@decentnetwork/peer 0.1.139 → 0.1.141

package/dist/compat/dnft1.d.ts

@@ -0,0 +1,62 @@
+/** "\u{1E}DNFT1" — the leading bytes of every frame. */
+export declare const DNFT1_MAGIC: Uint8Array<ArrayBuffer>;
+/** magic(6) + packetId(1) + payloadLen(4). */
+export declare const DNFT1_HEADER_LENGTH = 11;
+/** Wrap one file-transfer packet payload in a DNFT1 frame. */
+export declare function encodeDnft1Frame(packetId: number, payload: Uint8Array): Uint8Array;
+/**
+ * Parse a DNFT1 frame out of a received message body.
+ *
+ * Returns null for anything that is not a file-transfer frame (ordinary chat
+ * data — the common case, so this must stay cheap), and for a frame truncated
+ * below its declared payload length: dropped rather than half-parsed, since a
+ * short read would hand the engine a chunk with missing bytes. Bytes past
+ * payloadLen are transport junk and are ignored.
+ */
+export declare function parseDnft1Frame(raw: Uint8Array): {
+    packetId: number;
+    payload: Uint8Array;
+} | null;
+/**
+ * Picks the transport for each friend's file packets: raw messenger packets
+ * (a JS peer, which is faster — no envelope, no message-channel framing) or
+ * DNFT1 frames (a native peer, the only thing that reaches its app layer).
+ *
+ * There is no reliable capability handshake to key this off — appVersion is
+ * absent for older builds and lies across forks — so the mode is LEARNED from
+ * what actually works, which needs no negotiation and self-corrects:
+ *
+ *   - The engine already retransmits an unanswered OFFER until the receiver
+ *     responds. Every UNANSWERED_OFFERS_BEFORE_SWITCH of those with no inbound
+ *     file packet flips the transport. Alternating (rather than a one-way
+ *     downgrade) matters: an old JS peer that cannot parse DNFT1 must not be
+ *     stranded there by one slow response, and a native peer must not be
+ *     stranded on raw. Each transport keeps getting tried until one answers.
+ *   - The first inbound file packet PINS the mode to the transport it arrived
+ *     on and stops the alternation. That is ground truth about what the peer
+ *     speaks, so later transfers to that friend start on the right one.
+ *
+ * At the engine's offer cadence (~450ms) a switch costs about 1.4s, well
+ * inside the 60s give-up window, so the wrong initial guess is invisible.
+ */
+export declare class Dnft1TransportPolicy {
+    #private;
+    /** Consecutive unanswered offers before trying the other transport. */
+    static readonly UNANSWERED_OFFERS_BEFORE_SWITCH = 3;
+    /** True when this friend's file packets should be sent as DNFT1 frames. */
+    useDnft1(friendId: string): boolean;
+    /** True once a real inbound file packet has settled the transport. */
+    isPinned(friendId: string): boolean;
+    /**
+     * Called for every outbound OFFER (packet 80). Returns true when this offer
+     * flipped the transport — the caller should send THIS offer on the new one.
+     */
+    noteOfferSent(friendId: string): boolean;
+    /**
+     * Called for every inbound file packet, with the transport it arrived on.
+     * Pins the mode: the peer just proved which one it speaks.
+     */
+    noteInbound(friendId: string, viaDnft1: boolean): void;
+    /** Drop all state for a friend (removed, or session torn down). */
+    forget(friendId: string): void;
+}

package/dist/compat/dnft1.js

@@ -0,0 +1,146 @@
+// DNFT1 — carrying file-transfer packets 80–83 inside ordinary friend messages.
+//
+// Why this exists: the JS peer speaks toxcore messenger packets 80–83 natively,
+// but a native app never sees them. The precompiled Carrier C SDK consumes
+// 80/81/82 internally (they feed its own file state machine, which registers no
+// app callbacks) and discards 83 (FEC — it does not know the id). A P0 probe on
+// iOS confirmed it: raw packets never reach the mobile app layer, so JS↔iOS
+// file transfer could not work at all.
+//
+// The fix keeps the SDK untouched: both ends carry the SAME packet payloads
+// inside ordinary friend messages, wrapped in a frame no chat text can produce.
+// iOS implemented it first (FileTransferWire.swift in the Beagle app); this is
+// the byte-exact JS counterpart — read that file before changing anything here.
+//
+//   [0x1E]["DNFT1"][packetId u8][payloadLen u32 BE][payload]
+//
+// - 0x1E (record separator) leads, mirroring the "\u{1E}DNPACK1:" text-ack
+//   envelope convention — a one-byte reject for ordinary chat text.
+// - payloadLen is explicit because the carrier/express path can append junk
+//   past the real payload. Trailing junk after a binary chunk would corrupt the
+//   file, so the frame carries its own length and anything past it is ignored.
+//
+// The payloads inside are UNCHANGED — the same bytes filetransfer.ts already
+// builds. This module only adds and removes the envelope, so the engine, the
+// FEC layer and the conformance fixtures stay transport-agnostic.
+import { PACKET_ID_FILE_SENDREQUEST, PACKET_ID_FILE_FEC, } from "./filetransfer.js";
+/** "\u{1E}DNFT1" — the leading bytes of every frame. */
+export const DNFT1_MAGIC = Uint8Array.from([0x1e, 0x44, 0x4e, 0x46, 0x54, 0x31]);
+/** magic(6) + packetId(1) + payloadLen(4). */
+export const DNFT1_HEADER_LENGTH = 11;
+/** Wrap one file-transfer packet payload in a DNFT1 frame. */
+export function encodeDnft1Frame(packetId, payload) {
+    const out = new Uint8Array(DNFT1_HEADER_LENGTH + payload.length);
+    out.set(DNFT1_MAGIC, 0);
+    out[6] = packetId & 0xff;
+    const n = payload.length;
+    out[7] = (n >>> 24) & 0xff;
+    out[8] = (n >>> 16) & 0xff;
+    out[9] = (n >>> 8) & 0xff;
+    out[10] = n & 0xff;
+    out.set(payload, DNFT1_HEADER_LENGTH);
+    return out;
+}
+/**
+ * Parse a DNFT1 frame out of a received message body.
+ *
+ * Returns null for anything that is not a file-transfer frame (ordinary chat
+ * data — the common case, so this must stay cheap), and for a frame truncated
+ * below its declared payload length: dropped rather than half-parsed, since a
+ * short read would hand the engine a chunk with missing bytes. Bytes past
+ * payloadLen are transport junk and are ignored.
+ */
+export function parseDnft1Frame(raw) {
+    if (raw.length < DNFT1_HEADER_LENGTH)
+        return null;
+    for (let i = 0; i < DNFT1_MAGIC.length; i++) {
+        if (raw[i] !== DNFT1_MAGIC[i])
+            return null;
+    }
+    const packetId = raw[6];
+    if (packetId < PACKET_ID_FILE_SENDREQUEST || packetId > PACKET_ID_FILE_FEC)
+        return null;
+    // >>> 0 keeps the length unsigned: a hostile 0xFFFFFFFF must compare as
+    // 4294967295 (and fail the bounds check), not as -1 (which would pass it).
+    const length = ((raw[7] << 24) | (raw[8] << 16) | (raw[9] << 8) | raw[10]) >>> 0;
+    if (raw.length - DNFT1_HEADER_LENGTH < length)
+        return null;
+    return {
+        packetId,
+        payload: raw.subarray(DNFT1_HEADER_LENGTH, DNFT1_HEADER_LENGTH + length),
+    };
+}
+/**
+ * Picks the transport for each friend's file packets: raw messenger packets
+ * (a JS peer, which is faster — no envelope, no message-channel framing) or
+ * DNFT1 frames (a native peer, the only thing that reaches its app layer).
+ *
+ * There is no reliable capability handshake to key this off — appVersion is
+ * absent for older builds and lies across forks — so the mode is LEARNED from
+ * what actually works, which needs no negotiation and self-corrects:
+ *
+ *   - The engine already retransmits an unanswered OFFER until the receiver
+ *     responds. Every UNANSWERED_OFFERS_BEFORE_SWITCH of those with no inbound
+ *     file packet flips the transport. Alternating (rather than a one-way
+ *     downgrade) matters: an old JS peer that cannot parse DNFT1 must not be
+ *     stranded there by one slow response, and a native peer must not be
+ *     stranded on raw. Each transport keeps getting tried until one answers.
+ *   - The first inbound file packet PINS the mode to the transport it arrived
+ *     on and stops the alternation. That is ground truth about what the peer
+ *     speaks, so later transfers to that friend start on the right one.
+ *
+ * At the engine's offer cadence (~450ms) a switch costs about 1.4s, well
+ * inside the 60s give-up window, so the wrong initial guess is invisible.
+ */
+export class Dnft1TransportPolicy {
+    /** Consecutive unanswered offers before trying the other transport. */
+    static UNANSWERED_OFFERS_BEFORE_SWITCH = 3;
+    #dnft1 = new Set();
+    #pinned = new Set();
+    #unanswered = new Map();
+    /** True when this friend's file packets should be sent as DNFT1 frames. */
+    useDnft1(friendId) {
+        return this.#dnft1.has(friendId);
+    }
+    /** True once a real inbound file packet has settled the transport. */
+    isPinned(friendId) {
+        return this.#pinned.has(friendId);
+    }
+    /**
+     * Called for every outbound OFFER (packet 80). Returns true when this offer
+     * flipped the transport — the caller should send THIS offer on the new one.
+     */
+    noteOfferSent(friendId) {
+        if (this.#pinned.has(friendId))
+            return false;
+        const n = (this.#unanswered.get(friendId) ?? 0) + 1;
+        if (n < Dnft1TransportPolicy.UNANSWERED_OFFERS_BEFORE_SWITCH) {
+            this.#unanswered.set(friendId, n);
+            return false;
+        }
+        this.#unanswered.set(friendId, 0);
+        if (this.#dnft1.has(friendId))
+            this.#dnft1.delete(friendId);
+        else
+            this.#dnft1.add(friendId);
+        return true;
+    }
+    /**
+     * Called for every inbound file packet, with the transport it arrived on.
+     * Pins the mode: the peer just proved which one it speaks.
+     */
+    noteInbound(friendId, viaDnft1) {
+        this.#unanswered.delete(friendId);
+        this.#pinned.add(friendId);
+        if (viaDnft1)
+            this.#dnft1.add(friendId);
+        else
+            this.#dnft1.delete(friendId);
+    }
+    /** Drop all state for a friend (removed, or session torn down). */
+    forget(friendId) {
+        this.#dnft1.delete(friendId);
+        this.#pinned.delete(friendId);
+        this.#unanswered.delete(friendId);
+    }
+}

package/dist/index.d.ts

@@ -14,4 +14,4 @@ export { LegacyProtocolNotImplementedError } from "./runtime/errors.js";
 export type { CarrierPacket, FriendMessagePacket, FriendRequestPacket, InviteReqPacket, InviteRspPacket } from "./compat/packet.js";
 export type { ToxDhtCryptoRequest } from "./compat/tox-dht-crypto.js";
 export type { CarrierAddressParts } from "./compat/address.js";
-export type { CompatibilityMode, CustomPacketEvent, FriendConnectionEvent, FriendConnectionStatus, FriendInfoEvent, FriendRequest, InlineFileEvent, InviteEvent, InviteResponseEvent, LookupResult, NetworkNode, PeerOptions, SendTextUntilAckOptions, TextMessage } from "./types/peer.js";
+export type { CompatibilityMode, CustomPacketEvent, FriendConnectionEvent, FriendConnectionStatus, FriendInfoEvent, FriendRequest, InlineFileEvent, InlineSendResult, InviteEvent, InviteResponseEvent, LookupResult, NetworkNode, PeerOptions, SendTextUntilAckOptions, TextMessage } from "./types/peer.js";

package/dist/peer.d.ts

@@ -1,7 +1,7 @@
 import { type BootstrapResult } from "./compat/bootstrap.js";
 import type { FriendRecord } from "./store/friends.js";
 import { type CarrierTurnServerInfo, type RtcIceServer } from "./ice-servers.js";
-import type { CustomPacketEvent, FriendConnectionEvent, FriendRequest, FriendInfoEvent, InlineFileEvent, InviteEvent, InviteResponseEvent, LookupResult, NetworkNode, PeerOptions, SendTextUntilAckOptions, TextMessage } from "./types/peer.js";
+import type { CustomPacketEvent, FriendConnectionEvent, FriendRequest, FriendInfoEvent, InlineFileEvent, InlineSendResult, InviteEvent, InviteResponseEvent, LookupResult, NetworkNode, PeerOptions, SendTextUntilAckOptions, TextMessage } from "./types/peer.js";
 export declare class Peer {
     #private;
     private constructor();
@@ -140,7 +140,16 @@ export declare class Peer {
         name: string;
         data: Uint8Array;
         fileType?: "image" | "audio" | "text" | "unknown";
-    }): Promise<void>;
+        deliveryTimeoutMs?: number;
+    }): Promise<InlineSendResult>;
+    /**
+     * True when this friend is a NATIVE Carrier client (iOS/Android/C SDK): its
+     * DHT/relay key differs from its identity key, where a JS peer announces its
+     * identity key as its DHT key. Natives cannot see the toxcore file-transfer
+     * protocol (sendFile) — the inline envelope is their only file path — and
+     * they never speak the JS text-ACK scheme.
+     */
+    isNativeFriend(pubkey: string): boolean;
     /** Fired when a peer sends a Carrier friend-invite (PACKET_TYPE_INVITE_REQUEST).
      *  This is the channel the iOS/Android WebRTC SDK uses for call signaling —
      *  each RtcSignal arrives as an "invite" with ext="carrier" and `data` the

package/dist/peer.js

@@ -13,6 +13,7 @@ import { NET_PACKET_ONION_ANNOUNCE_RESPONSE, NET_PACKET_ONION_DATA_RESPONSE, ONI
 import { CRYPTO_PACKET_DHTPK, CRYPTO_PACKET_FRIEND_REQ, NET_PACKET_CRYPTO, createToxDhtCryptoRequest, openToxDhtCryptoRequest } from "./compat/tox-dht-crypto.js";
 import { NET_PACKET_PING_REQUEST, NET_PACKET_PING_RESPONSE, NET_PACKET_GET_NODES, NET_PACKET_SEND_NODES, encodeDhtRpc, decodeDhtRpc, buildPingPlain, parsePingPlain, buildGetNodesPlain, parseGetNodesPlain, buildSendNodesPlain, parseSendNodesNodeBytes, packUdpNodeV4 } from "./compat/dht-rpc.js";
 import { FileTransferManager, PACKET_ID_FILE_SENDREQUEST, PACKET_ID_FILE_CONTROL, PACKET_ID_FILE_DATA, PACKET_ID_FILE_FEC } from "./compat/filetransfer.js";
+import { Dnft1TransportPolicy, encodeDnft1Frame, parseDnft1Frame } from "./compat/dnft1.js";
 import { NET_PACKET_CRYPTO_DATA, NET_PACKET_CRYPTO_HS, NET_PACKET_COOKIE_REQUEST, NET_PACKET_COOKIE_RESPONSE, createCookieRequest, createCookieResponse, createCryptoDataPacket, createCryptoHandshake, openCookieRequest, openCookieResponse, openCryptoDataPacket, openCryptoHandshake, incrementNonce } from "./compat/net-crypto.js";
 import { LegacyExpressClient } from "./compat/express.js";
 import { TcpRelayPool } from "./compat/tcp-relay-pool.js";
@@ -295,12 +296,22 @@ export class Peer {
      *  old peer returns ACCEPT/ACK over its reliable TCP relay. */
     #fileRelayNegotiationUntil = new Map();
     // Toxcore-standard file transfer (wire-compatible with native Carrier/toxcore).
+    /** Which transport carries each friend's file packets — raw messenger
+     *  packets (JS peers) or DNFT1 frames inside friend messages (native peers,
+     *  whose Carrier SDK swallows 80-82 and drops 83). See compat/dnft1.ts. */
+    #dnft1 = new Dnft1TransportPolicy();
     #fileTransfer = new FileTransferManager((friendId, packetId, payload) => {
         if (packetId === PACKET_ID_FILE_SENDREQUEST) {
             const session = this.#friendSessions.get(friendId);
             const lan = !!session?.lanRemoteHost && session.remote?.host === session.lanRemoteHost;
             if (!lan)
                 this.#fileRelayNegotiationUntil.set(friendId, Date.now() + 6_000);
+            // Every unanswered offer is evidence the peer cannot hear this
+            // transport; the policy alternates until one of them answers.
+            this.#dnft1.noteOfferSent(friendId);
+        }
+        if (this.#dnft1.useDnft1(friendId)) {
+            return this.#sendDnft1Frame(friendId, packetId, payload);
         }
         return this.#sendMessengerPacket(friendId, packetId, payload);
     }, (event, payload) => { this.#events.emit(event, payload); }, (friendId) => {
@@ -1180,6 +1191,7 @@ export class Peer {
         const existed = this.#friends.delete(friendId);
         this.#friendSessions.delete(friendId);
         this.#fileRelayNegotiationUntil.delete(friendId);
+        this.#dnft1.forget(friendId);
         this.#pendingFriendRequests.delete(friendId);
         this.#cookieRetryCount.delete(friendId);
         this.#lastCookieSentKey.delete(friendId);
@@ -1240,6 +1252,9 @@ export class Peer {
         }
         await this.#sendTextPlain(pubkey, text);
     }
+    /** What #sendTextPlain actually did with the message — callers that promise
+     *  delivery semantics (inline files) need to know the path and, for the live
+     *  path, where the send window stood after the last fragment. */
     async #sendTextPlain(pubkey, text) {
         const friend = this.#friends.get(pubkey);
         if (!friend) {
@@ -1307,7 +1322,10 @@ export class Peer {
                 for (const p of livePackets) {
                     await this.#sendMessengerPacket(pubkey, PACKET_ID_MESSAGE, p);
                 }
-                return;
+                // Every fragment got a packet number BELOW the counter's position now —
+                // when the peer's implicit acks advance the window past it, the whole
+                // message is confirmed on their device.
+                return { via: "online", endPacketNumber: this.#friendSessions.get(pubkey)?.sendPacketNumber };
             }
             catch (error) {
                 const emsg = error.message;
@@ -1343,7 +1361,7 @@ export class Peer {
         // no session is simply a no-op.
         if (text.length === 0) {
             this.#debugLog(`sendText: empty connection-kick to ${pubkey} with no live session — dropping (not flooding express)`);
-            return;
+            return { via: "online" };
         }
         // Offline / fallback path via Carrier express HTTP store-and-forward.
         // Skipped entirely in control-plane-only mode (decentlan's data plane):
@@ -1353,7 +1371,7 @@ export class Peer {
         if (this.#express?.hasNodes() && !this.#opts.expressControlPlaneOnly) {
             await this.#express.sendOfflineText(pubkey, packet);
             this.#debugLog(`sendText: queued via express for ${pubkey}`);
-            return;
+            return { via: "offline" };
         }
         throw new Error("friend is offline and no express node is configured");
     }
@@ -1568,7 +1586,77 @@ export class Peer {
         if (envelope.length > CARRIER_MAX_APP_BULKMSG_LEN) {
             throw new Error(`inline file too large for the message channel (${envelope.length} bytes encoded, max ${CARRIER_MAX_APP_BULKMSG_LEN})`);
         }
-        await this.sendText(pubkey, envelope);
+        // The confirmation window scales with the payload: a floor for handshake
+        // latency plus time to move the envelope at a conservative 50 KB/s, capped
+        // so a dead session can't pin the caller for ages.
+        const deliveryTimeoutMs = opts.deliveryTimeoutMs ??
+            Math.min(180_000, 20_000 + Math.ceil(envelope.length / 50));
+        if (this.#shouldRequireTextAck(pubkey)) {
+            // JS peer: the app-level text-ACK is the strongest confirmation there is
+            // — the receiving app parsed the envelope. The retry interval must be
+            // longer than one full send of the payload, or a slow path gets the
+            // whole multi-MB envelope re-blasted mid-flight.
+            await this.sendTextUntilAck(pubkey, envelope, {
+                timeoutMs: deliveryTimeoutMs,
+                retryIntervalMs: Math.max(TEXT_ACK_RETRY_MS, Math.ceil(envelope.length / 100))
+            });
+            return { delivery: "acked" };
+        }
+        // Native peer (iOS/Android/C): it will never speak our text-ACK envelope,
+        // but its toxcore DOES acknowledge every reliable packet — the very signal
+        // its own SDK surfaces to the app as "Delivered". Wait for the send window
+        // to drain past our fragments.
+        const outcome = await this.#sendTextPlain(pubkey, envelope);
+        if (outcome.via === "offline")
+            return { delivery: "offline" };
+        if (outcome.endPacketNumber === undefined)
+            return { delivery: "accepted" };
+        const acked = await this.#awaitTransportAck(pubkey, outcome.endPacketNumber, deliveryTimeoutMs);
+        this.#debugLog(`inline file "${opts.name}" to ${pubkey}: transport ${acked ? "ACKED" : `NOT confirmed within ${deliveryTimeoutMs}ms`}`);
+        return { delivery: acked ? "acked" : "accepted" };
+    }
+    /**
+     * True once the friend's implicit acks (PACKET_ID_REQUEST walks) have moved
+     * our reliable send window past `endPacketNumber` — i.e. every packet we had
+     * sent by that point is confirmed received on their device. False when the
+     * window doesn't drain in time or the session dies/rekeys under us (a new
+     * session restarts the numbering, so the old position proves nothing).
+     */
+    async #awaitTransportAck(pubkey, endPacketNumber, timeoutMs) {
+        const watched = this.#friendSessions.get(pubkey);
+        if (!watched)
+            return false;
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const session = this.#friendSessions.get(pubkey);
+            if (session !== watched || !session.established)
+                return false;
+            const start = session.sendBufferStartNum;
+            if (start !== undefined) {
+                // Wraparound-safe: the window is ≤8192 packets, so a "distance" over
+                // 2^31 means start has passed endPacketNumber.
+                const pending = (endPacketNumber - start) >>> 0;
+                if (pending === 0 || pending > 0x80000000)
+                    return true;
+            }
+            else if (!session.sendArray || session.sendArray.size === 0) {
+                return true; // nothing left unacknowledged at all
+            }
+            if (Date.now() >= deadline)
+                return false;
+            await sleep(250);
+        }
+    }
+    /**
+     * True when this friend is a NATIVE Carrier client (iOS/Android/C SDK): its
+     * DHT/relay key differs from its identity key, where a JS peer announces its
+     * identity key as its DHT key. Natives cannot see the toxcore file-transfer
+     * protocol (sendFile) — the inline envelope is their only file path — and
+     * they never speak the JS text-ACK scheme.
+     */
+    isNativeFriend(pubkey) {
+        const friend = this.#friends.get(pubkey);
+        return !!(friend?.dhtPubkey && friend.dhtPubkey !== friend.pubkey);
     }
     /** Fired when a peer sends a Carrier friend-invite (PACKET_TYPE_INVITE_REQUEST).
      *  This is the channel the iOS/Android WebRTC SDK uses for call signaling —
@@ -1675,6 +1763,37 @@ export class Peer {
     onCustomPacket(cb) {
         this.#events.on("customPacket", cb);
     }
+    /**
+     * Send one file-transfer packet as a DNFT1 frame inside a friend message —
+     * the only route that reaches a native app's layer (its Carrier SDK
+     * swallows packets 80-82 and drops 83). Payload bytes are unchanged; see
+     * compat/dnft1.ts for the envelope and the iOS counterpart.
+     *
+     * Deliberately live-session only, and never express: express is
+     * store-and-forward for chat, and 100 MB of file chunks has no business in
+     * a mailbox. Control loss is already covered by the engine's offer/ack
+     * retransmits, so a failed send here is a dropped packet the engine will
+     * redo — not a lost transfer.
+     */
+    async #sendDnft1Frame(friendId, packetId, payload) {
+        const frame = encodeDnft1Frame(packetId, payload);
+        // A full DATA frame (11 + 5 + 1367 = 1383 B) exceeds the 1024-byte
+        // friendmsg unit, so it rides BULKMSG fragments — exactly what the C SDK
+        // does when iOS hands the same frame to sendFriendMessage.
+        if (frame.length <= CARRIER_MAX_APP_MESSAGE_LEN) {
+            await this.#sendMessengerPacket(friendId, PACKET_ID_MESSAGE, encodeFriendMessagePacket(frame));
+            return;
+        }
+        const tid = (BigInt(Date.now()) << 20n) ^ BigInt(Math.floor(Math.random() * 0xfffff));
+        for (let off = 0; off < frame.length; off += CARRIER_MAX_APP_MESSAGE_LEN) {
+            const end = Math.min(off + CARRIER_MAX_APP_MESSAGE_LEN, frame.length);
+            await this.#sendMessengerPacket(friendId, PACKET_ID_MESSAGE, encodeBulkMsgPacket({
+                totalsz: off === 0 ? frame.length : 0,
+                tid,
+                data: frame.subarray(off, end)
+            }));
+        }
+    }
     // ───────────────────── file transfer (toxcore-standard, native-ready) ─────
     /**
      * Offer a file to a friend (by userid). Returns the fileId (hex) or null if
@@ -3017,6 +3136,14 @@ export class Peer {
             // the very same packFilePayload as the online path).
             if (this.#tryEmitBinaryInlineFile(fromUserId, decoded.data, "offline"))
                 return;
+            // Neither end routes DNFT1 through express on purpose — a 100 MB stream
+            // has no business in a store-and-forward mailbox, and the engine's
+            // retransmits already cover control loss. But if a frame does surface
+            // here, swallow it rather than rendering the binary as chat mojibake.
+            if (parseDnft1Frame(decoded.data)) {
+                this.#debugLog(`ignoring DNFT1 frame from ${fromUserId} on the express path`);
+                return;
+            }
             if (this.#tryEmitInlineFile(fromUserId, text, "offline"))
                 return;
             void this.#dispatchTextMessage({ pubkey: fromUserId, text, via: "offline" });
@@ -4045,6 +4172,11 @@ export class Peer {
         if (kind === PACKET_ID_FILE_CONTROL)
             this.#fileRelayNegotiationUntil.delete(friendId);
         // Toxcore file transfer (FILE_SENDREQUEST/CONTROL/DATA = 80/81/82).
+        if (kind >= PACKET_ID_FILE_SENDREQUEST && kind <= PACKET_ID_FILE_FEC) {
+            // A raw file packet arrived, so this peer speaks raw — pin it and stop
+            // alternating toward DNFT1.
+            this.#dnft1.noteInbound(friendId, false);
+        }
         if (this.#fileTransfer.handlePacket(friendId, kind, inner))
             return;
         if (kind === PACKET_ID_ONLINE) {
@@ -4243,6 +4375,18 @@ export class Peer {
             else {
                 raw = inner;
             }
+            // DNFT1: a file-transfer packet carried inside a friend message (the
+            // native-interop path — see compat/dnft1.ts). Like the Android binary
+            // envelope below, this MUST run on the undecoded bytes: raw chunk bytes
+            // do not survive a UTF-8 decode.
+            const ft = parseDnft1Frame(raw);
+            if (ft) {
+                this.#dnft1.noteInbound(friendId, true);
+                if (ft.packetId === PACKET_ID_FILE_CONTROL)
+                    this.#fileRelayNegotiationUntil.delete(friendId);
+                this.#fileTransfer.handlePacket(friendId, ft.packetId, ft.payload);
+                return;
+            }
             if (this.#tryEmitBinaryInlineFile(friendId, raw, "online"))
                 return;
             text = decodeUtf8Best(raw);

package/dist/types/peer.d.ts

@@ -135,6 +135,23 @@ export type TextMessage = {
      *  can see when online delivery is failing and only offline messages land. */
     via?: "online" | "offline";
 };
+/**
+ * Outcome of an inline-file send — the caller's ONLY honest basis for a "sent"
+ * checkmark. "Bytes left this machine" is not delivery.
+ */
+export type InlineSendResult = {
+    /**
+     * - "acked": the peer CONFIRMED receipt — an app-level ACK from a JS peer,
+     *   or the toxcore transport ACK from a native one (the same signal Android
+     *   surfaces as ReceiptState.Delivered). Safe to mark "sent".
+     * - "accepted": the transport took the bytes but no confirmation arrived in
+     *   the window. NOT delivered as far as anyone can prove — mark it failed or
+     *   queued, never "sent".
+     * - "offline": stored on the express relay for the peer's next pull. Mark
+     *   it queued.
+     */
+    delivery: "acked" | "accepted" | "offline";
+};
 export type SendTextUntilAckOptions = {
     /** Stable id for retries across a caller-managed outbox. Defaults to a random id. */
     deliveryId?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.139",
+  "version": "0.1.141",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",