libp2r2p 0.11.24 → 0.11.26

package/README.md

@@ -10,7 +10,8 @@ power-ups used by that messenger.
 
 For remote-work scheduling, see [`libp2r2p/network`](network/README.md):
 `isOnline` probes connectivity and `onOnline` shares recovery monitoring,
-including retries when the browser omits its native `online` event.
+including retries when the browser omits its native `online` event and optional
+30-second expedited windows for foreground remote sends.
 
 ## Relay reads and lifecycle
 
@@ -633,9 +634,13 @@ tasks cannot deliver into a new channel generation. Mandatory persistence still
 owns its storage pause; incomplete history remains a pending recovery interval.
 Subscription setup is bounded separately from presence, so a slow announcement
 does not hold the other channels' readers. Sessions prioritize user persistence
-and publication before the next background presence signer call. Signing an outer
-envelope can overlap recovery-seed persistence, but no envelope is yielded for
-publication unless both succeed; only one outer is prepared at a time.
+and publication before the next background presence signer call. `onPreparedSeed`
+receives its existing router/jsonl fields plus `publication`, containing all
+signed fragments, recipient/channel identities and recovery rows for that logical
+event. The callback commits durable recovery before publication: a direct
+messenger uses its seed store; the session uses its encrypted outbox journal and
+archives indexed personal copies independently. No alternative legacy publisher
+is retained. Only one logical event/chunk is prepared per session entry at a time.
 
 `private-channel.fetch` reports incomplete reads as an `AggregateError` with
 stable `code: 'PRIVATE_CHANNEL_FETCH_INCOMPLETE'`. Its message names relays,
@@ -1241,5 +1246,9 @@ Private messenger/session constructors accept optional `fallbackDelayMs` (`null`
 by default). Automatic NIP-65 sends can start configured fallback relays after
 the chosen delay while primary publications retain their deadlines. Explicit
 routes keep sequential fallback; every encrypted recipient must be covered.
+Session `enqueue` accepts optional monotonic `attemptStartedAt`; supplied values
+make preparation consume that delay. Retries/reloads start a fresh attempt and
+uploads budget each chunk independently. Monotonic clocks never enter storage or
+Nostr events. Omitted timestamps keep the publication-local delay.
 `RelayPool.sendEvent` accepts a consumer `signal` without closing shared sockets.
 See [fallback and cancellation](private-messenger/session/README.md#relay-fallback).

package/network/README.md

@@ -30,3 +30,34 @@ Successful probes do not guarantee a particular relay or HTTP server is reachabl
 Handle request failures, cancellations, and timeouts separately. Browsers can
 suspend background tabs, so recovery notification has no wall-clock guarantee.
 Consumers should keep their own work queues but should not duplicate probe loops.
+
+
+## Expedited connectivity detection
+
+`onOnline(handler, { strict = false, expediteForMs = 0, onDebug })` can request
+an optional urgent window (clamped to 30,000 ms; finite, nonnegative durations).
+The same realm/mode monitor coalesces subscriptions: urgent requests can advance
+the next check, at least two seconds after the previous start. Failed checks
+repeat at five seconds between starts, without overlapping slow checks. Native
+online/focus/visibility wakeups remain available. Removing a subscription removes
+its demand without stopping other listeners.
+
+The urgent loop does not spend/reset the ordinary jittered backoff. At expiry it
+returns to the ordinary deadline, or a fresh interval of the preserved retry step
+if that deadline passed; it never catches up missed checks. For example, a normal
+60-second wait remains a 60-second step after an unsuccessful urgent window.
+Connectivity returning after the window must await normal recovery or a new user
+send/retry; automatic retries never extend urgency. `expediteForMs` is scheduling
+advice, not evidence of Internet connectivity or a relay/ACK delivery deadline.
+
+Private-message sessions remember a runtime-only 30-second deadline for new
+remote intents and manual retry. Only work actually waiting for network subscribes
+with the remaining time, sharing one subscription per session. Self-chat, restored
+outbox entries, chunks and automatic retries never renew that deadline. Lock and
+close discard urgency. A confirmed monitor result resumes the existing automatic
+pause owner without another immediate probe; explicit pauses remain caller-owned.
+
+Optional `onDebug` reports only probe reason, state, remaining window and duration.
+Consumers wire it only in development; it is disabled by default. The monitor
+retains no diagnostic history. Session diagnostics additionally correlate the
+network wait and pause-release duration with the event ID.

package/network/index.js

@@ -133,6 +133,8 @@ export function createConnectivityMonitor ({
   _setTimeout = globalThis.setTimeout,
   _clearTimeout = globalThis.clearTimeout,
   _random = Math.random,
+  _now = () => performance.now(),
+  onDebug,
   reportError = error => console.error('Online listener failed', error)
 } = {}) {
   if (check !== undefined && typeof check !== 'function') throw new ValidationError('INVALID_CONNECTIVITY_CHECK')
@@ -148,21 +150,49 @@ export function createConnectivityMonitor ({
     try { Promise.resolve(entry.handler()).catch(reportError) } catch (error) { reportError(error) }
   }
 
-  function schedule (current) {
-    if (session !== current || !listeners.size) return
-    const delay = current.online ? 60000 : RETRY_DELAYS[Math.min(current.retry++, RETRY_DELAYS.length - 1)]
+  const urgencyEnd = () => Math.max(0, ...[...listeners].map(entry => entry.expediteUntil))
+  function arm (current) {
+    if (session !== current || current.pending || !listeners.size) return
+    if (current.timer != null) clearTimer(current.timer)
+    const now = _now()
+    const until = urgencyEnd()
+    const urgent = until > now && (!current.online || current.urgentDue != null)
+    // Urgent checks do not consume or reset the ordinary retry sequence.
+    if (!urgent && current.normalDue <= now) current.normalDue = now + current.normalDelay
+    let due = current.normalDue
+    if (urgent) due = Math.min(until, current.urgentDue ?? current.lastStartedAt + 5000)
     current.timer = setTimer(() => {
       current.timer = null
-      return probe(current)
-    }, Math.round(delay * (0.8 + _random() * 0.4)))
+      if (urgent && _now() >= urgencyEnd()) { arm(current); return }
+      return probe(current, urgent ? 'expedited' : 'backoff')
+    }, Math.max(0, due - now))
     current.timer?.unref?.()
   }
 
-  async function probe (current) {
+  function schedule (current, expedited) {
+    if (session !== current || !listeners.size) return
+    if (!expedited || current.online) {
+      const delay = current.online ? 60000 : RETRY_DELAYS[Math.min(current.retry++, RETRY_DELAYS.length - 1)]
+      current.normalDelay = Math.round(delay * (0.8 + _random() * 0.4))
+      current.normalDue = _now() + current.normalDelay
+    }
+    current.urgentDue = null
+    arm(current)
+  }
+
+  async function probe (current, reason = 'wake') {
     if (session !== current || current.pending) return
     if (current.timer != null) clearTimer(current.timer)
     current.timer = null
     current.pending = true
+    current.lastStartedAt = _now()
+    const expedited = reason === 'expedited'
+    const startedAt = _now()
+    const report = values => {
+      const entry = { stage: 'connectivity-probe', reason, expediteRemainingMs: Math.max(0, urgencyEnd() - _now()), ...values }
+      for (const callback of [onDebug, ...[...listeners].map(listener => listener.onDebug)]) { try { callback?.(entry) } catch {} }
+    }
+    report({ state: 'started' })
     try {
       const online = await runCheck({ signal: current.controller.signal })
       if (session !== current) return
@@ -179,12 +209,13 @@ export function createConnectivityMonitor ({
       for (const entry of listeners) entry.delivered = false
     } finally {
       current.pending = false
-      schedule(current)
+      report({ state: current.online ? 'online' : 'offline', elapsedMs: _now() - startedAt })
+      schedule(current, expedited)
     }
   }
 
   function start () {
-    const current = { online: false, retry: 0, timer: null, pending: false, controller: new AbortController() }
+    const current = { online: false, retry: 0, timer: null, pending: false, lastStartedAt: -Infinity, normalDue: Infinity, normalDelay: 5000, urgentDue: null, controller: new AbortController() }
     session = current
     current.wake = () => { probe(current) }
     current.connectionChanged = () => {
@@ -213,18 +244,29 @@ export function createConnectivityMonitor ({
   }
 
   // Notify once on confirmed initial connectivity, then after each detected reconnection.
-  function onOnline (handler) {
+  function onOnline (handler, { expediteForMs = 0, onDebug } = {}) {
     if (typeof handler !== 'function') throw new ValidationError('INVALID_ONLINE_HANDLER')
-    const entry = { handler, delivered: false }
+    if (!Number.isFinite(expediteForMs) || expediteForMs < 0) throw new ValidationError('INVALID_EXPEDITE_FOR_MS')
+    if (onDebug !== undefined && typeof onDebug !== 'function') throw new ValidationError('INVALID_CONNECTIVITY_DEBUG')
+    const entry = { handler, onDebug, delivered: false, expediteUntil: _now() + Math.min(expediteForMs, 30000) }
     listeners.add(entry)
     if (!session) start()
     else {
       const current = session
-      queueMicrotask(() => { probe(current) })
+      if (expediteForMs > 0 || urgencyEnd() > _now()) {
+        current.urgentDue = Math.max(_now(), current.lastStartedAt + 2000)
+        arm(current)
+      } else {
+        queueMicrotask(() => {
+          if (urgencyEnd() > _now()) arm(current)
+          else probe(current)
+        })
+      }
     }
     return () => {
       if (!listeners.delete(entry)) return
       if (!listeners.size) stop()
+      else arm(session)
     }
   }
 
@@ -234,12 +276,12 @@ export function createConnectivityMonitor ({
 const defaultMonitors = new Map()
 
 // Share probes, capped backoff and wake-up listeners per mode in this realm.
-export function onOnline (handler, { strict = false } = {}) {
+export function onOnline (handler, { strict = false, expediteForMs = 0, onDebug } = {}) {
   const key = strict ? 'strict' : 'lenient'
   let monitor = defaultMonitors.get(key)
   if (!monitor) {
     monitor = createConnectivityMonitor({ strict })
     defaultMonitors.set(key, monitor)
   }
-  return monitor.onOnline(handler)
+  return monitor.onOnline(handler, { expediteForMs, onDebug })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.11.24",
+  "version": "0.11.26",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-channel/index.js

@@ -143,6 +143,7 @@ async function prepareRoutedMessage ({ senderSigner, imkcSigner, privateChannelS
       channelPubkey,
       channelReaderPubkey,
       preparedRows,
+      innerEventId: getEventHash({ ...event, pubkey: event.pubkey || senderPubkey }),
       imkcPubkey,
       imkcProof
     }
@@ -152,69 +153,74 @@ async function prepareRoutedMessage ({ senderSigner, imkcSigner, privateChannelS
   }
 }
 
-async function * wrapPreparedEvents ({ privateChannelSigner, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, expirationSeconds = EXPIRATION_SECONDS, context }) {
-  const routerSeckey = generateSecretKey()
-  const routerPubkey = getPublicKey(routerSeckey)
-  const receiverPubkeyList = receiverPubkeys(receivers)
-  const routerReceiverTag = receiverTag ?? (receiverPubkeyList.length === 1 ? receiverPubkeyList[0] : '')
-  const rowIndexes = preparedRowIndexesForReceivers(context.preparedRows, receivers)
-  const total = preparedChunkCount(context.preparedRows, rowIndexes)
-  const persistSeeds = async () => {
-    if (!onPreparedSeed) return
-    const router = makeRouterEvent({ pubkey: routerPubkey, senderPubkey: context.senderPubkey, imkcPubkey: context.imkcPubkey, imkcProof: context.imkcProof, receiverPubkey: routerReceiverTag, chunkIndex: 0, chunkTotal: 1, fileChunkIndex, content: '' })
+async function * wrapPreparedEvents ({ privateChannelSigner, senderSigner, event, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, expirationSeconds = EXPIRATION_SECONDS, context, preparedPublication }) {
+  let publication = preparedPublication
+  if (publication) {
+    const channelPubkey = await privateChannelSigner.getPublicKey()
+    const expected = receiverPubkeys(receivers).sort().join(',')
+    const innerEventId = getEventHash({ ...event, pubkey: event.pubkey || await senderSigner.getPublicKey() })
+    if (publication.innerEventId !== innerEventId || publication.channelPubkey !== channelPubkey || !Array.isArray(publication.receiverPubkeys) || publication.receiverPubkeys.slice().sort().join(',') !== expected ||
+        !Array.isArray(publication.events) || !publication.events.length || !Array.isArray(publication.seeds) ||
+        publication.events.some(event => !isValidEvent(event) || event.pubkey !== channelPubkey || event.kind !== PRIVATE_BROADCAST_KIND)) {
+      throw new ValidationError('INVALID_PREPARED_PUBLICATION')
+    }
+    if (publication.events.some(event => Number(event.tags.find(tag => tag[0] === 'expiration')?.[1]) <= nowSeconds())) throw new ValidationError('PREPARED_PUBLICATION_EXPIRED')
+  } else {
+    const routerSeckey = generateSecretKey()
+    const routerPubkey = getPublicKey(routerSeckey)
+    const receiverPubkeyList = receiverPubkeys(receivers)
+    const routerReceiverTag = receiverTag ?? (receiverPubkeyList.length === 1 ? receiverPubkeyList[0] : '')
+    const rowIndexes = preparedRowIndexesForReceivers(context.preparedRows, receivers)
+    const total = preparedChunkCount(context.preparedRows, rowIndexes)
+    const seedRouter = makeRouterEvent({ pubkey: routerPubkey, senderPubkey: context.senderPubkey, imkcPubkey: context.imkcPubkey, imkcProof: context.imkcProof, receiverPubkey: routerReceiverTag, chunkIndex: 0, chunkTotal: 1, fileChunkIndex, content: '' })
     const payloadRow = readPreparedRow(context.preparedRows, 0)
-    for (const rowIndex of rowIndexes) {
-      await onPreparedSeed({ channelPubkey: context.channelPubkey, router, jsonl: `${payloadRow}\n${readPreparedRow(context.preparedRows, rowIndex)}\n` })
+    const seeds = rowIndexes.map(rowIndex => ({ channelPubkey: context.channelPubkey, router: seedRouter, jsonl: `${payloadRow}\n${readPreparedRow(context.preparedRows, rowIndex)}\n` }))
+    const events = []
+    let index = 0
+    for (const content of preparedChunks(context.preparedRows, rowIndexes)) {
+      const router = finalizeEvent(makeRouterEvent({
+        pubkey: routerPubkey, senderPubkey: context.senderPubkey, imkcPubkey: context.imkcPubkey,
+        imkcProof: context.imkcProof, receiverPubkey: routerReceiverTag, fileChunkIndex,
+        chunkIndex: index++, chunkTotal: total, content
+      }), routerSeckey)
+      const createdAt = nowSeconds()
+      const outer = await privateChannelSigner.signEvent({
+        kind: PRIVATE_BROADCAST_KIND, created_at: createdAt,
+        tags: privateBroadcastTags({ deletionPubkey, createdAt, expirationSeconds }),
+        content: await nip44v3EncryptText(privateChannelSigner, context.channelReaderPubkey, PRIVATE_BROADCAST_KIND, JSON.stringify(router))
+      })
+      if (eventByteLength(outer) > MAX_EVENT_BYTES) throw new ValidationError('EVENT_TOO_LARGE')
+      events.push(outer)
     }
+    publication = { innerEventId: context.innerEventId, channelPubkey: context.channelPubkey, receiverPubkeys: receiverPubkeyList, events, seeds }
   }
-  let index = 0
-  for (const content of preparedChunks(context.preparedRows, rowIndexes)) {
-    const router = finalizeEvent(makeRouterEvent({
-      pubkey: routerPubkey,
-      senderPubkey: context.senderPubkey,
-      imkcPubkey: context.imkcPubkey,
-      imkcProof: context.imkcProof,
-      receiverPubkey: routerReceiverTag,
-      fileChunkIndex,
-      chunkIndex: index++,
-      chunkTotal: total,
-      content
-    }), routerSeckey)
-    const createdAt = nowSeconds()
-    const prepareOuter = async () => privateChannelSigner.signEvent({
-      kind: PRIVATE_BROADCAST_KIND,
-      created_at: createdAt,
-      tags: privateBroadcastTags({ deletionPubkey, createdAt, expirationSeconds }),
-      content: await nip44v3EncryptText(privateChannelSigner, context.channelReaderPubkey, PRIVATE_BROADCAST_KIND, JSON.stringify(router))
-    })
-    // These independent steps may run together, but no envelope is yielded
-    // until every seed is durable. Settle both before releasing prepared rows.
-    const [persistence, prepared] = await Promise.allSettled([index === 1 ? persistSeeds() : undefined, prepareOuter()])
-    if (persistence.status === 'rejected') throw persistence.reason
-    if (prepared.status === 'rejected') throw prepared.reason
-    const outer = prepared.value
-    if (eventByteLength(outer) > MAX_EVENT_BYTES) throw new ValidationError('EVENT_TOO_LARGE')
-    yield outer
+  // The callback commits recovery data before any bytes leave this publisher.
+  // A session commits its encrypted journal; a direct messenger commits seeds.
+  if (onPreparedSeed) {
+    for (const seed of publication.seeds) await onPreparedSeed({ ...seed, publication })
   }
+  yield * publication.events
 }
 
 // Streaming version of wrapEvent
-export async function * wrapEvents ({ senderSigner, imkcSigner, privateChannelSigner = senderSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, event, expirationSeconds = EXPIRATION_SECONDS, temporaryStorageArea, _getIykcProofs = getIykcProofs }) {
+export async function * wrapEvents ({ senderSigner, imkcSigner, privateChannelSigner = senderSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, event, expirationSeconds = EXPIRATION_SECONDS, temporaryStorageArea, _getIykcProofs = getIykcProofs, preparedPublication }) {
   const normalizedDeletionPubkey = normalizeDeletionPubkey(deletionPubkey)
-  const context = await prepareRoutedMessage({
-    senderSigner,
-    imkcSigner,
-    privateChannelSigner,
-    privateChannelReaderPubkey,
-    receivers,
-    event,
-    temporaryStorageArea,
-    _getIykcProofs
-  })
+  const context = preparedPublication
+    ? null
+    : await prepareRoutedMessage({
+      senderSigner,
+      imkcSigner,
+      privateChannelSigner,
+      privateChannelReaderPubkey,
+      receivers,
+      event,
+      temporaryStorageArea,
+      _getIykcProofs
+    })
   try {
-    yield * wrapPreparedEvents({ privateChannelSigner, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, expirationSeconds, context })
+    yield * wrapPreparedEvents({ privateChannelSigner, senderSigner, event, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, expirationSeconds, context, preparedPublication })
   } finally {
-    cleanupEnvelopeRows(context.preparedRows)
+    if (context) cleanupEnvelopeRows(context.preparedRows)
   }
 }
 
@@ -552,35 +558,37 @@ function withRecoveryRelays (relays, recoveryRelays) {
   return uniq([...(relays || []), ...(recoveryRelays || [])])
 }
 
-export async function publish ({ senderSigner, imkcSigner, privateChannelSigner = senderSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, event, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, _getIykcProofs = getIykcProofs, _publish = sendToRelays }) {
+export async function publish ({ senderSigner, imkcSigner, privateChannelSigner = senderSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey, event, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, _getIykcProofs = getIykcProofs, _publish = sendToRelays, preparedPublication }) {
   const normalizedDeletionPubkey = normalizeDeletionPubkey(deletionPubkey)
   const results = []
   // Relays are grouped only when they have the exact same recipient pubkey set
   const groups = groupedRelayReceivers({ relayToReceivers, receivers })
   if (groups) {
-    const context = await prepareRoutedMessage({
-      senderSigner,
-      imkcSigner,
-      privateChannelSigner,
-      privateChannelReaderPubkey,
-      receivers,
-      event,
-      temporaryStorageArea,
-      _getIykcProofs
-    })
+    const context = preparedPublication
+      ? null
+      : await prepareRoutedMessage({
+        senderSigner,
+        imkcSigner,
+        privateChannelSigner,
+        privateChannelReaderPubkey,
+        receivers,
+        event,
+        temporaryStorageArea,
+        _getIykcProofs
+      })
     try {
       for (const group of groups) {
-        for await (const wrappedEvent of wrapPreparedEvents({ privateChannelSigner, receivers: group.receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, expirationSeconds, context })) {
+        for await (const wrappedEvent of wrapPreparedEvents({ privateChannelSigner, senderSigner, event, receivers: group.receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, expirationSeconds, context, preparedPublication })) {
           results.push(await _publish(wrappedEvent, withRecoveryRelays(group.relays, recoveryRelays), { receiverPubkeys: receiverPubkeys(group.receivers), primaryRelays: group.relays }))
         }
       }
     } finally {
-      cleanupEnvelopeRows(context.preparedRows)
+      if (context) cleanupEnvelopeRows(context.preparedRows)
     }
     return results
   }
 
-  for await (const wrappedEvent of wrapEvents({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, event, expirationSeconds, temporaryStorageArea, _getIykcProofs })) {
+  for await (const wrappedEvent of wrapEvents({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag, fileChunkIndex, onPreparedSeed, deletionPubkey: normalizedDeletionPubkey, event, expirationSeconds, temporaryStorageArea, _getIykcProofs, preparedPublication })) {
     results.push(await _publish(wrappedEvent, withRecoveryRelays(relays, recoveryRelays), { receiverPubkeys: receiverPubkeys(receivers), primaryRelays: relays }))
   }
   return results

package/private-message/index.js

@@ -1,7 +1,7 @@
 import { normalizeRelayUrl } from '../url/index.js'
 import { isValidEvent } from '../event/index.js'
 import { ValidationError } from '../error/index.js'
-import { generateKeypair } from '../key/index.js'
+import { generateKeypair, keypairFromSeckey } from '../key/index.js'
 import * as privateChannel from '../private-channel/index.js'
 import { normalizeRumor, deliveryInfo } from '../private-channel/helpers/rumor.js'
 
@@ -41,11 +41,19 @@ function normalizeDeletionPubkey (deletionPubkey) {
   return deletionPubkey.toLowerCase()
 }
 
-function resolveDeletionCapability ({ deletionPubkey, deletionSeckey, autoDeletionCapability = true }) {
+function resolveDeletionCapability ({ deletionPubkey, deletionSeckey, autoDeletionCapability = true, preparedPublication }) {
   if (deletionSeckey !== undefined) throw new ValidationError('DELETION_SECKEY_NOT_ACCEPTED')
   if (typeof autoDeletionCapability !== 'boolean') throw new ValidationError('AUTO_DELETION_CAPABILITY_BOOLEAN_REQUIRED')
 
   const normalizedDeletionPubkey = normalizeDeletionPubkey(deletionPubkey)
+  if (preparedPublication) {
+    const capability = preparedPublication.deletionCapability
+    if (!capability || (capability.deletionPubkey !== undefined && normalizeDeletionPubkey(capability.deletionPubkey) !== capability.deletionPubkey) ||
+        (normalizedDeletionPubkey && normalizedDeletionPubkey !== capability.deletionPubkey) ||
+        (capability.deletionSeckey !== undefined && keypairFromSeckey(capability.deletionSeckey).pubkey !== capability.deletionPubkey) ||
+        preparedPublication.events?.some(event => event.tags.find(tag => tag[0] === 's')?.[1] !== capability.deletionPubkey)) throw new ValidationError('INVALID_PREPARED_PUBLICATION')
+    return { ...capability }
+  }
   if (normalizedDeletionPubkey) return { deletionPubkey: normalizedDeletionPubkey }
   if (!autoDeletionCapability) return {}
 
@@ -53,6 +61,14 @@ function resolveDeletionCapability ({ deletionPubkey, deletionSeckey, autoDeleti
   return { deletionPubkey: pubkey, deletionSeckey: seckey }
 }
 
+function preparedSeedHandler (onPreparedSeed, deletion) {
+  if (!onPreparedSeed) return undefined
+  return seed => {
+    seed.publication.deletionCapability = deletion
+    return onPreparedSeed(seed)
+  }
+}
+
 function withDelivery (result, reports, deletionSeckey) {
   const delivery = { reports }
   if (deletionSeckey !== undefined) delivery.deletionSeckey = deletionSeckey
@@ -652,10 +668,11 @@ async function sendPrivateMessage ({
   _getIykcProofs,
   fileChunkIndex,
   onPreparedSeed,
+  preparedPublication,
   _publish = privateChannel.publish
 }) {
   if (!privateChannelSigner?.getPublicKey) throw new ValidationError('PRIVATE_CHANNEL_WRITER_REQUIRED')
-  return _publish({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag, deletionPubkey, event, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed, _getIykcProofs })
+  return _publish({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag, deletionPubkey, event, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed, preparedPublication, _getIykcProofs })
 }
 
 async function sendNymMessage ({
@@ -860,13 +877,14 @@ export async function broadcastRumor ({
   autoDeletionCapability = true,
   fileChunkIndex,
   onPreparedSeed,
+  preparedPublication,
   _publish = privateChannel.publish
 }) {
   const receivers = uniq(receiverPubkeys)
   if (!receivers.length) throw new ValidationError('NO_RECEIVERS')
   const { event, wireEvent } = await makeOutgoingRumor({ senderSigner, rumor })
-  const deletion = resolveDeletionCapability({ deletionPubkey, deletionSeckey, autoDeletionCapability })
-  const reports = await sendPrivateMessage({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag: '', deletionPubkey: deletion.deletionPubkey, event: wireEvent, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed, _getIykcProofs, _publish })
+  const deletion = resolveDeletionCapability({ deletionPubkey, deletionSeckey, autoDeletionCapability, preparedPublication })
+  const reports = await sendPrivateMessage({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag: '', deletionPubkey: deletion.deletionPubkey, event: wireEvent, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed: preparedSeedHandler(onPreparedSeed, deletion), preparedPublication, _getIykcProofs, _publish })
   return withDelivery({ rumor: event }, reports, deletion.deletionSeckey)
 }
 
@@ -888,13 +906,14 @@ export async function broadcastEvent ({
   autoDeletionCapability = true,
   fileChunkIndex,
   onPreparedSeed,
+  preparedPublication,
   _publish = privateChannel.publish
 }) {
   const receivers = uniq(receiverPubkeys)
   if (!receivers.length) throw new ValidationError('NO_RECEIVERS')
   const wireEvent = assertValidSignedEvent({ ...event, tags: cloneTags(event?.tags) })
-  const deletion = resolveDeletionCapability({ deletionPubkey, deletionSeckey, autoDeletionCapability })
-  const reports = await sendPrivateMessage({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag: '', deletionPubkey: deletion.deletionPubkey, event: wireEvent, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed, _getIykcProofs, _publish })
+  const deletion = resolveDeletionCapability({ deletionPubkey, deletionSeckey, autoDeletionCapability, preparedPublication })
+  const reports = await sendPrivateMessage({ senderSigner, imkcSigner, privateChannelSigner, privateChannelReaderPubkey, receivers, receiverTag: '', deletionPubkey: deletion.deletionPubkey, event: wireEvent, relays, relayToReceivers, recoveryRelays, expirationSeconds, temporaryStorageArea, fileChunkIndex, onPreparedSeed: preparedSeedHandler(onPreparedSeed, deletion), preparedPublication, _getIykcProofs, _publish })
   return withDelivery({ event: wireEvent }, reports, deletion.deletionSeckey)
 }
 

package/private-messenger/file/index.js

@@ -144,14 +144,14 @@ export function createPrivateFileTransfer ({ messenger, resolveChannel, storage,
     if (decoded.root !== file.root || (index !== undefined && decoded.index !== index) || (file.size !== undefined && (decoded.total !== Math.ceil(file.size / IRFS_CHUNK_BYTES) || (decoded.index === decoded.total - 1 && decoded.contentBytes.length !== file.size - decoded.index * IRFS_CHUNK_BYTES)))) throw new ValidationError('FILE_CHUNK_DESCRIPTOR_MISMATCH')
     return decoded
   }
-  async function routing (file, receiverPubkey, signal) {
+  async function routing (file, receiverPubkey, signal, attemptStartedAt, onDebug) {
     const parent = messenger.requireWritableChannel(file.controlChannelPubkey)
-    return messenger.resolveSendRouting({ channel: parent, receiverPubkeys: [receiverPubkey], signal })
+    return messenger.resolveSendRouting({ channel: parent, receiverPubkeys: [receiverPubkey], signal, attemptStartedAt, onDebug })
   }
   function sendOptions (file, routes) {
     return { senderSigner: messenger.userSigner, imkcSigner: messenger.contentKeySigner, privateChannelSigner: file.signer, ...routes, temporaryStorageArea: messenger.temporaryStorageArea, expirationSeconds: messenger.eventExpirationSecondsFor(file.controlChannelPubkey), _getIykcProofs: messenger.contentKeyLookup() }
   }
-  async function publishChunk (descriptor, event, { signal } = {}) {
+  async function publishChunk (descriptor, event, { signal, attemptStartedAt, onPreparedSeed, preparedPublication, onDebug } = {}) {
     const file = await register(descriptor)
     usable(file)
     const decoded = checked(file, event)
@@ -162,7 +162,7 @@ export function createPrivateFileTransfer ({ messenger, resolveChannel, storage,
     }
     let result
     try {
-      const options = { ...sendOptions(file, await routing(file, file.peerPubkey, signal)), receiverPubkeys: [file.peerPubkey], fileChunkIndex: decoded.index, ...(messenger.channels.get(file.controlChannelPubkey)?.mode === 'watchtower' ? { onPreparedSeed: seed => saveSeed(file, seed) } : {}) }
+      const options = { ...sendOptions(file, await routing(file, file.peerPubkey, signal, attemptStartedAt, onDebug)), receiverPubkeys: [file.peerPubkey], fileChunkIndex: decoded.index, preparedPublication, ...(onPreparedSeed ? { onPreparedSeed } : messenger.channels.get(file.controlChannelPubkey)?.mode === 'watchtower' ? { onPreparedSeed: seed => saveSeed(file, seed) } : {}) }
       result = event.sig ? await _messages.broadcastEvent({ ...options, event }) : await _messages.broadcastRumor({ ...options, rumor: event })
       await assertMessagePublished(result, result?.rumor || result?.event || { ...event, pubkey: event.pubkey || messenger.userPubkey })
     } catch (error) { await uploadLeases.get(file.root)?.(); uploadLeases.delete(file.root); throw error }
@@ -463,5 +463,5 @@ export function createPrivateFileTransfer ({ messenger, resolveChannel, storage,
   const timer = setInterval(() => { prune().catch(onError) }, 60000)
   timer.unref?.()
   messenger.extensions.add(extension)
-  return { register, authorizeSeeding, publishChunk, download, readChunk: (root, index) => storage.read(root, index), stream: (descriptor, options = {}) => storage.stream ? storage.stream(descriptor, options) : chunkStream({ read: storage.read.bind(storage), ...descriptor, ...options }), close: extension.close, cancel (control, root) { const job = jobs.get(keyFor(control, root)); if (job) { job.pauseRequested = false; cancelJob(job) } }, observe (listener) { listeners.add(listener); for (const job of jobs.values()) emit(job); return () => listeners.delete(listener) } }
+  return { register, authorizeSeeding, publishChunk, archiveSeed: async (descriptor, seed) => saveSeed(await register(descriptor), seed), download, readChunk: (root, index) => storage.read(root, index), stream: (descriptor, options = {}) => storage.stream ? storage.stream(descriptor, options) : chunkStream({ read: storage.read.bind(storage), ...descriptor, ...options }), close: extension.close, cancel (control, root) { const job = jobs.get(keyFor(control, root)); if (job) { job.pauseRequested = false; cancelJob(job) } }, observe (listener) { listeners.add(listener); for (const job of jobs.values()) emit(job); return () => listeners.delete(listener) } }
 }

package/private-messenger/helpers/fallback-race.js

@@ -2,7 +2,7 @@ import { isReplaceableRelayFailure } from '../../relay/helpers/failure.js'
 
 // Each invocation owns one already signed outer event and its encrypted subset.
 // Lanes share coverage and the tried set; only started reports outlive the race.
-export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tried, nextPrimary, nextFallback, sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, delay, now, setTimer, clearTimer }) {
+export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tried, nextPrimary, nextFallback, sendEvent, isOnline, isCurrent, signal, pauseSignal, remember, delay, attemptStartedAt, monotonicNow = () => performance.now(), now, setTimer, clearTimer }) {
   const pending = new Set(receivers)
   const summaries = []
   const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
@@ -120,7 +120,8 @@ export function publishWithEarlyFallback ({ event, receivers, first, mirrors, tr
   }
   if (transportSignal?.aborted || !isCurrent()) { finish(false); return outcome.promise }
   transportSignal?.addEventListener('abort', interrupted, { once: true })
-  const deadline = now() + delay
+  const remaining = attemptStartedAt === undefined ? delay : Math.max(0, delay - Math.max(0, monotonicNow() - attemptStartedAt))
+  const deadline = now() + remaining
   const failed = reason => {
     if (done) return
     done = true; clearTimer(timer); timer = null

package/private-messenger/helpers/pause-recovery.js

@@ -33,11 +33,14 @@ export function createPauseRecovery ({ attempt, online, onOnline, retryable, onE
     const run = () => {
       if (!active() || job.work) return job.work
       const work = (async () => {
-        if (online && !await online({ signal: job.controller.signal })) {
+        const confirmedOnline = job.confirmedOnline
+        job.confirmedOnline = false
+        if (online && !confirmedOnline && !await online({ signal: job.controller.signal })) {
           if (!active()) return
           job.stopOnline = onOnline(() => {
             if (!active()) return
             job.stopOnline?.(); job.stopOnline = null
+            job.confirmedOnline = true
             schedule(0)
           })
           return

package/private-messenger/helpers/send-routing.js

@@ -32,10 +32,11 @@ function routeGroups (routes) {
   return [...groups.values()]
 }
 
-export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], fallbackDelayMs = null, exclusions, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, pauseSignal, now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout }) {
+export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey, primaryRelays, primaryRelayToReceivers, fallbackRelays = [], fallbackDelayMs = null, exclusions, pickRelays, recoveryRelays, publish, publishNymEvent, sendEvent, isOnline, isCurrent, signal, pauseSignal, attemptStartedAt, monotonicNow = () => performance.now(), now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout }) {
   // Keep discovery's defaults when NIP-65 is unavailable. Explicit maps/lists
   // retain their fanout; configured fallbacks are a separate last-resort stage.
   fallbackDelayMs = normalizeFallbackDelay(fallbackDelayMs)
+  if (attemptStartedAt !== undefined && (!Number.isFinite(attemptStartedAt) || attemptStartedAt < 0)) throw new ValidationError('INVALID_ATTEMPT_STARTED_AT')
   const transportSignal = signal && pauseSignal ? AbortSignal.any([signal, pauseSignal]) : signal || pauseSignal
   const explicit = Boolean(primaryRelays || primaryRelayToReceivers)
   const primaryRoutes = primaryRelayToReceivers || (primaryRelays
@@ -98,7 +99,7 @@ export function createSendRelayRouting ({ peer, peers = [peer], relaysByPubkey,
         event, receivers, first: first.length ? { receivers, relays: first } : null, mirrors, tried,
         nextPrimary: pending => pick(pending, false), nextFallback: pending => pick(pending, true),
         sendEvent, isOnline, isCurrent, signal, pauseSignal, remember,
-        delay: fallbackDelayMs, now, setTimer, clearTimer
+        delay: fallbackDelayMs, attemptStartedAt, monotonicNow, now, setTimer, clearTimer
       })
       if (!result.success && current()) exclusions.clear()
       return result