feat(wallet): rework the internal transfer and gate it behind Advanced mode

DashWallet/Sources/Application/App.swift

@@ -131,6 +131,10 @@ private let kFiatCurrencyDidChange = "FiatCurrencyDidChange"
 
 extension Notification.Name {
     static let fiatCurrencyDidChange = Notification.Name(kFiatCurrencyDidChange)
+    /// `DWGlobalOptions.advancedModeEnabled` was flipped. Posted by whoever
+    /// writes it, so a screen already on display can rebuild rather than show
+    /// the value it happened to read when it appeared.
+    static let advancedModeDidChange = Notification.Name("org.dash.advanced-mode-did-change")
     static let willRequestOSPermission = Notification.Name("org.dash.will-request-permission-notification")
     static let didRequestOSPermission = Notification.Name("org.dash.did-request-permission-notification")
     static let applicationTerminationRequest = Notification.Name("DWApplicationTerminationRequestNotification")

DashWallet/Sources/Infrastructure/SwiftDashSDK/Identity/DWIdentityAuthorizer.swift

@@ -37,8 +37,34 @@ final class DWIdentityAuthorizer {
         }
     }
 
+    /// True while a caller has already run this gate for the work about to
+    /// execute, so the executor's own `authorize()` must not ask a second
+    /// time.
+    ///
+    /// Task-local rather than a stored flag: it covers exactly the work run
+    /// inside `preauthorized(_:)` and nothing else, so every other entry point
+    /// (the recovery sheet, the Send screen, a profile top-up) still prompts
+    /// for itself, and it cannot be left set by a transfer that died.
+    @TaskLocal static var isPreauthorized = false
+
+    /// Runs `body` with this gate already satisfied. The caller must have
+    /// awaited `authorize()` successfully first — this only suppresses the
+    /// SECOND prompt, it never skips authentication.
+    ///
+    /// Why anyone would: the gate has to be settled before the screen that
+    /// asked for it goes away, and the executors raise it from deep inside
+    /// work that outlives that screen.
+    static func preauthorized<T>(_ body: () async -> T) async -> T {
+        await $isPreauthorized.withValue(true, operation: body)
+    }
+
     @MainActor
     func authorize() async throws {
+        if Self.isPreauthorized {
+            Self.logger.info("🪪 IDENTITY-AUTH :: already authorized for this operation — not prompting again")
+            return
+        }
+
         let biometricEnabled = DWGlobalOptions.sharedInstance().biometricAuthEnabled
         Self.logger.info("🪪 IDENTITY-AUTH :: authenticating via AuthenticationGate (biometric=\(biometricEnabled, privacy: .public))")
         let outcome = await AuthenticationGate.authenticate(biometric: biometricEnabled)

DashWallet/Sources/Infrastructure/SwiftDashSDK/Identity/DWIdentityRegistrationCoordinator.swift

@@ -158,13 +158,26 @@ enum PlatformPaymentIdentityFundingPolicy {
             fundingDuffs: fundingDuffs)
     }
 
-    /// Builds inputs in PlatformAddress/BTreeMap order. Rust's derived order
-    /// compares the address variant first (P2PKH before P2SH), then its
-    /// 20-byte hash.
-    static func makeInputs(
-        candidates: [Candidate],
-        targetCredits: UInt64
-    ) throws -> [ManagedPlatformWallet.IdentityAddressInput] {
+    /// Saturating credit total of `candidates`.
+    private static func totalCredits(of candidates: [Candidate]) -> UInt64 {
+        candidates.reduce(UInt64(0)) {
+            let (sum, overflow) = $0.addingReportingOverflow($1.balance)
+            return overflow ? .max : sum
+        }
+    }
+
+    /// The candidates `makeInputs` can actually plan from, in
+    /// PlatformAddress/BTreeMap order (Rust's derived order compares the
+    /// address variant first — P2PKH before P2SH — then the 20-byte hash),
+    /// plus their saturating credit total.
+    ///
+    /// Any selected address before the fee source would become BTreeMap
+    /// input 0 itself, so leading addresses that cannot retain the reserve
+    /// are skipped and the plan draws exclusively from the viable suffix.
+    /// `nil` when no address can be the fee source.
+    private static func usableSelection(
+        candidates: [Candidate]
+    ) -> (usable: [Candidate], availableCredits: UInt64)? {
         let sorted = candidates
             .filter { $0.balance > 0 }
             .sorted { lhs, rhs in
@@ -173,29 +186,40 @@ enum PlatformPaymentIdentityFundingPolicy {
                 }
                 return lhs.hash.lexicographicallyPrecedes(rhs.hash)
             }
-        let totalAvailable = sorted.reduce(UInt64(0)) {
-            let (sum, overflow) = $0.addingReportingOverflow($1.balance)
-            return overflow ? .max : sum
-        }
+        guard let feeSourceIndex = sorted.firstIndex(where: {
+            $0.balance > feeHeadroomCredits
+        }) else { return nil }
+        let usable = Array(sorted[feeSourceIndex...])
+        return (usable, totalCredits(of: usable))
+    }
+
+    /// Largest funding amount `makeInputs` can plan from `candidates`, in
+    /// whole duffs (floored, so the ceiling never overstates what the
+    /// credit-denominated planner accepts). Input 0 contributes
+    /// `balance − reserve` and every later input its full balance, so the
+    /// ceiling is the usable total minus the retained fee headroom. 0 when
+    /// no address qualifies as the fee source.
+    static func maxFundableDuffs(candidates: [Candidate]) -> UInt64 {
+        guard let (_, availableCredits) = usableSelection(candidates: candidates),
+              availableCredits > feeHeadroomCredits
+        else { return 0 }
+        return (availableCredits - feeHeadroomCredits) / creditsPerDuff
+    }
+
+    /// Builds inputs from the usable selection above.
+    static func makeInputs(
+        candidates: [Candidate],
+        targetCredits: UInt64
+    ) throws -> [ManagedPlatformWallet.IdentityAddressInput] {
         let required = {
             let (sum, overflow) = targetCredits.addingReportingOverflow(feeHeadroomCredits)
             return overflow ? UInt64.max : sum
         }()
 
-        // Any selected address before the fee source would become BTreeMap
-        // input 0 itself. Skip leading addresses that cannot retain the
-        // reserve, then plan exclusively from the viable suffix.
-        guard let feeSourceIndex = sorted.firstIndex(where: {
-            $0.balance > feeHeadroomCredits
-        }) else {
+        guard let (usable, usableAvailable) = usableSelection(candidates: candidates) else {
             throw PlanningError.insufficient(
                 required: required,
-                available: totalAvailable)
-        }
-        let usable = Array(sorted[feeSourceIndex...])
-        let usableAvailable = usable.reduce(UInt64(0)) {
-            let (sum, overflow) = $0.addingReportingOverflow($1.balance)
-            return overflow ? .max : sum
+                available: totalCredits(of: candidates))
         }
         guard usableAvailable >= required else {
             throw PlanningError.insufficient(

DashWallet/Sources/Models/DWGlobalOptions.h

@@ -47,6 +47,14 @@ NS_ASSUME_NONNULL_BEGIN
 @property (nonatomic, assign) BOOL balanceHidden;
 @property (nonatomic, assign) BOOL tapToHideBalanceShown;
 
+/// Opt-in to the advanced surfaces across the app. Off by default: the
+/// screens it unlocks assume the user knows what a UTXO or a derivation path
+/// is, and showing them unasked is how an ordinary wallet stops looking
+/// ordinary. Read it anywhere, but observe
+/// `Notification.Name.advancedModeDidChange` rather than caching the value —
+/// it can be flipped from Settings while any screen is on display.
+@property (nonatomic, assign) BOOL advancedModeEnabled;
+
 @property (nonatomic, assign) BOOL shouldDisplayOnboarding;
 @property (nonatomic, assign) BOOL shouldDisplayReclassifyYourTransactionsFlow;
 @property (nullable, nonatomic, strong) NSDate *dateReclassifyYourTransactionsFlowActivated;

DashWallet/Sources/Models/DWGlobalOptions.m

@@ -46,6 +46,7 @@ @implementation DWGlobalOptions
 @dynamic autoLockAppInterval;
 @dynamic shortcuts;
 @dynamic balanceHidden;
+@dynamic advancedModeEnabled;
 @dynamic tapToHideBalanceShown;
 @dynamic shouldDisplayOnboarding;
 @dynamic paymentsScreenCurrentTab;
@@ -229,6 +230,7 @@ - (void)restoreToDefaults {
     self.shortcuts = nil;
     self.localNotificationsEnabled = YES;
     self.balanceHidden = NO;
+    self.advancedModeEnabled = NO;
     self.tapToHideBalanceShown = NO;
     self.resyncingWallet = NO;
     self.selectedPaymentCurrency = DWPaymentCurrencyDash;

DashWallet/Sources/UI/Coinbase/Transfer Amount/TransferAmountView.swift

@@ -109,10 +109,6 @@ struct TransferAmountView<ViewModel: TransferAmountViewModelProtocol>: View {
             inProgress: viewModel.isProcessing,
             actionHandler: { viewModel.transfer() }
         )
-        .frame(maxWidth: .infinity, maxHeight: 320)
-        .background(Color.dash.secondaryBackground)
-        .clipShape(.rect(cornerRadius: 20))
-        .background(Color.dash.secondaryBackground, ignoresSafeAreaEdges: .bottom)
     }
 }
 

DashWallet/Sources/UI/DashPay/Contacts/SwiftUI/ContactProfileSheet.swift

@@ -807,7 +807,6 @@ struct PayContactSheet: View {
             inProgress: isSending,
             actionHandler: { pay() }
         )
-        .padding(.top, 8)
     }
 
     /// Fiat equivalent of what is typed, for the secondary line. Empty while

DashWallet/Sources/UI/DashPay/Profile/SDKIdentityProfileSheet.swift

@@ -390,6 +390,16 @@ final class IdentityTopUpViewModel: ObservableObject {
         case platform
         case transparent
 
+        /// The funding source that spends `network`'s balance — the internal
+        /// transfer screen's bridge from its FROM side to this executor.
+        init(spending network: ChainNetwork) {
+            switch network {
+            case .core: self = .transparent
+            case .platform: self = .platform
+            case .shielded: self = .shielded
+            }
+        }
+
         var title: String {
             switch self {
             case .shielded: return NSLocalizedString("Shielded", comment: "Shielded activity: funds moved into the private shielded balance")
@@ -439,10 +449,15 @@ final class IdentityTopUpViewModel: ObservableObject {
     /// unshield minimum (shielded route only, via the pure
     /// `estimateShieldedFee` FFI) plus the observed top-up transition fee.
     /// The transparent route also pays a small Core miner fee on top.
-    static func estimatedFeeCredits(source: FundingSource) -> UInt64 {
+    /// `nil` when the shielded route's unshield estimate is unavailable —
+    /// callers show "no number" rather than only the transition fee.
+    static func estimatedFeeCredits(source: FundingSource) -> UInt64? {
         let unshieldFee: UInt64
         if source == .shielded {
-            unshieldFee = (try? PlatformWalletManager.estimateShieldedFee(kind: .unshield, numActions: 2)) ?? 0
+            guard let estimate = try? PlatformWalletManager.estimateShieldedFee(kind: .unshield, numActions: 2) else {
+                return nil
+            }
+            unshieldFee = estimate
         } else {
             unshieldFee = 0
         }
@@ -828,7 +843,11 @@ struct IdentityTopUpSheet: View {
     }
 
     private var estimatedFeeText: String {
-        let credits = IdentityTopUpViewModel.estimatedFeeCredits(source: source)
+        guard let credits = IdentityTopUpViewModel.estimatedFeeCredits(source: source) else {
+            // Shielded route with the unshield estimate unavailable: show no
+            // number rather than one that omits the larger fee component.
+            return "—"
+        }
         let duffs = credits / 1000
         return String.localizedStringWithFormat(
             NSLocalizedString("~%@ DASH (≈ %@)", comment: "DashPay: estimated network fee — DASH amount, then its local-currency equivalent"),

DashWallet/Sources/UI/Explore Dash/Views/DashSpend/Components/DashSpendSinglePanel.swift

@@ -140,9 +140,6 @@ struct DashSpendSinglePanel: View {
                 inProgress: inProgress,
                 actionHandler: onAction
             )
-            .frame(maxWidth: .infinity)
-            .bottomPanelStyle()
-            .background(Color.dash.secondaryBackground, ignoresSafeAreaEdges: .bottom)
         }
 
     }

DashWallet/Sources/UI/Explore Dash/Views/DashSpend/DashSpendUserAuthScreen.swift

@@ -157,10 +157,6 @@ struct DashSpendUserAuthScreen: View {
                         viewModel.onContinue()
                     }
                 )
-                .frame(maxWidth: .infinity)
-                .frame(height: UIDevice.isIphone5OrLess ? 290 : 320)
-                .padding(.horizontal, 20)
-                .padding(.bottom, 20)
             } else {
                 ZStack(alignment: .center) {
                     DashButton(

DashWallet/Sources/UI/Home/Views/Home Balance View/HomeBalanceView.swift

@@ -28,22 +28,25 @@ enum HomeBalanceViewState: Int {
 // MARK: - HomeBalanceView
 
 /// Home header: the combined total (transparent + platform + shielded)
-/// as the hero amount, then one row per balance with its fiat value and
-/// circular in/out transfer buttons. Every row's in-arrow opens the
-/// receive sheet (Receive ↔ Internal) with that balance pinned as the
-/// destination; every out-arrow opens the mirrored send sheet
-/// (Send ↔ Internal) with that balance pinned as the source.
+/// as the hero amount, and — in Advanced mode only — one row per balance
+/// with its fiat value.
+///
+/// The rows are a readout, not a control surface. They used to carry an
+/// in/out arrow pair opening the pinned receive/send sheets; the transfer
+/// routes those reached are all on the payments tab, and a second, denser
+/// entry to them on the balance header was two taps the header did not need.
 struct HomeBalanceView: View {
     @ObservedObject var viewModel: BalanceModel
     @ObservedObject private var platformSync = PlatformAddressSyncCoordinator.shared
     @ObservedObject private var shieldedSync = ShieldedSyncMonitor.shared
     @State private var opacity: Double = 0.3
     var onLongPress: () -> Void
-    var onReceive: (ChainNetwork) -> Void = { _ in }
-    var onSend: (ChainNetwork) -> Void = { _ in }
-    /// Tap on a row's body (icon/title/amount — not the arrows): opens the
-    /// what-is-this-balance info sheet for that balance.
+    /// Tap on a row: opens the what-is-this-balance info sheet.
     var onInfo: (ChainNetwork) -> Void = { _ in }
+    /// The breakdown is one of the three surfaces Advanced mode unlocks —
+    /// without it the wallet has one balance, and naming its parts invites
+    /// questions the simple mode is there to avoid.
+    var showsBreakdown: Bool = true
 
     // Header nav-bar (SB-11) inputs, threaded in by HomeView from the same
     // app-owned identity snapshot the UIKit nav-bar avatar reads. A nil
@@ -137,7 +140,7 @@ struct HomeBalanceView: View {
                 onLongPress()
             }
 
-            if !viewModel.isBalanceHidden && platformSync.isRunning {
+            if showsBreakdown && !viewModel.isBalanceHidden && platformSync.isRunning {
                 breakdownCard
                     .padding(.horizontal, 16)
                     .padding(.top, 12)
@@ -205,26 +208,20 @@ struct HomeBalanceView: View {
                 icon: "wallet.pass",
                 title: NSLocalizedString("Transparent", comment: "Balance breakdown"),
                 duffs: viewModel.value,
-                infoAction: { onInfo(.core) },
-                inAction: { onReceive(.core) },
-                outAction: { onSend(.core) })
+                infoAction: { onInfo(.core) })
             rowDivider
             balanceRow(
                 icon: "cloud",
                 title: NSLocalizedString("Platform", comment: ""),
                 duffs: platformDuffs,
-                infoAction: { onInfo(.platform) },
-                inAction: { onReceive(.platform) },
-                outAction: { onSend(.platform) })
+                infoAction: { onInfo(.platform) })
             rowDivider
             balanceRow(
                 icon: "shield",
                 title: NSLocalizedString("Shielded", comment: ""),
                 duffs: shieldedDuffs,
                 isSyncing: shieldedSync.isSyncing || platformSync.isShieldedBalanceReconciling,
-                infoAction: { onInfo(.shielded) },
-                inAction: { onReceive(.shielded) },
-                outAction: { onSend(.shielded) })
+                infoAction: { onInfo(.shielded) })
         }
         .padding(.horizontal, 12)
         .background(Color.dash.white.opacity(0.12))
@@ -254,13 +251,9 @@ struct HomeBalanceView: View {
         title: String,
         duffs: UInt64,
         isSyncing: Bool = false,
-        infoAction: @escaping () -> Void,
-        inAction: @escaping () -> Void,
-        outAction: @escaping () -> Void
+        infoAction: @escaping () -> Void
     ) -> some View {
         HStack(spacing: 8) {
-            // The row body is its own tap target (info sheet); keeping it a
-            // sibling of the arrow buttons means it can't swallow their taps.
             HStack(spacing: 8) {
                 Image(systemName: icon)
                     .font(.system(size: 15))
@@ -293,32 +286,8 @@ struct HomeBalanceView: View {
             }
             .contentShape(Rectangle())
             .onTapGesture { infoAction() }
-
-            transferButton(systemName: "arrow.down",
-                           label: NSLocalizedString("Transfer in", comment: "Balance breakdown"),
-                           action: inAction)
-            transferButton(systemName: "arrow.up",
-                           label: NSLocalizedString("Transfer out", comment: "Balance breakdown"),
-                           action: outAction)
         }
         .padding(.vertical, 9)
     }
 
-    private func transferButton(
-        systemName: String,
-        label: String,
-        action: @escaping () -> Void
-    ) -> some View {
-        Button(action: action) {
-            Image(systemName: systemName)
-                .font(.system(size: 13, weight: .semibold))
-                .foregroundColor(Color.dash.whiteText)
-                .frame(width: 28, height: 28)
-                .background(Circle().fill(Color.dash.white.opacity(0.18)))
-                // Keep the visual small but the tap target comfortable.
-                .contentShape(Rectangle().inset(by: -8))
-        }
-        .buttonStyle(.plain)
-        .accessibilityLabel(label)
-    }
 }