# v1.19.0: A New Login, Remote Signers on Android, Wayland, and Marketplace Cards

Highlights:

- Redesigns the **login and sign-up screens** around signers: your signer
  app or a remote signer first, then the key field, on every platform.
- Adds **NIP-46 remote signer login on Android**, and makes it work with
  Opal and other signers that percent-encode their bunker addresses.
- Opens **gift wraps in parallel** for remote-signer accounts: a cold start
  that waited ~85s using a remote signer for DMs now takes ~20s.
- Gives the **desktop first-class key storage**: a status card in Key
  Backup, a password file when there is no system keyring, and an opt-out.
- Draws **natively on Wayland** in every Linux release, with the
  compositor's own title bar where it has one.
- **Compresses videos on desktop** through the system's ffmpeg, with the
  same quality table as Android.
- Honors **relay rate limits**: a relay's `rate-limited:` back-off now holds
  and re-sends the refused commands instead of losing them.
- Adds cards for **NIP-15 marketplaces**, NIP-85 trust assertions, Trusted
  Lists, decentralized lists and NIP-29 group metadata.

## New Features

### Login and Sign-up

- Redesigns the login, sign-up and remote-signer screens on one shared frame:
  the logo over a soft glow, rounded fields and buttons, Tor settings as a
  chip, and a brand-and-card split on windows 840 dp and wider.
- Shows the same order everywhere: the signer app where one is installed,
  the remote signer wherever it works, then "or", then the key field.
- Names and draws the installed signer app ("Login with Amber" and its
  icon), or says "a signer app" when there are several.
- Lights up Login once a key is typed, and Create Account once there is a
  name, and puts the terms checkbox at the top, gating every way in.
- Puts each error right under what it is about: the key field, the password
  field, the signer app's button or the remote signer's button.
- Fits the logged-off screens and the remote-signer dialog on small phones,
  and keeps the Add New Account bar above the form, not over it.
- Uses white and frosted cards instead of grey for the login, remote-signer,
  key-storage and Key Backup surfaces.

### Remote Signers (NIP-46)

- Logs in with a NIP-46 remote signer on Android too: paste a `bunker://`
  or show the `nostrconnect://` code.
- Hands the code to a signer app with Open signer, from an in-app menu when
  several take it, never to Amethyst itself.
- Shows the code in a large frame ringed by the logo's colors while it
  waits, with Copy, Open signer and the relays as pills.
- Lets you pick the relay your signer uses, or one of your inbox relays,
  when it can't reach the defaults.
- Uses relay.nip46.com, nrs.primal.net and bucket.coracle.social, the relays
  Amber and Opal default to, instead of the old single default relay, which
  stopped answering.
- Reads percent-encoded bunker addresses, as Opal writes them, and fails
  with an error instead of spinning forever.
- Accepts only an answer that carries the code's secret. Anyone who saw the
  code could reply first and pose as the signer.
- Resends the same request on a retry, so a signer that queues requests for
  approval (Amber) no longer asks twice.
- Waits five minutes for the signer instead of two, and introduces each
  platform by its own name and icon.
- Opens gift wraps, seals and drafts up to 8 at a time ahead of the indexer.
  With Amber over NIP-46, a desktop cold start opened its 118 wraps in
  ~20 s instead of ~85 s.
- Tries remote-signer accounts last when decrypting push notifications, so
  an offline bunker no longer holds every other account's notifications.

### Desktop Key Storage

- Shows where your keys live in a status card at the top of Key Backup,
  with Try again when the keychain refuses and Unlock when the key file is
  locked.
- Keeps keys in a password-protected NIP-49 file (`keys.ncryptsec`) when the
  computer has no system keyring, asking for the password once per launch.
- Adds "Remember my key on this device": turn it off and the key is asked
  for at each launch.
- Adds Save keys to take back this run's "Don't save".
- Stops rewriting the private key to the macOS Keychain on every settings
  save, which brought the Keychain password prompt back over and over.
- Fixes view-only, bunker and signer-app logins failing to load after a
  restart on Windows and Linux.
- Fixes the Linux OS keyring in release builds (deb, rpm, AppImage and
  Flatpak), which always fell back to the password file.
- Treats KWallet's missing item as absent, so a fresh KWallet no longer
  shows "Keychain error" on every launch.
- Upgrades a read-only session when you Unlock, Try again or log in again
  with the nsec.
- Reports a key the vault could not keep once per run, instead of on every
  settings save.
- Keeps the `nostrconnect://` secret out of the logs.

### Desktop Video Compression

- Compresses videos through the system's ffmpeg at the quality slider's
  level, with Android's resolution and bitrate table, HEVC when asked, and
  H.264 otherwise.
- Strips video metadata by remuxing the original when it is the one going
  up, and asks before uploading if the strip fails.
- Names the picked video and its target on the slider, such as
  "High · 4K video → 2160p, 8 Mbps".
- Hides the H.265 and GIF-to-MP4 switches without ffmpeg, showing an
  install hint instead.
- Tells you when an encode was discarded for not being smaller.
- Finds Homebrew and other package-manager installs of ffmpeg when the app
  is launched from Finder.

### Marketplaces (NIP-15)

- Adds cards for stalls, products, marketplaces, auctions, bids and bid
  confirmations, which showed as raw JSON or not at all.
- Shows a product's gallery, price, stock, stall, specs and a Message
  seller button that drafts a DM with the listing.
- Shows an auction's starting bid, its start and end with the merchant's
  extensions, an Upcoming/Live/Ended badge, and its highest bid and bid
  count.
- Reads marketplace events leniently (prices as strings, missing ids, tag
  form auctions from hash21 and mkauction), and keeps other apps' records
  on the same kinds out.

### Trust and List Cards

- Adds one card for NIP-85 trusted assertions (30382-30385): what it scores,
  the rank, hops, every other metric as a tile, timestamps as dates, and the
  provider.
- Shows a kind 10040's designated providers, with the services each serves.
- Adds cards for Trusted Lists (30392-30395) with members best first and
  their scores.
- Adds cards for decentralized list headers and items (9998/9999,
  39998/39999), loading a header's items while it is on screen, with `url`,
  `tel` and `email` fields as links.
- Adds a card for NIP-29 group metadata (39000) that opens the group.
- Renders hashtags, links and people in bookmark lists and sets, and quotes
  pinned notes instead of printing raw `nevent` strings.
- Pages long rosters (3, then 50 per Show more) and caps chip rows with a
  "+N more" chip, since event authors decide how many tags a card gets.

### Feeds and Cards

- Adds an info button to each feed filter that explains what it shows, and
  on the Notifications screen, what it does to notifications.
- Loads the relay lists of people-list members you don't follow, so list
  feeds, follow packs and All Follows find their notes.
- Draws live streams with their summary, start time, viewer count, and a
  Watch recording button over the cover once ended.
- Shows a classified's location and a Sold badge, a zap goal's end
  countdown, a calendar event's own time zone, and a long-form article's
  reading time and topics.
- Renders every kind as the thread's main note the way the feed does:
  RSVPs, calendars, lists, chess, live activities and more drew nothing or
  plain text there.
- Resolves NIP-30 custom emoji on reaction notification cards, and draws an
  untagged `:shortcode:` reaction as text instead of an empty image.
- Plays Blossom's `.mpga` audio files and Podcasting 2.0 trailers.
- Draws a kind 31337 as a music track only when it has a file to play, and
  leaves the rest (ad-skip data, game state) out of the feeds.

## Performance

- Makes the outbox's delivery state mutable under its lock: a publish cost
  O(relays²) in copies, ~3,400 ns per relay at 100 relays, now ~150 ns.
- Makes a screen's subscription invalidation lock-free: 1.1 ns instead of
  up to 8,300 ns while an update is running.
- Returns at once when pruning frees a note that is not a zap.

## Improvements and Bug fixes

- Shows a relay that refused a post with a back-off as retrying while the
  client waits it out.
- Stops one relay's hang-up during a publish retry from reconnecting the
  whole relay pool.
- Fixes acks from different relays being lost, which kept an event in the
  outbox and re-sent it on every reconnect.
- Fixes a forged copy of a note getting the real one dropped as its
  duplicate, and deleting an addressable's old version removing the
  current one.
- Downloads the Web of Trust network in ~10 s and 39 MB instead of minutes
  and 380 MB: it no longer fetches every deletion the provider signed, and
  learns of retracted cards over NIP-77.
- Routes the Web of Trust provider's relays like your own: clearnet by
  default instead of through Tor.
- Stops a Web of Trust download on mobile data when it is not allowed,
  keeps it through list updates, and checkpoints it so an interruption
  loses less.
- Fixes the zoom animation for images scrolled partly out of the feed or
  under the bars, and makes GIFs shrink back into their thumbnail.
- Fixes tapping a quoted reply in a chat scrolling to the wrong message.
- Stops the like icon crossfading from an empty heart on every scroll.
- Stops demoting the threads of audio rooms and video playback, which made
  audio stutter under load.
- Stops an audio room's service restarting after the app was killed and
  holding audio focus and a wake lock for a room that was gone.
- Stops any app from controlling picture-in-picture video playback.
- Reads timestamps written in milliseconds as seconds, which made goals
  and live streams end in "54,000 years".
- Keeps the Git Repositories search's `kind:git` chip out of the Namecoin
  and `.bit` lookups.
- Gives a room's name width before its label in Messages, so a Cordn group
  no longer shows only its coordinator.
- Follows the testls.space ElectrumX port swap for Namecoin.

## Desktop

- Draws natively on Wayland in every Linux package, with the JetBrains
  Runtime. Set `AMETHYST_X11=1` to stay on XWayland.
- Uses the compositor's title bar on KDE, sway, Hyprland, COSMIC and niri;
  GNOME keeps the GTK one.
- Fixes video playback on Windows, which said "Video playback unavailable"
  in 1.18.0, and on macOS release builds.
- Keeps the chart library intact in release builds, which ProGuard broke.
- Lets the `.deb` install on Ubuntu 22.04, Debian 12 and their derivatives.
- Fixes `.deb` and `.rpm` installs and removals failing on systems without
  `/usr/share/desktop-directories`, and upgrades that removed the menu
  entry.
- Requires the system libraries and a font in the `.rpm`, so minimal Fedora
  and openSUSE installs launch.
- Renames the Flatpak app ID to `com.vitorpamplona.amethyst.Amethyst`, so it
  doesn't share the Android package's listing in Nostr app stores. See
  `BUILDING.md` to move your v1.18.0 data.
- Fixes the Web of Trust download, which never started on desktop, and
  keeps Cordn's group state on disk.
- Drops the image viewer's URL tooltip and click-to-copy; Copy URL stays in
  its menu.
- Removes the Intel macOS options from the README: only Apple Silicon is
  built.

## Cli

- Fixes `amy` 1.18.0's self-contained bundles crashing on every command with
  `NoClassDefFoundError: java/lang/management/ManagementFactory`.
- Lists relays `amy fetch --paginate` could not page under `unpaged_relays`,
  and warns that the result may be partial.
- Adds `retry_after_ms` to `rejected_by` entries.
- Fetches all of a search such as `include:spam` on search.brainstorm.world:
  `amy fetch` returned 5,000 of 35,578 events, and `amy sync` none.

## Quartz

- Implements NIP-01 rate-limit back-offs (nostr-protocol/nips#2498):
  `OkMessage` and `ClosedMessage` carry `params` and `retryAfterMs`.
- Holds a relay's refused commands on its connection (`RateLimitGate`) and
  re-sends them when the back-off passes, across reconnects and pool
  changes, with the subscription's current filters.
- Adds `RateLimiter` and `RateLimitPolicy` for relays, with
  `PolicyResult.Rejected.rateLimited`.
- Pages a NIP-50 search with no words to rank, keeps `observer:` searches on
  one page, and carries the search on `fetchByIds`.
- Re-asks a page cut short inside its boundary second instead of reporting
  DRAINED.
- Fixes a decoder hang on short OK, CLOSED and NEG-ERR frames, a truncated
  JSON object looping, and a field like `jE` replacing an event's `id`.
- Fixes `subscribeAsFlow` and `fetchAsFlow` dropping the newest list on a
  burst.
- Fixes `QuicReader` overflowing on a peer-chosen length, and a bad datagram
  escaping to the crash handler.
- Reads NIP-15 marketplace events leniently, with `isWellFormed()`,
  `AuctionData.endsAt()` and `AuctionBidSummary`.
- Adds `AssertionMetric` readers, Trusted List accessors and D-list
  `fieldDeclarations()`, `displayHints()` and `listImage()`, with `tel` and
  `email` field types.
- Adds `TimeUtils.toUnixSeconds` for millisecond timestamps.
- `EmojiUrlTag.decode` returns null unless both shortcode and url are present.

## Geode

- Adds a `[rate_limits]` section for events and REQs per client per minute,
  answering with the NIP-01 back-off and 429 with `Retry-After` over NIP-FE.
  Off by default.
- Counts an IPv6 client by its /64.
- Caps WebSocket frames at 1 MiB by default; one header could cost 2 GB.

## Build & Documentation

- Fails the desktop release if ProGuard strips a JNI native method, a
  D-Bus transport or leaves a stale jar signature.
- Fails the `amy` build when its runtime lacks a JDK module its jars use.
- Self-tests the OS keyring on every packaged desktop build in CI.
- Speeds up `.deb` post-processing from 156 s to 51 s.
- Splits the iOS CI jobs and caches the Kotlin/Native toolchain, so they
  finish under their timeout.
- Adds `tools/desktop-run` to run and screenshot the shared UI headless, and
  asks agents to look at a UI change before calling it done.
- Clears the build and lint warnings across modules, and removes 125 unused
  Android strings and 10 unused drawables.
- Publishes the Flatpak to Orchard.
- States that issue bounties are not a promise of payment.
- Bumps `appCode` to 464.

## Contributors

- @npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z
- @npub1e2yuky03caw4ke3zy68lg0fz3r4gkt94hx4fjmlelacyljgyk79svn3eef
- @npub1gvv9ahktvavf9qjtrgm62le7gplmmchd5usp5wpfhr85hf79kncqj8xchs

## Translations

- Czech, German, Swedish, and Brazilian Portuguese by @npub1e2yuky03caw4ke3zy68lg0fz3r4gkt94hx4fjmlelacyljgyk79svn3eef
- Hindi by @npub1ww6huwu3xye6r05n3qkjeq62wds5pq0jswhl7uc59lchc0n0ns4sdtw5e6
- Hungarian by @npub1dnvslq0vvrs8d603suykc4harv94yglcxwna9sl2xu8grt2afm3qgfh0tp
- Polish by @npub16gjyljum0ksrrm28zzvejydgxwfm7xse98zwc4hlgq8epxeuggushqwyrm