* feat: scaffold contact sync plumbing (#320) * feat: scaffold contact sync plumbing Pulls down the contact and resolver protos, adds the SQLite tables backing the sync state machine, a Contacts permission authorizer mirroring CameraAuthorizer, and gRPC service wrappers for ContactList and PaymentDestination. No user-visible behavior yet — Phase 3 will wire the sync engine on top. * fix: review-pass corrections to contact sync plumbing - propagate writer.transaction throws so DB write errors surface - attach expectedChecksum to every FullUpload chunk (proto: required per request) - dedup snapshots and matched-set by e164 before insert - emit raw e164 strings from the contacts stream (no lossy Phone parse) - deliver streaming callbacks on the service queue, not via Task hops - @mainactor + final on ContactsAuthorizer - yield contacts before throwing on non-OK terminal batches - @sendable on the local server-streaming handler - rename PaymentDestinationService -> ResolverService (matches proto) - add .networkError to error enums for transient transport failures - mark new classes final * test: pure-logic coverage for contact sync wrappers - Array.chunked(into:) extension (used by ContactListService.fullUpload) - proto-to-Swift result mapping (FlipcashContactsBatch.Result) - isReportable matrices for ErrorContactSync + ErrorResolve - CheckSyncResult equality including .outOfSync associated values - Database+ContactSync edge cases: empty-input drainage, dedup-by-e164 first-wins (asserted as a set since the read has no ORDER BY) Service-level gRPC mocking is intentionally deferred — Phase 3's ContactSyncControllerTests will cover the integrated flow via the FlipClient mocking pattern that HistoryController / RatesController already use. * feat: contact sync state machine and triggers (#321) * feat: contact sync state machine and triggers ContactSyncController is dormant at construction; Phase 4 UI activates it after the user grants contact permission. Heavy work runs off the main actor via @Concurrent. ContactSyncing protocol extraction (alongside ContactVerifying / OnrampAuthorizing) lets the state machine accept a mock conformer; 25 tests cover lifecycle (dormancy, activate idempotency, didBecomeActive gating) and the state machine (first sync, steady-state, delta, CHECKSUM_DRIFT fallback, server drift, upload failures) — coverage 6.4% → 65.5%. Also fixes a pre-existing Date-precision flake in state_upsert (`.now` carries sub-second precision the SQLite Date column truncates). * review pass: persist-after-refresh, server-drift to full, test isolation - performSync: refresh matched-set BEFORE persisting snapshot/checksum so a stream failure leaves state unmodified and the next sync retries - server-drift on idle probe goes straight to full upload (delta with old==new is structurally guaranteed to be rejected) - sync(): coalesce in-flight triggers via needsResync flag — bursts of CN changes during sync no longer get dropped silently - inject authorizationStatusProvider for testability; tests pass .notDetermined so runSync short-circuits before any CN access - LifecycleTests use .serialized + AuthCounter to verify gate without ever touching real CN - PerformSyncTests use try #require for safe array access + a seedDatabase helper to cut duplication - Removed redundant comment in SessionAuthenticator construction site * review pass 2: region-aware Phone parse + 13 other findings #1 Phone(_:defaultRegion:) — region-aware parse for raw inputs (CN contacts); legacy Phone(_:) keeps implicit-US behavior for the UI flow that pre-formats. ContactSyncController.readContacts now uses Region.current ?? .us via a new pure normalizeContacts(rawNumbers:region:) helper. 15-case PhoneTests + NormalizeContactsTests cover the new path. #2 ErrorContactSync.isReportable flips .checksumMismatch and .notFound to true so the existing reportError calls in handleSyncError actually fire. #3 Exhaustive switch on CheckSyncResult per CLAUDE.md hard rule — no more 'if case .ok =' that would silently route a new case to drift. #5 New Database.updateContactSyncSnapshotAndState wraps snapshot + state writes in a single transaction — no more crash-between-writes risk. #6 sync()'s post-await cleanup runs inside MainActor.run so the isSyncing / syncTask / needsResync triple-read is atomic. #7 New syncCoalescesInFlightTriggerAndRerunsAfterCompletion test covers the needsResync re-trigger path that had no coverage. #8 streamFailure_doesNotPersistAndLeavesMatchedSetIntact now seeds prior matched-set rows and asserts they survive a stream failure. #9 MockContactSync.streamFlipcashContacts now installs an onTermination no-op to mirror FlipClient's shape, and reads streamYields / streamTerminalError inside the producer closure so test mutations after stream construction take effect. #10 Snapshot read hoisted into the delta branch — server-drift recovery no longer depends on the snapshot table being readable. #11 Snapshot / flipcashContacts test assertions use Set comparison — no longer rely on SQLite returning rows in insertion order. #12,#13 Class-level + sync() doc comments updated to reflect actual off-main behavior (runSync is nonisolated; the Task body inherits non-main via NonisolatedNonsendingByDefault). Warns against dropping the nonisolated annotation. * strip narrative / historical comments Per code-style rule: comments describe current API contract (one sentence on what + one sentence on non-obvious constraint). No why-rationale, no visibility justification, no cross-reference narration, no historical context, no inline restatements of what the test name already conveys. * fix(test): update isReportable matrix for flipped cases ErrorContactSync.isReportable now returns true for .checksumMismatch and .notFound (matches review-pass 2 production change); parameterized test arguments adjusted to match. * feat: contacts permission screen + Send section gating (#323) * feat: ContactsPermissionScreen + ContactSyncController activation hook Shared priming view for the contacts authorization prompt, used by both the onboarding step and the Send section. Owns a ContactsAuthorizer passed by the parent so grants propagate to the parent's observation graph. ContactsAuthorizer init no longer auto-reads CNContactStore.authorizationStatus (iOS 26.5+ first- read footgun); refresh() runs the read off-main via Task.detached. SessionAuthenticator.createSessionContainer activates the controller off-main at session bootstrap when the system status is .authorized. ContactSyncController.sync() and the CNContactStoreDidChange observer task now use Task.detached so heavy work (CN enumeration, SQLite, RPCs) actually runs off the main actor — under Swift 6's NonisolatedNonsendingByDefault (SE-0461), a non-detached Task inside @mainactor context runs nonisolated async on main, defeating Phase 3's intent. Per the server team, .notFound from GetFlipcashContacts is a successful 0- match response, not an error. streamFlipcashContacts no longer throws on .notFound and ErrorContactSync.notFound is no longer reportable. The dead arm in handleSyncError is retained for switch exhaustiveness. * feat: contacts permission slot in onboarding sequence Inserts the contacts permission step before push notifications: after access key, show ContactsPermissionScreen when CNContactStore.authorizationStatus is .notDetermined; otherwise advance to push (or completeLogin). A small wrapper view owns the @State ContactsAuthorizer for onboarding. UI tests gain allowContactsIfNeeded() — mirrors allowPushNotificationsIfNeeded and handles the iOS 26+ 'Share All N Contacts' follow-up sheet. Wired into both CreateAccount smoke tests in the right order. * feat: Send section entry point + three-state gating Adds a fourth LargeButton ('Send', paper plane icon) to ScanBottomBar that presents a new AppRouter sheet. The sheet's root SendRootScreen gates entry on two preconditions: 1. session.profile.isPhoneVerified — empty state ConnectPhoneEmptyState launches the standalone PhoneVerificationFlowScreen as a child sheet 2. ContactsAuthorizer.status == .authorized — falls into the shared ContactsPermissionScreen When both are satisfied, a placeholder renders until Phase 5 ships the recipient picker. Granting contacts inside the priming screen calls contactSyncController.activate() and the body re-renders into the picker placeholder via @observable propagation. * fix: tint Send icon as template, name illustration overlap constant Send.imageset is a single-color SVG (fill=white); marking it as template rendering intent lets the foregroundStyle modifier tint it (used in ConnectPhoneEmptyState). Replaces the magic .padding(.bottom, -60) on the contacts illustration with a named static constant on the title's top padding — same Figma overlap effect, clearer intent. * Revert padding swap on ContactsPermissionScreen .padding(.top, -N) on the title is NOT equivalent to .padding(.bottom, -N) on the illustration in a VStack — the latter overlaps content correctly, the former shifts the title's outer frame and breaks both the illustration-title and title-subtitle spacing. Reverting to the original. * Trim comments across the Phase 4 surface API contracts only — drop cross-reference narration, historical context, and redundant prose about main-thread / SE-0461 details that the docstrings on the relevant types already cover. * chore: pre-commit hook refusing GoogleService-Info.plist changes Install once per clone: git config core.hooksPath Scripts/git-hooks * feat: recipient picker with On Flipcash and Invite sections (#325) * feat: ContactAvatarView with image cache and initials fallback Circular avatar primitive for FlipcashUI. Decoded thumbnails live in a process-wide NSCache keyed by id so list scrolling doesn't re-decode the same blob. Falls back to a two-letter monogram chip when no image data is supplied. * feat: recipient picker with On Flipcash and Invite sections Replaces SendRootScreen's placeholder with RecipientPickerScreen — the Send section's primary view. Reads contact-sync DB tables, joins each snapshot entry against CNContactStore for display name and thumbnail, and renders two sections (On Flipcash, Not on Flipcash Yet) with an inline search field. Loader dedupes by CNContact.identifier, preferring a matched e164 when present — a single contact with multiple phone-number entries shows up once with the address the user can act on. Invite + send row taps are stubbed pending Phase 6 (composer sheet) and Phase 7 (resolve-and-send wire-up). * test: skip optional Continue prompt for iOS 18 contacts permission The contacts permission flow differs by iOS version: - iOS 18: the share-picker sheet appears directly after the priming screen; no Continue prompt. - iOS 26+: Continue prompt appears first, then the share picker. The helper asserted on Continue with a 30s timeout, hanging UI tests on iOS 18. Make Continue optional (same pattern Share All already uses) so the helper works on any supported iOS version. * refactor: hoist resolved contacts onto ContactSyncController Removes the picker's internal loading state. The controller now owns a resolvedContacts cache (observable) populated after every sync — including the early-return path when checksum probes report no work to do. The picker reads from the controller directly; CN-change updates flow through atomically with no spinner flash on screen. SendRootScreen gains a .loadingContacts step for the gap between permission grant and first resolution. In that state the priming screen stays visible with the primary button replaced by a spinner via Loadable. ContactsPermissionScreen takes a new isAllowing flag to drive that. ResolvedContact, ResolvedContacts, and RecipientLoader move out of the picker file into a dedicated ContactDirectory.swift so the controller can depend on them without pulling in the view file. * refactor: preserve every (e164, contactId) pair in the directory The picker should show each address-book contact with each of their phone numbers, and a phone shared across contacts should show once per contact name (per product spec — don't ever show the same name + same number twice). Snapshot table moves to composite PK (e164, contactId); SQLiteVersion 12 -> 13. The contact-sync code paths that previously deduped by e164 alone now dedupe on the tuple. Server upload + checksum still derive the unique e164 set (server doesn't care which contacts a phone is on), using stable first-seen ordering for deterministic payloads. RecipientLoader.placements becomes a direct snapshot-to-placement map. A new deduplicatedForDisplay step collapses (displayName, nationalPhone) collisions to a single row, preferring the variant whose e164 is on Flipcash so the resulting row is actionable. CN unifiedContact lookups are now cached per contactId — same contact across rows hits CN once instead of once per phone. ResolvedContact gains a separate contactId field; its Identifiable id becomes composite "contactId|e164" so ForEach IDs stay unique when a contact has multiple phones. * fix: avoid pipe-separator collision in deduplicatedForDisplay The old '\(displayName)|\(nationalPhone)' joined-string key collided when either field contained a literal pipe — 'a|b' + 'c' hashed the same as 'a' + 'b|c'. Use a Hashable struct key instead so any character is safe in the data. Regression test guards the case. * test: route iOS 18 contacts share-picker through LimitedAccessPromptView iOS 18 hosts the "How do you want to share contacts?" picker in a dedicated XPC process (com.apple.ContactsUI.LimitedAccessPromptView) rather than springboard. Poll both processes for the Share All button so the helper works across iOS versions. Don't call activate() on the picker process — it launches it fresh and steals foreground. * feat: invite sheet, onboarding phone verification, and smoke coverage (#326) * feat: iMessage invite sheet for non-Flipcash contacts * feat: onboarding phone verification step before contacts * test: onboarding phone smoke helper and per-caller titles * refactor: address review feedback + SendSmokeTests * feat: direct send to resolved contact (#327) * feat: Session.send direct transfer method Adds Session.send(amount:verifiedState:to:) for direct on-chain payments to a contact resolved via the Flip resolver. Submits an IntentTransfer (SendPublicPayment, isWithdrawal: false, isRemoteSend: false) carrying the recipient's VM vault as destination and the resolver-returned owner authority as destinationOwner. Server (ocp-server intent handler) recognises the destination as a Code-managed timelock and accepts the intent; flipcash2-server's contact-payment integration uses destinationOwner to fire the CONTACT_PAYMENT push. Recipient vault is derived client-side via TimelockDerivedAccounts (public derivation from owner + mint + VM time-authority) — same derivation the recipient's own device runs on login, no private key needed. Routes through a new DirectSending capability protocol so the upcoming SendAmountViewModel can inject MockSession's sendHandler for unit tests. Test: SessionSendVerifiedStateTests.send_throwsStale mirrors the withdraw/buy/sell pre-flight assertFresh precedent. * feat: Send amount screen + picker tap wire-up Wires the Send section's 'On Flipcash' tap to a direct on-chain payment to the resolved contact. Adds: - ContactResolver (sibling controller on SessionContainer) that wraps FlipClient.resolvePhone with the signed-in owner. - SendAmountViewModel + SendAmountScreen (amount-entry mirror of Give, terminal action calls Session.send and the screen swaps to an auto-dismissing success view via .task(id:) tied to the view's life). - AppRouter destination .sendAmount on the .send stack. - RecipientPickerScreen tap handler: resolves via ContactResolver, pushes .sendAmount on success, dialogs + removeContact on NOT_FOUND, dialogs on DENIED, dialogs + captureError on other errors. Analytics for tap, resolve outcomes, send outcomes. - ContactSyncController.removeContact / Database.removeContact / ResolvedContacts.removing(e164:) for optimistically purging a contact whose resolve returned NOT_FOUND, with a follow-up sync(). Tests: SendAmountViewModelTests (recipient storage, canSend branches, sendAction empty / insufficient / no-pin paths), ResolvedContactsRemoving Tests, ContactSyncControllerTests/RemoveContactTests, Database removeContact tests. * refactor: address Phase 7 review findings - Drop ContactResolver; add session.resolveContact(e164:) alongside the other FlipClient-backed Session methods. - Session.send: ladder catch for ErrorSubmitIntent.denied / .staleState / CancellationError / generic, each with rich metadata. - SendAmountViewModel: switch keypad parsing from NumberFormatter.decimal(from:) to Decimal(string:) (locale-safe, per CLAUDE.md keypad rule); move balance read after .usdf branch; default mint param to nil. - SendAmountScreen: lazy-compute the maxLimit fallback. - Session.Error: Equatable + migrate all stale-state tests (buy / buyNewCurrency / sell / withdraw / send) to #expect(throws:). - Trim narrative / cross-reference comments across touched files. * refactor: trust contact sync on resolve NOT_FOUND Drop the optimistic local purge (Database.removeContact / ContactSyncController.removeContact / ResolvedContacts.removing) plus their tests. The picker now shows a soft 'Couldn't Send / can't reach this contact right now' dialog on NOT_FOUND or denied, and lets the next ContactSync reconcile authoritatively. * refactor: drop redundant typed catch ladder in Session.send ErrorReporting.capture already gates on ServerError.isReportable (line 117), and ErrorSubmitIntent declares .denied/.invalidIntent/ .staleState as non-reportable. The typed catches were just gating the same logic at the call site (anti-pattern per CLAUDE.md). Collapse to a single catch — call capturePayment unconditionally, keep the explicit CancellationError skip since it isn't a ServerError. * feat: notification service extension for CONTACT_JOIN (#333) * feat: app group + SQLite path migration to shared container Creates a NotificationService extension target stub and moves the per-owner SQLite store to the group.com.flipcash.app.ios app-group container so the extension can read it. Bumps SQLiteVersion 13 → 14 and removes the legacy applicationSupportDirectory copies on next launch. Adds AppGroup + SharedDefaults helpers; writes the current owner's base58 pubkey on login and clears on logout. Adds Database.localContactsSnapshot(forE164:) accessor + tests. NSE body remains the Xcode-generated stub; the substitution chain ships in commits 2 + 3. * feat: pure-logic notification payload, substitution applier, name resolver NSE-bound helpers in FlipcashCore/Push/. NotificationPayload decodes the flipcash_payload key into Flipcash_Push_V1_Payload. SubstitutionApplier fills positional {0}/{1}/... templates, using "Someone you know" instead of any phone-derived fallback so raw E.164s never reach the lock screen. ContactNameResolver maps phone → contactId via ContactSnapshotReading → display name via ContactNameProviding (returns the first non-empty match). Database conforms ContactSnapshotReading. 18 unit tests cover happy paths, the fallback rule, and the no-E.164-leak invariant. * feat: NotificationService extension target + didReceive wiring Replaces the Xcode stub with the real CONTACT_JOIN handler. The NSE decodes flipcash_payload into Flipcash_Push_V1_Payload, resolves each title/body substitution phone to a local contact name via ContactSnapshotReader (read-only SQLite query against the shared app-group store) + CNContactNameProvider (CNContactStore lookup), applies positional {0}/{1}/... substitutions, and sets threadIdentifier from the payload's groupKey. Links FlipcashCore + SQLite as package dependencies on the NSE target. * chore: polish NSE helpers + tests from review CNContactNameProvider uses CNContactFormatter.string(from:style:.fullName) to handle locale-ordered names; drops the static keysToFetch in favor of inline CNContactFormatter.descriptorForRequiredKeys. ContactSnapshotReader busyTimeout matches Database.swift (1000 → 2000). SubstitutionApplierTests parameterizes uniform cases; the no-E.164-leak test now asserts directly on unresolvedFallback. NotificationPayloadTests uses try #require on titleSubstitutions.first to avoid count-then-index. * refactor: drop SQLite share; NSE queries CNContactStore directly NSE resolves phone → contact name via CNContact.predicateForContacts instead of looking up via a shared SQLite snapshot. Removes the app-group container, SQLite path migration, SharedDefaults, ContactSnapshotReading, the snapshot reader, the per-E164 DB accessor, and CNContactNameProvider — all infrastructure that fed the NSE's contactId middleman. NSE declares NSContactsUsageDescription. Whether iOS shares the main app's Contacts grant with the extension is undocumented; needs device verification. * fix(pbxproj): drop SQLite from NSE packageProductDependencies * feat(send): resolve recipient on the amount screen (#336) Tapping a recipient now pushes the amount screen immediately and resolves the phone->pubkey in the background, instead of blocking the tap on the network round-trip. Send stays disabled until resolved; a transient failure retries once, then shows a dialog and pops back to the recipient list. * feat: clear server contact set on contacts revoke and account deletion (#337) * feat: clear server contact set on contacts revoke and account deletion When contacts access is revoked (authorized → denied/restricted) or the user deletes their account, wipe the server's stored contact set via an empty full upload — no new RPC. Revoke is detected on foreground, is idempotent, and leaves the stored status armed on failure so the next foreground retries. * refactor: checksum-based revoke detection; off-main delete-account wipe The persisted contact checksum already implies prior authorized access, so detect a revoke from `checksum != nil` plus the current status instead of a separate stored authorization status. Run the account-deletion wipe via `@concurrent` so its SQLite work stays off the main thread. * fix: keep phone verification continue button above the keyboard (#338) * feat: support limited contacts access (#339) * feat: support limited contacts access Treat .limited (iOS 18 partial access) as a syncable state: the sync, picker-render, and bootstrap gates accept {authorized, limited} via CNAuthorizationStatus.allowsContactAccess; the permission screen routes .limited into the picker instead of Settings; the Send gate resolves contacts status before deciding so the priming screen no longer flashes; and an inline ContactAccessButton lets limited users expand the shared set. * refactor(send): drop blocked in-app contact-add affordance iOS 26 renders both ContactAccessButton and contactAccessPicker as a blank sheet (FB14821786, no workaround), so the in-app affordance to expand the shared set is removed. Limited-access users with no shared contacts now get an app-styled empty state that routes to Settings, and all Send empty states use the app's fonts and BubbleButton instead of ContentUnavailableView. * test(send): accept limited-access empty state in picker smoke test Phase 11 added the 'No Contacts Shared' limited-access empty state; the Send picker smoke test now accepts it alongside the On-Flipcash / Invite / 'No Contacts Found' states. * fix(send): stop reading contacts status on Send sheet open The flash-fix root .task called CNContactStore.authorizationStatus when the Send sheet appeared — during the phone-verification step — which triggers the iOS 26 contacts permission prompt and violates the Phase 4 invariant (no Contacts API before the permission screen). The prompt stalled the Send flow on the phone gate. Reverts to the original gating; the priming-screen flash is a pre-existing cosmetic issue tracked separately. * fix(send): resolve contacts status after the phone gate Re-adds the priming-screen flash fix, but gated on phone verification: the status read (a Contacts API call) now runs only after the phone gate is satisfied, never on sheet open. Reading it earlier trips the iOS 26 prompt-on-authorizationStatus behavior during the phone-verification step. A neutral spinner shows during the brief post-phone resolve, and the real status keeps limited-access detection and revoke handling correct. * test(send): tap Connect Your Phone Number to reach phone verification The Send sheet gates phone entry behind a CTA (onboarding presents EnterPhoneScreen directly), so the smoke test must tap through it before allowPhoneVerificationIfNeeded can drive the flow — otherwise the helper no-ops and the test stalls on the phone gate. * feat: link verified phones for payment (#340) * feat: link verified phone for payment in send flow * fix: decode push payload nested under aps key * fix: refresh matched contacts when a contact joins * feat: link existing verified phone for payment * refactor: inline phone-payment link onto Session; tidy review nits Drop the redundant double-fire of the send-flow phone link (an inline Session method now owns the one-shot link), removing the PhonePaymentLinker indirection. Trim over-explanatory comments and mark the NSNotification.Name extension nonisolated. * fix: release the phone-link guard on failure so a later refresh retries * test: fix smoke tests broken by the forced onboarding phone step Three new-account smoke tests (Currency/Discover/Give) never cleared the onboarding phone + contacts gates added in #326, so they stalled on the phone screen — add the helper calls. SendSmokeTests targeted a label-ambiguous "Close"; use the share sheet's header.closeButton identifier instead. * fix: align NotificationService version with the app (1.11.0 -> 1.12.0) (#342) * fix: resolve Send recipient on tap, not eagerly on appear (#346) * test: add enablePhoneNumberSend to UserFlags fixtures after main rebase DatabaseProfileTests and SessionTests build UserFlags through the memberwise initializer. Rebasing contact-sync onto main brought those fixtures (added on main) alongside contact-sync's required enablePhoneNumberSend field, so both now pass it explicitly. * fix: resolve Send recipient on tap, not eagerly on appear Offline handling for the Send amount screen. The recipient resolve now happens on the Send tap (retried once on a transient network failure) rather than eagerly on appear, so the screen stays interactive offline. canSend reflects amount validity only, so a red subtitle means over-limit. NOT_FOUND pops back to the picker; a network failure shows a dismiss-only error and stays. ErrorResolve.notFound is non-reportable and resolvePhone/resolveContact return a non-optional PublicKey. * fix: always link a verified phone for payment for now The server enablePhoneNumberSend flag is off for everyone, so the gated path never ran. Link verified phones unconditionally for now; a TODO marks re-gating behind a local override (BetaFlags || server flag) as follow-up. * chore: update invite message copy * fix: resolve cached contacts offline so Send doesn't spin (#347) activate() resolves the directory from the local cache before the network sync, so the recipient picker renders cached contacts offline instead of gating on a sync that can never complete. * feat: swipe-to-send control on the Send amount screen (#348) * feat: swipe-to-send control on the Send amount screen * fix: lifecycle-safe Send success navigation + sendAction outcome tests * feat: link to Settings from the recipient list in limited contacts mode (#351) * feat: contact avatars on Sent You Cash notifications (#350) * feat: contact avatars and per-category name styling in notifications Sent You Cash pushes render as communication notifications with the sender's contact photo (system monogram fallback) and use the first name. Joined pushes keep the full name and the app icon. Name style is chosen by push category. * refactor: remove name styling — the avatar makes iOS use the full contact name iOS communication notifications take the sender name from the linked contact, so the per-category first-name styling never applied. Removes NotificationNameStyle and reverts the NSE to full-name resolution. * fix: stop Send defaulting to USDF (#352) * fix: stop Send defaulting to USDF Send now shares Give's currency-selection rule via a new CurrencySelection helper, so it excludes USDF when auto-selecting the default currency. Also fixes Give's keypad amount parsing to use Decimal(string:). * refactor: move currency resolution to RatesController Replace the CurrencySelection enum with RatesController.resolveInitialBalance and a giveable array extension on ExchangedBalance. * feat: one-time "already on Flipcash" dialog after first contact scan (#353) Fires once per account when the first contact sync matches at least one contact; surfaced via session.dialogItem above the Send sheet so it never competes with the screen's sheets. * fix: stop "No Contacts Found" flash on first contacts grant (#354) The picker's loading gate is derived from whether contacts are present or the first sync has settled, so a first grant stays on the spinner until the sync completes instead of flashing the empty state. * refactor: lean out contact-sync and fix shared-number picker (#355) * fix: preserve every contact for a shared phone number in the picker The combined snapshot write deduped on e164 only, dropping all but the first contact for a shared number. Both write paths now route through one helper that dedupes on the full (e164, contactId) tuple. Also removes the unused changeHistory/lastSyncedAt columns (SQLiteVersion 13->14). * refactor: extract shared amount-entry ExchangedFiat factory GiveViewModel and SendAmountViewModel shared near-identical enteredFiat logic; both now delegate to ExchangedBalance.enteredFiat(for:rate:). Consolidates the duplicated createExchangedBalance test fixture into a shared ExchangedBalance.makeTest. * refactor: remove dead and speculative code from contact-sync Drops the unused isAllowing param, MessageComposerSheet.body, and the configurable avatar-cache init; tightens comments and access levels. * fix: don't activate contact sync until a phone is verified Bootstrap activation was gated only on contacts access, so a new user who granted contacts during onboarding triggered a first scan and the "already on Flipcash" dialog before verifying a phone. It now also requires the cached profile's verified phone. Also wraps the phone-payment link in a bounded retry. * fix: never retry CancellationError in Task.retry Cancellation must short-circuit. The helper now rethrows CancellationError before consulting shouldRetry or sleeping, so every caller propagates cancellation promptly. Adds a regression test. * fix: show one recipient row per number, preferring the named contact Two contacts sharing a phone number collapse to a single picker row labeled by the best name — a real name beats a bare-number fallback, and between two named contacts the last-seen wins. Also refreshes the local snapshot on the unchanged-checksum sync path so a contact added or renamed on an existing number surfaces without a full re-sync. * feat: animate recipient list row changes (#356) Wrap the contact-sync refresh in withAnimation(.snappy) so rows animate as contacts resolve or join. Search and first appear stay instant. * feat: dynamic Home Screen quick actions with flag-gated Send (#357) Build the long-press quick actions dynamically on login and clear them on logout, replacing the static Info.plist list. The Send action is included only for users with the phone-number send flag; everyone else keeps Discover, Cash, and Wallet. * refactor: native search and empty states in Send recipient picker (#359) * refactor: native search and empty states in Send recipient picker * fix: swipe control success checkmark no longer renders green * refactor: replace BlurView with native ultraThinMaterial (#360) * fix: adopt slimmed LargeButton API in ScanBottomBar #366 baked the bottom-bar layout into LargeButton and dropped its per-button sizing params; the Send button was the last caller still passing them. Use the slim form like the other bottom-bar buttons. * refactor: classify transport failures in contact-sync and send services Conform the unary RPCs added on this branch (ContactList checkSync/deltaUpload, Resolver resolvePhone, Phone linkForPayment) to the TransportClassifiableError standard from #345: transient gRPC failures route to a non-reportable .transportFailure via the Result-returning handle overload, instead of mapping every failure to .networkError/.unknown. Fixes linkForPayment reporting timeouts to Bugsnag as fake server errors. * refactor: fade swipe control label as the knob slides (#367) Swap the gradient wipe for a mask whose alpha falls off as the knob advances, and tidy the control: extract the commit flow into a method, collapse the knob's animation modifiers into one, reuse the shared input-stroke color, and drop a redundant layout frame. * feat: nudge to deposit when sending with no balance (#369) * chore: regenerate Core protos for chat, messaging, and event services Adds chat/v1, messaging/v1, and event/v1 to the Core domain. Prefixes the Core messaging-service files (flipcash_messaging_v1_*) so their basenames don't collide with the OCP Payments messaging service in the merged FlipcashAPI module; Scripts/run reproduces the rename on future regens. * feat: DM chat with conversations, live event stream, and iMessage UI Adds a protocol-oriented ChatController (single-concern capability protocols, unit-tested via mocks) backed by a pure ConversationStore, the bidirectional event.v1 stream, and an iMessage-style transcript (grouped bubbles, date headers, focused composer). Counterpart names resolve via ProfileService. Surfaced as a Chats section in the recipient picker. Cash-in-chat deferred pending a server change. * fix: use "Flipcash User" fallback for un-named DM counterparts The server leaves chat-member display names empty and there is no client path from a member UserId to a contact, so an un-named DM showed the cold "Direct Message". Show "Flipcash User" until the name resolves. * refactor: harden the chat event stream and unit-test its decode Lifts patterns from LiveMintDataStreamer: stop the stream on logout (it was never stopped, leaking it and evicting the next session), a status-code logging matrix, isLikelyHealthy, and generation/backoff logging. Extracts the ChatUpdate->ChatStreamEvent decode into a pure ChatStreamEvent.decode(_:) and unit-tests it plus the controller stream-apply path. * refactor: source chat names and read state from the feed, not extra RPCs The DM feed already ships each member's profile name and READ pointer, but the controller re-fetched the name via a per-conversation getProfile (an N+1 fan-out) and never read the pointers, so markRead re-advanced on every open. - Drop resolveNames and the now-unused ProfileFetching dependency; titles use the feed-provided display name. - Map Member.pointers into ChatMember.readPointer and short-circuit markRead when the latest message is already read. - Decode live pointer_updates into a readPointersChanged event, applied monotonically, so read state stays current mid-session. * refactor: drop redundant contact-sync SQLite re-read and phone re-parses - replaceFlipcashContacts/refreshFlipcashContacts return the deduped match count, so first-scan signalling no longer re-reads the whole FlipcashContact table it just wrote. - Memoize E.164 to national formatting in RecipientLoader so a recurring number is parsed through PhoneNumberKit once per load. * refactor: avoid full-transcript rebuilds in the chat hot paths - mergeMessages: fast monotonic-append when incoming is strictly newer than the current tail, instead of rebuilding the whole [MessageID: ChatMessage] map and re-sorting on every streamed/sent message. Out-of-order, first-load, and the send echo still route to the dedupe+sort fallback. - ChatScreen: move transcript grouping into the ConversationTranscript child (messages + selfUserID as let inputs) so composer keystrokes no longer recompute the grouped [TranscriptItem]. * fix: stop markRead double-firing on first chat open On first open, .task awaits loadMessages (which flips messages.last?.id from nil, firing onChange's markRead) then awaits its own markRead; both pass the synchronous read-watermark guard before either advancePointer RPC resumes, so each sends a redundant pointer advance. Gate the onChange path behind a didInitialRead flag set after the initial read — hasLoaded is set too early to use here. * refactor: rename chat domain models to Conversation Renames the client domain types, controller, screen, and tests from Chat* to Conversation* (ConversationID, ConversationMessage, ConversationMember, ConversationStreamEvent, ConversationController, ConversationScreen). The service/RPC layer (ChatService, ChatMessagingService, getDmChatFeed, getChat) stays wire-aligned with the chat.v1 proto for cross-stack traceability. * chore: adopt latest backend protos (chat cash content, intent app metadata, indirect-send rename) Regen Core (flipcash2) and Payments (OCP) protos. Adapts the activity metadata case renames (gave/sent -> directlySent/indirectlySent) and the isRemoteSend -> isIndirectSend field rename across intent builders. New surfaces (CashContent, intent/v1 AppMetadata, contact dm_chat_id, push chat navigation) are generated but not yet consumed. * feat: post contact payments into DM chats and render cash messages Contact payments now attach intent app metadata (chat id + linked source/destination phones) so the server posts the payment as a cash message in the contact's DM, creating the chat when needed. Contact sync stores each contact's dm_chat_id (SQLiteVersion 14 -> 15), and conversations decode and render CashContent bubbles alongside text. * feat: title DM conversations with the contact's address-book name Joins conversation IDs to synced contacts via dm_chat_id. Falls back to the server-provided member name, then the generic placeholder. Resolves even before the feed loads. * feat: chat-first contact send flow with iMessage-style transcript polish Tapping a contact now opens the DM chat directly, with Send Cash and Send Message actions; Send Message appears only once the chat actually exists (dmChatID is pre-assigned for matched contacts, so existence is feed/messages based). Cash cards, text bubbles, the glass composer, grouped-corner morphing and insertion/amount animations follow the Message UI design. New chats hydrate into the Recents feed live from the event stream, and unmatched push senders show their phone number instead of "Someone you know". * fix: ride the chat transcript with the keyboard and match the footer gradient * feat: open DM conversations from /chat deep links and pushes * feat: unread indicator on chat rows in the Send picker * feat: collapse the Send picker into one activity-sorted On Flipcash section * refactor: dedupe bubble and picker row chrome, split ConversationScreen Shared ConversationBubbleChrome modifier and RecipientRowScaffold replace forked view chrome; transcript and bottom bar move to their own files. Also: one fallback-name constant, Task.delay convention, unified push substitution resolution, hydrate-log metadata, test poll helper. * feat: persist conversations in SQLite and make chat opens static Conversations, members, and messages now cache locally (SQLiteVersion 16); the controller hydrates at init and writes through on every server touch. Transcripts seed from the warm store at mount, the list is born bottom- anchored with an instant post-layout correction, and animations gate on the persisted read pointer: a message animates only the first time it's seen. * perf: move conversation cache off the launch path and bound it Hydration runs off-main after session start instead of blocking init; message dates store as epoch doubles to skip the per-row date parse; the feed fetch requests newest-first and the local cache keeps only the most recent 100 messages per chat. Cold opens render statically via a captured read-pointer boundary, matching warm launches. * fix: classify chat RPC transport failures as non-reportable The five unary handlers in ChatMessagingService and ChatService hand-mapped gRPC transport failures to a reportable .unknown, shipping timeouts and unavailable-channel conditions to Bugsnag. Route them through the Result-returning handle overload and conform their error enums to TransportClassifiableError so transient statuses land in .transportFailure. * fix: keep the chat composer up on a cancelled back-swipe and lean out transcript scrolling The composer collapsed to the action buttons when a cancelled interactive back-swipe transiently lowered the keyboard. Drive the composer/buttons swap off @focusstate (which survives the cancelled pop) instead of a keyboardWillHide observer, so it stays up. Transcript: keep defaultScrollAnchor(.bottom) for opening at and following the bottom, and a single keyboardWillShow scroll that re-realizes the lazy rows and rides the keyboard. Drops the redundant open, new-message, and keyboard-hide scrolls (the hide scroll was the cancelled-swipe jank). * refactor: remove dead chat/send code and tighten comments Isolated, behavior-preserving cleanups across the chat/send surface: - ConversationStore: drop the mergeMessages strictly-newer fast path (the dictionary fallback is identical); remove its dedicated test. - ContactDirectory: delete ContactPlacement + placements() (the isOnFlipcash field was never read); iterate the snapshot directly. Drop its tests. - Drop unused conformances/payloads: ConversationID: Comparable, ChatPaymentMetadata: Equatable/Hashable, RecipientResolution.failed's Error. - ConversationMessageRow: inline displayedAmountValue; plain let for the bubble grouping params (no speculative defaults). - RecipientPickerScreen: log the compose result directly, drop outcomeName. - ConversationBottomBar: inline the one-use ComposerGlass modifier. - ConversationController.markRead: do/catch with error reporting, not a swallowing (try? ...) != nil probe. - Trim narration/roadmap comments to one-what + one-constraint. * fix: render the chat transcript on open without a scroll nudge A large conversation opened blank: defaultScrollAnchor(.bottom) positions the first paint but doesn't realize the LazyVStack's rows, so nothing showed until a manual scroll. Restore an onAppear scroll-to-bottom (with a deferred second pass for the estimated-height residue) that forces realization on open; short transcripts that fit the viewport don't scroll and stay top-aligned. * refactor: rebuild ConnectPhoneEmptyState on ContentUnavailableView Match the sibling Send empty states; drop the hand-rolled VStack/Spacer/sized-image scaffolding. * refactor: drop the displayedMessages mirror; feed the transcript live messages Removes displayedMessages/isTopmost and the 400ms syncDisplayedAfterReturn deferral. The transcript reads the controller's live messages directly; the once-per-message amount roll still gates on the read watermark (seenBoundary), and the onAppear scroll opens at the bottom. A cash card that arrives while the amount screen covers the chat now appears immediately on return rather than springing in after the pop. * refactor: own composer state inside the conversation bottom bar Push draft/isSending/focus/send() out of ConversationScreen and into ConversationBottomBar, which reads ConversationController from the environment. Keystrokes no longer re-evaluate the whole screen body, and the screen passes only conversationID plus the two visibility flags. interactiveDismissDisabled keys off isComposing. * fix: stop the transcript over-scrolling on a cancelled back-swipe The transcript scrolled to the bottom on every keyboardWillShow, so a cancelled interactive back-swipe — which churns the keyboard frame without reopening the composer — fired a spurious scroll that overshot mid-transition and snapped the whole transcript away. Arm the scroll when the composer opens (isComposing flips true) and consume it on the next keyboardWillShow, keeping the keyboard-rise timing that pins the newest message while ignoring keyboard churn that isn't composer-driven. * feat: chat read receipts Capture the messaging Pointer.ts and show an iMessage-style receipt under the user's latest sent message: "Delivered" until the counterpart reads it, then "Read 3:42 PM". The read time threads proto -> stream/model -> store -> SQLite (new conversation_member.readPointerTimestamp column, SQLiteVersion 19); the transcript derives the counterpart receipt live from the controller. Also fix the transcript not opening at the bottom when newer messages load after the cached open: restore the explicit follow-the-bottom scroll that defaultScrollAnchor(.bottom) does not provide once the first paint is past. * refactor: state the read-pointer timestamp explicitly on self mark-read advanceReadPointer no longer defaults its date argument, so the self mark-read path passes `at: nil` explicitly rather than silently dropping the pointer's paired timestamp through a default. * feat: clear the notification badge when the app becomes active Server pushes now set an app-icon badge; reset it to 0 in the .active scenePhase handler so it doesn't linger after the user opens the app. * feat: page older chat history with a bottom-anchored transcript Bottom-anchored transcript (defaultScrollAnchor): opens on the newest message, holds position as older pages prepend, and rides up with the keyboard. Pages older history with a before:-cursor, fetching only when scrolled to the top and showing the spinner just during the fetch. Adds a debounced mark-read and a DEBUG message-blast menu, and bumps the min deployment target to iOS 18 for the ScrollPosition APIs. * refactor: rework chat transcript scrolling on atelier's ChatScrollView Open on the newest message, load the full history so scrolling up reaches the first message, and follow sent/received messages to the bottom. Remove the debug blast button. * fix: restore drag-to-dismiss on the chat transcript The atelier ChatScrollView rework dropped scrollDismissesKeyboard, so a cancelled compose had no way back to the Send Cash / Send Message buttons. Dragging the transcript down lowers the keyboard again and the focus-loss handler collapses the composer. * fix: stop the chat transcript flickering on keyboard drag-down The interactive keyboard dismiss makes SwiftUI transiently re-report the scroll content height, which fed the follow-to-bottom scrollTo and looped at ~30Hz. Gate the follow on a stable container height and only re-arm it while the scroll is idle. * refactor: request contacts only from Send, not during onboarding Onboarding no longer prompts for Contacts; phone verification advances straight to push permission and login. Contacts access is requested when the user opens Send, where the picker already presents the permission screen. * test: tap the invite row by its accessibility label in the send smoke test The invite affordance is the whole contact row — a single button labeled with the contact's name and number — not a button titled "Invite".

Uh oh!

How to Use the Seed Phrase in a solana Wallet to get the same Adress like in the Code Wallet on IPhone? #5

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions