flowchart TD
    START([User Opens App]) --> CHECK{Has stored accounts?}
    CHECK -->|No| GOOGLE[Google Sign-In Button]
    CHECK -->|Yes| ACCOUNTS[Account Selector Screen]

    GOOGLE --> OAUTH[Google OAuth Consent]
    OAUTH --> TOKEN[Receive id_token]
    TOKEN --> SETUP[AuthService.login - Setup Device Keys]
    SETUP --> DBINIT["Open/Create Encrypted SQLite DB\n(keyed by BIP39 mnemonic)"]
    DBINIT --> WSCONN[Connect WebSocket]
    WSCONN --> AUTH["Send AUTH {token, publicKey}"]
    AUTH --> VERIFY[Server Validates Token]
    VERIFY --> SUCCESS{Valid?}

    SUCCESS -->|Yes| AUTHSUCCESS["AUTH_SUCCESS {email, sessionToken}"]
    SUCCESS -->|No| ERROR[Show Error]
    ERROR --> GOOGLE

    AUTHSUCCESS --> SAVETOKEN[Save session token to SafeStorage]
    SAVETOKEN --> SESSLIST[Receive SESSION_LIST]
    SESSLIST --> PENDINGREQ[Receive PENDING_REQUESTS]
    PENDINGREQ --> HOME([Home Screen])

    ACCOUNTS --> LOCK[App Lock PIN Screen]
    LOCK -->|Correct PIN| PHASE1["switchAccountLocal - Unlock DB"]
    PHASE1 --> HOME2([Home Screen - Immediately Visible])
    HOME2 --> BGCONN["switchAccountConnect - Connect WS in background"]

    style START fill:#4CAF50,color:#fff
    style HOME fill:#4CAF50,color:#fff
    style HOME2 fill:#4CAF50,color:#fff
    style ERROR fill:#f44336,color:#fff

flowchart TD
    USER[User Clicks Lock] --> LOCK["ChatClient.lockSession()"]
    LOCK --> CLEAR["Clear: authToken, userEmail,\nidentityKeyPair in memory"]
    CLEAR --> DISC[Disconnect WebSocket]
    DISC --> EMIT["emit('auth_error', {isManualLogout: true})"]
    EMIT --> SELECTOR[Account Selector / Login Screen]
    SELECTOR --> RESUME[User selects account]
    RESUME --> PHASE1["switchAccountLocal - Instant DB unlock"]
    PHASE1 --> HOME[Home Screen visible]
    HOME --> PHASE2["switchAccountConnect - Background WS auth"]

    style USER fill:#2196F3,color:#fff
    style HOME fill:#4CAF50,color:#fff

flowchart TD
    SIDEBAR[User opens sidebar] --> SWITCH[Clicks 'Switch Account']
    SWITCH --> SELECTOR[Account List Overlay]
    SELECTOR --> SELECT[Select target account]
    SELECT --> LOCK[App Lock PIN Screen for target account]
    LOCK -->|PIN Correct| PHASE1["switchAccountLocal(email)\nClose WS, open new DB, load keys"]
    PHASE1 --> UI[UI refreshes with new account's data]
    UI --> PHASE2["switchAccountConnect() in background\nNew WS connection + AUTH"]
    PHASE2 --> SYNC[Receive SESSION_LIST + PENDING_REQUESTS]

sequenceDiagram
    participant UA as User A (Initiator)
    participant S as Relay Server
    participant UB as User B (Target)

    UA->>S: GET_PUBLIC_KEY {targetEmail}
    S-->>UA: PUBLIC_KEY {publicKeys: [pubB64A, pubB64B, ...], targetEmail}

    note over UA: For each of User B's device keys,<br/>encrypt profile using derived ECDH shared key

    UA->>S: FRIEND_REQUEST {targetEmail, payloads: [{publicKey, encryptedPacket}, ...]}
    S->>S: Store in pending_requests table
    S-->>UA: REQUEST_SENT
    S-->>UB: FRIEND_REQUEST (forwarded if online)

    note over UB: Iterate payloads, find the one<br/>matching own public key, decrypt

    UB->>UB: Show incoming request UI
    UB->>S: FRIEND_ACCEPT {targetEmail, payloads: [...]}
    S->>S: Register friends record with SID
    S-->>UB: FRIEND_ACCEPTED_ACK
    S-->>UA: FRIEND_ACCEPTED {payloads: [...]}

    note over UA,UB: Both derive AES-GCM-256 session key<br/>from ECDH shared secret.<br/>Key stored in SQLite. Session active.

flowchart TD
    SEND[User presses Send] --> GENID[Generate UUID message ID]
    GENID --> SAVE["Save to SQLite (status=1 pending)"]
    SAVE --> ENCRYPT["Encrypt for each peer device key\nAES-GCM + random 12-byte IV"]
    ENCRYPT --> TRANSMIT["Send MSG {sid, data.payloads: {pubKey: blob}}"]

    TRANSMIT --> RELAY{Server relays}
    RELAY -->|Peer Online| DELIVER["Deliver to correct device by pubKey"]
    RELAY -->|Peer Offline| DFAILED[DELIVERED_FAILED]

    DELIVER --> PDECRYPT[Peer decrypts with local session key]
    PDECRYPT --> PSAVE["Peer saves to SQLite (status=2 delivered)"]
    PSAVE --> ACK["Peer sends DELIVERED back"]

    ACK --> UPDATE["Update status to 2 in SQLite"]
    UPDATE --> UI[Checkmark shown in UI]

    DFAILED --> QUEUE["Message stays status=1"]
    QUEUE --> WAIT[Wait for PEER_ONLINE event]
    WAIT --> RETRY["syncPendingMessages() re-sends"]
    RETRY --> DELIVER

    style SEND fill:#4CAF50,color:#fff
    style UI fill:#4CAF50,color:#fff

flowchart TD
    LONGPRESS[Long-press message] --> CHECK{Whose message?}

    CHECK -->|My message| MYDELETE["Hard delete from local SQLite\n+ Send DELETE packet to peer"]
    MYDELETE --> UPDATE["Update UI - remove bubble"]
    MYDELETE --> PEERRECV[Peer receives DELETE packet]
    PEERRECV --> PEERDELETE[Peer hard deletes locally]

    CHECK -->|Peer's message| LOCALONLY["Hard delete from local SQLite only\n(no network packet)"]
    LOCALONLY --> UPDATE

flowchart TD
    START([User attaches file]) --> PICKER[File picker opens]
    PICKER --> READ[Read file as Blob]
    READ --> COMPRESS[Optional: compress image/video]
    COMPRESS --> VAULT[Save encrypted Base64 to Vault storage]
    VAULT --> THUMB[Generate thumbnail if image/video]
    THUMB --> MSGDB[Create message record in SQLite]
    MSGDB --> META["Encrypt FILE_INFO\n{name, size, type, thumbnail, messageId}"]
    META --> SEND["Send as MSG frame to peer"]
    SEND --> PEER[Peer receives FILE_INFO]
    PEER --> PREVIEW[Peer shows preview + Download button]

    PREVIEW --> WAIT{User clicks Download}
    WAIT --> REQ["Send FILE_REQ_CHUNK {messageId, index=0}"]

    REQ --> READCHUNK["Sender reads 250KB chunk from Vault"]
    READCHUNK --> ENCCHUNK[Encrypt chunk with session key]
    ENCCHUNK --> SENDCHUNK["Send FILE_CHUNK {messageId, index, payload, isLast}"]
    SENDCHUNK --> DECODE[Peer decodes + decrypts chunk]
    DECODE --> APPEND[Append to local file buffer]
    APPEND --> MORE{More chunks?}
    MORE -->|Yes| REQ
    MORE -->|No| COMPLETE["Mark as 'downloaded' in SQLite"]

    style START fill:#4CAF50,color:#fff
    style COMPLETE fill:#4CAF50,color:#fff

sequenceDiagram
    participant Caller
    participant Server as Relay Server
    participant Receiver

    Caller->>Server: GET_TURN_CREDS
    Server-->>Caller: TURN_CREDS {urls, username, credential}

    Caller->>Caller: Request mic/camera permission
    Caller->>Caller: Create RTCPeerConnection with ICE config
    Caller->>Caller: Encrypt CALL_START {type: "Audio"|"Video"}
    Caller->>Server: MSG {CALL_START} (encrypted in session key)
    Server-->>Receiver: MSG {CALL_START}

    Receiver->>Receiver: Show incoming call UI
    Receiver-->>Caller: (Accept action)
    Receiver->>Receiver: Request mic/camera permission
    Receiver->>Receiver: Create RTCPeerConnection
    Receiver->>Receiver: Encrypt CALL_ACCEPT
    Receiver->>Server: MSG {CALL_ACCEPT}
    Server-->>Caller: MSG {CALL_ACCEPT}

    Caller->>Caller: Create SDP Offer
    Caller->>Caller: Encrypt SDP Offer
    Caller->>Server: RTC_OFFER {payload: encryptedSDP}
    Server-->>Receiver: RTC_OFFER

    Receiver->>Receiver: Decrypt + set Remote Description
    Receiver->>Receiver: Create SDP Answer
    Receiver->>Receiver: Encrypt SDP Answer
    Receiver->>Server: RTC_ANSWER {payload: encryptedSDP}
    Server-->>Caller: RTC_ANSWER

    loop ICE Candidates
        Caller->>Server: RTC_ICE {payload: encryptedCandidate}
        Server-->>Receiver: RTC_ICE
        Receiver->>Server: RTC_ICE {payload: encryptedCandidate}
        Server-->>Caller: RTC_ICE
    end

    note over Caller,Receiver: WebRTC connection established via TURN relay.<br/>Audio/Video streams use DTLS-SRTP encryption.<br/>Server sees only opaque WebSocket frames.

    Caller->>Server: MSG {CALL_END} (to end call)
    Server-->>Receiver: MSG {CALL_END}
    note over Caller,Receiver: Both sides clean up RTCPeerConnection.<br/>Call duration logged in messages table.

flowchart LR
    subgraph "Own Device Sync"
        D1[Device A] -->|MANIFEST: blocks+requests+aliases+profile+messages| D2[Device B]
        D2 -->|MANIFEST: ...| D1
    end
    subgraph "Peer Message Push"
        D1 -->|MANIFEST: messages only| PeerDevice[Peer's Device]
        PeerDevice -->|MANIFEST: messages only| D1
    end

flowchart TD
    CONNECTED[Connected State] --> DISC[Network Lost / WS Closed]
    DISC --> DETECT["SocketManager: onclose fired"]
    DETECT --> RETRY[Auto-reconnect with backoff]
    RETRY --> ATTEMPT{Reconnect attempt}
    ATTEMPT -->|Fail| WAIT[Wait 1-30 seconds]
    WAIT --> RETRY
    ATTEMPT -->|Success| WS_CONN["WS_CONNECTED event"]
    WS_CONN --> LOADS[Load sessions from SQLite]
    LOADS --> REAUTH["Send AUTH {token, publicKey}"]
    REAUTH --> SESSLIST[Receive SESSION_LIST]
    SESSLIST --> SYNC[Trigger MANIFEST sync + pending messages]
    SYNC --> CONNECTED