENSSL_sk_find(ossl_check_PKCS7_sk_type(sk), ossl_check_PKCS7_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/proverr.h

@@ -49,6 +49,7 @@
 # define PROV_R_FINAL_CALL_OUT_OF_ORDER                   237
 # define PROV_R_FIPS_MODULE_CONDITIONAL_ERROR             227
 # define PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE          224
+# define PROV_R_FIPS_MODULE_IMPORT_PCT_ERROR              253
 # define PROV_R_FIPS_MODULE_IN_ERROR_STATE                225
 # define PROV_R_GENERATE_ERROR                            191
 # define PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE       165
@@ -133,6 +134,7 @@
 # define PROV_R_PATH_MUST_BE_ABSOLUTE                     219
 # define PROV_R_PERSONALISATION_STRING_TOO_LONG           195
 # define PROV_R_PSS_SALTLEN_TOO_SMALL                     172
+# define PROV_R_REPEATED_PARAMETER                        252
 # define PROV_R_REQUEST_TOO_LARGE_FOR_DRBG                196
 # define PROV_R_REQUIRE_CTR_MODE_CIPHER                   206
 # define PROV_R_RESEED_ERROR                              197

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/safestack.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/safestack.h.in
  *
- * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -36,6 +36,11 @@ extern "C" {
     typedef int (*sk_##t1##_compfunc)(const t3 * const *a, const t3 *const *b); \
     typedef void (*sk_##t1##_freefunc)(t3 *a); \
     typedef t3 * (*sk_##t1##_copyfunc)(const t3 *a); \
+    static ossl_inline void sk_##t1##_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) \
+    { \
+        sk_##t1##_freefunc freefunc = (sk_##t1##_freefunc) freefunc_arg; \
+        freefunc((t3 *)ptr); \
+    } \
     static ossl_unused ossl_inline t2 *ossl_check_##t1##_type(t2 *ptr) \
     { \
         return ptr; \
@@ -66,6 +71,11 @@ extern "C" {
     typedef int (*sk_##t1##_compfunc)(const t3 * const *a, const t3 *const *b); \
     typedef void (*sk_##t1##_freefunc)(t3 *a); \
     typedef t3 * (*sk_##t1##_copyfunc)(const t3 *a); \
+    static ossl_inline void sk_##t1##_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) \
+    { \
+        sk_##t1##_freefunc freefunc = (sk_##t1##_freefunc) freefunc_arg;\
+        freefunc((t3 *)ptr);\
+    } \
     static ossl_unused ossl_inline int sk_##t1##_num(const STACK_OF(t1) *sk) \
     { \
         return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \
@@ -76,7 +86,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new(sk_##t1##_compfunc compare) \
     { \
-        return (STACK_OF(t1) *)OPENSSL_sk_new((OPENSSL_sk_compfunc)compare); \
+        OPENSSL_STACK *ret = OPENSSL_sk_new((OPENSSL_sk_compfunc)compare); \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        return (STACK_OF(t1) *)OPENSSL_sk_set_thunks(ret, f_thunk); \
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new_null(void) \
     { \
@@ -84,7 +98,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline STACK_OF(t1) *sk_##t1##_new_reserve(sk_##t1##_compfunc compare, int n) \
     { \
-        return (STACK_OF(t1) *)OPENSSL_sk_new_reserve((OPENSSL_sk_compfunc)compare, n); \
+        OPENSSL_STACK *ret = OPENSSL_sk_new_reserve((OPENSSL_sk_compfunc)compare, n); \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        return (STACK_OF(t1) *)OPENSSL_sk_set_thunks(ret, f_thunk); \
     } \
     static ossl_unused ossl_inline int sk_##t1##_reserve(STACK_OF(t1) *sk, int n) \
     { \
@@ -125,6 +143,11 @@ extern "C" {
     } \
     static ossl_unused ossl_inline void sk_##t1##_pop_free(STACK_OF(t1) *sk, sk_##t1##_freefunc freefunc) \
     { \
+        OPENSSL_sk_freefunc_thunk f_thunk; \
+        \
+        f_thunk = (OPENSSL_sk_freefunc_thunk)sk_##t1##_freefunc_thunk; \
+        sk = (STACK_OF(t1) *)OPENSSL_sk_set_thunks((OPENSSL_STACK *)sk, f_thunk); \
+        \
         OPENSSL_sk_pop_free((OPENSSL_STACK *)sk, (OPENSSL_sk_freefunc)freefunc); \
     } \
     static ossl_unused ossl_inline int sk_##t1##_insert(STACK_OF(t1) *sk, t2 *ptr, int idx) \
@@ -217,7 +240,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_STRING, char, char)
 #define sk_OPENSSL_STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr))
 #define sk_OPENSSL_STRING_pop(sk) ((char *)OPENSSL_sk_pop(ossl_check_OPENSSL_STRING_sk_type(sk)))
 #define sk_OPENSSL_STRING_shift(sk) ((char *)OPENSSL_sk_shift(ossl_check_OPENSSL_STRING_sk_type(sk)))
-#define sk_OPENSSL_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_STRING_sk_type(sk),ossl_check_OPENSSL_STRING_freefunc_type(freefunc))
+#define sk_OPENSSL_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_freefunc_type(freefunc))
 #define sk_OPENSSL_STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr), (idx))
 #define sk_OPENSSL_STRING_set(sk, idx, ptr) ((char *)OPENSSL_sk_set(ossl_check_OPENSSL_STRING_sk_type(sk), (idx), ossl_check_OPENSSL_STRING_type(ptr)))
 #define sk_OPENSSL_STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_STRING_sk_type(sk), ossl_check_OPENSSL_STRING_type(ptr))
@@ -243,7 +266,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_CSTRING, const char, char)
 #define sk_OPENSSL_CSTRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr))
 #define sk_OPENSSL_CSTRING_pop(sk) ((const char *)OPENSSL_sk_pop(ossl_check_OPENSSL_CSTRING_sk_type(sk)))
 #define sk_OPENSSL_CSTRING_shift(sk) ((const char *)OPENSSL_sk_shift(ossl_check_OPENSSL_CSTRING_sk_type(sk)))
-#define sk_OPENSSL_CSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_CSTRING_sk_type(sk),ossl_check_OPENSSL_CSTRING_freefunc_type(freefunc))
+#define sk_OPENSSL_CSTRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_freefunc_type(freefunc))
 #define sk_OPENSSL_CSTRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr), (idx))
 #define sk_OPENSSL_CSTRING_set(sk, idx, ptr) ((const char *)OPENSSL_sk_set(ossl_check_OPENSSL_CSTRING_sk_type(sk), (idx), ossl_check_OPENSSL_CSTRING_type(ptr)))
 #define sk_OPENSSL_CSTRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_CSTRING_sk_type(sk), ossl_check_OPENSSL_CSTRING_type(ptr))
@@ -277,7 +300,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OPENSSL_BLOCK, void, void)
 #define sk_OPENSSL_BLOCK_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr))
 #define sk_OPENSSL_BLOCK_pop(sk) ((void *)OPENSSL_sk_pop(ossl_check_OPENSSL_BLOCK_sk_type(sk)))
 #define sk_OPENSSL_BLOCK_shift(sk) ((void *)OPENSSL_sk_shift(ossl_check_OPENSSL_BLOCK_sk_type(sk)))
-#define sk_OPENSSL_BLOCK_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_BLOCK_sk_type(sk),ossl_check_OPENSSL_BLOCK_freefunc_type(freefunc))
+#define sk_OPENSSL_BLOCK_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_freefunc_type(freefunc))
 #define sk_OPENSSL_BLOCK_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr), (idx))
 #define sk_OPENSSL_BLOCK_set(sk, idx, ptr) ((void *)OPENSSL_sk_set(ossl_check_OPENSSL_BLOCK_sk_type(sk), (idx), ossl_check_OPENSSL_BLOCK_type(ptr)))
 #define sk_OPENSSL_BLOCK_find(sk, ptr) OPENSSL_sk_find(ossl_check_OPENSSL_BLOCK_sk_type(sk), ossl_check_OPENSSL_BLOCK_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/self_test.h

@@ -31,6 +31,7 @@ extern "C" {
 # define OSSL_SELF_TEST_TYPE_CRNG               "Continuous_RNG_Test"
 # define OSSL_SELF_TEST_TYPE_PCT                "Conditional_PCT"
 # define OSSL_SELF_TEST_TYPE_PCT_KAT            "Conditional_KAT"
+# define OSSL_SELF_TEST_TYPE_PCT_IMPORT         "Import_PCT"
 # define OSSL_SELF_TEST_TYPE_KAT_INTEGRITY      "KAT_Integrity"
 # define OSSL_SELF_TEST_TYPE_KAT_CIPHER         "KAT_Cipher"
 # define OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER    "KAT_AsymmetricCipher"
@@ -50,6 +51,7 @@ extern "C" {
 # define OSSL_SELF_TEST_DESC_PCT_RSA_PKCS1  "RSA"
 # define OSSL_SELF_TEST_DESC_PCT_ECDSA      "ECDSA"
 # define OSSL_SELF_TEST_DESC_PCT_EDDSA      "EDDSA"
+# define OSSL_SELF_TEST_DESC_PCT_DH         "DH"
 # define OSSL_SELF_TEST_DESC_PCT_DSA        "DSA"
 # define OSSL_SELF_TEST_DESC_PCT_ML_DSA     "ML-DSA"
 # define OSSL_SELF_TEST_DESC_PCT_ML_KEM     "ML-KEM"
@@ -65,7 +67,9 @@ extern "C" {
 # define OSSL_SELF_TEST_DESC_SIGN_DSA       "DSA"
 # define OSSL_SELF_TEST_DESC_SIGN_RSA       "RSA"
 # define OSSL_SELF_TEST_DESC_SIGN_ECDSA     "ECDSA"
+# define OSSL_SELF_TEST_DESC_SIGN_DetECDSA  "DetECDSA"
 # define OSSL_SELF_TEST_DESC_SIGN_EDDSA     "EDDSA"
+# define OSSL_SELF_TEST_DESC_SIGN_LMS       "LMS"
 # define OSSL_SELF_TEST_DESC_SIGN_ML_DSA    "ML-DSA"
 # define OSSL_SELF_TEST_DESC_SIGN_SLH_DSA   "SLH-DSA"
 # define OSSL_SELF_TEST_DESC_KEM            "KEM"

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/srp.h

@@ -59,7 +59,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_gN_cache, SRP_gN_cache, SRP_gN_cache)
 #define sk_SRP_gN_cache_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr))
 #define sk_SRP_gN_cache_pop(sk) ((SRP_gN_cache *)OPENSSL_sk_pop(ossl_check_SRP_gN_cache_sk_type(sk)))
 #define sk_SRP_gN_cache_shift(sk) ((SRP_gN_cache *)OPENSSL_sk_shift(ossl_check_SRP_gN_cache_sk_type(sk)))
-#define sk_SRP_gN_cache_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_cache_sk_type(sk),ossl_check_SRP_gN_cache_freefunc_type(freefunc))
+#define sk_SRP_gN_cache_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_freefunc_type(freefunc))
 #define sk_SRP_gN_cache_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr), (idx))
 #define sk_SRP_gN_cache_set(sk, idx, ptr) ((SRP_gN_cache *)OPENSSL_sk_set(ossl_check_SRP_gN_cache_sk_type(sk), (idx), ossl_check_SRP_gN_cache_type(ptr)))
 #define sk_SRP_gN_cache_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_gN_cache_sk_type(sk), ossl_check_SRP_gN_cache_type(ptr))
@@ -99,7 +99,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_user_pwd, SRP_user_pwd, SRP_user_pwd)
 #define sk_SRP_user_pwd_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr))
 #define sk_SRP_user_pwd_pop(sk) ((SRP_user_pwd *)OPENSSL_sk_pop(ossl_check_SRP_user_pwd_sk_type(sk)))
 #define sk_SRP_user_pwd_shift(sk) ((SRP_user_pwd *)OPENSSL_sk_shift(ossl_check_SRP_user_pwd_sk_type(sk)))
-#define sk_SRP_user_pwd_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_user_pwd_sk_type(sk),ossl_check_SRP_user_pwd_freefunc_type(freefunc))
+#define sk_SRP_user_pwd_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_freefunc_type(freefunc))
 #define sk_SRP_user_pwd_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr), (idx))
 #define sk_SRP_user_pwd_set(sk, idx, ptr) ((SRP_user_pwd *)OPENSSL_sk_set(ossl_check_SRP_user_pwd_sk_type(sk), (idx), ossl_check_SRP_user_pwd_type(ptr)))
 #define sk_SRP_user_pwd_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_user_pwd_sk_type(sk), ossl_check_SRP_user_pwd_type(ptr))
@@ -158,7 +158,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRP_gN, SRP_gN, SRP_gN)
 #define sk_SRP_gN_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr))
 #define sk_SRP_gN_pop(sk) ((SRP_gN *)OPENSSL_sk_pop(ossl_check_SRP_gN_sk_type(sk)))
 #define sk_SRP_gN_shift(sk) ((SRP_gN *)OPENSSL_sk_shift(ossl_check_SRP_gN_sk_type(sk)))
-#define sk_SRP_gN_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_sk_type(sk),ossl_check_SRP_gN_freefunc_type(freefunc))
+#define sk_SRP_gN_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_freefunc_type(freefunc))
 #define sk_SRP_gN_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr), (idx))
 #define sk_SRP_gN_set(sk, idx, ptr) ((SRP_gN *)OPENSSL_sk_set(ossl_check_SRP_gN_sk_type(sk), (idx), ossl_check_SRP_gN_type(ptr)))
 #define sk_SRP_gN_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRP_gN_sk_type(sk), ossl_check_SRP_gN_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ssl.h

@@ -258,7 +258,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SRTP_PROTECTION_PROFILE, SRTP_PROTECTION_PROFILE, S
 #define sk_SRTP_PROTECTION_PROFILE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr))
 #define sk_SRTP_PROTECTION_PROFILE_pop(sk) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_pop(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk)))
 #define sk_SRTP_PROTECTION_PROFILE_shift(sk) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_shift(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk)))
-#define sk_SRTP_PROTECTION_PROFILE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk),ossl_check_SRTP_PROTECTION_PROFILE_freefunc_type(freefunc))
+#define sk_SRTP_PROTECTION_PROFILE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_freefunc_type(freefunc))
 #define sk_SRTP_PROTECTION_PROFILE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr), (idx))
 #define sk_SRTP_PROTECTION_PROFILE_set(sk, idx, ptr) ((SRTP_PROTECTION_PROFILE *)OPENSSL_sk_set(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), (idx), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr)))
 #define sk_SRTP_PROTECTION_PROFILE_find(sk, ptr) OPENSSL_sk_find(ossl_check_SRTP_PROTECTION_PROFILE_sk_type(sk), ossl_check_SRTP_PROTECTION_PROFILE_type(ptr))
@@ -401,13 +401,16 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
 # define SSL_OP_ENABLE_MIDDLEBOX_COMPAT                  SSL_OP_BIT(20)
     /*
      * Prioritize Chacha20Poly1305 when client does.
-     * Modifies SSL_OP_CIPHER_SERVER_PREFERENCE
+     * Modifies SSL_OP_SERVER_PREFERENCE
      */
 # define SSL_OP_PRIORITIZE_CHACHA                        SSL_OP_BIT(21)
     /*
-     * Set on servers to choose the cipher according to server's preferences.
+     * Set on servers to choose cipher, curve or group according to server's
+     * preferences.
      */
-# define SSL_OP_CIPHER_SERVER_PREFERENCE                 SSL_OP_BIT(22)
+# define SSL_OP_SERVER_PREFERENCE                        SSL_OP_BIT(22)
+    /* Equivalent definition for backwards compatibility: */
+# define SSL_OP_CIPHER_SERVER_PREFERENCE SSL_OP_SERVER_PREFERENCE
     /*
      * If set, a server will allow a client to issue an SSLv3.0 version
      * number as latest version supported in the premaster secret, even when
@@ -446,8 +449,8 @@ typedef int (*SSL_async_callback_fn)(SSL *s, void *arg);
 # define SSL_OP_NO_RX_CERTIFICATE_COMPRESSION            SSL_OP_BIT(33)
     /* Enable KTLS TX zerocopy on Linux */
 # define SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE         SSL_OP_BIT(34)
-
-#define SSL_OP_PREFER_NO_DHE_KEX                         SSL_OP_BIT(35)
+# define SSL_OP_PREFER_NO_DHE_KEX                        SSL_OP_BIT(35)
+# define SSL_OP_LEGACY_EC_POINT_FORMATS                  SSL_OP_BIT(36)
 
 /*
  * Option "collections."
@@ -824,7 +827,7 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
 # endif
 
 __owur int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
-                                 const unsigned char *in, unsigned int inlen,
+                                 const unsigned char *server, unsigned int server_len,
                                  const unsigned char *client,
                                  unsigned int client_len);
 
@@ -1010,7 +1013,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SSL_CIPHER, const SSL_CIPHER, SSL_CIPHER)
 #define sk_SSL_CIPHER_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr))
 #define sk_SSL_CIPHER_pop(sk) ((const SSL_CIPHER *)OPENSSL_sk_pop(ossl_check_SSL_CIPHER_sk_type(sk)))
 #define sk_SSL_CIPHER_shift(sk) ((const SSL_CIPHER *)OPENSSL_sk_shift(ossl_check_SSL_CIPHER_sk_type(sk)))
-#define sk_SSL_CIPHER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_CIPHER_sk_type(sk),ossl_check_SSL_CIPHER_freefunc_type(freefunc))
+#define sk_SSL_CIPHER_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_freefunc_type(freefunc))
 #define sk_SSL_CIPHER_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr), (idx))
 #define sk_SSL_CIPHER_set(sk, idx, ptr) ((const SSL_CIPHER *)OPENSSL_sk_set(ossl_check_SSL_CIPHER_sk_type(sk), (idx), ossl_check_SSL_CIPHER_type(ptr)))
 #define sk_SSL_CIPHER_find(sk, ptr) OPENSSL_sk_find(ossl_check_SSL_CIPHER_sk_type(sk), ossl_check_SSL_CIPHER_type(ptr))
@@ -1386,6 +1389,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 # define SSL_CTRL_GET0_IMPLEMENTED_GROUPS        139
 # define SSL_CTRL_GET_SIGNATURE_NAME             140
 # define SSL_CTRL_GET_PEER_SIGNATURE_NAME        141
+# define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP_EX        142
+# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP_EX        143
 # define SSL_CERT_SET_FIRST                      1
 # define SSL_CERT_SET_NEXT                       2
 # define SSL_CERT_SET_SERVER                     3
@@ -2404,6 +2409,8 @@ __owur SSL *SSL_new_stream(SSL *s, uint64_t flags);
 __owur int SSL_set_incoming_stream_policy(SSL *s, int policy, uint64_t aec);
 
 #define SSL_ACCEPT_STREAM_NO_BLOCK      (1U << 0)
+#define SSL_ACCEPT_STREAM_UNI           (1U << 1)
+#define SSL_ACCEPT_STREAM_BIDI          (1U << 2)
 __owur SSL *SSL_accept_stream(SSL *s, uint64_t flags);
 __owur size_t SSL_get_accept_stream_queue_len(SSL *s);
 

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/stack.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -24,6 +24,7 @@ typedef struct stack_st OPENSSL_STACK; /* Use STACK_OF(...) instead */
 
 typedef int (*OPENSSL_sk_compfunc)(const void *, const void *);
 typedef void (*OPENSSL_sk_freefunc)(void *);
+typedef void (*OPENSSL_sk_freefunc_thunk)(OPENSSL_sk_freefunc, void *);
 typedef void *(*OPENSSL_sk_copyfunc)(const void *);
 
 int OPENSSL_sk_num(const OPENSSL_STACK *);
@@ -34,9 +35,10 @@ void *OPENSSL_sk_set(OPENSSL_STACK *st, int i, const void *data);
 OPENSSL_STACK *OPENSSL_sk_new(OPENSSL_sk_compfunc cmp);
 OPENSSL_STACK *OPENSSL_sk_new_null(void);
 OPENSSL_STACK *OPENSSL_sk_new_reserve(OPENSSL_sk_compfunc c, int n);
+OPENSSL_STACK *OPENSSL_sk_set_thunks(OPENSSL_STACK *st, OPENSSL_sk_freefunc_thunk f_thunk);
 int OPENSSL_sk_reserve(OPENSSL_STACK *st, int n);
 void OPENSSL_sk_free(OPENSSL_STACK *);
-void OPENSSL_sk_pop_free(OPENSSL_STACK *st, void (*func) (void *));
+void OPENSSL_sk_pop_free(OPENSSL_STACK *st, OPENSSL_sk_freefunc func);
 OPENSSL_STACK *OPENSSL_sk_deep_copy(const OPENSSL_STACK *,
                                     OPENSSL_sk_copyfunc c,
                                     OPENSSL_sk_freefunc f);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/store.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -279,6 +279,8 @@ void OSSL_STORE_LOADER_do_all_provided(OSSL_LIB_CTX *libctx,
 int OSSL_STORE_LOADER_names_do_all(const OSSL_STORE_LOADER *loader,
                                    void (*fn)(const char *name, void *data),
                                    void *data);
+const OSSL_PARAM *
+OSSL_STORE_LOADER_settable_ctx_params(const OSSL_STORE_LOADER *loader);
 
 /*-
  *  Function to register a loader for the given URI scheme.

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/tls1.h

@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  * Copyright 2005 Nokia. All rights reserved.
  *
@@ -325,6 +325,12 @@ __owur int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
 # define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
         SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen,arg)
 
+# define SSL_get0_tlsext_status_ocsp_resp_ex(ssl, arg) \
+    SSL_ctrl(ssl, SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP_EX, 0, arg)
+
+# define SSL_set0_tlsext_status_ocsp_resp_ex(ssl, arg) \
+    SSL_ctrl(ssl, SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP_EX, 0, arg)
+
 # define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \
         SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,\
                 (void (*)(void))cb)

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/ui.h

@@ -305,7 +305,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(UI_STRING, UI_STRING, UI_STRING)
 #define sk_UI_STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_UI_STRING_sk_type(sk), ossl_check_UI_STRING_type(ptr))
 #define sk_UI_STRING_pop(sk) ((UI_STRING *)OPENSSL_sk_pop(ossl_check_UI_STRING_sk_type(sk)))
 #define sk_UI_STRING_shift(sk) ((UI_STRING *)OPENSSL_sk_shift(ossl_check_UI_STRING_sk_type(sk)))
-#define sk_UI_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_UI_STRING_sk_type(sk),ossl_check_UI_STRING_freefunc_type(freefunc))
+#define sk_UI_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_UI_STRING_sk_type(sk), ossl_check_UI_STRING_freefunc_type(freefunc))
 #define sk_UI_STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_UI_STRING_sk_type(sk), ossl_check_UI_STRING_type(ptr), (idx))
 #define sk_UI_STRING_set(sk, idx, ptr) ((UI_STRING *)OPENSSL_sk_set(ossl_check_UI_STRING_sk_type(sk), (idx), ossl_check_UI_STRING_type(ptr)))
 #define sk_UI_STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_UI_STRING_sk_type(sk), ossl_check_UI_STRING_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/x509.h

@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by Makefile from include/openssl/x509.h.in
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -64,7 +64,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_NAME, X509_NAME, X509_NAME)
 #define sk_X509_NAME_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_NAME_sk_type(sk), ossl_check_X509_NAME_type(ptr))
 #define sk_X509_NAME_pop(sk) ((X509_NAME *)OPENSSL_sk_pop(ossl_check_X509_NAME_sk_type(sk)))
 #define sk_X509_NAME_shift(sk) ((X509_NAME *)OPENSSL_sk_shift(ossl_check_X509_NAME_sk_type(sk)))
-#define sk_X509_NAME_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_NAME_sk_type(sk),ossl_check_X509_NAME_freefunc_type(freefunc))
+#define sk_X509_NAME_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_NAME_sk_type(sk), ossl_check_X509_NAME_freefunc_type(freefunc))
 #define sk_X509_NAME_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_NAME_sk_type(sk), ossl_check_X509_NAME_type(ptr), (idx))
 #define sk_X509_NAME_set(sk, idx, ptr) ((X509_NAME *)OPENSSL_sk_set(ossl_check_X509_NAME_sk_type(sk), (idx), ossl_check_X509_NAME_type(ptr)))
 #define sk_X509_NAME_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_NAME_sk_type(sk), ossl_check_X509_NAME_type(ptr))
@@ -90,7 +90,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509, X509, X509)
 #define sk_X509_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_sk_type(sk), ossl_check_X509_type(ptr))
 #define sk_X509_pop(sk) ((X509 *)OPENSSL_sk_pop(ossl_check_X509_sk_type(sk)))
 #define sk_X509_shift(sk) ((X509 *)OPENSSL_sk_shift(ossl_check_X509_sk_type(sk)))
-#define sk_X509_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_sk_type(sk),ossl_check_X509_freefunc_type(freefunc))
+#define sk_X509_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_sk_type(sk), ossl_check_X509_freefunc_type(freefunc))
 #define sk_X509_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_sk_type(sk), ossl_check_X509_type(ptr), (idx))
 #define sk_X509_set(sk, idx, ptr) ((X509 *)OPENSSL_sk_set(ossl_check_X509_sk_type(sk), (idx), ossl_check_X509_type(ptr)))
 #define sk_X509_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_sk_type(sk), ossl_check_X509_type(ptr))
@@ -116,7 +116,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_REVOKED, X509_REVOKED, X509_REVOKED)
 #define sk_X509_REVOKED_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_REVOKED_sk_type(sk), ossl_check_X509_REVOKED_type(ptr))
 #define sk_X509_REVOKED_pop(sk) ((X509_REVOKED *)OPENSSL_sk_pop(ossl_check_X509_REVOKED_sk_type(sk)))
 #define sk_X509_REVOKED_shift(sk) ((X509_REVOKED *)OPENSSL_sk_shift(ossl_check_X509_REVOKED_sk_type(sk)))
-#define sk_X509_REVOKED_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_REVOKED_sk_type(sk),ossl_check_X509_REVOKED_freefunc_type(freefunc))
+#define sk_X509_REVOKED_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_REVOKED_sk_type(sk), ossl_check_X509_REVOKED_freefunc_type(freefunc))
 #define sk_X509_REVOKED_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_REVOKED_sk_type(sk), ossl_check_X509_REVOKED_type(ptr), (idx))
 #define sk_X509_REVOKED_set(sk, idx, ptr) ((X509_REVOKED *)OPENSSL_sk_set(ossl_check_X509_REVOKED_sk_type(sk), (idx), ossl_check_X509_REVOKED_type(ptr)))
 #define sk_X509_REVOKED_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_REVOKED_sk_type(sk), ossl_check_X509_REVOKED_type(ptr))
@@ -142,7 +142,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_CRL, X509_CRL, X509_CRL)
 #define sk_X509_CRL_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_CRL_sk_type(sk), ossl_check_X509_CRL_type(ptr))
 #define sk_X509_CRL_pop(sk) ((X509_CRL *)OPENSSL_sk_pop(ossl_check_X509_CRL_sk_type(sk)))
 #define sk_X509_CRL_shift(sk) ((X509_CRL *)OPENSSL_sk_shift(ossl_check_X509_CRL_sk_type(sk)))
-#define sk_X509_CRL_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_CRL_sk_type(sk),ossl_check_X509_CRL_freefunc_type(freefunc))
+#define sk_X509_CRL_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_CRL_sk_type(sk), ossl_check_X509_CRL_freefunc_type(freefunc))
 #define sk_X509_CRL_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_CRL_sk_type(sk), ossl_check_X509_CRL_type(ptr), (idx))
 #define sk_X509_CRL_set(sk, idx, ptr) ((X509_CRL *)OPENSSL_sk_set(ossl_check_X509_CRL_sk_type(sk), (idx), ossl_check_X509_CRL_type(ptr)))
 #define sk_X509_CRL_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_CRL_sk_type(sk), ossl_check_X509_CRL_type(ptr))
@@ -215,7 +215,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_NAME_ENTRY, X509_NAME_ENTRY, X509_NAME_ENTRY)
 #define sk_X509_NAME_ENTRY_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_NAME_ENTRY_sk_type(sk), ossl_check_X509_NAME_ENTRY_type(ptr))
 #define sk_X509_NAME_ENTRY_pop(sk) ((X509_NAME_ENTRY *)OPENSSL_sk_pop(ossl_check_X509_NAME_ENTRY_sk_type(sk)))
 #define sk_X509_NAME_ENTRY_shift(sk) ((X509_NAME_ENTRY *)OPENSSL_sk_shift(ossl_check_X509_NAME_ENTRY_sk_type(sk)))
-#define sk_X509_NAME_ENTRY_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_NAME_ENTRY_sk_type(sk),ossl_check_X509_NAME_ENTRY_freefunc_type(freefunc))
+#define sk_X509_NAME_ENTRY_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_NAME_ENTRY_sk_type(sk), ossl_check_X509_NAME_ENTRY_freefunc_type(freefunc))
 #define sk_X509_NAME_ENTRY_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_NAME_ENTRY_sk_type(sk), ossl_check_X509_NAME_ENTRY_type(ptr), (idx))
 #define sk_X509_NAME_ENTRY_set(sk, idx, ptr) ((X509_NAME_ENTRY *)OPENSSL_sk_set(ossl_check_X509_NAME_ENTRY_sk_type(sk), (idx), ossl_check_X509_NAME_ENTRY_type(ptr)))
 #define sk_X509_NAME_ENTRY_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_NAME_ENTRY_sk_type(sk), ossl_check_X509_NAME_ENTRY_type(ptr))
@@ -246,7 +246,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_EXTENSION, X509_EXTENSION, X509_EXTENSION)
 #define sk_X509_EXTENSION_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_EXTENSION_sk_type(sk), ossl_check_X509_EXTENSION_type(ptr))
 #define sk_X509_EXTENSION_pop(sk) ((X509_EXTENSION *)OPENSSL_sk_pop(ossl_check_X509_EXTENSION_sk_type(sk)))
 #define sk_X509_EXTENSION_shift(sk) ((X509_EXTENSION *)OPENSSL_sk_shift(ossl_check_X509_EXTENSION_sk_type(sk)))
-#define sk_X509_EXTENSION_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_EXTENSION_sk_type(sk),ossl_check_X509_EXTENSION_freefunc_type(freefunc))
+#define sk_X509_EXTENSION_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_EXTENSION_sk_type(sk), ossl_check_X509_EXTENSION_freefunc_type(freefunc))
 #define sk_X509_EXTENSION_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_EXTENSION_sk_type(sk), ossl_check_X509_EXTENSION_type(ptr), (idx))
 #define sk_X509_EXTENSION_set(sk, idx, ptr) ((X509_EXTENSION *)OPENSSL_sk_set(ossl_check_X509_EXTENSION_sk_type(sk), (idx), ossl_check_X509_EXTENSION_type(ptr)))
 #define sk_X509_EXTENSION_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_EXTENSION_sk_type(sk), ossl_check_X509_EXTENSION_type(ptr))
@@ -275,7 +275,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_ATTRIBUTE, X509_ATTRIBUTE, X509_ATTRIBUTE)
 #define sk_X509_ATTRIBUTE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_ATTRIBUTE_sk_type(sk), ossl_check_X509_ATTRIBUTE_type(ptr))
 #define sk_X509_ATTRIBUTE_pop(sk) ((X509_ATTRIBUTE *)OPENSSL_sk_pop(ossl_check_X509_ATTRIBUTE_sk_type(sk)))
 #define sk_X509_ATTRIBUTE_shift(sk) ((X509_ATTRIBUTE *)OPENSSL_sk_shift(ossl_check_X509_ATTRIBUTE_sk_type(sk)))
-#define sk_X509_ATTRIBUTE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ATTRIBUTE_sk_type(sk),ossl_check_X509_ATTRIBUTE_freefunc_type(freefunc))
+#define sk_X509_ATTRIBUTE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_ATTRIBUTE_sk_type(sk), ossl_check_X509_ATTRIBUTE_freefunc_type(freefunc))
 #define sk_X509_ATTRIBUTE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_ATTRIBUTE_sk_type(sk), ossl_check_X509_ATTRIBUTE_type(ptr), (idx))
 #define sk_X509_ATTRIBUTE_set(sk, idx, ptr) ((X509_ATTRIBUTE *)OPENSSL_sk_set(ossl_check_X509_ATTRIBUTE_sk_type(sk), (idx), ossl_check_X509_ATTRIBUTE_type(ptr)))
 #define sk_X509_ATTRIBUTE_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_ATTRIBUTE_sk_type(sk), ossl_check_X509_ATTRIBUTE_type(ptr))
@@ -410,7 +410,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_INFO, X509_INFO, X509_INFO)
 #define sk_X509_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_INFO_sk_type(sk), ossl_check_X509_INFO_type(ptr))
 #define sk_X509_INFO_pop(sk) ((X509_INFO *)OPENSSL_sk_pop(ossl_check_X509_INFO_sk_type(sk)))
 #define sk_X509_INFO_shift(sk) ((X509_INFO *)OPENSSL_sk_shift(ossl_check_X509_INFO_sk_type(sk)))
-#define sk_X509_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_INFO_sk_type(sk),ossl_check_X509_INFO_freefunc_type(freefunc))
+#define sk_X509_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_INFO_sk_type(sk), ossl_check_X509_INFO_freefunc_type(freefunc))
 #define sk_X509_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_INFO_sk_type(sk), ossl_check_X509_INFO_type(ptr), (idx))
 #define sk_X509_INFO_set(sk, idx, ptr) ((X509_INFO *)OPENSSL_sk_set(ossl_check_X509_INFO_sk_type(sk), (idx), ossl_check_X509_INFO_type(ptr)))
 #define sk_X509_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_INFO_sk_type(sk), ossl_check_X509_INFO_type(ptr))
@@ -955,6 +955,7 @@ OSSL_DEPRECATEDIN_1_1_0 ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *crl);
 X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl);
 const STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions(const X509_CRL *crl);
 STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(X509_CRL *crl);
+const X509_ALGOR *X509_CRL_get0_tbs_sigalg(const X509_CRL *crl);
 void X509_CRL_get0_signature(const X509_CRL *crl, const ASN1_BIT_STRING **psig,
                              const X509_ALGOR **palg);
 int X509_CRL_get_signature_nid(const X509_CRL *crl);

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/x509_acert.h

@@ -147,7 +147,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_IETF_ATTR_SYNTAX_VALUE, OSSL_IETF_ATTR_SYNTAX_
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk), ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_type(ptr))
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_pop(sk) ((OSSL_IETF_ATTR_SYNTAX_VALUE *)OPENSSL_sk_pop(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk)))
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_shift(sk) ((OSSL_IETF_ATTR_SYNTAX_VALUE *)OPENSSL_sk_shift(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk)))
-#define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk),ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_freefunc_type(freefunc))
+#define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk), ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_freefunc_type(freefunc))
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk), ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_type(ptr), (idx))
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_set(sk, idx, ptr) ((OSSL_IETF_ATTR_SYNTAX_VALUE *)OPENSSL_sk_set(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk), (idx), ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_type(ptr)))
 #define sk_OSSL_IETF_ATTR_SYNTAX_VALUE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_sk_type(sk), ossl_check_OSSL_IETF_ATTR_SYNTAX_VALUE_type(ptr))
@@ -215,7 +215,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_TARGET, OSSL_TARGET, OSSL_TARGET)
 #define sk_OSSL_TARGET_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_TARGET_sk_type(sk), ossl_check_OSSL_TARGET_type(ptr))
 #define sk_OSSL_TARGET_pop(sk) ((OSSL_TARGET *)OPENSSL_sk_pop(ossl_check_OSSL_TARGET_sk_type(sk)))
 #define sk_OSSL_TARGET_shift(sk) ((OSSL_TARGET *)OPENSSL_sk_shift(ossl_check_OSSL_TARGET_sk_type(sk)))
-#define sk_OSSL_TARGET_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TARGET_sk_type(sk),ossl_check_OSSL_TARGET_freefunc_type(freefunc))
+#define sk_OSSL_TARGET_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TARGET_sk_type(sk), ossl_check_OSSL_TARGET_freefunc_type(freefunc))
 #define sk_OSSL_TARGET_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_TARGET_sk_type(sk), ossl_check_OSSL_TARGET_type(ptr), (idx))
 #define sk_OSSL_TARGET_set(sk, idx, ptr) ((OSSL_TARGET *)OPENSSL_sk_set(ossl_check_OSSL_TARGET_sk_type(sk), (idx), ossl_check_OSSL_TARGET_type(ptr)))
 #define sk_OSSL_TARGET_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_TARGET_sk_type(sk), ossl_check_OSSL_TARGET_type(ptr))
@@ -243,7 +243,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_TARGETS, OSSL_TARGETS, OSSL_TARGETS)
 #define sk_OSSL_TARGETS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_TARGETS_sk_type(sk), ossl_check_OSSL_TARGETS_type(ptr))
 #define sk_OSSL_TARGETS_pop(sk) ((OSSL_TARGETS *)OPENSSL_sk_pop(ossl_check_OSSL_TARGETS_sk_type(sk)))
 #define sk_OSSL_TARGETS_shift(sk) ((OSSL_TARGETS *)OPENSSL_sk_shift(ossl_check_OSSL_TARGETS_sk_type(sk)))
-#define sk_OSSL_TARGETS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TARGETS_sk_type(sk),ossl_check_OSSL_TARGETS_freefunc_type(freefunc))
+#define sk_OSSL_TARGETS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TARGETS_sk_type(sk), ossl_check_OSSL_TARGETS_freefunc_type(freefunc))
 #define sk_OSSL_TARGETS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_TARGETS_sk_type(sk), ossl_check_OSSL_TARGETS_type(ptr), (idx))
 #define sk_OSSL_TARGETS_set(sk, idx, ptr) ((OSSL_TARGETS *)OPENSSL_sk_set(ossl_check_OSSL_TARGETS_sk_type(sk), (idx), ossl_check_OSSL_TARGETS_type(ptr)))
 #define sk_OSSL_TARGETS_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_TARGETS_sk_type(sk), ossl_check_OSSL_TARGETS_type(ptr))
@@ -278,7 +278,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_ISSUER_SERIAL, OSSL_ISSUER_SERIAL, OSSL_ISSUER
 #define sk_OSSL_ISSUER_SERIAL_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk), ossl_check_OSSL_ISSUER_SERIAL_type(ptr))
 #define sk_OSSL_ISSUER_SERIAL_pop(sk) ((OSSL_ISSUER_SERIAL *)OPENSSL_sk_pop(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk)))
 #define sk_OSSL_ISSUER_SERIAL_shift(sk) ((OSSL_ISSUER_SERIAL *)OPENSSL_sk_shift(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk)))
-#define sk_OSSL_ISSUER_SERIAL_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk),ossl_check_OSSL_ISSUER_SERIAL_freefunc_type(freefunc))
+#define sk_OSSL_ISSUER_SERIAL_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk), ossl_check_OSSL_ISSUER_SERIAL_freefunc_type(freefunc))
 #define sk_OSSL_ISSUER_SERIAL_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk), ossl_check_OSSL_ISSUER_SERIAL_type(ptr), (idx))
 #define sk_OSSL_ISSUER_SERIAL_set(sk, idx, ptr) ((OSSL_ISSUER_SERIAL *)OPENSSL_sk_set(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk), (idx), ossl_check_OSSL_ISSUER_SERIAL_type(ptr)))
 #define sk_OSSL_ISSUER_SERIAL_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_ISSUER_SERIAL_sk_type(sk), ossl_check_OSSL_ISSUER_SERIAL_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/x509_vfy.h

@@ -38,6 +38,8 @@
 extern "C" {
 #endif
 
+DEFINE_STACK_OF(OCSP_RESPONSE)
+
 /*-
 SSL_CTX -> X509_STORE
                 -> X509_LOOKUP
@@ -80,7 +82,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_LOOKUP, X509_LOOKUP, X509_LOOKUP)
 #define sk_X509_LOOKUP_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_LOOKUP_sk_type(sk), ossl_check_X509_LOOKUP_type(ptr))
 #define sk_X509_LOOKUP_pop(sk) ((X509_LOOKUP *)OPENSSL_sk_pop(ossl_check_X509_LOOKUP_sk_type(sk)))
 #define sk_X509_LOOKUP_shift(sk) ((X509_LOOKUP *)OPENSSL_sk_shift(ossl_check_X509_LOOKUP_sk_type(sk)))
-#define sk_X509_LOOKUP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_LOOKUP_sk_type(sk),ossl_check_X509_LOOKUP_freefunc_type(freefunc))
+#define sk_X509_LOOKUP_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_LOOKUP_sk_type(sk), ossl_check_X509_LOOKUP_freefunc_type(freefunc))
 #define sk_X509_LOOKUP_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_LOOKUP_sk_type(sk), ossl_check_X509_LOOKUP_type(ptr), (idx))
 #define sk_X509_LOOKUP_set(sk, idx, ptr) ((X509_LOOKUP *)OPENSSL_sk_set(ossl_check_X509_LOOKUP_sk_type(sk), (idx), ossl_check_X509_LOOKUP_type(ptr)))
 #define sk_X509_LOOKUP_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_LOOKUP_sk_type(sk), ossl_check_X509_LOOKUP_type(ptr))
@@ -106,7 +108,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_OBJECT, X509_OBJECT, X509_OBJECT)
 #define sk_X509_OBJECT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_type(ptr))
 #define sk_X509_OBJECT_pop(sk) ((X509_OBJECT *)OPENSSL_sk_pop(ossl_check_X509_OBJECT_sk_type(sk)))
 #define sk_X509_OBJECT_shift(sk) ((X509_OBJECT *)OPENSSL_sk_shift(ossl_check_X509_OBJECT_sk_type(sk)))
-#define sk_X509_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_OBJECT_sk_type(sk),ossl_check_X509_OBJECT_freefunc_type(freefunc))
+#define sk_X509_OBJECT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_freefunc_type(freefunc))
 #define sk_X509_OBJECT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_type(ptr), (idx))
 #define sk_X509_OBJECT_set(sk, idx, ptr) ((X509_OBJECT *)OPENSSL_sk_set(ossl_check_X509_OBJECT_sk_type(sk), (idx), ossl_check_X509_OBJECT_type(ptr)))
 #define sk_X509_OBJECT_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_type(ptr))
@@ -132,7 +134,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_VERIFY_PARAM, X509_VERIFY_PARAM, X509_VERIFY_P
 #define sk_X509_VERIFY_PARAM_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_VERIFY_PARAM_sk_type(sk), ossl_check_X509_VERIFY_PARAM_type(ptr))
 #define sk_X509_VERIFY_PARAM_pop(sk) ((X509_VERIFY_PARAM *)OPENSSL_sk_pop(ossl_check_X509_VERIFY_PARAM_sk_type(sk)))
 #define sk_X509_VERIFY_PARAM_shift(sk) ((X509_VERIFY_PARAM *)OPENSSL_sk_shift(ossl_check_X509_VERIFY_PARAM_sk_type(sk)))
-#define sk_X509_VERIFY_PARAM_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_VERIFY_PARAM_sk_type(sk),ossl_check_X509_VERIFY_PARAM_freefunc_type(freefunc))
+#define sk_X509_VERIFY_PARAM_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_VERIFY_PARAM_sk_type(sk), ossl_check_X509_VERIFY_PARAM_freefunc_type(freefunc))
 #define sk_X509_VERIFY_PARAM_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_VERIFY_PARAM_sk_type(sk), ossl_check_X509_VERIFY_PARAM_type(ptr), (idx))
 #define sk_X509_VERIFY_PARAM_set(sk, idx, ptr) ((X509_VERIFY_PARAM *)OPENSSL_sk_set(ossl_check_X509_VERIFY_PARAM_sk_type(sk), (idx), ossl_check_X509_VERIFY_PARAM_type(ptr)))
 #define sk_X509_VERIFY_PARAM_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_VERIFY_PARAM_sk_type(sk), ossl_check_X509_VERIFY_PARAM_type(ptr))
@@ -169,7 +171,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_TRUST, X509_TRUST, X509_TRUST)
 #define sk_X509_TRUST_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_TRUST_sk_type(sk), ossl_check_X509_TRUST_type(ptr))
 #define sk_X509_TRUST_pop(sk) ((X509_TRUST *)OPENSSL_sk_pop(ossl_check_X509_TRUST_sk_type(sk)))
 #define sk_X509_TRUST_shift(sk) ((X509_TRUST *)OPENSSL_sk_shift(ossl_check_X509_TRUST_sk_type(sk)))
-#define sk_X509_TRUST_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_TRUST_sk_type(sk),ossl_check_X509_TRUST_freefunc_type(freefunc))
+#define sk_X509_TRUST_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_TRUST_sk_type(sk), ossl_check_X509_TRUST_freefunc_type(freefunc))
 #define sk_X509_TRUST_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_TRUST_sk_type(sk), ossl_check_X509_TRUST_type(ptr), (idx))
 #define sk_X509_TRUST_set(sk, idx, ptr) ((X509_TRUST *)OPENSSL_sk_set(ossl_check_X509_TRUST_sk_type(sk), (idx), ossl_check_X509_TRUST_type(ptr)))
 #define sk_X509_TRUST_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_TRUST_sk_type(sk), ossl_check_X509_TRUST_type(ptr))
@@ -413,6 +415,14 @@ X509_LOOKUP_ctrl_ex((x), X509_L_ADD_STORE, (name), 0, NULL,           \
 # define X509_V_ERR_EC_KEY_EXPLICIT_PARAMS               94
 # define X509_V_ERR_RPK_UNTRUSTED                        95
 
+/* additional OCSP status errors */
+# define X509_V_ERR_OCSP_RESP_INVALID                    96
+# define X509_V_ERR_OCSP_SIGNATURE_FAILURE               97
+# define X509_V_ERR_OCSP_NOT_YET_VALID                   98
+# define X509_V_ERR_OCSP_HAS_EXPIRED                     99
+# define X509_V_ERR_OCSP_NO_RESPONSE                    100
+# define X509_V_ERR_CRL_VERIFY_FAILED                   101
+
 /* Certificate verify flags */
 # ifndef OPENSSL_NO_DEPRECATED_1_1_0
 #  define X509_V_FLAG_CB_ISSUER_CHECK             0x0   /* Deprecated */
@@ -464,6 +474,11 @@ X509_LOOKUP_ctrl_ex((x), X509_L_ADD_STORE, (name), 0, NULL,           \
 /* Do not check certificate/CRL validity against current time */
 # define X509_V_FLAG_NO_CHECK_TIME               0x200000
 
+/* Verify OCSP stapling response for server certificate */
+# define X509_V_FLAG_OCSP_RESP_CHECK 0x400000
+/* Verify OCSP stapling responses for whole chain */
+# define X509_V_FLAG_OCSP_RESP_CHECK_ALL 0x800000
+
 # define X509_VP_FLAG_DEFAULT                    0x1
 # define X509_VP_FLAG_OVERWRITE                  0x2
 # define X509_VP_FLAG_RESET_FLAGS                0x4
@@ -772,6 +787,9 @@ void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *target);
 void X509_STORE_CTX_set0_rpk(X509_STORE_CTX *ctx, EVP_PKEY *target);
 void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *c, STACK_OF(X509) *sk);
 void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk);
+# ifndef OPENSSL_NO_OCSP
+void X509_STORE_CTX_set_ocsp_resp(X509_STORE_CTX *ctx, STACK_OF(OCSP_RESPONSE) *sk);
+# endif
 int X509_STORE_CTX_set_purpose(X509_STORE_CTX *ctx, int purpose);
 int X509_STORE_CTX_set_trust(X509_STORE_CTX *ctx, int trust);
 int X509_STORE_CTX_purpose_inherit(X509_STORE_CTX *ctx, int def_purpose,

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/openssl/x509v3.h

@@ -124,7 +124,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509V3_EXT_METHOD, X509V3_EXT_METHOD, X509V3_EXT_ME
 #define sk_X509V3_EXT_METHOD_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509V3_EXT_METHOD_sk_type(sk), ossl_check_X509V3_EXT_METHOD_type(ptr))
 #define sk_X509V3_EXT_METHOD_pop(sk) ((X509V3_EXT_METHOD *)OPENSSL_sk_pop(ossl_check_X509V3_EXT_METHOD_sk_type(sk)))
 #define sk_X509V3_EXT_METHOD_shift(sk) ((X509V3_EXT_METHOD *)OPENSSL_sk_shift(ossl_check_X509V3_EXT_METHOD_sk_type(sk)))
-#define sk_X509V3_EXT_METHOD_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509V3_EXT_METHOD_sk_type(sk),ossl_check_X509V3_EXT_METHOD_freefunc_type(freefunc))
+#define sk_X509V3_EXT_METHOD_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509V3_EXT_METHOD_sk_type(sk), ossl_check_X509V3_EXT_METHOD_freefunc_type(freefunc))
 #define sk_X509V3_EXT_METHOD_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509V3_EXT_METHOD_sk_type(sk), ossl_check_X509V3_EXT_METHOD_type(ptr), (idx))
 #define sk_X509V3_EXT_METHOD_set(sk, idx, ptr) ((X509V3_EXT_METHOD *)OPENSSL_sk_set(ossl_check_X509V3_EXT_METHOD_sk_type(sk), (idx), ossl_check_X509V3_EXT_METHOD_type(ptr)))
 #define sk_X509V3_EXT_METHOD_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509V3_EXT_METHOD_sk_type(sk), ossl_check_X509V3_EXT_METHOD_type(ptr))
@@ -223,7 +223,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ACCESS_DESCRIPTION, ACCESS_DESCRIPTION, ACCESS_DESC
 #define sk_ACCESS_DESCRIPTION_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ACCESS_DESCRIPTION_sk_type(sk), ossl_check_ACCESS_DESCRIPTION_type(ptr))
 #define sk_ACCESS_DESCRIPTION_pop(sk) ((ACCESS_DESCRIPTION *)OPENSSL_sk_pop(ossl_check_ACCESS_DESCRIPTION_sk_type(sk)))
 #define sk_ACCESS_DESCRIPTION_shift(sk) ((ACCESS_DESCRIPTION *)OPENSSL_sk_shift(ossl_check_ACCESS_DESCRIPTION_sk_type(sk)))
-#define sk_ACCESS_DESCRIPTION_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ACCESS_DESCRIPTION_sk_type(sk),ossl_check_ACCESS_DESCRIPTION_freefunc_type(freefunc))
+#define sk_ACCESS_DESCRIPTION_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ACCESS_DESCRIPTION_sk_type(sk), ossl_check_ACCESS_DESCRIPTION_freefunc_type(freefunc))
 #define sk_ACCESS_DESCRIPTION_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ACCESS_DESCRIPTION_sk_type(sk), ossl_check_ACCESS_DESCRIPTION_type(ptr), (idx))
 #define sk_ACCESS_DESCRIPTION_set(sk, idx, ptr) ((ACCESS_DESCRIPTION *)OPENSSL_sk_set(ossl_check_ACCESS_DESCRIPTION_sk_type(sk), (idx), ossl_check_ACCESS_DESCRIPTION_type(ptr)))
 #define sk_ACCESS_DESCRIPTION_find(sk, ptr) OPENSSL_sk_find(ossl_check_ACCESS_DESCRIPTION_sk_type(sk), ossl_check_ACCESS_DESCRIPTION_type(ptr))
@@ -249,7 +249,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(GENERAL_NAME, GENERAL_NAME, GENERAL_NAME)
 #define sk_GENERAL_NAME_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_GENERAL_NAME_sk_type(sk), ossl_check_GENERAL_NAME_type(ptr))
 #define sk_GENERAL_NAME_pop(sk) ((GENERAL_NAME *)OPENSSL_sk_pop(ossl_check_GENERAL_NAME_sk_type(sk)))
 #define sk_GENERAL_NAME_shift(sk) ((GENERAL_NAME *)OPENSSL_sk_shift(ossl_check_GENERAL_NAME_sk_type(sk)))
-#define sk_GENERAL_NAME_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_NAME_sk_type(sk),ossl_check_GENERAL_NAME_freefunc_type(freefunc))
+#define sk_GENERAL_NAME_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_NAME_sk_type(sk), ossl_check_GENERAL_NAME_freefunc_type(freefunc))
 #define sk_GENERAL_NAME_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_GENERAL_NAME_sk_type(sk), ossl_check_GENERAL_NAME_type(ptr), (idx))
 #define sk_GENERAL_NAME_set(sk, idx, ptr) ((GENERAL_NAME *)OPENSSL_sk_set(ossl_check_GENERAL_NAME_sk_type(sk), (idx), ossl_check_GENERAL_NAME_type(ptr)))
 #define sk_GENERAL_NAME_find(sk, ptr) OPENSSL_sk_find(ossl_check_GENERAL_NAME_sk_type(sk), ossl_check_GENERAL_NAME_type(ptr))
@@ -282,7 +282,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(GENERAL_NAMES, GENERAL_NAMES, GENERAL_NAMES)
 #define sk_GENERAL_NAMES_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_GENERAL_NAMES_sk_type(sk), ossl_check_GENERAL_NAMES_type(ptr))
 #define sk_GENERAL_NAMES_pop(sk) ((GENERAL_NAMES *)OPENSSL_sk_pop(ossl_check_GENERAL_NAMES_sk_type(sk)))
 #define sk_GENERAL_NAMES_shift(sk) ((GENERAL_NAMES *)OPENSSL_sk_shift(ossl_check_GENERAL_NAMES_sk_type(sk)))
-#define sk_GENERAL_NAMES_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_NAMES_sk_type(sk),ossl_check_GENERAL_NAMES_freefunc_type(freefunc))
+#define sk_GENERAL_NAMES_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_NAMES_sk_type(sk), ossl_check_GENERAL_NAMES_freefunc_type(freefunc))
 #define sk_GENERAL_NAMES_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_GENERAL_NAMES_sk_type(sk), ossl_check_GENERAL_NAMES_type(ptr), (idx))
 #define sk_GENERAL_NAMES_set(sk, idx, ptr) ((GENERAL_NAMES *)OPENSSL_sk_set(ossl_check_GENERAL_NAMES_sk_type(sk), (idx), ossl_check_GENERAL_NAMES_type(ptr)))
 #define sk_GENERAL_NAMES_find(sk, ptr) OPENSSL_sk_find(ossl_check_GENERAL_NAMES_sk_type(sk), ossl_check_GENERAL_NAMES_type(ptr))
@@ -342,7 +342,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(DIST_POINT, DIST_POINT, DIST_POINT)
 #define sk_DIST_POINT_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_DIST_POINT_sk_type(sk), ossl_check_DIST_POINT_type(ptr))
 #define sk_DIST_POINT_pop(sk) ((DIST_POINT *)OPENSSL_sk_pop(ossl_check_DIST_POINT_sk_type(sk)))
 #define sk_DIST_POINT_shift(sk) ((DIST_POINT *)OPENSSL_sk_shift(ossl_check_DIST_POINT_sk_type(sk)))
-#define sk_DIST_POINT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_DIST_POINT_sk_type(sk),ossl_check_DIST_POINT_freefunc_type(freefunc))
+#define sk_DIST_POINT_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_DIST_POINT_sk_type(sk), ossl_check_DIST_POINT_freefunc_type(freefunc))
 #define sk_DIST_POINT_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_DIST_POINT_sk_type(sk), ossl_check_DIST_POINT_type(ptr), (idx))
 #define sk_DIST_POINT_set(sk, idx, ptr) ((DIST_POINT *)OPENSSL_sk_set(ossl_check_DIST_POINT_sk_type(sk), (idx), ossl_check_DIST_POINT_type(ptr)))
 #define sk_DIST_POINT_find(sk, ptr) OPENSSL_sk_find(ossl_check_DIST_POINT_sk_type(sk), ossl_check_DIST_POINT_type(ptr))
@@ -385,7 +385,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(SXNETID, SXNETID, SXNETID)
 #define sk_SXNETID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_SXNETID_sk_type(sk), ossl_check_SXNETID_type(ptr))
 #define sk_SXNETID_pop(sk) ((SXNETID *)OPENSSL_sk_pop(ossl_check_SXNETID_sk_type(sk)))
 #define sk_SXNETID_shift(sk) ((SXNETID *)OPENSSL_sk_shift(ossl_check_SXNETID_sk_type(sk)))
-#define sk_SXNETID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SXNETID_sk_type(sk),ossl_check_SXNETID_freefunc_type(freefunc))
+#define sk_SXNETID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_SXNETID_sk_type(sk), ossl_check_SXNETID_freefunc_type(freefunc))
 #define sk_SXNETID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_SXNETID_sk_type(sk), ossl_check_SXNETID_type(ptr), (idx))
 #define sk_SXNETID_set(sk, idx, ptr) ((SXNETID *)OPENSSL_sk_set(ossl_check_SXNETID_sk_type(sk), (idx), ossl_check_SXNETID_type(ptr)))
 #define sk_SXNETID_find(sk, ptr) OPENSSL_sk_find(ossl_check_SXNETID_sk_type(sk), ossl_check_SXNETID_type(ptr))
@@ -445,7 +445,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(POLICYQUALINFO, POLICYQUALINFO, POLICYQUALINFO)
 #define sk_POLICYQUALINFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_POLICYQUALINFO_sk_type(sk), ossl_check_POLICYQUALINFO_type(ptr))
 #define sk_POLICYQUALINFO_pop(sk) ((POLICYQUALINFO *)OPENSSL_sk_pop(ossl_check_POLICYQUALINFO_sk_type(sk)))
 #define sk_POLICYQUALINFO_shift(sk) ((POLICYQUALINFO *)OPENSSL_sk_shift(ossl_check_POLICYQUALINFO_sk_type(sk)))
-#define sk_POLICYQUALINFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICYQUALINFO_sk_type(sk),ossl_check_POLICYQUALINFO_freefunc_type(freefunc))
+#define sk_POLICYQUALINFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICYQUALINFO_sk_type(sk), ossl_check_POLICYQUALINFO_freefunc_type(freefunc))
 #define sk_POLICYQUALINFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_POLICYQUALINFO_sk_type(sk), ossl_check_POLICYQUALINFO_type(ptr), (idx))
 #define sk_POLICYQUALINFO_set(sk, idx, ptr) ((POLICYQUALINFO *)OPENSSL_sk_set(ossl_check_POLICYQUALINFO_sk_type(sk), (idx), ossl_check_POLICYQUALINFO_type(ptr)))
 #define sk_POLICYQUALINFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_POLICYQUALINFO_sk_type(sk), ossl_check_POLICYQUALINFO_type(ptr))
@@ -479,7 +479,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(POLICYINFO, POLICYINFO, POLICYINFO)
 #define sk_POLICYINFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_POLICYINFO_sk_type(sk), ossl_check_POLICYINFO_type(ptr))
 #define sk_POLICYINFO_pop(sk) ((POLICYINFO *)OPENSSL_sk_pop(ossl_check_POLICYINFO_sk_type(sk)))
 #define sk_POLICYINFO_shift(sk) ((POLICYINFO *)OPENSSL_sk_shift(ossl_check_POLICYINFO_sk_type(sk)))
-#define sk_POLICYINFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICYINFO_sk_type(sk),ossl_check_POLICYINFO_freefunc_type(freefunc))
+#define sk_POLICYINFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICYINFO_sk_type(sk), ossl_check_POLICYINFO_freefunc_type(freefunc))
 #define sk_POLICYINFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_POLICYINFO_sk_type(sk), ossl_check_POLICYINFO_type(ptr), (idx))
 #define sk_POLICYINFO_set(sk, idx, ptr) ((POLICYINFO *)OPENSSL_sk_set(ossl_check_POLICYINFO_sk_type(sk), (idx), ossl_check_POLICYINFO_type(ptr)))
 #define sk_POLICYINFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_POLICYINFO_sk_type(sk), ossl_check_POLICYINFO_type(ptr))
@@ -514,7 +514,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(POLICY_MAPPING, POLICY_MAPPING, POLICY_MAPPING)
 #define sk_POLICY_MAPPING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_POLICY_MAPPING_sk_type(sk), ossl_check_POLICY_MAPPING_type(ptr))
 #define sk_POLICY_MAPPING_pop(sk) ((POLICY_MAPPING *)OPENSSL_sk_pop(ossl_check_POLICY_MAPPING_sk_type(sk)))
 #define sk_POLICY_MAPPING_shift(sk) ((POLICY_MAPPING *)OPENSSL_sk_shift(ossl_check_POLICY_MAPPING_sk_type(sk)))
-#define sk_POLICY_MAPPING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICY_MAPPING_sk_type(sk),ossl_check_POLICY_MAPPING_freefunc_type(freefunc))
+#define sk_POLICY_MAPPING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_POLICY_MAPPING_sk_type(sk), ossl_check_POLICY_MAPPING_freefunc_type(freefunc))
 #define sk_POLICY_MAPPING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_POLICY_MAPPING_sk_type(sk), ossl_check_POLICY_MAPPING_type(ptr), (idx))
 #define sk_POLICY_MAPPING_set(sk, idx, ptr) ((POLICY_MAPPING *)OPENSSL_sk_set(ossl_check_POLICY_MAPPING_sk_type(sk), (idx), ossl_check_POLICY_MAPPING_type(ptr)))
 #define sk_POLICY_MAPPING_find(sk, ptr) OPENSSL_sk_find(ossl_check_POLICY_MAPPING_sk_type(sk), ossl_check_POLICY_MAPPING_type(ptr))
@@ -550,7 +550,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(GENERAL_SUBTREE, GENERAL_SUBTREE, GENERAL_SUBTREE)
 #define sk_GENERAL_SUBTREE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_GENERAL_SUBTREE_sk_type(sk), ossl_check_GENERAL_SUBTREE_type(ptr))
 #define sk_GENERAL_SUBTREE_pop(sk) ((GENERAL_SUBTREE *)OPENSSL_sk_pop(ossl_check_GENERAL_SUBTREE_sk_type(sk)))
 #define sk_GENERAL_SUBTREE_shift(sk) ((GENERAL_SUBTREE *)OPENSSL_sk_shift(ossl_check_GENERAL_SUBTREE_sk_type(sk)))
-#define sk_GENERAL_SUBTREE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_SUBTREE_sk_type(sk),ossl_check_GENERAL_SUBTREE_freefunc_type(freefunc))
+#define sk_GENERAL_SUBTREE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_GENERAL_SUBTREE_sk_type(sk), ossl_check_GENERAL_SUBTREE_freefunc_type(freefunc))
 #define sk_GENERAL_SUBTREE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_GENERAL_SUBTREE_sk_type(sk), ossl_check_GENERAL_SUBTREE_type(ptr), (idx))
 #define sk_GENERAL_SUBTREE_set(sk, idx, ptr) ((GENERAL_SUBTREE *)OPENSSL_sk_set(ossl_check_GENERAL_SUBTREE_sk_type(sk), (idx), ossl_check_GENERAL_SUBTREE_type(ptr)))
 #define sk_GENERAL_SUBTREE_find(sk, ptr) OPENSSL_sk_find(ossl_check_GENERAL_SUBTREE_sk_type(sk), ossl_check_GENERAL_SUBTREE_type(ptr))
@@ -728,7 +728,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_PURPOSE, X509_PURPOSE, X509_PURPOSE)
 #define sk_X509_PURPOSE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_PURPOSE_sk_type(sk), ossl_check_X509_PURPOSE_type(ptr))
 #define sk_X509_PURPOSE_pop(sk) ((X509_PURPOSE *)OPENSSL_sk_pop(ossl_check_X509_PURPOSE_sk_type(sk)))
 #define sk_X509_PURPOSE_shift(sk) ((X509_PURPOSE *)OPENSSL_sk_shift(ossl_check_X509_PURPOSE_sk_type(sk)))
-#define sk_X509_PURPOSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_PURPOSE_sk_type(sk),ossl_check_X509_PURPOSE_freefunc_type(freefunc))
+#define sk_X509_PURPOSE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_PURPOSE_sk_type(sk), ossl_check_X509_PURPOSE_freefunc_type(freefunc))
 #define sk_X509_PURPOSE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_PURPOSE_sk_type(sk), ossl_check_X509_PURPOSE_type(ptr), (idx))
 #define sk_X509_PURPOSE_set(sk, idx, ptr) ((X509_PURPOSE *)OPENSSL_sk_set(ossl_check_X509_PURPOSE_sk_type(sk), (idx), ossl_check_X509_PURPOSE_type(ptr)))
 #define sk_X509_PURPOSE_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_PURPOSE_sk_type(sk), ossl_check_X509_PURPOSE_type(ptr))
@@ -1077,7 +1077,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(X509_POLICY_NODE, X509_POLICY_NODE, X509_POLICY_NOD
 #define sk_X509_POLICY_NODE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_X509_POLICY_NODE_sk_type(sk), ossl_check_X509_POLICY_NODE_type(ptr))
 #define sk_X509_POLICY_NODE_pop(sk) ((X509_POLICY_NODE *)OPENSSL_sk_pop(ossl_check_X509_POLICY_NODE_sk_type(sk)))
 #define sk_X509_POLICY_NODE_shift(sk) ((X509_POLICY_NODE *)OPENSSL_sk_shift(ossl_check_X509_POLICY_NODE_sk_type(sk)))
-#define sk_X509_POLICY_NODE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_POLICY_NODE_sk_type(sk),ossl_check_X509_POLICY_NODE_freefunc_type(freefunc))
+#define sk_X509_POLICY_NODE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_X509_POLICY_NODE_sk_type(sk), ossl_check_X509_POLICY_NODE_freefunc_type(freefunc))
 #define sk_X509_POLICY_NODE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_X509_POLICY_NODE_sk_type(sk), ossl_check_X509_POLICY_NODE_type(ptr), (idx))
 #define sk_X509_POLICY_NODE_set(sk, idx, ptr) ((X509_POLICY_NODE *)OPENSSL_sk_set(ossl_check_X509_POLICY_NODE_sk_type(sk), (idx), ossl_check_X509_POLICY_NODE_type(ptr)))
 #define sk_X509_POLICY_NODE_find(sk, ptr) OPENSSL_sk_find(ossl_check_X509_POLICY_NODE_sk_type(sk), ossl_check_X509_POLICY_NODE_type(ptr))
@@ -1122,7 +1122,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASIdOrRange, ASIdOrRange, ASIdOrRange)
 #define sk_ASIdOrRange_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASIdOrRange_sk_type(sk), ossl_check_ASIdOrRange_type(ptr))
 #define sk_ASIdOrRange_pop(sk) ((ASIdOrRange *)OPENSSL_sk_pop(ossl_check_ASIdOrRange_sk_type(sk)))
 #define sk_ASIdOrRange_shift(sk) ((ASIdOrRange *)OPENSSL_sk_shift(ossl_check_ASIdOrRange_sk_type(sk)))
-#define sk_ASIdOrRange_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASIdOrRange_sk_type(sk),ossl_check_ASIdOrRange_freefunc_type(freefunc))
+#define sk_ASIdOrRange_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASIdOrRange_sk_type(sk), ossl_check_ASIdOrRange_freefunc_type(freefunc))
 #define sk_ASIdOrRange_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASIdOrRange_sk_type(sk), ossl_check_ASIdOrRange_type(ptr), (idx))
 #define sk_ASIdOrRange_set(sk, idx, ptr) ((ASIdOrRange *)OPENSSL_sk_set(ossl_check_ASIdOrRange_sk_type(sk), (idx), ossl_check_ASIdOrRange_type(ptr)))
 #define sk_ASIdOrRange_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASIdOrRange_sk_type(sk), ossl_check_ASIdOrRange_type(ptr))
@@ -1187,7 +1187,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(IPAddressOrRange, IPAddressOrRange, IPAddressOrRang
 #define sk_IPAddressOrRange_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_IPAddressOrRange_sk_type(sk), ossl_check_IPAddressOrRange_type(ptr))
 #define sk_IPAddressOrRange_pop(sk) ((IPAddressOrRange *)OPENSSL_sk_pop(ossl_check_IPAddressOrRange_sk_type(sk)))
 #define sk_IPAddressOrRange_shift(sk) ((IPAddressOrRange *)OPENSSL_sk_shift(ossl_check_IPAddressOrRange_sk_type(sk)))
-#define sk_IPAddressOrRange_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_IPAddressOrRange_sk_type(sk),ossl_check_IPAddressOrRange_freefunc_type(freefunc))
+#define sk_IPAddressOrRange_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_IPAddressOrRange_sk_type(sk), ossl_check_IPAddressOrRange_freefunc_type(freefunc))
 #define sk_IPAddressOrRange_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_IPAddressOrRange_sk_type(sk), ossl_check_IPAddressOrRange_type(ptr), (idx))
 #define sk_IPAddressOrRange_set(sk, idx, ptr) ((IPAddressOrRange *)OPENSSL_sk_set(ossl_check_IPAddressOrRange_sk_type(sk), (idx), ossl_check_IPAddressOrRange_type(ptr)))
 #define sk_IPAddressOrRange_find(sk, ptr) OPENSSL_sk_find(ossl_check_IPAddressOrRange_sk_type(sk), ossl_check_IPAddressOrRange_type(ptr))
@@ -1233,7 +1233,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(IPAddressFamily, IPAddressFamily, IPAddressFamily)
 #define sk_IPAddressFamily_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_IPAddressFamily_sk_type(sk), ossl_check_IPAddressFamily_type(ptr))
 #define sk_IPAddressFamily_pop(sk) ((IPAddressFamily *)OPENSSL_sk_pop(ossl_check_IPAddressFamily_sk_type(sk)))
 #define sk_IPAddressFamily_shift(sk) ((IPAddressFamily *)OPENSSL_sk_shift(ossl_check_IPAddressFamily_sk_type(sk)))
-#define sk_IPAddressFamily_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_IPAddressFamily_sk_type(sk),ossl_check_IPAddressFamily_freefunc_type(freefunc))
+#define sk_IPAddressFamily_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_IPAddressFamily_sk_type(sk), ossl_check_IPAddressFamily_freefunc_type(freefunc))
 #define sk_IPAddressFamily_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_IPAddressFamily_sk_type(sk), ossl_check_IPAddressFamily_type(ptr), (idx))
 #define sk_IPAddressFamily_set(sk, idx, ptr) ((IPAddressFamily *)OPENSSL_sk_set(ossl_check_IPAddressFamily_sk_type(sk), (idx), ossl_check_IPAddressFamily_type(ptr)))
 #define sk_IPAddressFamily_find(sk, ptr) OPENSSL_sk_find(ossl_check_IPAddressFamily_sk_type(sk), ossl_check_IPAddressFamily_type(ptr))
@@ -1334,7 +1334,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ASN1_STRING, ASN1_STRING, ASN1_STRING)
 #define sk_ASN1_STRING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ASN1_STRING_sk_type(sk), ossl_check_ASN1_STRING_type(ptr))
 #define sk_ASN1_STRING_pop(sk) ((ASN1_STRING *)OPENSSL_sk_pop(ossl_check_ASN1_STRING_sk_type(sk)))
 #define sk_ASN1_STRING_shift(sk) ((ASN1_STRING *)OPENSSL_sk_shift(ossl_check_ASN1_STRING_sk_type(sk)))
-#define sk_ASN1_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_sk_type(sk),ossl_check_ASN1_STRING_freefunc_type(freefunc))
+#define sk_ASN1_STRING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ASN1_STRING_sk_type(sk), ossl_check_ASN1_STRING_freefunc_type(freefunc))
 #define sk_ASN1_STRING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ASN1_STRING_sk_type(sk), ossl_check_ASN1_STRING_type(ptr), (idx))
 #define sk_ASN1_STRING_set(sk, idx, ptr) ((ASN1_STRING *)OPENSSL_sk_set(ossl_check_ASN1_STRING_sk_type(sk), (idx), ossl_check_ASN1_STRING_type(ptr)))
 #define sk_ASN1_STRING_find(sk, ptr) OPENSSL_sk_find(ossl_check_ASN1_STRING_sk_type(sk), ossl_check_ASN1_STRING_type(ptr))
@@ -1373,7 +1373,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(PROFESSION_INFO, PROFESSION_INFO, PROFESSION_INFO)
 #define sk_PROFESSION_INFO_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_PROFESSION_INFO_sk_type(sk), ossl_check_PROFESSION_INFO_type(ptr))
 #define sk_PROFESSION_INFO_pop(sk) ((PROFESSION_INFO *)OPENSSL_sk_pop(ossl_check_PROFESSION_INFO_sk_type(sk)))
 #define sk_PROFESSION_INFO_shift(sk) ((PROFESSION_INFO *)OPENSSL_sk_shift(ossl_check_PROFESSION_INFO_sk_type(sk)))
-#define sk_PROFESSION_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PROFESSION_INFO_sk_type(sk),ossl_check_PROFESSION_INFO_freefunc_type(freefunc))
+#define sk_PROFESSION_INFO_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_PROFESSION_INFO_sk_type(sk), ossl_check_PROFESSION_INFO_freefunc_type(freefunc))
 #define sk_PROFESSION_INFO_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_PROFESSION_INFO_sk_type(sk), ossl_check_PROFESSION_INFO_type(ptr), (idx))
 #define sk_PROFESSION_INFO_set(sk, idx, ptr) ((PROFESSION_INFO *)OPENSSL_sk_set(ossl_check_PROFESSION_INFO_sk_type(sk), (idx), ossl_check_PROFESSION_INFO_type(ptr)))
 #define sk_PROFESSION_INFO_find(sk, ptr) OPENSSL_sk_find(ossl_check_PROFESSION_INFO_sk_type(sk), ossl_check_PROFESSION_INFO_type(ptr))
@@ -1399,7 +1399,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(ADMISSIONS, ADMISSIONS, ADMISSIONS)
 #define sk_ADMISSIONS_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_ADMISSIONS_sk_type(sk), ossl_check_ADMISSIONS_type(ptr))
 #define sk_ADMISSIONS_pop(sk) ((ADMISSIONS *)OPENSSL_sk_pop(ossl_check_ADMISSIONS_sk_type(sk)))
 #define sk_ADMISSIONS_shift(sk) ((ADMISSIONS *)OPENSSL_sk_shift(ossl_check_ADMISSIONS_sk_type(sk)))
-#define sk_ADMISSIONS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ADMISSIONS_sk_type(sk),ossl_check_ADMISSIONS_freefunc_type(freefunc))
+#define sk_ADMISSIONS_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_ADMISSIONS_sk_type(sk), ossl_check_ADMISSIONS_freefunc_type(freefunc))
 #define sk_ADMISSIONS_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_ADMISSIONS_sk_type(sk), ossl_check_ADMISSIONS_type(ptr), (idx))
 #define sk_ADMISSIONS_set(sk, idx, ptr) ((ADMISSIONS *)OPENSSL_sk_set(ossl_check_ADMISSIONS_sk_type(sk), (idx), ossl_check_ADMISSIONS_type(ptr)))
 #define sk_ADMISSIONS_find(sk, ptr) OPENSSL_sk_find(ossl_check_ADMISSIONS_sk_type(sk), ossl_check_ADMISSIONS_type(ptr))
@@ -1484,7 +1484,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(USERNOTICE, USERNOTICE, USERNOTICE)
 #define sk_USERNOTICE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_USERNOTICE_sk_type(sk), ossl_check_USERNOTICE_type(ptr))
 #define sk_USERNOTICE_pop(sk) ((USERNOTICE *)OPENSSL_sk_pop(ossl_check_USERNOTICE_sk_type(sk)))
 #define sk_USERNOTICE_shift(sk) ((USERNOTICE *)OPENSSL_sk_shift(ossl_check_USERNOTICE_sk_type(sk)))
-#define sk_USERNOTICE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_USERNOTICE_sk_type(sk),ossl_check_USERNOTICE_freefunc_type(freefunc))
+#define sk_USERNOTICE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_USERNOTICE_sk_type(sk), ossl_check_USERNOTICE_freefunc_type(freefunc))
 #define sk_USERNOTICE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_USERNOTICE_sk_type(sk), ossl_check_USERNOTICE_type(ptr), (idx))
 #define sk_USERNOTICE_set(sk, idx, ptr) ((USERNOTICE *)OPENSSL_sk_set(ossl_check_USERNOTICE_sk_type(sk), (idx), ossl_check_USERNOTICE_type(ptr)))
 #define sk_USERNOTICE_find(sk, ptr) OPENSSL_sk_find(ossl_check_USERNOTICE_sk_type(sk), ossl_check_USERNOTICE_type(ptr))
@@ -1521,7 +1521,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_ROLE_SPEC_CERT_ID, OSSL_ROLE_SPEC_CERT_ID, OSS
 #define sk_OSSL_ROLE_SPEC_CERT_ID_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk), ossl_check_OSSL_ROLE_SPEC_CERT_ID_type(ptr))
 #define sk_OSSL_ROLE_SPEC_CERT_ID_pop(sk) ((OSSL_ROLE_SPEC_CERT_ID *)OPENSSL_sk_pop(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk)))
 #define sk_OSSL_ROLE_SPEC_CERT_ID_shift(sk) ((OSSL_ROLE_SPEC_CERT_ID *)OPENSSL_sk_shift(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk)))
-#define sk_OSSL_ROLE_SPEC_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk),ossl_check_OSSL_ROLE_SPEC_CERT_ID_freefunc_type(freefunc))
+#define sk_OSSL_ROLE_SPEC_CERT_ID_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk), ossl_check_OSSL_ROLE_SPEC_CERT_ID_freefunc_type(freefunc))
 #define sk_OSSL_ROLE_SPEC_CERT_ID_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk), ossl_check_OSSL_ROLE_SPEC_CERT_ID_type(ptr), (idx))
 #define sk_OSSL_ROLE_SPEC_CERT_ID_set(sk, idx, ptr) ((OSSL_ROLE_SPEC_CERT_ID *)OPENSSL_sk_set(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk), (idx), ossl_check_OSSL_ROLE_SPEC_CERT_ID_type(ptr)))
 #define sk_OSSL_ROLE_SPEC_CERT_ID_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_ROLE_SPEC_CERT_ID_sk_type(sk), ossl_check_OSSL_ROLE_SPEC_CERT_ID_type(ptr))
@@ -1769,7 +1769,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_TIME_PERIOD, OSSL_TIME_PERIOD, OSSL_TIME_PERIO
 #define sk_OSSL_TIME_PERIOD_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_TIME_PERIOD_sk_type(sk), ossl_check_OSSL_TIME_PERIOD_type(ptr))
 #define sk_OSSL_TIME_PERIOD_pop(sk) ((OSSL_TIME_PERIOD *)OPENSSL_sk_pop(ossl_check_OSSL_TIME_PERIOD_sk_type(sk)))
 #define sk_OSSL_TIME_PERIOD_shift(sk) ((OSSL_TIME_PERIOD *)OPENSSL_sk_shift(ossl_check_OSSL_TIME_PERIOD_sk_type(sk)))
-#define sk_OSSL_TIME_PERIOD_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TIME_PERIOD_sk_type(sk),ossl_check_OSSL_TIME_PERIOD_freefunc_type(freefunc))
+#define sk_OSSL_TIME_PERIOD_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_TIME_PERIOD_sk_type(sk), ossl_check_OSSL_TIME_PERIOD_freefunc_type(freefunc))
 #define sk_OSSL_TIME_PERIOD_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_TIME_PERIOD_sk_type(sk), ossl_check_OSSL_TIME_PERIOD_type(ptr), (idx))
 #define sk_OSSL_TIME_PERIOD_set(sk, idx, ptr) ((OSSL_TIME_PERIOD *)OPENSSL_sk_set(ossl_check_OSSL_TIME_PERIOD_sk_type(sk), (idx), ossl_check_OSSL_TIME_PERIOD_type(ptr)))
 #define sk_OSSL_TIME_PERIOD_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_TIME_PERIOD_sk_type(sk), ossl_check_OSSL_TIME_PERIOD_type(ptr))
@@ -1797,7 +1797,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_DAY_TIME_BAND, OSSL_DAY_TIME_BAND, OSSL_DAY_TI
 #define sk_OSSL_DAY_TIME_BAND_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk), ossl_check_OSSL_DAY_TIME_BAND_type(ptr))
 #define sk_OSSL_DAY_TIME_BAND_pop(sk) ((OSSL_DAY_TIME_BAND *)OPENSSL_sk_pop(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk)))
 #define sk_OSSL_DAY_TIME_BAND_shift(sk) ((OSSL_DAY_TIME_BAND *)OPENSSL_sk_shift(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk)))
-#define sk_OSSL_DAY_TIME_BAND_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk),ossl_check_OSSL_DAY_TIME_BAND_freefunc_type(freefunc))
+#define sk_OSSL_DAY_TIME_BAND_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk), ossl_check_OSSL_DAY_TIME_BAND_freefunc_type(freefunc))
 #define sk_OSSL_DAY_TIME_BAND_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk), ossl_check_OSSL_DAY_TIME_BAND_type(ptr), (idx))
 #define sk_OSSL_DAY_TIME_BAND_set(sk, idx, ptr) ((OSSL_DAY_TIME_BAND *)OPENSSL_sk_set(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk), (idx), ossl_check_OSSL_DAY_TIME_BAND_type(ptr)))
 #define sk_OSSL_DAY_TIME_BAND_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_DAY_TIME_BAND_sk_type(sk), ossl_check_OSSL_DAY_TIME_BAND_type(ptr))
@@ -1859,7 +1859,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_ATTRIBUTE_MAPPING, OSSL_ATTRIBUTE_MAPPING, OSS
 #define sk_OSSL_ATTRIBUTE_MAPPING_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk), ossl_check_OSSL_ATTRIBUTE_MAPPING_type(ptr))
 #define sk_OSSL_ATTRIBUTE_MAPPING_pop(sk) ((OSSL_ATTRIBUTE_MAPPING *)OPENSSL_sk_pop(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk)))
 #define sk_OSSL_ATTRIBUTE_MAPPING_shift(sk) ((OSSL_ATTRIBUTE_MAPPING *)OPENSSL_sk_shift(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk)))
-#define sk_OSSL_ATTRIBUTE_MAPPING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk),ossl_check_OSSL_ATTRIBUTE_MAPPING_freefunc_type(freefunc))
+#define sk_OSSL_ATTRIBUTE_MAPPING_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk), ossl_check_OSSL_ATTRIBUTE_MAPPING_freefunc_type(freefunc))
 #define sk_OSSL_ATTRIBUTE_MAPPING_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk), ossl_check_OSSL_ATTRIBUTE_MAPPING_type(ptr), (idx))
 #define sk_OSSL_ATTRIBUTE_MAPPING_set(sk, idx, ptr) ((OSSL_ATTRIBUTE_MAPPING *)OPENSSL_sk_set(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk), (idx), ossl_check_OSSL_ATTRIBUTE_MAPPING_type(ptr)))
 #define sk_OSSL_ATTRIBUTE_MAPPING_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_ATTRIBUTE_MAPPING_sk_type(sk), ossl_check_OSSL_ATTRIBUTE_MAPPING_type(ptr))
@@ -1909,7 +1909,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_ALLOWED_ATTRIBUTES_CHOICE, OSSL_ALLOWED_ATTRIB
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_type(ptr))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_pop(sk) ((OSSL_ALLOWED_ATTRIBUTES_CHOICE *)OPENSSL_sk_pop(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk)))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_shift(sk) ((OSSL_ALLOWED_ATTRIBUTES_CHOICE *)OPENSSL_sk_shift(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk)))
-#define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk),ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_freefunc_type(freefunc))
+#define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_freefunc_type(freefunc))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_type(ptr), (idx))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_set(sk, idx, ptr) ((OSSL_ALLOWED_ATTRIBUTES_CHOICE *)OPENSSL_sk_set(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk), (idx), ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_type(ptr)))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_CHOICE_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_CHOICE_type(ptr))
@@ -1937,7 +1937,7 @@ SKM_DEFINE_STACK_OF_INTERNAL(OSSL_ALLOWED_ATTRIBUTES_ITEM, OSSL_ALLOWED_ATTRIBUT
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_unshift(sk, ptr) OPENSSL_sk_unshift(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_type(ptr))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_pop(sk) ((OSSL_ALLOWED_ATTRIBUTES_ITEM *)OPENSSL_sk_pop(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk)))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_shift(sk) ((OSSL_ALLOWED_ATTRIBUTES_ITEM *)OPENSSL_sk_shift(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk)))
-#define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk),ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_freefunc_type(freefunc))
+#define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_pop_free(sk, freefunc) OPENSSL_sk_pop_free(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_freefunc_type(freefunc))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_insert(sk, ptr, idx) OPENSSL_sk_insert(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_type(ptr), (idx))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_set(sk, idx, ptr) ((OSSL_ALLOWED_ATTRIBUTES_ITEM *)OPENSSL_sk_set(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk), (idx), ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_type(ptr)))
 #define sk_OSSL_ALLOWED_ATTRIBUTES_ITEM_find(sk, ptr) OPENSSL_sk_find(ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_sk_type(sk), ossl_check_OSSL_ALLOWED_ATTRIBUTES_ITEM_type(ptr))

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Headers/orconfig.h

@@ -7,12 +7,12 @@
 /* All assert failures are fatal */
 /* #undef ALL_BUGS_ARE_FATAL */
 
-/* # for 0.4.8.17 Approximate date when this software was released. (Updated
+/* # for 0.4.8.19 Approximate date when this software was released. (Updated
    when the version changes.) */
-#define APPROX_RELEASE_DATE "2025-06-30"
+#define APPROX_RELEASE_DATE "2025-10-06"
 
 /* tor's build directory */
-#define BUILDDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define BUILDDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Compiler name */
 #define COMPILER /**/
@@ -24,10 +24,10 @@
 #define COMPILER_VERSION "17.0.0"
 
 /* tor's configuration directory */
-#define CONFDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
+#define CONFDIR "/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64/etc/tor"
 
 /* Flags passed to configure */
-#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator18.5.sdk CFLAGS=-Os -ffunction-sections -fdata-sections -miphonesimulator-version-min=12.0 CPPFLAGS= -Isrc/core -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 LDFLAGS=-lz  LZMA_CFLAGS=-I/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/include LZMA_LIBS=/Users/jack/vibe/Tor.framework-408.17.4/build/iphonesimulator/liblzma-arm64/lib/liblzma.a cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
+#define CONFIG_FLAGS "--enable-silent-rules --enable-pic --disable-module-relay --disable-module-dirauth --disable-tool-name-check --disable-unittests --enable-static-openssl --enable-static-libevent --disable-asciidoc --disable-system-torrc --disable-linker-hardening --disable-dependency-tracking --disable-manpage --disable-html-manual --disable-gcc-warnings-advisory --enable-lzma=no --disable-zstd --with-libevent-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64 --with-openssl-dir=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64 --prefix=/Users/jack/vibe/Tor.framework/build/iphonesimulator/libtor-nolzma-arm64 CC=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk -Os -ffunction-sections -fdata-sections CPP=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -E -arch arm64 -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator26.0.sdk CPPFLAGS=-Isrc/core -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libssl-arm64/include -I/Users/jack/vibe/Tor.framework/build/iphonesimulator/libevent-arm64/include -miphonesimulator-version-min=12.0 -Os -ffunction-sections -fdata-sections LDFLAGS=-lz cross_compiling=yes ac_cv_func__NSGetEnviron=no ac_cv_func_clock_gettime=no ac_cv_func_getentropy=no"
 
 /* Enable smartlist debugging */
 /* #undef DEBUG_SMARTLIST */
@@ -720,7 +720,7 @@
 #define PACKAGE_NAME "tor"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "tor 0.4.8.17"
+#define PACKAGE_STRING "tor 0.4.8.19"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "tor"
@@ -729,7 +729,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "0.4.8.17"
+#define PACKAGE_VERSION "0.4.8.19"
 
 /* How to access the PC from a struct ucontext */
 /* #undef PC_FROM_UCONTEXT */
@@ -780,7 +780,7 @@
 #define SIZEOF___INT64 0
 
 /* tor's sourcedir directory */
-#define SRCDIR "/Users/jack/vibe/Tor.framework-408.17.4/build/tor"
+#define SRCDIR "/Users/jack/vibe/Tor.framework/build/tor"
 
 /* Set to 1 if we can compile a simple stdatomic example. */
 #define STDATOMIC_WORKS 1
@@ -908,7 +908,7 @@
 #define USING_TWOS_COMPLEMENT 1
 
 /* Version number of package */
-#define VERSION "0.4.8.17"
+#define VERSION "0.4.8.19"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64-simulator/tor-nolzma.framework/Info.plist

@@ -2,23 +2,27 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>CFBundleDevelopmentRegion</key>
-	<string>en</string>
-	<key>CFBundleExecutable</key>
-	<string>tor-nolzma</string>
-	<key>CFBundleIdentifier</key>
-	<string>org.torproject.tor-nolzma</string>
-	<key>CFBundleInfoDictionaryVersion</key>
-	<string>6.0</string>
-	<key>CFBundleName</key>
-	<string>tor-nolzma</string>
-	<key>CFBundlePackageType</key>
-	<string>FMWK</string>
-	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
-	<key>CFBundleVersion</key>
-	<string>1</string>
-	<key>MinimumOSVersion</key>
-	<string>16.0</string>
+    <key>CFBundleDevelopmentRegion</key>
+    <string>en</string>
+    <key>CFBundleExecutable</key>
+    <string>tor-nolzma</string>
+    <key>CFBundleIdentifier</key>
+    <string>org.torproject.tor-nolzma</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>tor-nolzma</string>
+    <key>CFBundlePackageType</key>
+    <string>FMWK</string>
+    <key>CFBundleShortVersionString</key>
+    <string>0.4.8.19</string>
+    <key>CFBundleSupportedPlatforms</key>
+    <array>
+        <string>iPhoneSimulator</string>
+    </array>
+    <key>CFBundleVersion</key>
+    <string>0.4.8.19</string>
+    <key>MinimumOSVersion</key>
+    <string>12.0</string>
 </dict>
 </plist>

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64/tor-nolzma.framework/Headers/NSBundle+GeoIP.h

@@ -1,20 +0,0 @@
-//
-//  NSBundle+GeoIP.h
-//  Tor
-//
-//  Created by Benjamin Erhart on 02.12.21.
-//
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-@interface NSBundle (GeoIP)
-
-@property (class, readonly, nullable) NSBundle *geoIpBundle;
-@property (readonly, nullable) NSURL *geoipFile;
-@property (readonly, nullable) NSURL *geoip6File;
-
-@end
-
-NS_ASSUME_NONNULL_END

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64/tor-nolzma.framework/Headers/NSCharacterSet+PredefinedSets.h

@@ -1,19 +0,0 @@
-//
-//  NSCharacterSet+PredefinedSets.h
-//  Tor
-//
-//  Created by Benjamin Erhart on 12.12.19.
-//
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-@interface NSCharacterSet (PredefinedSets)
-
-@property (class, readonly) NSCharacterSet *doubleQuote;
-@property (class, readonly) NSCharacterSet *longNameDivider;
-
-@end
-
-NS_ASSUME_NONNULL_END

localPackages/Tor/Frameworks/tor-nolzma.xcframework/ios-arm64/tor-nolzma.framework/Headers/TORAuthKey.h

@@ -1,140 +0,0 @@
-//
-//  TORAuthKey.h
-//  Tor
-//
-//  Created by Benjamin Erhart on 29.09.21.
-//
-
-#import <Foundation/Foundation.h>
-
-NS_ASSUME_NONNULL_BEGIN
-
-/**
- The representation of one private or public v3 onion service authentication key.
- */
-NS_SWIFT_NAME(TorAuthKey)
-@interface TORAuthKey : NSObject
-
-/**
- The location on disk, where this data was read from/will be written to.
- */
-@property (nonatomic, readonly, nonnull) NSURL *file;
-
-/**
- Flag, if this is a private (\c YES) or a public (\c NO) key.
- */
-@property (atomic, readonly) BOOL isPrivate;
-
-/**
- The full  onion service URL.
- */
-@property (nonatomic, readonly, nullable) NSURL *onionAddress;
-
-/**
- The authentication type.
-
-Currently only the \c descriptor type is supported. This class will set this value hard for you.
- */
-@property (nonatomic, readonly, nonnull) NSString *authType;
-
-/**
- The key type.
-
- Currently only \c x25519 is supported. This class will set this value hard for you.
- Make sure, that the key you provide actually is of that type!
- */
-@property (nonatomic, readonly, nonnull) NSString *keyType;
-
-/**
- The actual public OR private key.
-
- This class doesn't enforce it, but Tor wants this to be in a BASE32 encoded format.
-
- Make sure, it is of the type \c x25519, as this is currently the only supported type by Tor and by this class!
- */
-@property (nonatomic, readonly, nonnull) NSString *key;
-
-
-/**
- Load from a key file on disk.
-
- See https://2019.www.torproject.org/docs/tor-manual.html.en#ClientOnionAuthDir
- and https://2019.www.torproject.org/docs/tor-manual.html.en#_client_authorization
- for the expected format.
-
- @param url The URL to the file containing the key. Expected to be in the correct format.
- */
-- (instancetype)initFromUrl:(NSURL *)url;
-
-/**
- Load from a key file on disk.
-
- See https://2019.www.torproject.org/docs/tor-manual.html.en#ClientOnionAuthDir
- and https://2019.www.torproject.org/docs/tor-manual.html.en#_client_authorization
- for the expected format.
-
- @param path The path to the file containing the key. Expected to be in the correct format.
- */
-- (instancetype)initFromFile:(NSString *)path;
-
-/**
- Create a new private key for a given domain.
-
- Normally, the domain will be used as file name, but this method will generate a UUID, if no domain can be found.
-
- @param key A \c BASE32 encoded \c x25519 private key.
- @param url A URL containing the v3 onion service domain for which this key is.
- */
-- (instancetype)initPrivate:(NSString * _Nonnull)key forDomain:(NSURL * _Nonnull)url;
-
-/**
- Create a new public key with the given name.
-
- The name wil be used as the file name.
-
- @param key A \c BASE32 encoded \c x25519 public key.
- @param name A name to identify this key to be used as the file name.
- */
-- (instancetype)initPublic:(NSString * _Nonnull)key withName: (NSString *)name;
-
-
-/**
- Set the base directory for the key.
-
- This needs to be called \b before \c persist, if you created a fresh key.
-
- @param directory The base directory where this key should be persisted.
-
- @see -persist
- */
-- (void)setDirectory:(NSURL *)directory;
-
-/**
- Persists this key to the file system.
-
- Call \c setDirectory:, if this instance wasn't created by reading a key from a file!
-
- @returns \c YES on success, \c NO on failure.
-
- @see -setDirectory:
- */
-- (BOOL)persist;
-
-/**
- Keys are considered equal, if their file URLs match.
- */
-- (BOOL)isEqualToAuthKey:(TORAuthKey *)authKey;
-
-
-/**
- Checks, if the given file name has the correct extension for either a private or public key.
-
- @param url A file URL to a key file.
-
- @returns \c YES, if this URL contains a key file extension.
- */
-+ (BOOL)isAuthFile:(NSURL *)url;
-
-@end
-
-NS_ASSUME_NONNULL_END