Show logged-in user's avatar in verify page tutorial

Swap the FormSection-wrapped mono textarea on "Tell your story" for the
borderless, auto-growing muted textarea used by the organization bio
step, so the two long-form surfaces look the same.

.env.example

@@ -7,5 +7,8 @@ VITE_NOSTR_PUSH_PUBKEY=""
 # Primarily useful for native (Capacitor) builds, where window.location.origin is capacitor://localhost.
 # Example: VITE_SHARE_ORIGIN="https://agora.spot"
 VITE_SHARE_ORIGIN=""
+# DeepL-backed translation worker for user-generated content.
+# Example: VITE_TRANSLATE_WORKER_URL="https://agora-translate.<your-subdomain>.workers.dev"
+VITE_TRANSLATE_WORKER_URL="https://agora-translate.lemonknowsall.workers.dev/"
 # Set to "*" to allow any host in the Vite dev server (eg. when proxying through a custom domain)
-# ALLOWED_HOSTS="*"
+# ALLOWED_HOSTS="*"

.gitlab-ci.yml

@@ -37,6 +37,12 @@ deploy-web:
     - if: $CI_COMMIT_TAG
       when: never
     - if: $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $DEPLOY_SSH_KEY && $DEPLOY_TARGET
+  # Vite inlines VITE_* env vars at build time. These are sourced directly from
+  # project-level CI/CD variables, which are already present in the job
+  # environment — do NOT re-declare them here as `KEY: $KEY`. That self-reference
+  # overwrites the real value with the literal string "$KEY" whenever the source
+  # variable is out of scope (e.g. a Protected variable on an unprotected ref),
+  # which is how "$VITE_TRANSLATE_WORKER_URL" leaked into the built app.
   script:
     # Build the web app
     - npm ci
@@ -161,23 +167,33 @@ build-apk:
     # Write local.properties for Gradle
     - echo "sdk.dir=$ANDROID_SDK_ROOT" > android/local.properties
 
-    # Decode signing keystore and migrate JKS -> PKCS12 for Gradle compatibility
+    # Decode signing keystore and migrate JKS -> PKCS12 for Gradle compatibility.
+    # PKCS12 conceptually uses one password for the store and every entry; if the
+    # store and key passwords differ, keytool protects the migrated entry with the
+    # STORE password regardless of -destkeypass, so Gradle's later read with the
+    # key password fails ("Given final block not properly padded"). Unlock the
+    # source key with its own password ($KEY_PASSWORD), then write the PKCS12 with
+    # a single uniform password ($KEY_PASSWORD) for both store and entry so the
+    # key.properties below is internally consistent.
     - echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > android/app/my-upload-key.jks
     - keytool -importkeystore
         -srckeystore android/app/my-upload-key.jks
         -destkeystore android/app/my-upload-key.keystore
         -deststoretype pkcs12
         -srcstorepass "$KEYSTORE_PASSWORD"
-        -deststorepass "$KEYSTORE_PASSWORD"
         -srcalias upload
         -destalias upload
+        -srckeypass "$KEY_PASSWORD"
+        -deststorepass "$KEY_PASSWORD"
+        -destkeypass "$KEY_PASSWORD"
         -noprompt
     - rm android/app/my-upload-key.jks
 
-    # Write key.properties from CI/CD variables
+    # Write key.properties from CI/CD variables. The PKCS12 above uses
+    # $KEY_PASSWORD uniformly, so both storePassword and keyPassword point to it.
     - |
       cat > android/key.properties << EOF
-      storePassword=$KEYSTORE_PASSWORD
+      storePassword=$KEY_PASSWORD
       keyPassword=$KEY_PASSWORD
       keyAlias=upload
       storeFile=my-upload-key.keystore

AGENTS.md

@@ -1,6 +1,10 @@
 # Project Overview
 
-Agora is a Nostr client built with React 19.x, TailwindCSS 3.x, Vite, shadcn/ui, and Nostrify, wrapped as a native iOS/Android app via Capacitor.
+Agora is a peer-to-peer crowdfunding Nostr client built with React 19.x, TailwindCSS 3.x, Vite, shadcn/ui, and Nostrify, wrapped as a native iOS/Android app via Capacitor.
+
+Donations are **on-chain Bitcoin** — donors pay a campaign's Bitcoin address directly. Agora ships an integrated **non-custodial HD Bitcoin wallet** (deterministically derived from the user's Nostr key) with BIP-86 Taproot and **BIP-352 silent-payment** support. The app never custodies or converts funds; it is a non-custodial UI that connects donors and campaigns peer-to-peer.
+
+**This is not a Lightning project.** Lightning (`useZaps`, `useWallet`, `useNWC`, LNURL/NWC/WebLN) survives only as a secondary *tipping* path for notes/profiles and a deprecated Breez/Spark wallet in recovery-only mode — never for campaign donations. The crowdfunding core is strictly on-chain.
 
 ## Technology Stack
 
@@ -17,7 +21,7 @@ Agora is a Nostr client built with React 19.x, TailwindCSS 3.x, Vite, shadcn/ui,
 ## Project Structure
 
 - `/src/components/` — UI components. `ui/` holds shadcn primitives; `auth/` holds login components.
-- `/src/hooks/` — custom hooks. Discover the full set with `ls src/hooks/`. Key ones: `useNostr`, `useAuthor`, `useCurrentUser`, `useNostrPublish`, `useUploadFile`, `useAppContext`, `useTheme`, `useToast`, `useLoggedInAccounts`, `useLoginActions`, `useIsMobile`, `useZaps`, `useWallet`, `useNWC`, `useShakespeare`.
+- `/src/hooks/` — custom hooks. Discover the full set with `ls src/hooks/`. Core Nostr: `useNostr`, `useAuthor`, `useCurrentUser`, `useNostrPublish`, `useUploadFile`, `useAppContext`, `useTheme`, `useToast`, `useLoggedInAccounts`, `useLoginActions`, `useIsMobile`. **On-chain wallet & crowdfunding (the headline feature):** `useHdWallet`, `useHdWalletSp` (BIP-352 silent payments), `useBitcoinSigner`, `useDonateCampaign`, `useCampaign`/`useCampaigns`, `useCampaignDonations`, `useOnchainZap`. **Lightning (secondary tipping only, not campaigns):** `useZaps`, `useWallet` (NWC/WebLN status — *not* the on-chain wallet), `useNWC`.
 - `/src/pages/` — page components wired into `AppRouter.tsx`. The catch-all `/:nip19` route is handled by `NIP19Page.tsx` (see the `nip19-routing` skill).
 - `/src/lib/` — utility functions and shared logic.
 - `/src/contexts/` — React context providers (`AppContext`, `NWCContext`).
@@ -260,6 +264,21 @@ Routes live in `AppRouter.tsx`. To add one:
 
 The router provides automatic scroll-to-top on navigation and a 404 `NotFound` page.
 
+## Internationalization
+
+All user-facing strings live in `src/locales/<lang>.json`. `en.json` is the source of truth; ten other locales ship alongside it: `ar`, `es`, `fa`, `fr`, `km`, `ps`, `pt`, `ru`, `sn`, `zh`.
+
+**When you edit, add, or remove a translated string, update every locale in the same change — not just `en.json`.** Leaving the other locales stale ships an inconsistent app: users in other languages either see outdated copy or get an English fallback in the middle of a localized screen. This applies to FAQ entries, guide bodies, button labels, error messages — every value reachable through `t()`.
+
+Concrete rules:
+
+- **Edits to an existing key** — change the value in `en.json` first, then update the corresponding key in all ten other locales. Translate the new content into each language; don't paste English. Preserve `{{interpolation}}` placeholders, markdown links, and technical tokens (`sp1…`, `BIP-352`, kind numbers, etc.) verbatim.
+- **New keys** — add to `en.json` first, then add the same key with a translated value in every other locale. `src/test/locales.test.ts` fails the build if any locale ships a key that doesn't exist in `en.json`, but the inverse (a key missing from a non-English locale) is allowed and falls back to English at runtime — which is exactly the user-visible mess you're trying to avoid.
+- **Removed keys** — delete from `en.json` and every other locale together. Leftover keys are dead translations and clutter future diffs.
+- **Parallelize the translation work** — when updating one English string across all ten locales, dispatch the per-language edits to subagents in parallel rather than translating ten files sequentially. Provide each subagent the new English source, the existing translation snippet (so it matches established voice), and explicit instructions to preserve placeholders and technical tokens.
+
+Always run `npm run test` after locale changes — `locales.test.ts` catches structural drift, and the wider suite catches any `t()` calls that referenced a key you renamed.
+
 ## Development Practices
 
 - React Query for data fetching and caching

CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
 
+## [2.8.9] - 2026-06-02
+
+Adds an in-app prompt to grab the Android app from Zapstore, makes it easier to start or explore campaigns right from the home page, and irons out a batch of language and display fixes.
+
+### Added
+
+- A prompt to download the Android app from Zapstore, shown to mobile web visitors on the home page, in the account menu, and in the slide-out menu.
+- A "Start a campaign" button alongside "Browse all" in the middle of the home page.
+
+### Changed
+
+- The "Explore campaigns" button now appears for everyone, not just logged-out visitors.
+
+### Fixed
+
+- Switching languages now takes effect immediately instead of showing stale text.
+- The reply box and the replies heading on a post now show up in your chosen language.
+- Account balances keep their Latin numerals regardless of display language.
+- Filled in missing translations on the "Why Agora" screen.
+
+## [2.8.8] - 2026-06-02
+
+Fixes the app icon proportions and updates the loading splash to the Agora bolt.
+
+### Fixed
+
+- App icon no longer appears squashed.
+- Loading splash now shows the Agora bolt instead of the old logo.
+
+## [2.8.7] - 2026-06-02
+
+Fixes the top navigation bar rendering behind the status bar on Android.
+
+### Fixed
+
+- Top navigation bar now clears the system status bar on Android.
+
+## [2.8.6] - 2026-06-02
+
+Refreshes the app icon to the orange Agora bolt mark across Android, iOS, and the web.
+
+### Changed
+
+- Update the app icon to the current Agora bolt on a brand-orange background.
+
+## [2.8.5] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.4] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.3] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.2] - 2026-06-02
+
+A maintenance release that fixes the Android build pipeline so signed releases publish correctly. No user-facing changes.
+
+## [2.8.1] - 2026-06-02
+
+Agora becomes a home for putting your money where your heart is. Launch and back fundraising campaigns, rally around organizations with their own events and pledges, and send support straight from a built-in Bitcoin and Lightning wallet. Explore the world through immersive country pages, chat with a new AI agent, and move through a faster, cleaner app with a fresh look throughout.
+
+### Added
+
+- Fundraising campaigns as the new home surface — create, edit, and back campaigns, set goals, add beneficiaries, and follow progress.
+- Organizations with their own events, pledges, members, and moderation tools.
+- Built-in wallet for sending Bitcoin and Lightning payments, with transaction history and balances shown in USD.
+- One-tap support: zap posts, profiles, campaigns, and organizations.
+- AI agent chat with a model selector, tool-calling, and slash commands.
+- Immersive country pages with anthems, flags, weather, and a country-scoped feed, plus a new Discover square for exploring the world.
+- Comments and reactions on campaigns, and donation receipts shown inline.
+
+### Changed
+
+- Refreshed Agora branding, navigation, and app icons throughout.
+- Streamlined onboarding with country and people follows.
+- Polished campaign, organization, and donation flows end to end.
+
+### Removed
+
+- Direct messaging and ephemeral geo chat.
+
 ## [1.0.0] - 2026-04-30
 
 ### Added

NIP.md

@@ -12,9 +12,10 @@
 
 | Kind  | Name                       | Description                                                    |
 |-------|----------------------------|----------------------------------------------------------------|
-| 30223 | Campaign                   | Fundraising campaign with a list of on-chain Bitcoin recipients |
+| 33863 | Campaign                   | Self-authored fundraising campaign with a single Bitcoin wallet endpoint (`bc1...` or `sp1...`) |
 | 30385 | Community Stats Snapshot   | Pre-computed per-country / global community leaderboards       |
 | 36639 | Pledge                     | Donor pledge for concrete submissions, stored as sats           |
+| 14672 | Verifier Statement         | Self-authored statement describing how the author verifies campaigns (one per user) |
 
 ### Agora Protocols
 
@@ -22,7 +23,56 @@
 |--------------------------|-----------------------------------------|-----------------------------------------------------------------|
 | Flat Communities | 34550, 30009, 8, 1111, 1984 | One-level badge membership with explicit moderators (NIP-72 ext) |
 | Community Chat | 34550, 1311 | Realtime member chat scoped to a NIP-72 community |
-| Campaign Moderation | 30223, 1985, 39089 | Homepage curation (approved / hidden / featured axes) via moderator-signed labels in the `agora.moderation` namespace, gated by a follow-pack moderator roster |
+| Campaign Moderation | 33863, 34550, 36639, 1985, 39089 | Discovery curation (hidden + featured axes) via moderator-signed labels in the `agora.moderation` namespace, gated by a follow-pack moderator roster. Covers campaigns, organizations, and pledges identically. |
+| Campaign Verification | 33863, 1985 | Positive trust signal: moderator-signed NIP-32 labels in the `agora.verified` namespace (value `verified`) vouching for a campaign. Gated by the same moderator pack as hide/feature; retracted via kind 5 deletion. |
+| HD Wallet Derivation | — | BIP-39 mnemonic deterministically derived from the user's nsec via HKDF; seeds a BIP-86 Taproot + BIP-352 silent-payment wallet importable into any BIP-39-compatible wallet (see [Agora HD Wallet](#agora-hd-wallet-derivation) below). |
+
+### Agora Content Marker
+
+Every event Agora publishes that represents a first-class Agora object carries the single-letter tag `["t", "agora"]`. This marker enables the Agora activity feed to filter strictly server-side via the relay-indexed `#t` filter (multi-letter tags like the NIP-89 `client` tag are not indexed by relays and are therefore unsuitable for this purpose).
+
+#### Tagged kinds
+
+| Kind  | Object              | Where tagged                                                  |
+|-------|---------------------|---------------------------------------------------------------|
+| 1     | Note (top-level, reply, quote) | `ComposeBox` default for top-level kind 1 publishes |
+| 1111  | NIP-22 comment      | `usePostComment` (all comments authored in Agora)             |
+| 8333  | Onchain zap         | `useOnchainZap`, `useDonateCampaign`, `SendBitcoinDialog`     |
+| 9041  | Zap goal            | `CreateGoalDialog`                                            |
+| 33863 | Campaign            | `CreateCampaignPage`                                          |
+| 31922 | Date calendar event | `CreateEventPage`, `CreateCommunityEventDialog`               |
+| 31923 | Time calendar event | `CreateEventPage`, `CreateCommunityEventDialog`               |
+| 34550 | Community           | `CreateCommunityPage`                                         |
+| 36639 | Pledge              | `CreateActionPage`                                            |
+
+The tag is added at publish time via the `withAgoraTag` helper in `src/lib/agoraNoteTags.ts`, which dedupes against any user-supplied `t:agora` tag.
+
+#### Untagged kinds (intentional)
+
+Reactions, reposts, follow lists, profile metadata, lists, settings, badges, vanish requests, encrypted DMs, and live chat are user-state or response events rather than first-class Agora content. Tagging them would pollute `#agora` hashtag surfaces without adding value to the activity feed.
+
+Untagged on purpose: 0, 3, 6, 7, 8, 16, 62, 1311, 30009, 10000-series, 30078, and any NIP-04 / NIP-44 encrypted kind.
+
+#### Querying
+
+The Agora activity feed combines a `t:agora`-strict layer with an intentionally cross-client world layer:
+
+```json
+[
+  { "kinds": [33863, 36639, 34550, 8333], "#t": ["agora", "Agora"] },
+  { "kinds": [1111], "#t": ["agora", "Agora"], "#K": ["33863", "36639", "34550"] },
+  { "kinds": [1111, 1068], "#k": ["iso3166", "geo"] },
+  { "kinds": [1], "#t": ["agora", "Agora"] }
+]
+```
+
+The first two filters surface only Agora-created content. The third surfaces all country/geo-rooted comments and polls regardless of origin — the world layer is intentionally cross-client. The fourth captures any kind 1 note carrying `#agora` (including hashtags users type themselves), which preserves viral / opt-in discovery.
+
+Clients filter both case variants (`agora` and `Agora`) because Nostr `t` tags are conventionally lowercase but some clients normalize hashtags to title case.
+
+#### Backward compatibility
+
+Events published before this marker was adopted do not carry `t:agora` and therefore do not appear in the Agora activity feed. They remain reachable by direct link and via kind-specific directories (e.g. the moderator-curated `/campaigns`). Authors who wish to surface a legacy event in the feed can republish it (any edit through the Agora UI will add the marker automatically).
 
 ### Community Chat
 
@@ -89,26 +139,45 @@ Single-recipient zap (the common case — tipping a post or profile):
 }
 ```
 
-Multi-recipient zap (one transaction paying multiple recipients — campaign donations, community splits):
+Multi-recipient zap (one transaction paying multiple recipients — community splits):
 
 ```json
 {
   "kind": 8333,
   "pubkey": "<sender-pubkey>",
-  "content": "Great campaign!",
+  "content": "Great community!",
   "tags": [
     ["i", "bitcoin:tx:<txid>"],
     ["p", "<recipient-1-pubkey>"],
     ["p", "<recipient-2-pubkey>"],
     ["p", "<recipient-3-pubkey>"],
     ["amount", "<total-sats-paid-to-all-listed-recipients>"],
-    ["a", "30223:<campaign-author>:<campaign-d-tag>"],
-    ["K", "30223"],
+    ["a", "34550:<community-author>:<community-d-tag>"],
+    ["K", "34550"],
     ["alt", "Donation: 75000 sats across 3 recipients"]
   ]
 }
 ```
 
+Campaign donation (one transaction paying a single campaign wallet — see Kind 33863 below):
+
+```json
+{
+  "kind": 8333,
+  "pubkey": "<donor-pubkey>",
+  "content": "Keep up the good work.",
+  "tags": [
+    ["i", "bitcoin:tx:<txid>"],
+    ["amount", "<sats-paid-to-campaign-wallet>"],
+    ["a", "33863:<campaign-author>:<campaign-d-tag>"],
+    ["K", "33863"],
+    ["alt", "Donation to Save the Last Bookstore: 25000 sats"]
+  ]
+}
+```
+
+Campaign donation receipts MUST NOT include `p` tags — campaigns no longer have Nostr-identity recipients, only a `w` wallet endpoint. Verification matches tx outputs against the campaign's declared `w` address rather than derived Taproot addresses (see *Verification* and Kind 33863 below).
+
 ### Content
 
 The `content` field is a human-readable comment from the sender (may be empty). It is NOT a zap request JSON (unlike NIP-57 kind 9735).
@@ -165,13 +234,25 @@ For addressable events, use `"#a": ["<kind>:<pubkey>:<d-tag>"]` instead. For pro
 
 **Verification (REQUIRED before trusting amounts):**
 
-Clients MUST verify a kind 8333 event on-chain before counting it toward a zap total or displaying its amount. The `amount` tag is self-reported by the sender and would otherwise be trivially spoofable. To verify:
+Clients MUST verify a kind 8333 event on-chain before counting it toward a zap total or displaying its amount. The `amount` tag is self-reported by the sender and would otherwise be trivially spoofable. Verification has two modes depending on the event shape:
+
+*Identity-recipient mode* (the event has `p` tags — profile zaps, event zaps, community splits):
 
 1. Extract the txid from the `i` tag.
 2. Fetch the transaction from a Bitcoin data source (e.g. a mempool.space-compatible Esplora API).
 3. For each `p` tag, derive the recipient's expected Taproot address.
 4. Sum the values of all outputs in the transaction that pay any of the derived recipient addresses. This is the **verified amount**. Change outputs paying back to the **sender's** derived Taproot address MUST NOT be counted toward the verified amount — only outputs to listed recipients.
-5. If the verified amount is 0 (no listed recipient received anything in the tx), the event SHOULD be discarded.
+
+*Campaign-wallet mode* (the event has an `a` tag pointing at a kind 33863 campaign and no `p` tags):
+
+1. Extract the txid from the `i` tag and the campaign coordinate from the `a` tag.
+2. Fetch the campaign event and read its `w` tag to get the campaign's declared bech32(m) wallet address. Reject the receipt if `w` is missing, malformed, or starts with `sp1` (silent-payment campaigns do not publish receipts; see Kind 33863).
+3. Fetch the transaction from a Bitcoin data source.
+4. Sum the values of all outputs in the transaction that pay the campaign's `w` address. This is the **verified amount**.
+
+In both modes:
+
+5. If the verified amount is 0, the event SHOULD be discarded.
 6. If the sender's `amount` tag exceeds the verified amount, clients MAY discard the event or MAY display the smaller verified amount (capping). Clients MUST NOT display or count the claimed amount when it exceeds the verified amount.
 7. Unconfirmed transactions MAY be displayed as pending; clients MAY require confirmation before counting them toward public totals. Because unconfirmed transactions can be evicted (RBF, double-spend), clients SHOULD either exclude them from aggregate zap totals or clearly label them as pending.
 
@@ -199,139 +280,233 @@ The two zap kinds are complementary. Clients SHOULD sum verified amounts from bo
 
 ---
 
-## Kind 30223: Campaign
+## Kind 33863: Campaign
 
 ### Summary
 
-Addressable event representing a **fundraising campaign**. A campaign carries the marketing-style metadata you would expect on GoFundMe, Kickstarter, or GiveSendGo (title, summary, cover image, story, category, goal, optional deadline, and recommended country), and — most importantly — a list of recipient pubkeys (`p` tags) that share the proceeds of any donation.
+Addressable event representing a **self-authored fundraising campaign**. A campaign carries marketing-style metadata (title, summary, banner image, markdown story, optional goal, optional country) and one or two Bitcoin wallet endpoints declared in `w` tags. Each wallet endpoint is either a public on-chain bech32(m) address (`bc1q…`, `bc1p…`) or a silent-payment code (`sp1…`, per BIP-352). The mode of each endpoint is inferred from the prefix — the client renders a QR code that combines the present endpoints and adjusts the donation-progress UI accordingly. A campaign MAY declare **at most one** endpoint per mode (at most one on-chain address and at most one silent-payment code).
 
-Donations are sent as a **single Bitcoin on-chain transaction** with one output per recipient. The donor's wallet derives each recipient's Taproot address from their pubkey via BIP-340/BIP-341 (the same scheme used by kind 8333 onchain zaps), so the campaign event itself does not need to carry Bitcoin addresses. After broadcasting the funding tx, the donor's client publishes one kind 8333 event referencing the `txid`, listing every campaign recipient under its own `p` tag, and tagging the campaign via `a` / `K`. The donation then shows up in the campaign's totals and in each recipient's profile zap history (the `#p` filter matches every listed recipient).
+The author of the event is also the beneficiary. Campaigns are never authored on behalf of someone else; the event creator owns the wallet declared in `w` and receives the donations. To stop accepting donations, the creator publishes a NIP-09 kind 5 deletion request referencing the campaign's `a` coordinate.
 
-The kind is addressable so the creator can edit the story, image, goal, deadline, and recipient list over the life of the campaign without minting new identifiers. The `d` tag is the campaign's slug.
+The kind is addressable so the creator can edit the story, banner, goal, and wallet over the life of the campaign without minting new identifiers. The `d` tag is the campaign's slug.
 
 ### Event Structure
 
 ```json
 {
-  "kind": 30223,
+  "kind": 33863,
   "pubkey": "<creator-pubkey>",
   "content": "<markdown story>",
   "tags": [
-    ["d", "save-the-bookstore"],
+    ["d", "save-the-last-bookstore"],
+
     ["title", "Save the Last Bookstore"],
     ["summary", "Help our 40-year-old neighborhood bookstore make rent through winter."],
-    ["image", "https://example.com/cover.jpg"],
-    ["t", "human-rights"],
-    ["t", "legal-defense"],
-    ["goal", "10000000"],
-    ["deadline", "1735689600"],
-    ["i", "iso3166:VE"],
+    ["banner", "https://blossom.example/abc123.jpg"],
+    ["imeta",
+      "url https://blossom.example/abc123.jpg",
+      "m image/jpeg",
+      "x abc123def456...",
+      "dim 1600x900",
+      "blurhash LKO2?U%2Tw=w]~RBVZRi};RPxuwH",
+      "alt Storefront of the Last Bookstore at dusk"
+    ],
+    ["alt", "Fundraising campaign: Save the Last Bookstore"],
+
+    ["w", "bc1p7w2k3xq9...xyz"],
+    ["w", "sp1qq...verylongsilentpaymentcode..."],
+
+    ["goal", "25000"],
+
+    ["i", "iso3166:US"],
     ["k", "iso3166"],
-    ["p", "<recipient-1-hex-pubkey>", "wss://relay.example", "2"],
-    ["p", "<recipient-2-hex-pubkey>", "wss://relay.example", "1"],
-    ["p", "<recipient-3-hex-pubkey>"],
-    ["alt", "Fundraising campaign: Save the Last Bookstore"]
+    ["t", "legal-defense"],
+    ["t", "mutual-aid"]
   ]
 }
 ```
 
+A silent-payment-only campaign omits the `bc1…` `w` tag and carries only the `sp1…`:
+
+```json
+["w", "sp1qq...verylongsilentpaymentcode..."]
+```
+
+An on-chain-only campaign omits the `sp1…` `w` tag and carries only the `bc1…`:
+
+```json
+["w", "bc1p7w2k3xq9...xyz"]
+```
+
 ### Content
 
 The `content` field is the **campaign story**, formatted as Markdown. Clients SHOULD render it with the same Markdown renderer they use for NIP-23 long-form content. Empty content is permitted (e.g. for a campaign that lives entirely in its summary).
 
 ### Tags
 
-| Tag        | Required | Description                                                                                                                                                       |
-|------------|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `d`        | Yes      | Campaign slug, unique per author. Forms the addressable coordinate `30223:<pubkey>:<d>`.                                                                          |
-| `title`    | Yes      | Display title of the campaign (plain text, max ~200 chars).                                                                                                       |
-| `summary`  | Recommended | Short one-paragraph tagline shown in feed cards and previews.                                                                                                  |
-| `image`    | Recommended | HTTPS URL of the cover image (jpg/png/webp). Clients MUST sanitize and verify the URL before rendering.                                                       |
-| `t`        | Recommended | Topic tag for discovery and filtering (e.g. `human-rights`, `legal-defense`, `independent-media`). Multiple `t` tags MAY be used. Clients SHOULD normalize user-entered tag labels by removing a leading `#`, lowercasing, and replacing whitespace with hyphens. |
-| `goal`     | Recommended | Fundraising goal in **satoshis** (decimal integer). Omit if the campaign has no fixed goal.                                                                       |
-| `deadline` | Optional | Unix timestamp (seconds) at which the campaign closes. After the deadline, clients SHOULD show the campaign as ended but MAY still accept donations.              |
-| `i`        | Recommended | NIP-73 country identifier for sorting and discovery. SHOULD be `iso3166:<code>` with an uppercase ISO 3166-1 alpha-2 country code (e.g. `iso3166:VE`).              |
-| `k`        | Recommended if `i` is present | NIP-73 external content kind. For country identifiers this SHOULD be `iso3166`.                                                        |
-| `location` | Legacy | Human-readable location string used by older campaign events. New events SHOULD prefer `i` + `k` country tags. Clients MAY display this as a fallback only.          |
-| `status`   | Optional | Lifecycle status. The only defined value is `archived`, which marks the campaign closed without deleting it. Other values SHOULD be ignored. See *Closing & archiving* below. |
-| `p`        | Yes (≥1) | Recipient pubkey. The 2nd element is the hex pubkey; the 3rd (optional) is a relay hint; the 4th (optional) is a positive decimal **weight** for split allocation. |
-| `alt`      | Recommended | NIP-31 human-readable fallback.                                                                                                                                   |
+| Tag       | Required | Description                                                                                                                                                                                                                  |
+|-----------|----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `d`       | Yes      | Campaign slug, unique per author. Forms the addressable coordinate `33863:<pubkey>:<d>`.                                                                                                                                     |
+| `title`   | Yes      | Display title of the campaign (plain text, max ~200 chars).                                                                                                                                                                  |
+| `w`       | Yes      | Bitcoin wallet endpoint. The 2nd element is a single bech32(m) string: a mainnet on-chain address starting with `bc1q` (P2WPKH/P2WSH) or `bc1p` (P2TR), **or** a silent-payment code starting with `sp1` per BIP-352. A campaign MUST carry at least one `w` tag and MAY carry up to two — at most one per mode (on-chain and silent payment). |
+| `summary` | Recommended | Short one-paragraph tagline shown in feed cards and previews.                                                                                                                                                              |
+| `banner`  | Recommended | HTTPS URL of the wide banner image. Clients MUST sanitize the URL (see `sanitizeUrl()` in `nostr-security`) before rendering, and SHOULD pair the URL with a NIP-92 `imeta` tag for dimensions, blurhash, MIME type, and SHA-256. |
+| `imeta`   | Recommended | NIP-92 media metadata for the banner. The first `url <value>` pair MUST match the `banner` URL; clients SHOULD ignore an `imeta` whose URL does not match.                                                                  |
+| `goal`    | Optional | Fundraising goal in **integer US Dollars** (no unit suffix, no decimals). Clients MAY display an estimated sat-equivalent at view time using a live exchange rate.                                                          |
+| `i`       | Recommended | NIP-73 country identifier. SHOULD be `iso3166:<code>` with an uppercase ISO 3166-1 alpha-2 country code (e.g. `iso3166:VE`).                                                                                          |
+| `k`       | Recommended if `i` is present | NIP-73 external content kind. For country identifiers this SHOULD be `iso3166`.                                                                                                              |
+| `t`       | Optional | User-entered discovery/category tags. Agora also adds `t:agora` as the app marker; other `t` values are freeform topics such as `legal-defense` or `mutual-aid`. |
+| `alt`     | Recommended | NIP-31 human-readable fallback.                                                                                                                                                                                            |
 
-### Recipient Split Rules
+### Wallet Modes
 
-When a donor sends an amount `T` in satoshis to a campaign:
+The prefix of each `w` value selects one of two donation modes. Clients MUST detect the mode from the prefix; the event carries no other mode discriminator. When a campaign carries both an on-chain and a silent-payment endpoint, the client SHOULD present a single combined QR (see "Combined QR" below) so a scan offers the donor's wallet whichever endpoint it supports, while still rendering on-chain aggregate UI from the on-chain endpoint and the silent-payment privacy notice from the silent-payment endpoint.
 
-1. Read all `p` tags from the campaign event.
-2. Parse the weight of each `p` tag from the 4th element. If absent, malformed, or non-positive, the weight defaults to **1**.
-3. Compute each recipient's share as `floor(T * weight_i / sum_of_weights)` satoshis.
-4. Any remainder from rounding (at most N−1 sats) MAY be appended to the largest share or kept by the donor as change — clients SHOULD prefer appending the remainder to the largest share so the full amount reaches the campaign.
-5. If any computed share is below the Bitcoin dust limit (546 sats for P2TR), the donor's client MUST refuse the donation and surface a minimum-amount error.
+| Prefix              | Mode      | Description                                                                                                                              |
+|---------------------|-----------|------------------------------------------------------------------------------------------------------------------------------------------|
+| `bc1q…` / `bc1p…`   | On-chain  | Public mainnet bech32(m) address. Donations are traceable; clients show a progress bar, total raised, and donation list.                |
+| `sp1…`              | Silent payment | BIP-352 silent-payment code. Donations are **unlinkable by design**. Clients MUST hide all aggregate totals and progress UI (see below). |
 
-Equal splits are the default: omit the weight on every `p` tag, and all recipients receive `floor(T / N)` sats each.
+Other prefixes (`tb1…`, `bcrt1…`, `tsp1…`, lightning invoices, etc.) MUST be rejected at parse time; the campaign does not render. A campaign carrying two `w` tags of the same mode (e.g., two `bc1…` addresses) is invalid and MUST NOT render — only one endpoint per mode is permitted.
 
-### Donation Flow
+Clients SHOULD validate the bech32(m) checksum of each `w` value, not just its prefix.
 
-1. Donor opens the campaign and chooses an amount in sats (preset or custom).
-2. Donor's client computes per-recipient amounts using the split rules above.
-3. Donor's client builds a **single PSBT** with one output per recipient (paying each recipient's derived Taproot address) plus a change output back to the donor.
-4. Donor signs the PSBT with their Nostr key (Taproot key-path spend) and broadcasts the resulting transaction.
-5. Donor's client publishes **one kind 8333 event for the whole transaction**, listing every recipient under its own `p` tag. The event MUST include:
+### Combined QR
+
+When a campaign declares both endpoints, clients SHOULD render a single BIP-21 URI that combines them:
+
+```
+bitcoin:<bc1-address>?sp=<sp1-code>
+```
+
+BIP-352-aware wallets pick the `sp=` parameter and use the silent-payment flow; legacy wallets fall back to the on-chain address. Clients MAY also surface each endpoint's raw string as a copyable affordance so donors who prefer one over the other can choose explicitly. A single-endpoint campaign uses the standard form: `bitcoin:<bc1-address>` (on-chain only) or `bitcoin:?sp=<sp1-code>` (silent payment only).
+
+### Client Behavior by Mode
+
+Each endpoint type drives its own UI elements independently. A dual-endpoint campaign shows the on-chain aggregate UI (computed from the on-chain endpoint) **and** the silent-payment privacy notice (because at least some donations may flow through the SP endpoint and not be visible in any aggregate).
+
+| UI element                  | On-chain (`bc1`) present                                        | Silent payment (`sp1`) present                        |
+|-----------------------------|-----------------------------------------------------------------|-------------------------------------------------------|
+| QR code                     | bech32(m) address in BIP-21 `bitcoin:` URI                      | SP code in BIP-21 `?sp=` extension (combined with on-chain address when both are present) |
+| "Raised X" / progress bar   | Shown, computed from cumulative `chain_stats.funded_txo_sum` on the on-chain `w` address via an Esplora endpoint (default mempool.space). Kind 8333 receipts are **not** the source of this total — donors paying the BIP-21 QR with a native wallet would otherwise be missed. | **Not contributed.** When the on-chain endpoint is absent, aggregate UI is hidden entirely. |
+| Donor / recent-donation list| Shown, populated from verified kind 8333 receipts against the on-chain address (attribution only — these do not feed the headline total). | **Not contributed.**                                   |
+| Goal display                | Shown as USD target with optional sat-equivalent estimate       | Shown as USD target; no progress computation when on-chain endpoint is absent |
+| Donation receipt published  | Donor's client publishes a kind 8333 receipt against the on-chain endpoint (see below) | **No receipt published.** Publishing one would defeat SP unlinkability and is forbidden. |
+
+For campaigns with **only** a silent-payment endpoint (no on-chain endpoint), clients MUST NOT attempt to scan the chain, MUST NOT publish receipts, and MUST NOT display any aggregate that could leak donation activity. For dual-endpoint campaigns, the on-chain aggregate UI is permitted but clients SHOULD render a privacy notice indicating that silent-payment donations are not reflected in the totals.
+
+### Donation Flow — On-chain (`bc1`)
+
+1. Donor opens the campaign and chooses an amount.
+2. Donor's client constructs and broadcasts a Bitcoin transaction paying the campaign's `w` address.
+3. After broadcast, the donor's client publishes a single kind 8333 receipt:
 
    ```json
    [
      ["i", "bitcoin:tx:<txid>"],
-     ["p", "<recipient-1-pubkey>"],
-     ["p", "<recipient-2-pubkey>"],
-     ["p", "<recipient-3-pubkey>"],
-     ["amount", "<total-sats-paid-to-all-recipients>"],
-     ["a", "30223:<campaign-author-pubkey>:<campaign-d-tag>"],
-     ["K", "30223"],
+     ["amount", "<sats-paid-to-campaign-wallet>"],
+     ["a", "33863:<campaign-author-pubkey>:<campaign-d-tag>"],
+     ["K", "33863"],
      ["alt", "Donation to <campaign-title>: <total-amount> sats"]
    ]
    ```
 
-   The `amount` tag is the sum of the outputs paying the listed recipients (i.e. the full donation, excluding the donor's change). Per-recipient amounts are not encoded in the event; clients that need them recompute them from the on-chain transaction by matching each recipient's derived Taproot address against the tx outputs.
+   The receipt MUST NOT carry `p` tags — campaigns are not Nostr-identity recipients. The `amount` tag is the sum of tx outputs paying the campaign's `w` address (excluding the donor's change output).
 
-This mirrors the community batch-zap pattern documented in the kind 8333 section above, with the campaign's addressable coordinate replacing the community coordinate.
+4. The receipt is published **after** the tx is broadcast; the txid is already final at that point. A receipt-publish failure does not roll back the donation — the on-chain transaction stands.
+
+### Donation Flow — Silent Payment (`sp1`)
+
+1. Donor opens the campaign and chooses an amount.
+2. Donor's client uses the campaign's SP code to derive a fresh, one-time Taproot output script per BIP-352.
+3. Donor broadcasts a Bitcoin transaction paying that derived output.
+4. **No Nostr event is published.** The campaign owner discovers the donation by scanning the chain locally with their SP private key.
+
+Silent-payment unlinkability is the entire point of this mode. Clients MUST NOT publish receipts, MUST NOT advertise the donation in any other Nostr event (replies, mentions, etc.) on the donor's behalf, and MUST NOT correlate the donor's pubkey with the campaign in any persisted client telemetry.
 
 ### Querying
 
 **List campaigns (newest first):**
 
 ```json
-{ "kinds": [30223], "limit": 50 }
-```
-
-**Filter by category:**
-
-```json
-{ "kinds": [30223], "#t": ["medical"], "limit": 50 }
+{ "kinds": [33863], "limit": 50 }
 ```
 
 **Fetch a specific campaign:**
 
 ```json
-{ "kinds": [30223], "authors": ["<creator-pubkey>"], "#d": ["<slug>"], "limit": 1 }
+{ "kinds": [33863], "authors": ["<creator-pubkey>"], "#d": ["<slug>"], "limit": 1 }
 ```
 
-**Aggregate donations for a campaign:**
+**Compute the "raised" total:**
+
+The headline "raised" amount for an on-chain campaign MUST be sourced **directly from the campaign's on-chain `w` address**, not by aggregating kind 8333 receipts. Specifically, clients SHOULD query a mempool.space-compatible Esplora endpoint for the address and use the cumulative `chain_stats.funded_txo_sum` (plus `mempool_stats.funded_txo_sum` if surfacing pending donations) as the total raised.
+
+This is the source of truth for three reasons:
+
+1. **Completeness.** Donors who pay the BIP-21 QR with a native wallet do not publish a kind 8333 receipt. Aggregating receipts would undercount the campaign.
+2. **Forgery resistance.** A single Esplora `GET /address/<addr>` call cannot be spoofed by Nostr publishers, whereas verifying 500+ receipts against the chain is slower and more brittle (relay availability, pagination, replay attempts).
+3. **Stability.** `funded_txo_sum` is cumulative — it does not regress when the beneficiary spends from the address.
+
+**List individual donations (for the recent-donations sidebar):**
 
 ```json
-{ "kinds": [8333], "#a": ["30223:<creator-pubkey>:<slug>"], "limit": 500 }
+{ "kinds": [8333], "#a": ["33863:<creator-pubkey>:<slug>"], "limit": 500 }
 ```
 
-Clients MUST verify each kind 8333 event on-chain before counting it toward the campaign total, per the verification rules in the kind 8333 section.
+Kind 8333 receipts are used **only** to attribute individual donations to Nostr identities (donor pubkey, comment, timestamp) — not to compute the campaign total. Clients MUST still verify each receipt on-chain per the *Campaign-wallet mode* verification rules in the kind 8333 section before displaying it.
+
+**Filter by country:**
+
+```json
+{ "kinds": [33863], "#i": ["iso3166:VE"], "limit": 50 }
+```
+
+**Fetch pinned event comments:**
+
+Event owners MAY pin important comments or activity feed events with a NIP-78 app-specific data event (`kind: 30078`) authored by the root event owner. The `d` tag is scoped to the root event coordinate. Agora uses this for campaigns (`33863`), pledges (`36639`), organizations (`34550`), and calendar events (`31922` / `31923`).
+
+```json
+{
+  "kind": 30078,
+  "pubkey": "<root-event-author-pubkey>",
+  "content": "{\"pinnedEvents\":[\"<event-id-2>\",\"<event-id-1>\"]}",
+  "tags": [
+    ["d", "agora-pinned-comments:<kind>:<root-event-author-pubkey>:<d-tag>"],
+    ["a", "<kind>:<root-event-author-pubkey>:<d-tag>"],
+    ["k", "<kind>"],
+    ["alt", "Pinned event comments"]
+  ]
+}
+```
+
+Clients SHOULD query the pin list with:
+
+```json
+{ "kinds": [30078], "authors": ["<root-event-author-pubkey>"], "#d": ["agora-pinned-comments:<kind>:<root-event-author-pubkey>:<d-tag>"], "limit": 1 }
+```
+
+The `pinnedEvents` array is ordered newest pin first. Pinning an already-pinned event removes it. Clients SHOULD ignore pin lists not authored by the root event owner.
 
 ### Client Behavior
 
-- **Recipient validity:** clients SHOULD reject `p` tag entries whose pubkey is not 64 hex characters and SHOULD ignore weights that are not positive finite decimals.
-- **Dust protection:** when a donor enters an amount that would assign any recipient less than the dust limit, the client MUST block the donation and either suggest the minimum viable total or prompt the donor to remove recipients.
-- **Editability:** the creator MAY republish the same `(kind, pubkey, d)` triple to update the campaign. Clients SHOULD keep `published_at` from the first publish on subsequent edits (NIP-23 convention).
-- **Closing & archiving:** the creator MAY soft-close a campaign by republishing it with a `["status", "archived"]` tag. Clients SHOULD hide archived campaigns from discovery feeds and disable the donate flow, but MUST keep them reachable by direct link so existing donors can still find them and donation history is preserved. The creator can reopen the campaign by republishing without the status tag (or with any other status value). For a hard delete, the creator MAY publish a NIP-09 kind 5 deletion request referencing the campaign's `a` coordinate; clients SHOULD continue to render past donations against the campaign even after deletion.
+- **Wallet validity:** clients MUST reject events that carry no `w` tag, that carry more than one `w` tag of the same mode (e.g., two `bc1…` addresses), or whose `w` values fail bech32(m) checksum validation for one of the supported prefixes. Invalid campaigns do not render.
+- **Editability:** the creator MAY republish the same `(33863, pubkey, d)` triple to update any field, including the `w` wallet endpoint. Clients SHOULD keep `published_at` from the first publish on subsequent edits (NIP-23 convention).
+- **Closing a campaign:** there is no `status` tag. To stop accepting donations, the creator publishes a NIP-09 kind 5 deletion request referencing the campaign's `a` coordinate. Clients SHOULD honor the deletion by removing the campaign from discovery feeds. Historical kind 8333 receipts MAY still be rendered against the (now-deleted) campaign coordinate so donors can find their past donations.
+- **Categories:** clients MAY use user-entered `t` tags for topic filtering and discovery. Agora reserves `t:agora` as its app marker but does not reserve any other topic namespace.
+- **Migration:** kind 33863 has no relationship to any earlier campaign kind. Clients MUST NOT read, merge, or migrate events of any other kind into the kind 33863 namespace.
 
-### Campaign Moderation Labels
+### Agora Moderation Labels
 
-Agora curates which kind 30223 campaigns appear on the homepage (`/`) and on Discover (`/discover`) via moderator-signed NIP-32 label events (kind 1985) in a dedicated label namespace. The campaign event itself is never modified — surfacing is purely a client-side rollup of label events.
+Agora curates which kind 33863 campaigns appear on the homepage (`/`) and on the Support directory (`/campaigns`), which kind 34550 organizations appear in the Featured shelf on `/communities`, and which kind 36639 pledges appear in the discovery surfaces on `/pledges`, via moderator-signed NIP-32 label events (kind 1985) in a dedicated label namespace. The labeled event itself is never modified — surfacing is purely a client-side rollup of label events.
+
+Campaigns, organizations, and pledges share a single label namespace and a single moderator pack (Team Soapbox); the only thing distinguishing the three streams is the kind prefix on the `a` tag of each label:
+
+- `33863:<author-pubkey>:<d>` — campaign (kind 33863, see "Open Campaigns" above).
+- `34550:<author-pubkey>:<d>` — organization (kind 34550, NIP-72 community definition).
+- `36639:<author-pubkey>:<d>` — pledge (kind 36639, see "Pledge" below).
+
+A client surfacing campaigns MUST filter folded labels to those whose `a` tag starts with `33863:`. A client surfacing organizations MUST filter to `34550:`. A client surfacing pledges MUST filter to `36639:`. Mixing the streams would let a moderator's `featured` label on a campaign appear to feature an unrelated pledge with the same `d` tag, or any other cross-surface bleed.
 
 #### Namespace
 
@@ -346,21 +521,59 @@ Each label event carries the namespace twice, per NIP-32:
 
 #### Label values
 
-Three independent axes; the newest moderator-signed label per axis per campaign wins.
+Two independent axes are defined; the newest moderator-signed label per axis per coordinate wins. All three surfaces (campaigns, organizations, pledges) use the same two axes — every Agora-tagged entity is publicly visible by default, and moderation reduces to suppressing unwanted entries (`hide`) and lifting curated ones into a featured row (`featured`).
 
-| Axis     | Values                    | Meaning                                                                 |
-|----------|---------------------------|-------------------------------------------------------------------------|
-| approval | `approved`, `unapproved`  | `approved` allows the campaign on `/` and Discover. `unapproved` retracts a previous approval. |
-| hide     | `hidden`, `unhidden`      | `hidden` suppresses the campaign everywhere it would otherwise appear. `unhidden` retracts a previous hide. |
-| featured | `featured`, `unfeatured`  | `featured` places the campaign in the hand-picked Featured row on `/`. `unfeatured` retracts. |
+| Axis     | Values                    | Surfaces                           | Meaning                                                                 |
+|----------|---------------------------|------------------------------------|-------------------------------------------------------------------------|
+| hide     | `hidden`, `unhidden`      | campaigns, organizations, pledges  | `hidden` suppresses the target everywhere it would otherwise appear. `unhidden` retracts a previous hide. |
+| featured | `featured`, `unfeatured`  | campaigns, organizations, pledges  | `featured` places the target in a hand-picked Featured row. `unfeatured` retracts. |
+
+> **Legacy `approved` / `unapproved` labels.** A previous revision of this spec defined a third axis ("approval") used only by campaigns to gate which campaigns appeared on the home page. The axis was retired once `featured` became the single positive-curation mechanism on the home page. Clients MUST ignore `approved` / `unapproved` labels and SHOULD NOT publish new ones. Existing labels in relay archives are dead data.
 
 Surfacing rules (hide always wins):
 
-- **Featured row on `/`** — iff the latest featured label is `featured` AND the latest hide label is not `hidden`. Ordered newest-`created_at`-of-`featured`-label first. Featured is independent of Approved at the protocol level; a campaign may be featured without being approved (the home page treats Featured and Approved as deduplicated bins, with Featured taking precedence).
-- **Community Campaigns grid on `/`** — iff approved, not hidden, and not featured (featured campaigns get their own row above).
-- **Discover shelf** — iff approved AND not hidden.
-- **Moderator-only "Pending"** — iff neither approved nor hidden.
+**Campaigns**
+
+- **Featured row on `/`** — iff the latest featured label is `featured` AND the latest hide label is not `hidden`. Ordered by the featured label's effective rank (see Moderator-driven Ordering), descending.
+- **Discover shelf on `/campaigns`** — iff the latest hide label is not `hidden`. Every non-hidden campaign on the network is enumerable here; the home page's Featured row is a curated subset, not a gate.
+- **Moderator-only "Hidden"** — iff hidden. Surfaces the suppressed set so moderators can unhide.
+
+**Organizations**
+
+- **Featured shelf on `/communities`** — iff the latest featured label is `featured` AND the latest hide label is not `hidden`. Ordered by the featured label's effective rank, descending (see Moderator-driven Ordering).
+- **"My organizations" shelf on `/communities`** — intentionally ignores all moderation labels. A user's own founded, moderated, or followed organizations always render regardless of label state.
+- **Moderator-only "Needs review"** — iff `t:agora` AND not featured AND not hidden. Surfaces orgs minted through Agora's create flow that haven't been triaged into Featured or Hidden yet.
 - **Moderator-only "Hidden"** — iff hidden.
+- **Hide enforcement on other organization discovery surfaces** — clients SHOULD suppress `hidden` organizations from any future "All organizations" / browse surface for non-moderators. Moderators MAY see hidden organizations with a "Hidden" treatment so they can unhide.
+
+**Pledges**
+
+- **Discovery surfaces on `/pledges`** — non-moderators MUST NOT see `hidden` pledges in the active / upcoming / past sections, the search results grid, or any future browse surface. Moderators MAY opt-in to seeing hidden pledges via a Show-hidden toggle so they can unhide.
+- **Author-own surfaces** — a pledge author's own pledges in their profile always render regardless of moderation state. Moderation governs public discovery, not authorship.
+- **Direct-URL access** — a pledge's detail page (`/<naddr>`) renders regardless of moderation state. Hidden pledges remain reachable by anyone who has the link; moderation only governs which surfaces enumerate them.
+- **Featured** — reserved for a future curated pledge shelf. The `featured` axis is defined for symmetry with campaigns/organizations, and clients MAY use it when implementing such a shelf.
+
+#### Moderator-driven Ordering
+
+The Featured row is sorted by the **effective rank** of the moderator's latest `featured` label per campaign coordinate, descending.
+
+A label's effective rank is the numeric value of its `["rank", "<number>"]` tag if present, falling back to the label's `created_at` when no rank tag is set. Labels published before this feature existed — and any normal hide / feature actions that don't carry a rank — surface with their `created_at` as the effective rank, so newer feature actions naturally float to the top.
+
+The fold rule per `(coord, axis)` is unchanged: the newest event by `created_at` wins. Encoding order in the `created_at` itself would conflict with that rule the moment a moderator tried to lower a campaign's position — the new label would have an older `created_at` than the existing one and lose the fold. The rank tag decouples sort key from event recency so reorder publishes always use `created_at = now` and the fold always picks them up.
+
+A moderator MAY reorder the row by republishing the `featured` label for a campaign with a `rank` tag carrying a chosen integer. Three operations cover the common cases:
+
+- **Move to top** — publish with `rank = max(freshRank, currentTopRank + 1)`, where `freshRank` is a strictly-monotonic integer the client SHOULD source from current wall-clock time at sub-second resolution (Agora uses `Date.now() * 1000`). The `max` guard handles a (rare) clock-skewed existing rank that's already above `freshRank`.
+- **Move up by one** — publish with `rank = neighborAbove.rank + 1`, where `neighborAbove` is the label sorted directly above the campaign being moved.
+- **Move down by one** — publish with `rank = neighborBelow.rank - 1`. Only the moved campaign's label is republished; the neighbor below is untouched.
+
+A general "drop at index `j`" (e.g. drag-and-drop in a moderator UI) is implemented by computing the two new neighbors of the moved campaign in the rearranged list and choosing any integer rank strictly between their ranks. When the gap is too tight (`prev.rank - next.rank < 2`), clients SHOULD pick `next.rank + 1` and accept that the rendered list may briefly be off by one until the next reorder leaves a wider gap. Using a sub-second-resolution `freshRank` keeps inter-rank gaps wide enough for many midpoint inserts before any renumbering is needed.
+
+The conflict model matches the rest of the moderation namespace: the newest label per `(coord, axis)` from any moderator wins. Concurrent reorders by two moderators resolve to whoever's publish lands later; clients SHOULD refetch labels after a reorder publish to surface the authoritative order.
+
+Reorder labels remain valid moderation labels in every other respect. Clients that don't recognize the `rank` tag simply read the label's axis state and ignore the rank — the labels are not a separate kind, not a separate namespace, and not a new tag namespace. Non-Agora clients see exactly the same hide / feature state they always have.
+
+The featured row is the only Agora surface that uses moderator-driven ordering today. The same mechanism MAY be applied to the organization or pledge featured shelves if those grow a curation UI; until then, those shelves sort by `created_at` (the legacy behavior, identical to using a missing rank tag).
 
 #### Event Structure
 
@@ -370,21 +583,69 @@ Surfacing rules (hide always wins):
   "content": "",
   "tags": [
     ["L", "agora.moderation"],
-    ["l", "approved", "agora.moderation"],
-    ["a", "30223:<author-pubkey>:<campaign-d-tag>"],
-    ["alt", "Campaign moderation: approved"]
+    ["l", "featured", "agora.moderation"],
+    ["a", "33863:<author-pubkey>:<campaign-d-tag>"],
+    ["alt", "Campaign moderation: featured"]
   ]
 }
 ```
 
-A `featured` label has the same shape with `["l", "featured", "agora.moderation"]` and `["alt", "Campaign moderation: featured"]`.
+An organization label has the same shape with a kind 34550 `a` tag:
+
+```json
+{
+  "kind": 1985,
+  "content": "",
+  "tags": [
+    ["L", "agora.moderation"],
+    ["l", "featured", "agora.moderation"],
+    ["a", "34550:<author-pubkey>:<organization-d-tag>"],
+    ["alt", "Organization moderation: featured"]
+  ]
+}
+```
+
+A pledge label has the same shape with a kind 36639 `a` tag:
+
+```json
+{
+  "kind": 1985,
+  "content": "",
+  "tags": [
+    ["L", "agora.moderation"],
+    ["l", "hidden", "agora.moderation"],
+    ["a", "36639:<author-pubkey>:<pledge-d-tag>"],
+    ["alt", "Pledge moderation: hidden"]
+  ]
+}
+```
 
 Required tags:
 
 - `L` set to `agora.moderation`.
 - `l` with the label value as the 2nd element and `agora.moderation` as the 3rd.
-- `a` referencing the campaign coordinate `30223:<pubkey>:<d>`.
-- `alt` (NIP-31) — clients without label support will display this string.
+- `a` referencing the target coordinate (`33863:<pubkey>:<d>` for a campaign, `34550:<pubkey>:<d>` for an organization, `36639:<pubkey>:<d>` for a pledge).
+- `alt` (NIP-31) — clients without label support will display this string. The `alt` value SHOULD identify the surface (e.g. `Campaign moderation: featured`, `Organization moderation: featured`, or `Pledge moderation: hidden`) so non-Agora clients can read it.
+
+Optional tags:
+
+- `rank` — single string element parsed as an integer. Used on `featured` labels to position the target within the moderator-curated Featured row; see Moderator-driven Ordering above. Labels without this tag sort by `created_at` (descending), which is the correct behavior for all non-reorder uses.
+
+A label with a rank tag looks like:
+
+```json
+{
+  "kind": 1985,
+  "content": "",
+  "tags": [
+    ["L", "agora.moderation"],
+    ["l", "featured", "agora.moderation"],
+    ["a", "33863:<author-pubkey>:<campaign-d-tag>"],
+    ["rank", "1700000000123000"],
+    ["alt", "Campaign moderation: featured"]
+  ]
+}
+```
 
 #### Trust Model
 
@@ -396,12 +657,14 @@ pubkey:     932614571afcbad4d17a191ee281e39eebbb41b93fac8fd87829622aeb112f4d
 d-tag:      k4p5w0n22suf
 ```
 
-The pack `p` tags are the authoritative moderator list. Anyone may publish a kind 1985 event in the `agora.moderation` namespace, but events from non-pack authors are silently ignored at the relay-filter layer (`authors:` is pinned to the pack `p` tags). This means:
+The pack `p` tags are the authoritative moderator list. Clients MUST pin `authors:` on their label REQ to the pack `p` tags; events from non-pack authors MUST be ignored. This means:
 
-- Self-approval is impossible unless the pack author has added you.
-- A moderator removed from the pack immediately loses moderation authority — campaigns kept alive only by their labels return to "pending" until another moderator approves them.
+- Self-promotion is impossible unless the pack author has added you.
+- A moderator removed from the pack immediately loses moderation authority — campaigns kept alive on the Featured row only by their labels fall off the row until another moderator features them.
 - The pack author (single signer) can reset the entire moderator roster by republishing the pack.
 
+The same moderator set governs both campaign and organization labels. Carving out per-surface moderator subsets is out of scope; clients that need that distinction would have to introduce a second follow pack and a second label namespace.
+
 #### Querying
 
 Step 1 — fetch the pack:
@@ -426,16 +689,115 @@ Step 2 — fetch label events from pack members in the namespace:
 }
 ```
 
-Step 3 — fold by `(campaign-coord, axis)`, latest-`created_at`-wins. Then fetch only the approved-and-not-hidden campaign coordinates with one filter per author (bundled in a single REQ).
+Step 3 — fold by `(coord, axis)`, latest-`created_at`-wins, filtering to the relevant kind prefix (`33863:` for campaigns or `34550:` for organizations). Then fetch the targeted events themselves — one filter per author (bundled in a single REQ) keyed by their d-tags.
 
 #### Client Behavior
 
-- Clients SHOULD render approve/hide controls only for users whose pubkey appears in the pack.
-- Clients MAY display "Hidden" badges on hidden campaigns when viewed by a moderator, and SHOULD NOT render them at all to non-moderators.
-- Non-moderator authors viewing the homepage SHOULD see their own pending campaigns in a separate explained section so they understand why their campaign isn't yet on the homepage. The campaign URL remains live and donatable regardless of moderation state.
+- Clients SHOULD render hide/feature controls only for users whose pubkey appears in the pack.
+- Clients MAY display "Hidden" badges on hidden campaigns/organizations/pledges when viewed by a moderator, and SHOULD NOT render them at all to non-moderators.
+- Authors' own campaigns, organizations, and pledges are visible at their NIP-19 routes regardless of moderation state. The campaign URL remains live and donatable even when the campaign is not on the home page's Featured row.
+
+#### Campaign Verification Labels (`agora.verified`)
+
+Separately from the hide/feature moderation axes above, Agora supports a positive **verification** signal: a campaign moderator vouches for a specific campaign. Verification is a distinct NIP-32 label namespace, `agora.verified`, with a single value `verified`. It rides the same kind 1985 label kind and the **same moderator pack** as the hide/feature labels, but is otherwise independent of `agora.moderation` — no axes, no rank, purely additive.
+
+A verification label points at one campaign coordinate (`33863:<pubkey>:<d>`):
+
+```json
+{
+  "kind": 1985,
+  "content": "",
+  "tags": [
+    ["L", "agora.verified"],
+    ["l", "verified", "agora.verified"],
+    ["a", "33863:<campaign-pubkey>:<campaign-d>"],
+    ["alt", "Campaign verification"]
+  ]
+}
+```
+
+**Trust model.** The set of pubkeys whose `agora.verified` labels are honored is the campaign moderator pack — the same allowlist that governs hide/feature labels (the Team Soapbox follow pack `p` tags). Clients MUST filter the read query by `authors: <moderators>` — a `verified` label signed by any pubkey outside the pack MUST be ignored, otherwise the badge is forgeable by anyone. As with moderation labels, clients MUST NOT run the query with an empty `authors:` filter.
+
+**Reading.** One filter fetches every verification across all moderators:
+
+```json
+{
+  "kinds": [1985],
+  "authors": ["<moderator-1>", "<moderator-2>"],
+  "#L": ["agora.verified"],
+  "#l": ["verified"],
+  "limit": 2000
+}
+```
+
+Fold by `(coord, moderator)`, keeping the newest label per pair. A campaign is "verified by" the set of moderators with a surviving label; clients SHOULD render the moderators' avatars stacked as a badge, with multiple moderators forming a stack.
+
+**Retraction.** There is no `unverified` value. A moderator retracts a verification by publishing a NIP-09 kind 5 deletion of their own label event (referenced by `e` tag plus `k: 1985`). A kind 5 only takes effect on events authored by the signer, so a moderator can only remove their own verification.
+
+**Client behavior.**
+- Verification is a moderator action: clients SHOULD render the verify / remove-verification control inside the campaign moderator menu (alongside hide / add-to-list), gated on moderator membership.
+- Verification is purely additive — it never hides or promotes a campaign on its own. It is a trust hint layered over whatever moderation/discovery state already applies.
+- The label kind 1985 read is routed to Agora's search relays (`relay.ditto.pub`, `relay.dreamith.to`) where these labels are published.
 
 ---
 
+## Kind 14672: Verifier Statement
+
+### Summary
+
+Replaceable event kind for a **self-authored statement describing how the author verifies campaigns**. Anyone can "become a verifier" simply by publishing one of these events — there is no gatekeeper. The statement is a public, freeform explanation of the diligence process the author applies before vouching for a campaign, so donors can judge whether to trust that author's judgement.
+
+Exactly one statement per user (replaceable, no `d` tag): publishing a new event replaces the previous one. Clients surface the statement prominently on the author's profile page.
+
+This kind is **distinct from** the `agora.verified` campaign-verification labels (kind 1985, see Kind 33863 above). Those are moderator-signed, gated by the Team Soapbox follow pack, and vouch for one specific campaign. A kind 14672 statement is an open, self-published description of an author's *general* verification methodology and confers no special authority — it is a reputation signal donors read, not an access-control mechanism.
+
+### Event Structure
+
+```json
+{
+  "kind": 14672,
+  "pubkey": "<author-pubkey>",
+  "content": "I personally visit each campaign organizer over video call, confirm their identity against a government ID, and cross-check the cause with at least two independent local sources before I vouch for it. ...",
+  "tags": [
+    ["alt", "Verifier statement: how this account verifies campaigns"],
+    ["t", "agora"]
+  ]
+}
+```
+
+### Content
+
+The `content` field is the verifier statement, formatted as **Markdown**. Clients SHOULD render it with the same Markdown renderer they use for other long-form Agora content (campaign stories, policy pages). Empty or whitespace-only content means the author has **withdrawn** their verifier statement — clients MUST treat an empty-content event the same as no event (the author is no longer a verifier) and MUST NOT render a verifier section for it.
+
+### Tags
+
+| Tag   | Required    | Description                                                                 |
+|-------|-------------|-----------------------------------------------------------------------------|
+| `alt` | Recommended | NIP-31 human-readable fallback describing the event's purpose.              |
+| `t`   | Optional    | Agora content marker (`t:agora`). Added at publish time via `withAgoraTag`. |
+
+The statement carries no queryable fields beyond the author and kind — it is identified entirely by `(14672, pubkey)`.
+
+### Querying
+
+**Fetch a user's verifier statement:**
+
+```json
+{ "kinds": [14672], "authors": ["<pubkey>"], "limit": 1 }
+```
+
+Clients MUST filter by `authors` — a verifier statement only describes the diligence of the pubkey that signed it, so an unfiltered query would be meaningless (and would let anyone's statement be attributed to anyone).
+
+### Client Behavior
+
+- **Becoming a verifier:** a user publishes a kind 14672 event with their statement in `content`. No approval, allowlist, or moderation gate applies.
+- **Withdrawing:** a user republishes the event with empty `content`, or publishes a NIP-09 kind 5 deletion referencing the event. Either way clients stop rendering the verifier section.
+- **Rendering:** clients SHOULD surface the statement prominently on the author's profile (e.g. a dedicated "Verifier" section in the profile overview), rendering the Markdown content sanitized.
+- **Editing:** because the kind is replaceable, the latest event per `(14672, pubkey)` wins. Clients performing an edit SHOULD pass the previous event as `prev` so `published_at` is preserved (NIP-23 convention).
+
+---
+
+
 ## Kind 16769: Profile Tabs
 
 ### Summary
@@ -805,6 +1167,9 @@ A kind `34550` event defines the community, extending [NIP-72](https://github.co
 | `image` | No | Image URL. |
 | `a` | Yes (1) | Member badge definition reference with role marker `"member"`. |
 | `p` | No | Moderator pubkeys. The 4th element SHOULD be `"moderator"`. |
+| `i` | No | Agora extension: NIP-73 country identifier (`iso3166:XX`) for country-scoped group discovery. This is not part of NIP-72. |
+| `k` | Recommended if `i` is present | Agora extension: external content kind hint. Use `iso3166` for country identifiers. |
+| `t` | No | Agora extension: user-entered discovery/category tags. Agora also adds `t:agora` as the app marker. |
 | `relay` | No | Recommended relay URL for community content (per [NIP-72](https://github.com/nostr-protocol/nips/blob/master/72.md)). |
 | `alt` | No | [NIP-31](https://github.com/nostr-protocol/nips/blob/master/31.md) description. |
 
@@ -830,6 +1195,10 @@ The fourth element is a strict protocol marker, not a display label. Communities
     ["image", "https://example.com/clan-banner.jpg"],
     ["a", "30009:<founder-pubkey>:a1b2c3d4-...-member", "", "member"],
     ["p", "<co-moderator-pubkey>", "", "moderator"],
+    ["i", "iso3166:US"],
+    ["k", "iso3166"],
+    ["t", "local-news"],
+    ["t", "mutual-aid"],
     ["relay", "wss://relay.example.com"],
     ["alt", "Community: The Arbiter's Guard"]
   ]
@@ -1317,3 +1686,85 @@ Albums are represented as kind 34139 playlist events with a `["t", "album"]` tag
 - Albums display release date and label information when available
 - Track ordering follows the order of `a` tags in the event
 - The same detail view, playback, and commenting features apply to both albums and playlists
+
+---
+
+## Agora HD Wallet Derivation
+
+### Summary
+
+Agora's Bitcoin wallet is hierarchical-deterministic and derived from the user's Nostr secret key (`nsec`). The user backs up either the nsec or the 24-word BIP-39 mnemonic — the mnemonic is a deterministic, one-way function of the nsec, so anyone with the nsec can regenerate the mnemonic at will.
+
+This specification covers two derivation generations:
+
+- **v2 (current)** — nsec → HKDF → BIP-39 24-word mnemonic → PBKDF2 → BIP-32 master seed. The resulting mnemonic imports into any BIP-39-compatible wallet (Sparrow, Electrum, Trezor, Ledger, BlueWallet, Phoenix, …) at the standard BIP-86 / BIP-352 paths.
+- **v1 (legacy, migration-only)** — nsec used directly as the BIP-32 master seed (`HDKey.fromMasterSeed(nsec_bytes)`). v1 and v2 produce different addresses for the same nsec.
+
+### v2 Derivation
+
+The v2 pipeline turns a 32-byte nsec into a 64-byte BIP-32 master seed in three steps:
+
+```
+entropy  = HKDF-SHA256(ikm = nsec_bytes,
+                       salt = "" (default per RFC 5869),
+                       info = "agora/v1",
+                       length = 32 bytes)
+mnemonic = BIP-39 encoding of (entropy || SHA256(entropy)[0])      // 24 words
+seed     = PBKDF2-HMAC-SHA512(password = mnemonic,
+                              salt = "mnemonic",
+                              iterations = 2048,
+                              dkLen = 64)
+master   = HDKey.fromMasterSeed(seed)                              // BIP-32 root
+```
+
+The `"agora/v1"` HKDF info string is a versioning hook: changing it would derive a completely independent wallet from the same nsec. The `"mnemonic"` PBKDF2 salt is the literal BIP-39 default (no user passphrase).
+
+#### Properties
+
+- **Deterministic** — the same nsec always produces the same mnemonic, seed, and BIP-32 master.
+- **One-way** — the mnemonic is a hash of the nsec; an attacker who learns the mnemonic learns only the wallet, not the Nostr identity.
+- **Interoperable** — the resulting 24-word phrase is a standard BIP-39 mnemonic. Any BIP-39-compatible wallet can import it at the BIP-86 / BIP-352 paths and recover the same on-chain addresses.
+
+### Address Derivation
+
+Once the BIP-32 master is in hand, addresses derive at the standard paths:
+
+#### BIP-86 (Taproot single-key, key-path-only)
+
+```
+m/86'/0'/0'/<chain>/<index>
+```
+
+- `chain ∈ {0, 1}` — `0` = receive, `1` = change.
+- `index` — advanced per receive (no address reuse).
+
+Output script is P2TR with the derived x-only pubkey as `internalPubkey` (no tapscript tree).
+
+#### BIP-352 (Silent Payments)
+
+```
+m/352'/0'/0'/0'/0    // spend keypair
+m/352'/0'/0'/1'/0    // scan keypair
+```
+
+The silent-payment address (`sp1q…`) is the bech32m encoding of `(scan_pubkey || spend_pubkey)` with version `0` and HRP `sp`. The address is **static** — a user publishes one `sp1q…` and reuses it; each sender derives a fresh, unlinkable Taproot output per payment.
+
+### v1 → v2 Migration
+
+The v1 derivation (`HDKey.fromMasterSeed(nsec_bytes)`) produces a different BIP-32 master than v2 for the same nsec, so a user upgrading from v1 to v2 has funds at addresses that the v2 wallet never scans. Agora ships a one-shot migration page (`/wallet/migrate-v1`) that:
+
+1. Detects v1 funds by scanning the v1 xpub against the configured Blockbook indexer and reading the v1 silent-payment UTXO doc from the user's relays (NIP-78 d-tag `${appId}/hdwallet/sp-utxos`).
+2. If any v1 funds exist, builds a single sweep PSBT consuming every v1 BIP-86 UTXO + every v1 SP UTXO, with one output (`total − fee`) at the v2 wallet's first BIP-86 receive address.
+3. Signs every input using v1-derived keys (`HDKey.fromMasterSeed(nsec_bytes)`) and broadcasts via Blockbook.
+
+The v1 derivation code is retained indefinitely so users can migrate at any time. New scans, sends, and receives always run against v2.
+
+### NIP-78 Storage
+
+Agora stores per-wallet auxiliary state as a NIP-78 encrypted addressable event (kind 30078, NIP-44 to the user's own pubkey). The v2 d-tag suffix is `hdwallet/sp-utxos/v2`; the legacy v1 d-tag is `hdwallet/sp-utxos`. The two are independent: v2 never writes to the v1 tag, and the v1 tag is read only by the migration sweep.
+
+### Security Notes
+
+- The nsec is both the Nostr identity secret and the wallet seed source. Anyone with the nsec controls both. The 24-word mnemonic is the wallet half of that secret and is safer to share with Bitcoin-side tools (it can't impersonate the user on Nostr).
+- The wallet is gated to nsec logins. Browser-extension (NIP-07) and remote-signer (NIP-46) logins do not expose the raw secret key, so the wallet cannot derive child keys and surfaces an "unsupported" state.
+- Spend signing happens locally in the browser using the derived BIP-32 leaves. The nsec never leaves the device.

NOSTR_WEBXDC.md

@@ -1,116 +0,0 @@
-NIP-DC
-======
-
-Nostr Webxdc
-------------
-
-`draft` `optional`
-
-This NIP defines how to share and run [webxdc](https://webxdc.org/) apps over Nostr. Webxdc apps are `.xdc` (ZIP) files containing sandboxed HTML5 applications. They are attached to regular Nostr events using `imeta` tags (NIP-92), and state is coordinated through a unique identifier.
-
-This spec covers public webxdc communication only. Private communication may be addressed in a future update.
-
-## Attachment
-
-A webxdc app is attached to any event by including the `.xdc` file URL in the content and an `imeta` tag with MIME type `application/x-webxdc`.
-
-The `imeta` tag SHOULD include a `webxdc` property with a randomly generated unique string. This serves as the coordination identifier for state updates and realtime channels. If omitted, the app can still run but state won't work.
-
-```json
-{
-  "kind": 1,
-  "content": "Let's play chess! https://blossom.example.com/abc123.xdc",
-  "tags": [
-    ["imeta",
-      "url https://blossom.example.com/abc123.xdc",
-      "m application/x-webxdc",
-      "x a1b2c3d4e5f6...",
-      "webxdc 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
-    ]
-  ]
-}
-```
-
-A webxdc MAY also be published as a kind `1063` (NIP-94) file metadata event:
-
-```json
-{
-  "kind": 1063,
-  "content": "A collaborative chess game. Play with friends over Nostr!",
-  "tags": [
-    ["url", "https://blossom.example.com/abc123.xdc"],
-    ["m", "application/x-webxdc"],
-    ["x", "a1b2c3d4e5f6..."],
-    ["alt", "Webxdc app: Chess"],
-    ["webxdc", "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"]
-  ]
-}
-```
-
-## Kind `4932`: State Update
-
-A regular event carrying a state update, mapping to the webxdc [`sendUpdate()`](https://webxdc.org/docs/spec/sendUpdate.html) API. Updates are ordered by `created_at` and assigned serial numbers by the client.
-
-### Tags
-
-- `i`: The `webxdc` identifier from the originating event (required)
-- `alt`: NIP-31 human-readable description (required)
-- `info`: Short info message, max ~50 chars (optional)
-- `document`: Document name being edited (optional)
-- `summary`: Short summary text, e.g. "8 votes" (optional)
-
-The optional tags correspond to fields in the webxdc `sendUpdate()` API.
-
-### Content
-
-JSON-serialized payload from `sendUpdate()`.
-
-```json
-{
-  "kind": 4932,
-  "content": "{\"move\":\"e2e4\",\"player\":\"white\"}",
-  "tags": [
-    ["i", "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"],
-    ["alt", "Webxdc update"],
-    ["info", "White played e2-e4"]
-  ]
-}
-```
-
-## Kind `20932`: Realtime Data (Ephemeral)
-
-An ephemeral event carrying realtime data, mapping to the webxdc [`joinRealtimeChannel`](https://webxdc.org/docs/spec/joinRealtimeChannel.html) API. Relays forward these to active subscribers but do not store them.
-
-### Tags
-
-- `i`: The `webxdc` identifier from the originating event (required)
-
-### Content
-
-Base64-encoded `Uint8Array` payload (max 128,000 bytes raw).
-
-```json
-{
-  "kind": 20932,
-  "content": "SGVsbG8gZnJvbSBucHViMWFiYy4uLg==",
-  "tags": [
-    ["i", "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"]
-  ]
-}
-```
-
-## Flow
-
-1. A user uploads a `.xdc` file (e.g. to Blossom) and publishes an event with the URL in content and an `imeta` tag. The `imeta` SHOULD include a `webxdc` property.
-2. A client detects the `imeta` tag, downloads the `.xdc`, extracts it, and runs `index.html` in a sandboxed iframe or webview.
-3. `sendUpdate()` publishes a kind `4932` event with the `webxdc` identifier in an `i` tag.
-4. The client subscribes to kind `4932` events with `#i` matching the identifier and delivers them via `setUpdateListener()`.
-5. `joinRealtimeChannel()` subscribes to kind `20932` events with `#i` matching the identifier. `send()` publishes ephemeral kind `20932` events. `leave()` closes the subscription.
-6. `selfAddr` and `selfName` MAY map to the user's npub and display name, or any other values.
-
-## Security Considerations
-
-- Webxdc apps MUST be sandboxed with no network access, per the [webxdc spec](https://webxdc.org/docs/spec/messenger.html).
-- Clients SHOULD verify the `.xdc` file hash (`x` tag) before running it.
-- All communication in this spec is public. Webxdc apps designed for private chats or small groups may not work as expected.
-- Webxdc apps have no access to Nostr signatures or identity verification. Any participant can claim to be anyone within the app. Apps should not rely on `selfAddr` or `selfName` for trust decisions.

android/app/build.gradle

@@ -14,8 +14,15 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
-        versionName "2.14.4"
+        versionName "2.8.9"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
+        // The arti-mobile AAR bundles large native Rust libraries for every
+        // ABI (~45 MB total). Restrict to the ABIs we actually ship/test:
+        // arm64-v8a + armeabi-v7a (real devices) and x86_64 (emulators).
+        // Drop x86_64 here if you only ever test on physical devices.
+        ndk {
+            abiFilters 'arm64-v8a', 'armeabi-v7a', 'x86_64'
+        }
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
              // Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
@@ -51,10 +58,18 @@ repositories {
 dependencies {
     implementation fileTree(include: ['*.jar'], dir: 'libs')
     implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
+    implementation "androidx.core:core:$androidxCoreVersion"
     implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
     implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
     implementation project(':capacitor-android')
     implementation 'com.squareup.okhttp3:okhttp:4.12.0'
+    // Tor in Rust (arti) — prebuilt AAR from Guardian Project's gpmaven repo.
+    // Provides org.torproject.arti.ArtiProxy used by TorController.
+    implementation 'org.torproject:arti-mobile:1.7.0.1'
+    // arti pulls androidx.webkit in transitively but only at runtime; we
+    // compile against ProxyController/WebViewFeature in TorController, so
+    // declare it explicitly on the app's compile classpath.
+    implementation "androidx.webkit:webkit:$androidxWebkitVersion"
     testImplementation "junit:junit:$junitVersion"
     androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
     androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"

android/app/proguard-rules.pro

@@ -19,6 +19,18 @@
 -dontwarn okio.**
 -keep class okhttp3.** { *; }
 
+# Barcode scanner plugin (@capacitor/barcode-scanner -> OutSystems ionbarcode)
+# references Gson's @SerializedName, but Gson isn't on the release classpath.
+# Suppress the missing-class warning, keep the annotation attribute, and keep
+# the plugin's model classes so R8 doesn't strip/rename serialized fields.
+-dontwarn com.google.gson.**
+-keepattributes *Annotation*
+-keep class com.outsystems.plugins.barcode.** { *; }
+
+# Keep arti (Tor) classes — ArtiJNI declares native methods invoked from the
+# Rust .so via JNI, so its names must not be obfuscated/stripped.
+-keep class org.torproject.arti.** { *; }
+
 # Uncomment this to preserve the line number information for
 # debugging stack traces.
 #-keepattributes SourceFile,LineNumberTable

android/app/src/main/AndroidManifest.xml

@@ -60,4 +60,6 @@
     <uses-permission android:name="android.permission.WAKE_LOCK" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
     <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
+    <uses-permission android:name="android.permission.CAMERA" />
+    <uses-feature android:name="android.hardware.camera" android:required="false" />
 </manifest>

android/app/src/main/java/spot/agora/app/MainActivity.java

@@ -8,6 +8,12 @@ import android.net.Uri;
 import android.os.Build;
 import android.os.Bundle;
 import android.util.Log;
+import android.view.View;
+import android.webkit.WebView;
+
+import androidx.core.graphics.Insets;
+import androidx.core.view.ViewCompat;
+import androidx.core.view.WindowInsetsCompat;
 
 import com.getcapacitor.BridgeActivity;
 
@@ -19,6 +25,14 @@ public class MainActivity extends BridgeActivity {
     protected void onCreate(Bundle savedInstanceState) {
         // Register native plugins before super.onCreate.
         registerPlugin(DittoNotificationPlugin.class);
+        registerPlugin(TorPlugin.class);
+
+        // If the user enabled Tor (apply on relaunch), start arti BEFORE
+        // super.onCreate so the WebView SOCKS proxy override is installed
+        // before the WebView issues any network request — no leak window.
+        if (TorController.isEnabled(this)) {
+            TorController.getInstance().start(getApplicationContext());
+        }
 
         super.onCreate(savedInstanceState);
 
@@ -47,6 +61,35 @@ public class MainActivity extends BridgeActivity {
 
         // Handle notification tap deep link
         handleNotificationIntent(getIntent());
+
+        // The Android WebView reports env(safe-area-inset-*) as 0, so inject the
+        // real system-bar insets as CSS variables (--safe-area-inset-top/bottom)
+        // that the web layer consumes (see src/index.css). Without this, the top
+        // nav renders behind the status bar in the APK.
+        applySafeAreaInsets();
+    }
+
+    /**
+     * Read the status-bar (top) and navigation-bar (bottom) insets and write
+     * them into the WebView as CSS pixel variables. Re-applies on every inset
+     * change (rotation, status-bar show/hide, etc.).
+     */
+    private void applySafeAreaInsets() {
+        final WebView webView = getBridge().getWebView();
+        if (webView == null) return;
+
+        ViewCompat.setOnApplyWindowInsetsListener(webView, (v, insets) -> {
+            Insets bars = insets.getInsets(WindowInsetsCompat.Type.systemBars());
+            float density = getResources().getDisplayMetrics().density;
+            int topPx = Math.round(bars.top / density);
+            int bottomPx = Math.round(bars.bottom / density);
+            String js =
+                "document.documentElement.style.setProperty('--safe-area-inset-top','" + topPx + "px');" +
+                "document.documentElement.style.setProperty('--safe-area-inset-bottom','" + bottomPx + "px');";
+            v.post(() -> webView.evaluateJavascript(js, null));
+            return insets;
+        });
+        ViewCompat.requestApplyInsets(webView);
     }
 
     @Override

android/app/src/main/java/spot/agora/app/TorController.java

@@ -0,0 +1,375 @@
+package spot.agora.app;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.util.Log;
+
+import androidx.annotation.Nullable;
+import androidx.webkit.ProxyConfig;
+import androidx.webkit.ProxyController;
+import androidx.webkit.WebViewFeature;
+
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.net.InetSocketAddress;
+import java.net.Proxy;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.torproject.arti.ArtiProxy;
+
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.Response;
+
+/**
+ * Process-wide controller for the optional Tor (arti) mode on Android.
+ *
+ * <p>When enabled, this starts a local SOCKS5 proxy backed by arti (Tor in
+ * Rust) and — via {@link ArtiProxy.ArtiProxyBuilder#setWrapWebView(boolean)} —
+ * installs an Android {@code ProxyController} override so that <em>all</em>
+ * Capacitor WebView traffic (every {@code fetch} and relay {@code WebSocket})
+ * is routed through Tor. No changes to the TypeScript HTTP layer are needed.
+ *
+ * <p>Activation is "apply on relaunch": the enabled flag is persisted to
+ * {@link SharedPreferences} by {@link TorPlugin} and read here at startup from
+ * {@link MainActivity}. arti is started <em>before</em> the WebView loads so
+ * there is no pre-bootstrap leak window.
+ *
+ * <p>Pluggable transports (obfs4 via IPtProxy) are intentionally not wired up
+ * yet — the builder already exposes {@code setObfs4Port}/{@code setBridgeLines}
+ * for a future censorship-resistance layer.
+ */
+public class TorController {
+
+    private static final String TAG = "TorController";
+
+    /** Local SOCKS5 port arti listens on (arti's own default). */
+    public static final int SOCKS_PORT = 9150;
+
+    static final String PREFS_NAME = "tor_config";
+    static final String KEY_ENABLED = "enabled";
+
+    /** Endpoint used to confirm a working Tor circuit (small JSON response). */
+    private static final String PROBE_URL = "https://check.torproject.org/api/ip";
+    // Re-verify continuously (gently) so the status reflects current reality.
+    private static final long PROBE_INTERVAL_SECONDS = 10;
+    /** After this long without a successful probe, surface a soft "failed". */
+    private static final long SOFT_TIMEOUT_SECONDS = 120;
+
+    // Status values mirrored to JS (see src/lib/tor.ts TorStatus).
+    public static final String STATUS_DISABLED = "disabled";
+    public static final String STATUS_CONNECTING = "connecting";
+    public static final String STATUS_CONNECTED = "connected";
+    public static final String STATUS_FAILED = "failed";
+
+    /** Receives status changes so the Capacitor plugin can forward them to JS. */
+    public interface StatusListener {
+        void onTorStatus(String status, int bootstrapPercent, @Nullable String error, @Nullable String exitIp);
+    }
+
+    private static volatile TorController instance;
+
+    private final Object lock = new Object();
+    private final AtomicBoolean started = new AtomicBoolean(false);
+
+    private ArtiProxy artiProxy;
+    private ScheduledExecutorService scheduler;
+
+    private volatile String status = STATUS_DISABLED;
+    private volatile int bootstrapPercent = 0;
+    @Nullable private volatile String error = null;
+    /** Tor exit-node IP from the last successful check (for verification UI). */
+    @Nullable private volatile String exitIp = null;
+    /** Consecutive failed probes; used to debounce CONNECTED -> reconnecting. */
+    private int consecutiveFailures = 0;
+    @Nullable private volatile StatusListener listener;
+    private volatile long startedAtMs = 0;
+
+    private TorController() {}
+
+    public static TorController getInstance() {
+        if (instance == null) {
+            synchronized (TorController.class) {
+                if (instance == null) {
+                    instance = new TorController();
+                }
+            }
+        }
+        return instance;
+    }
+
+    /** Whether Tor is enabled in persisted preferences (read at next launch). */
+    public static boolean isEnabled(Context context) {
+        SharedPreferences prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE);
+        return prefs.getBoolean(KEY_ENABLED, false);
+    }
+
+    /** Persist the enabled flag. Takes effect on the next app launch. */
+    public static void setEnabled(Context context, boolean enabled) {
+        context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+                .edit()
+                .putBoolean(KEY_ENABLED, enabled)
+                .apply();
+    }
+
+    public void setListener(@Nullable StatusListener listener) {
+        this.listener = listener;
+        // Replay the current status so a freshly-attached listener is in sync.
+        if (listener != null) {
+            listener.onTorStatus(status, bootstrapPercent, error, exitIp);
+        }
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public int getBootstrapPercent() {
+        return bootstrapPercent;
+    }
+
+    @Nullable
+    public String getError() {
+        return error;
+    }
+
+    @Nullable
+    public String getExitIp() {
+        return exitIp;
+    }
+
+    /**
+     * Start arti and install the WebView proxy override. Idempotent: a second
+     * call while already running is a no-op. Heavy work runs off the caller's
+     * thread so this is safe to invoke from {@code MainActivity.onCreate}.
+     */
+    public void start(Context context) {
+        if (!started.compareAndSet(false, true)) {
+            return;
+        }
+        final Context appContext = context.getApplicationContext();
+        exitIp = null;
+        consecutiveFailures = 0;
+        // Install the fail-closed WebView proxy override synchronously, BEFORE
+        // the WebView loads (start() is called from MainActivity.onCreate ahead
+        // of super.onCreate). With no direct fallback, any request that arti
+        // can't carry fails instead of leaking out directly — even during the
+        // bootstrap window when arti isn't connected yet.
+        applyWebViewProxy();
+        updateStatus(STATUS_CONNECTING, 0, null);
+        startedAtMs = System.currentTimeMillis();
+
+        Thread t = new Thread(() -> {
+            try {
+                synchronized (lock) {
+                    // NB: we do NOT use setWrapWebView(true) — arti's helper
+                    // appends a DIRECT fallback (fail-open). We set our own
+                    // fail-closed override in applyWebViewProxy() instead.
+                    artiProxy = ArtiProxy.Builder(appContext)
+                            .setSocksPort(SOCKS_PORT)
+                            .setLogListener(this::onArtiLog)
+                            .build();
+                    artiProxy.start();
+                }
+                Log.d(TAG, "arti started on socks://127.0.0.1:" + SOCKS_PORT);
+                beginConnectivityProbe();
+            } catch (Throwable e) {
+                Log.e(TAG, "Failed to start arti", e);
+                updateStatus(STATUS_FAILED, bootstrapPercent, String.valueOf(e.getMessage()));
+            }
+        }, "arti-start");
+        t.setDaemon(true);
+        t.start();
+    }
+
+    /** Stop arti and route the WebView back to a direct connection. Safe to
+     *  call live (toggle off) — clears the SOCKS proxy override so traffic
+     *  doesn't get stranded on the now-stopped proxy. */
+    public void stop() {
+        // Remove the WebView SOCKS override first so new requests go direct.
+        clearWebViewProxy();
+        synchronized (lock) {
+            if (scheduler != null) {
+                scheduler.shutdownNow();
+                scheduler = null;
+            }
+            if (artiProxy != null) {
+                try {
+                    artiProxy.stop();
+                } catch (Throwable e) {
+                    Log.w(TAG, "Error stopping arti", e);
+                }
+                artiProxy = null;
+            }
+        }
+        started.set(false);
+        exitIp = null;
+        updateStatus(STATUS_DISABLED, 0, null);
+    }
+
+    /** Re-run the connectivity probe (used by a "Retry" action in the gate). */
+    public void retry() {
+        if (!started.get()) {
+            return;
+        }
+        consecutiveFailures = 0;
+        startedAtMs = System.currentTimeMillis();
+        if (!STATUS_CONNECTED.equals(status)) {
+            updateStatus(STATUS_CONNECTING, bootstrapPercent, null);
+        }
+        beginConnectivityProbe();
+    }
+
+    // --- internals -------------------------------------------------------
+
+    /**
+     * Route the WebView through arti's SOCKS proxy, FAIL-CLOSED. There is no
+     * {@code addDirect()} fallback, so when Tor can't carry a request it fails
+     * rather than leaking to a direct connection. localhost is bypassed (it's
+     * the local Capacitor asset server, never remote traffic).
+     */
+    private void applyWebViewProxy() {
+        try {
+            if (WebViewFeature.isFeatureSupported(WebViewFeature.PROXY_OVERRIDE)) {
+                ProxyConfig config = new ProxyConfig.Builder()
+                        .addProxyRule("socks://127.0.0.1:" + SOCKS_PORT)
+                        // No addDirect() — fail closed.
+                        .addBypassRule("localhost")
+                        .addBypassRule("127.0.0.1")
+                        .build();
+                ProxyController.getInstance().setProxyOverride(config, Runnable::run, () -> {});
+            }
+        } catch (Throwable e) {
+            Log.w(TAG, "Error applying WebView proxy override", e);
+        }
+    }
+
+    /** Remove the app-wide WebView SOCKS proxy override so the WebView reverts
+     *  to a direct connection. */
+    private void clearWebViewProxy() {
+        try {
+            if (WebViewFeature.isFeatureSupported(WebViewFeature.PROXY_OVERRIDE)) {
+                ProxyController.getInstance().clearProxyOverride(Runnable::run, () -> {});
+            }
+        } catch (Throwable e) {
+            Log.w(TAG, "Error clearing WebView proxy override", e);
+        }
+    }
+
+    private static final Pattern PERCENT = Pattern.compile("(\\d{1,3})\\s*%");
+
+    private void onArtiLog(String line) {
+        if (line == null) return;
+        Log.d("artilog", line);
+        // Best-effort bootstrap progress for the UI. arti's log format isn't a
+        // stable API, so the connectivity probe (below) remains authoritative
+        // for the definitive "connected" signal.
+        Matcher m = PERCENT.matcher(line);
+        if (m.find()) {
+            try {
+                int pct = Integer.parseInt(m.group(1));
+                if (pct >= 0 && pct <= 100 && pct >= bootstrapPercent
+                        && !STATUS_CONNECTED.equals(status)) {
+                    updateStatus(STATUS_CONNECTING, pct, null);
+                }
+            } catch (NumberFormatException ignored) {
+            }
+        }
+    }
+
+    private void beginConnectivityProbe() {
+        synchronized (lock) {
+            if (scheduler != null) {
+                scheduler.shutdownNow();
+            }
+            scheduler = Executors.newSingleThreadScheduledExecutor(r -> {
+                Thread th = new Thread(r, "tor-probe");
+                th.setDaemon(true);
+                return th;
+            });
+            final ScheduledExecutorService s = scheduler;
+            final OkHttpClient client = new OkHttpClient.Builder()
+                    .proxy(new Proxy(Proxy.Type.SOCKS, new InetSocketAddress("127.0.0.1", SOCKS_PORT)))
+                    .connectTimeout(20, TimeUnit.SECONDS)
+                    .readTimeout(20, TimeUnit.SECONDS)
+                    .build();
+
+            // Probe continuously (no shutdown on success). check.torproject.org
+            // reports whether the request actually exited via Tor, so we only
+            // report CONNECTED when IsTor is true — and we keep re-verifying so a
+            // dropped circuit downgrades the status instead of lying.
+            s.scheduleWithFixedDelay(() -> {
+                Request req = new Request.Builder()
+                        .url(PROBE_URL)
+                        .header("Accept", "application/json")
+                        .build();
+                try (Response resp = client.newCall(req).execute()) {
+                    String body = resp.body() != null ? resp.body().string() : "";
+                    boolean isTor = false;
+                    String ip = null;
+                    try {
+                        JSONObject json = new JSONObject(body);
+                        isTor = json.optBoolean("IsTor", false);
+                        ip = json.has("IP") ? json.optString("IP", null) : null;
+                    } catch (JSONException ignored) {
+                        // Non-JSON response — treat as not-via-Tor below.
+                    }
+
+                    if (resp.isSuccessful() && isTor) {
+                        consecutiveFailures = 0;
+                        exitIp = ip;
+                        updateStatus(STATUS_CONNECTED, 100, null);
+                    } else if (resp.isSuccessful()) {
+                        // Reached the internet but NOT through Tor — a leak/bypass.
+                        // This should not happen with the SOCKS proxy, but report
+                        // it honestly rather than claiming a Tor connection.
+                        consecutiveFailures = 0;
+                        exitIp = ip;
+                        updateStatus(STATUS_FAILED, bootstrapPercent,
+                                "Connected to the internet, but not through Tor.");
+                    } else {
+                        handleProbeFailure();
+                    }
+                } catch (Exception e) {
+                    handleProbeFailure();
+                }
+            }, 0, PROBE_INTERVAL_SECONDS, TimeUnit.SECONDS);
+        }
+    }
+
+    /** A probe couldn't reach Tor. Debounce CONNECTED, surface FAILED after the
+     *  soft timeout while still connecting. */
+    private void handleProbeFailure() {
+        consecutiveFailures++;
+        if (STATUS_CONNECTED.equals(status)) {
+            // Tolerate a couple of transient blips before downgrading.
+            if (consecutiveFailures >= 3) {
+                exitIp = null;
+                updateStatus(STATUS_CONNECTING, bootstrapPercent,
+                        "Lost the Tor circuit; reconnecting…");
+            }
+            return;
+        }
+        long elapsed = (System.currentTimeMillis() - startedAtMs) / 1000;
+        if (elapsed >= SOFT_TIMEOUT_SECONDS && !STATUS_FAILED.equals(status)) {
+            updateStatus(STATUS_FAILED, bootstrapPercent,
+                    "Couldn't reach the Tor network. Your network may be blocking Tor.");
+        }
+    }
+
+    private void updateStatus(String newStatus, int percent, @Nullable String err) {
+        this.status = newStatus;
+        this.bootstrapPercent = percent;
+        this.error = err;
+        StatusListener l = this.listener;
+        if (l != null) {
+            l.onTorStatus(newStatus, percent, err, exitIp);
+        }
+    }
+}

android/app/src/main/java/spot/agora/app/TorPlugin.java

@@ -0,0 +1,95 @@
+package spot.agora.app;
+
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+/**
+ * Capacitor bridge for the Tor (arti) mode.
+ *
+ * <p>Mirrors {@link DittoNotificationPlugin}'s pattern: JS configures native
+ * state, native owns the work. The enabled flag is persisted only — arti is
+ * actually started at launch from {@link MainActivity} (apply on relaunch).
+ * Live bootstrap status is pushed to JS via the {@code torStatus} event.
+ *
+ * <p>JS interface: see {@code src/lib/tor.ts}.
+ */
+@CapacitorPlugin(name = "Tor")
+public class TorPlugin extends Plugin {
+
+    private static final String EVENT_STATUS = "torStatus";
+
+    @Override
+    public void load() {
+        // Forward native status changes to JS listeners. Attaching also replays
+        // the current status, keeping a newly-mounted JS gate in sync.
+        TorController.getInstance().setListener((status, bootstrapPercent, error, exitIp) -> {
+            JSObject data = new JSObject();
+            data.put("status", status);
+            data.put("bootstrapPercent", bootstrapPercent);
+            data.put("error", error);
+            data.put("exitIp", exitIp);
+            notifyListeners(EVENT_STATUS, data);
+        });
+    }
+
+    /** Whether Tor is enabled in persisted preferences. */
+    @PluginMethod
+    public void isEnabled(PluginCall call) {
+        JSObject ret = new JSObject();
+        ret.put("enabled", TorController.isEnabled(getContext()));
+        call.resolve(ret);
+    }
+
+    /** Persist the enabled flag. Applied on the next app launch. */
+    @PluginMethod
+    public void setEnabled(PluginCall call) {
+        Boolean enabled = call.getBoolean("enabled");
+        if (enabled == null) {
+            call.reject("Missing 'enabled' boolean");
+            return;
+        }
+        TorController.setEnabled(getContext(), enabled);
+        call.resolve();
+    }
+
+    /** Start arti now (live activation). Also persists enabled=true so it
+     *  auto-starts on the next cold launch. */
+    @PluginMethod
+    public void start(PluginCall call) {
+        TorController.setEnabled(getContext(), true);
+        TorController.getInstance().start(getContext());
+        call.resolve();
+    }
+
+    /** Stop arti now (live deactivation) and clear the WebView proxy. Also
+     *  persists enabled=false. */
+    @PluginMethod
+    public void stop(PluginCall call) {
+        TorController.setEnabled(getContext(), false);
+        TorController.getInstance().stop();
+        call.resolve();
+    }
+
+    /** Current connection status (synchronous snapshot). */
+    @PluginMethod
+    public void getStatus(PluginCall call) {
+        TorController controller = TorController.getInstance();
+        JSObject ret = new JSObject();
+        ret.put("enabled", TorController.isEnabled(getContext()));
+        ret.put("status", controller.getStatus());
+        ret.put("bootstrapPercent", controller.getBootstrapPercent());
+        ret.put("error", controller.getError());
+        ret.put("exitIp", controller.getExitIp());
+        call.resolve(ret);
+    }
+
+    /** Re-run the connectivity probe (for a "Retry" action in the gate). */
+    @PluginMethod
+    public void retry(PluginCall call) {
+        TorController.getInstance().retry();
+        call.resolve();
+    }
+}

android/app/src/main/res/drawable-v24/ic_launcher_foreground.xml

@@ -1,50 +0,0 @@
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="108dp"
-    android:height="108dp"
-    android:viewportWidth="100"
-    android:viewportHeight="100">
-
-    <!--
-      Ditto logo from public/logo.svg.
-      SVG viewBox is "-5 -10 100 100", so we shift all paths by (+5, +10)
-      to place the origin at (0,0) for the 100x100 viewport.
-      Then scale to 60% around the content center (50, 40) to fit within
-      Android's adaptive icon safe zone (66% of 108dp).
-    -->
-
-    <group
-        android:translateX="5"
-        android:translateY="10"
-        android:scaleX="0.7"
-        android:scaleY="0.7"
-        android:pivotX="50"
-        android:pivotY="40">
-
-        <!-- path1: bottom arc / bottom-right swash -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 71.719615,49.36907 -0.62891,0.37109 c -0.12891,0.07031 -0.26172,0.14844 -0.39062,0.21875 -3.9883,10.309 -14.008,17.617 -25.699,17.617 -4.1211,0 -8.0312,-0.89844 -11.539,-2.5391 -0.12891,0.03906 -0.26172,0.07031 -0.39063,0.10156 l -0.35156,0.08984 h -0.02734 l -0.25,0.05859 -0.07813,0.01953 -0.10938,0.03125 c -0.55859,0.12891 -1.1289,0.26172 -1.6992,0.39062 -0.10156,0.03125 -0.19922,0.05078 -0.30078,0.07031 l -0.30078,0.10156 -0.18359,0.0078 c -0.26953,0.05859 -1.3086,0.26953 -1.3086,0.26953 -0.28906,0.05859 -0.55859,0.10937 -0.82813,0.17187 4.9805,3.3086 10.961,5.2305 17.371,5.2305 15.059,0 27.699,-10.602 30.828,-24.738 -0.75,0.48828 -1.5195,0.96875 -2.2891,1.4414 -0.59375,0.36328 -1.2031,0.72656 -1.8242,1.0859 z" />
-
-        <!-- path2: small left accent dot/arc -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 30.926615,29.47807 c 0.36328,-0.48828 0.75,-0.95312 1.1523,-1.3828 0.75781,-0.80469 0.71484,-2.0703 -0.08984,-2.8281 -0.80469,-0.75781 -2.0703,-0.71484 -2.8281,0.08984 -0.50781,0.53906 -0.99219,1.125 -1.4492,1.7383 -0.65625,0.88672 -0.47266,2.1406 0.41406,2.7969 0.35938,0.26562 0.77344,0.39453 1.1875,0.39453 0.61719,0 1.2227,-0.27734 1.6133,-0.80859 z" />
-
-        <!-- path3: left vertical bar -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 26.742615,32.67807 c -1.0586,-0.3125 -2.1719,0.29687 -2.4805,1.3594 -0.55859,1.9062 -0.83984,3.9141 -0.83984,5.9609 0,2.3789 0.39062,4.7227 1.1602,6.9609 0.28516,0.82812 1.0625,1.3516 1.8906,1.3516 0.21484,0 0.43359,-0.03516 0.64844,-0.10938 1.043,-0.35938 1.6016,-1.4961 1.2422,-2.543 -0.625,-1.8203 -0.94141,-3.7227 -0.94141,-5.6602 0,-1.668 0.22656,-3.2969 0.67969,-4.8398 0.30859,-1.0586 -0.30078,-2.168 -1.3594,-2.4805 z" />
-
-        <!-- path4: main ring arc -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 14.691615,48.83807 c 0.10156,0.33984 0.19922,0.67969 0.32812,1.0195 0.42969,1.3516 0.94922,2.6484 1.5781,3.9102 0.10156,-0.01172 0.21094,-0.01172 0.32031,-0.01953 l 0.16016,-0.01172 0.80078,-0.07031 c 0.37109,-0.03906 0.67188,-0.07031 0.98047,-0.10156 0.51172,-0.05859 1.0195,-0.12109 1.5586,-0.19922 l 0.21875,-0.03125 c 0.07031,-0.01172 0.14062,-0.01953 0.21094,-0.03125 -1.2188,-2.2109 -2.1484,-4.6016 -2.7305,-7.1211 -0.16016,-0.71094 -0.30078,-1.4297 -0.39844,-2.1602 -0.19922,-1.3086 -0.30078,-2.6602 -0.30078,-4.0312 0,-0.89844 0.03906,-1.7812 0.12891,-2.6484 0.07031,-0.71094 0.16016,-1.4102 0.28906,-2.1016 2.25,-12.949 13.57,-22.828 27.16,-22.828 6.0508,0 11.648,1.9609 16.211,5.3008 0.57031,0.41016 1.1289,0.85938 1.6719,1.3203 1.6914,1.4219 3.2109,3.0703 4.5,4.8789 0.42969,0.60156 0.83984,1.2109 1.2188,1.8398 1.3203,2.1602 2.3398,4.5117 3.0195,7 0.23828,-0.17188 0.42969,-0.30859 0.62891,-0.46875 0.64844,-0.48047 1.2109,-0.92188 1.7383,-1.3398 0.28125,-0.23047 0.5,-0.41016 0.71094,-0.57812 0.10156,-0.07813 0.19141,-0.16016 0.28125,-0.23828 -0.42969,-1.3516 -0.96094,-2.6484 -1.5898,-3.8984 -0.14062,-0.32812 -0.30859,-0.64844 -0.48047,-0.96875 -0.32812,-0.64844 -0.69922,-1.2891 -1.0898,-1.9102 -1.6797,-2.7109 -3.7695,-5.1406 -6.1719,-7.2188 -0.57031,-0.48828 -1.1484,-0.96875 -1.7617,-1.4102 -0.55859,-0.42188 -1.1406,-0.82812 -1.7305,-1.2109 -4.9414,-3.2188 -10.852,-5.0898 -17.16,-5.0898 -14.961,0 -27.531,10.469 -30.75,24.469 -0.17188,0.67969 -0.30859,1.3711 -0.42188,2.0703 -0.12891,0.73828 -0.21875,1.5 -0.28906,2.2617 -0.07813,0.91016 -0.12109,1.8398 -0.12109,2.7812 0,2.3008 0.25,4.5508 0.71875,6.7109 0.17188,0.71484 0.35156,1.4258 0.5625,2.125 z" />
-
-        <!-- path5: top-right swash / outer arc with tail -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 90.441615,21.60007 c -2.1797,-5.3398 -9.4102,-7.3984 -21,-6.0391 1.8906,1.8906 3.5391,3.9688 4.9297,6.2109 0.28906,0.46094 0.55859,0.92187 0.80859,1.3789 5.5391,-0.12109 7.6094,1.0391 7.8398,1.4492 0.12891,0.46875 -0.55078,2.7305 -4.5898,6.4805 -0.01953,0.01953 -0.03125,0.03125 -0.03906,0.03906 -0.26172,0.23828 -0.51953,0.48047 -0.80078,0.71875 -0.19922,0.17969 -0.41016,0.35938 -0.62891,0.53906 -0.10938,0.10156 -0.21875,0.19141 -0.33984,0.28906 -0.23828,0.19922 -0.5,0.41016 -0.76172,0.62109 -0.12891,0.10156 -0.26172,0.21094 -0.39844,0.32031 -0.42969,0.33984 -0.89063,0.69141 -1.3711,1.0508 -0.26953,0.21094 -0.53906,0.41016 -0.82812,0.60938 -0.32031,0.23047 -0.64062,0.46875 -0.98047,0.69922 0,0.01172 -0.01172,0.01172 -0.01172,0.01172 -0.26953,0.19141 -0.55078,0.37891 -0.82812,0.57031 -0.28125,0.19141 -0.55859,0.37109 -0.85156,0.55859 -0.25,0.16016 -0.5,0.32812 -0.76172,0.48828 -6,3.8984 -13.48,7.7188 -21.379,10.922 -8.0117,3.2383 -15.871,5.6602 -22.93,7.0391 -0.30078,0.05859 -0.60156,0.12109 -0.89062,0.17188 -0.60938,0.12109 -1.2188,0.21875 -1.8203,0.32031 -0.07031,0.01172 -0.12891,0.01953 -0.19922,0.03125 h -0.01953 c -0.28906,0.05078 -0.57031,0.08984 -0.83984,0.12891 -0.30859,0.05078 -0.60938,0.08984 -0.91016,0.12891 -0.57031,0.07813 -1.1094,0.14844 -1.6406,0.21094 -0.35156,0.03906 -0.69141,0.07031 -1.0195,0.10156 -0.30078,0.03125 -0.58984,0.05078 -0.87891,0.07813 -0.48047,0.03125 -0.92969,0.05859 -1.3711,0.07813 -0.39844,0.01953 -0.78125,0.03125 -1.1484,0.03906 -5.5116996,0.10938 -7.5702996,-1.0391 -7.8007996,-1.4492 -0.12891,-0.48047 0.55078,-2.7383 4.6093996,-6.5 -0.12891,-0.48828 -0.26172,-1 -0.37891,-1.5391 -0.51953,-2.4219 -0.78906,-4.8906 -0.78906,-7.3594 0,-0.17969 0,-0.37109 0.01172,-0.55078 -9.2733996,7.082 -13.0229996,13.59 -10.8749996,18.949 1.7383,4.2695 6.7188,6.4492 14.5899996,6.4492 2.8594,0 6.1016,-0.28906 9.7109,-0.87109 0.17188,-0.03125 0.33984,-0.05859 0.51953,-0.08984 0.17188,-0.03125 0.35156,-0.05859 0.51953,-0.08984 l 1.2188,-0.21875 c 0.57031,-0.10156 1.1484,-0.21875 1.7305,-0.33984 0.53125,-0.10938 1.0508,-0.21094 1.5781,-0.32812 0.01172,0 0.03125,-0.01172 0.03906,-0.01172 0.05078,-0.01172 0.08984,-0.01953 0.14062,-0.03125 0.07031,-0.01172 0.12891,-0.03125 0.19922,-0.05078 0.57812,-0.12891 1.1602,-0.26172 1.7383,-0.39844 0.05078,-0.01172 0.10156,-0.03125 0.14844,-0.03906 0.21094,-0.05078 0.42188,-0.10156 0.64062,-0.14844 h 0.01172 c 6.0898,-1.5117 12.559,-3.6406 19.102,-6.2891 6.5508,-2.6602 12.68,-5.6289 18.109,-8.7812 0.21875,-0.12891 0.44141,-0.26172 0.66016,-0.39062 0.58984,-0.33984 1.1797,-0.69141 1.7617,-1.0508 1.5703,-0.96094 3.0586,-1.9297 4.4805,-2.9102 0.12891,-0.08984 0.26172,-0.17969 0.39062,-0.26953 11.242,-7.8477 15.941,-15.09 13.594,-20.938 z" />
-
-    </group>
-
-</vector>

android/app/src/main/res/drawable/splash_icon_vector.xml

@@ -5,43 +5,26 @@
     android:viewportHeight="1200">
 
     <!--
-      Android 12 splash screen masks the icon to a circle at 2/3 of canvas (160dp of 240dp).
-      The Ditto logo SVG has viewBox="-5 -10 100 100".
-      We scale the 100x100 logo to fit ~800x800 in the center of 1200x1200,
-      leaving ~200px padding on each side for the circular safe zone.
-      Scale factor: 800/100 = 8. Translate: (200 + 5*8, 200 + 10*8) = (240, 280) to shift origin.
+      Agora double-bolt logo from public/logo.svg (viewBox "0 0 720 880").
+      Android 12 splash masks the icon to a circle at 2/3 of the canvas
+      (~800dp of 1200dp). The logo is 720x880 (portrait); scale 880 -> 800
+      (factor 800/880 = 0.9091) giving a scaled width of ~654, then center:
+        translateX = (1200 - 720*0.9091) / 2 ≈ 273
+        translateY = (1200 - 880*0.9091) / 2 = 200
     -->
 
     <group
-        android:translateX="240"
-        android:translateY="280"
-        android:scaleX="8"
-        android:scaleY="8">
+        android:translateX="273"
+        android:translateY="200"
+        android:scaleX="0.9091"
+        android:scaleY="0.9091">
 
-        <!-- path1: bottom arc / bottom-right swash -->
         <path
             android:fillColor="#FFFFFF"
-            android:pathData="m 71.719615,49.36907 -0.62891,0.37109 c -0.12891,0.07031 -0.26172,0.14844 -0.39062,0.21875 -3.9883,10.309 -14.008,17.617 -25.699,17.617 -4.1211,0 -8.0312,-0.89844 -11.539,-2.5391 -0.12891,0.03906 -0.26172,0.07031 -0.39063,0.10156 l -0.35156,0.08984 h -0.02734 l -0.25,0.05859 -0.07813,0.01953 -0.10938,0.03125 c -0.55859,0.12891 -1.1289,0.26172 -1.6992,0.39062 -0.10156,0.03125 -0.19922,0.05078 -0.30078,0.07031 l -0.30078,0.10156 -0.18359,0.0078 c -0.26953,0.05859 -1.3086,0.26953 -1.3086,0.26953 -0.28906,0.05859 -0.55859,0.10937 -0.82813,0.17187 4.9805,3.3086 10.961,5.2305 17.371,5.2305 15.059,0 27.699,-10.602 30.828,-24.738 -0.75,0.48828 -1.5195,0.96875 -2.2891,1.4414 -0.59375,0.36328 -1.2031,0.72656 -1.8242,1.0859 z" />
-
-        <!-- path2: small left accent dot/arc -->
+            android:pathData="M415.596 0L0 417.12L284.123 702.287L346.922 468.3H189.533L415.596 0Z" />
         <path
             android:fillColor="#FFFFFF"
-            android:pathData="m 30.926615,29.47807 c 0.36328,-0.48828 0.75,-0.95312 1.1523,-1.3828 0.75781,-0.80469 0.71484,-2.0703 -0.08984,-2.8281 -0.80469,-0.75781 -2.0703,-0.71484 -2.8281,0.08984 -0.50781,0.53906 -0.99219,1.125 -1.4492,1.7383 -0.65625,0.88672 -0.47266,2.1406 0.41406,2.7969 0.35938,0.26562 0.77344,0.39453 1.1875,0.39453 0.61719,0 1.2227,-0.27734 1.6133,-0.80859 z" />
-
-        <!-- path3: left vertical bar -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 26.742615,32.67807 c -1.0586,-0.3125 -2.1719,0.29687 -2.4805,1.3594 -0.55859,1.9062 -0.83984,3.9141 -0.83984,5.9609 0,2.3789 0.39062,4.7227 1.1602,6.9609 0.28516,0.82812 1.0625,1.3516 1.8906,1.3516 0.21484,0 0.43359,-0.03516 0.64844,-0.10938 1.043,-0.35938 1.6016,-1.4961 1.2422,-2.543 -0.625,-1.8203 -0.94141,-3.7227 -0.94141,-5.6602 0,-1.668 0.22656,-3.2969 0.67969,-4.8398 0.30859,-1.0586 -0.30078,-2.168 -1.3594,-2.4805 z" />
-
-        <!-- path4: main ring arc -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 14.691615,48.83807 c 0.10156,0.33984 0.19922,0.67969 0.32812,1.0195 0.42969,1.3516 0.94922,2.6484 1.5781,3.9102 0.10156,-0.01172 0.21094,-0.01172 0.32031,-0.01953 l 0.16016,-0.01172 0.80078,-0.07031 c 0.37109,-0.03906 0.67188,-0.07031 0.98047,-0.10156 0.51172,-0.05859 1.0195,-0.12109 1.5586,-0.19922 l 0.21875,-0.03125 c 0.07031,-0.01172 0.14062,-0.01953 0.21094,-0.03125 -1.2188,-2.2109 -2.1484,-4.6016 -2.7305,-7.1211 -0.16016,-0.71094 -0.30078,-1.4297 -0.39844,-2.1602 -0.19922,-1.3086 -0.30078,-2.6602 -0.30078,-4.0312 0,-0.89844 0.03906,-1.7812 0.12891,-2.6484 0.07031,-0.71094 0.16016,-1.4102 0.28906,-2.1016 2.25,-12.949 13.57,-22.828 27.16,-22.828 6.0508,0 11.648,1.9609 16.211,5.3008 0.57031,0.41016 1.1289,0.85938 1.6719,1.3203 1.6914,1.4219 3.2109,3.0703 4.5,4.8789 0.42969,0.60156 0.83984,1.2109 1.2188,1.8398 1.3203,2.1602 2.3398,4.5117 3.0195,7 0.23828,-0.17188 0.42969,-0.30859 0.62891,-0.46875 0.64844,-0.48047 1.2109,-0.92188 1.7383,-1.3398 0.28125,-0.23047 0.5,-0.41016 0.71094,-0.57812 0.10156,-0.07813 0.19141,-0.16016 0.28125,-0.23828 -0.42969,-1.3516 -0.96094,-2.6484 -1.5898,-3.8984 -0.14062,-0.32812 -0.30859,-0.64844 -0.48047,-0.96875 -0.32812,-0.64844 -0.69922,-1.2891 -1.0898,-1.9102 -1.6797,-2.7109 -3.7695,-5.1406 -6.1719,-7.2188 -0.57031,-0.48828 -1.1484,-0.96875 -1.7617,-1.4102 -0.55859,-0.42188 -1.1406,-0.82812 -1.7305,-1.2109 -4.9414,-3.2188 -10.852,-5.0898 -17.16,-5.0898 -14.961,0 -27.531,10.469 -30.75,24.469 -0.17188,0.67969 -0.30859,1.3711 -0.42188,2.0703 -0.12891,0.73828 -0.21875,1.5 -0.28906,2.2617 -0.07813,0.91016 -0.12109,1.8398 -0.12109,2.7812 0,2.3008 0.25,4.5508 0.71875,6.7109 0.17188,0.71484 0.35156,1.4258 0.5625,2.125 z" />
-
-        <!-- path5: top-right swash / outer arc with tail -->
-        <path
-            android:fillColor="#FFFFFF"
-            android:pathData="m 90.441615,21.60007 c -2.1797,-5.3398 -9.4102,-7.3984 -21,-6.0391 1.8906,1.8906 3.5391,3.9688 4.9297,6.2109 0.28906,0.46094 0.55859,0.92187 0.80859,1.3789 5.5391,-0.12109 7.6094,1.0391 7.8398,1.4492 0.12891,0.46875 -0.55078,2.7305 -4.5898,6.4805 -0.01953,0.01953 -0.03125,0.03125 -0.03906,0.03906 -0.26172,0.23828 -0.51953,0.48047 -0.80078,0.71875 -0.19922,0.17969 -0.41016,0.35938 -0.62891,0.53906 -0.10938,0.10156 -0.21875,0.19141 -0.33984,0.28906 -0.23828,0.19922 -0.5,0.41016 -0.76172,0.62109 -0.12891,0.10156 -0.26172,0.21094 -0.39844,0.32031 -0.42969,0.33984 -0.89063,0.69141 -1.3711,1.0508 -0.26953,0.21094 -0.53906,0.41016 -0.82812,0.60938 -0.32031,0.23047 -0.64062,0.46875 -0.98047,0.69922 0,0.01172 -0.01172,0.01172 -0.01172,0.01172 -0.26953,0.19141 -0.55078,0.37891 -0.82812,0.57031 -0.28125,0.19141 -0.55859,0.37109 -0.85156,0.55859 -0.25,0.16016 -0.5,0.32812 -0.76172,0.48828 -6,3.8984 -13.48,7.7188 -21.379,10.922 -8.0117,3.2383 -15.871,5.6602 -22.93,7.0391 -0.30078,0.05859 -0.60156,0.12109 -0.89062,0.17188 -0.60938,0.12109 -1.2188,0.21875 -1.8203,0.32031 -0.07031,0.01172 -0.12891,0.01953 -0.19922,0.03125 h -0.01953 c -0.28906,0.05078 -0.57031,0.08984 -0.83984,0.12891 -0.30859,0.05078 -0.60938,0.08984 -0.91016,0.12891 -0.57031,0.07813 -1.1094,0.14844 -1.6406,0.21094 -0.35156,0.03906 -0.69141,0.07031 -1.0195,0.10156 -0.30078,0.03125 -0.58984,0.05078 -0.87891,0.07813 -0.48047,0.03125 -0.92969,0.05859 -1.3711,0.07813 -0.39844,0.01953 -0.78125,0.03125 -1.1484,0.03906 -5.5116996,0.10938 -7.5702996,-1.0391 -7.8007996,-1.4492 -0.12891,-0.48047 0.55078,-2.7383 4.6093996,-6.5 -0.12891,-0.48828 -0.26172,-1 -0.37891,-1.5391 -0.51953,-2.4219 -0.78906,-4.8906 -0.78906,-7.3594 0,-0.17969 0,-0.37109 0.01172,-0.55078 -9.2733996,7.082 -13.0229996,13.59 -10.8749996,18.949 1.7383,4.2695 6.7188,6.4492 14.5899996,6.4492 2.8594,0 6.1016,-0.28906 9.7109,-0.87109 0.17188,-0.03125 0.33984,-0.05859 0.51953,-0.08984 0.17188,-0.03125 0.35156,-0.05859 0.51953,-0.08984 l 1.2188,-0.21875 c 0.57031,-0.10156 1.1484,-0.21875 1.7305,-0.33984 0.53125,-0.10938 1.0508,-0.21094 1.5781,-0.32812 0.01172,0 0.03125,-0.01172 0.03906,-0.01172 0.05078,-0.01172 0.08984,-0.01953 0.14062,-0.03125 0.07031,-0.01172 0.12891,-0.03125 0.19922,-0.05078 0.57812,-0.12891 1.1602,-0.26172 1.7383,-0.39844 0.05078,-0.01172 0.10156,-0.03125 0.14844,-0.03906 0.21094,-0.05078 0.42188,-0.10156 0.64062,-0.14844 h 0.01172 c 6.0898,-1.5117 12.559,-3.6406 19.102,-6.2891 6.5508,-2.6602 12.68,-5.6289 18.109,-8.7812 0.21875,-0.12891 0.44141,-0.26172 0.66016,-0.39062 0.58984,-0.33984 1.1797,-0.69141 1.7617,-1.0508 1.5703,-0.96094 3.0586,-1.9297 4.4805,-2.9102 0.12891,-0.08984 0.26172,-0.17969 0.39062,-0.26953 11.242,-7.8477 15.941,-15.09 13.594,-20.938 z" />
+            android:pathData="M431.879 127.936L363.762 381.328H527.876L258.808 880L720 417.114L431.879 127.936Z" />
 
     </group>
 

android/app/src/main/res/values/ic_launcher_background.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <color name="ic_launcher_background">#ff6600</color>
+    <color name="ic_launcher_background">#e9673f</color>
 </resources>

android/build.gradle

@@ -21,6 +21,9 @@ allprojects {
     repositories {
         google()
         mavenCentral()
+        // Guardian Project's experimental Maven repo, hosting the prebuilt
+        // org.torproject:arti-mobile AAR (Tor in Rust) used for the optional Tor mode.
+        maven { url "https://raw.githubusercontent.com/guardianproject/gpmaven/master" }
     }
 }
 

android/variables.gradle

@@ -1,5 +1,5 @@
 ext {
-    minSdkVersion = 24
+    minSdkVersion = 26
     compileSdkVersion = 36
     targetSdkVersion = 36
     androidxActivityVersion = '1.11.0'

capacitor.config.ts

@@ -18,13 +18,6 @@ const config: CapacitorConfig = {
     contentInset: 'never',
     scheme: 'Agora'
   },
-  plugins: {
-    SystemBars: {
-      // Inject --safe-area-inset-* CSS variables on Android to work around
-      // a Chromium bug (<140) where env(safe-area-inset-*) reports 0.
-      insetsHandling: 'css',
-    },
-  },
 };
 
 export default config;

index.html

@@ -4,12 +4,12 @@
     <title>Agora — Power to the people.</title>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, interactive-widget=resizes-content" />
-    <meta name="description" content="Agora — a Nostr social client for communities, creativity, and ownership." />
+    <meta name="description" content="Agora — a peer-to-peer crowdfunding app on Nostr with an integrated non-custodial on-chain Bitcoin wallet. Fund campaigns directly, no middlemen." />
 
     <!-- Open Graph -->
     <meta property="og:title" content="Agora" />
     <meta property="og:description" content="Power to the people." />
-    <meta property="og:image" content="https://agora.spot/og-image.png" />
+    <meta property="og:image" content="https://agora.spot/og-image.jpg" />
     <meta property="og:image:width" content="1200" />
     <meta property="og:image:height" content="630" />
     <meta property="og:image:type" content="image/jpeg" />
@@ -21,9 +21,9 @@
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="Agora" />
     <meta name="twitter:description" content="Power to the people." />
-    <meta name="twitter:image" content="https://agora.spot/og-image.png" />
+    <meta name="twitter:image" content="https://agora.spot/og-image.jpg" />
 
-    <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src 'self' https:; font-src 'self' https:; base-uri 'self'; manifest-src 'self'; connect-src 'self' blob: https: wss:; img-src 'self' data: blob: https:; media-src 'self' blob: https:">
+    <meta http-equiv="content-security-policy" content="default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; child-src 'self' blob:; style-src 'self' 'unsafe-inline'; frame-src 'self' https:; font-src 'self' https:; base-uri 'self'; manifest-src 'self'; connect-src 'self' blob: https: wss:; img-src 'self' data: blob: https:; media-src 'self' blob: https:">
     <link rel="icon" type="image/x-icon" href="/favicon.ico">
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png">
     <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png">

ios/App/App.xcodeproj/project.pbxproj

@@ -323,7 +323,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 2.14.4;
+				MARKETING_VERSION = 2.8.9;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = spot.agora.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -347,7 +347,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 2.8.0;
+				MARKETING_VERSION = 2.8.9;
 				PRODUCT_BUNDLE_IDENTIFIER = spot.agora.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";

ios/App/App/Info.plist

@@ -50,7 +50,7 @@
 	<key>NSPhotoLibraryUsageDescription</key>
 	<string>Agora needs access to your photo library to upload images to your posts and profile.</string>
 	<key>NSCameraUsageDescription</key>
-	<string>Agora needs camera access to take photos and videos for your posts.</string>
+	<string>Agora needs camera access to take photos and videos for your posts, and to scan QR codes when sending Bitcoin.</string>
 	<key>NSMicrophoneUsageDescription</key>
 	<string>Agora needs access to your microphone to record voice messages.</string>
 	<key>ITSAppUsesNonExemptEncryption</key>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "agora",
   "private": true,
-  "version": "2.8.0",
+  "version": "2.8.9",
   "type": "module",
   "scripts": {
     "dev": "npm i --silent && vite",
@@ -15,7 +15,6 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@bitcoinerlab/secp256k1": "^1.2.0",
     "@breeztech/breez-sdk-spark": "^0.10.0",
     "@capacitor/app": "^8.0.0",
     "@capacitor/barcode-scanner": "^3.0.2",
@@ -31,30 +30,18 @@
     "@dnd-kit/utilities": "^3.2.2",
     "@emoji-mart/data": "^1.2.1",
     "@emoji-mart/react": "^1.1.1",
-    "@fontsource-variable/comfortaa": "^5.2.8",
-    "@fontsource-variable/dm-sans": "^5.2.8",
     "@fontsource-variable/fredoka": "^5.2.10",
     "@fontsource-variable/inter": "^5.2.6",
-    "@fontsource-variable/jetbrains-mono": "^5.2.8",
-    "@fontsource-variable/lora": "^5.2.8",
-    "@fontsource-variable/merriweather": "^5.2.6",
-    "@fontsource-variable/montserrat": "^5.2.8",
     "@fontsource-variable/nunito": "^5.2.7",
-    "@fontsource-variable/outfit": "^5.2.8",
     "@fontsource-variable/playfair-display": "^5.2.8",
-    "@fontsource/bungee-shade": "^5.2.7",
+    "@fontsource/bebas-neue": "^5.2.7",
     "@fontsource/caveat": "^5.2.8",
-    "@fontsource/cherry-bomb-one": "^5.2.7",
-    "@fontsource/comic-neue": "^5.2.7",
-    "@fontsource/comic-relief": "^5.2.2",
-    "@fontsource/courier-prime": "^5.2.8",
     "@fontsource/creepster": "^5.2.7",
-    "@fontsource/luckiest-guy": "^5.2.8",
     "@fontsource/noto-sans-nushu": "^5.2.6",
+    "@fontsource/noto-sans-tc": "^5.2.9",
     "@fontsource/pacifico": "^5.2.7",
     "@fontsource/permanent-marker": "^5.2.7",
     "@fontsource/pirata-one": "^5.2.8",
-    "@fontsource/press-start-2p": "^5.2.7",
     "@fontsource/silkscreen": "^5.2.8",
     "@fontsource/special-elite": "^5.2.8",
     "@getalby/sdk": "^5.1.1",
@@ -72,23 +59,19 @@
     "@milkdown/utils": "^7.20.0",
     "@noble/curves": "^2.2.0",
     "@noble/hashes": "^1.8.0",
-    "@nostrify/nostrify": "^0.52.0",
-    "@nostrify/react": "^0.6.0",
+    "@nostrify/nostrify": "^0.52.2",
+    "@nostrify/react": "^0.6.2",
     "@nostrify/types": "^0.37.0",
     "@plausible-analytics/tracker": "^0.4.4",
     "@radix-ui/react-accordion": "^1.2.0",
     "@radix-ui/react-alert-dialog": "^1.1.1",
-    "@radix-ui/react-aspect-ratio": "^1.1.0",
     "@radix-ui/react-avatar": "^1.1.0",
     "@radix-ui/react-checkbox": "^1.1.1",
     "@radix-ui/react-collapsible": "^1.1.0",
-    "@radix-ui/react-context-menu": "^2.2.16",
     "@radix-ui/react-dialog": "^1.1.2",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-hover-card": "^1.1.15",
     "@radix-ui/react-label": "^2.1.0",
-    "@radix-ui/react-menubar": "^1.1.16",
-    "@radix-ui/react-navigation-menu": "^1.2.14",
     "@radix-ui/react-popover": "^1.1.15",
     "@radix-ui/react-progress": "^1.1.0",
     "@radix-ui/react-radio-group": "^1.2.0",
@@ -103,14 +86,15 @@
     "@radix-ui/react-toggle": "^1.1.0",
     "@radix-ui/react-toggle-group": "^1.1.0",
     "@radix-ui/react-tooltip": "^1.2.8",
+    "@scure/base": "^1.1.1",
+    "@scure/bip32": "^2.2.0",
     "@scure/bip39": "^1.6.0",
+    "@scure/btc-signer": "^2.2.0",
     "@sentry/react": "^10.42.0",
     "@tanstack/react-query": "^5.56.2",
     "@unhead/addons": "^2.1.13",
     "@unhead/react": "^2.1.13",
-    "bitcoinjs-lib": "^7.0.1",
     "blurhash": "^2.0.5",
-    "buffer": "^6.0.3",
     "capacitor-secure-storage-plugin": "^0.13.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -119,37 +103,28 @@
     "d3-scale": "^4.0.2",
     "date-fns": "^3.6.0",
     "dompurify": "^3.3.3",
-    "ecpair": "^3.0.1",
     "embla-carousel-react": "^8.3.0",
     "emoji-mart": "^5.6.0",
-    "fflate": "^0.8.2",
     "hls.js": "^1.6.15",
-    "html-to-image": "^1.11.13",
     "i18next": "^26.0.5",
     "i18next-browser-languagedetector": "^8.2.1",
     "idb": "^8.0.3",
-    "input-otp": "^1.2.4",
-    "iso-3166": "^4.4.0",
-    "leaflet": "^1.9.4",
     "lucide-react": "^1.8.0",
     "nostr-tools": "^2.13.0",
+    "qr-scanner": "^1.4.2",
     "qrcode": "^1.5.4",
     "react": "^19.2.4",
     "react-blurhash": "^0.3.0",
-    "react-day-picker": "^9.14.0",
     "react-dom": "^19.2.4",
     "react-easy-crop": "^5.5.6",
     "react-hook-form": "^7.71.1",
     "react-i18next": "^17.0.4",
     "react-intersection-observer": "^9.16.0",
-    "react-leaflet": "^4.2.1",
     "react-markdown": "^10.1.0",
-    "react-resizable-panels": "^2.1.3",
     "react-router-dom": "^6.26.2",
     "recharts": "^2.12.7",
     "rehype-sanitize": "^6.0.0",
     "slugify": "^1.6.8",
-    "smol-toml": "^1.6.0",
     "tailwind-merge": "^2.5.2",
     "tailwindcss-animate": "^1.0.7",
     "uri-templates": "^0.2.0",
@@ -169,19 +144,18 @@
     "@testing-library/react": "^16.3.2",
     "@types/d3-scale": "^4.0.9",
     "@types/dompurify": "^3.0.5",
-    "@types/leaflet": "^1.9.21",
     "@types/node": "^22.5.5",
     "@types/qrcode": "^1.5.5",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.1",
     "@webbtc/webln-types": "^3.0.0",
-    "@webxdc/types": "^2.1.2",
     "autoprefixer": "^10.4.20",
     "eslint": "^9.9.0",
     "eslint-plugin-react-hooks": "^5.1.0-rc.0",
     "eslint-plugin-react-refresh": "^0.4.9",
     "globals": "^15.9.0",
+    "iso-3166": "^4.4.0",
     "jsdom": "^26.1.0",
     "postcss": "^8.4.47",
     "rollup-plugin-visualizer": "^7.0.1",
@@ -189,7 +163,7 @@
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.0.1",
     "vite": "^8.0.3",
-    "vitest": "^3.1.4"
+    "vitest": "^4.1.8"
   },
   "overrides": {
     "react": "$react",

public/CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
 
+## [2.8.9] - 2026-06-02
+
+Adds an in-app prompt to grab the Android app from Zapstore, makes it easier to start or explore campaigns right from the home page, and irons out a batch of language and display fixes.
+
+### Added
+
+- A prompt to download the Android app from Zapstore, shown to mobile web visitors on the home page, in the account menu, and in the slide-out menu.
+- A "Start a campaign" button alongside "Browse all" in the middle of the home page.
+
+### Changed
+
+- The "Explore campaigns" button now appears for everyone, not just logged-out visitors.
+
+### Fixed
+
+- Switching languages now takes effect immediately instead of showing stale text.
+- The reply box and the replies heading on a post now show up in your chosen language.
+- Account balances keep their Latin numerals regardless of display language.
+- Filled in missing translations on the "Why Agora" screen.
+
+## [2.8.8] - 2026-06-02
+
+Fixes the app icon proportions and updates the loading splash to the Agora bolt.
+
+### Fixed
+
+- App icon no longer appears squashed.
+- Loading splash now shows the Agora bolt instead of the old logo.
+
+## [2.8.7] - 2026-06-02
+
+Fixes the top navigation bar rendering behind the status bar on Android.
+
+### Fixed
+
+- Top navigation bar now clears the system status bar on Android.
+
+## [2.8.6] - 2026-06-02
+
+Refreshes the app icon to the orange Agora bolt mark across Android, iOS, and the web.
+
+### Changed
+
+- Update the app icon to the current Agora bolt on a brand-orange background.
+
+## [2.8.5] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.4] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.3] - 2026-06-02
+
+A maintenance release that fixes the Android build so signed releases publish correctly. No user-facing changes.
+
+## [2.8.2] - 2026-06-02
+
+A maintenance release that fixes the Android build pipeline so signed releases publish correctly. No user-facing changes.
+
+## [2.8.1] - 2026-06-02
+
+Agora becomes a home for putting your money where your heart is. Launch and back fundraising campaigns, rally around organizations with their own events and pledges, and send support straight from a built-in Bitcoin and Lightning wallet. Explore the world through immersive country pages, chat with a new AI agent, and move through a faster, cleaner app with a fresh look throughout.
+
+### Added
+
+- Fundraising campaigns as the new home surface — create, edit, and back campaigns, set goals, add beneficiaries, and follow progress.
+- Organizations with their own events, pledges, members, and moderation tools.
+- Built-in wallet for sending Bitcoin and Lightning payments, with transaction history and balances shown in USD.
+- One-tap support: zap posts, profiles, campaigns, and organizations.
+- AI agent chat with a model selector, tool-calling, and slash commands.
+- Immersive country pages with anthems, flags, weather, and a country-scoped feed, plus a new Discover square for exploring the world.
+- Comments and reactions on campaigns, and donation receipts shown inline.
+
+### Changed
+
+- Refreshed Agora branding, navigation, and app icons throughout.
+- Streamlined onboarding with country and people follows.
+- Polished campaign, organization, and donation flows end to end.
+
+### Removed
+
+- Direct messaging and ephemeral geo chat.
+
 ## [1.0.0] - 2026-04-30
 
 ### Added

public/manifest.webmanifest

@@ -38,56 +38,6 @@
       "purpose": "any"
     }
   ],
-  "screenshots": [
-    {
-      "src": "https://blossom.ditto.pub/47fcb3bdc414ced245fbba53b0456d9bfdf112d711ecf5cc628361a47002392a.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/e387a4c4566545c650477cee66e638131eb874a90761cf0a371e5abf1e2c7af2.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/73585c9547868da215a91f8a13543251a20967a74f6e8329231544add50e3dee.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/4216d18d5854444c64b482dbbac9e077a453f85a9d72d91bc6adf89fd1f42c36.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/a7521e652d625c57cf66fd97ea92c66b8559bcedcb805aaf375bc047415625a3.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/daf008f146391f0172b89595500f640b84eac4e146b2e081db80791819443fa0.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/22c144a792e32559a838c8f69fbb4ae22264f47ff3d04341e656748d264064bc.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    },
-    {
-      "src": "https://blossom.ditto.pub/fa609e4a03e984063fbc6c474bd8a73bb088666b7c0e5561f993264f372c90ef.png",
-      "sizes": "1080x1920",
-      "type": "image/png",
-      "form_factor": "narrow"
-    }
-  ],
   "related_applications": [
     {
       "platform": "play",

public/theme.js

@@ -1,58 +1,33 @@
 // Reads the saved theme from localStorage and applies it to <html> and the
 // preloader background before first paint. Runs as a blocking <script> so
 // there's no flash of the wrong theme.
+//
+// Agora's colors are hardcoded in src/index.css via :root {} and .dark {}
+// blocks. There is no custom-theme branch; the only thing this script
+// does is set the right class on <html> and paint the preloader with the
+// matching background + primary color so the page doesn't flash white
+// in dark mode (or vice versa) before the React bundle boots.
+//
+// The colors below MUST stay in sync with the values in src/index.css.
 (function () {
-  // Builtin themes — must match builtinThemes in src/themes.ts
   var builtins = {
-    dark:  { bg: 'hsl(0 0% 10%)', primary: 'hsl(15 90% 52%)' },
-    light: { bg: 'hsl(0 0% 100%)', primary: 'hsl(15 90% 48%)' }
+    dark:  { bg: 'hsl(0 0% 10%)',  primary: 'hsl(24 100% 50%)' },
+    light: { bg: 'hsl(0 0% 100%)', primary: 'hsl(24 100% 50%)' }
   };
 
-  var theme = 'dark';
-  var colors = builtins.dark;
-  var cfg;
+  var theme = 'system';
   try {
-    cfg = JSON.parse(localStorage.getItem('nostr:app-config') || '{}');
-    if (cfg.theme) theme = cfg.theme;
+    var cfg = JSON.parse(localStorage.getItem('nostr:app-config') || '{}');
+    if (cfg.theme === 'dark' || cfg.theme === 'light' || cfg.theme === 'system') {
+      theme = cfg.theme;
+    }
   } catch (e) {}
 
-  // Resolve "system" to light or dark based on OS preference
   if (theme === 'system') {
     theme = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
   }
 
-  if (theme === 'custom') {
-    // Custom theme: read colors from customTheme.colors (ThemeConfig format)
-    try {
-      var ct = cfg && cfg.customTheme;
-      if (ct && ct.colors) {
-        var bg = ct.colors.background;
-        var pr = ct.colors.primary;
-        if (bg && pr) {
-          colors = { bg: 'hsl(' + bg + ')', primary: 'hsl(' + pr + ')' };
-        }
-      }
-    } catch (e) {}
-  } else if (theme === 'light' || theme === 'dark') {
-    // Check for configured theme overrides (ThemesConfig in cfg.themes)
-    try {
-      var themes = cfg && cfg.themes;
-      if (themes && themes[theme] && themes[theme].colors) {
-        var tc = themes[theme].colors;
-        if (tc.background && tc.primary) {
-          colors = { bg: 'hsl(' + tc.background + ')', primary: 'hsl(' + tc.primary + ')' };
-        } else {
-          colors = builtins[theme];
-        }
-      } else {
-        colors = builtins[theme];
-      }
-    } catch (e) {
-      colors = builtins[theme];
-    }
-  } else {
-    colors = builtins.dark;
-  }
+  var colors = builtins[theme] || builtins.dark;
 
   document.documentElement.className = theme;
   document.body.style.background = colors.bg;

scripts/derive_vectors.mjs

@@ -0,0 +1,50 @@
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { entropyToMnemonic, mnemonicToSeedSync } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+import { HDKey } from '@scure/bip32';
+import { bech32m, hex } from '@scure/base';
+import * as btc from '@scure/btc-signer';
+
+// Test vector 1: all-zero nsec
+const nsec1 = new Uint8Array(32);
+
+// Test vector 2: nsec from a deterministic source — all 0x01s
+const nsec2 = new Uint8Array(32).fill(0x01);
+
+// Test vector 3: an actual realistic nsec
+const nsec3 = hex.decode('67dea2ed018072d675f5415ecfaed7d2597555e202d85b3d65ea4e58d2d92ffa');
+
+function deriveAll(nsec, label) {
+  const entropy = hkdf(sha256, nsec, undefined, 'agora/v1', 32);
+  const mnemonic = entropyToMnemonic(entropy, wordlist);
+  const seed = mnemonicToSeedSync(mnemonic);
+  const root = HDKey.fromMasterSeed(seed);
+  const account = root.derive("m/86'/0'/0'");
+  const receive0 = account.deriveChild(0).deriveChild(0);
+  const xonly = receive0.publicKey.slice(1, 33);
+  const { address } = btc.p2tr(xonly, undefined, btc.NETWORK);
+
+  const spendNode = root.derive("m/352'/0'/0'/0'/0");
+  const scanNode = root.derive("m/352'/0'/0'/1'/0");
+  const spendPub = spendNode.publicKey;
+  const scanPub = scanNode.publicKey;
+  const payload = new Uint8Array(66);
+  payload.set(scanPub, 0);
+  payload.set(spendPub, 33);
+  const words = [0, ...bech32m.toWords(payload)];
+  const spAddress = bech32m.encode('sp', words, 1023);
+
+  console.log(`\n--- ${label} ---`);
+  console.log(`nsec hex:  ${hex.encode(nsec)}`);
+  console.log(`entropy:   ${hex.encode(entropy)}`);
+  console.log(`mnemonic:  ${mnemonic}`);
+  console.log(`seed:      ${hex.encode(seed)}`);
+  console.log(`xpub:      ${account.publicExtendedKey}`);
+  console.log(`addr 0/0:  ${address}`);
+  console.log(`sp addr:   ${spAddress}`);
+}
+
+deriveAll(nsec1, 'all-zero nsec');
+deriveAll(nsec2, 'all-0x01 nsec');
+deriveAll(nsec3, 'realistic nsec');

scripts/gen-subdivision-codes.mjs

@@ -0,0 +1,39 @@
+// Generate src/lib/subdivisionCodes.ts — the authoritative list of ISO 3166-2
+// subdivision codes, extracted from the `iso-3166` package.
+//
+// We ship only the code strings (~42 KB) instead of importing the full
+// `iso-3166` dataset (~244 KB of objects with names, parents, and tree
+// structure) into the critical-path bundle. The only thing the runtime needs
+// these for is validating that a `CC-XX` code is a real subdivision
+// (see src/lib/countries.ts `isValidSubdivisionCode`).
+//
+// Run with: node scripts/gen-subdivision-codes.mjs
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { iso31662 } from 'iso-3166';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, '..');
+const OUTPUT = path.join(REPO_ROOT, 'src/lib/subdivisionCodes.ts');
+
+const codes = [...new Set(iso31662.map((s) => s.code))].sort();
+
+const header = `// AUTO-GENERATED — do not edit by hand.
+//
+// The authoritative list of ISO 3166-2 subdivision codes, extracted from the
+// \`iso-3166\` package at build time. We ship only the code strings (~42 KB)
+// instead of importing the full \`iso-3166\` dataset (~244 KB of objects with
+// names, parents, and tree structure) into the critical-path bundle, since
+// the only thing the runtime needs these for is validating that a \`CC-XX\`
+// code is a real subdivision.
+//
+// Regenerate with: node scripts/gen-subdivision-codes.mjs
+
+`;
+
+const body = `export const SUBDIVISION_CODES: readonly string[] = ${JSON.stringify(codes)};\n`;
+
+fs.writeFileSync(OUTPUT, header + body);
+console.log(`Wrote ${path.relative(REPO_ROOT, OUTPUT)} (${codes.length} codes)`);

scripts/generate-favicons.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+# Regenerate the web tab favicon assets from public/logo.svg.
+#
+# Why this script exists:
+#   The 16x16 favicon edge antialiasing must survive small-size rendering.
+#   Saving as palette/indexed PNG or 8bpp ICO bakes the editor's background
+#   into the antialiased edge pixels, producing the "ugly outline" halo
+#   you see in browser tab strips. We render at high resolution, downsample
+#   with Lanczos, and force full 32-bit RGBA output.
+#
+# Outputs (overwrites in place):
+#   public/favicon-16.png       — 16x16 RGBA
+#   public/favicon-32.png       — 32x32 RGBA
+#   public/favicon.ico          — multi-size ICO, every frame 32bpp
+#   public/apple-touch-icon.png — 180x180 RGBA
+set -e
+
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+# Pick an SVG renderer (inkscape preferred, rsvg-convert fallback)
+if command -v inkscape &> /dev/null; then
+    SVG_RENDERER="inkscape"
+elif command -v rsvg-convert &> /dev/null; then
+    SVG_RENDERER="rsvg"
+else
+    echo -e "${YELLOW}Error: install inkscape or rsvg-convert.${NC}" >&2
+    exit 1
+fi
+
+# ImageMagick: v7 uses `magick`, v6 uses `convert`.
+if command -v magick &> /dev/null; then
+    MAGICK="magick"
+elif command -v convert &> /dev/null; then
+    MAGICK="convert"
+else
+    echo -e "${YELLOW}Error: install ImageMagick.${NC}" >&2
+    exit 1
+fi
+
+SOURCE_SVG="public/logo.svg"
+if [ ! -f "$SOURCE_SVG" ]; then
+    echo -e "${YELLOW}Error: $SOURCE_SVG not found.${NC}" >&2
+    exit 1
+fi
+
+# Agora brand orange. Keep in sync with the preloader / theme.
+LOGO_COLOR="#FF6600"
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+COLORED_SVG="$TMPDIR/logo_colored.svg"
+RAW_PNG="$TMPDIR/raw.png"
+MASTER_PNG="$TMPDIR/master.png"
+
+# Recolor the SVG's black fill to the brand color, on transparent background.
+sed 's/fill="black"/fill="'"$LOGO_COLOR"'"/g' "$SOURCE_SVG" > "$COLORED_SVG"
+
+# The SVG's viewBox is 720x880 (taller than wide). Render at its native
+# aspect ratio first so we don't squish the logo horizontally.
+MASTER_BOX=512        # final square canvas size
+MASTER_H=$MASTER_BOX  # render the longer side at full size
+MASTER_W=$(( MASTER_BOX * 720 / 880 ))  # preserve 720:880 aspect
+
+echo "Rendering ${MASTER_W}x${MASTER_H} from $SOURCE_SVG (preserving 720:880 aspect)..."
+if [ "$SVG_RENDERER" = "inkscape" ]; then
+    inkscape --export-type=png --export-filename="$RAW_PNG" \
+        -w "$MASTER_W" -h "$MASTER_H" --export-background-opacity=0 \
+        "$COLORED_SVG" 2>/dev/null
+else
+    rsvg-convert -w "$MASTER_W" -h "$MASTER_H" -b none "$COLORED_SVG" -o "$RAW_PNG"
+fi
+
+# Centre the rendered logo on a transparent square canvas so downstream
+# square targets (favicons, apple-touch-icon) don't restretch it.
+$MAGICK -size "${MASTER_BOX}x${MASTER_BOX}" "xc:none" \
+    "$RAW_PNG" -gravity center -compose over -composite \
+    "$MASTER_PNG"
+
+# Downsample to a target size with a quality filter, forcing RGBA output.
+# `png:color-type=6` is PNG RGBA (8 bits per channel, with alpha).
+# `-strip` removes metadata to keep files small.
+render_png() {
+    local size=$1
+    local dest=$2
+    $MAGICK "$MASTER_PNG" \
+        -filter Lanczos \
+        -resize "${size}x${size}" \
+        -background none -alpha on \
+        -define png:color-type=6 \
+        -strip \
+        "$dest"
+    echo -e "  ${GREEN}✓${NC} $dest ($(file -b "$dest" | head -c 80))"
+}
+
+echo "Generating PNG variants..."
+render_png 16 public/favicon-16.png
+render_png 32 public/favicon-32.png
+render_png 180 public/apple-touch-icon.png
+
+# Multi-size ICO. Building from the high-res master with auto-resize keeps
+# every frame 32bpp RGBA. Verified with `file public/favicon.ico`.
+echo "Generating multi-size favicon.ico (16, 32, 48)..."
+$MAGICK "$MASTER_PNG" \
+    -filter Lanczos \
+    -background none -alpha on \
+    -define icon:auto-resize=16,32,48 \
+    public/favicon.ico
+echo -e "  ${GREEN}✓${NC} public/favicon.ico ($(file -b public/favicon.ico | head -c 120))"
+
+echo -e "\n${GREEN}Favicons regenerated.${NC}"

scripts/generate-icons.sh

@@ -42,21 +42,28 @@ if [ ! -f "$SOURCE_SVG" ]; then
 fi
 
 # Brand colors
-BG_COLOR="#7c52e0"   # Ditto purple
+BG_COLOR="#e9673f"   # Agora orange (hsl(14 79% 58%))
 
 TMPDIR=$(mktemp -d)
 LOGO_WHITE_SVG="$TMPDIR/logo_white.svg"
 LOGO_WHITE="$TMPDIR/logo_white.png"
 
-# Recolor the SVG fill to white before rasterizing.
-sed 's/#7c52e0/#ffffff/g' "$SOURCE_SVG" > "$LOGO_WHITE_SVG"
+# Recolor the SVG fill to white before rasterizing. logo.svg declares the
+# glyph with fill="black", so recolor both the attribute form and any hex.
+sed -e 's/fill="black"/fill="#ffffff"/g' \
+    -e 's/#000000/#ffffff/g' \
+    -e 's/#7c52e0/#ffffff/g' "$SOURCE_SVG" > "$LOGO_WHITE_SVG"
 
-echo "Rendering white SVG at 512x512..."
+echo "Rendering white SVG (preserving aspect ratio)..."
 
+# Render at 1024px tall and let the renderer derive the width from the SVG
+# viewBox, so the non-square logo (720x880) is NOT stretched into a square.
+# The composite steps below use -resize WxH which fits-inside (aspect-
+# preserving), keeping the glyph's true proportions.
 if [ "$SVG_RENDERER" = "inkscape" ]; then
-    inkscape --export-type=png --export-filename="$LOGO_WHITE" -w 512 -h 512 "$LOGO_WHITE_SVG" 2>/dev/null
+    inkscape --export-type=png --export-filename="$LOGO_WHITE" -h 1024 "$LOGO_WHITE_SVG" 2>/dev/null
 else
-    rsvg-convert -w 512 -h 512 "$LOGO_WHITE_SVG" -o "$LOGO_WHITE"
+    rsvg-convert -h 1024 "$LOGO_WHITE_SVG" -o "$LOGO_WHITE"
 fi
 
 # ── Adaptive icon foreground PNGs (transparent bg, white logo, safe-zone padding) ──
@@ -82,23 +89,27 @@ make_foreground 192 android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foregrou
 
 # ── Legacy launcher icons (ic_launcher.png and ic_launcher_round.png) ──
 # These are used on pre-API-26 devices and as fallback on some launchers.
-# They must have the logo composited onto the purple background — NOT just
-# a solid color fill.
+# Both are the white logo composited onto an orange circle (brand mark).
 
 echo "Generating legacy launcher icons (ic_launcher.png and ic_launcher_round.png)..."
 
-# make_legacy_square: logo on flat purple square background
+# make_legacy_square: white logo on an orange circle (transparent corners)
 make_legacy_square() {
     local size=$1
     local content_size=$(echo "$size * 60 / 100" | bc)
     local dest=$2
+    local mask="$TMPDIR/circle_mask_sq_${size}.png"
+    $MAGICK -size "${size}x${size}" "xc:none" \
+        -fill white -draw "circle $((size/2)),$((size/2)) $((size/2)),0" \
+        "$mask"
     $MAGICK -size "${size}x${size}" "xc:${BG_COLOR}" \
+        "$mask" -compose dst-in -composite \
         \( "$LOGO_WHITE" -resize "${content_size}x${content_size}" \) \
         -gravity center -compose over -composite \
         "$dest"
 }
 
-# make_legacy_round: logo on circular purple background (alpha-masked circle)
+# make_legacy_round: white logo on circular orange background (alpha-masked circle)
 make_legacy_round() {
     local size=$1
     local content_size=$(echo "$size * 60 / 100" | bc)
@@ -108,7 +119,7 @@ make_legacy_round() {
     $MAGICK -size "${size}x${size}" "xc:none" \
         -fill white -draw "circle $((size/2)),$((size/2)) $((size/2)),0" \
         "$mask"
-    # Fill purple, apply circle mask, composite logo
+    # Fill orange, apply circle mask, composite logo
     $MAGICK -size "${size}x${size}" "xc:${BG_COLOR}" \
         "$mask" -compose dst-in -composite \
         \( "$LOGO_WHITE" -resize "${content_size}x${content_size}" \) \
@@ -134,11 +145,11 @@ mkdir -p android/app/src/main/res/values
 cat > "$BACKGROUND_COLOR_FILE" << 'EOF'
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <color name="ic_launcher_background">#7c52e0</color>
+    <color name="ic_launcher_background">#e9673f</color>
 </resources>
 EOF
 
-# ── iOS App Icon (1024x1024, white logo on purple background) ──
+# ── iOS App Icon (1024x1024, white logo on orange background) ──
 
 echo "Generating iOS app icon..."
 
@@ -146,7 +157,7 @@ IOS_ICON_DIR="ios/App/App/Assets.xcassets/AppIcon.appiconset"
 
 if [ -d "$IOS_ICON_DIR" ]; then
     IOS_ICON="$IOS_ICON_DIR/AppIcon-512@2x.png"
-    # Logo at ~60% of canvas, centered on purple background (matches legacy Android style)
+    # Logo at ~60% of canvas, centered on orange background (matches Android style)
     $MAGICK -size "1024x1024" "xc:${BG_COLOR}" \
         \( "$LOGO_WHITE" -resize "614x614" \) \
         -gravity center -compose over -composite \
@@ -160,7 +171,7 @@ fi
 rm -rf "$TMPDIR"
 
 echo -e "\n${GREEN}App icons generated successfully!${NC}"
-echo -e "Icon: white Ditto logo on ${GREEN}${BG_COLOR}${NC} (Ditto purple)"
+echo -e "Icon: white Agora logo on ${GREEN}${BG_COLOR}${NC} (Agora orange)"
 echo -e "Generated:"
 echo -e "  Android:"
 echo -e "    - ic_launcher_foreground.png (adaptive, all densities)"

src/App.tsx

@@ -15,9 +15,14 @@ import { SentryProvider } from "@/components/SentryProvider";
 
 
 import { TooltipProvider } from "@/components/ui/tooltip";
+import { useAppContext } from "@/hooks/useAppContext";
 import { useNsecPasteGuard } from "@/hooks/useNsecPasteGuard";
+import { useTor } from "@/hooks/useTor";
 import type { AppConfig } from "@/contexts/AppContext";
+import { AudioPlayerProvider } from "@/contexts/AudioPlayerContext";
 import { NWCProvider } from "@/contexts/NWCContext";
+import { OnboardingProvider } from "@/contexts/OnboardingProvider";
+import { HdWalletSpProvider } from "@/contexts/HdWalletSpProvider";
 import { BuildConfigSchema, type BuildConfig } from "@/lib/schemas";
 import { secureStorage } from "@/lib/secureStorage";
 import AppRouter from "./AppRouter";
@@ -42,8 +47,7 @@ const hardcodedConfig: AppConfig = {
   appId: "agora",
   shareOrigin: import.meta.env.VITE_SHARE_ORIGIN || undefined,
   homePage: "campaigns",
-  client: "naddr1qvzqqqru7cpzq7q6z5ns2hm5c8msyv83qwzxpxe52j8c4d4q5m92wsp9sflelkh9qqzkg6t5w3hswjl4yp",
-  magicMouse: false,
+  client: "naddr1qvzqqqru7cpzq7q6z5ns2hm5c8msyv83qwzxpxe52j8c4d4q5m92wsp9sflelkh9qqzkzem0wfssdl264k",
   theme: "system",
   useAppRelays: true,
   useUserRelays: false,
@@ -57,48 +61,46 @@ const hardcodedConfig: AppConfig = {
     feedIncludeReposts: true,
     feedIncludeGenericReposts: true,
     feedIncludeReactions: false,
-    feedIncludeZaps: false,
+    feedIncludeZaps: true,
     feedIncludeArticles: true,
     showArticles: true,
     showHighlights: true,
-    feedIncludeHighlights: false,
+    feedIncludeHighlights: true,
     showEvents: true,
     feedIncludeEvents: true,
-    showVines: true,
+    showVines: false,
     showPolls: true,
-    showTreasures: true,
-    showTreasureGeocaches: true,
-    showTreasureFoundLogs: true,
-    showColors: true,
+    showTreasures: false,
+    showTreasureGeocaches: false,
+    showTreasureFoundLogs: false,
+    showColors: false,
     showPeopleLists: true,
-    feedIncludeVines: true,
+    feedIncludeVines: false,
     feedIncludePolls: true,
-    feedIncludeTreasureGeocaches: true,
-    feedIncludeTreasureFoundLogs: true,
-    feedIncludeColors: true,
+    feedIncludeTreasureGeocaches: false,
+    feedIncludeTreasureFoundLogs: false,
+    feedIncludeColors: false,
     feedIncludePeopleLists: true,
-    showDecks: true,
-    feedIncludeDecks: true,
-    showWebxdc: true,
-    feedIncludeWebxdc: true,
+    showDecks: false,
+    feedIncludeDecks: false,
     showPhotos: true,
     feedIncludePhotos: true,
     showVideos: true,
     feedIncludeNormalVideos: true,
     feedIncludeShortVideos: true,
     feedIncludeVoiceMessages: true,
-    showEmojiPacks: true,
-    feedIncludeEmojiPacks: true,
-    showCustomEmojis: true,
-    showUserStatuses: true,
-    showMusic: true,
-    feedIncludeMusicTracks: true,
-    feedIncludeMusicPlaylists: true,
-    showPodcasts: true,
-    feedIncludePodcastEpisodes: true,
-    feedIncludePodcastTrailers: true,
-    showDevelopment: true,
-    feedIncludeDevelopment: true,
+    showEmojiPacks: false,
+    feedIncludeEmojiPacks: false,
+    showCustomEmojis: false,
+    showUserStatuses: false,
+    showMusic: false,
+    feedIncludeMusicTracks: false,
+    feedIncludeMusicPlaylists: false,
+    showPodcasts: false,
+    feedIncludePodcastEpisodes: false,
+    feedIncludePodcastTrailers: false,
+    showDevelopment: false,
+    feedIncludeDevelopment: false,
     showCommunities: true,
     feedIncludeCommunities: true,
     showBadges: true,
@@ -109,10 +111,10 @@ const hardcodedConfig: AppConfig = {
     feedIncludeProfileBadges: true,
     feedIncludeBadgeAwards: true,
     feedIncludeVanish: true,
-    showBirdstar: true,
-    feedIncludeBirdDetections: true,
-    feedIncludeBirdex: true,
-    feedIncludeConstellations: true,
+    showBirdstar: false,
+    feedIncludeBirdDetections: false,
+    feedIncludeBirdex: false,
+    feedIncludeConstellations: false,
     followsFeedShowReplies: true,
   },
   sidebarOrder: [
@@ -145,9 +147,17 @@ const hardcodedConfig: AppConfig = {
   savedFeeds: [],
   autoplayVideos: false,
   imageQuality: 'compressed',
+  imageProxy: 'https://wsrv.nl',
+  lowBandwidthMode: false,
+  torEnabled: false,
   curatorPubkey: '932614571afcbad4d17a191ee281e39eebbb41b93fac8fd87829622aeb112f4d',
-  sandboxDomain: 'iframe.diy',
-  esploraBaseUrl: 'https://mempool.space/api',
+  esploraApis: [
+    'https://mempool.emzy.de/api',
+    'https://mempool.space/api',
+    'https://blockstream.info/api',
+  ],
+  blockbookBaseUrl: 'https://btc.trezor.io',
+  bip352IndexerUrl: 'https://silentpayments.dev/blindbit/mainnet',
   sidebarWidgets: [
     { id: 'trends' },
     { id: 'hot-posts' },
@@ -157,6 +167,7 @@ const hardcodedConfig: AppConfig = {
   aiApiKey: '',
   aiModel: 'google/gemma-4-26b',
   aiSystemPrompt: '',
+  translateWorkerUrl: import.meta.env.VITE_TRANSLATE_WORKER_URL || '',
 };
 
 /**
@@ -186,6 +197,24 @@ const defaultConfig: AppConfig = {
   feedSettings: { ...hardcodedConfig.feedSettings, ...buildConfig.feedSettings },
 };
 
+/**
+ * Wraps NostrProvider with a key that changes when Tor routing changes, so the
+ * relay layer remounts: existing connections close and reopen under the new
+ * routing (direct ⇄ fail-closed Tor), and reconnect immediately once Tor is up
+ * rather than waiting out the relay reconnect backoff. No-op off Android (the
+ * key is always "direct").
+ */
+function RelayProvider({ children }: { children: React.ReactNode }) {
+  const { config } = useAppContext();
+  const { status } = useTor();
+  const key = !config.torEnabled
+    ? "direct"
+    : status === "connected"
+      ? "tor-connected"
+      : "tor-pending";
+  return <NostrProvider key={key}>{children}</NostrProvider>;
+}
+
 export function App() {
   useNsecPasteGuard();
 
@@ -197,17 +226,23 @@ export function App() {
           <PlausibleProvider>
             <QueryClientProvider client={queryClient}>
               <NostrLoginProvider storageKey="nostr:login" storage={secureStorage}>
-                <NostrProvider>
+                <RelayProvider>
                   <NostrSync />
                   <InitialSyncRunner />
                   <NativeNotifications />
 
                     <NWCProvider>
-                      <TooltipProvider>
-                        <AppRouter />
-                      </TooltipProvider>
+                      <OnboardingProvider>
+                        <TooltipProvider>
+                          <HdWalletSpProvider>
+                            <AudioPlayerProvider>
+                              <AppRouter />
+                            </AudioPlayerProvider>
+                          </HdWalletSpProvider>
+                        </TooltipProvider>
+                      </OnboardingProvider>
                   </NWCProvider>
-                </NostrProvider>
+                </RelayProvider>
               </NostrLoginProvider>
             </QueryClientProvider>
           </PlausibleProvider>

src/AppRouter.tsx

@@ -1,149 +1,68 @@
-import { lazy, Suspense, useState } from "react";
-import { BrowserRouter, Navigate, Route, Routes } from "react-router-dom";
-import { AudioNavigationGuard } from "@/components/AudioNavigationGuard";
-import { DeepLinkHandler } from "@/components/DeepLinkHandler";
-import { MinimizedAudioBar } from "@/components/MinimizedAudioBar";
-import { AudioPlayerProvider } from "@/contexts/AudioPlayerContext";
-import { sidebarItemIcon } from "@/lib/sidebarItems";
+import { lazy, Suspense } from "react";
+import { BrowserRouter, Link, Navigate, Outlet, Route, Routes } from "react-router-dom";
+import { useTranslation } from "react-i18next";
+import { Loader2 } from "lucide-react";
 import { Toaster } from "./components/ui/toaster";
-import { FundraiserLayout } from "./components/FundraiserLayout";
+import { TopNav } from "./components/TopNav";
+import { OnboardingGate } from "./components/OnboardingGate";
 import { ScrollToTop } from "./components/ScrollToTop";
 import { VersionCheck } from "./components/VersionCheck";
+import { MinimizedAudioBar } from "./components/MinimizedAudioBar";
+import { AudioNavigationGuard } from "./components/AudioNavigationGuard";
+import { TorStatusBanner } from "./components/TorStatusBanner";
 import { useCurrentUser } from "./hooks/useCurrentUser";
 import { useProfileUrl } from "./hooks/useProfileUrl";
-import { getExtraKindDef } from "./lib/extraKinds";
+import { cn } from "@/lib/utils";
+import { openUrl } from "@/lib/downloadFile";
 
 // Critical-path pages: eagerly loaded (landing + fallback)
 import Index from "./pages/Index";
 import NotFound from "./pages/NotFound";
-import MessagesPage from "./pages/Messages";
-
-// Lazy-loaded compose modal (pulls in emoji-mart ~620K)
-const ReplyComposeModal = lazy(() => import("@/components/ReplyComposeModal").then(m => ({ default: m.ReplyComposeModal })));
-
-// Lazy-loaded emoji pack dialog
-const EmojiPackDialog = lazy(() => import("@/components/EmojiPackDialog").then(m => ({ default: m.EmojiPackDialog })));
 
 // Campaigns: home + create. (Campaign detail is dispatched from NIP19Page
-// when an naddr resolves to kind 30223.) The campaigns list IS the homepage;
-// the configurable HomePage delegation from the Twitter-era app is gone.
+// when an naddr resolves to kind 33863.)
 const CampaignsPage = lazy(() => import("./pages/CampaignsPage").then(m => ({ default: m.CampaignsPage })));
 const CreateCampaignPage = lazy(() => import("./pages/CreateCampaignPage").then(m => ({ default: m.CreateCampaignPage })));
 const AllCampaignsPage = lazy(() => import("./pages/AllCampaignsPage").then(m => ({ default: m.AllCampaignsPage })));
+const CampaignListDetailPage = lazy(() => import("./pages/CampaignListDetailPage").then(m => ({ default: m.CampaignListDetailPage })));
 
 // All other pages: code-split via React.lazy
 const ActionsPage = lazy(() => import("./pages/ActionsPage"));
 const CreateActionPage = lazy(() => import("./pages/CreateActionPage").then(m => ({ default: m.CreateActionPage })));
 const AdvancedSettingsPage = lazy(() => import("./pages/AdvancedSettingsPage").then(m => ({ default: m.AdvancedSettingsPage })));
-const AIChatPage = lazy(() => import("./pages/AIChatPage").then(m => ({ default: m.AIChatPage })));
 const AppearanceSettingsPage = lazy(() => import("./pages/AppearanceSettingsPage").then(m => ({ default: m.AppearanceSettingsPage })));
-const ArchivePage = lazy(() => import("./pages/ArchivePage").then(m => ({ default: m.ArchivePage })));
-const ArticleEditorPage = lazy(() => import("./pages/ArticleEditorPage").then(m => ({ default: m.ArticleEditorPage })));
-const BadgesPage = lazy(() => import("./pages/BadgesPage").then(m => ({ default: m.BadgesPage })));
-const BlueskyPage = lazy(() => import("./pages/BlueskyPage").then(m => ({ default: m.BlueskyPage })));
-const BookmarksPage = lazy(() => import("./pages/BookmarksPage").then(m => ({ default: m.BookmarksPage })));
-const BooksPage = lazy(() => import("./pages/BooksPage").then(m => ({ default: m.BooksPage })));
 const ChangelogPage = lazy(() => import("./pages/ChangelogPage").then(m => ({ default: m.ChangelogPage })));
 const CommunitiesPage = lazy(() => import("./pages/CommunitiesPage").then(m => ({ default: m.CommunitiesPage })));
 const CreateCommunityPage = lazy(() => import("./pages/CreateCommunityPage").then(m => ({ default: m.CreateCommunityPage })));
 const CreateEventPage = lazy(() => import("./pages/CreateEventPage").then(m => ({ default: m.CreateEventPage })));
-const ContentPage = lazy(() => import("./pages/ContentPage").then(m => ({ default: m.ContentPage })));
-const ContentSettingsPage = lazy(() => import("./pages/ContentSettingsPage").then(m => ({ default: m.ContentSettingsPage })));
 const CSAEPolicyPage = lazy(() => import("./pages/CSAEPolicyPage").then(m => ({ default: m.CSAEPolicyPage })));
-const DiscoverPage = lazy(() => import("./pages/DiscoverPage").then(m => ({ default: m.DiscoverPage })));
-const DomainFeedPage = lazy(() => import("./pages/DomainFeedPage").then(m => ({ default: m.DomainFeedPage })));
-const EventsFeedPage = lazy(() => import("./pages/EventsFeedPage").then(m => ({ default: m.EventsFeedPage })));
 const ExternalContentPage = lazy(() => import("./pages/ExternalContentPage").then(m => ({ default: m.ExternalContentPage })));
 const GeotagPage = lazy(() => import("./pages/GeotagPage").then(m => ({ default: m.GeotagPage })));
 const HashtagPage = lazy(() => import("./pages/HashtagPage").then(m => ({ default: m.HashtagPage })));
-const HelpPage = lazy(() => import("./pages/HelpPage").then(m => ({ default: m.HelpPage })));
+const MyDashboardPage = lazy(() => import("./pages/MyDashboardPage").then(m => ({ default: m.MyDashboardPage })));
+const AboutPage = lazy(() => import("./pages/AboutPage").then(m => ({ default: m.AboutPage })));
 const DonorGuidePage = lazy(() => import("./pages/DonorGuidePage").then(m => ({ default: m.DonorGuidePage })));
-const ActivistGuidePage = lazy(() => import("./pages/ActivistGuidePage").then(m => ({ default: m.ActivistGuidePage })));
-const KindFeedPage = lazy(() => import("./pages/KindFeedPage").then(m => ({ default: m.KindFeedPage })));
-const LetterComposePage = lazy(() => import("./pages/LetterComposePage").then(m => ({ default: m.LetterComposePage })));
-const LetterPreferencesPage = lazy(() => import("./pages/LetterPreferencesPage").then(m => ({ default: m.LetterPreferencesPage })));
-const LettersPage = lazy(() => import("./pages/LettersPage").then(m => ({ default: m.LettersPage })));
-const MagicSettingsPage = lazy(() => import("./pages/MagicSettingsPage").then(m => ({ default: m.MagicSettingsPage })));
-const MusicPage = lazy(() => import("./pages/MusicPage").then(m => ({ default: m.MusicPage })));
+const RecipientGuidePage = lazy(() => import("./pages/RecipientGuidePage").then(m => ({ default: m.RecipientGuidePage })));
+const LanguageSettingsPage = lazy(() => import("./pages/LanguageSettingsPage").then(m => ({ default: m.LanguageSettingsPage })));
 const NetworkSettingsPage = lazy(() => import("./pages/NetworkSettingsPage").then(m => ({ default: m.NetworkSettingsPage })));
 const NIP19Page = lazy(() => import("./pages/NIP19Page").then(m => ({ default: m.NIP19Page })));
 const NotificationSettings = lazy(() => import("./pages/NotificationSettings").then(m => ({ default: m.NotificationSettings })));
 const NotificationsPage = lazy(() => import("./pages/NotificationsPage").then(m => ({ default: m.NotificationsPage })));
+const OrganizationsPage = lazy(() => import("./pages/OrganizationsPage").then(m => ({ default: m.OrganizationsPage })));
 const OrganizersPage = lazy(() => import("./pages/OrganizersPage").then(m => ({ default: m.OrganizersPage })));
 const EventDashboardPage = lazy(() => import("./pages/EventDashboardPage").then(m => ({ default: m.EventDashboardPage })));
-const PhotosFeedPage = lazy(() => import("./pages/PhotosFeedPage").then(m => ({ default: m.PhotosFeedPage })));
-const PodcastsFeedPage = lazy(() => import("./pages/PodcastsFeedPage").then(m => ({ default: m.PodcastsFeedPage })));
 const PrivacyPolicyPage = lazy(() => import("./pages/PrivacyPolicyPage").then(m => ({ default: m.PrivacyPolicyPage })));
 const ProfileSettings = lazy(() => import("./pages/ProfileSettings").then(m => ({ default: m.ProfileSettings })));
-const RelayPage = lazy(() => import("./pages/RelayPage").then(m => ({ default: m.RelayPage })));
 const SearchPage = lazy(() => import("./pages/SearchPage").then(m => ({ default: m.SearchPage })));
 const SettingsPage = lazy(() => import("./pages/SettingsPage").then(m => ({ default: m.SettingsPage })));
-const TreasuresPage = lazy(() => import("./pages/TreasuresPage").then(m => ({ default: m.TreasuresPage })));
-const TrendsPage = lazy(() => import("./pages/TrendsPage").then(m => ({ default: m.TrendsPage })));
-const UserListsPage = lazy(() => import("./pages/UserListsPage").then(m => ({ default: m.UserListsPage })));
-const VerifiedPage = lazy(() => import("./pages/VerifiedPage").then(m => ({ default: m.VerifiedPage })));
-const VideosFeedPage = lazy(() => import("./pages/VideosFeedPage").then(m => ({ default: m.VideosFeedPage })));
-const VinesFeedPage = lazy(() => import("./pages/VinesFeedPage").then(m => ({ default: m.VinesFeedPage })));
 const WalletPage = lazy(() => import("./pages/WalletPage").then(m => ({ default: m.WalletPage })));
+const WalletMigrateV1Page = lazy(() => import("./pages/WalletMigrateV1Page").then(m => ({ default: m.WalletMigrateV1Page })));
+const WalletDoubleTweakFixPage = lazy(() => import("./pages/WalletDoubleTweakFixPage").then(m => ({ default: m.WalletDoubleTweakFixPage })));
 const WalletRecoveryPage = lazy(() => import("./pages/WalletRecoveryPage").then(m => ({ default: m.WalletRecoveryPage })));
 const WalletSettingsPage = lazy(() => import("./pages/WalletSettingsPage").then(m => ({ default: m.WalletSettingsPage })));
-const WebxdcFeedPage = lazy(() => import("./pages/WebxdcFeedPage").then(m => ({ default: m.WebxdcFeedPage })));
-const WikipediaPage = lazy(() => import("./pages/WikipediaPage").then(m => ({ default: m.WikipediaPage })));
-const WorldPage = lazy(() => import("./pages/WorldPage").then(m => ({ default: m.WorldPage })));
-const FollowPage = lazy(() => import("./pages/FollowPage").then(m => ({ default: m.FollowPage })));
-const ReceivePage = lazy(() => import("./pages/ReceivePage").then(m => ({ default: m.ReceivePage })));
-const ClaimPage = lazy(() => import("./pages/ClaimPage").then(m => ({ default: m.ClaimPage })));
+const LegacyWalletRecoveryPage = lazy(() => import("./pages/LegacyWalletRecoveryPage").then(m => ({ default: m.LegacyWalletRecoveryPage })));
 const RemoteLoginSuccessPage = lazy(() => import("./pages/RemoteLoginSuccessPage").then(m => ({ default: m.RemoteLoginSuccessPage })));
 
-const pollsDef = getExtraKindDef("polls")!;
-const colorsDef = getExtraKindDef("colors")!;
-const packsDef = getExtraKindDef("packs")!;
-const articlesDef = getExtraKindDef("articles")!;
-const decksDef = getExtraKindDef("decks")!;
-const emojisDef = getExtraKindDef("emojis")!;
-const developmentDef = getExtraKindDef("development")!;
-const highlightsDef = getExtraKindDef("highlights")!;
-
-/** Polls feed page with a FAB that opens the compose modal (poll mode via + menu). */
-function PollsFeedPage() {
-  const [composeOpen, setComposeOpen] = useState(false);
-  return (
-    <>
-      <KindFeedPage
-        kind={pollsDef.kind}
-        title={pollsDef.label}
-        icon={sidebarItemIcon("polls", "size-5")}
-        onFabClick={() => setComposeOpen(true)}
-      />
-      {composeOpen && (
-        <Suspense fallback={null}>
-          <ReplyComposeModal open={composeOpen} onOpenChange={setComposeOpen} initialMode="poll" />
-        </Suspense>
-      )}
-    </>
-  );
-}
-
-/** Emoji feed page with a FAB that opens the emoji pack creation dialog. */
-function EmojiFeedPage() {
-  const [composeOpen, setComposeOpen] = useState(false);
-  return (
-    <>
-      <KindFeedPage
-        kind={emojisDef.kind}
-        title={emojisDef.label}
-        icon={sidebarItemIcon("emojis", "size-5")}
-        onFabClick={() => setComposeOpen(true)}
-      />
-      {composeOpen && (
-        <Suspense fallback={null}>
-          <EmojiPackDialog open={composeOpen} onOpenChange={setComposeOpen} />
-        </Suspense>
-      )}
-    </>
-  );
-}
-
 /** Redirects /profile to the user's canonical profile URL (nip05 or npub). */
 function ProfileRedirect() {
   const { user, metadata } = useCurrentUser();
@@ -152,187 +71,176 @@ function ProfileRedirect() {
   return <Navigate to={profileUrl} replace />;
 }
 
+function PageSkeleton() {
+  // Shown briefly while a route's lazy chunk is being fetched. A skeleton
+  // tuned to one page's shape (`max-w-6xl` with hero + paragraph blocks)
+  // ends up wrong-shaped on every other page — narrow settings pages,
+  // small wallet screens, etc. A neutral centered spinner is honest about
+  // "loading" without misleading the eye with content-shaped boxes that
+  // never appear.
+  return (
+    <div className="flex items-center justify-center py-24">
+      <Loader2 className="size-6 animate-spin text-muted-foreground" />
+    </div>
+  );
+}
+
+function SiteFooter() {
+  const { t } = useTranslation();
+  return (
+    <footer className="bg-background mt-auto pt-6 sm:pt-12">
+      <div className="mx-auto max-w-7xl px-4 sm:px-6 py-8 flex flex-col sm:flex-row items-center justify-between gap-4 text-xs text-muted-foreground">
+        <button
+          type="button"
+          onClick={() => void openUrl("https://gitlab.com/soapbox-pub/agora")}
+          className="hover:text-foreground motion-safe:transition-colors"
+        >
+          {t('nav.sourceCode')}
+        </button>
+        <nav className="flex items-center gap-5">
+          <Link to="/about" className="hover:text-foreground motion-safe:transition-colors">{t('nav.about')}</Link>
+          <Link to="/verify" className="hover:text-foreground motion-safe:transition-colors">{t('nav.verify')}</Link>
+          <Link to="/privacy" className="hover:text-foreground motion-safe:transition-colors">{t('nav.privacy')}</Link>
+          <Link to="/safety" className="hover:text-foreground motion-safe:transition-colors">{t('nav.safety')}</Link>
+          <Link to="/changelog" className="hover:text-foreground motion-safe:transition-colors">{t('nav.changelog')}</Link>
+        </nav>
+      </div>
+    </footer>
+  );
+}
+
+/**
+ * Persistent app shell. GoFundMe-style top-nav-only chrome wrapping the route
+ * outlet. The width of the center column is decided by the layout variant
+ * picked in the route tree below — narrow (default, `max-w-3xl`) for
+ * form/prose-style pages, wide (full width) for landing / dashboard / detail
+ * pages that render their own internal layout.
+ */
+function FundraiserLayout({ narrow }: { narrow: boolean }) {
+  return (
+    <div className="min-h-dvh flex flex-col bg-background">
+      <TopNav />
+      <Suspense fallback={<PageSkeleton />}>
+        <div
+          className={cn("flex-1 min-w-0 w-full mx-auto", narrow && "max-w-3xl")}
+        >
+          <Outlet />
+        </div>
+      </Suspense>
+      <SiteFooter />
+    </div>
+  );
+}
+
 export function AppRouter() {
   return (
-    <AudioPlayerProvider>
-      <BrowserRouter>
-        <Toaster />
-        <VersionCheck />
-        <MinimizedAudioBar />
-        <AudioNavigationGuard />
-        <DeepLinkHandler />
-        <ScrollToTop />
+    <BrowserRouter>
+      <Toaster />
+      <VersionCheck />
+      <ScrollToTop />
+      <AudioNavigationGuard />
+      <MinimizedAudioBar />
+      {/* App-wide Tor status banner. Must live inside BrowserRouter — it
+          renders a <Link> to the Tor settings, which needs Router context. */}
+      <TorStatusBanner />
+      <OnboardingGate>
         <Routes>
-          {/* Auto-follow deep link: fullscreen immersive (no sidebars/nav) */}
-          <Route path="/follow/:npub" element={<FollowPage />} />
-          <Route path="/receive" element={<ReceivePage />} />
-          <Route path="/claim" element={<ClaimPage />} />
+        {/* Narrow layout — `max-w-3xl` center column. The default for
+            form/prose-style pages. */}
+        <Route element={<FundraiserLayout narrow />}>
+          <Route path="/feed" element={<Index />} />
+          <Route path="/my-dashboard" element={<MyDashboardPage />} />
+          <Route path="/notifications" element={<NotificationsPage />} />
+          <Route path="/search" element={<SearchPage />} />
+          <Route path="/profile" element={<ProfileRedirect />} />
+          <Route path="/t/:tag" element={<HashtagPage />} />
+          <Route path="/g/:geohash" element={<GeotagPage />} />
+          <Route path="/settings" element={<SettingsPage />} />
+          <Route path="/settings/appearance" element={<AppearanceSettingsPage />} />
+          <Route path="/settings/language" element={<LanguageSettingsPage />} />
+          <Route path="/settings/profile" element={<ProfileSettings />} />
+          <Route path="/settings/wallet" element={<WalletSettingsPage />} />
+          <Route path="/settings/notifications" element={<NotificationSettings />} />
+          <Route path="/settings/advanced" element={<AdvancedSettingsPage />} />
+          <Route path="/settings/network" element={<NetworkSettingsPage />} />
+          <Route path="/wallet" element={<WalletPage />} />
+          <Route path="/wallet/legacy" element={<LegacyWalletRecoveryPage />} />
+          {/* Old nested paths kept as redirects so any existing links / muscle
+              memory still land on the right page. `/wallet/settings` was an
+              intermediate hub that has been replaced by an overflow menu on
+              `/wallet`, so it redirects to the wallet home. `/wallet/backup`
+              is now an in-page dialog opened from that menu, so it also
+              redirects home. */}
+          <Route path="/wallet/settings" element={<Navigate to="/wallet" replace />} />
+          <Route path="/wallet/backup" element={<Navigate to="/wallet" replace />} />
+          <Route path="/wallet/settings/backup" element={<Navigate to="/wallet" replace />} />
+          <Route path="/wallet/settings/legacy" element={<Navigate to="/wallet/legacy" replace />} />
+          <Route path="/wallet/recovery" element={<WalletRecoveryPage />} />
+          <Route path="/wallet/migrate-v1" element={<WalletMigrateV1Page />} />
+          <Route path="/wallet/double-tweak-fix" element={<WalletDoubleTweakFixPage />} />
+          <Route path="/bitcoin" element={<Navigate to="/wallet" replace />} />
+          {/* Legacy /help routes redirect to /about so existing links keep
+              working. The About page and the two guides themselves live
+              under the wide layout below. */}
+          <Route path="/help" element={<Navigate to="/about" replace />} />
+          <Route path="/help/donors" element={<Navigate to="/about/donors" replace />} />
+          <Route path="/help/activists" element={<Navigate to="/about/recipients" replace />} />
+          <Route path="/help/recipients" element={<Navigate to="/about/recipients" replace />} />
+          <Route path="/privacy" element={<PrivacyPolicyPage />} />
+          <Route path="/safety" element={<CSAEPolicyPage />} />
+          <Route path="/changelog" element={<ChangelogPage />} />
+          <Route path="/organizers" element={<OrganizersPage />} />
+          {/* `/settings/verifier` moved to the public `/verify` onboarding
+              page. Keep the old path as a redirect so existing links resolve. */}
+          <Route path="/settings/verifier" element={<Navigate to="/verify" replace />} />
+          {/* Callback target for remote signers (e.g. Amber, Primal) after NIP-46 approval */}
+          <Route path="/remoteloginsuccess" element={<RemoteLoginSuccessPage />} />
+        </Route>
 
-          {/* All routes share the persistent FundraiserLayout (top nav + footer) */}
-          <Route element={<FundraiserLayout />}>
-            <Route path="/" element={<CampaignsPage />} />
-            <Route path="/discover" element={<DiscoverPage />} />
-            <Route path="/feed" element={<Index />} />
-            <Route path="/campaigns" element={<Navigate to="/" replace />} />
-            <Route path="/campaigns/new" element={<CreateCampaignPage />} />
-            <Route path="/campaigns/all" element={<AllCampaignsPage />} />
-            <Route path="/notifications" element={<NotificationsPage />} />
-            <Route path="/messages" element={<MessagesPage />} />
-            <Route path="/search" element={<SearchPage />} />
-            <Route path="/trends" element={<TrendsPage />} />
-            <Route path="/profile" element={<ProfileRedirect />} />
-             <Route path="/t/:tag" element={<HashtagPage />} />
-             <Route path="/g/:geohash" element={<GeotagPage />} />
-            <Route path="/feed/:domain" element={<DomainFeedPage />} />
-            <Route path="/settings" element={<SettingsPage />} />
-            <Route path="/settings/appearance" element={<AppearanceSettingsPage />} />
-            <Route path="/settings/profile" element={<ProfileSettings />} />
-            <Route path="/settings/feed" element={<ContentSettingsPage />} />
-            <Route path="/settings/content" element={<ContentPage />} />
-            <Route path="/settings/wallet" element={<WalletSettingsPage />} />
-            <Route
-              path="/settings/notifications"
-              element={<NotificationSettings />}
-            />
-            <Route
-              path="/settings/advanced"
-              element={<AdvancedSettingsPage />}
-            />
-            <Route path="/settings/magic" element={<MagicSettingsPage />} />
-            <Route path="/settings/network" element={<NetworkSettingsPage />} />
-            <Route path="/lists" element={<UserListsPage />} />
-            <Route path="/events" element={<EventsFeedPage />} />
-            <Route path="/events/new" element={<CreateEventPage />} />
-            <Route path="/photos" element={<PhotosFeedPage />} />
-            <Route path="/videos" element={<VideosFeedPage />} />
-            {/* /streams redirects to /videos for backward compatibility */}
-            <Route
-              path="/streams"
-              element={<Navigate to="/videos" replace />}
-            />
-            <Route path="/vines" element={<VinesFeedPage />} />
-            <Route path="/music" element={<MusicPage />} />
-            <Route path="/podcasts" element={<PodcastsFeedPage />} />
-            <Route path="/polls" element={<PollsFeedPage />} />
-            <Route path="/treasures" element={<TreasuresPage />} />
-            <Route
-              path="/colors"
-              element={
-                <KindFeedPage
-                  kind={colorsDef.kind}
-                  title={colorsDef.label}
-                  icon={sidebarItemIcon("colors", "size-5")}
-                />
-              }
-            />
-            <Route
-              path="/packs"
-              element={
-                <KindFeedPage
-                  kind={packsDef.kind}
-                  title={packsDef.label}
-                  icon={sidebarItemIcon("packs", "size-5")}
-                />
-              }
-            />
-            <Route path="/webxdc" element={<WebxdcFeedPage />} />
-            <Route path="/articles/new" element={<ArticleEditorPage />} />
-            <Route path="/articles/edit/:naddr" element={<ArticleEditorPage />} />
-            <Route
-              path="/articles"
-              element={
-                <KindFeedPage
-                  kind={articlesDef.kind}
-                  title={articlesDef.label}
-                  icon={sidebarItemIcon("articles", "size-5")}
-                  fabHref="/articles/new"
-                />
-              }
-            />
-            <Route
-              path="/highlights"
-              element={
-                <KindFeedPage
-                  kind={highlightsDef.kind}
-                  title={highlightsDef.label}
-                  icon={sidebarItemIcon("highlights", "size-5")}
-                  showFAB={false}
-                />
-              }
-            />
-            <Route
-              path="/decks"
-              element={
-                <KindFeedPage
-                  kind={decksDef.kind}
-                  title={decksDef.label}
-                  icon={sidebarItemIcon("decks", "size-5")}
-                />
-              }
-            />
-            <Route path="/emojis" element={<EmojiFeedPage />} />
-            <Route
-              path="/development"
-              element={
-                <KindFeedPage
-                  kind={[
-                    developmentDef.kind,
-                    ...(developmentDef.extraFeedKinds ?? []),
-                  ]}
-                  title={developmentDef.label}
-                  icon={sidebarItemIcon("development", "size-5")}
-                  showFAB={false}
-                />
-              }
-            />
-            <Route path="/wallet" element={<WalletPage />} />
-            <Route path="/wallet/recovery" element={<WalletRecoveryPage />} />
-            <Route path="/bitcoin" element={<Navigate to="/wallet" replace />} />
-            <Route path="/bookmarks" element={<BookmarksPage />} />
-            <Route path="/ai-chat" element={<AIChatPage />} />
-            <Route path="/verified" element={<VerifiedPage />} />
-            <Route path="/world" element={<WorldPage />} />
-            <Route path="/badges" element={<BadgesPage />} />
-            <Route path="/books" element={<BooksPage />} />
-            <Route path="/archive" element={<ArchivePage />} />
-            <Route path="/bluesky" element={<BlueskyPage />} />
-            <Route path="/wikipedia" element={<WikipediaPage />} />
-            <Route path="/communities" element={<CommunitiesPage />} />
-            <Route path="/communities/new" element={<CreateCommunityPage />} />
-            <Route path="/letters" element={<LettersPage />} />
-            <Route path="/letters/compose" element={<LetterComposePage />} />
-            <Route path="/settings/letters" element={<LetterPreferencesPage />} />
-            <Route path="/help" element={<HelpPage />} />
-            <Route path="/help/donors" element={<DonorGuidePage />} />
-            <Route path="/help/activists" element={<ActivistGuidePage />} />
-            <Route path="/privacy" element={<PrivacyPolicyPage />} />
-            <Route path="/safety" element={<CSAEPolicyPage />} />
-            <Route path="/changelog" element={<ChangelogPage />} />
-            <Route path="/r/*" element={<RelayPage />} />
-            <Route
-              path="/settings/lists"
-              element={<Navigate to="/lists" replace />}
-            />
-            <Route path="/i/*" element={<ExternalContentPage />} />
-            <Route path="/actions" element={<ActionsPage />} />
-            <Route path="/actions/new" element={<CreateActionPage />} />
-            <Route path="/pledges" element={<ActionsPage />} />
-            <Route path="/pledges/new" element={<CreateActionPage />} />
-            <Route path="/agent" element={<AIChatPage />} />
-            <Route path="/organizers" element={<OrganizersPage />} />
-            <Route path="/dashboard" element={<EventDashboardPage />} />
-            <Route path="/event-dashboard" element={<Navigate to="/dashboard" replace />} />
-
-            {/* Callback target for remote signers (e.g. Amber, Primal) after NIP-46 approval */}
-            <Route path="/remoteloginsuccess" element={<RemoteLoginSuccessPage />} />
-            {/* NIP-19 route for npub1, note1, naddr1, nevent1, nprofile1 */}
-            <Route path="/:nip19" element={<NIP19Page />} />
-            {/* ADD ALL CUSTOM ROUTES ABOVE THE CATCH-ALL "*" ROUTE */}
-            <Route path="*" element={<NotFound />} />
-          </Route>
+        {/* Wide layout — no max-width on the center column. Used by landing /
+            list / detail pages that render their own internal width
+            constraints. */}
+        <Route element={<FundraiserLayout narrow={false} />}>
+          <Route path="/" element={<CampaignsPage />} />
+          <Route path="/campaigns" element={<AllCampaignsPage />} />
+          <Route path="/campaigns/new" element={<CreateCampaignPage />} />
+          <Route path="/campaigns/lists/:slug" element={<CampaignListDetailPage />} />
+          {/* Legacy URL: the all-campaigns directory lived at
+              `/campaigns/all` for a while. Keep it as a redirect so
+              external links and bookmarks still resolve. */}
+          <Route path="/campaigns/all" element={<Navigate to="/campaigns" replace />} />
+          <Route path="/groups" element={<CommunitiesPage />} />
+          <Route path="/groups/new" element={<CreateCommunityPage />} />
+          <Route path="/events/new" element={<CreateEventPage />} />
+          <Route path="/pledges" element={<ActionsPage />} />
+          <Route path="/pledges/new" element={<CreateActionPage />} />
+          <Route path="/dashboard" element={<EventDashboardPage />} />
+          <Route path="/i/*" element={<ExternalContentPage />} />
+          {/* About page + Donor / Recipient guides. Full-bleed landing-style
+              layouts that render their own internal max-widths. */}
+          <Route path="/about" element={<AboutPage />} />
+          <Route path="/about/donors" element={<DonorGuidePage />} />
+          <Route path="/about/recipients" element={<RecipientGuidePage />} />
+          {/* Verification onboarding / marketing page. Wide layout so the
+              hero and section backgrounds can span the viewport like /about. */}
+          <Route path="/verify" element={<OrganizationsPage />} />
+          <Route path="/organizations" element={<Navigate to="/verify" replace />} />
+          {/* Legacy URL: the recipient guide lived at `/about/activists`
+              before the "activist" → "recipient" copy change. Redirect so
+              external links and bookmarks still resolve. */}
+          <Route path="/about/activists" element={<Navigate to="/about/recipients" replace />} />
+          {/* NIP-19 route for npub1, note1, naddr1, nevent1, nprofile1.
+              Goes through the wide layout because the dispatch may resolve to
+              a profile, campaign, action, or community page — all of which
+              render their own internal layout. PostDetailPage / ListDetailPage
+              also work edge-to-edge. */}
+          <Route path="/:nip19" element={<NIP19Page />} />
+          {/* ADD ALL CUSTOM ROUTES ABOVE THE CATCH-ALL "*" ROUTE */}
+          <Route path="*" element={<NotFound />} />
+        </Route>
         </Routes>
-      </BrowserRouter>
-    </AudioPlayerProvider>
+      </OnboardingGate>
+    </BrowserRouter>
   );
 }
 export default AppRouter;

src/components/AcceptBadgeButton.tsx

@@ -8,7 +8,7 @@ import { useProfileBadges } from '@/hooks/useProfileBadges';
 import { BADGE_DEFINITION_KIND } from '@/lib/badgeUtils';
 import { cn } from '@/lib/utils';
 
-export interface AcceptBadgeButtonProps {
+interface AcceptBadgeButtonProps {
   /** The kind 8 badge award event. */
   awardEvent: NostrEvent;
   /** Prominent pill style (large, rounded-full, colored). Otherwise compact outline variant. */

src/components/ActionShareMenu.tsx

@@ -0,0 +1,193 @@
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { useQueryClient } from '@tanstack/react-query';
+import { nip19 } from 'nostr-tools';
+import {
+  Check,
+  Link as LinkIcon,
+  Loader2,
+  MoreHorizontal,
+  Trash2,
+} from 'lucide-react';
+
+import { Button } from '@/components/ui/button';
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu';
+import { ModerationMenuItems } from '@/components/moderation';
+import { useCampaignModerators } from '@/hooks/useCampaignModerators';
+import { useCurrentUser } from '@/hooks/useCurrentUser';
+import { useNostrPublish } from '@/hooks/useNostrPublish';
+import { useShareOrigin } from '@/hooks/useShareOrigin';
+import { useToast } from '@/hooks/useToast';
+import { getPledgeCoord } from '@/lib/pledges';
+import type { Action } from '@/hooks/useActions';
+
+/**
+ * Per-card kebab menu for pledges. Surfaces:
+ *   • Delete (owner only) — NIP-09 with both `e` and `a` tags so
+ *     relays that ignore a-tag-only deletions still drop the event.
+ *   • Copy link — naddr1 URL on the current share origin.
+ *   • Moderation actions (mods only) — hide / feature, under a
+ *     separator that only renders when the viewer is a moderator.
+ *
+ * Lives outside `ActionsPage` so both the page and the reusable
+ * `PledgesDiscoverySection` can pin it to the card's `topRight` slot
+ * without duplicating the logic.
+ */
+export function ActionShareMenu({
+  action,
+  displayTitle,
+}: {
+  action: Action;
+  displayTitle: string;
+}) {
+  const { t } = useTranslation();
+  const { user } = useCurrentUser();
+  const { data: moderators } = useCampaignModerators();
+  const { mutateAsync: createEvent } = useNostrPublish();
+  const { toast } = useToast();
+  const shareOrigin = useShareOrigin();
+  const queryClient = useQueryClient();
+  const [copied, setCopied] = useState(false);
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const isOwner = user?.pubkey === action.pubkey;
+  // Moderator gate is identical to the one in `ModerationMenuItems`,
+  // duplicated here so we can decide whether to render the trailing
+  // separator that introduces the moderator section.
+  // `ModerationMenuItems` returns `null` for non-mods, so without
+  // this check we'd render an orphaned separator at the bottom of
+  // the dropdown.
+  const isMod = !!user && !!moderators && moderators.includes(user.pubkey);
+
+  const naddr = nip19.naddrEncode({
+    kind: 36639,
+    pubkey: action.pubkey,
+    identifier: action.id,
+  });
+
+  const actionUrl = `${shareOrigin}/${naddr}`;
+
+  const handleCopyLink = async () => {
+    try {
+      await navigator.clipboard.writeText(actionUrl);
+      setCopied(true);
+      toast({ title: t('pledges.card.linkCopied') });
+      setTimeout(() => setCopied(false), 2000);
+    } catch (error) {
+      console.error('Failed to copy link:', error);
+      toast({ title: t('pledges.card.linkCopyFailed'), variant: 'destructive' });
+    }
+  };
+
+  const handleDelete = async (e: React.MouseEvent) => {
+    e.preventDefault();
+    e.stopPropagation();
+    if (!user || !isOwner) return;
+
+    const confirmed = window.confirm(t('pledges.card.confirmDelete'));
+    if (!confirmed) return;
+
+    setIsDeleting(true);
+    try {
+      // NIP-09 deletion. Include both 'e' and 'a' tags — some relays don't
+      // honour a-tag-only deletions for addressable events.
+      await createEvent({
+        kind: 5,
+        content: t('pledges.card.deletedContent'),
+        tags: [
+          ['e', action.event.id],
+          ['a', getPledgeCoord(action)],
+        ],
+      });
+      // Extract any organization `A` tag the pledge was associated with so
+      // the org's activity shelf and community feeds refresh too.
+      const orgATag = action.event.tags.find(([n]) => n === 'A')?.[1];
+      await Promise.all([
+        queryClient.invalidateQueries({ queryKey: ['agora-actions'] }),
+        queryClient.invalidateQueries({ queryKey: ['agora-action'] }),
+        ...(orgATag
+          ? [
+              queryClient.invalidateQueries({
+                queryKey: ['organization-activity', orgATag],
+              }),
+              queryClient.invalidateQueries({
+                queryKey: ['community-actions', orgATag],
+              }),
+              queryClient.invalidateQueries({
+                predicate: (q) => {
+                  const [root, aTagsKey] = q.queryKey;
+                  return (
+                    root === 'community-activity-feed' &&
+                    typeof aTagsKey === 'string' &&
+                    aTagsKey.split(',').includes(orgATag)
+                  );
+                },
+              }),
+            ]
+          : []),
+      ]);
+      toast({ title: t('pledges.card.deleted') });
+    } catch (error) {
+      console.error('Failed to delete pledge:', error);
+      toast({ title: t('pledges.card.deleteFailed'), variant: 'destructive' });
+    } finally {
+      setIsDeleting(false);
+    }
+  };
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger asChild onClick={(e) => e.preventDefault()}>
+        <Button
+          variant="ghost"
+          size="icon"
+          aria-label={t('pledges.card.actionsAriaLabel')}
+          className="h-8 w-8 bg-background/80 backdrop-blur text-muted-foreground hover:text-foreground"
+        >
+          <MoreHorizontal className="h-4 w-4" />
+        </Button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" onClick={(e) => e.stopPropagation()}>
+        {isOwner && (
+          <>
+            <DropdownMenuItem onClick={handleDelete} disabled={isDeleting}>
+              {isDeleting ? (
+                <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+              ) : (
+                <Trash2 className="h-4 w-4 mr-2" />
+              )}
+              {t('pledges.card.deletePledge')}
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+          </>
+        )}
+        <DropdownMenuItem onClick={handleCopyLink}>
+          {copied ? (
+            <Check className="h-4 w-4 mr-2 text-primary" />
+          ) : (
+            <LinkIcon className="h-4 w-4 mr-2" />
+          )}
+          {t('pledges.card.copyLink')}
+        </DropdownMenuItem>
+        {/* Moderator actions appear under a separator when the viewer
+            is a Team Soapbox moderator. `ModerationMenuItems` returns
+            null for non-mods, so we gate the trailing separator on
+            the same `isMod` check to avoid an orphan separator at
+            the bottom of non-mod dropdowns. */}
+        {isMod && <DropdownMenuSeparator />}
+        <ModerationMenuItems
+          coord={getPledgeCoord(action)}
+          entityTitle={displayTitle}
+          surface="pledge"
+          axes={['hide', 'featured']}
+        />
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}

src/components/AddMembersDialog.tsx

@@ -126,7 +126,7 @@ export function AddMembersDialog({ open, onOpenChange, listId, listPubkeys }: Ad
         <div ref={listRef} className="overflow-y-auto flex-1">
           {!query.trim() ? (
             <div className="py-12 text-center text-muted-foreground text-sm">
-              <UserPlus className="size-8 mx-auto mb-2 opacity-50" />
+              <UserPlus className="size-8 mx-auto mb-2" />
               Search for people to add to this list.
             </div>
           ) : isLoading && !searchResults ? (

src/components/AddToListDialog.tsx

@@ -143,7 +143,7 @@ export function AddToListDialog({ pubkey, displayName, open, onOpenChange }: Add
             </div>
           ) : !hasAny ? (
             <div className="py-8 px-4 text-center text-sm text-muted-foreground">
-              <List className="size-8 mx-auto mb-2 text-muted-foreground/40" />
+              <List className="size-8 mx-auto mb-2 text-muted-foreground" />
               No lists or packs yet. Create one below.
             </div>
           ) : (