Merge branch 'master' into ep/test-coverage

test coverage
2026-08-30 07:38:44 +00:00 · 2023-06-02 18:05:07 +04:00 · 2023-05-29 09:36:37 +01:00
188 changed files with 7125 additions and 21956 deletions
@@ -11,7 +11,7 @@ on:

 jobs:
  build:
-    name: build-${{ matrix.os }}-${{ matrix.ghc }}
+    name: build-${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
@@ -19,22 +19,17 @@ jobs:
        include:
          - os: ubuntu-20.04
            platform_name: 20_04-x86-64
-            ghc: "8.10.7"
-          - os: ubuntu-20.04
-            platform_name: 20_04-x86-64
-            ghc: "9.6.3"
          - os: ubuntu-22.04
            platform_name: 22_04-x86-64
-            ghc: "9.6.3"
    steps:
      - name: Clone project
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: Setup Haskell
-        uses: haskell-actions/setup@v2
+        uses: haskell/actions/setup@v1
        with:
-          ghc-version: ${{ matrix.ghc }}
-          cabal-version: "3.10.1.0"
+          ghc-version: "8.10.7"
+          cabal-version: "latest"

      - name: Cache dependencies
        uses: actions/cache@v2
@@ -75,7 +70,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'ubuntu-20.04' && matrix.ghc == '9.6.3'
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'ubuntu-20.04'
        uses: softprops/action-gh-release@v1
        with:
          body: |
@@ -1 +0,0 @@
- ignore: {name: "Use underscore"}
@@ -1,216 +1,3 @@
-# 5.7.1
-
-SMP agent:
- increase timeout for TLS connection via SOCKS
-
-# 5.7.0
-
-Version 5.7.0.4
-
-_Please note_: the earliest SimpleX Chat clients supported by this version of the servers is 5.5.3 (released on February 11, 2024).
-
-SMP server:
- increase max SMP protocol version to 7 (support for deniable authenticators).
-
-NTF server:
- increase max NTF protocol version to 2 (support for deniable authenticators).
-
-XFTP server:
- version handshake using ALPN.
-
-SMP agent:
- increase timeouts for XFTP files.
- don't send commands after timeout.
- PQ encryption support.
-
-# 5.6.2
-
-Version 5.6.2.2.
-
-SMP agent:
- Lower memory consumption (~20-25%).
- More stable XFTP file uploads and downloads.
- API to receive network connectivity changes from the apps.
- to reduce battery consumption: connection attempts interval growing to every 2 hours when app reports as offline.
- to reduce retries and traffic: 50% increased timeouts when on mobile network.
-
-XFTP server:
- expire files on start.
- version negotiation based on TLS ALPN and handshake.
-
-NTF server:
- reduced downtime by ~100x faster start time.
- exclude test tokens from statistics.
-
-# 5.6.1
-
-Version 5.6.1.0.
-
- Much faster iOS notification server start time (fewer skipped notifications).
- Fix SMP server stored message stats.
- Prevent overwriting uploaded XFTP files with subsequent upload attempts.
- Faster base64 encoding/parsing.
- Control port audit log and authentication.
-
-# 5.6.0
-
-Version 5.6.0.4.
-
-SMP protocol/client/server:
- support deniable sender command authorization (to be enabled in the next version).
- remove support for SMP protocol versions (prior to v4, 07/2022).
-
-Agent:
- optional post-quantum key agreement using sntrup761 in double ratchet protocol.
- improve performance of deleting multiple connections and files by batching database operations.
- delay connection deletion to deliver pending messages.
- API to test for notifications server.
- remove support for client protocols versions (prior to 10/2022).
-
-XFTP server:
- restore storage quota in case of failed uploads.
-
-Performance and stability improvements.
-
-# 5.5.3
-
-Agent:
- notification token API also returns active notifications server.
- support file descriptions with redirection and file URIs.
-
-Servers:
- CLI commands for online key and certificate rotation.
- Configure config and log paths via environment variables.
-
-# 5.5.2
-
-Extensible handshake for clients and SMP/NTF servers (ignore extra data).
-
-# 5.5.1
-
-SMP servers:
- do not keep stats file open
- additional stats about currently stored messages
-
-Agent:
- support multiple notification servers (only one can be used at a time).
- expire messages after "quota exceeded" error after 7 days (instead of 21 days previously).
- stabilize message delivery, remove unnecessary subscription retries and traffic.
- improve database performance for message delivery.
- fix sockets/memory leak - a very old bug "activated" by improvements in v5.5.0.
-
-# 5.5.0
-
-Code:
- compatible with GHC 8.10.7 to support compilation for armv7a.
- migrate to `crypton` from deprecated `cryptonite` (the seed for DRG is now sha512-hashed).
- use ChaChaDRG for all random IDs, keys and nonces, only using hashed entropy as seed.
- more efficient transaction batching in SMP protocol client and server.
-
-Agent:
- stabilize message reception and delivery, migrate message delivery to database queue.
- additional event MSGNTF confirming that message received via notification is processed.
- efficient processing of messages sent to multiple recipients with batched database transactions.
- new worker abstraction for all queued tasks resilient to race conditions and some database errors.
- many fixed race conditions.
- background mode for iOS NSE.
- additional error reporting to client on critical errors (to be show as alert in the clients).
- functional api to get worker statistics.
-
-SMP/XFTP servers:
- fix socket and memory leak on servers with high load (inactive clients without subscriptions are disconnected after set time of inactivity).
- control port improvements.
- fix statistics for stored queues, messages and files.
- make writing to store log atomic (fixes a rare bug in XFTP server).
-
-# 5.4.0
-
-Migrate to GHC 9.6.3
-
-Agent:
- database improvements:
-  - track slow queries.
-  - better performance.
-  - "busy" error handling.
-  - create parent folder when needed.
-  - support closing and re-opening database.
- SMP agent improvements
-  - streaming for batched SMP commands.
-  - fix asynchronous JOINing connection.
-  - handle repeating JOINs without failure.
-  - api to get subscribed connections.
-  - return simplex:/ links as invitations.
-  - fix memory leak.
- XFTP improvements:
-  - suspend when agent is suspended.
-  - support locally encrypted files.
-  - fixes - create empty file, prevent permanent error treated as temporary.
-  - upgrade HTTP2 library (fixes error handling and flow control).
- Remote control protocol (XRCP)
-
-SMP server:
- control port commands for GHC threads introspection.
- allow creating new queues without subscriptions (required for iOS).
-
-XFTP server:
- allow 64kb file chunks.
-
-NTF server:
- faster startup.
-
-# 5.3.0
-
-Agent:
- improve performance, track slow database queries.
- support delivery receipts.
-
-SMP server:
- control port
-
-# 5.2.0 (NTF server 1.5.0)
-
-Agent:
- treat agent INACTIVE error as temporary - fixes failed message delivery in some race conditions.
- restore connection confirmations after client restart - fixes failed connections.
- ratchet resynchronization protocol and API.
- increase connection version to mutually supported by both peers on each received message.
-
-Client:
- make timeout for batched functions dependent on the number of batches - fixes expiry on large batches.
-
-Servers:
- add timeout in case of sending TCP traffic and in case of partial delivery of requested blocks to avoid resource leaks.
-
-# 5.1.2, 5.1.3 (NTF server 1.4.1, 1.4.2)
-
-Agent:
- ACK message on decryption error (fixes stuck message delivery bug)
- more robust connection switching logic, API to abort switching the address
-
-Notification server:
- batch subscriptions to SMP servers
-
-# 5.1.1 (NTF server 1.4.0)
-
-Agent:
- store and check hashes of previous encrypted messages to differentiate between duplicates and decryption errors
-
-Server:
- larger processing queues
- expire messages when restoring them
-
-# 5.1.0
-
-XFTP client:
- check encrypted file exists when uploading
- remove user ID from deletion API
-
-Agent:
- vacuum database on migrations
-
-SMP server:
- configure message expiration time in INI file
-
 # 5.0.0

 SimpleX File Transfer Protocol (XFTP):
@@ -241,7 +28,7 @@ SMP agent:
 - batch connection deletion
 - improve asynchronous connection deletion – it may now be completed after the client is restarted as well.
 - improve subscription logic to retry if initial attempt fails.
- end SMP client connection after a number of failed PINGs (default is 3).
+- end SMP client connection after a number of failed PINGs (defalt is 3).

 # 4.3.0

@@ -274,7 +61,7 @@ SMP agent:

 Notification server (v1.3.0):

- check token status when sending verification notification.
+- check token status when sending verification notificaiton.

 # 4.1.0

@@ -293,15 +80,15 @@ SMP agent:
 SMP server:

 - Basic authentication. The server address can now include an optional password that is required to create messaging queues, so the contacts who message you will not be able to receive messages via your server, unless you share with them the address with the password. It is recommended to enable basic authentication on all private servers by adding `create_password` parameter into AUTH section of server INI file (the previously deployed servers do not have this section, you need to add it).
- Disable creating new queues completely with `new_queues: off` parameter in AUTH section of INI file - it can be used to simplify migrating the existing connections to another server.
+- Disable creating new queues completely with `new_queues: off` parameter in AUTH section of INI file - it can be used to simplify migrating the exising connections to another server.
 - Updated server CLI with changed defaults:
-  - interactive server initialization, use -y flag to initialize the server non-interactively.
+  - interactive server initialization, use -y flag to initalize the server non-interactively.
  - store log is now enabled by default, so messaging queues and messages are restored when the server is restarted (to restore undelivered messages the server needs to be stopped with SIGINT signal).
  - a random password is now generated by default during the server initialization.

 SMP agent:

- API to test SMP servers. It connects to the server, creates and deletes a messaging queue. The new SimpleX Chat client uses this API to allow you to test that you have the correct server address, with the valid certificate fingerprint and password, before enabling the new server.
+- API to test SMP servers. It connects to the server, creates and deletes a messaging queue. The new SimpleX Chat client uses this API to allow you to test that you have the correct server address, with the valid certificate fingerprint and pasword, before enabling the new server.

 # 3.4.0

@@ -347,9 +134,9 @@ SMP server and agent:

 SMP server:

- restore undelivered messages when the server is restarted.
+- restore undeliverd messages when the server is restarted.
 - SMP protocol v3 to support push notification:
-  - updated SEND and MSG to add message flags (for notification flag that confirm whether the notification is sent and for any future extensions) and to move message meta-data sent to the recipient into the encrypted envelope.
+  - updated SEND and MSG to add message flags (for notification flag that contros whether the notification is sent and for any future extensions) and to move message meta-data sent to the recipient into the encrypted envelope.
  - update NKEY and NID to add e2e encryption keys (for the notification meta-data encryption between SMP server and the client), and update NMSG to include this meta-data.
  - update ACK command to include message ID (to avoid acknowledging unprocessed message).
  - add NDEL commands to remove notification subscription credentials from SMP queue.
@@ -360,7 +147,7 @@ SMP agent:
 - new protocol for duplex connection handshake reducing traffic and connection time.
 - support for SMP notifications server and managing device token.
 - remove redundant FQDN validation from TLS handshake to prepare for access via Tor.
- support for fully stopping agent and for temporary suspending agent operations.
+- support for fully stopping agent and for termporary suspending agent operations.
 - improve management of duplicate message delivery.

 SMP notifications server v1.0:
@@ -5,11 +5,11 @@ FROM ubuntu:${TAG} AS build
 ### Build stage

 # Install curl and git and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev libssl-dev
+RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev

 # Specify bootstrap Haskell versions
-ENV BOOTSTRAP_HASKELL_GHC_VERSION=9.6.3
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.10.1.0
+ENV BOOTSTRAP_HASKELL_GHC_VERSION=8.10.7
+ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.6.2.0

 # Install ghcup
 RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
@@ -19,7 +19,7 @@ ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"

 # Set both as default
 RUN ghcup set ghc "${BOOTSTRAP_HASKELL_GHC_VERSION}" && \
-    ghcup set cabal "${BOOTSTRAP_HASKELL_CABAL_VERSION}"
+    ghcup set cabal

 COPY . /project
 WORKDIR /project
@@ -150,7 +150,7 @@ You can install and setup servers automatically using our script:

 ```sh
 curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/simplex-chat/simplexmq/stable/install.sh -o simplex-server-install.sh \
-&& if echo 'b8cf2be103f21f9461d9a500bcd3db06ab7d01d68871b07f4bd245195cbead1d simplex-server-install.sh' | sha256sum -c; then chmod +x ./simplex-server-install.sh && ./simplex-server-install.sh; rm ./simplex-server-install.sh; else echo "SHA-256 checksum is incorrect!" && rm ./simplex-server-install.sh; fi
+&& if echo '1268d605e90bca1a8c7ef476038a8bd9aa9b1a28f79ea0a1485669ccf8fc23cd simplex-server-install.sh' | sha256sum -c; then chmod +x ./simplex-server-install.sh && ./simplex-server-install.sh; rm /simplex-server-install.sh; else echo "SHA-256 checksum is incorrect!" && rm ./simplex-server-install.sh; fi
 ```

 ### Build from source
@@ -1,14 +1,13 @@
 module Main where

 import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
 import Simplex.Messaging.Notifications.Server.Main

-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex-notifications"
+cfgPath :: FilePath
+cfgPath = "/etc/opt/simplex-notifications"

-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex-notifications"
+logPath :: FilePath
+logPath = "/var/opt/simplex-notifications"

 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
@@ -16,6 +15,4 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
 main :: IO ()
 main = do
  setLogLevel LogDebug -- change to LogError in production
-  cfgPath <- getEnvPath "NTF_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "NTF_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ ntfServerCLI cfgPath logPath
@@ -1,12 +1,10 @@
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE TypeApplications #-}

 module Main where

 import Control.Logger.Simple
-import Data.ByteArray (ScrubbedBytes)
 import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
 import Simplex.Messaging.Agent.Env.SQLite
@@ -21,7 +19,7 @@ cfg = defaultAgentConfig
 agentDbFile :: String
 agentDbFile = "smp-agent.db"

-agentDbKey :: ScrubbedBytes
+agentDbKey :: String
 agentDbKey = ""

 servers :: InitialAgentServers
@@ -36,11 +34,9 @@ servers =
 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}

-- Warning: this SMP agent server is experimental - it does not work correctly with multiple connected TCP clients in some cases.
 main :: IO ()
 main = do
-  let AgentConfig {tcpPort} = cfg
-  putStrLn $ maybe (error "no agent port") (\port -> "SMP agent listening on port " ++ port) tcpPort
+  putStrLn $ "SMP agent listening on port " ++ tcpPort (cfg :: AgentConfig)
  setLogLevel LogInfo -- LogError
-  Right st <- createAgentStore agentDbFile agentDbKey False MCConsole
+  Right st <- createAgentStore agentDbFile agentDbKey MCConsole
  withGlobalLogging logCfg $ runSMPAgent (transport @TLS) cfg servers st
@@ -1,16 +1,13 @@
-{-# LANGUAGE LambdaCase #-}
-
 module Main where

 import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
 import Simplex.Messaging.Server.Main

-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex"
+cfgPath :: FilePath
+cfgPath = "/etc/opt/simplex"

-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex"
+logPath :: FilePath
+logPath = "/var/opt/simplex"

 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
@@ -18,6 +15,4 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
 main :: IO ()
 main = do
  setLogLevel LogDebug
-  cfgPath <- getEnvPath "SMP_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "SMP_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ smpServerCLI cfgPath logPath
@@ -1,14 +1,13 @@
 module Main where

 import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
 import Simplex.FileTransfer.Server.Main

-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex-xftp"
+cfgPath :: FilePath
+cfgPath = "/etc/opt/simplex-xftp"

-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex-xftp"
+logPath :: FilePath
+logPath = "/var/opt/simplex-xftp"

 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
@@ -16,6 +15,4 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
 main :: IO ()
 main = do
  setLogLevel LogDebug -- change to LogError in production
-  cfgPath <- getEnvPath "XFTP_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "XFTP_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ xftpServerCLI cfgPath logPath
@@ -2,29 +2,36 @@ packages: .
 -- packages: . ../direct-sqlcipher ../sqlcipher-simple
 -- packages: . ../hs-socks
 -- packages: . ../http2
-- packages: . ../network-transport

-index-state: 2023-12-12T00:00:00Z
+package *
+  coverage: True
+  library-coverage: True

-package cryptostore
-    flags: +use_crypton
+package attoparsec
+  coverage: False
+  library-coverage: False

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/aeson.git
-    tag: aab7b5a14d6c5ea64c64dcaee418de1bb00dcc2b
+    tag: 3eb66f9a68f103b5f1489382aad89f5712a64db7

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/hs-socks.git
    tag: a30cc7a79a08d8108316094f8f2f82a0c5e1ac51

+source-repository-package
+    type: git
+    location: https://github.com/kazu-yamamoto/http2.git
+    tag: b5a1b7200cf5bc7044af34ba325284271f6dff25
+
 source-repository-package
    type: git
    location: https://github.com/simplex-chat/direct-sqlcipher.git
-    tag: f814ee68b16a9447fbb467ccc8f29bdd3546bfd9
+    tag: 34309410eb2069b029b8fc1872deb1e0db123294

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/sqlcipher-simple.git
-    tag: a46bd361a19376c5211f1058908fc0ae6bf42446
+    tag: 5e154a2aeccc33ead6c243ec07195ab673137221
@@ -1,3 +0,0 @@
-# Streamlined NTRU Prime: sntrup761
-
-The implementation of sntrup761 is the _exact_ copy from this [Internet draft](https://www.ietf.org/archive/id/draft-josefsson-ntruprime-streamlined-00.html).
@@ -1,9 +0,0 @@
-#include <openssl/sha.h>
-#include "sha512.h"
-
-void crypto_hash_sha512 (unsigned char *out,
-                         const unsigned char *in,
-                         unsigned long long inlen)
-{
-  SHA512(in, inlen, out);
-}
@@ -1,3 +0,0 @@
-void crypto_hash_sha512 (unsigned char *out,
-                         const unsigned char *in,
-                         unsigned long long inlen);
@@ -1,33 +0,0 @@
-/*
- * Derived from public domain source, written by (in alphabetical order):
- * - Daniel J. Bernstein
- * - Chitchanok Chuengsatiansup
- * - Tanja Lange
- * - Christine van Vredendaal
- */
-
-#ifndef SNTRUP761_H
-#define SNTRUP761_H
-
-#include <string.h>
-#include <stdint.h>
-
-#define SNTRUP761_SECRETKEY_SIZE 1763
-#define SNTRUP761_PUBLICKEY_SIZE 1158
-#define SNTRUP761_CIPHERTEXT_SIZE 1039
-#define SNTRUP761_SIZE 32
-
-typedef void sntrup761_random_func (void *ctx, size_t length, uint8_t *dst);
-
-void
-sntrup761_keypair (uint8_t *pk, uint8_t *sk,
-                   void *random_ctx, sntrup761_random_func *random);
-
-void
-sntrup761_enc (uint8_t *c, uint8_t *k, const uint8_t *pk,
-               void *random_ctx, sntrup761_random_func *random);
-
-void
-sntrup761_dec (uint8_t *k, const uint8_t *c, const uint8_t *sk);
-
-#endif /* SNTRUP761_H */
@@ -1,30 +0,0 @@
-indentation: 2
-column-limit: none
-function-arrows: trailing
-comma-style: trailing
-import-export-style: trailing
-indent-wheres: true
-record-brace-space: true
-newlines-between-decls: 1
-haddock-style: single-line
-haddock-style-module: null
-let-style: inline
-in-style: right-align
-single-constraint-parens: never
-unicode: never
-respectful: true
-fixities:
-  - infixr 9 .
-  - infixr 8 .:, .:., .=
-  - infixr 6 <>
-  - infixr 5 ++
-  - infixl 4 <$>, <$, $>,  <$$>, <$?>
-  - infixl 4 <*>, <*, *>, <**>
-  - infix 4 ==, /=
-  - infixr 3 &&
-  - infixl 3 <|>
-  - infixr 2 ||
-  - infixl 1 >>, >>=
-  - infixr 1 =<<, >=>, <=<
-  - infixr 0 $, $!
-reexports: []
@@ -11,7 +11,6 @@ scripts_systemd_smp="$scripts/smp-server.service"
 scripts_systemd_xftp="$scripts/xftp-server.service"
 scripts_update="$scripts/simplex-servers-update"
 scripts_uninstall="$scripts/simplex-servers-uninstall"
-scripts_stopscript="$scripts/simplex-servers-stopscript"

 # Default installation paths
 path_bin="/usr/local/bin"
@@ -19,7 +18,6 @@ path_bin_smp="$path_bin/smp-server"
 path_bin_xftp="$path_bin/xftp-server"
 path_bin_update="$path_bin/simplex-servers-update"
 path_bin_uninstall="$path_bin/simplex-servers-uninstall"
-path_bin_stopscript="$path_bin/simplex-servers-stopscript"

 path_conf_etc="/etc/opt"
 path_conf_var="/var/opt"
@@ -62,8 +60,8 @@ ${GRN}3.${NC} Setup user for each server:
 ${GRN}4.${NC} Create systemd services:
    - smp: ${YLW}${path_systemd_smp}${NC}
    - xftp: ${YLW}${path_systemd_xftp}${NC}
-${GRN}5.${NC} Install stopscript (systemd), update and uninstallation script:
-    - all: ${YLW}${path_bin_update}${NC}, ${YLW}${path_bin_uninstall}${NC}, ${YLW}${path_bin_stopscript}${NC}
+${GRN}5.${NC} Install update and uninstallation script:
+    - all: ${YLW}${path_bin_update}${NC}, ${YLW}${path_bin_uninstall}${NC}

 Press ${GRN}ENTER${NC} to continue or ${RED}Ctrl+C${NC} to cancel installation"

@@ -89,9 +87,9 @@ setup_users() {
 setup_dirs() {
 # Unquoted varibles, so field splitting can occur
 mkdir -p $path_conf_smp
- chown "$user_smp":"$user_smp" $path_conf_smp
+ chown "$user_smp":"$user_smp" "$path_conf_smp"
 mkdir -p $path_conf_xftp
- chown "$user_xftp":"$user_xftp" $path_conf_xftp
+ chown "$user_xftp":"$user_xftp" "$path_conf_xftp"
 }

 setup_systemd() {
@@ -102,7 +100,6 @@ setup_systemd() {
 setup_scripts() {
 curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_update" -o "$path_bin_update" && chmod +x "$path_bin_update"
 curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_uninstall" -o "$path_bin_uninstall" && chmod +x "$path_bin_uninstall"
- curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_stopscript" -o "$path_bin_stopscript" && chmod +x "$path_bin_stopscript"
 }

 checks() {
@@ -134,7 +131,7 @@ main() {
 setup_systemd
 printf "${GRN} Done!${NC}\n"

- printf "Installing stopscript, update and uninstallation script..."
+ printf "Installing update and uninstallation script..."
 setup_scripts
 printf "${GRN} Done!${NC}\n"

@@ -1,5 +1,5 @@
 name: simplexmq
-version: 5.7.1.0
+version: 5.1.1
 synopsis: SimpleXMQ message broker
 description: |
  This package includes <./docs/Simplex-Messaging-Server.html server>,
@@ -20,11 +20,9 @@ category: Chat, Network, Web, System, Cryptography
 extra-source-files:
  - README.md
  - CHANGELOG.md
-  - cbits/sha512.h
-  - cbits/sntrup761.h

 dependencies:
-  - aeson == 2.2.*
+  - aeson == 2.0.*
  - ansi-terminal >= 0.10 && < 0.12
  - asn1-encoding == 0.9.*
  - asn1-types == 0.3.*
@@ -32,81 +30,64 @@ dependencies:
  - attoparsec == 0.14.*
  - base >= 4.14 && < 5
  - base64-bytestring >= 1.0 && < 1.3
+  - bytestring == 0.10.*
  - case-insensitive == 1.2.*
  - composition == 1.0.*
  - constraints >= 0.12 && < 0.14
  - containers == 0.6.*
-  - crypton == 0.34.*
-  - crypton-x509 == 1.7.*
-  - crypton-x509-store == 1.6.*
-  - crypton-x509-validation == 1.6.*
-  - cryptostore == 0.3.*
+  - cryptonite >= 0.27 && < 0.30
+  - cryptostore == 0.2.*
  - data-default == 0.7.*
  - direct-sqlcipher == 2.3.*
  - directory == 1.3.*
  - filepath == 1.4.*
-  - hourglass == 0.2.*
  - http-types == 0.12.*
-  - http2 >= 4.2.2 && < 4.3
+  - http2 == 4.1.*
+  - generic-random >= 1.3 && < 1.5
  - ini == 0.4.1
  - iproute == 1.7.*
  - iso8601-time == 0.1.*
-  - memory == 0.18.*
-  - mtl >= 2.3.1 && < 3.0
+  - memory == 0.15.*
+  - mtl == 2.2.*
  - network >= 3.1.2.7 && < 3.2
-  - network-info >= 0.2 && < 0.3
-  - network-transport == 0.5.6
-  - network-udp >= 0.0 && < 0.1
+  - network-transport == 0.5.4
  - optparse-applicative >= 0.15 && < 0.17
+  - QuickCheck == 2.14.*
  - process == 1.6.*
  - random >= 1.1 && < 1.3
  - simple-logger == 0.1.*
  - socks == 0.6.*
  - sqlcipher-simple == 0.4.*
  - stm == 2.5.*
+  - template-haskell == 2.16.*
  - temporary == 1.3.*
-  - time == 1.12.*
+  - text == 1.2.*
+  - time == 1.9.*
+  - time-compat == 1.9.*
  - time-manager == 0.0.*
-  - tls >= 1.7.0 && < 1.8
-  - transformers == 0.6.*
+  - tls >= 1.6.0 && < 1.7
+  - transformers == 0.5.*
  - unliftio == 0.2.*
  - unliftio-core == 0.2.*
  - websockets == 0.12.*
+  - x509 == 1.7.*
+  - x509-store == 1.6.*
+  - x509-validation == 1.6.*
  - yaml == 0.11.*
-  - zstd == 0.1.3.*

 flags:
  swift:
    description: Enable swift JSON format
    manual: True
    default: False
-  use_crypton:
-    description: Use crypton etc. in cryptostore
-    manual: True
-    default: True

 when:
  - condition: flag(swift)
    cpp-options:
      - -DswiftJSON
-  - condition: impl(ghc >= 9.6.2)
-    dependencies:
-      - bytestring == 0.11.*
-      - template-haskell == 2.20.*
-      - text >= 2.0.1 && < 2.2
-  - condition: impl(ghc < 9.6.2)
-    dependencies:
-      - bytestring == 0.10.*
-      - template-haskell == 2.16.*
-      - text >= 1.2.3.0 && < 1.3

 library:
  source-dirs: src
-  c-sources:
-    - cbits/sha512.c
-    - cbits/sntrup761.c
-  include-dirs: cbits
-  extra-libraries: crypto

 executables:
  smp-server:
@@ -116,7 +97,6 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
-      - -rtsopts

  ntf-server:
    source-dirs: apps/ntf-server
@@ -125,7 +105,6 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
-      - -rtsopts

  xftp-server:
    source-dirs: apps/xftp-server
@@ -134,7 +113,6 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
-      - -rtsopts

  smp-agent:
    source-dirs: apps/smp-agent
@@ -143,7 +121,6 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
-      - -rtsopts

  xftp:
    source-dirs: apps/xftp
@@ -152,7 +129,6 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
-      - -rtsopts

 tests:
  simplexmq-test:
@@ -161,19 +137,15 @@ tests:
    dependencies:
      - simplexmq
      - deepseq == 1.4.*
-      - generic-random == 1.5.*
-      - hspec == 2.11.*
-      - hspec-core == 2.11.*
+      - hspec == 2.7.*
+      - hspec-core == 2.7.*
      - HUnit == 1.6.*
      - QuickCheck == 2.14.*
      - silently == 1.2.*
      - main-tester == 0.2.*
      - timeit == 2.0.*
    ghc-options:
-      - -threaded
-      - -rtsopts
-      - -with-rtsopts=-A64M
-      - -with-rtsopts=-N1
+      - -fhpc

 ghc-options:
  # - -haddock
@@ -184,7 +156,3 @@ ghc-options:
  - -Wincomplete-record-updates
  - -Wincomplete-uni-patterns
  - -Wunused-type-patterns
-  - -O2
-
-default-extensions:
-  - StrictData
@@ -347,7 +347,7 @@ Simplex messaging server implementations MUST NOT create, store or send to any o

 - Snapshots of the database they use to store queues and messages (instead simplex messaging clients must manage redundancy by using more than one simplex messaging server). In-memory persistence is recommended.

- Any other information that may compromise privacy or [forward secrecy][4] of communication between clients using simplex messaging servers (the servers cannot compromise forward secrecy of any application layer protocol, such as double ratchet).
+- Any other information that may compromise privacy or [forward secrecy][4] of communication between clients using simplex messaging servers.

 ## Message delivery notifications

@@ -364,9 +364,9 @@ The clients can optionally instruct a dedicated push notification server to subs

 [`SEND` command](#send-message) includes the notification flag to instruct SMP server whether to send the notification - this flag is forwarded to the recepient inside encrypted envelope, together with the timestamp and the message body, so even if TLS is compromised this flag cannot be used for traffic correlation.

-## SMP Transmission and transport block structure
+## SMP Transmission andtransport block structure

-Each transport block has a fixed size of 16384 bytes for traffic uniformity.
+Each transport block (SMP transmission) has a fixed size of 16384 bytes for traffic uniformity.

 From SMP version 4 each block can contain multiple transmissions, version 3 blocks have 1 transmission.
 Some parts of SMP transmission are padded to a fixed size; this padding is uniformly added as a word16 encoded in network byte order - see `paddedString` syntax.
@@ -387,17 +387,17 @@ Each transmission/block for SMP v3 between the client and the server must have t

 ```abnf
 paddedTransmission = <padded(transmission), 16384>
-transmission = signature signed
-signed = sessionIdentifier corrId queueId smpCommand
+transmission = [signature] SP signed
+signed = sessionIdentifier SP [corrId] SP [queueId] SP smpCommand
 ; corrId is required in client commands and server responses,
 ; it is empty in server notifications.
-corrId = length *OCTET
-queueId = length *OCTET
+corrId = 1*32(%x21-7F) ; any characters other than control/whitespace
+queueId = encoded ; max 32 bytes when decoded (24 bytes is used),
 ; empty queue ID is used with "create" command and in some server responses
-signature = length *OCTET
+signature = encoded
 ; empty signature can be used with "send" before the queue is secured with secure command
 ; signature is always empty with "ping" and "serverMsg"
-length = 1*1 OCTET
+encoded = <base64 encoded binary>
 ```

 `base64` encoding should be used with padding, as defined in section 4 of [RFC 4648][9]
@@ -1,16 +0,0 @@
-Scheme name: xftp
-
-Status: Provisional
-
-Applications/protocols that use this scheme name:
-This scheme is used for URIs of XFTP (SimpleX File Transfer Protocol) servers,
-a client-server protocol for asynchronous file transfer via relays,
-preserving file meta-data (including size and name) and content privacy.
-
-Contact: Evgeny Poberezkin <ep@simplex.chat>
-
-Change controller: Evgeny Poberezkin <ep@simplex.chat>
-
-References:
-The syntax for server URIs in the provisional specification for SimpleX File Transfer Protocol:
-https://github.com/simplex-chat/simplexmq/blob/master/rfcs/2022-12-26-simplex-file-transfer.md#server-address-syntax
@@ -1,15 +0,0 @@
-Scheme name: xrcp
-
-Status: Provisional
-
-Applications/protocols that use this scheme name:
-This scheme is used for URIs of controller sessions via SimpleX Remote Control protocol (XRCP),
-a protocol for remote access and management of hosts via insecure network.
-
-Contact: Evgeny Poberezkin <ep@simplex.chat>
-
-Change controller: Evgeny Poberezkin <ep@simplex.chat>
-
-References:
-The syntax for server URIs in the provisional specification for SimpleX File Transfer Protocol:
-https://github.com/simplex-chat/simplexmq/blob/master/rfcs/2023-10-25-remote-control.md#session-invitation
@@ -149,19 +149,6 @@ parts:

 This file description is sent to all recipients via normal messages, split to 15780 byte chunks if needed.

-### Server address syntax
-
-The server address is a URI with the following format:
-
-```abnf
-xftpServerURI = %s"xftp://" xftpServer
-xftpServer = serverIdentity "@" srvHost [":" port]
-srvHost = <hostname> ; RFC1123, RFC5891
-port = 1*DIGIT
-serverIdentity = base64url
-base64url = <base64url encoded binary> ; RFC4648, section 5
-```
-
 ### Receiving file

 Having received the description, the recipient will:
@@ -1,58 +0,0 @@
-# Re-sync encryption ratchets, queue rotation, message delivery receipts
-
-This is very unfocussed doc outlining several problems that seem somewhat related, and some possible solution approaches.
-
-## Problems
-
-When old database backup is used, the sending client encrypts the messages in a way that the receiving client cannot decrypt them, because it does not store the old keys, and does not try to decrypt ratchet headers using the old keys. When receiving the messages, the client that uses the old database is unable to decrypt them, either the header or the message itself (if more than 500 messages are skipped, or if root ratchet step happened).
-
-The same symptoms happen during the queue rotation, unfortunately, as we do not keep the history of received messages once they are acknowledged, so the client reports these error to the users.
-
-While these are two different problems, to the users they manifest in the same way, so it is difficult to differentiate.
-
-Another ratchet problem that should be solved as well is not deleting unused skipped keys after some time or some number of events, possibly it should be considered at the same time.
-
-While it is tempting to consider delivery receipts as an isolated problem, it is somewhat coupled, as the requests to re-sync ratchets and to re-deliver skipped messages are effectively delivery receipts.
-
-A naive solution to delivery receipts when each message is responded to with a confirmation has two downsides:
-
- it doubles the traffic.
- in the absense of delays, it also leaks some information about the network latency, that can be used to track user's location.
-
-Both problems can be mitigated by sending delivery receipts with a random delay, to confirm all messages sent, not each one. But this would only reduce the traffic when the sender sends many messages. Alternatively, we could think how to reduce the block size for SMP commands. The challenge is profile pictures and image previews, so to reduce traffic we need to start sending them as XFTP files, potentially with a smaller 64kb chunks (that would also increase preview quality).
-
-## Solution for queue rotation
-
-We need to:
- store and show the rotation status in the UI to prevent attempts to rotate the queue multiple times.
- process multiple message delivery events while there is a redundancy, to avoid errors in terminal.
- differentiate between decryption errors during queue rotation - that would require keeping the messages for some time, at least keeping their IDs and hashes together with some additional status. In this case when duplicate or old message arrives, we can check whether this message was already processed, and do not show error if it was.
-
-## Solution to re-sync ratchets
-
-When we establish that the receiving client is indeed unable to decrypt messages, we should:
- notify the user - it is already happening, but it happens in case of rotation as well.
- optionally, notify another client that message was not decrypted - this effectively becomes a delivery receipt. That could be a separate command triggered by the user in the UI.
- clients can get into this state at the same time, how do we handle concurrent requests? Possibly, we could design these messages so this is irrelevant whether the message is sent in response or not, and calculate the new ratchet keys once the clients have both the sent and received messages. After that both clients can send "ratchet reset" message:
-  - EKEY - message containing a new set of keys to initialize the ratchets
-  - EREADY - message confirming that the ratchet is ready, already e2e encrypted
-
-The downside of this approach, is that unlike the initial handshake, where the second ratchet key is sent in e2e encrypted response, this message will be sent only encrypted with queue key. We could change this protocol by adding EREPLY message, and the clients would know to ingnore EKEY with bigger hash of the keys, so that the client who sent keys with smaller hash would be processing response from another client (that is if EKEY is received after EKEY is sent).
-
-```
-A                B
-
-EKEY 1 ->        <- EKEY 2 (e2e encrypted with per-queue key only)
-EKEY 2 <-        -> EKEY 1
-1 < 2, wait      2 > 1, reply EREPLY 3 (e2e encrypted with ratchets)
-ratchet: 1, 3   ratchet: 3, 1
-```
-
-Once ratchets are re-synched the clients could additionally request delivery of skipped messages. As ratchets being out of sync is not the only problem when messages can be lost, it may be managed independently from the ratchet re-sync. This problem seems tied with delivery receipts too, as requesting to re-deliver some messages automatically confirms that some other messages were delivered.
-
-Alternatively, the request for ratchet sync can already contain the ID of the first failed message - that would allow the agent:
- stop sending messages until ratchets are in sync.
- re-deliver failed messages first.
- only then deliver any pending messages.
-
-This approach would probably result in a better UX (no out of order delivery), but requires tracking pending messages that are not attempted to deliver and to also insert old messages in the delivery queue with the old IDs.
@@ -1,170 +0,0 @@
-# Delivery receipts
-
-## Problems
-
-User experience - users need to know that the messages are delivered to the recipient, as this confirms that the system is functioning.
-
-The downside of communicating message delivery as it confirms that the recipient was online, and, unless there is a delay in confirming, can be used to track the location via the variation in network latency. So delivery receipts should be delayed with a randomized interval and should be opt in or opt out.
-
-Another problem of message receipts is that they increase network traffic and server load. This could be avoided if delivery receipts are communicated as part of normal message delivery flow.
-
-Some other existing and planned features implicitely confirm message delivery and, possibly, should depend on message delivery being enabled:
- agent message to resume delivery when quota was exceeded (implemented, [rfc](./2022-12-27-queue-quota.md))
- agent message to re-deliver skipped messages or to re-negotiate double ratchet.
-
-## Solution
-
-There are three layers where delivery receipts can be implemented:
- chat protocol. Pro: logic of when to deliver it is decoupled from the message flow, Con: extra traffic, can only work in duplex connections.
- agent client protocol. Pro: can be automated and combined with the protocol to re-deliver skipped messages. Con: extra traffic.
- SMP protocol. Pro: minimal extra traffic, Con: complicates server design as it would require pushing receipts when there is no next message.
-
-The last approach seems the most promising for avoiding additional traffic:
- modify client ACK command to include whether delivery receipt should be provided to sender, and, possibly, any e2e encrypted data that should be included in the receipt (e.g., that the receiving client already saw this message in case we use "feedback" variant of roumor-mongering protocol for groups).
- server would manage delaying of the receipts, by randomizing the time after which the receipt will be available to the sender, and by combining the receipts when possible.
- modify response to SEND command to include any available delivery receipts.
- add a separate delivery receipt that will be pushed to the sender in the connection where the message was received by the server.
-
-## SMP protocol changes
-
-```haskell
-data Command (p :: Party) where
-  -- ...
-  ACK :: MsgId -> Maybe ByteString -> Command Recipient
-  -- the presense of ByteString in ACK indicates that the delivery needs to be confirmed.
-  -- the protocol does not define the format of this confirmation, it is application specific, and can be -- an empty string.
-  -- And open question is how to e2e encrypt information in this string - this probably can be handled on Agent client protocol level, and could be the same ratchet key that was used to encrypt and decrypt the message. The downside of this approach is that this key currently is not stored, and storing it requires additional logic to clear these keys if unused after some time.
-  -- TODO consider what could be a better approach.
-  SENT :: MsgId -> [(MsgId, UTCTime, ByteString)] -> Command Sender
-  -- or
-  -- SENT :: MsgId -> Command Sender
-  -- in case we just batch
-  -- this response will be sent to SEND command and will include a sender's message ID generated by the server (currently it does not exist), and posibly an empty list of delivery receipts with the same message IDs as in responses to SEND, timestamps when these receipts became available, and e2e encrypted ByteString passed in ACK command.
-  -- The ID in this response should be different from the ID used in MSG, to keep the promise of not having shared identifiers in sent/received traffic even inside TLS tunnel.
-  -- Keeping the quality of shared ciphertext also requires adding additional encryption layer between the server and the sender, this can be achieved in one of two ways:
-  -- 1) passing a separate DH key in each SEND command, and server including additional DH key in each SENT response, with computed DH secret per message later used to encrypt and decrypt the delivery receipt payloads. This is probably a bad idea as it would increase a cryptographic load on both the server and the client.
-  -- 2) agree a key per queue, in the same way it is done for the recipient. Possibly, it requires additional DH key in confirmation message that the recipient then uses to secure the queue, and passing this key in KEY (secure queue) command. The response to this secure command would the include server's DH key returned to the recipient that would be passed to the sender in HELLO message. Even though recipient could observe both public DH keys, they won't know the computed shared secret. Recipient that controls the server could perform MITM attack on this key exchange, but it doesn't give any benefit over what recipient can do when they have access to the server - the threat model remains the same. The downside of this approach is that it also requires additional changes in client protocol level (confirmation message format and HELLO message).
-  -- 3) also agree on a key per queue, but via separate commands between the sender and the server, once the sender was notified that the queue is secured. This approach is probably better, and the server would simply delay the delivery of delivery receipts until the shared secret is agreed.
-  SKEY :: C.PublicKeyX25519 -> Command Sender
-  SBKEY :: C.PublicKeyX25519 -> BrokerMsg
-  -- these are the command and response to agree secret to encrypt delivery receipt payloads for option 3
-  SSUB :: Command Sender
-  -- subscribe to receive delivery receipts for a given queue - will be sent when the conversation is opened (unless there is an active subscription already), not all queues at once, and won't be re-subscribed on losing the server connection (TBC).
-  RCVD :: MsgId -> UTCTime -> ByteString -> Command Recipient
-  -- delivery receipt. UTCTime is the time when it became available, not the time when ACK was sent by the recipient, to avoid leaking location via network latency.
-```
-
-Possibly, there is no need to include delivery receipts into SENT response and instead just use batching of responses that is already supported. As server responses are not signed, there is no per-response overhead that is substantial, and a lot of receipts that are available can be packed into one block (depending on the size of payload that has to be fixed not to leak metadata).
-
-This all seems rather complicated for SMP protocol, and the approach of doing it on a higher level seems more attractive than initially. Possibly we should reconsider, and reduce traffic by reducing block sizes... Reducing block sizes unfortunately requires supporting variable block sizes, and would leak some metadata during the transition period.
-
-## Another approach
-
-Above represents substantial complexity, and at least doubles server code complexity for the feature that is definitely not doubling the value of server software. Moving to variable block size is simpler, but also has a lot of complexity, reduces metadata privacy (at least for the duration of migration period), reduces image preview quality, and requires postponing this feature for multiple releases, until all clients migrate.
-
-Given that the main traffic is generated by the groups, and direct messages do not create a lot of traffic, a much simpler and better solution is to simply send delivery receipts as the message, in direct conversations only, either as chat protocol message or as agent client protocol message (either on the message or on the envelope layer).
-
-### Comparison of these two approaches:
-
-**Chat protocol message**
-
-Pros:
- simpler, more contained change - SMP layer is not aware of this feature
- easier to extend protocol with additional application specific payload, e.g. references to group DAG
-Cons:
- ?
-
-```json
-  // ...
-  "x.msg.delivered": {
-    "properties": {
-      "msgId": {"ref": "base64url"},
-      "params": {
-        "properties": {
-          "msgId": {"ref": "base64url"},
-        },
-        "optionalProperties": {
-          "data": {} // possibly the initial protocol does not need it, with JSON can be added later
-        }
-      }
-    }
-  },
-  // ...
-```
-
-**Agent client protocol envelope**
-
-Pros:
- possibility of using it in a wider range of the applications
- possibility to include received message hash to increase communication integrity - the sending client would be then notified, and it can be exposed in the UI, that the received message is not the same as sent.
-
-Cons:
- additional implementation complexity - requires additional events to communicate between chat and agent.
-
-```haskell
-data AMessage =
-  -- ...
-  | A_RCVD AgentMsgId MsgHash ByteString -- references to the received message
-  -- ...
-```
-
-The weirdness of the above design is that it refers to the data present in the header of another message, the alternative would be to have a separate envelope for delivery receipt:
-
-```haskell
-data AgentMessage =
-  -- ...
-  AgentMessageRcvd APrivHeader AgentMsgId MsgHash ByteString -- references to the received message
-  -- ...
-```
-
-But probably the first one is a bit better, TBC.
-
-In any case there should be an additional event to notify chat client:
-
-```haskell
-data ACommand (p :: AParty) (e :: AEntity) where
-  -- ...
-  RCVD AgentMsgId MsgMeta ByteString -> ACommand Agent AEConn
-  -- ...
-```
-
-On the balance of things, implementing on the level of Agent Client protocol seems better, as the additional complexity is marginal, but it allows for wider range of applications, and also allows for additional delivery integrity validation. The format for payload still requires chat protocol message encoding once we want to add it, but initially it could be just an empty string.
-
-## Implementation plan
-
-Currently, we delete sent messages once delivered to the server. It would be helpful if we could keep the records in snd_messages table, and then use them to process delivery receipts, although it may be insufficient (we could add fields). Probably it is not possible to keep them as there is a foreign key constraint with `on delete cascade`.
-
-The new table will be used to track sent message hashes to correlate their IDs with delivery receipts (that will also be stored in messages/rcv_messages). Receipts need to be processed in chat in the same way as normal messages, so they would be sent to chat with MsgMeta, and the chat will need to ack them once processed.
-
-Agent ackMessage function will be also used to automatically schedule sending delivery receipts if they are enabled for connection, only for normal messages - no sending receipts to receipts.
-
-There can be receipt re-delivery to the chat in the same cases as when normal message can be re-delivered (in case of AGENT A_DUPLICATE when it was not ack'd by the user).
-
-## Other considerations
-
-### How clients decide whether to send delivery receipts
-
-Two options are possible - local settings per conversation or chat preferences framework, that allows to have mutual on/off. The latter seems preferable as without knowing whether the other party is sending receipts, it is not possible to uderstand what the absense of the receipt means - network malfunction or receipts disabled.
-
-Groups are a special case, as while some groups may enable sending the delivery receipts, the group members should be able to disable it locally. This should probably be done via a separate conversation setting in the same way as enabling notifications or favourites. In this case the receipt would only be sent to the group if it is enabled in the group and not disabled by the member. The toggle may be located in the same page as chat preferences, but it should be a separate setting. We might want though to communicate somehow whether a given member sends delivery receipts so that other members know whether to expect them or not.
-
-### How this functionality is released
-
-5.2:
- support for sending and receiving delivery receipts preference, both in direct messages and in groups (for forward compatibility).
- support for sending and receiving delivery receipts in direct chats only, but disable sending them
-
-5.3:
- show receipt preferences in the UI
- enable sending receipts in direct chats where they are enabled
-
-A separate question is how to enable this functionality for the existing contacts. Possible options are:
-
-1. Enable (as per default) for all contacts, show notification to the user when they open the app for update that delivery notifications are now sent by default to all contacts. Pro: no extra logic to implement. Con: may be perceived as a privacy violation, as to some contacts the delivery receipts will be sent before the user had chance to disable them.
-2. Ask the user when the new version first runs whether they want to use delivery receipts and offer these options:
-  1) keep enabled for all profiles (and for all contacts)
-  2) enable for all profiles in ~12 or in ~24 hours giving users the chance to review all contacts / profiles and disable some of them. The problem here is also in possibility of the correlation in case they all start sending receipts at the same time. Possibly the option could be to set a random time in 12-15 or 24-30 hours range to avoid the possibility of such correlation.
-  3) disable for all profiles – it will require sending profile updates to all contacts, so the delivery receipts should be kept disabled and profile updates should be sent after random intervals, one by one (not scheduled all at once, as the time may pass while the app is off).
-3. Offer an option to enable globally later - we could keep it as a one-off option, available only to existing users, and visible on the top level of the Settings - once enabled, the option will disappear and it won't be possible to disable again. The downside here is that the new contacts would be receiving the profile with enabled notifications but they still won't be delivered...
-4. Another option is to have all new contacts decided based on a global user default (that can be set in the settings and in the dialog on first start), but for the existing contacts keep in unset state that is not interpreted as either on or off, but interpreted as unknown until the user makes a choice... That might be an optimal solution for the users but it would probably require changing the preferences framework or some ad-hoc hacks. That still keeps the question open how to avoid correlation between profiles.
-5. That might be the case for version agreement too - the availability of the option per contact will depend on the version. It doesn't answer the question what to do with global defaults though...
@@ -1,34 +0,0 @@
-# SMP and XFTP delivery relays
-
-## Problem
-
-SimpleX network relies on SMP relays to hold sent messages while the recipient is offline. This design provides many advantages over pure p2p designs [1]. The threat model for relays is covered in [2].
-
-The problem with this design is that the relays are chosen by the recipients, and they as a result can be used to record transport addresses of the senders.
-
-Similar problem, but reversed, exists with XFTP design - XFTP relays are chosen by the senders and also can be modified to record transport addresses of the recipients.
-
-The current solution to this problem is to use onion routing to access relays, and many users do it already. The downside is that it requires additional configuration and can be complex to some users.
-
-## Solution approach
-
-Add a second type of relays to the network design.
-
-For SMP protocol, these relays would accept messages from the senders and deliver them to the recipients. If the recipient were to modify the relay used to receive the messages to also records senders' IP addresses, then they would only succeed in recording the IP address of the relay, not the sender.
-
-Similar relay can be introduced for XFTP protocol.
-
-The additional advantage of using the relays is the reduced number of network connections that need to be used, and reduced traffic.
-
-Compared with Tor this approach has:
- lower latency
- no centralized components or the registry of the servers
- still no visibility of the whole network to the relays, as sending relays do not need to randomly choose the next relay, but would forward the messages directly to the destination relay.
-
-The downside of this approach is that relays will have more visibility of the network than in the current design.
-
-## Implementation considerations
-
-1. Should this new relays be included in the existing SMP and XFTP protocols and servers, or should they be designed as separate protocols and servers?
-
-2. Should the client aim to choose the same host for delivery relay as the destination server (to reduce the traffic), if possible, or should it aim to choose a different host (to reduce metadata available to single host)? The answer to this would affect the answer to the first question.
@@ -1,366 +0,0 @@
-# Re-sync encryption ratchets
-
-## Problem
-
-See https://github.com/simplex-chat/simplexmq/pull/743/files for problem and high-level solution.
-
-## Implementation
-
-### Diagnosing ratchet de-synchronization
-
-Message decryption happens in `agentClientMsg`, in `agentRatchetDecrypt`, which can return decryption result or error. Decryption error can be differentiated in `agentClientMsg` result pattern match, in Left cases, where we already differentiate duplicate error (`AGENT A_DUPLICATE`).
-
-Question: Which decryption errors can be diagnosed as ratchet de-synchronization?
-
-Possibly any `AGENT A_CRYPTO` error. Definitely on `RATCHET_HEADER`, TBC other. See `cryptoError :: C.CryptoError -> AgentErrorType` for conversion from decryption errors to `A_CRYPTO` or other agent errors. We're only interested in crypto errors, as other are either other client implementation errors, internal errors, or already processed duplicate error.
-
-Proposed classification of crypto errors, based on `AgentCryptoError`:
-
-`DECRYPT_AES` -> re-sync allowed (recommended/required?)
-
-`DECRYPT_CB` -> re-sync allowed (recommended/required?)
-
-`RATCHET_HEADER` -> **re-sync required**
-
-`RATCHET_EARLIER` -> re-sync allowed
-
-`RATCHET_SKIPPED` -> **re-sync required**
-
-Ratchet re-synchronization could be started automatically on diagnosing de-synchronization, based on these errors. As a potentially dangerous feature (e.g., implementation error could lead to infinite re-sync loop causing large traffic consumption), initially it will be available via agent functional api for client to call. Ratchet de-synchronization will instead produce an event prompting client to re-synchronize.
-
-Diagnosing possible ratchet de-synchronization also will be recorded as connection state - `ratchet_desync_state` field in `connections` table. Client should be prohibited to start ratchet re-synchronization unless `ratchet_desync_state` is set.
-
-Event should not be repeated for following received messages that can't be decrypted - based on `ratchet_desync_state`. If a received message can be decrypted, `ratchet_desync_state` should be set to NULL and a new event sent, indicating ratchet has healed.
-
-New event - `RDESYNC :: RatchetDesyncState -> ConnectionStats -> ACommand Agent AEConn`
-
-```haskell
-data RatchetDesyncState
-  = RDResyncAllowed
-  | RDResyncRequired
-  | RDHealed
-```
-
-New field should be added to `ConnectionStats` - `ratchetDesyncState :: Maybe RatchetDesyncState`, based on `ratchet_desync_state`.
-
-> On `RDESYNC` events chat should create chat item, prompting ratchet re-synchronization or notifying it has healed.
-> If connection has diagnosed ratchet de-sync, chat item should have a button to start ratchet re-sync.
-> We'd have to get `ConnectionStats` on chat level for this instead of chat info.
-> This wouldn't work for groups. One option is to add `ConnectionStats` to `GroupMember` type and update on events.
-> Same could be done for `Contact` then.
-
-To consider - allow to start ratchet re-synchronization at any time regardless of this field as an experimental feature. In chat it could be behind "Developer tools" + additional "Experimental" toggle. Agent api would have `force :: Bool` as parameter, allowing to bypass `ratchet_desync_state`. Should `ratchet_resync_state` (see below) still be honored in this case?
-
-### Re-synchronization process
-
-\*\*\*\*\*
-
-Basic idea is the following:
-
-Both agents send new ratchet keys and compute a new shared secret. Agent that starts re-synchronization should record this fact in the connection state. Agent that receives a new key should respond with a key of its own, unless it has recorded that it itself started re-synchronization in the connection state.
-
-It can happen that both agents start re-synchronizing simultaneously. In this case they both would record it in the connection state and would not respond with a new message - instead they would use each other's already sent keys.
-
-Agent has both keys if:
-
- It initiates with the first key, and then receives the second key;
- It receives the first key and then generates its own in response.
-
-After agent has both keys, it initiates new ratchet depending on keys ordering. The agent that sent the lower key should use `initRcvRatchet` function, the agent that sent the greater key should use `initSndRatchet` (or vice versa - but they should deterministically choose different sides).
-
-\*\*\*\*\*
-
-State whether the ratchet re-synchronization is in progress should be tracked in database via `connections` table new `ratchet_resync_state` field.
-
-New functional api:
-
-```haskell
-resyncConnectionRatchet :: AgentErrorMonad m => AgentClient -> ConnId -> m ConnectionStats
-```
-
-or if we want to allow re-synchronizing ratchet at any time even if de-synchronization wasn't diagnosed:
-
-```haskell
-resyncConnectionRatchet :: AgentErrorMonad m => AgentClient -> ConnId -> Bool -> m ConnectionStats
-resyncConnectionRatchet c connId force = ...
-```
-
-Possibly client command?
-
-``` haskell
-data ACommand (p :: AParty) (e :: AEntity) where
-  ...
-  RESYNC_RATCHET :: Bool -> ACommand Client AEConn
-```
-
-New event - `RRESYNC :: RatchetResyncState -> ConnectionStats -> ACommand Agent AEConn`
-
-```haskell
-data RatchetResyncState
-  = RRStarted
-  | RRAgreedSnd
-  | RRAgreedRcv
-  | RRComplete
-```
-
-New `ConnectionStats` field - `ratchetResyncState :: Maybe RatchetResyncState`.
-
-When called, it should:
-
- Generate new keys.
- Update database connection state.
-  - Set `ratchet_desync_state` to NULL.
-  - Set `ratchet_resync_state` to `RRStarted`.
-  - Delete old ratchet from `ratchets` (is it safe?), create new ratchet.
- Send `AgentRatchetKey` message.
- Return updated `ConnectionStats` to client.
-
-> On `RRESYNC` events chat should create chat item, and reset connection verification.
-> Parameterized `RRESYNC` allows to distinguish: start and end of re-synchronization for initiating party; chat item direction - `RRESYNC RRStarted` is snd, `RRESYNC RRAgreedSnd/Rcv` and `RRESYNC RRComplete` are rcv (`RRESYNC RRAgreedSnd/Rcv` chat item could be omitted).
-
-AgentRatchetKey is a new message on the level of AgentMsgEnvelope - encrypted with queue level e2e encryption, but not with connection level e2e encryption (since ratchet de-synchronized).
-
-```haskell
-data AgentMsgEnvelope
-  = ...
-  | AgentRatchetKey
-      { agentVersion :: Version,
-        e2eEncryption :: E2ERatchetParams 'C.X448,
-        info :: ByteString -- for extension
-      }
-```
-
-On receiving `AgentRatchetKey`, if the receiving client hasn't started the ratchet re-synchronization itself (check `ratchet_resync_state`), it should:
-
- Generate new keys and compute new shared secret, initializing ratchet based on keys comparison.
- Update database connection state.
-  - Set `ratchet_resync_state` to `RRAgreedSnd/Rcv` (depending on whether ratchet was initialized as sending or receiving).
-  - Delete old ratchet from `ratchets`, create new ratchet.
- Reply with its own `AgentRatchetKey`.
- Notify client with `RRESYNC RRAgreedSnd/Rcv`.
- If ratchet was initialized as sending, send `EREADY` message, notifying other agent ratchet is re-synced.
-
-New agent message:
-
-```haskell
-data AMessage
-  = ...
-  | -- ratchet re-synchronization is complete, with last decrypted sender message id
-    EREADY PrevExternalSndId
-```
-
-On receiving `AgentRatchetKey`, if the receiving client started re-sync:
-
- Compute new shared secret, initializing ratchet based on keys comparison.
- Update database connection state.
-  - Set `ratchet_resync_state` to `RRAgreedSnd/Rcv` (depending on whether ratchet was initialized as sending or receiving).
-  - Update ratchet.
- Notify client with `RRESYNC RRAgreedSnd/Rcv`.
- If ratchet was initialized as sending, send `EREADY` message.
-
-After agent receives `EREADY` (or any other message that successfully decrypts):
-
- Reset `ratchet_resync_state` to NULL.
- Notify client with `RRESYNC RRComplete`.
- If ratchet was initialized as receiving, send reply `EREADY` message.
-
-### State transitions
-
-For initiating party:
-
-```
-    +------------+
-    | Ratchet ok |
-    +------------+
-          |
-          | message received, decryption error
-   * ---->|-----------------------------------+
-          |                                   |
-          V          new (clarifying)         V
-  +-----------------+     error      +------------------+
-  | Re-sync allowed |--------------->| Re-sync required |
-  +-----------------+                +------------------+
-          |                                   |
-          |-----------------------------------|
-          |                                   | alternative - message received,
-          | re-sync started by client         | successfully decrypted
-          V                                   V
-  +-----------------+                   +------------+
-  | Re-sync started |                   | Ratchet ok |
-  +-----------------+                   +------------+
-          |
-          | other party replied with new ratchet key
-          V
-  +----------------+
-  | Re-sync agreed |----> * message received, decryption error
-  |   snd / rcv    |        (should remember agreed state for reply EREADY?)
-  +----------------+
-          |
-          | message received, successfully decrypted
-          | (can be, but not necessarily, EREADY)
-          V
-    +------------+
-    | Ratchet ok |
-    +------------+
-```
-
-For replying party:
-
-```
-    +------------+
-    | Ratchet ok |
-    +------------+
-          |
-          | other party sent new ratchet key
-          V
-  +----------------+
-  | Re-sync agreed |
-  |   snd / rcv    |
-  +----------------+
-          |
-          | message received, successfully decrypted
-          | (can be, but not necessarily, EREADY)
-          V
-    +------------+
-    | Ratchet ok |
-    +------------+
-```
-
-### Ratchet state model
-
-#### 2 state variables
-
-Above we considered model with separate de-sync and re-sync state.
-
-| Desync \ Resync      | Nothing | RRStarted | RRAgreedSnd | RRAgreedRcv |
-| ---                  |  :---:  |   :---:   |    :---:    |    :---:    |
-| **Nothing**          | 1       | 3         | 4           | 4           |
-| **RDResyncAllowed**  | 2       |           | 5           | 5           |
-| **RDResyncRequired** | 2       |           | 5           | 5           |
-
-1: Ratchet is ok.
-
-2: Re-sync diagnosed, not in progress.
-
-3: Rs-sync started, diagnosing de-sync is prohibited.
-
-4: Re-sync agreed.
-
-5: Re-sync agreed, new de-sync is diagnosed.
-
-Combination 5 is possible in case de-sync was diagnosed before message that could be decrypted is received, for example if `EREADY` failed to deliver and no other decryptable message followed. We shouldn't prohibit diagnosing de-sync in this case, because agent may never exit "Agreed" state (if new decryptable message is never received). We also shouldn't overwrite/forget state of re-sync, even if we diagnose new possible de-sync, because if the decryptable `EREADY` is received and ratchet is in `RRAgreedRcv` state, it should respond with reply `EREADY`.
-
-Some combinations should be impossible:
-
-  - `RDResyncAllowed` with `RRStarted`.
-
-  - `RDResyncRequired` with `RRStarted`.
-
-`RDHealed` is equivalent to `Nothing` and only used for `RDESYNC` event, `Maybe RatchetDesyncState` can be replaced with `RatchetDesyncState`, with single new constructor `RDNoDesync` replacing `Nothing` and `RDHealed`.
-
-`RRComplete` is equivalent to `Nothing` and only used for `RRESYNC` event, `Maybe RatchetResyncState` can be replaced with `RatchetResyncState`, with single new constructor `RDNoResync` replacing `Nothing` and `RRComplete`.
-
-#### Single state variable
-
-Another option is two have a single state variable describing ratchet.
-
-```haskell
-data RatchetState
-  = RSOk
-  | RSResyncAllowed
-  | RSResyncRequired
-  | RSResyncStarted
-  | RRResyncAgreedSnd
-  | RRResyncAgreedRcv
-
-- When `resyncConnectionRatchet` is not prohibited. Can override with `force`.
-- Currently we check:`(isJust ratchetDesyncState || force) && ratchetResyncState /= Just RRStarted`.
-resyncConnectionRatchetAllowed :: RatchetState -> Bool
-resyncConnectionRatchetAllowed = \case
-  RSOk -> False
-  RSResyncAllowed -> True
-  RSResyncRequired -> True
-  RSResyncStarted -> False -- `force` shouldn't override
-  RRResyncAgreedSnd -> False
-  RRResyncAgreedRcv -> False
-
-- When we register and notify about ratchet de-synchronization.
-- Currently we check: `(isNothing ratchetDesyncState && ratchetResyncState /= Just RRStarted)`.
-- We should also allow to update from Allowed to Required.
-shouldNotifyRDESYNC :: RatchetState -> Bool
-shouldNotifyRDESYNC = \case
-  RSOk -> True
-  RSResyncAllowed -> False -- only if new error implies Required
-  RSResyncRequired -> False
-  RSResyncStarted -> False
-  RRResyncAgreedSnd -> True
-  RRResyncAgreedRcv -> True
-
-- When we prohibit connection switch, for `checkRatchetDesync`.
-- Currently we check: `(ratchetDesyncState == Just RDResyncRequired || ratchetResyncState == Just RRStarted)`
-- Also use in `runSmpQueueMsgDelivery` to pause delivery?
-ratchetDesynced :: RatchetState -> Bool
-ratchetDesynced = \case
-  RSOk -> False
-  RSResyncAllowed -> False
-  RSResyncRequired -> True
-  RSResyncStarted -> True
-  RRResyncAgreedSnd -> False
-  RRResyncAgreedRcv -> False
-```
-
-Having a single state variable limits differentiation described for combination 5 in matrix. It also limits possible differentiations in client between events when ratchet is healed on its own, and when ratchet re-sync is completed after agents negotiation. Overall, since matrix is not very sparse and allows for more fine-grained decision-making, having separate state variables for de-sync and re-sync seems preferred.
-
-#### Single state variable simplified (final version)
-
-```haskell
-data RatchetSyncState
-  = RSOk
-  | RSAllowed
-  | RSRequired
-  | RSStarted
-  | RSAgreed
-
-- event
-RSYNC :: RatchetSyncState -> ConnectionStats -> ACommand Agent AEConn`
-
-- ConnectionStats field
-ratchetSyncState :: RatchetSyncState
-```
-
-Updated design decisions:
-
-1. Single constructor for "Agreed" state. Differentiating `RRResyncAgreedSnd` and `RRResyncAgreedRcv` allowed for easier processing of `EREADY` by helping to determine whether reply `EREADY` has to be sent. However, it duplicated information already present in ratchet's state, and can be instead worked around by remembering and analyzing ratchet state pre decryption.
-
-2. Prohibit transition from "Agreed" state to "Desync" states. This would make possible edge-cases that leave ratchet in de-synchronized state without ability to progress (e.g. failed delivery of `AgentRatchetKey`), but would simplify state machine by removing dedicated "Desync" variable. Besides, there's still a recovery way with a `force` option.
-
-3. Treat "Agreed" as unfinished state - prohibit new messages to be enqueued, etc. Reception of any decryptable message transitions ratchet to "Ok" state.
-
-Possible improvements:
-
- Repeatedly triggering re-synchronization while in "Started"/"Agreed" state re-sends same keys and EREADY.
- Cooldown period, during which repeat re-synchronization is prohibited.
-
-### Skipped messages
-
-Options:
-
-1. Ignore skipped messages.
-2. Stop sending new messages while connection re-synchronizes (can use `ratchet_resync_state`).
-
- Initiator shouldn't send new messages until receives `AgentRatchetKey` from second party.
- Second party knows new shared secret immediately after processing first `AgentRatchetKey`, so it's not necessary to limit?
-
-3. 2 + Re-send skipped messages first.
-
- Add `last_external_snd_msg_id` to `AgentRatchetKey`? + see link above
-
-4. Re-send only messages after the latest ratchet step. \*
-
-It may be okay to ignore skipped messages, or at most implement option 2, as ratchet de-synchronization is usually caused by misuse (human error) - the most common cause of ratchet de-sync seems to be sending and receiving messages after running agent with old database backup. In this case user has already seen most skipped messages, and it can be expected to not have them after switching to an old backup. So in this case the only "really skipped" messages are those that were sent during the latest ratchet step and failed to decrypt, triggering ratchet re-sync (\* another option is to only re-send those).
-
-Besides, depending on time of backup there may be an arbitrary large number of skipped messages, which may consume a lot of traffic and may halt delivery of up-to-date messages for some time.
-
-It may be better to have request for repeat delivery as a separate feature, that can be requested in necessary contexts - for example for group stability.
-
-Can servers delivery failure lead to de-sync? If message is lost on server and never delivered, ratchet wouldn't advance, so there's no room for de-sync? If yes, re-evaluate.
@@ -1,240 +0,0 @@
-# Protecting IP addresses of the users from their contacts
-
-## Problem
-
-SMP protocol relays are chosen and can be controlled by the message recipients. It means that the recipients can find out IP addresses of message senders by modifying SMP relay code (or by using proxies and timing correlation), unless the senders use VPN or some overlay network. Tor is an audequate solution in most cases to mitigate it, but it requires additional technical knowledge to install and configure (even installing Orbot on Android is seen as "complex" by many users), and reduces usability because of higher latency.
-
-The lack of in-built IP address protection is the main concern of many users, particularly given that most people do not realise that it is lacking by default - without transport protection SimpleX is not perceived as a "whole product".
-
-Similarly, XFTP protocol relays are chosen by senders, and they can be used to detect file recipients' IP addresses.
-
-## Possible solutions
-
-1. Embed Tor in the client.
-
-Pros:
- no changes in the protocols/servers
- acceptable threat model for most users
- removes complexity of installing and configuring Tor
- probably, the most attractive option for Tor users
-
-Cons:
- higher latency and error rate
- higher resource usage
- requires us updating Tor client regularly
- restriction on Tor usage in some networks, so it would require supporting bridges in the app UI
- legislative restrictions on Tor usage, so it may require supporting multiple app versions, and won't solve the problem where Tor is not embedded
-
-2. Thin clients with hosted accounts.
-
-Host some part of the current client on the server and have another part running on the devices.
-
-Pros:
- substantially reduces the traffic for mobile clients
- probably the most attractive option for mass market users who expect to have an account on the server and be able to access it from multiple devices and via web.
-
-Cons:
- a lot of design and development
- makes accounts visible to the server
- the new protocol design to protect connections graph and message content from the hosting server.
- quite different threat model
-
-Overall, this is not a viable or even appropriate option for the current stage.
-
-3. SMP / XFTP proxy.
-
-Introduce SMP and XFTP protocol extenstions to allow message senders and file recipients to delegate the tasks of sending messages and receiving files to the proxies, so that peer-chosen relays can only observe IP addresses of the proxies and not of the users.
-
-Pros:
- no dependency on and lower latency than via Tor
- reduces client traffic, both due to retries handled by these proxies and due to the smaller number of connections to the peer-chosen relays. The flip side is that additional commands (and traffic) are needed to create the sessions with relays.
- higher transport privacy: protects IP addresses from peers and makes transport correlation harder.
- additional function: retrying pending messages, while the queue is not secured yet, without extra traffic for the clients.
- improves current threat model by preventing session-based correlation of the traffic by the destination relay (assuming no information sharing with the proxies), as there will be one session between proxy and destination relay, mixing traffic from multiple users.
-
-Cons:
- design and development cost
- can undermine delivery stability
-
-This seems an attractive option, both from technical (reasonable complexity) and positioning (moving SimpleX closer to mix networks, while still avoiding server list visibility) points of view, and it is in the middle between embedding Tor, which would make the product more niche and has downsides and development costs too, and thin clients, which is 10x+ more work, and also creates a different threat model, that is not very attractive for the current stage and users.
-
-Below considers this design.
-
-## SMP/XFTP proxy design
-
-### Design requirements
-
-1. To avoid increasing the complexity of self-hosting, we should not create additional server types, and existing SMP and XFTP servers should be extended to provide proxy functions.
-
-2. SMP proxy should not be able to observe queue addresses and their count on the destination relays. This requirement is not needed for XFTP proxies, as each file chunk is downloaded only once, so there is no need to hide its address.
-
-3. There must be no identifiers and cyphertext in common in outgoing and incoming traffic inside TLS (the current designs have this quality).
-
-4. Traffic between the client and destination relays must be e2e encrypted, with MITM-by-proxy mitigated, relying on the relay identity (certificate fingerprint), ideally without any additional fingerprint in relay address.
-
-5. SMP proxy should implement retry logic and hold messages while they are delivered. They also should return relay replies to the client. To avoid any additional traffic the client should just add "sent to proxy" status and only show "sent" once proxy returns the response from the destination relay - there should be no additional response from the proxy confirming acceptance to delivery.
-
-This would also reduce the difference in how the traffic looks to the observer - sending via proxy may look similar to sending to the usual server (which can be further supported by friendly destination relays that could add latency for direct requests and reply quickly when response came via proxy and be undermined by hostile relays that would introduce some latency pattern to help traffic correlation. The latter problem can be mitigated by having a fixed response latency from proxy that may be "come back later for destination response").
-
-6. Sending messages to groups have to be batched in the client to avoid multiple requests for destination relay sessions - such requests can be batched to proxy, even though it leaks _some_ metadata - which destination relays are used by a given sender's IP address, it also reduces the overhead from proxies – it could be an option based on the privacy slider.
-
-6. SMP proxy may also increase utility and privacy of the platform:
-
- holding messages and retrying them for the new connections while the receiving queue is not secured yet.
- add delays in message delivery to make traffic correlation harder (same can be done in SMP relays).
-
-### Implementation considerations
-
-1. Block size. Possibly, there is not enough spare capacity in the current 16kb block to fit additional headers, any necessary metadata and encryption authentication tags, in which case we cannot send SMP and SMP-proxy traffic in the same transport connection (in case the same server plays both roles). In which case we will need to negotiate role during connection handshake and define a different (sub-)protocol for SMP-proxy.
-
-2. To be decided if we see it as extension of SMP protocol or as another protocol, irrespective of whether it's provided by the same or another server. Given different roles and block size it may be simpler to see it as a separate protocol, and which protocol is provided in the connection is determined during handshake.
-
-3. We probably should aim to avoid changing agent/client logic and see it instead as transport concern that can be dynamically decided at a point of sending a message, based on the current configuration.
-
-4. Configuration should probably allow to choose between not using proxies (particularly, during testing, when it would be the default), using proxies only for unknown relays, and using proxies for all relays (extra traffic, but more complex transport correlation - although randomizing this choice can be more beneficial to the transport privacy). The clients can aim to use proxy from another provider, to reduce the risks of sharing the information.
-
-### SMP-proxy protocol
-
-The flow of the messages will be:
-
-1. Client requests proxy to create session with the relay by sending `server` command with the SMP relay address and optional proxy basic AUTH (below). It should be possible to batch multiple session requests into one block, to reduce traffic.
-
-2. Proxy connects to SMP relay, negotiating a shared secret in the handshake that will be used to encrypt all sender blocks inside TLS (proxy-relay encryption). SMP relay also returns in handshake its temporary DH key to agree e2e encryption with the client (sender-relay encryption, to hide metadata sent to the destination relay from proxy).
-
-3. Proxy replies with `server_id` command including relay session ID to identify it in further requests, relay DH key for e2e encryption with the client - this key is signed with the TLS online private key associated with the certificate (its fingerprint is included in the relay address), and the TLS session ID between proxy and relay (this session ID must be used in transmissions, to mitigate replay attacks as before).
-
-A possible attack here is that proxy can use this TLS session to replay commands received from the client. Possibly, it could be mitigated with a bloom filter per proxy/SMP relay connection that would reject the repeated DH keys (that need to be used for replay), and also with DH key expiration (this mitigation should allow some acceptable rate of false positives from the bloom filter).
-
-With 32 bits per key there will be ~1/1,000,000 false positives (see https://en.wikipedia.org/wiki/Bloom_filter), and the filter would use ~32mb per each proxy connection if we reset relay key every 1000000 messages or more frequently. Given that the only commands accepted via relay would be SEND, replaying it would be interpreted by the receiving client as duplicate message delivery, so a small number of replayed messages won't cause any problems. But without mitigation it could be used to flood the receiving SMP relay queues with repeated messages, effectively causing DoS on these queues, even in case when SMP relays require basic auth to create queues.
-
-Given that the client chooses proxy it has some trust to, maybe this replay attack risk can be accepted.
-
-It is important that the same public key from destination relay is returned to all clients, so proxy does not need to repeat this request to know relays while the key did not expire, as using different keys for different clients would allow destination relays to correlate requests to the clients. A proxy that colludes with the destination relay can pass different public keys to the same client, but it is not changing threat model as colluding proxy can share information as well. It is also important that the client uses a new random key for each command, as using the same key would allow the destination relay to identify these commands as comming from the same user, and using a different key for each queue while would protect privacy of the user from the destination relay, would make it visible to the proxy how many different queues the client has on destination relay.
-
-*Unrelated cosideration for SMP protocol privacy improvement*: instead of signing commands to the destination relay, the sender could have a ratchet per queue agreed with the destination relay that would simply use authenticated encryption with per-message symmetric key to encrypt the message on the way to relay, and this encryption would be used as a proof of sender.
-
-4. Now the client sends `forward` to proxy, which it then forwards to SMP relay, applying additional encryption layer.
-
-5. SMP relay sends `response` to proxy applying additional encryption layer, which it then forwards to the client removing the additional encryption layer.
-
-Effectively it works as a simplified two-hop onion routing with the first relay (proxy) chosen by the sending client and the second relay chosen by the recipient, not only protecting senders' IP addresses from the recipients' relays, but also preventing recipients relays from correlating senders' traffic to different queues, as TLS session is owned by the proxy now and it mixes the traffic from multiple senders. To correlate traffic to users, proxy and relay would have to combine their information. SMP relays are still able to correlate traffic to receiving users via transport session.
-
-Sequence diagram for sending the message via SMP proxy:
-
-```
-------------               -------------                     -------------              -------------
-|  sending  |               |    SMP    |                     |    SMP    |              | receiving |
-|  client   |               |   proxy   |                     |   relay   |              |  client   |
-------------               -------------                     -------------              -------------
-     |       `server`             |                                 |                          |
-     | -------------------------> |   create TLS session, get keys  |                          |
-     |                            | ------------------------------> |                          |
-     |        `server_id`         |       (if doesn't exist)        |                          |
-     | <------------------------- |                                 |                          |
-     |                            |                                 |                          |
-     | TLS(F:s2r(SEND(e2e(msg)))) |                                 |                          |
-     | -------------------------> | TLS(F:p2r(s2r(SEND(e2e(msg))))) |                          |
-     |                            | ------------------------------> |                          |
-     |                            |                                 |                          |
-     |                            |     TLS(R:p2r(s2r(OK/ERR)))     |                          |
-     |     TLS(R:s2r(OK/ERR))     | <------------------------------ |                          |
-     | <------------------------- |                                 | TLS(MSG(r2c(e2e(msg))))  |
-     |                            |                                 | -----------------------> |
-     |                            |                                 |                          |
-     |                            |                                 |        TLS(ACK)          |
-     |                            |                                 | <----------------------- |
-     |                            |                                 |                          |
-     |                            |                                 |                          |
-
-```
-
-Below diagram shows the encrypttion layers for `forward` and `response` commands:
-
- s2r (added) - encryption between client and SMP relay, with relay key returned in server_id command, with MITM by proxy mitigated by verifying the certificate fingerprint included in the relay address.
- e2e (exists now) - end-to-end encryption per SMP queue, with double ratchet e2e encryption inside it.
- p2r (added) - additional encryption between proxy and SMP relay with key agreed in the handshake, to mitigate traffic correlation inside TLS. This key could also be signed by the same certificate, if we don't want to rely on TLS security.
- r2c (exists now) additional encryption between SMP relay and client to prevent traffic correlation inside TLS.
-
-```
-----------------             -----------------  -- TLS --  -----------------             -----------------
-|               |  -- TLS --  |               |  -- p2r --  |               |  -- TLS --  |               |
-|               |  -- s2r --  |               |  -- s2r --  |               |  -- r2c --  |               |
-|    sending    |  -- e2e --  |               |  -- e2e --  |               |  -- e2e --  |   receiving   |
-|    client     |     MSG     |   SMP proxy   |     MSG     |   SMP relay   |     MSG     |    client     |
-|               |  -- e2e --  |               |  -- e2e --  |               |  -- e2e --  |               |
-|               |  -- s2r --  |               |  -- s2r --  |               |  -- r2c --  |               |
-|               |  -- TLS --  |               |  -- p2r --  |               |  -- TLS --  |               |
-----------------             -----------------  -- TLS --  -----------------             -----------------
-```
-
-When proxy connects to SMP relay it would indicate in the handshake that it will use proxy protocol and the SMP relay would expect the same `forward` commands and reply with `response`s.
-
-Below syntax aims to fit in 16kb block using spare capacity in SMP protocol.
-
-```abnf
-proxy_block = padded(proxy_transmission, 16384)
-proxy_transmission = corr_id relay_session_id proxy_command
-corr_id = length *8 OCTET
-proxy_command = server / server_id / forward / response / error
-server = "S" address [relay_basic_auth] ; creates transport session between proxy and relay
-server_id = "I" relay_session_id tls_session_id signed_relay_key ;
-    ; session_id is the TLS session ID between proxy and relay, it has to be included inside encrypted block to prevent replay attacks
-forward = %s"F" random_dh_pub_key encrypted_block ; it's important that a new key is used for each command, to prevent any correlation by proxy or by destination relay
-response = %s"R" encrypted_block; response received from the destination SMP relay
-relay_session_id = length *8 OCTET
-error = %s"E" error
-```
-
-The overhead is: 1+8 (corrId) + 1+8 (relay_session_id) + 1 (command) + 1+32 (random_dh_pub_key) + 2 (original length) + 16 (auth tag for e2e encryption) + 16 (auth tag for proxy to relay encryption) = 86 bytes. The reserve for sent messages in SMP is ~84 bytes, so it should about fit with some reduced bytes somewhere.
-
-Another possible design is to allow mixing sent messages and normal SMP commands in the same transport connection, but it can make fitting in the block a bit harder, additional overhead would be: 1 (transmission count) + 2 (transmission size) + 1 (empty signature) = 4 bytes.
-
-The above assumes that the client can only send one message to an SMP relay and then has to wait for response before sending the next message. Missing the response would cause re-delivery (further improvement is possible when proxy detects these redelieveries and not send them to relays but simply reply with the same response).
-
-### Threat model for SMP proxy and changes to threat model for SMP
-
-#### SMP proxy
-
-*can:*
-
- learn a user's IP address, as long as Tor is not used.
-
- learn when a user with a given IP address is online.
-
- know how many messages are sent from a given IP address and to a given destination SMP relay.
-
- drop all messages from a given IP address or to a given destination relay.
-
- unless SMP relay detects repeated public DH keys of senders, replay messages to a destination relay within a single session, causing either duplicate message delivery (which will be detected and ignored by the receiving clients), or, when receiving client is not connected to SMP relay, exhausting capacity of destination queues used within the session.
-
-*cannot:*
-
- perform queue correlation (matching multiple queues to a single user), unless it has additional information from SMP relay.
-
- undetectably add, duplicate, or corrupt individual messages.
-
- undetectably drop individual messages, so long as a subsequent message is delivered.
-
- learn the contents of messages.
-
- learn the destination queues of messages.
-
- distinguish noise messages from regular messages except via timing regularities.
-
- compromise the user's end-to-end encryption with another user via an active attack.
-
- compromise the user's end-to-end encryption with destination relay via an active attack.
-
-#### SMP relay accessed via SMP proxy
-
-*still can:*
-
- perform recipients' queue correlation (matching multiple queues to a single recipient) via either a re-used transport connection, user's IP Address, or connection timing regularities
-
-*no longer can:*
-
- perform senders' queue correlation (matching multiple queues to a single sender) via either a re-used transport connection, user's IP Address, or connection timing regularities, unless it has additional information from SMP proxy.
-
- learn a sender's IP address, track them through other IP addresses they use to access the same queue, and infer information (e.g. employer) based on the IP addresses, even if Tor is not used.
-
-The rest of the threat model for SMP relays remains the same as in [overview](../protocol/overview-tjr.md#simplex-messaging-protocol-server).
@@ -1,361 +0,0 @@
-# SimpleX Remote Control protocol
-
-Using profiles in SimpleX Chat mobile app from desktop app with minimal risk to the security/threat model of SimpleX protocols.
-
-## Problem
-
-Synchronizing profiles that use double ratchet for e2e encryption is effectively impossible in a way that tolerates partitioning between devices without reducing security of double ratchet.
-
-We are not considering replacing (or weakening) double ratchet to allow profile synchronization, as some other messengers did (e.g., Session). We are also not considering Signal model, when profile is known to the server and adding devices results in changing security code and no visibility of conversation history, as it would be substantially different from the current model, and also effectively weakens the security, as in practives most users don't revalidate security codes when they change.
-
-## Solution
-
-The proposed solution is a new remote access/control protocol, when the application on host device (usually mobile) acts as a server, and application on another device (usually desktop) acts as a controller usually running in the same local network.
-
-Existing service discovery and remote control protocols known to us are vulnerable to spoofing, spamming and MITM attacks. This design aims to solve these problems.
-
-## Requirements
-
- Strong, cryptographically verified identity of the controller device, with the initial connection requiring out-of-band communication of public keys (QR code or link).
- Identity verification of the host device during session handshake.
- Protection against malicious "controllers" trying to make host connect to them instead of valid controller on the same network.
- Protection against replay attacks, both during discovery and during control session.
- Additional encryption layer inside TLS, with post-quantum algorithm in key agreement.
- Protect host device from unauthorized access in case of controller compromise.
- Post-compromised security - that is, even if long term secrets were copied from the controller, and host device was made to connect to malicious controller device, prevent malicious controller from accessing the host device data.
- Allow general high-level interactions common for many applications:
-  - RPC pattern for commands executed by the host application.
-  - Events sent by host to update controller UI.
-  - Uploading and downloading files between host and controller, either to be processed by the host or to be presented in the controller UI.
-
-This design will allow application-level protocol that is quite close to how SimpleX Chat UI interacts with SimpleX Chat core - there is a similar RPC + events protocol and support for files. The application-level protocol is out of scope of this specification.
-
-## Protocol phases
-
-Protocol consists of four phases:
- controller session invitation
- establishing session TLS connection
- session verification and protocol negotiation
- session operation
-
-### Session invitation
-
-The invitation to the first session between host and controller pair MUST be shared out-of-band, to establish a long term identity keys/certificates of the controller to host device.
-
-The subsequent sessions can be announced via an application-defined site-local multicast group, e.g. `224.0.0.251` (also used in mDNS/bonjour) and an application-defined port (SimpleX Chat uses 5227).
-
-The session invitation contains this data:
- supported version range for remote control protocol
- application-specific information, e.g. device name, application name and supported version range, settings, etc.
- session start time in seconds since epoch
- if multicast is used, counter of announce packets sent by controller
- network address (ipv4 address and port) of the controller
- CA TLS certificate fingerprint of the controller - this is part of long term identity of the controller established during the first session, and repeated in the subsequent session announcements.
- Session Ed25519 public key used to verify the announcement and commands - this mitigates the compromise of the long term signature key, as the controller will have to sign each command with this key first.
- Long-term Ed25519 public key used to verify the announcement and commands - this is part of the long term controller identity.
- Session X25519 DH key and sntrup761 KEM encapsulation key to agree session encryption (both for multicast announcement and for commands and responses in TLS), as described in https://datatracker.ietf.org/doc/draft-josefsson-ntruprime-hybrid/. The new keys are used for each session, and if client key is already available (from the previous session), the computed shared secret will be used to encrypt the announcement multicast packet. The out-of-band invitation is unencrypted. These DH public key and KEM encapsulation key are always sent unencrypted. NaCL Cryptobox is used for encryption.
-
-Host device decrypts (except the first session) and validates the invitation:
- Session signature is valid.
- Timestamp is within some window from the current time.
- Long-term key signature is valid.
- Long-term CA and signature key are the same as in the first session.
- Some version in the offered range is supported.
-
-OOB session invitation is a URI with this syntax:
-
-```abnf
-sessionAddressUri = "xrcp://" encodedCAFingerprint "@" host ":" port "#/?" qsParams
-encodedCAFingerprint = base64url
-qsParams = param *("&" param)
-param = versionRangeParam / appInfoParam / sessionTsParam /
-        sessPubKeyParam / idPubKeyParam / kemEncKeyParam / dhPubKeyParam /
-        sessSignatureParam / idSignatureParam
-versionRangeParam = "v=" (versionParam / (versionParam "-" versionParam))
-versionParam = 1*DIGIT
-appInfoParam = "app=" escapedJSON ; optional
-sessionTsParam = "ts=" 1*DIGIT
-sessPubKeyParam = "skey=" base64url ; required
-idPubKeyParam = "idkey=" base64url ; required
-dhPubKeyParam = "dh=" base64url ; required
-sessSignatureParam = "ssig=" base64url ; required, signs the URI with this and idSignatureParam param removed
-idSignatureParam = "idsig=" base64url ; required, signs the URI with this param removed
-base64url = <base64url encoded binary> ; RFC4648, section 5
-```
-
-Multicast session announcement is a binary encoded packet with this syntax:
-
-```abnf
-sessionAddressPacket = dhPubKey nonce encrypted(unpaddedSize sessionAddress packetPad)
-dhPubKey = length x509encoded ; same as announced
-nonce = length *OCTET
-sessionAddress = largeLength sessionAddressUri ; as above
-length = 1*1 OCTET ; for binary data up to 255 bytes
-largeLength = 2*2 OCTET ; for binary data up to 65535 bytes
-packetPad = <pad packet size to 1450 bytes> ; possibly, we may need to move KEM agreement one step later,
-; with encapsulation key in HELLO block and KEM ciphertext in reply to HELLO.
-```
-
-### Establishing session TLS connection
-
-Host connects to controller via TCP session and validates CA credentials during TLS handshake. Controller acts as a TCP server in this connection, to avoid host device listening on a port, which might create an attack vector. During TLS handshake the controller's TCP server MUST present a self-signed two-certificate chain where the fingerprint of the first certificate MUST be the same as in the announcement.
-
-Host device presents its own client certificate chain with CA representing a long-term identity of the host device.
-
-### Session verification and protocol negotiation
-
-Once TLS session is established, both the host and controller device present a "session security code" to the user who must match them (e.g., visually or via QR code scan) and confirm on the host device. The session security code must be a digest of tlsunique channel binding. As it is computed as a digest of the TLS handshake for both the controller and the host, it will validate that the same TLS certificates are used on both sides, and that the same TLS session is established, mitigating the possibility of MITM attack in the connection.
-
-Once the session is confirmed by the user, the host device sends "hello" block to the controller. ALPN TLS extension is not used to obtain tlsunique prior to sending any packets.
-
-Block size should be 16384 bytes.
-
-Host HELLO must contain:
- new session DH key - used to compute new shared secret with the controller keys from the announcement.
- encrypted part of hello block (JSON object), containing:
-  - chosen protocol version.
-  - host CA TLS certificate fingerprint - part of host long term identity - must match the one presented in TLS handshake and the previous sessions, otherwise the connection is terminated.
-  - KEM encapsulation key - used to compute new shared secret for the session.
-  - additional application specific parameters, e.g host device name, application version, host settings or JSON encoding format.
-
-Hello block syntax:
-
-```abnf
-hostHello = unpaddedSize %s"HELLO " dhPubKey nonce encrypted(unpaddedSize hostHelloJSON helloPad) pad
-unpaddedSize = largeLength
-dhPubKey = length x509encoded
-pad = <pad block size to 16384 bytes>
-helloPad = <pad hello size to 12888 bytes>
-largeLength = 2*2 OCTET
-```
-
-Controller decrypts (including the first session) and validates the received hello block:
- Chosen versions are supported (must be within offered ranges).
- CA fingerprint matches the one presented in TLS handshake and the previous sessions - in subsequent sessions TLS connection should be rejected if the fingerprint is different.
-
-JTD schema for the encrypted part of host HELLO block `hostHelloJSON`: 
-
-```json
-{
-  "definitions": {
-    "version": {
-      "type": "string",
-      "metadata": {
-        "format": "[0-9]+"
-      }
-    },
-    "base64url": {
-      "type": "string",
-      "metadata": {
-        "format": "base64url"
-      }
-    }
-  },
-  "properties": {
-    "v": {"ref": "version"},
-    "ca": {"ref": "base64url"},
-    "kem": {"ref": "base64url"}
-  },
-  "optionalProperties": {
-    "app": {"properties": {}, "additionalProperties": true}
-  },
-  "additionalProperties": true
-}
-```
-
-Controller should reply with with `hello` or `error` response:
-
-```abnf
-ctrlHello = unpaddedSize %s"HELLO " kemCyphertext nonce encrypted(unpaddedSize ctrlHelloJSON helloPad) pad
-; ctrlHelloJSON is encrypted with the hybrid secret,
-; including both previously agreed DH secret and KEM secret from kemCyphertext
-unpaddedSize = largeLength
-kemCyphertext = largeLength *OCTET
-pad = <pad block size to 16384 bytes>
-helloPad = <pad hello size to 12888 bytes>
-largeLength = 2*2 OCTET
-
-ctrlError = unpaddedSize %s"ERROR " nonce encrypted(unpaddedSize ctrlErrorJSON helloPad) pad
-; ctrlErrorJSON is encrypted using previously agreed DH secret.
-```
-
-JTD schema for the encrypted part of controller HELLO block `ctrlHelloJSON`:
-
-```json
-{
-  "properties": {},
-  "additionalProperties": true
-}
-```
-
-JTD schema for the encrypted part of controller ERROR block `ctrlErrorJSON`:
-
-```json
-{
-  "properties": {
-    "message": {"type": "string"}
-  },
-  "additionalProperties": true
-}
-```
-
-Once controller replies HELLO to the valid host HELLO block, it should stop accepting new TCP connections.
-
-
-### Сontroller/host session operation
-
-The protocol for communication during the session is out of scope of this protocol.
-
-SimpleX Chat will use HTTP2 encoding, where host device acts as a server and controller acts as a client (these roles are reversed compared with TLS connection).
-
-Payloads in the protocol must be encrypted using NaCL cryptobox using the hybrid shared secret agreed during session establishment.
-
-Commands of the controller must be signed after the encryption using the controller's session and long term Ed25519 keys.
-
-tlsunique channel binding from TLS session MUST be included in commands (included in the signed body).
-
-The syntax for encrypted command and response body encoding:
-
-```
-commandBody = encBody sessSignature idSignature (attachment / noAttachment)
-responseBody = encBody attachment; should match counter in the command
-encBody = nonce encLength32 encrypted(tlsunique counter body)
-attachment = %x01 nonce encLength32 encrypted(attachment)
-noAttachment = %x00
-tlsunique = length 1*OCTET
-counter = 8*8 OCTET ; int64
-encLength32 = 4*4 OCTET ; uint32, includes authTag
-```
-
-If the command or response includes attachment, it's hash must be included in command/response and validated.
-
-## Key agreement for announcement packet and for session
-
-Initial announcement is shared out-of-band (URI with xrcp scheme), and it is not encrypted.
-
-This announcement contains only DH keys, as KEM key is too large to include in QR code, which are used to agree encryption key for host HELLO block. The host HELLO block will containt DH key in plaintext part and KEM encapsulation (public) key in encrypted part, that will be used to determine the shared secret (using SHA256 over concatenated DH shared secret and KEM encapsulated secret) both for controller HELLO response (that contains KEM cyphertext in plaintext part) and subsequent session commands and responses.
-
-During the next session the announcement is sent via encrypted multicast block. The shared key for this announcement and for host HELLO block is determined using the KEM shared secred from the previous session and DH shared secret computed using the host DH key from the previous session and the new controller DH key from the announcement.
-
-For the session, the shared secred is computed again using the KEM shared secret encapsulated by the controller using the new KEM key from the HOST hello block and DH shared secret computed using the host DH key from HELLO block and the new controller DH key from the announcement.
-
-To describe it in pseudocode:
-
-```
-// session 1
-hostHelloSecret(1) = dhSecret(1)
-sessionSecret(1) = sha256(dhSecret(1) || kemSecret(1)) // to encrypt session 1 data, incl. controller hello
-dhSecret(1) = dh(hostHelloDhKey(1), controllerInvitationDhKey(1))
-kemCiphertext(1) = enc(kemSecret(1), kemEncKey(1))
-// kemEncKey is included in host HELLO, kemCiphertext - in controller HELLO
-kemSecret(1) = dec(kemCiphertext(1), kemDecKey(1))
-
-// multicast announcement for session n
-announcementSecret(n) = sha256(dhSecret(n'))
-dhSecret(n') = dh(hostHelloDhKey(n - 1), controllerDhKey(n))
-
-// session n
-hostHelloSecret(n) = dhSecret(n)
-sessionSecret(n) = sha256(dhSecret(n) || kemSecret(n)) // to encrypt session n data, incl. controller hello
-dhSecret(n) = dh(hostHelloDhKey(n), controllerDhKey(n))
-// controllerDhKey(n) is either from invitation or from multicast announcement
-kemCiphertext(n) = enc(kemSecret(n), kemEncKey(n))
-kemSecret(n) = dec(kemCiphertext(n), kemDecKey(n))
-```
-
-If controller fails to store the new host DH key after receiving HELLO block, the encryption will become out of sync and the host won't be able to decrypt the next announcement. To mitigate it, the host should keep the last session DH key and also previous session DH key to try to decrypt the next announcement computing shared secret using both keys (first the new one, and in case it fails - the previous).
-
-To decrypt multicast announcement, the host should try to decrypt it using the keys of all known (paired) remote controllers.
-
-## Other options
-
-The proposed design has these pros/cons:
-
-Pros:
- mobile host that has sensitive data doesn't act as TLS server.
- multicast is optional - all sessions can happen via QR code only.
-
-Cons:
- reversing of client/server roles between TLS and HTTP2.
- in the first session mobile host TLS client credentials are verified after TLS connection is accepted.
- cannot be used with host that runs in VM.
-
-The alternative design will use mobile host device as TLS server. The session negotiation process:
-
- desktop shares its initial credentials via QR code, only for the first session
- mobile sends encrypted multicast with session address, TLS CA fingerprint, DH key in clear text
- desktop connects to mobile
- session tlsunique presented to users on both devices - either user would have to confirm session on both devices or the mobile would have to send an additional "ready" block.
-
-Pros:
- no reversing server role between TLS and HTTP2
- TLS credentials are exchanged before TLS, so invalid credentials can be rejected during the handshake of the first session.
- if some other way to pass data from host to controller is added, then it can be used with host running in VM.
-
-Cons:
- multicast is mandatory, as there is no efficient way to communicate from mobile to desktop.
- still needs hello or confirmation on both devices
- mobile is now acting as TLS server creating additional attack vector
-
-In both proposed and alternative design mobile host has chat data, acts as HTTP2 server, commands are signed with desktop key presented out-of–band, and both commands and responses are encrypted inside TLS session.
-
-Other considered options:
- SSH - more work integrating it.
- use SMP connection to negotiate TLS session - it seems wrong to require Internet connection to negotiate a local network connection between desktop and mobile.
- other multicast service discovery protocols - quite insecure.
-
-## Threat model
-
-#### A passive network adversary able to monitor the site-local traffic:
-
-*can:*
- observe session times, duration and volume of the transmitted data between host and controller.
-
-*cannot:*
- observe the content of the transmitted data.
- substitute the transmitted commands or responses.
- replay transmitted commands or events from the hosts.
-
-#### An active network adversary able to intercept and substitute the site-local traffic:
-
-*can:*
- prevent host and controller devices from establishing the session
-
-*cannot:*
- same as passive adversary, provided that user visually verified session code out-of-band.
-
-#### An active adversary with the access to the network:
-
-*can:*
- spam controller device.
-
-*cannot:*
- compromise host or controller devices.
-
-#### An active adversary with the access to the network who also observed OOB announcement:
-
-*can:*
- connect to controller instead of the host.
- present incorrect data to the controller.
-
-*cannot:*
- connect to the host or make host connect to itself.
-
-#### Compromised controller device:
-
-*can:*
- observe the content of the transmitted data.
- access any data of the controlled host application, within the capabilities of the provided API.
-
-*cannot:*
- access other data on the host device.
- compromise host device.
-
-#### Compromised host device:
-
-*can:*
- present incorrect data to the controller.
- incorrectly interpret controller commands.
-
-*cannot:*
- access controller data, even related to this host device.
@@ -1,36 +0,0 @@
-# Post-quantum double ratchet implementation
-
-See [the previous doc](https://github.com/simplex-chat/simplex-chat/blob/stable/docs/rfcs/2023-09-30-pq-double-ratchet.md).
-
-The main implementation consideration is that it should be both backwards and forwards compatible, to allow changing the connection DR to/from using PQ primitives (although client version downgrade may be impossible in this case), and also to decide whether to use PQ primitive on per-connection basis:
- use without links (in SMP confirmation or in SMP invitation via address or via member), don't use with links (as they would be too large).
- use in small groups, don't use in large groups.
-
-Also note that for DR to work we need to have 2 KEMs running in parallel.
-
-Possible combinations (assuming both clients support PQ):
-
-| Stage        | No PQ kem | PQ key sent | PQ key + PQ ct sent |
-|:------------:|:---------:|:-----------:|:-------------------:|
-| inv   | + | + | - |
-| conf, in reply to:   <br>no-pq inv <br>pq inv        | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+ |
-| 1st msg, in reply to:<br>no-pq conf<br>pq/pq+ct conf | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+ |
-| Nth msg, in reply to:<br>no-pq msg <br>pq/pq+ct msg  | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+ |
-
-These rules can be reduced to:
-1. initial invitation optionally has PQ key, but must not have ciphertext.
-2. all subsequent messages should be allowed without PQ key/ciphertext, but:
-  - if the previous message had PQ key or PQ key with ciphertext, they must either have no PQ key, or have PQ key with ciphertext (PQ key without ciphertext is an error).
-  - if the previous message had no PQ key, they must either have no PQ key, or have PQ key without ciphertext (PQ key with ciphertext is an error).
-
-The rules for calculating the shared secret for received/sent messages are (assuming received message is valid according to the above rules):
-
-|   sent msg ><br>V received msg | no-pq       | pq      | pq+ct           |
-|:------------------------------:|:-----------:|:-------:|:---------------:|
-| no-pq                          | DH / DH     | DH / DH | err             |
-| pq (sent msg was NOT pq)       | DH / DH     | err     | DH / DH+KEM     |
-| pq+ct (sent msg was NOT no-pq) | DH+KEM / DH | err     | DH+KEM / DH+KEM |
-
-To summarize, the upgrade to DH+KEM secret happens in a sent message that has PQ key with ciphertext sent in reply to message with PQ key only (without ciphertext), and the downgrade to DH secret happens in the message that has no PQ key.
-
-The type for sending PQ key with optional ciphertext is `Maybe E2ERachetKEM` where `data E2ERachetKEM = E2ERachetKEM KEMPublicKey (Maybe KEMCiphertext)`, and for SMP invitation it will be simply `Maybe KEMPublicKey`. Possibly, there is a way to encode the rules above in the types, these types don't constrain possible transitions to valid ones.
@@ -1,73 +0,0 @@
-# Sending large file descriptions
-
-It is desirable to provide a QR code/URI from which a file can be downloaded. This way files may be addressed outside a chat client.
-Currently the `xftp` CLI tool can generate YAML file descriptions that can be used to receive a file.
-It is possible to pass such a description as an URI, but descriptions for files larger than ~8 MBs (two 4 MB chunks) would give QR codes that are difficult to process.
-A user can manually upload description and get a shorter one. Typically descriptions for files that are up to ~20 GBs would still be small enough to not require another pass, and that is way beyond any current (or, reasonable, fwiw) limitations.
-
-It is possible to streamline this process, so any application using simplexmq agent can easily send file descriptions and follow redirects.
-A file description with a redirect contains an extra field with final file size and digest so it can be followed automatically.
-
-The flow would be like this:
-
- Sending:
-  1. Upload file as usual with `xftpSendFile`, get recipient file descriptions in `SFDONE` message.
-  2. Upload one of the file descriptions with `xftpSendDescription`, get its redirect-description in its `SFDONE` message.
-  3. Wrap in `FileDescriptionURI` and use `strEncode` to get a QR-sized URI.
-  4. Show QR code / copy link.
- Receiving:
-  1. Scan QR code / paste link.
-  2. Use `strDecode` and unwrap `FileDescriptionURI` to get `ValidFileDescription 'FRecipient`.
-  3. Download it as usual with `xftpReceiveFile`, getting `RFDONE` message when the file is fully received.
-
-It is not necesary to use redirect description if original description can be encoded to fit in 1002 characters. Beyond this size there is a significant jump in QR code complexity.
-It is possible to call `encodeFileDescriptionURI` right after upload to test if the URI fits and skip step 2.
-When `xftpReceiveFile` receives a decoded description that lacks `redirect` field, the procedure for downloading a file is the same as usual - download chunks and reassemble local file.
-
-## Agent changes
-
-### Sending
-
-Sending and receiving files in agent is a multi-step process mediated by DB entries in `snd_files` and `rcv_files` tables.
-
-`xftpSendDescription` is tasked with storing original description in a temporary locally-encrypted file, then creating upload task for it.
-
-It is necessary to preserve redirect metadata so it can be attached to descriptions in the `SFDONE` message sent by a worker:
-
-```sql
-ALTER TABLE snd_files ADD COLUMN redirect_size INTEGER;
-ALTER TABLE snd_files ADD COLUMN redirect_digest BLOB;
-```
-
-### Receiving
-
-`xftpReceiveFile` gets a file description as an argument and knows if it should follow redirect procedure or run an ordinary download.
-For redirects it will prepare a `RcvFile` for redirect and then a placeholder, for the final file.
-Agent messages would be sent using the entity ID of the final file, which is stored along with redirect metadata in `RcvFile` for the redirect.
-
-```sql
-ALTER TABLE rcv_files ADD COLUMN redirect_id INTEGER REFERENCES rcv_files ON DELETE CASCADE; -- for later updates
-ALTER TABLE rcv_files ADD COLUMN redirect_entity_id BLOB; -- for notifications
-ALTER TABLE rcv_files ADD COLUMN redirect_size INTEGER;
-ALTER TABLE rcv_files ADD COLUMN redirect_digest BLOB;
-```
-
-These additional fields will exist on the file that is a short description to receive an actual description of the final file.
-
-While a description YAML is being downloaded, the application will get `RFPROG` messages tagged for final entity, containing bytes downloaded so far and the total size from the original file.
-When the description is fully downloaded, the worker would decode description and check if the stated size and digest match the declared in redirect.
-Then it will replace placeholder description in `rcv_files` for destination file with the actual data from downloaded description.
-Finally, instead of sending `RFDONE` for redirect, it hands over work to chunk download worker, which will run exactly as if the user requested its download directly.
-An application will then receive `RFPROG` and `RFDONE` messages as usual.
-
-## URI encoding
-
-File description URIs use the same service schema `simplex:` or its `https://simplex.chat` (or any custom host) equivalent as do contact links and can be extracted from text and processed the same way.
-The path section is `/file` (with an optional trailing `/`).
-The payload is encoded in the "fragment" part of the link, using `#/?`, followed by a query string.
-File description is encoded first in a YAML document, then URL-encoded in under the key `d`.
-An application may want to pass extra parameters not necessary to download a file. Those go in the `_` key, encoded as a JSON dictionary.
-
-An example link:
-
-`simplex:/file#/?d=chunkSize%3A%2064kb%0Adigest%3A%20OtpnXkECTW4a18Eots2m3O22maeOCMqPUX4ulugIjgMEJfCpTYc_-T257Uw7s9bW_F0G5WBg5BioBWd4Z_OoCw%3D%3D%0Akey%3A%20rNR8_2SJuH7Qve43gV3zszL0R6oY5HSdRZT_paB-wfE%3D%0Anonce%3A%202oKwfK-w75nwyWp8_1Lv6QnQonIRtJmG%0Aparty%3A%20recipient%0Areplicas%3A%0A-%20chunks%3A%0A%20%20-%201%3ATdvaxMnG2Ph1e3QCx3-rpA%3D%3D%3AMC4CAQAwBQYDK2VwBCIEILdErEICvgrBCajDLTX2h3LXyMB7z5vrtLa3XVigJuf-%3ANS46KuYdgOWs6dUeMp7p2oF8rBQ9wQ2Ez6TW6Y6gHg0%3D%0A%20%20-%202%3AH5SRbtKYrXWVXTthrkeWzw%3D%3D%3AMC4CAQAwBQYDK2VwBCIEIGeEPNLt7lUGPfplwsoJLCDFnbIc5Hm31kz5X6rWXmgu%3A7QNRI-gvFx9UM-baXp3YVDli9pcfh3HGFKDhsA9JQHY%3D%0A%20%20-%203%3A_xjukkIl9WZFryUXT0h_TQ%3D%3D%3AMC4CAQAwBQYDK2VwBCIEIIRFBaL1HvUfePvKLuggwUrC_q_ZHd7v08IL9jhM7teC%3Aid2lgLMMjTGsR8SUogJuRdLoEHAc5SDQKFDqlZRSuEY%3D%0A%20%20server%3A%20xftp%3A%2F%2FLcJUMfVhwD8yxjAiSaDzzGF3-kLG4Uh0Fl_ZIjrRwjI%3D%40localhost%3A7002%0Asize%3A%20192kb%0A&_=%7B%22k%22:%22test%22%7D`
@@ -1,51 +0,0 @@
-# Repudiation for message senders
-
-## Problem
-
-We use double ratchet protocol to send messages. One of its important qualities is the use of symmetric encryption with forward secrecy, when the new key to encrypt the message is rotated after each message. This provides senders ability to plausibly deny having sent some messages, without denying having sent others. While the recipients can prove to themselves that the message was indeed sent by the sender, because it was encrypted using authenticated encryption with associated data, the recipients cannot prove it to any third party - as the message could have been encrypted by themselves, as they also have the same symmetric keys.
-
-To receive the messages, the recipients agree a message queue with the senders, and the commands sent to this queue are signed by the senders using the cryptographic key (Edwards curve key) of which the public counterpart was shared with the recipient in the confirmation message of SMP protocol (this confirmation message itself is not signed).
-
-While it was never claimed that the messaging protocol provides deniability, the deniability is often mentioned as one of the important qualities of double ratchet algorithm used in the innermost layer of e2e encryption, so without explicit disclaimer of deniability limitations, it may be assumed by the users that the system as a whole provides the same level of deniability as the double ratchet algorithm, which currently is not the case.
-
-While societal understanding and legal acceptance of repudiation is arguable, there was less than a decade since this quality became widely available in Signal - legal systems take longer to evolve.  While the argument that the message was forged is unlikely to be accepted in the usual court cases with the ordinary people, it is likely to be considered in cases with high profile defendants, who can reasonably claim that they are the target of smear campaign and are being attributed something that they never sent - the statement that the message is forged is reasonable in such cases, and it provides plausible deniability, and the cryptographic experts invited to the hearing would attest to that.
-
-It’s important to both continue providing repudiation quality in communication systems, when it is appropriate, and also to educate the users about when it can be used as a reasonable defence strategy, thus improving privacy of communication and making digital off-the-record communications possible and understood both by the society and by legal systems.
-
-## Solution
-
-The proposed solution is to avoid the use of signature algorithm for server command authorization, and instead use authenticated encryption to authorize the commands sent to the server queues. If this protocol change is adopted, it could be used both for senders and recipients commands, both for consistency, and also to provide the deniability to recipients about executing any commands on the servers, in a similar way.
-
-The proposed approach is to use NaCl crypto_box that proves authentication and third party unforgeability and, unlike signature, repudiation guarantee. See [crypto_box docs](https://nacl.cr.yp.to/box.html):
-
-> The crypto_box function is designed to meet the standard notions of privacy and third-party unforgeability for a public-key authenticated-encryption scheme using nonces. The crypto_box function is not meant to provide non-repudiation. On the contrary: the crypto_box function guarantees repudiability. A receiver can freely modify a boxed message, and therefore cannot convince third parties that this particular message came from the sender. The sender and receiver are nevertheless protected against forgeries by other parties. In the terminology of https://groups.google.com/group/sci.crypt/msg/ec5c18b23b11d82c, crypto_box uses "public-key authenticators" rather than "public-key signatures.”
-
-DJB further writes in the link above:
-
-> If you were already planning to encrypt the message, using another key derived from g^xy, then you don't have to do any extra public-key work. A secret-key authenticator is easier to implement than a public-key signature, and it takes less CPU time to compute.
-
-So the proposed solution appears to have desired security qualities, without non-repudiation, that is undesirable in the context of private messaging.
-
-When queue is created or secured, the recipient would provide a DH key (X25519) to the server (either their own or received from the sender), and the server would provide its own random X25519 key per session. Then, either the authenticator will be computed in this way:
-
-```abnf
-transmission = authenticator authorized
-authenticator = crypto_box(sha512(authorized), secret = dh(client long term queue key, server session key), nonce = correlation ID)
-authorized = tlsunique correlationId queueId protocol_command ; same as the currently signed part of the transmission
-```
-
-The authenticator is smaller in size than currently used signature size, freeing ~34 bytes from the transmission.
-
-This allows to retain the protocol logic and make authentication scheme configurable, both by the clients and servers, e.g. some servers might be configured to use signature for non-repudiation, and clients may be configured to either agree or disagree to that, per conversation.
-
-There is no required change in SMP command syntax other than allowing X25519 key instead of Ed signature keys passed to the server in NEW and KEY commands. We could add support for migration of the existing queues to the new authorization scheme, but it is not strictly required, as the clients provide a mechanism to rotate the receiving addresses (currently manually, and once automated all queues will be rotated). On another hand, per queue key and identifiers rotation is cheaper than negotiating the new queue (it can be done between client and server, without the involvement of another party), and could be considered as an independent improvement.
-
-## Migration plan
-
-As this new scheme breaks backward compatibility, as the new scheme requires additional keys in protocol handshake, and current implementation does not support forward compatible header extension, we have to migrate in multiple steps, to minimize any disruption to the users.
-
-1. Upgrade clients for forward compatibility of the protocol handshake (ignore extra bytes) - 5.5.3.
-2. Add support for handshake and version negotiation to XFTP - 5.5.4 or 5.6.
-3. Upgrade clients to drop support of SMP earlier than v4 (batching) and also drop support of old double ratchet protocol and old handshake - 5.6.
-4. Upgrade servers to offer SMP v7 with support for new authorization - by the time 5.6 is released.
-5. Upgrade clients to require server support for SMP v7 / new authorization scheme and start using it - 5.7 or 5.8. At this point the old version of the servers will not be supported, as maintaining this backward compatibility would substantially increase the complexity and logic of the client - at the point of generating the key we do not even know which server version will be used.
@@ -1,33 +0,0 @@
-# Transmission encryption
-
-## Problems
-
-### Protection of meta-data from sending proxy
-
-The SEND commands and message queue IDs need to be encrypted so that sending proxy cannot see how many queues exist on each server.
-
-Correlation IDs need to be random and can be re-used as nonces so that the destination relay cannot use the increasing correlation IDs that are sent in v6 of the protocol to track the sender.
-
-###  Protection of the traffic from the attacker who compromised TLS
-
-Currently, even though different sending and receiving queue IDs are used, the attacker who compromised TLS could do statistical analysis and in this way correlate queue IDs of senders and recipients, and therefore correlate the senders and recipients.
-
-## Possible solutions
-
-1. Encrypt sent messages, other commands and their responses in the additional envelope, irrespective of whether proxy is used or not. In this case the requestion transmission could have this syntax:
-
-```abnf
-encReqTransmission = pubKey nonce encrypted(reqTransmission)
-reqTransmission = respNonce entityId command
-
-encRespTransmission = replyNonce encrypted(respTransmission)
-respTransmission = entityId command
-```
-
-The keys to encrypt and decrypt both the command and responses would be computed as curve25519 from the key sent together with command and server session key. For the requests, the nonce has to be random and sent outside of the encrypted envelopt, but for the response respNonce would be taken from inside of the encrypted envelope and it would also be used for correlating commands and responses. This way the attacker who could compromise TLS would not be able to correlate the commands and responses, and also observe entity IDs.
-
-2. The remaining question is to how encrypt and decrypt messages delivered not in response to the commands.
-
-The possible options are:
- restore client session key only for that purpose, but do not forward this key to the destination proxy for sent messages. Then the messages can be sent with a random replyNonce and the key would be computed from session keys. The advantage here is that we won't need to parameterize handles as both client and server would have session keys. The downside that we would have to either somehow differentiate messages and responses, either by some flag that would allow some correlation or just by the absense of replyNonce in the lookup map - that is if the client can find replyNonce, it would use the associated key to decrypt, and if not it would use session key.
- use the same key that was sent with SUB or ACK command. This is much more complex, and would only have some upside if we were to introduce receiving proxies (to conceal transport sessions from the receiving relays for the recipients).
@@ -1,92 +0,0 @@
-# Migrating existing connections to post-quantum double ratchet algorithm
-
-## Problem
-
-Post-quantum variant of double ratchet algorithm represents an almost full-stack change affecting all parts of the protocol stack except client-server protocol (SMP):
- double-ratchet end-to-end encryption: different encoding (additional large keys require byte-strings larger than 255 bytes with 2-byte length prefixes) and larger message headers (increased by ~2200 bytes).
- agent-agent protocol: a smaller maximum message size to accomodate larger headers and to fit in 16kb blocks, reduced by ~2200 bytes for the messages and by almost ~4000 bytes for connection information.
- chat protocol: also a smaller message size compensated by zstd comression of JSON messages.
-
-We want the versioning that achieves these objectives:
- all changes in all protocol layers happen at the same time, when both clients support it.
- ability to downgrade the clients to the previous version without losing connection.
- ability to opt-in into this functionality via "experimental" feature toggle, that enables post-quantum encryption in connections when both contacts enable this toggle.
-
-To have ability to downgrade the clients we have two options:
- roll-out this functionality in two stages: 1) roll-out clients support but do not enable the new version, and then 2) upgrade client version. The problem here is that the clients won't be able to opt-in into this experiment.
- make offered range dependent on experimental feature being enabled. Currently we have an option to enable PQ encryption in agent API, and this option can be used as a proxy to maxium supported protocol version - if the option is passed, it can be seen as an indication that higher version range (or version) should offered (or accepted).
-
-## Solution
-
-Currently ratchet state stores version range. It's unclear what was the intended semantics of that version range - it simply stores the offered/supported version range at the time ratchet was initialised, but only a high bound is used to send in message headers, and it is never upgraded. In JSON this range is encoded as tuple (an array of two elements in JSON).
-
-We could continue using this range with the meaning of the lower bound to be "currently used ratchet version" and the meaning of higher boundary to be "maximum supported ratchet version". We could also use the version communicated in message headers to upgrade ratchet version, with the condition that upgrade should only happen if both sides want it. Currently it's defined by pqEnableKEM property in ratchet state. We could also make it more explicit by defining maximum version to which ratchet should upgrade. Given that irreversible upgrades are not very common, it is probably ok to keep it implicit.
-
-We can define a better type than VersionRange to reflect semantics of the range in ratchet (current/max supported range), but for backward compatibility it needs to be encoded in the same way as now.
-
-To summarize, the proposed solution for ratchet versioning is:
- define ratchet versions as new type to include current and maximum allowed versions, where maximum allowed will be either the same or lower than maximum supported based on PQ option (in 5.6), and in 5.7 it will be changed to maximum supported, so version starts upgrading independently from PQ being enabled.
- make encodings in ratchet depend on current version (in curent code it depends on max version).
- include max allowed in message header.
- upgrade current if in range on each new message if less than max and higher than current (same as we do for connections).
- increase max allowed once PQ is enabled (only in 5.6). Make max allowed the same as max supported (global constant).
-
-```haskell
-data RatchetVR = RatchetVR
-  { currentVersion :: Version,
-    maxAllowedVersion :: Version
-  }
-
-instance ToJSON RatchetVR where
-  toEncoding (RatchetVR v1 v2) = toEncoding (v1, v2)
-  toJSON (RatchetVR v1 v2) = toJSON (v1, v2)
-
-instance FromJSON RatchetVR where
-  parseJSON v = do
-    -- this also verifies that v2 > v1 (although we could remove JSON instances for VersionRange)
-    VersionRange v1 v2 <- parseJSON v
-    pure $ RatchetVR v1 v2
-```
-
-For connections, we could also make version used for the purposes of encoding dependent on the PQ being enabled, and version for decoding taken from message header, but then we'd have to not only upgrade ratchets but the connection as well every time PQ mode changes.
-
-Another suggestion to ensure that correct version range is used in correct contexts could be:
- using different newtypes for different version ranges.
- define generic type class for version aware encoding that would also accept only specific type class for the version to use the correct range. This may be justified as there will be several version-aware encodings, and not just the protocol as now.
-
-```haskell
-class Ord v => EncodingV v a where
-  {-# MINIMAL smpEncodeV, (smpDecodeV | smpVP) #-}
-  smpEncodeV :: v -> a -> ByteString
-  -- default decode uses parser
-  smpDecodeV :: v -> ByteString -> Either String a
-  smpDecodeV = parseAll . smpVP
-  -- default parser decodes from length-specified bytestring
-  smpVP :: v -> Parser a
-  smpVP v = smpDecodeV v <$?> smpP
-```
-
-The version will be passed from currently agreed version, it may only change when message is received, not when message is sent. The version will not be extracted from the encoding itself as it happens now in ratchet encodings.
-
-## Various options how the problem can be simplified
-
-1. Do not support connection downgrade once both devices upgraded. If applied to all existing connections then it is a bad option, as it would disrupt some important conversations.
-
-2. Do not provide ability to opt-in into PQ encryption until v5.7 where it will be rolled out automatically. That is also suboptimal, as it won't allow announcing technology design and have testing outside of the team devices.
-
-3. The logic explained above where connection upgrade and downgrade is possible and applied to all existing connections if both parties consent to it. There are these important downsides:
-  - complexity of this logic
-  - regression risks when this logic is removed.
-  - some non-coordinated upgrades of existing, potentially important conversations, simply because two users opt-in into the experiment without any expectation that another side also opts-in.
-
-4. Apply upgrade/downgrade logic and enable PQ encryption as opt-in, based on the toggle in the UX, only for the new connections. This seems the least risky, and also simpler than option 3, as it would only apply to the new connections, and both users will have to enable experimental toggle prior to connecting.
-
-Option 4 seems the best trade-off, and has these sub-options regarding where it is controlled:
-a) in chat based on connection flag. Chat will pass PQ options only to connections that were created when experimental option was enabled.
-b) in agent - there will be additional logic to ignore PQ option for existing connections.
-c) both in chat and in agent.
-
-Option 4a seems better, as it would:
- simplify agent code
- minimise required changes when releasing v5.7 (as we do want that all direct and small groups connections migrate to PQ encryption at the time, without any toggles)
- allow tests for connection upgrade in the currect code.
@@ -1,123 +0,0 @@
-# Relay metadata and SimpleX network decentralization
-
-## Problem
-
-Currently, the clients configure/choose which servers to use, but they cannot see who operates them, in which geography and hosting provider, what is the server source code (in case it was modified from the reference implementation we provide) and also any administrative and feedback contacts.
-
-Further, we currently use simplex.chat domain to host group links, and as diversity of the groups grows it is beginning to require managing feedback from the users about groups. It is important that this feedback is directed to relay owners and not to us, in case they are not our relays, as we are simply providing software here.
-
-We also need to make it much easier to access administrative actions - e.g., if the relay owner wants to block some address based on the feedback, they should be able to do so effectively. While freedom of speech of users is important the autonomy and sovereignty of relay operators allowing them to decide what they want or don't want to host, irrespective of the reasons, is as important - public relays constitute a public space rather than a service, and while there is no authentication or authorization required to use them, the relay owners should be able to decide their conditions and limitations of use, as is the case for any public space.
-
-## Why it is important
-
-1. We are building network and not a service, so contrary to the traditional approach when service collects users metadata and conceals its own, it appears important to do the opposite - expose all relay metadata that may have any effect on users privacy and security and provide access to this metadata with the minimal friction, via the app UI.
-2. We need to remove the only remaining bit of centralization - using simplex.chat website to show the QR code and help new users onboarding - this role can be delegated to the relays.
-3. We need to make it easy for the users to submit feedback and to the relay operators to manage that feedback. That includes ourselves, as relay operators, and also any other person or organization that operates public relays.
-4. It is important to stress the requirement of AGPLv3 license to provide access to the source code to the relay users, as any code modifications might undermine user privacy and security and must be made transparent to the relay users.
-
-While this document is not the end of the journey to decentralize the network, it's an important first step.
-
-## Proposed solution
-
-The proposed solution consists of two parts:
-
- communicate server metadata via protocol, so it can be observed by the clients.
- create home page for the relays, with all the same metadata.
- create invitation and address links in the same domain name as the relay.
-
-The latter point is important so it is clear to the users who operates and owns the relay and where the access point to the content or group is hosted. Even though simplex.chat domain is never accessed by the app, and the meaningful part of the address is never sent to the page hosting server, it creates an impression of centralization, and some dependency on simplex.chat domain for anything other that showing the link QR code.
-
-Moving invitation links to the domain of the relay (primary relay, in case the link has redundancy) will both clarify relay ownership, solve the incorrect mis-perception of centralization, remove the dependency on simplex-chat domain without any user effort, and provides the means to submit content complaints to the relay operators (should they wish to receive them, which seems reasonable for large public relays, but may be unnecessary for private relays where unidentified parties cannot create links).
-
-## Solution details
-
-Extend server INI file with information section:
-
-```
-[INFORMATION]
-# Please note that under AGPLv3 license conditions you MUST make
-# any source code modifications available to the end users of the server.
-# LICENSE: https://github.com/simplex-chat/simplexmq/blob/stable/LICENSE
-# Not doing so would constitute a license violation.
-# Declaring an incorrect information here amounts to a fraud.
-# The license holders reserve the right to prosecute missing or incorrect
-# information about the server source code to the fullest extent permitted by the law.
-# The server will show warning on start if this field is absent
-# and will not launch from v6.0 until this field is added.
-# If any other information field is present, source code property also MUST be present.
-source_code: https://github.com/simplex-chat/simplexmq
-
-# Declaring all below information is optional, any of these fields can be omitted.
-# Declaring an incorrect information here would amount to a fraud.
-
-# We should split this document to the model one, where specific parameters will be external to the document,
-# and specific to us, so that relay operators can adopt our recommended policy and publish any amendments separately.
-conditions: https://github.com/simplex-chat/simplex-chat/blob/_archived-ep/ios-file-provider/PRIVACY.md
-# conditions_amendments: link
-
-server_country: SE
-operator: SimpleX Chat Ltd.
-operator_country: GB # operator country
-website: https://simplex.chat
-admin_simplex: administrative SimpleX address
-admin_email: chat@simplex.chat
-admin_pgp: PGP key
-feedback_simplex: SimpleX address for feedback, comments and complaints
-feedback_email: complaints@simplex.chat
-feedback_pgp: PGP key
-hosting: Linode / Akamai Inc.
-hosting_country: US
-```
-
-Server home page would show whether queue creation is allowed and/or password protected, server retention policy (e.g., preserve messages on restart or not, and persist connections or not).
-
-Server queue address/contact pages will optionally, provide the UI to submit feedback, comments and complaints directly from the web page (not an MVP, initially we would simply show addresses for feedback, and, probably, create link that opens in the app with pre-populated message, and we could also use this addresses defined in server meta-data to submit feedback from inside of the app - it's also out of MVP scope).
-
-If server is available on .onion address, the web pages would show "open via .onion" in Tor browser.
-
-Extend server handshake header with these information fields:
-
-```haskell
-data ServerHandshake = ServerHandshake
-  { smpVersionRange :: VersionRangeSMP,
-    sessionId :: SessionId,
-    -- pub key to agree shared secrets for command authorization and entity ID encryption.
-    authPubKey :: Maybe (X.CertificateChain, X.SignedExact X.PubKey),
-    -- ^^ existing fields
-    -- vv new field that will be sent as length-prefixed JSON in the handshake
-    information :: Maybe ServerInformation
-  }
-
-data ServerInformation = ServerInformation
-  { -- below is based on the existing server configuration
-    persistence :: SMPServerPersistenceMode,
-    messageExpiration :: Int,
-    statsEnabled :: Bool,
-    newQueuesAllowed :: Bool,
-    basicAuthEnabled :: Bool, -- server is private if enabled
-    -- below is based on INFORMATION section of INI file
-    sourceCode :: Text, -- note that this property is not optional, in line with AGPLv3 license
-    -- all below properties are optional, except entity name MUST be present if any entity country is present
-    conditions :: Maybe ServerConditions,
-    operator :: Maybe Entity,
-    website :: Maybe Text,
-    admin :: Maybe ServerContactAddress,
-    feedback :: Maybe ServerContactAddress,
-    hosting :: Maybe Entity,
-    serverCountry :: Maybe Text
-  }
-
-data ServerPersistenceMode = SMPMemoryOnly | SPMQueues | SPMQueuesMessages
-
-data ServerConditions = ServerConditions {conditions :: Text, amendments :: Maybe Text}
-
-data Entity = Entity {name :: Text, country :: Maybe Text}
-
-data ServerContactAddress = ServerContactAddress
-  { simplex :: Maybe Text,
-    email :: Maybe Text, -- it is recommended that it matches DNS email address, if either is present
-    pgp :: Maybe Text
-  }
-```
-
-This extended server information will be stored in the chat database every time it changes and shown in the UI of the server configuration.
@@ -1,120 +0,0 @@
-# XFTP version agreement
-
-## Problem
-
-XFTP is using HTTP2 protocol for encoding requests and responses.
-Unlike SMP which has a connection handshake initiated by a server and signals available versions XFTP/HTTP2 is almost entirely client-driven.
-So, a client can only try to guess which protocol versions are supported by a server by sending a probe/hello request first.
-Determining the endpoint for such a request is an implicit version agreement by itself.
-Sending such a request to an old server would error out and requiring it from old clients would break them.
-
-## Solution
-
-The TLS layer used by the XFTP server has an optional [ALPN](https://datatracker.ietf.org/doc/html/rfc7301) extension which allows the client and server to negotiate protocols and store the decision in TLS session context.
-Unless a client and a server run ALPN-aware versions, they would default to the old "unversioned" protocol.
-
-TLS extension content is a 65kb chunk, but ALPN standard breaks it into 254b-sized chunks making it unusable for things like key exchange.
-The exchange is still client-driven: the client proposes a list, and then a server callback picks one.
-In effect, this makes it usable only to signal that some application-level handshake is desired and supported.
-
-## Implementation
-
-ALPN can be used to negotiate for any TLS-based protocol, but the description will focus on XFTP.
-
-TransportClientConfig gets a new `alpn :: Maybe [ALPN]` field so a TLS transport can use it during TLS client creation.
-XFTP client sets it to `Just ["xftp/1"]`.
-The exact value is not important as long it is in agreement with the server side, but ALPN RFC insists on it being an IANA-registered identifier.
-
-XFTP server sets `onALPNClientSuggest` TLS hook to pick the protocol when it is provided.
-The `tls` library treats SHOULD from the RFC as MUST and does a client-side check that the server responded with one of the client-proposed protocols.
-
-Upon connection, transport implementation invokes `getNegotiatedProtocol` and stores it in `tlsALPN :: Maybe ALPN` field of transport context.
-HTTP2 transport implementation using `withHTTP2` passes negotiated "protocol" to client and server setup callbacks where they store it in their respective wrappers along with TLS session ID.
-A server request handler then knows by looking at the `sessionALPN` if it should require a "handshake" request first.
-A client code that got HTTP2Client with `sessionALPN` set knows if it has to proceed with handshake request.
-A handshake request still has to be initiated by a client, so it should be kept minimal, just enough data to pass the initiative to a server.
-A reply to that initial request should contain a server version range for the client to pick.
-A client then commits to a version, sending its part of a handshake.
-
-In the future ALPN negotiation can be dropped in favor of mandatory handshakes or used to signal further handshake schemes.
-
-The XFTP handshake data types and validation code are cloned from SMP.
-Currently they carry version information and session authentication parameters.
-Authentication parameters made mandatory as this exchange is guarded by the handshake version.
-
-### Server side
-
-`runHTTP2Server` callback used by `xftpServer` should get access to the session state to track handshakes.
-A local `TMap SessionId Handshake` is enough to switch request handlers.
-The HTTP2 server framework is extended with a way to signal client disconnection to remove sessions from this map.
-
-The `Handshake` type mimics implicit state in stream based handshakes of SMP and NTF.
-
-```haskell
-data Handshake
-  = HandshakeSent C.PrivateKeyX25519 -- server private key that will be merged with client public in `THandleAuth`
-  | HandshakeAccepted THandleAuth VersionXFTP -- session steady state after handshakes
-```
-
-An HTTP2 request without ALPN is treated as legacy and requires no session entry.
-Its `Request`s are marked with `THandleParams {thVersion = VersionXFTP 1, ..}`.
-
-An HTTP2 request with ALPN requires a session lookup.
- A lack of entry indicates that a client must send an empty request, to which the server replies with its "server handshake" block and stores its private state in `HandshakeSent`.
- If the session entry contains `HandshakeSent`, then the only valid request content is the "client handshake" block.
-  The server validates client handshake (in the same way as SMP) and stores authentication and version in `HandshakeAccepted`
- If the session entry contains `HandshakeAccepted`, then the server just passes it to `THandleParams`.
-
-### Client side
-
-`getXFTPClient` tweaks its transport config to include the ALPN marker and then checks if the client got its `sessionALPN` value.
-If there's a value set, it then sends an initial block and checks out the server handshake in response.
-After validation, it sends "client handshake" request to finish version negotiation.
-
-```haskell
-let tcConfig = (transportClientConfig xftpNetworkConfig) {alpn = Just ["xftp/1"]}
-- ...
-http2Client <- liftEitherError xftpClientError $ getVerifiedHTTP2Client -- ...
-thVersion <- case sessionALPN http2Client of
-  Nothing -> pure $ VersionXFTP 1
-  Just proto -> negotiate http2Client proto
-```
-
-The resulting `XFTPClient` then contains a negotiated version and can be used to send transmissions with a more recent encoding.
-
-## Block encoding
-
-### Client Hello (request)
-
-A request with an empty body and no padding.
-
-### Server handshake (response)
-
-SMP-encoded and padded to `xftpBlockSize` (~16kb).
-
-```haskell
-data XFTPServerHandshake = XFTPServerHandshake
-  { xftpVersionRange :: VersionRangeXFTP,
-    sessionId :: SessionId, -- validated by client against TLS unique
-    authPubKey ::
-      ( X.CertificateChain, -- fingerprint validated by client against pre-shared hash
-        X.SignedExact X.PubKey -- signature validated by client against server key from TLS
-      )
-  }
-```
-
-### Client handshake (request)
-
-SMP-encoded and padded to `xftpBlockSize` (~16kb).
-
-```haskell
-data XFTPClientHandshake = XFTPClientHandshake
-  { xftpVersion :: VersionXFTP,
-    keyHash :: C.KeyHash, -- validated by server against its own cert fingerprint
-    authPubKey :: C.PublicKeyX25519
-  }
-```
-
-### Server confirmation (response)
-
-A response with an empty body and no padding.
@@ -19,9 +19,7 @@ if [ ! -f "${confd}/file-server.ini" ]; then
  # Set quota
  case "${QUOTA}" in
    '') printf 'Please specify $QUOTA environment variable.\n'; exit 1 ;;
-    *GB) QUOTA="$(printf ${QUOTA} | tr '[:upper:]' '[:lower:]')"; set -- "$@" --quota "${QUOTA}" ;;
-    *gb) set -- "$@" --quota "${QUOTA}" ;;
-    *) printf 'Wrong format. Format should be: 1gb, 10gb, 100gb.\n'; exit 1 ;;
+    *) set -- "$@" --quota "${QUOTA}" ;;
  esac

  # Init the certificates and configs
@@ -1,30 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-path_conf_var="/var/opt"
-path_conf_smp="$path_conf_var/simplex"
-path_conf_xftp="$path_conf_var/simplex-xftp"
-path_conf_storelog_smp="$path_conf_smp/smp-server-store.log"
-path_conf_storelog_xftp="$path_conf_xftp/file-server-store.log"
-date="$(date -u '+%Y-%m-%dT%H:%M:%S')"
-
-backup_smp() {
- if [ -e "$path_conf_storelog_smp" ]; then
-  cp "$path_conf_storelog_smp" "${path_conf_storelog_smp}.${date:-date-failed}"
- fi
-}
-
-backup_xftp() {
- if [ -e "$path_conf_storelog_xftp" ]; then
-  cp "$path_conf_storelog_xftp" "${path_conf_storelog_xftp}.${date:-date-failed}"
- fi
-}
-
-if [ "$1" = 'smp-server' ]; then
- backup_smp
-elif [ "$1" = 'xftp-server' ]; then
- backup_xftp
-else
- backup_smp
- backup_xftp
-fi
@@ -13,11 +13,6 @@ fi
 printf "${RED}This action will permanently remove all configs, directories, binaries from Installation Script. Please backup any relevant configs if they are needed.${NC}\n\nPress ${GRN}ENTER${NC} to continue or ${RED}Ctrl+C${NC} to cancel installation"
 read ans

-systemctl stop smp-server
-systemctl stop xftp-server
-
-rm -rf /var/opt/simplex /etc/opt/simplex /var/opt/simplex-xftp /etc/opt/simplex-xftp /srv/xftp /etc/systemd/system/smp-server.service /etc/systemd/system/xftp-server.service /usr/local/bin/smp-server /usr/local/bin/xftp-server /usr/local/bin/simplex-servers-update /usr/local/bin/simplex-servers-uninstall
-
-userdel smp && userdel xftp
+rm -rf /var/opt/simplex /etc/opt/simplex /var/opt/simplex-xftp /etc/opt/simplex-xftp /srv/xftp /etc/systemd/system/smp-server.service /etc/systemd/system/xftp-server.service /usr/local/bin/smp-server /usr/local/bin/xftp-server /usr/local/bin/simplex-servers-update /usr/local/bin/simplex-servers-uninstall && userdel smp && userdel xftp

 printf "Uninstallation is complete! Thanks for trying out SimpleX!\n"
@@ -11,7 +11,6 @@ scripts_systemd_smp="$scripts/smp-server.service"
 scripts_systemd_xftp="$scripts/xftp-server.service"
 scripts_update="$scripts/simplex-servers-update"
 scripts_uninstall="$scripts/simplex-servers-uninstall"
-scripts_stopscript="$scripts/simplex-servers-stopscript"

 # Default installation paths
 path_bin="/usr/local/bin"
@@ -19,7 +18,6 @@ path_bin_smp="$path_bin/smp-server"
 path_bin_xftp="$path_bin/xftp-server"
 path_bin_update="$path_bin/simplex-servers-update"
 path_bin_uninstall="$path_bin/simplex-servers-uninstall"
-path_bin_stopscript="$path_bin/simplex-servers-stopscript"

 path_systemd="/etc/systemd/system"
 path_systemd_smp="$path_systemd/smp-server.service"
@@ -29,7 +27,6 @@ path_systemd_xftp="$path_systemd/xftp-server.service"
 path_tmp_bin="$(mktemp -d)"
 path_tmp_bin_update="$path_tmp_bin/simplex-servers-update"
 path_tmp_bin_uninstall="$path_tmp_bin/simplex-servers-uninstall"
-path_tmp_bin_stopscript="$path_tmp_bin/simplex-servers-stopscript"
 path_tmp_systemd_smp="$path_tmp_bin/smp-server.service"
 path_tmp_systemd_xftp="$path_tmp_bin/xftp-server.service"

@@ -46,9 +43,8 @@ remote_version="$(curl --proto '=https' --tlsv1.2 -sSf -L https://api.github.com
 update_scripts() {
  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_update" -o "$path_tmp_bin_update" && chmod +x "$path_tmp_bin_update"
  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_uninstall" -o "$path_tmp_bin_uninstall" && chmod +x "$path_tmp_bin_uninstall"
-  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_stopscript" -o "$path_tmp_bin_stopscript" && chmod +x "$path_tmp_bin_stopscript"

-  if diff -q "$path_bin_uninstall" "$path_tmp_bin_uninstall" > /dev/null 2>&1; then
+  if diff -q "$path_bin_uninstall" "$path_tmp_bin_uninstall" > /dev/null; then
    printf -- "- ${YLW}Uninstall script is up-to-date${NC}.\n"
    rm "$path_tmp_bin_uninstall"
  else
@@ -56,15 +52,7 @@ update_scripts() {
    mv "$path_tmp_bin_uninstall" "$path_bin_uninstall"
    printf "${GRN}Done!${NC}\n"
  fi
-  if diff -q "$path_bin_stopscript" "$path_tmp_bin_stopscript" > /dev/null 2>&1; then
-    printf -- "- ${YLW}Stopscript script is up-to-date${NC}.\n"
-    rm "$path_tmp_bin_stopscript"
-  else
-    printf -- "- Updating stopscript script..."
-    mv "$path_tmp_bin_stopscript" "$path_bin_stopscript"
-    printf "${GRN}Done!${NC}\n"
-  fi
-  if diff -q "$path_bin_update" "$path_tmp_bin_update" > /dev/null 2>&1; then
+  if diff -q "$path_bin_update" "$path_tmp_bin_update" > /dev/null; then
    printf -- "- ${YLW}Update script is up-to-date${NC}.\n"
    rm "$path_tmp_bin_update"
  else
@@ -80,7 +68,7 @@ update_systemd() {
  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_systemd_smp" -o "$path_tmp_systemd_smp"
  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_systemd_xftp" -o "$path_tmp_systemd_xftp"

-  if diff -q "$path_systemd_smp" "$path_tmp_systemd_smp" > /dev/null 2>&1; then
+  if diff -q "$path_systemd_smp" "$path_tmp_systemd_smp" > /dev/null; then
    printf -- "- ${YLW}smp-server service is up-to-date${NC}.\n"
    rm "$path_tmp_systemd_smp"
  else
@@ -89,7 +77,7 @@ update_systemd() {
    systemctl daemon-reload
    printf "${GRN}Done!${NC}\n"
  fi
-  if diff -q "$path_systemd_xftp" "$path_tmp_systemd_xftp" > /dev/null 2>&1; then
+  if diff -q "$path_systemd_xftp" "$path_tmp_systemd_xftp" > /dev/null; then
    printf -- "- ${YLW}xftp-server service is up-to-date${NC}.\n"
    rm "$path_tmp_systemd_xftp"
  else
@@ -107,16 +95,16 @@ update_bins() {
      systemctl stop smp-server
      printf "${GRN}Done!${NC}\n"

-      printf -- "- Updating smp-server bin to %s..." "$remote_version"
-      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$path_bin_smp" && chmod +x "$path_bin_smp"
+      print -- "- Updating smp-server bin to %s..." "$remote_version"
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$bin_path_smp" && chmod +x "$bin_path_smp"
      printf "${GRN}Done!${NC}\n"
      
      printf -- "- Starting smp-server service..."
-      systemctl start smp-server
+      systemctl stop smp-server
      printf "${GRN}Done!${NC}\n"
    else
-      printf -- "- Updating smp-server bin..."
-      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$path_bin_smp" && chmod +x "$path_bin_smp"
+      print -- "- Updating smp-server bin..."
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$bin_path_smp" && chmod +x "$bin_path_smp"
      printf "${GRN}Done!${NC}\n"
    fi

@@ -125,16 +113,16 @@ update_bins() {
      systemctl stop xftp-server
      printf "${GRN}Done!${NC}\n"

-      printf -- "- Updating xftp-server bin to %s..." "$remote_version"
-      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_xftp" -o "$path_bin_xftp" && chmod +x "$path_bin_xftp"
+      print -- "- Updating xftp-server bin to %s..." "$remote_version"
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_xftp" -o "$bin_path_xftp" && chmod +x "$bin_path_xftp"
      printf "${GRN}Done!${NC}\n"
      
      printf -- "- Starting xftp-server service..."
-      systemctl start xftp-server
+      systemctl stop xftp-server
      printf "${GRN}Done!${NC}\n"
    else
-      printf -- "- Updating xftp-server bin..."
-      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$path_bin_xftp" && chmod +x "$path_bin_xftp"
+      print -- "- Updating xftp-server bin..."
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin_smp" -o "$bin_path_xftp" && chmod +x "$bin_path_xftp"
      printf "${GRN}Done!${NC}\n"
    fi
  else
@@ -167,8 +155,6 @@ main() {
  
  printf "Updating simplex server binaries...\n"
  update_bins
-
-  rm -rf "$path_tmp_bin"
 }

 main "$@"
@@ -6,7 +6,7 @@ User=smp
 Group=smp
 Type=simple
 ExecStart=/usr/local/bin/smp-server start +RTS -N -RTS 
-ExecStopPost=/usr/local/bin/simplex-servers-stopscript smp-server
+ExecStopPost=/usr/bin/env sh -c '[ -e "/var/opt/simplex/smp-server-store.log" ] && cp "/var/opt/simplex/smp-server-store.log" "/var/opt/simplex/smp-server-store.log.$(date +%FT%T)'
 LimitNOFILE=65535
 KillSignal=SIGINT
 TimeoutStopSec=infinity
@@ -6,7 +6,7 @@ User=xftp
 Group=xftp
 Type=simple
 ExecStart=/usr/local/bin/xftp-server start +RTS -N -RTS
-ExecStopPost=/usr/local/bin/simplex-servers-stopscript xftp-server
+ExecStopPost=/usr/bin/env sh -c '[ -e "/var/opt/simplex-xftp/file-server-store.log" ] && cp "/var/opt/simplex-xftp/file-server-store.log" "/var/opt/simplex-xftp/file-server-store.log.$(date +%FT%T)'
 LimitNOFILE=65535
 KillSignal=SIGINT
 TimeoutStopSec=infinity
@@ -1,11 +1,11 @@
 cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.0.
+-- This file has been generated from package.yaml by hpack version 0.35.1.
 --
 -- see: https://github.com/sol/hpack

 name:           simplexmq
-version:        5.7.1.0
+version:        5.1.1
 synopsis:       SimpleXMQ message broker
 description:    This package includes <./docs/Simplex-Messaging-Server.html server>,
                <./docs/Simplex-Messaging-Client.html client> and
@@ -26,23 +26,16 @@ build-type:     Simple
 extra-source-files:
    README.md
    CHANGELOG.md
-    cbits/sha512.h
-    cbits/sntrup761.h

 flag swift
  description: Enable swift JSON format
  manual: True
  default: False

-flag use_crypton
-  description: Use crypton etc. in cryptostore
-  manual: True
-  default: True
-
 library
  exposed-modules:
+      Simplex.FileTransfer
      Simplex.FileTransfer.Agent
-      Simplex.FileTransfer.Chunks
      Simplex.FileTransfer.Client
      Simplex.FileTransfer.Client.Agent
      Simplex.FileTransfer.Client.Main
@@ -51,7 +44,6 @@ library
      Simplex.FileTransfer.Description
      Simplex.FileTransfer.Protocol
      Simplex.FileTransfer.Server
-      Simplex.FileTransfer.Server.Control
      Simplex.FileTransfer.Server.Env
      Simplex.FileTransfer.Server.Main
      Simplex.FileTransfer.Server.Stats
@@ -71,8 +63,6 @@ library
      Simplex.Messaging.Agent.Server
      Simplex.Messaging.Agent.Store
      Simplex.Messaging.Agent.Store.SQLite
-      Simplex.Messaging.Agent.Store.SQLite.Common
-      Simplex.Messaging.Agent.Store.SQLite.DB
      Simplex.Messaging.Agent.Store.SQLite.Migrations
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
@@ -92,32 +82,13 @@ library
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
-      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
+      Simplex.Messaging.Agent.TAsyncs
      Simplex.Messaging.Agent.TRcvQueues
      Simplex.Messaging.Client
      Simplex.Messaging.Client.Agent
-      Simplex.Messaging.Compression
      Simplex.Messaging.Crypto
-      Simplex.Messaging.Crypto.File
      Simplex.Messaging.Crypto.Lazy
      Simplex.Messaging.Crypto.Ratchet
-      Simplex.Messaging.Crypto.SNTRUP761
-      Simplex.Messaging.Crypto.SNTRUP761.Bindings
-      Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines
-      Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
-      Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG
      Simplex.Messaging.Encoding
      Simplex.Messaging.Encoding.String
      Simplex.Messaging.Notifications.Client
@@ -126,7 +97,6 @@ library
      Simplex.Messaging.Notifications.Server.Env
      Simplex.Messaging.Notifications.Server.Main
      Simplex.Messaging.Notifications.Server.Push.APNS
-      Simplex.Messaging.Notifications.Server.Push.APNS.Internal
      Simplex.Messaging.Notifications.Server.Stats
      Simplex.Messaging.Notifications.Server.Store
      Simplex.Messaging.Notifications.Server.StoreLog
@@ -136,7 +106,6 @@ library
      Simplex.Messaging.Protocol
      Simplex.Messaging.Server
      Simplex.Messaging.Server.CLI
-      Simplex.Messaging.Server.Control
      Simplex.Messaging.Server.Env.STM
      Simplex.Messaging.Server.Expiration
      Simplex.Messaging.Server.Main
@@ -146,44 +115,26 @@ library
      Simplex.Messaging.Server.QueueStore.STM
      Simplex.Messaging.Server.Stats
      Simplex.Messaging.Server.StoreLog
-      Simplex.Messaging.ServiceScheme
-      Simplex.Messaging.Session
      Simplex.Messaging.TMap
      Simplex.Messaging.Transport
      Simplex.Messaging.Transport.Buffer
      Simplex.Messaging.Transport.Client
-      Simplex.Messaging.Transport.Credentials
      Simplex.Messaging.Transport.HTTP2
      Simplex.Messaging.Transport.HTTP2.Client
-      Simplex.Messaging.Transport.HTTP2.File
      Simplex.Messaging.Transport.HTTP2.Server
      Simplex.Messaging.Transport.KeepAlive
      Simplex.Messaging.Transport.Server
      Simplex.Messaging.Transport.WebSockets
      Simplex.Messaging.Util
      Simplex.Messaging.Version
-      Simplex.Messaging.Version.Internal
-      Simplex.RemoteControl.Client
-      Simplex.RemoteControl.Discovery
-      Simplex.RemoteControl.Discovery.Multicast
-      Simplex.RemoteControl.Invitation
-      Simplex.RemoteControl.Types
  other-modules:
      Paths_simplexmq
  hs-source-dirs:
      src
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2
-  include-dirs:
-      cbits
-  c-sources:
-      cbits/sha512.c
-      cbits/sntrup761.c
-  extra-libraries:
-      crypto
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -191,31 +142,27 @@ library
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -223,29 +170,24 @@ library
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 executable ntf-server
  main-is: Main.hs
@@ -253,11 +195,10 @@ executable ntf-server
      Paths_simplexmq
  hs-source-dirs:
      apps/ntf-server
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -265,31 +206,27 @@ executable ntf-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -298,29 +235,24 @@ executable ntf-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 executable smp-agent
  main-is: Main.hs
@@ -328,11 +260,10 @@ executable smp-agent
      Paths_simplexmq
  hs-source-dirs:
      apps/smp-agent
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -340,31 +271,27 @@ executable smp-agent
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -373,29 +300,24 @@ executable smp-agent
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 executable smp-server
  main-is: Main.hs
@@ -403,11 +325,10 @@ executable smp-server
      Paths_simplexmq
  hs-source-dirs:
      apps/smp-server
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -415,31 +336,27 @@ executable smp-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -448,29 +365,24 @@ executable smp-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 executable xftp
  main-is: Main.hs
@@ -478,11 +390,10 @@ executable xftp
      Paths_simplexmq
  hs-source-dirs:
      apps/xftp
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -490,31 +401,27 @@ executable xftp
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -523,29 +430,24 @@ executable xftp
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 executable xftp-server
  main-is: Main.hs
@@ -553,11 +455,10 @@ executable xftp-server
      Paths_simplexmq
  hs-source-dirs:
      apps/xftp-server
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
  build-depends:
-      aeson ==2.2.*
+      QuickCheck ==2.14.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -565,31 +466,27 @@ executable xftp-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , hourglass ==0.2.*
+    , generic-random >=1.3 && <1.5
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -598,29 +495,24 @@ executable xftp-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3

 test-suite simplexmq-test
  type: exitcode-stdio-1.0
@@ -629,30 +521,23 @@ test-suite simplexmq-test
      AgentTests
      AgentTests.ConnectionRequestTests
      AgentTests.DoubleRatchetTests
-      AgentTests.EqInstances
      AgentTests.FunctionalAPITests
      AgentTests.MigrationTests
      AgentTests.NotificationTests
      AgentTests.SchemaDump
      AgentTests.SQLiteTests
      CLITests
-      CoreTests.BatchingTests
-      CoreTests.CryptoFileTests
      CoreTests.CryptoTests
      CoreTests.EncodingTests
      CoreTests.ProtocolErrorTests
      CoreTests.RetryIntervalTests
-      CoreTests.TRcvQueuesTests
-      CoreTests.UtilTests
      CoreTests.VersionRangeTests
      FileDescriptionTests
      NtfClient
      NtfServerTests
-      RemoteControl
      ServerTests
      SMPAgentClient
      SMPClient
-      Util
      XFTPAgent
      XFTPCLI
      XFTPClient
@@ -660,13 +545,11 @@ test-suite simplexmq-test
      Paths_simplexmq
  hs-source-dirs:
      tests
-  default-extensions:
-      StrictData
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -O2 -threaded -rtsopts -with-rtsopts=-A64M -with-rtsopts=-N1
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -fhpc
  build-depends:
      HUnit ==1.6.*
    , QuickCheck ==2.14.*
-    , aeson ==2.2.*
+    , aeson ==2.0.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -674,36 +557,31 @@ test-suite simplexmq-test
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
+    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , crypton ==0.34.*
-    , crypton-x509 ==1.7.*
-    , crypton-x509-store ==1.6.*
-    , crypton-x509-validation ==1.6.*
-    , cryptostore ==0.3.*
+    , cryptonite >=0.27 && <0.30
+    , cryptostore ==0.2.*
    , data-default ==0.7.*
    , deepseq ==1.4.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random ==1.5.*
-    , hourglass ==0.2.*
-    , hspec ==2.11.*
-    , hspec-core ==2.11.*
+    , generic-random >=1.3 && <1.5
+    , hspec ==2.7.*
+    , hspec-core ==2.7.*
    , http-types ==0.12.*
-    , http2 >=4.2.2 && <4.3
+    , http2 ==4.1.*
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
    , main-tester ==0.2.*
-    , memory ==0.18.*
-    , mtl >=2.3.1 && <3.0
+    , memory ==0.15.*
+    , mtl ==2.2.*
    , network >=3.1.2.7 && <3.2
-    , network-info ==0.2.*
-    , network-transport ==0.5.6
-    , network-udp ==0.0.*
+    , network-transport ==0.5.4
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -713,27 +591,22 @@ test-suite simplexmq-test
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , time ==1.12.*
+    , text ==1.2.*
+    , time ==1.9.*
+    , time-compat ==1.9.*
    , time-manager ==0.0.*
    , timeit ==2.0.*
-    , tls >=1.7.0 && <1.8
-    , transformers ==0.6.*
+    , tls >=1.6.0 && <1.7
+    , transformers ==0.5.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
+    , x509 ==1.7.*
+    , x509-store ==1.6.*
+    , x509-validation ==1.6.*
    , yaml ==0.11.*
-    , zstd ==0.1.3.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
-  if impl(ghc >= 9.6.2)
-    build-depends:
-        bytestring ==0.11.*
-      , template-haskell ==2.20.*
-      , text >=2.0.1 && <2.2
-  if impl(ghc < 9.6.2)
-    build-depends:
-        bytestring ==0.10.*
-      , template-haskell ==2.16.*
-      , text >=1.2.3.0 && <1.3
@@ -0,0 +1,14 @@
+module Simplex.FileTransfer where
+
+-- TODO
+-- Protocol
+-- Store (in memory storage)
+-- StoreLog (append only log)
+-- FileDescription
+-- Server
+-- Client
+-- Server/Main (server CLI)
+-- Client/Main (client CLI)
+--
+-- Transport for HTTP2 ?
+-- streaming Crypto
@@ -7,44 +7,42 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
-{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Agent
-  ( startXFTPWorkers,
+  ( startWorkers,
    closeXFTPAgent,
    toFSFilePath,
    -- Receiving files
-    xftpReceiveFile',
-    xftpDeleteRcvFile',
-    xftpDeleteRcvFiles',
+    receiveFile,
+    deleteRcvFile,
    -- Sending files
-    xftpSendFile',
-    xftpSendDescription',
+    sendFileExperimental,
+    sendFile,
    deleteSndFileInternal,
-    deleteSndFilesInternal,
    deleteSndFileRemote,
-    deleteSndFilesRemote,
  )
 where

+import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple (logError)
 import Control.Monad
 import Control.Monad.Except
 import Control.Monad.Reader
+import Crypto.Random (ChaChaDRG, randomBytesGenerate)
 import Data.Bifunctor (first)
+import Data.ByteString (ByteString)
+import qualified Data.ByteString.Base64.URL as U
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
-import Data.Coerce (coerce)
 import Data.Composition ((.:))
-import Data.Either (rights)
 import Data.Int (Int64)
-import Data.List (foldl', partition, sortOn)
+import Data.List (foldl', isSuffixOf, partition, sortOn)
+import Data.List.NonEmpty (nonEmpty)
 import qualified Data.List.NonEmpty as L
 import Data.Map (Map)
 import qualified Data.Map.Strict as M
-import Data.Maybe (mapMaybe)
-import qualified Data.Set as S
 import Data.Text (Text)
 import Data.Time.Clock (getCurrentTime)
 import Data.Time.Format (defaultTimeLocale, formatTime)
@@ -52,9 +50,8 @@ import Simplex.FileTransfer.Client (XFTPChunkSpec (..))
 import Simplex.FileTransfer.Client.Main
 import Simplex.FileTransfer.Crypto
 import Simplex.FileTransfer.Description
-import Simplex.FileTransfer.Protocol (FileParty (..), SFileParty (..))
+import Simplex.FileTransfer.Protocol (FileParty (..), FilePartyI, SFileParty (..))
 import Simplex.FileTransfer.Transport (XFTPRcvChunkSpec (..))
-import qualified Simplex.FileTransfer.Transport as XFTP
 import Simplex.FileTransfer.Types
 import Simplex.FileTransfer.Util (removePath, uniqueCombine)
 import Simplex.Messaging.Agent.Client
@@ -62,157 +59,161 @@ import Simplex.Messaging.Agent.Env.SQLite
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Agent.Store.SQLite
-import qualified Simplex.Messaging.Agent.Store.SQLite.DB as DB
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.File (CryptoFile (..), CryptoFileArgs)
-import qualified Simplex.Messaging.Crypto.File as CF
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
-import Simplex.Messaging.Encoding.String (strDecode, strEncode)
-import Simplex.Messaging.Protocol (EntityId, XFTPServer)
-import Simplex.Messaging.Util (catchAll_, liftError, tshow, unlessM, whenM)
+import Simplex.Messaging.Encoding.String
+import Simplex.Messaging.Protocol (EntityId, XFTPServer, XFTPServerWithAuth)
+import Simplex.Messaging.TMap (TMap)
+import qualified Simplex.Messaging.TMap as TM
+import Simplex.Messaging.Util (liftError, liftIOEither, tshow, unlessM, whenM)
 import System.FilePath (takeFileName, (</>))
 import UnliftIO
+import UnliftIO.Concurrent
 import UnliftIO.Directory
 import qualified UnliftIO.Exception as E

-startXFTPWorkers :: AgentClient -> Maybe FilePath -> AM ()
-startXFTPWorkers c workDir = do
+startWorkers :: AgentMonad m => AgentClient -> Maybe FilePath -> m ()
+startWorkers c workDir = do
  wd <- asks $ xftpWorkDir . xftpAgent
  atomically $ writeTVar wd workDir
-  cfg <- asks config
-  startRcvFiles cfg
-  startSndFiles cfg
-  startDelFiles cfg
+  startRcvFiles
+  startSndFiles
+  startDelFiles
  where
-    startRcvFiles :: AgentConfig -> AM ()
-    startRcvFiles AgentConfig {rcvFilesTTL} = do
+    startRcvFiles = do
+      rcvFilesTTL <- asks $ rcvFilesTTL . config
      pendingRcvServers <- withStore' c (`getPendingRcvFilesServers` rcvFilesTTL)
-      lift . forM_ pendingRcvServers $ \s -> resumeXFTPRcvWork c (Just s)
+      forM_ pendingRcvServers $ \s -> addXFTPRcvWorker c (Just s)
      -- start local worker for files pending decryption,
      -- no need to make an extra query for the check
      -- as the worker will check the store anyway
-      lift $ resumeXFTPRcvWork c Nothing
-    startSndFiles :: AgentConfig -> AM ()
-    startSndFiles AgentConfig {sndFilesTTL} = do
+      addXFTPRcvWorker c Nothing
+    startSndFiles = do
+      sndFilesTTL <- asks $ sndFilesTTL . config
      -- start worker for files pending encryption/creation
-      lift $ resumeXFTPSndWork c Nothing
+      addXFTPSndWorker c Nothing
      pendingSndServers <- withStore' c (`getPendingSndFilesServers` sndFilesTTL)
-      lift . forM_ pendingSndServers $ \s -> resumeXFTPSndWork c (Just s)
-    startDelFiles :: AgentConfig -> AM ()
-    startDelFiles AgentConfig {rcvFilesTTL} = do
+      forM_ pendingSndServers $ \s -> addXFTPSndWorker c (Just s)
+    startDelFiles = do
+      rcvFilesTTL <- asks $ rcvFilesTTL . config
      pendingDelServers <- withStore' c (`getPendingDelFilesServers` rcvFilesTTL)
-      lift . forM_ pendingDelServers $ resumeXFTPDelWork c
+      forM_ pendingDelServers $ addXFTPDelWorker c

-closeXFTPAgent :: XFTPAgent -> IO ()
-closeXFTPAgent a = do
-  stopWorkers $ xftpRcvWorkers a
-  stopWorkers $ xftpSndWorkers a
-  stopWorkers $ xftpDelWorkers a
+closeXFTPAgent :: MonadUnliftIO m => XFTPAgent -> m ()
+closeXFTPAgent XFTPAgent {xftpRcvWorkers, xftpSndWorkers} = do
+  stopWorkers xftpRcvWorkers
+  stopWorkers xftpSndWorkers
  where
-    stopWorkers workers = atomically (swapTVar workers M.empty) >>= mapM_ (liftIO . cancelWorker)
+    stopWorkers wsSel = do
+      ws <- atomically $ stateTVar wsSel (,M.empty)
+      mapM_ (uninterruptibleCancel . snd) ws

-xftpReceiveFile' :: AgentClient -> UserId -> ValidFileDescription 'FRecipient -> Maybe CryptoFileArgs -> AM RcvFileId
-xftpReceiveFile' c userId (ValidFileDescription fd@FileDescription {chunks, redirect}) cfArgs = do
-  g <- asks random
-  prefixPath <- lift $ getPrefixPath "rcv.xftp"
+receiveFile :: AgentMonad m => AgentClient -> UserId -> ValidFileDescription 'FRecipient -> m RcvFileId
+receiveFile c userId (ValidFileDescription fd@FileDescription {chunks}) = do
+  g <- asks idsDrg
+  prefixPath <- getPrefixPath "rcv.xftp"
  createDirectory prefixPath
  let relPrefixPath = takeFileName prefixPath
      relTmpPath = relPrefixPath </> "xftp.encrypted"
      relSavePath = relPrefixPath </> "xftp.decrypted"
-  lift $ createDirectory =<< toFSFilePath relTmpPath
-  lift $ createEmptyFile =<< toFSFilePath relSavePath
-  let saveFile = CryptoFile relSavePath cfArgs
-  fId <- case redirect of
-    Nothing -> withStore c $ \db -> createRcvFile db g userId fd relPrefixPath relTmpPath saveFile
-    Just _ -> do
-      -- prepare description paths
-      let relTmpPathRedirect = relPrefixPath </> "xftp.redirect-encrypted"
-          relSavePathRedirect = relPrefixPath </> "xftp.redirect-decrypted"
-      lift $ createDirectory =<< toFSFilePath relTmpPathRedirect
-      lift $ createEmptyFile =<< toFSFilePath relSavePathRedirect
-      cfArgsRedirect <- atomically $ CF.randomArgs g
-      let saveFileRedirect = CryptoFile relSavePathRedirect $ Just cfArgsRedirect
-      -- create download tasks
-      withStore c $ \db -> createRcvFileRedirect db g userId fd relPrefixPath relTmpPathRedirect saveFileRedirect relTmpPath saveFile
-  forM_ chunks (downloadChunk c)
+  createDirectory =<< toFSFilePath relTmpPath
+  createEmptyFile =<< toFSFilePath relSavePath
+  fId <- withStore c $ \db -> createRcvFile db g userId fd relPrefixPath relTmpPath relSavePath
+  forM_ chunks downloadChunk
  pure fId
+  where
+    downloadChunk :: AgentMonad m => FileChunk -> m ()
+    downloadChunk FileChunk {replicas = (FileChunkReplica {server} : _)} = do
+      addXFTPRcvWorker c (Just server)
+    downloadChunk _ = throwError $ INTERNAL "no replicas"

-downloadChunk :: AgentClient -> FileChunk -> AM ()
-downloadChunk c FileChunk {replicas = (FileChunkReplica {server} : _)} = do
-  lift . void $ getXFTPRcvWorker True c (Just server)
-downloadChunk _ _ = throwError $ INTERNAL "no replicas"
-
-getPrefixPath :: String -> AM' FilePath
+getPrefixPath :: AgentMonad m => String -> m FilePath
 getPrefixPath suffix = do
  workPath <- getXFTPWorkPath
  ts <- liftIO getCurrentTime
  let isoTime = formatTime defaultTimeLocale "%Y%m%d_%H%M%S_%6q" ts
  uniqueCombine workPath (isoTime <> "_" <> suffix)

-toFSFilePath :: FilePath -> AM' FilePath
+toFSFilePath :: AgentMonad m => FilePath -> m FilePath
 toFSFilePath f = (</> f) <$> getXFTPWorkPath

-createEmptyFile :: FilePath -> AM' ()
-createEmptyFile fPath = liftIO $ B.writeFile fPath ""
+createEmptyFile :: AgentMonad m => FilePath -> m ()
+createEmptyFile fPath = do
+  h <- openFile fPath AppendMode
+  liftIO $ B.hPut h "" >> hFlush h

-resumeXFTPRcvWork :: AgentClient -> Maybe XFTPServer -> AM' ()
-resumeXFTPRcvWork = void .: getXFTPRcvWorker False
+addXFTPRcvWorker :: AgentMonad m => AgentClient -> Maybe XFTPServer -> m ()
+addXFTPRcvWorker c = addWorker c xftpRcvWorkers runXFTPRcvWorker runXFTPRcvLocalWorker

-getXFTPRcvWorker :: Bool -> AgentClient -> Maybe XFTPServer -> AM' Worker
-getXFTPRcvWorker hasWork c server = do
-  ws <- asks $ xftpRcvWorkers . xftpAgent
-  getAgentWorker "xftp_rcv" hasWork c server ws $
-    maybe (runXFTPRcvLocalWorker c) (runXFTPRcvWorker c) server
+addWorker ::
+  AgentMonad m =>
+  AgentClient ->
+  (XFTPAgent -> TMap (Maybe XFTPServer) (TMVar (), Async ())) ->
+  (AgentClient -> XFTPServer -> TMVar () -> m ()) ->
+  (AgentClient -> TMVar () -> m ()) ->
+  Maybe XFTPServer ->
+  m ()
+addWorker c wsSel runWorker runWorkerNoSrv srv_ = do
+  ws <- asks $ wsSel . xftpAgent
+  atomically (TM.lookup srv_ ws) >>= \case
+    Nothing -> do
+      doWork <- newTMVarIO ()
+      let runWorker' = case srv_ of
+            Just srv -> runWorker c srv doWork
+            Nothing -> runWorkerNoSrv c doWork
+      worker <- async $ runWorker' `E.finally` atomically (TM.delete srv_ ws)
+      atomically $ TM.insert srv_ (doWork, worker) ws
+    Just (doWork, _) ->
+      void . atomically $ tryPutTMVar doWork ()

-runXFTPRcvWorker :: AgentClient -> XFTPServer -> Worker -> AM ()
-runXFTPRcvWorker c srv Worker {doWork} = do
-  cfg <- asks config
+runXFTPRcvWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
+runXFTPRcvWorker c srv doWork = do
  forever $ do
-    lift $ waitForWork doWork
+    void . atomically $ readTMVar doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation cfg
+    runXFTPOperation
  where
-    runXFTPOperation :: AgentConfig -> AM ()
-    runXFTPOperation AgentConfig {rcvFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} =
-      withWork c doWork (\db -> getNextRcvChunkToDownload db srv rcvFilesTTL) $ \case
-        RcvFileChunk {rcvFileId, rcvFileEntityId, fileTmpPath, replicas = []} -> rcvWorkerInternalError c rcvFileId rcvFileEntityId (Just fileTmpPath) "chunk has no replicas"
-        fc@RcvFileChunk {userId, rcvFileId, rcvFileEntityId, digest, fileTmpPath, replicas = replica@RcvFileChunkReplica {rcvChunkReplicaId, server, delay} : _} -> do
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    runXFTPOperation :: m ()
+    runXFTPOperation = do
+      rcvFilesTTL <- asks (rcvFilesTTL . config)
+      nextChunk <- withStore' c $ \db -> getNextRcvChunkToDownload db srv rcvFilesTTL
+      case nextChunk of
+        Nothing -> noWorkToDo
+        Just RcvFileChunk {rcvFileId, rcvFileEntityId, fileTmpPath, replicas = []} -> rcvWorkerInternalError c rcvFileId rcvFileEntityId (Just fileTmpPath) "chunk has no replicas"
+        Just fc@RcvFileChunk {userId, rcvFileId, rcvFileEntityId, digest, fileTmpPath, replicas = replica@RcvFileChunkReplica {rcvChunkReplicaId, server, delay} : _} -> do
+          ri <- asks $ reconnectInterval . config
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop -> do
-            lift $ waitForUserNetwork c
+          withRetryInterval ri' $ \delay' loop ->
            downloadFileChunk fc replica
-              `catchAgentError` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
+              `catchError` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAgentError (\_ -> pure ()) $ do
+              flip catchError (\_ -> pure ()) $ do
+                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
                when notifyOnRetry $ notify c rcvFileEntityId $ RFERR e
-                liftIO $ closeXFTPServerClient c userId server digest
+                closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateRcvChunkReplicaDelay db rcvChunkReplicaId replicaDelay
              atomically $ assertAgentForeground c
              loop
            retryDone e = rcvWorkerInternalError c rcvFileId rcvFileEntityId (Just fileTmpPath) (show e)
-    downloadFileChunk :: RcvFileChunk -> RcvFileChunkReplica -> AM ()
+    downloadFileChunk :: RcvFileChunk -> RcvFileChunkReplica -> m ()
    downloadFileChunk RcvFileChunk {userId, rcvFileId, rcvFileEntityId, rcvChunkId, chunkNo, chunkSize, digest, fileTmpPath} replica = do
-      fsFileTmpPath <- lift $ toFSFilePath fileTmpPath
+      fsFileTmpPath <- toFSFilePath fileTmpPath
      chunkPath <- uniqueCombine fsFileTmpPath $ show chunkNo
      let chunkSpec = XFTPRcvChunkSpec chunkPath (unFileSize chunkSize) (unFileDigest digest)
          relChunkPath = fileTmpPath </> takeFileName chunkPath
      agentXFTPDownloadChunk c userId digest replica chunkSpec
-      atomically $ waitUntilForeground c
-      (entityId, complete, progress) <- withStore c $ \db -> runExceptT $ do
+      (complete, progress) <- withStore c $ \db -> runExceptT $ do
        liftIO $ updateRcvFileChunkReceived db (rcvChunkReplicaId replica) rcvChunkId relChunkPath
-        RcvFile {size = FileSize currentSize, chunks, redirect} <- ExceptT $ getRcvFile db rcvFileId
+        RcvFile {size = FileSize total, chunks} <- ExceptT $ getRcvFile db rcvFileId
        let rcvd = receivedSize chunks
            complete = all chunkReceived chunks
-            (entityId, total) = case redirect of
-              Nothing -> (rcvFileEntityId, currentSize)
-              Just RcvFileRedirect {redirectFileInfo = RedirectFileInfo {size = FileSize finalSize}, redirectEntityId} -> (redirectEntityId, finalSize)
        liftIO . when complete $ updateRcvFileStatus db rcvFileId RFSReceived
-        pure (entityId, complete, RFPROG rcvd total)
-      notify c entityId progress
-      when complete . lift . void $
-        getXFTPRcvWorker True c Nothing
+        pure (complete, RFPROG rcvd total)
+      notify c rcvFileEntityId progress
+      when complete $ addXFTPRcvWorker c Nothing
      where
        receivedSize :: [RcvFileChunk] -> Int64
        receivedSize = foldl' (\sz ch -> sz + receivedChunkSize ch) 0
@@ -221,212 +222,209 @@ runXFTPRcvWorker c srv Worker {doWork} = do
          | otherwise = 0
        chunkReceived RcvFileChunk {replicas} = any received replicas

-- The first call of action has n == 0, maxN is max number of retries
-withRetryIntervalLimit :: forall m. MonadIO m => Int -> RetryInterval -> (Int64 -> m () -> m ()) -> m ()
-withRetryIntervalLimit maxN ri action =
-  withRetryIntervalCount ri $ \n delay loop ->
-    when (n < maxN) $ action delay loop
-
-retryOnError :: Text -> AM a -> AM a -> AgentErrorType -> AM a
+retryOnError :: AgentMonad m => Text -> m a -> m a -> AgentErrorType -> m a
 retryOnError name loop done e = do
  logError $ name <> " error: " <> tshow e
  if temporaryAgentError e
    then loop
    else done

-rcvWorkerInternalError :: AgentClient -> DBRcvFileId -> RcvFileId -> Maybe FilePath -> String -> AM ()
+rcvWorkerInternalError :: AgentMonad m => AgentClient -> DBRcvFileId -> RcvFileId -> Maybe FilePath -> String -> m ()
 rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath internalErrStr = do
-  lift $ forM_ tmpPath (removePath <=< toFSFilePath)
+  forM_ tmpPath (removePath <=< toFSFilePath)
  withStore' c $ \db -> updateRcvFileError db rcvFileId internalErrStr
  notify c rcvFileEntityId $ RFERR $ INTERNAL internalErrStr

-runXFTPRcvLocalWorker :: AgentClient -> Worker -> AM ()
-runXFTPRcvLocalWorker c Worker {doWork} = do
-  cfg <- asks config
+runXFTPRcvLocalWorker :: forall m. AgentMonad m => AgentClient -> TMVar () -> m ()
+runXFTPRcvLocalWorker c doWork = do
  forever $ do
-    lift $ waitForWork doWork
+    void . atomically $ readTMVar doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation cfg
+    runXFTPOperation
  where
-    runXFTPOperation :: AgentConfig -> AM ()
-    runXFTPOperation AgentConfig {rcvFilesTTL} =
-      withWork c doWork (`getNextRcvFileToDecrypt` rcvFilesTTL) $
-        \f@RcvFile {rcvFileId, rcvFileEntityId, tmpPath} ->
-          decryptFile f `catchAgentError` (rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath . show)
-    decryptFile :: RcvFile -> AM ()
-    decryptFile RcvFile {rcvFileId, rcvFileEntityId, size, digest, key, nonce, tmpPath, saveFile, status, chunks, redirect} = do
-      let CryptoFile savePath cfArgs = saveFile
-      fsSavePath <- lift $ toFSFilePath savePath
-      lift . when (status == RFSDecrypting) $
+    runXFTPOperation :: m ()
+    runXFTPOperation = do
+      rcvFilesTTL <- asks (rcvFilesTTL . config)
+      nextFile <- withStore' c (`getNextRcvFileToDecrypt` rcvFilesTTL)
+      case nextFile of
+        Nothing -> noWorkToDo
+        Just f@RcvFile {rcvFileId, rcvFileEntityId, tmpPath} ->
+          decryptFile f `catchError` (rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath . show)
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    decryptFile :: RcvFile -> m ()
+    decryptFile RcvFile {rcvFileId, rcvFileEntityId, key, nonce, tmpPath, savePath, status, chunks} = do
+      fsSavePath <- toFSFilePath savePath
+      when (status == RFSDecrypting) $
        whenM (doesFileExist fsSavePath) (removeFile fsSavePath >> createEmptyFile fsSavePath)
      withStore' c $ \db -> updateRcvFileStatus db rcvFileId RFSDecrypting
      chunkPaths <- getChunkPaths chunks
      encSize <- liftIO $ foldM (\s path -> (s +) . fromIntegral <$> getFileSize path) 0 chunkPaths
-      when (FileSize encSize /= size) $ throwError $ XFTP XFTP.SIZE
-      encDigest <- liftIO $ LC.sha512Hash <$> readChunks chunkPaths
-      when (FileDigest encDigest /= digest) $ throwError $ XFTP XFTP.DIGEST
-      let destFile = CryptoFile fsSavePath cfArgs
-      void $ liftError (INTERNAL . show) $ decryptChunks encSize chunkPaths key nonce $ \_ -> pure destFile
-      case redirect of
-        Nothing -> do
-          notify c rcvFileEntityId $ RFDONE fsSavePath
-          lift $ forM_ tmpPath (removePath <=< toFSFilePath)
-          atomically $ waitUntilForeground c
-          withStore' c (`updateRcvFileComplete` rcvFileId)
-        Just RcvFileRedirect {redirectFileInfo, redirectDbId} -> do
-          let RedirectFileInfo {size = redirectSize, digest = redirectDigest} = redirectFileInfo
-          lift $ forM_ tmpPath (removePath <=< toFSFilePath)
-          atomically $ waitUntilForeground c
-          withStore' c (`updateRcvFileComplete` rcvFileId)
-          -- proceed with redirect
-          yaml <- liftError (INTERNAL . show) (CF.readFile $ CryptoFile fsSavePath cfArgs) `agentFinally` (lift $ toFSFilePath fsSavePath >>= removePath)
-          next@FileDescription {chunks = nextChunks} <- case strDecode (LB.toStrict yaml) of
-            Left _ -> throwError . XFTP $ XFTP.REDIRECT "decode error"
-            Right (ValidFileDescription fd@FileDescription {size = dstSize, digest = dstDigest})
-              | dstSize /= redirectSize -> throwError . XFTP $ XFTP.REDIRECT "size mismatch"
-              | dstDigest /= redirectDigest -> throwError . XFTP $ XFTP.REDIRECT "digest mismatch"
-              | otherwise -> pure fd
-          -- register and download chunks from the actual file
-          withStore c $ \db -> updateRcvFileRedirect db redirectDbId next
-          forM_ nextChunks (downloadChunk c)
+      void $ liftError (INTERNAL . show) $ decryptChunks encSize chunkPaths key nonce $ \_ -> pure fsSavePath
+      notify c rcvFileEntityId $ RFDONE fsSavePath
+      forM_ tmpPath (removePath <=< toFSFilePath)
+      withStore' c (`updateRcvFileComplete` rcvFileId)
      where
-        getChunkPaths :: [RcvFileChunk] -> AM [FilePath]
+        getChunkPaths :: [RcvFileChunk] -> m [FilePath]
        getChunkPaths [] = pure []
        getChunkPaths (RcvFileChunk {chunkTmpPath = Just path} : cs) = do
          ps <- getChunkPaths cs
-          fsPath <- lift $ toFSFilePath path
+          fsPath <- toFSFilePath path
          pure $ fsPath : ps
        getChunkPaths (RcvFileChunk {chunkTmpPath = Nothing} : _cs) =
          throwError $ INTERNAL "no chunk path"

-xftpDeleteRcvFile' :: AgentClient -> RcvFileId -> AM' ()
-xftpDeleteRcvFile' c rcvFileEntityId = xftpDeleteRcvFiles' c [rcvFileEntityId]
+deleteRcvFile :: AgentMonad m => AgentClient -> RcvFileId -> m ()
+deleteRcvFile c rcvFileEntityId = do
+  RcvFile {rcvFileId, prefixPath, status} <- withStore c $ \db -> getRcvFileByEntityId db rcvFileEntityId
+  if status == RFSComplete || status == RFSError
+    then do
+      removePath prefixPath
+      withStore' c (`deleteRcvFile'` rcvFileId)
+    else withStore' c (`updateRcvFileDeleted` rcvFileId)

-xftpDeleteRcvFiles' :: AgentClient -> [RcvFileId] -> AM' ()
-xftpDeleteRcvFiles' c rcvFileEntityIds = do
-  rcvFiles <- rights <$> withStoreBatch c (\db -> map (fmap (first storeError) . getRcvFileByEntityId db) rcvFileEntityIds)
-  redirects <- rights <$> batchFiles getRcvFileRedirects rcvFiles
-  let (toDelete, toMarkDeleted) = partition fileComplete $ concat redirects <> rcvFiles
-  void $ batchFiles deleteRcvFile' toDelete
-  void $ batchFiles updateRcvFileDeleted toMarkDeleted
-  workPath <- getXFTPWorkPath
-  liftIO . forM_ toDelete $ \RcvFile {prefixPath} ->
-    (removePath . (workPath </>)) prefixPath `catchAll_` pure ()
+sendFileExperimental :: forall m. AgentMonad m => AgentClient -> UserId -> FilePath -> Int -> m SndFileId
+sendFileExperimental c@AgentClient {xftpServers} userId filePath numRecipients = do
+  g <- asks idsDrg
+  sndFileId <- liftIO $ randomId g 12
+  xftpSrvs <- atomically $ TM.lookup userId xftpServers
+  void $ forkIO $ sendCLI sndFileId $ maybe [] L.toList xftpSrvs
+  pure sndFileId
  where
-    fileComplete RcvFile {status} = status == RFSComplete || status == RFSError
-    batchFiles :: (DB.Connection -> DBRcvFileId -> IO a) -> [RcvFile] -> AM' [Either AgentErrorType a]
-    batchFiles f rcvFiles = withStoreBatch' c $ \db -> map (\RcvFile {rcvFileId} -> f db rcvFileId) rcvFiles
+    randomId :: TVar ChaChaDRG -> Int -> IO ByteString
+    randomId gVar n = U.encode <$> (atomically . stateTVar gVar $ randomBytesGenerate n)
+    sendCLI :: SndFileId -> [XFTPServerWithAuth] -> m ()
+    sendCLI sndFileId xftpSrvs = do
+      let fileName = takeFileName filePath
+      workPath <- getXFTPWorkPath
+      outputDir <- uniqueCombine workPath $ fileName <> ".descr"
+      createDirectory outputDir
+      let tempPath = workPath </> "snd"
+      createDirectoryIfMissing False tempPath
+      runSend fileName outputDir tempPath `catchError` \e -> do
+        cleanup outputDir tempPath
+        notify c sndFileId $ SFERR e
+      where
+        runSend :: String -> FilePath -> FilePath -> m ()
+        runSend fileName outputDir tempPath = do
+          let sendOptions =
+                SendOptions
+                  { filePath,
+                    outputDir = Just outputDir,
+                    numRecipients,
+                    xftpServers = xftpSrvs,
+                    retryCount = 3,
+                    tempPath = Just tempPath,
+                    verbose = False
+                  }
+          liftCLI $ cliSendFileOpts sendOptions False $ notify c sndFileId .: SFPROG
+          (sndDescr, rcvDescrs) <- readDescrs outputDir fileName
+          cleanup outputDir tempPath
+          notify c sndFileId $ SFDONE sndDescr rcvDescrs
+        cleanup :: FilePath -> FilePath -> m ()
+        cleanup outputDir tempPath = do
+          removePath tempPath
+          removePath outputDir
+    liftCLI :: ExceptT CLIError IO () -> m ()
+    liftCLI = either (throwError . INTERNAL . show) pure <=< liftIO . runExceptT
+    readDescrs :: FilePath -> FilePath -> m (ValidFileDescription 'FSender, [ValidFileDescription 'FRecipient])
+    readDescrs outDir fileName = do
+      let descrDir = outDir </> (fileName <> ".xftp")
+      files <- listDirectory descrDir
+      let (sdFiles, rdFiles) = partition ("snd.xftp.private" `isSuffixOf`) files
+          sdFile = maybe "" (\l -> descrDir </> L.head l) (nonEmpty sdFiles)
+          rdFiles' = map (descrDir </>) rdFiles
+      (,) <$> readDescr sdFile <*> mapM readDescr rdFiles'
+    readDescr :: FilePartyI p => FilePath -> m (ValidFileDescription p)
+    readDescr f = liftIOEither $ first INTERNAL . strDecode <$> B.readFile f

-notify :: forall m e. (MonadIO m, AEntityI e) => AgentClient -> EntityId -> ACommand 'Agent e -> m ()
+notify :: forall m e. (MonadUnliftIO m, AEntityI e) => AgentClient -> EntityId -> ACommand 'Agent e -> m ()
 notify c entId cmd = atomically $ writeTBQueue (subQ c) ("", entId, APC (sAEntity @e) cmd)

-xftpSendFile' :: AgentClient -> UserId -> CryptoFile -> Int -> AM SndFileId
-xftpSendFile' c userId file numRecipients = do
-  g <- asks random
-  prefixPath <- lift $ getPrefixPath "snd.xftp"
+sendFile :: AgentMonad m => AgentClient -> UserId -> FilePath -> Int -> m SndFileId
+sendFile c userId filePath numRecipients = do
+  g <- asks idsDrg
+  prefixPath <- getPrefixPath "snd.xftp"
  createDirectory prefixPath
  let relPrefixPath = takeFileName prefixPath
-  key <- atomically $ C.randomSbKey g
-  nonce <- atomically $ C.randomCbNonce g
+  key <- liftIO C.randomSbKey
+  nonce <- liftIO C.randomCbNonce
  -- saving absolute filePath will not allow to restore file encryption after app update, but it's a short window
-  fId <- withStore c $ \db -> createSndFile db g userId file numRecipients relPrefixPath key nonce Nothing
-  lift . void $ getXFTPSndWorker True c Nothing
+  fId <- withStore c $ \db -> createSndFile db g userId numRecipients filePath relPrefixPath key nonce
+  addXFTPSndWorker c Nothing
  pure fId

-xftpSendDescription' :: AgentClient -> UserId -> ValidFileDescription 'FRecipient -> Int -> AM SndFileId
-xftpSendDescription' c userId (ValidFileDescription fdDirect@FileDescription {size, digest}) numRecipients = do
-  g <- asks random
-  prefixPath <- lift $ getPrefixPath "snd.xftp"
-  createDirectory prefixPath
-  let relPrefixPath = takeFileName prefixPath
-  let directYaml = prefixPath </> "direct.yaml"
-  cfArgs <- atomically $ CF.randomArgs g
-  let file = CryptoFile directYaml (Just cfArgs)
-  liftError (INTERNAL . show) $ CF.writeFile file (LB.fromStrict $ strEncode fdDirect)
-  key <- atomically $ C.randomSbKey g
-  nonce <- atomically $ C.randomCbNonce g
-  fId <- withStore c $ \db -> createSndFile db g userId file numRecipients relPrefixPath key nonce $ Just RedirectFileInfo {size, digest}
-  lift . void $ getXFTPSndWorker True c Nothing
-  pure fId
+addXFTPSndWorker :: AgentMonad m => AgentClient -> Maybe XFTPServer -> m ()
+addXFTPSndWorker c = addWorker c xftpSndWorkers runXFTPSndWorker runXFTPSndPrepareWorker

-resumeXFTPSndWork :: AgentClient -> Maybe XFTPServer -> AM' ()
-resumeXFTPSndWork = void .: getXFTPSndWorker False
-
-getXFTPSndWorker :: Bool -> AgentClient -> Maybe XFTPServer -> AM' Worker
-getXFTPSndWorker hasWork c server = do
-  ws <- asks $ xftpSndWorkers . xftpAgent
-  getAgentWorker "xftp_snd" hasWork c server ws $
-    maybe (runXFTPSndPrepareWorker c) (runXFTPSndWorker c) server
-
-runXFTPSndPrepareWorker :: AgentClient -> Worker -> AM ()
-runXFTPSndPrepareWorker c Worker {doWork} = do
-  cfg <- asks config
+runXFTPSndPrepareWorker :: forall m. AgentMonad m => AgentClient -> TMVar () -> m ()
+runXFTPSndPrepareWorker c doWork = do
  forever $ do
-    lift $ waitForWork doWork
+    void . atomically $ readTMVar doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation cfg
+    runXFTPOperation
  where
-    runXFTPOperation :: AgentConfig -> AM ()
-    runXFTPOperation cfg@AgentConfig {sndFilesTTL} =
-      withWork c doWork (`getNextSndFileToPrepare` sndFilesTTL) $
-        \f@SndFile {sndFileId, sndFileEntityId, prefixPath} ->
-          prepareFile cfg f `catchAgentError` (sndWorkerInternalError c sndFileId sndFileEntityId prefixPath . show)
-    prepareFile :: AgentConfig -> SndFile -> AM ()
-    prepareFile _ SndFile {prefixPath = Nothing} =
+    runXFTPOperation :: m ()
+    runXFTPOperation = do
+      sndFilesTTL <- asks (sndFilesTTL . config)
+      nextFile <- withStore' c (`getNextSndFileToPrepare` sndFilesTTL)
+      case nextFile of
+        Nothing -> noWorkToDo
+        Just f@SndFile {sndFileId, sndFileEntityId, prefixPath} ->
+          prepareFile f `catchError` (sndWorkerInternalError c sndFileId sndFileEntityId prefixPath . show)
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    prepareFile :: SndFile -> m ()
+    prepareFile SndFile {prefixPath = Nothing} =
      throwError $ INTERNAL "no prefix path"
-    prepareFile cfg sndFile@SndFile {sndFileId, userId, prefixPath = Just ppath, status} = do
+    prepareFile sndFile@SndFile {sndFileId, userId, prefixPath = Just ppath, status} = do
      SndFile {numRecipients, chunks} <-
        if status /= SFSEncrypted -- status is SFSNew or SFSEncrypting
          then do
-            fsEncPath <- lift . toFSFilePath $ sndFileEncPath ppath
-            when (status == SFSEncrypting) . whenM (doesFileExist fsEncPath) $
-              removeFile fsEncPath
+            fsEncPath <- toFSFilePath $ sndFileEncPath ppath
+            when (status == SFSEncrypting) $
+              whenM (doesFileExist fsEncPath) $ removeFile fsEncPath
            withStore' c $ \db -> updateSndFileStatus db sndFileId SFSEncrypting
            (digest, chunkSpecsDigests) <- encryptFileForUpload sndFile fsEncPath
            withStore c $ \db -> do
              updateSndFileEncrypted db sndFileId digest chunkSpecsDigests
              getSndFile db sndFileId
          else pure sndFile
+      maxRecipients <- asks (xftpMaxRecipientsPerRequest . config)
      let numRecipients' = min numRecipients maxRecipients
      -- concurrently?
-      -- separate worker to create chunks? record retries and delay on snd_file_chunks?
-      forM_ (filter (\SndFileChunk {replicas} -> null replicas) chunks) $ createChunk numRecipients'
+      forM_ (filter (not . chunkCreated) chunks) $ createChunk numRecipients'
      withStore' c $ \db -> updateSndFileStatus db sndFileId SFSUploading
      where
-        AgentConfig {xftpMaxRecipientsPerRequest = maxRecipients, messageRetryInterval = ri} = cfg
-        encryptFileForUpload :: SndFile -> FilePath -> AM (FileDigest, [(XFTPChunkSpec, FileDigest)])
-        encryptFileForUpload SndFile {key, nonce, srcFile, redirect} fsEncPath = do
-          let CryptoFile {filePath} = srcFile
-              fileName = takeFileName filePath
-          fileSize <- liftIO $ fromInteger <$> CF.getFileContentsSize srcFile
-          when (fileSize > maxFileSizeHard) $ throwError $ INTERNAL "max file size exceeded"
+        encryptFileForUpload :: SndFile -> FilePath -> m (FileDigest, [(XFTPChunkSpec, FileDigest)])
+        encryptFileForUpload SndFile {key, nonce, filePath} fsEncPath = do
+          let fileName = takeFileName filePath
+          fileSize <- fromInteger <$> getFileSize filePath
+          when (fileSize > maxFileSize) $ throwError $ INTERNAL "max file size exceeded"
          let fileHdr = smpEncode FileHeader {fileName, fileExtra = Nothing}
              fileSize' = fromIntegral (B.length fileHdr) + fileSize
-              payloadSize = fileSize' + fileSizeLen + authTagSize
-          chunkSizes <- case redirect of
-            Nothing -> pure $ prepareChunkSizes payloadSize
-            Just _ -> case singleChunkSize payloadSize of
-              Nothing -> throwError $ INTERNAL "max file size exceeded for redirect"
-              Just chunkSize -> pure [chunkSize]
-          let encSize = sum $ map fromIntegral chunkSizes
-          void $ liftError (INTERNAL . show) $ encryptFile srcFile fileHdr key nonce fileSize' encSize fsEncPath
+              chunkSizes = prepareChunkSizes $ fileSize' + fileSizeLen + authTagSize
+              chunkSizes' = map fromIntegral chunkSizes
+              encSize = sum chunkSizes'
+          void $ liftError (INTERNAL . show) $ encryptFile filePath fileHdr key nonce fileSize' encSize fsEncPath
          digest <- liftIO $ LC.sha512Hash <$> LB.readFile fsEncPath
          let chunkSpecs = prepareChunkSpecs fsEncPath chunkSizes
-          chunkDigests <- liftIO $ mapM getChunkDigest chunkSpecs
-          pure (FileDigest digest, zip chunkSpecs $ coerce chunkDigests)
-        createChunk :: Int -> SndFileChunk -> AM ()
+          chunkDigests <- map FileDigest <$> mapM (liftIO . getChunkDigest) chunkSpecs
+          pure (FileDigest digest, zip chunkSpecs chunkDigests)
+        chunkCreated :: SndFileChunk -> Bool
+        chunkCreated SndFileChunk {replicas} =
+          any (\SndFileChunkReplica {replicaStatus} -> replicaStatus == SFRSCreated) replicas
+        createChunk :: Int -> SndFileChunk -> m ()
        createChunk numRecipients' ch = do
          atomically $ assertAgentForeground c
          (replica, ProtoServerWithAuth srv _) <- tryCreate
          withStore' c $ \db -> createSndFileReplica db ch replica
-          lift . void $ getXFTPSndWorker True c (Just srv)
+          addXFTPSndWorker c $ Just srv
          where
            tryCreate = do
+              ri <- asks $ messageRetryInterval . config
              usedSrvs <- newTVarIO ([] :: [XFTPServer])
-              withRetryInterval (riFast ri) $ \_ loop -> do
-                lift $ waitForUserNetwork c
+              withRetryInterval (riFast ri) $ \_ loop ->
                createWithNextSrv usedSrvs
-                  `catchAgentError` \e -> retryOnError "XFTP prepare worker" (retryLoop loop) (throwError e) e
+                  `catchError` \e -> retryOnError "XFTP prepare worker" (retryLoop loop) (throwError e) e
              where
                retryLoop loop = atomically (assertAgentForeground c) >> loop
            createWithNextSrv usedSrvs = do
@@ -436,48 +434,51 @@ runXFTPSndPrepareWorker c Worker {doWork} = do
                replica <- agentXFTPNewChunk c ch numRecipients' srvAuth
                pure (replica, srvAuth)

-sndWorkerInternalError :: AgentClient -> DBSndFileId -> SndFileId -> Maybe FilePath -> String -> AM ()
+sndWorkerInternalError :: AgentMonad m => AgentClient -> DBSndFileId -> SndFileId -> Maybe FilePath -> String -> m ()
 sndWorkerInternalError c sndFileId sndFileEntityId prefixPath internalErrStr = do
-  lift . forM_ prefixPath $ removePath <=< toFSFilePath
+  forM_ prefixPath $ removePath <=< toFSFilePath
  withStore' c $ \db -> updateSndFileError db sndFileId internalErrStr
  notify c sndFileEntityId $ SFERR $ INTERNAL internalErrStr

-runXFTPSndWorker :: AgentClient -> XFTPServer -> Worker -> AM ()
-runXFTPSndWorker c srv Worker {doWork} = do
-  cfg <- asks config
+runXFTPSndWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
+runXFTPSndWorker c srv doWork = do
  forever $ do
-    lift $ waitForWork doWork
+    void . atomically $ readTMVar doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation cfg
+    runXFTPOperation
  where
-    runXFTPOperation :: AgentConfig -> AM ()
-    runXFTPOperation cfg@AgentConfig {sndFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} = do
-      withWork c doWork (\db -> getNextSndChunkToUpload db srv sndFilesTTL) $ \case
-        SndFileChunk {sndFileId, sndFileEntityId, filePrefixPath, replicas = []} -> sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) "chunk has no replicas"
-        fc@SndFileChunk {userId, sndFileId, sndFileEntityId, filePrefixPath, digest, replicas = replica@SndFileChunkReplica {sndChunkReplicaId, server, delay} : _} -> do
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    runXFTPOperation :: m ()
+    runXFTPOperation = do
+      sndFilesTTL <- asks (sndFilesTTL . config)
+      nextChunk <- withStore' c $ \db -> getNextSndChunkToUpload db srv sndFilesTTL
+      case nextChunk of
+        Nothing -> noWorkToDo
+        Just SndFileChunk {sndFileId, sndFileEntityId, filePrefixPath, replicas = []} -> sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) "chunk has no replicas"
+        Just fc@SndFileChunk {userId, sndFileId, sndFileEntityId, filePrefixPath, digest, replicas = replica@SndFileChunkReplica {sndChunkReplicaId, server, delay} : _} -> do
+          ri <- asks $ reconnectInterval . config
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop -> do
-            lift $ waitForUserNetwork c
-            uploadFileChunk cfg fc replica
-              `catchAgentError` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
+          withRetryInterval ri' $ \delay' loop ->
+            uploadFileChunk fc replica
+              `catchError` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAgentError (\_ -> pure ()) $ do
+              flip catchError (\_ -> pure ()) $ do
+                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
                when notifyOnRetry $ notify c sndFileEntityId $ SFERR e
-                liftIO $ closeXFTPServerClient c userId server digest
+                closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateSndChunkReplicaDelay db sndChunkReplicaId replicaDelay
              atomically $ assertAgentForeground c
              loop
            retryDone e = sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) (show e)
-    uploadFileChunk :: AgentConfig -> SndFileChunk -> SndFileChunkReplica -> AM ()
-    uploadFileChunk AgentConfig {xftpMaxRecipientsPerRequest = maxRecipients} sndFileChunk@SndFileChunk {sndFileId, userId, chunkSpec = chunkSpec@XFTPChunkSpec {filePath}, digest = chunkDigest} replica = do
+    uploadFileChunk :: SndFileChunk -> SndFileChunkReplica -> m ()
+    uploadFileChunk sndFileChunk@SndFileChunk {sndFileId, userId, chunkSpec = chunkSpec@XFTPChunkSpec {filePath}, digest = chunkDigest} replica = do
      replica'@SndFileChunkReplica {sndChunkReplicaId} <- addRecipients sndFileChunk replica
-      fsFilePath <- lift $ toFSFilePath filePath
+      fsFilePath <- toFSFilePath filePath
      unlessM (doesFileExist fsFilePath) $ throwError $ INTERNAL "encrypted file doesn't exist on upload"
      let chunkSpec' = chunkSpec {filePath = fsFilePath} :: XFTPChunkSpec
      atomically $ assertAgentForeground c
      agentXFTPUploadChunk c userId chunkDigest replica' chunkSpec'
-      atomically $ waitUntilForeground c
      sf@SndFile {sndFileEntityId, prefixPath, chunks} <- withStore c $ \db -> do
        updateSndChunkReplicaStatus db sndChunkReplicaId SFRSUploaded
        getSndFile db sndFileId
@@ -488,34 +489,35 @@ runXFTPSndWorker c srv Worker {doWork} = do
      when complete $ do
        (sndDescr, rcvDescrs) <- sndFileToDescrs sf
        notify c sndFileEntityId $ SFDONE sndDescr rcvDescrs
-        lift . forM_ prefixPath $ removePath <=< toFSFilePath
+        forM_ prefixPath $ removePath <=< toFSFilePath
        withStore' c $ \db -> updateSndFileComplete db sndFileId
      where
-        addRecipients :: SndFileChunk -> SndFileChunkReplica -> AM SndFileChunkReplica
+        addRecipients :: SndFileChunk -> SndFileChunkReplica -> m SndFileChunkReplica
        addRecipients ch@SndFileChunk {numRecipients} cr@SndFileChunkReplica {rcvIdsKeys}
          | length rcvIdsKeys > numRecipients = throwError $ INTERNAL "too many recipients"
          | length rcvIdsKeys == numRecipients = pure cr
          | otherwise = do
-              let numRecipients' = min (numRecipients - length rcvIdsKeys) maxRecipients
-              rcvIdsKeys' <- agentXFTPAddRecipients c userId chunkDigest cr numRecipients'
-              cr' <- withStore' c $ \db -> addSndChunkReplicaRecipients db cr $ L.toList rcvIdsKeys'
-              addRecipients ch cr'
-        sndFileToDescrs :: SndFile -> AM (ValidFileDescription 'FSender, [ValidFileDescription 'FRecipient])
+            maxRecipients <- asks $ xftpMaxRecipientsPerRequest . config
+            let numRecipients' = min (numRecipients - length rcvIdsKeys) maxRecipients
+            rcvIdsKeys' <- agentXFTPAddRecipients c userId chunkDigest cr numRecipients'
+            cr' <- withStore' c $ \db -> addSndChunkReplicaRecipients db cr $ L.toList rcvIdsKeys'
+            addRecipients ch cr'
+        sndFileToDescrs :: SndFile -> m (ValidFileDescription 'FSender, [ValidFileDescription 'FRecipient])
        sndFileToDescrs SndFile {digest = Nothing} = throwError $ INTERNAL "snd file has no digest"
        sndFileToDescrs SndFile {chunks = []} = throwError $ INTERNAL "snd file has no chunks"
-        sndFileToDescrs SndFile {digest = Just digest, key, nonce, chunks = chunks@(fstChunk : _), redirect} = do
+        sndFileToDescrs SndFile {digest = Just digest, key, nonce, chunks = chunks@(fstChunk : _)} = do
          let chunkSize = FileSize $ sndChunkSize fstChunk
              size = FileSize $ sum $ map (fromIntegral . sndChunkSize) chunks
          -- snd description
          sndDescrChunks <- mapM toSndDescrChunk chunks
-          let fdSnd = FileDescription {party = SFSender, size, digest, key, nonce, chunkSize, chunks = sndDescrChunks, redirect = Nothing}
+          let fdSnd = FileDescription {party = SFSender, size, digest, key, nonce, chunkSize, chunks = sndDescrChunks}
          validFdSnd <- either (throwError . INTERNAL) pure $ validateFileDescription fdSnd
          -- rcv descriptions
-          let fdRcv = FileDescription {party = SFRecipient, size, digest, key, nonce, chunkSize, chunks = [], redirect}
+          let fdRcv = FileDescription {party = SFRecipient, size, digest, key, nonce, chunkSize, chunks = []}
              fdRcvs = createRcvFileDescriptions fdRcv chunks
          validFdRcvs <- either (throwError . INTERNAL) pure $ mapM validateFileDescription fdRcvs
          pure (validFdSnd, validFdRcvs)
-        toSndDescrChunk :: SndFileChunk -> AM FileChunk
+        toSndDescrChunk :: SndFileChunk -> m FileChunk
        toSndDescrChunk SndFileChunk {replicas = []} = throwError $ INTERNAL "snd file chunk has no replicas"
        toSndDescrChunk ch@SndFileChunk {chunkNo, digest = chDigest, replicas = (SndFileChunkReplica {server, replicaId, replicaKey} : _)} = do
          let chunkSize = FileSize $ sndChunkSize ch
@@ -540,7 +542,7 @@ runXFTPSndWorker c srv Worker {doWork} = do
            rcvChunks :: [[FileChunk]]
            rcvChunks = map (sortChunks . M.elems) $ M.elems $ foldl' addRcvChunk M.empty rcvReplicas
            sortChunks :: [FileChunk] -> [FileChunk]
-            sortChunks = map reverseReplicas . sortOn (\FileChunk {chunkNo} -> chunkNo)
+            sortChunks = map reverseReplicas . sortOn (chunkNo :: FileChunk -> Int)
            reverseReplicas ch@FileChunk {replicas} = (ch :: FileChunk) {replicas = reverse replicas}
            addRcvChunk :: Map Int (Map Int FileChunk) -> SentRecipientReplica -> Map Int (Map Int FileChunk)
            addRcvChunk m SentRecipientReplica {chunkNo, server, rcvNo, replicaId, replicaKey, digest, chunkSize} =
@@ -566,81 +568,74 @@ runXFTPSndWorker c srv Worker {doWork} = do
        chunkUploaded SndFileChunk {replicas} =
          any (\SndFileChunkReplica {replicaStatus} -> replicaStatus == SFRSUploaded) replicas

-deleteSndFileInternal :: AgentClient -> SndFileId -> AM' ()
-deleteSndFileInternal c sndFileEntityId = deleteSndFilesInternal c [sndFileEntityId]
+deleteSndFileInternal :: AgentMonad m => AgentClient -> SndFileId -> m ()
+deleteSndFileInternal c sndFileEntityId = do
+  SndFile {sndFileId, prefixPath, status} <- withStore c $ \db -> getSndFileByEntityId db sndFileEntityId
+  if status == SFSComplete || status == SFSError
+    then do
+      forM_ prefixPath $ removePath <=< toFSFilePath
+      withStore' c (`deleteSndFile'` sndFileId)
+    else withStore' c (`updateSndFileDeleted` sndFileId)

-deleteSndFilesInternal :: AgentClient -> [SndFileId] -> AM' ()
-deleteSndFilesInternal c sndFileEntityIds = do
-  sndFiles <- rights <$> withStoreBatch c (\db -> map (fmap (first storeError) . getSndFileByEntityId db) sndFileEntityIds)
-  let (toDelete, toMarkDeleted) = partition fileComplete sndFiles
-  workPath <- getXFTPWorkPath
-  liftIO . forM_ toDelete $ \SndFile {prefixPath} ->
-    mapM_ (removePath . (workPath </>)) prefixPath `catchAll_` pure ()
-  batchFiles_ deleteSndFile' toDelete
-  batchFiles_ updateSndFileDeleted toMarkDeleted
+deleteSndFileRemote :: forall m. AgentMonad m => AgentClient -> UserId -> SndFileId -> ValidFileDescription 'FSender -> m ()
+deleteSndFileRemote c userId sndFileEntityId (ValidFileDescription FileDescription {chunks}) = do
+  deleteSndFileInternal c sndFileEntityId `catchError` (notify c sndFileEntityId . SFERR)
+  forM_ chunks $ \ch -> deleteFileChunk ch `catchError` (notify c sndFileEntityId . SFERR)
  where
-    fileComplete SndFile {status} = status == SFSComplete || status == SFSError
-    batchFiles_ :: (DB.Connection -> DBSndFileId -> IO a) -> [SndFile] -> AM' ()
-    batchFiles_ f sndFiles = void $ withStoreBatch' c $ \db -> map (\SndFile {sndFileId} -> f db sndFileId) sndFiles
+    deleteFileChunk :: FileChunk -> m ()
+    deleteFileChunk FileChunk {digest, replicas = replica@FileChunkReplica {server} : _} = do
+      withStore' c $ \db -> createDeletedSndChunkReplica db userId replica digest
+      addXFTPDelWorker c server
+    deleteFileChunk _ = pure ()

-deleteSndFileRemote :: AgentClient -> UserId -> SndFileId -> ValidFileDescription 'FSender -> AM' ()
-deleteSndFileRemote c userId sndFileEntityId sfd = deleteSndFilesRemote c userId [(sndFileEntityId, sfd)]
-
-deleteSndFilesRemote :: AgentClient -> UserId -> [(SndFileId, ValidFileDescription 'FSender)] -> AM' ()
-deleteSndFilesRemote c userId sndFileIdsDescrs = do
-  deleteSndFilesInternal c (map fst sndFileIdsDescrs) `E.catchAny` (notify c "" . SFERR . INTERNAL . show)
-  let rs = concatMap (mapMaybe chunkReplica . fdChunks . snd) sndFileIdsDescrs
-  void $ withStoreBatch' c (\db -> map (uncurry $ createDeletedSndChunkReplica db userId) rs)
-  let servers = S.fromList $ map (\(FileChunkReplica {server}, _) -> server) rs
-  mapM_ (getXFTPDelWorker True c) servers
-  where
-    fdChunks (ValidFileDescription FileDescription {chunks}) = chunks
-    chunkReplica :: FileChunk -> Maybe (FileChunkReplica, FileDigest)
-    chunkReplica = \case
-      FileChunk {digest, replicas = replica : _} -> Just (replica, digest)
-      _ -> Nothing
-
-resumeXFTPDelWork :: AgentClient -> XFTPServer -> AM' ()
-resumeXFTPDelWork = void .: getXFTPDelWorker False
-
-getXFTPDelWorker :: Bool -> AgentClient -> XFTPServer -> AM' Worker
-getXFTPDelWorker hasWork c server = do
+addXFTPDelWorker :: AgentMonad m => AgentClient -> XFTPServer -> m ()
+addXFTPDelWorker c srv = do
  ws <- asks $ xftpDelWorkers . xftpAgent
-  getAgentWorker "xftp_del" hasWork c server ws $ runXFTPDelWorker c server
+  atomically (TM.lookup srv ws) >>= \case
+    Nothing -> do
+      doWork <- newTMVarIO ()
+      worker <- async $ runXFTPDelWorker c srv doWork `E.finally` atomically (TM.delete srv ws)
+      atomically $ TM.insert srv (doWork, worker) ws
+    Just (doWork, _) ->
+      void . atomically $ tryPutTMVar doWork ()

-runXFTPDelWorker :: AgentClient -> XFTPServer -> Worker -> AM ()
-runXFTPDelWorker c srv Worker {doWork} = do
-  cfg <- asks config
+runXFTPDelWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
+runXFTPDelWorker c srv doWork = do
  forever $ do
-    lift $ waitForWork doWork
+    void . atomically $ readTMVar doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation cfg
+    runXFTPOperation
  where
-    runXFTPOperation :: AgentConfig -> AM ()
-    runXFTPOperation AgentConfig {rcvFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} = do
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    runXFTPOperation :: m ()
+    runXFTPOperation = do
      -- no point in deleting files older than rcv ttl, as they will be expired on server
-      withWork c doWork (\db -> getNextDeletedSndChunkReplica db srv rcvFilesTTL) processDeletedReplica
-      where
-        processDeletedReplica replica@DeletedSndChunkReplica {deletedSndChunkReplicaId, userId, server, chunkDigest, delay} = do
+      rcvFilesTTL <- asks (rcvFilesTTL . config)
+      nextReplica <- withStore' c $ \db -> getNextDeletedSndChunkReplica db srv rcvFilesTTL
+      case nextReplica of
+        Nothing -> noWorkToDo
+        Just replica@DeletedSndChunkReplica {deletedSndChunkReplicaId, userId, server, chunkDigest, delay} -> do
+          ri <- asks $ reconnectInterval . config
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop -> do
-            lift $ waitForUserNetwork c
-            deleteChunkReplica
-              `catchAgentError` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
+          withRetryInterval ri' $ \delay' loop ->
+            deleteChunkReplica replica
+              `catchError` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAgentError (\_ -> pure ()) $ do
+              flip catchError (\_ -> pure ()) $ do
+                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
                when notifyOnRetry $ notify c "" $ SFERR e
-                liftIO $ closeXFTPServerClient c userId server chunkDigest
+                closeXFTPServerClient c userId server chunkDigest
                withStore' c $ \db -> updateDeletedSndChunkReplicaDelay db deletedSndChunkReplicaId replicaDelay
              atomically $ assertAgentForeground c
              loop
-            retryDone = delWorkerInternalError c deletedSndChunkReplicaId
-            deleteChunkReplica = do
-              agentXFTPDeleteChunk c userId replica
-              withStore' c $ \db -> deleteDeletedSndChunkReplica db deletedSndChunkReplicaId
+            retryDone e = delWorkerInternalError c deletedSndChunkReplicaId e
+    deleteChunkReplica :: DeletedSndChunkReplica -> m ()
+    deleteChunkReplica replica@DeletedSndChunkReplica {userId, deletedSndChunkReplicaId} = do
+      agentXFTPDeleteChunk c userId replica
+      withStore' c $ \db -> deleteDeletedSndChunkReplica db deletedSndChunkReplicaId

-delWorkerInternalError :: AgentClient -> Int64 -> AgentErrorType -> AM ()
+delWorkerInternalError :: AgentMonad m => AgentClient -> Int64 -> AgentErrorType -> m ()
 delWorkerInternalError c deletedSndChunkReplicaId e = do
  withStore' c $ \db -> deleteDeletedSndChunkReplica db deletedSndChunkReplicaId
  notify c "" $ SFERR e
@@ -1,35 +0,0 @@
-module Simplex.FileTransfer.Chunks where
-
-import Data.Word (Word32)
-
-serverChunkSizes :: [Word32]
-serverChunkSizes = [chunkSize0, chunkSize1, chunkSize2, chunkSize3]
-{-# INLINE serverChunkSizes #-}
-
-chunkSize0 :: Word32
-chunkSize0 = kb 64
-{-# INLINE chunkSize0 #-}
-
-chunkSize1 :: Word32
-chunkSize1 = kb 256
-{-# INLINE chunkSize1 #-}
-
-chunkSize2 :: Word32
-chunkSize2 = mb 1
-{-# INLINE chunkSize2 #-}
-
-chunkSize3 :: Word32
-chunkSize3 = mb 4
-{-# INLINE chunkSize3 #-}
-
-kb :: Integral a => a -> a
-kb n = 1024 * n
-{-# INLINE kb #-}
-
-mb :: Integral a => a -> a
-mb n = 1024 * kb n
-{-# INLINE mb #-}
-
-gb :: Integral a => a -> a
-gb n = 1024 * mb n
-{-# INLINE gb #-}
@@ -4,17 +4,12 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}

 module Simplex.FileTransfer.Client where

-import Control.Logger.Simple
-import Control.Monad
 import Control.Monad.Except
-import Crypto.Random (ChaChaDRG)
 import Data.Bifunctor (first)
 import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
@@ -23,12 +18,10 @@ import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty (..))
 import Data.Time (UTCTime)
 import Data.Word (Word32)
-import qualified Data.X509 as X
-import qualified Data.X509.Validation as XV
 import qualified Network.HTTP.Types as N
 import qualified Network.HTTP2.Client as H
+import Simplex.FileTransfer.Description (mb)
 import Simplex.FileTransfer.Protocol
-import Simplex.FileTransfer.Server.Env (supportedXFTPhandshakes)
 import Simplex.FileTransfer.Transport
 import Simplex.Messaging.Client
  ( NetworkConfig (..),
@@ -42,7 +35,6 @@ import Simplex.Messaging.Client
 import Simplex.Messaging.Client.Agent ()
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
-import Simplex.Messaging.Encoding (smpDecode, smpEncode)
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol
  ( BasicAuth,
@@ -51,27 +43,23 @@ import Simplex.Messaging.Protocol
    RecipientId,
    SenderId,
  )
-import Simplex.Messaging.Transport (ALPN, HandshakeError (VERSION), THandleAuth (..), THandleParams (..), TransportError (..), TransportPeer (..), supportedParameters)
-import Simplex.Messaging.Transport.Client (TransportClientConfig, TransportHost, alpn)
+import Simplex.Messaging.Transport (supportedParameters)
+import Simplex.Messaging.Transport.Client (TransportClientConfig, TransportHost)
 import Simplex.Messaging.Transport.HTTP2
 import Simplex.Messaging.Transport.HTTP2.Client
-import Simplex.Messaging.Transport.HTTP2.File
-import Simplex.Messaging.Util (bshow, liftEitherWith, liftError', tshow, whenM)
-import Simplex.Messaging.Version (compatibleVersion, pattern Compatible)
+import Simplex.Messaging.Util (bshow, liftEitherError, whenM)
 import UnliftIO
 import UnliftIO.Directory

 data XFTPClient = XFTPClient
  { http2Client :: HTTP2Client,
    transportSession :: TransportSession FileResponse,
-    thParams :: THandleParams XFTPVersion 'TClient,
    config :: XFTPClientConfig
  }

 data XFTPClientConfig = XFTPClientConfig
  { xftpNetworkConfig :: NetworkConfig,
-    serverVRange :: VersionRangeXFTP,
-    clientALPN :: Maybe [ALPN]
+    uploadTimeoutPerMb :: Int64
  }

 data XFTPChunkBody = XFTPChunkBody
@@ -93,13 +81,12 @@ defaultXFTPClientConfig :: XFTPClientConfig
 defaultXFTPClientConfig =
  XFTPClientConfig
    { xftpNetworkConfig = defaultNetworkConfig,
-      serverVRange = supportedFileServerVRange,
-      clientALPN = Just supportedXFTPhandshakes
+      uploadTimeoutPerMb = 10000000 -- 10 seconds
    }

 getXFTPClient :: TransportSession FileResponse -> XFTPClientConfig -> (XFTPClient -> IO ()) -> IO (Either XFTPClientError XFTPClient)
-getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {clientALPN, xftpNetworkConfig, serverVRange} disconnected = runExceptT $ do
-  let tcConfig = (transportClientConfig xftpNetworkConfig) {alpn = clientALPN}
+getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {xftpNetworkConfig} disconnected = runExceptT $ do
+  let tcConfig = transportClientConfig xftpNetworkConfig
      http2Config = xftpHTTP2Config tcConfig config
      username = proxyUsername transportSession
      ProtocolServer _ host port keyHash = srv
@@ -107,53 +94,11 @@ getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {clientALPN,
  clientVar <- newTVarIO Nothing
  let usePort = if null port then "443" else port
      clientDisconnected = readTVarIO clientVar >>= mapM_ disconnected
-  http2Client <- liftError' xftpClientError $ getVerifiedHTTP2Client (Just username) useHost usePort (Just keyHash) Nothing http2Config clientDisconnected
-  let HTTP2Client {sessionId, sessionALPN} = http2Client
-      thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = VersionXFTP 1, thAuth = Nothing, implySessId = False, batch = True}
-  logDebug $ "Client negotiated handshake protocol: " <> tshow sessionALPN
-  thParams@THandleParams {thVersion} <- case sessionALPN of
-    Just "xftp/1" -> xftpClientHandshakeV1 serverVRange keyHash http2Client thParams0
-    Nothing -> pure thParams0
-    _ -> throwError $ PCETransportError (TEHandshake VERSION)
-  logDebug $ "Client negotiated protocol: " <> tshow thVersion
-  let c = XFTPClient {http2Client, thParams, transportSession, config}
+  http2Client <- liftEitherError xftpClientError $ getVerifiedHTTP2Client (Just username) useHost usePort (Just keyHash) Nothing http2Config clientDisconnected
+  let c = XFTPClient {http2Client, transportSession, config}
  atomically $ writeTVar clientVar $ Just c
  pure c

-xftpClientHandshakeV1 :: VersionRangeXFTP -> C.KeyHash -> HTTP2Client -> THandleParamsXFTP 'TClient -> ExceptT XFTPClientError IO (THandleParamsXFTP 'TClient)
-xftpClientHandshakeV1 serverVRange keyHash@(C.KeyHash kh) c@HTTP2Client {sessionId, serverKey} thParams0 = do
-  shs@XFTPServerHandshake {authPubKey = ck} <- getServerHandshake
-  (v, sk) <- processServerHandshake shs
-  sendClientHandshake XFTPClientHandshake {xftpVersion = v, keyHash}
-  pure thParams0 {thAuth = Just THAuthClient {serverPeerPubKey = sk, serverCertKey = ck, sessSecret = Nothing}, thVersion = v}
-  where
-    getServerHandshake :: ExceptT XFTPClientError IO XFTPServerHandshake
-    getServerHandshake = do
-      let helloReq = H.requestNoBody "POST" "/" []
-      HTTP2Response {respBody = HTTP2Body {bodyHead = shsBody}} <-
-        liftError' (const $ PCEResponseError HANDSHAKE) $ sendRequest c helloReq Nothing
-      liftHS . smpDecode =<< liftHS (C.unPad shsBody)
-    processServerHandshake :: XFTPServerHandshake -> ExceptT XFTPClientError IO (VersionXFTP, C.PublicKeyX25519)
-    processServerHandshake XFTPServerHandshake {xftpVersionRange, sessionId = serverSessId, authPubKey = serverAuth} = do
-      unless (sessionId == serverSessId) $ throwError $ PCEResponseError SESSION
-      case xftpVersionRange `compatibleVersion` serverVRange of
-        Nothing -> throwError $ PCEResponseError HANDSHAKE
-        Just (Compatible v) ->
-          fmap (v,) . liftHS $ do
-            let (X.CertificateChain cert, exact) = serverAuth
-            case cert of
-              [_leaf, ca] | XV.Fingerprint kh == XV.getFingerprint ca X.HashSHA256 -> pure ()
-              _ -> throwError "bad certificate"
-            pubKey <- maybe (throwError "bad server key type") (`C.verifyX509` exact) serverKey
-            C.x509ToPublic (pubKey, []) >>= C.pubKey
-    sendClientHandshake :: XFTPClientHandshake -> ExceptT XFTPClientError IO ()
-    sendClientHandshake chs = do
-      chs' <- liftHS $ C.pad (smpEncode chs) xftpBlockSize
-      let chsReq = H.requestBuilder "POST" "/" [] $ byteString chs'
-      HTTP2Response {respBody = HTTP2Body {bodyHead}} <- liftError' (const $ PCEResponseError HANDSHAKE) $ sendRequest c chsReq Nothing
-      unless (B.null bodyHead) $ throwError $ PCEResponseError HANDSHAKE
-    liftHS = liftEitherWith (const $ PCEResponseError HANDSHAKE)
-
 closeXFTPClient :: XFTPClient -> IO ()
 closeXFTPClient XFTPClient {http2Client} = closeHTTP2Client http2Client

@@ -163,7 +108,7 @@ xftpClientServer = B.unpack . strEncode . snd3 . transportSession
    snd3 (_, s, _) = s

 xftpTransportHost :: XFTPClient -> TransportHost
-xftpTransportHost XFTPClient {http2Client = HTTP2Client {client_ = HClient {host}}} = host
+xftpTransportHost = (host :: HClient -> TransportHost) . client_ . http2Client

 xftpSessionTs :: XFTPClient -> UTCTime
 xftpSessionTs = sessionTs . http2Client
@@ -183,41 +128,37 @@ xftpClientError = \case
  HCNetworkError -> PCENetworkError
  HCIOError e -> PCEIOError e

-sendXFTPCommand :: forall p. FilePartyI p => XFTPClient -> C.APrivateAuthKey -> XFTPFileId -> FileCommand p -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
-sendXFTPCommand c@XFTPClient {thParams} pKey fId cmd chunkSpec_ = do
+sendXFTPCommand :: forall p. FilePartyI p => XFTPClient -> C.APrivateSignKey -> XFTPFileId -> FileCommand p -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
+sendXFTPCommand XFTPClient {config, http2Client = http2@HTTP2Client {sessionId}} pKey fId cmd chunkSpec_ = do
  t <-
    liftEither . first PCETransportError $
-      xftpEncodeAuthTransmission thParams pKey ("", fId, FileCmd (sFileParty @p) cmd)
-  sendXFTPTransmission c t chunkSpec_
-
-sendXFTPTransmission :: XFTPClient -> ByteString -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
-sendXFTPTransmission XFTPClient {config, thParams, http2Client} t chunkSpec_ = do
-  let req = H.requestStreaming N.methodPost "/" [] streamBody
-      reqTimeout = xftpReqTimeout config $ (\XFTPChunkSpec {chunkSize} -> chunkSize) <$> chunkSpec_
-  HTTP2Response {respBody = body@HTTP2Body {bodyHead}} <- withExceptT xftpClientError . ExceptT $ sendRequest http2Client req (Just reqTimeout)
+      xftpEncodeTransmission sessionId (Just pKey) ("", fId, FileCmd (sFileParty @p) cmd)
+  let req = H.requestStreaming N.methodPost "/" [] $ streamBody t
+      reqTimeout = (\XFTPChunkSpec {chunkSize} -> chunkTimeout config chunkSize) <$> chunkSpec_
+  HTTP2Response {respBody = body@HTTP2Body {bodyHead}} <- liftEitherError xftpClientError $ sendRequest http2 req reqTimeout
  when (B.length bodyHead /= xftpBlockSize) $ throwError $ PCEResponseError BLOCK
  -- TODO validate that the file ID is the same as in the request?
-  (_, _, (_, _fId, respOrErr)) <- liftEither . first PCEResponseError $ xftpDecodeTransmission thParams bodyHead
+  (_, _, (_, _fId, respOrErr)) <- liftEither . first PCEResponseError $ xftpDecodeTransmission sessionId bodyHead
  case respOrErr of
    Right r -> case protocolError r of
      Just e -> throwError $ PCEProtocolError e
      _ -> pure (r, body)
    Left e -> throwError $ PCEResponseError e
  where
-    streamBody :: (Builder -> IO ()) -> IO () -> IO ()
-    streamBody send done = do
+    streamBody :: ByteString -> (Builder -> IO ()) -> IO () -> IO ()
+    streamBody t send done = do
      send $ byteString t
      forM_ chunkSpec_ $ \XFTPChunkSpec {filePath, chunkOffset, chunkSize} ->
        withFile filePath ReadMode $ \h -> do
          hSeek h AbsoluteSeek $ fromIntegral chunkOffset
-          hSendFile h send $ fromIntegral chunkSize
+          sendFile h send $ fromIntegral chunkSize
      done

 createXFTPChunk ::
  XFTPClient ->
-  C.APrivateAuthKey ->
+  C.APrivateSignKey ->
  FileInfo ->
-  NonEmpty C.APublicAuthKey ->
+  NonEmpty C.APublicVerifyKey ->
  Maybe BasicAuth ->
  ExceptT XFTPClientError IO (SenderId, NonEmpty RecipientId)
 createXFTPChunk c spKey file rcps auth_ =
@@ -225,19 +166,19 @@ createXFTPChunk c spKey file rcps auth_ =
    (FRSndIds sId rIds, body) -> noFile body (sId, rIds)
    (r, _) -> throwError . PCEUnexpectedResponse $ bshow r

-addXFTPRecipients :: XFTPClient -> C.APrivateAuthKey -> XFTPFileId -> NonEmpty C.APublicAuthKey -> ExceptT XFTPClientError IO (NonEmpty RecipientId)
+addXFTPRecipients :: XFTPClient -> C.APrivateSignKey -> XFTPFileId -> NonEmpty C.APublicVerifyKey -> ExceptT XFTPClientError IO (NonEmpty RecipientId)
 addXFTPRecipients c spKey fId rcps =
  sendXFTPCommand c spKey fId (FADD rcps) Nothing >>= \case
    (FRRcvIds rIds, body) -> noFile body rIds
    (r, _) -> throwError . PCEUnexpectedResponse $ bshow r

-uploadXFTPChunk :: XFTPClient -> C.APrivateAuthKey -> XFTPFileId -> XFTPChunkSpec -> ExceptT XFTPClientError IO ()
+uploadXFTPChunk :: XFTPClient -> C.APrivateSignKey -> XFTPFileId -> XFTPChunkSpec -> ExceptT XFTPClientError IO ()
 uploadXFTPChunk c spKey fId chunkSpec =
  sendXFTPCommand c spKey fId FPUT (Just chunkSpec) >>= okResponse

-downloadXFTPChunk :: TVar ChaChaDRG -> XFTPClient -> C.APrivateAuthKey -> XFTPFileId -> XFTPRcvChunkSpec -> ExceptT XFTPClientError IO ()
-downloadXFTPChunk g c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {filePath, chunkSize} = do
-  (rDhKey, rpDhKey) <- atomically $ C.generateKeyPair g
+downloadXFTPChunk :: XFTPClient -> C.APrivateSignKey -> XFTPFileId -> XFTPRcvChunkSpec -> ExceptT XFTPClientError IO ()
+downloadXFTPChunk c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {filePath, chunkSize} = do
+  (rDhKey, rpDhKey) <- liftIO C.generateKeyPair'
  sendXFTPCommand c rpKey fId (FGET rDhKey) Nothing >>= \case
    (FRFile sDhKey cbNonce, HTTP2Body {bodyHead = _bg, bodySize = _bs, bodyPart}) -> case bodyPart of
      -- TODO atm bodySize is set to 0, so chunkSize will be incorrect - validate once set
@@ -245,39 +186,24 @@ downloadXFTPChunk g c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {
        let dhSecret = C.dh' sDhKey rpDhKey
        cbState <- liftEither . first PCECryptoError $ LC.cbInit dhSecret cbNonce
        let t = chunkTimeout config chunkSize
-        ExceptT (sequence <$> (t `timeout` download cbState)) >>= maybe (throwError PCEResponseTimeout) pure
+        t `timeout` download cbState >>= maybe (throwError PCEResponseTimeout) pure
        where
          download cbState =
-            runExceptT . withExceptT PCEResponseError $
+            withExceptT PCEResponseError $
              receiveEncFile chunkPart cbState chunkSpec `catchError` \e ->
                whenM (doesFileExist filePath) (removeFile filePath) >> throwError e
      _ -> throwError $ PCEResponseError NO_FILE
    (r, _) -> throwError . PCEUnexpectedResponse $ bshow r

-xftpReqTimeout :: XFTPClientConfig -> Maybe Word32 -> Int
-xftpReqTimeout cfg@XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpTimeout}} chunkSize_ =
-  maybe tcpTimeout (chunkTimeout cfg) chunkSize_
-
 chunkTimeout :: XFTPClientConfig -> Word32 -> Int
-chunkTimeout XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpTimeout, tcpTimeoutPerKb}} sz =
-  tcpTimeout + fromIntegral (min ((fromIntegral sz `div` 1024) * tcpTimeoutPerKb) (fromIntegral (maxBound :: Int)))
+chunkTimeout config chunkSize = fromIntegral $ (fromIntegral chunkSize * uploadTimeoutPerMb config) `div` mb 1

-deleteXFTPChunk :: XFTPClient -> C.APrivateAuthKey -> SenderId -> ExceptT XFTPClientError IO ()
+deleteXFTPChunk :: XFTPClient -> C.APrivateSignKey -> SenderId -> ExceptT XFTPClientError IO ()
 deleteXFTPChunk c spKey sId = sendXFTPCommand c spKey sId FDEL Nothing >>= okResponse

-ackXFTPChunk :: XFTPClient -> C.APrivateAuthKey -> RecipientId -> ExceptT XFTPClientError IO ()
+ackXFTPChunk :: XFTPClient -> C.APrivateSignKey -> RecipientId -> ExceptT XFTPClientError IO ()
 ackXFTPChunk c rpKey rId = sendXFTPCommand c rpKey rId FACK Nothing >>= okResponse

-pingXFTP :: XFTPClient -> ExceptT XFTPClientError IO ()
-pingXFTP c@XFTPClient {thParams} = do
-  t <-
-    liftEither . first PCETransportError $
-      xftpEncodeTransmission thParams ("", "", FileCmd SFRecipient PING)
-  (r, _) <- sendXFTPTransmission c t Nothing
-  case r of
-    FRPong -> pure ()
-    _ -> throwError $ PCEUnexpectedResponse $ bshow r
-
 okResponse :: (FileResponse, HTTP2Body) -> ExceptT XFTPClientError IO ()
 okResponse = \case
  (FROk, body) -> noFile body ()
@@ -8,9 +8,7 @@
 module Simplex.FileTransfer.Client.Agent where

 import Control.Logger.Simple (logInfo)
-import Control.Monad
 import Control.Monad.Except
-import Control.Monad.Trans (lift)
 import Data.Bifunctor (first)
 import qualified Data.ByteString.Char8 as B
 import Data.Text (Text)
@@ -23,7 +21,7 @@ import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtocolServer (..), XFTPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (catchAll_)
+import Simplex.Messaging.Util (catchAll_, tryError)
 import UnliftIO

 type XFTPClientVar = TMVar (Either XFTPClientAgentError XFTPClient)
@@ -87,7 +85,7 @@ getXFTPServerClient XFTPClientAgent {xftpClients, config} srv = do
    waitForXFTPClient :: XFTPClientVar -> ME XFTPClient
    waitForXFTPClient clientVar = do
      let XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpConnectTimeout}} = xftpConfig config
-      client_ <- liftIO $ tcpConnectTimeout `timeout` atomically (readTMVar clientVar)
+      client_ <- tcpConnectTimeout `timeout` atomically (readTMVar clientVar)
      liftEither $ case client_ of
        Just (Right c) -> Right c
        Just (Left e) -> Left e
@@ -111,7 +109,7 @@ getXFTPServerClient XFTPClientAgent {xftpClients, config} srv = do
                  TM.delete srv xftpClients
              throwError e
        tryConnectAsync :: ME ()
-        tryConnectAsync = void . lift . async . runExceptT $ do
+        tryConnectAsync = void . async $ do
          withRetryInterval (reconnectInterval config) $ \_ loop -> void $ tryConnectClient loop

 showServer :: XFTPServer -> Text
@@ -8,7 +8,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TypeApplications #-}
-{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Client.Main
  ( SendOptions (..),
@@ -16,40 +15,41 @@ module Simplex.FileTransfer.Client.Main
    xftpClientCLI,
    cliSendFile,
    cliSendFileOpts,
-    singleChunkSize,
    prepareChunkSizes,
    prepareChunkSpecs,
+    chunkSize1,
+    chunkSize2,
+    chunkSize3,
    maxFileSize,
-    maxFileSizeHard,
    fileSizeLen,
    getChunkDigest,
    SentRecipientReplica (..),
  )
 where

+import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple
 import Control.Monad
 import Control.Monad.Except
-import Crypto.Random (ChaChaDRG)
+import Crypto.Random (getRandomBytes)
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Char (toLower)
-import Data.Either (partitionEithers)
+import Data.Function (on)
 import Data.Int (Int64)
-import Data.List (foldl', sortOn)
+import Data.List (foldl', groupBy, sortOn)
 import Data.List.NonEmpty (NonEmpty (..), nonEmpty)
 import qualified Data.List.NonEmpty as L
 import Data.Map (Map)
 import qualified Data.Map as M
-import Data.Maybe (fromMaybe, listToMaybe)
+import Data.Maybe (fromMaybe)
 import qualified Data.Text as T
 import Data.Word (Word32)
 import GHC.Records (HasField (getField))
 import Options.Applicative
-import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Client
 import Simplex.FileTransfer.Client.Agent
 import Simplex.FileTransfer.Client.Presets
@@ -60,15 +60,13 @@ import Simplex.FileTransfer.Transport (XFTPRcvChunkSpec (..))
 import Simplex.FileTransfer.Types
 import Simplex.FileTransfer.Util (uniqueCombine)
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.File (CryptoFile (..), FTCryptoError (..))
-import qualified Simplex.Messaging.Crypto.File as CF
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String (StrEncoding (..))
 import Simplex.Messaging.Parsers (parseAll)
-import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), SenderId, SndPrivateAuthKey, XFTPServer, XFTPServerWithAuth)
+import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), SenderId, SndPrivateSignKey, XFTPServer, XFTPServerWithAuth)
 import Simplex.Messaging.Server.CLI (getCliCommand')
-import Simplex.Messaging.Util (groupAllOn, ifM, tshow, whenM)
+import Simplex.Messaging.Util (ifM, tshow, whenM)
 import System.Exit (exitFailure)
 import System.FilePath (splitFileName, (</>))
 import System.IO.Temp (getCanonicalTemporaryDirectory)
@@ -77,19 +75,23 @@ import UnliftIO
 import UnliftIO.Directory

 xftpClientVersion :: String
-xftpClientVersion = "1.0.1"
+xftpClientVersion = "0.1.0"
+
+chunkSize1 :: Word32
+chunkSize1 = kb 256
+
+chunkSize2 :: Word32
+chunkSize2 = mb 1
+
+chunkSize3 :: Word32
+chunkSize3 = mb 4

-- | Soft limit for XFTP clients. Should be checked and reported to user.
 maxFileSize :: Int64
 maxFileSize = gb 1

 maxFileSizeStr :: String
 maxFileSizeStr = B.unpack . strEncode $ FileSize maxFileSize

-- | Hard internal limit for XFTP agent after which it refuses to prepare chunks.
-maxFileSizeHard :: Int64
-maxFileSizeHard = gb 5
-
 fileSizeLen :: Int64
 fileSizeLen = 8

@@ -101,7 +103,6 @@ cliCryptoError = \case
  FTCECryptoError e -> CLIError $ "Error decrypting file: " <> show e
  FTCEInvalidHeader e -> CLIError $ "Invalid file header: " <> e
  FTCEInvalidAuthTag -> CLIError "Error decrypting file: incorrect auth tag"
-  FTCEInvalidFileSize -> CLIError "Error decrypting file: incorrect file size"
  FTCEFileIOError e -> CLIError $ "File IO error: " <> show e

 data CliCommand
@@ -217,25 +218,25 @@ cliCommandP =
 data SentFileChunk = SentFileChunk
  { chunkNo :: Int,
    sndId :: SenderId,
-    sndPrivateKey :: SndPrivateAuthKey,
+    sndPrivateKey :: SndPrivateSignKey,
    chunkSize :: FileSize Word32,
    digest :: FileDigest,
    replicas :: [SentFileChunkReplica]
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data SentFileChunkReplica = SentFileChunkReplica
  { server :: XFTPServer,
-    recipients :: [(ChunkReplicaId, C.APrivateAuthKey)]
+    recipients :: [(ChunkReplicaId, C.APrivateSignKey)]
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data SentRecipientReplica = SentRecipientReplica
  { chunkNo :: Int,
    server :: XFTPServer,
    rcvNo :: Int,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
+    replicaKey :: C.APrivateSignKey,
    digest :: FileDigest,
    chunkSize :: FileSize Word32
  }
@@ -272,11 +273,10 @@ cliSendFileOpts :: SendOptions -> Bool -> (Int64 -> Int64 -> IO ()) -> ExceptT C
 cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, retryCount, tempPath, verbose} printInfo notifyProgress = do
  let (_, fileName) = splitFileName filePath
  liftIO $ when printInfo $ printNoNewLine "Encrypting file..."
-  g <- liftIO C.newRandom
-  (encPath, fdRcv, fdSnd, chunkSpecs, encSize) <- encryptFileForUpload g fileName
+  (encPath, fdRcv, fdSnd, chunkSpecs, encSize) <- encryptFileForUpload fileName
  liftIO $ when printInfo $ printNoNewLine "Uploading file..."
  uploadedChunks <- newTVarIO []
-  sentChunks <- uploadFile g chunkSpecs uploadedChunks encSize
+  sentChunks <- uploadFile chunkSpecs uploadedChunks encSize
  whenM (doesFileExist encPath) $ removeFile encPath
  -- TODO if only small chunks, use different default size
  liftIO $ do
@@ -289,48 +289,45 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
      putStrLn "Pass file descriptions to the recipient(s):"
    forM_ fdRcvPaths putStrLn
  where
-    encryptFileForUpload :: TVar ChaChaDRG -> String -> ExceptT CLIError IO (FilePath, FileDescription 'FRecipient, FileDescription 'FSender, [XFTPChunkSpec], Int64)
-    encryptFileForUpload g fileName = do
+    encryptFileForUpload :: String -> ExceptT CLIError IO (FilePath, FileDescription 'FRecipient, FileDescription 'FSender, [XFTPChunkSpec], Int64)
+    encryptFileForUpload fileName = do
      fileSize <- fromInteger <$> getFileSize filePath
      when (fileSize > maxFileSize) $ throwError $ CLIError $ "Files bigger than " <> maxFileSizeStr <> " are not supported"
      encPath <- getEncPath tempPath "xftp"
-      key <- atomically $ C.randomSbKey g
-      nonce <- atomically $ C.randomCbNonce g
+      key <- liftIO C.randomSbKey
+      nonce <- liftIO C.randomCbNonce
      let fileHdr = smpEncode FileHeader {fileName, fileExtra = Nothing}
          fileSize' = fromIntegral (B.length fileHdr) + fileSize
          chunkSizes = prepareChunkSizes $ fileSize' + fileSizeLen + authTagSize
          defChunkSize = head chunkSizes
          chunkSizes' = map fromIntegral chunkSizes
          encSize = sum chunkSizes'
-          srcFile = CF.plain filePath
-      withExceptT (CLIError . show) $ encryptFile srcFile fileHdr key nonce fileSize' encSize encPath
+      withExceptT (CLIError . show) $ encryptFile filePath fileHdr key nonce fileSize' encSize encPath
      digest <- liftIO $ LC.sha512Hash <$> LB.readFile encPath
      let chunkSpecs = prepareChunkSpecs encPath chunkSizes
-          fdRcv = FileDescription {party = SFRecipient, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = [], redirect = Nothing}
-          fdSnd = FileDescription {party = SFSender, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = [], redirect = Nothing}
+          fdRcv = FileDescription {party = SFRecipient, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = []}
+          fdSnd = FileDescription {party = SFSender, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = []}
      logInfo $ "encrypted file to " <> tshow encPath
      pure (encPath, fdRcv, fdSnd, chunkSpecs, encSize)
-    uploadFile :: TVar ChaChaDRG -> [XFTPChunkSpec] -> TVar [Int64] -> Int64 -> ExceptT CLIError IO [SentFileChunk]
-    uploadFile g chunks uploadedChunks encSize = do
+    uploadFile :: [XFTPChunkSpec] -> TVar [Int64] -> Int64 -> ExceptT CLIError IO [SentFileChunk]
+    uploadFile chunks uploadedChunks encSize = do
      a <- atomically $ newXFTPAgent defaultXFTPClientAgentConfig
      gen <- newTVarIO =<< liftIO newStdGen
      let xftpSrvs = fromMaybe defaultXFTPServers (nonEmpty xftpServers)
      srvs <- liftIO $ replicateM (length chunks) $ getXFTPServer gen xftpSrvs
      let thd3 (_, _, x) = x
-          chunks' = groupAllOn thd3 $ zip3 [1 ..] chunks srvs
+          chunks' = groupBy ((==) `on` thd3) $ sortOn thd3 $ zip3 [1 ..] chunks srvs
      -- TODO shuffle/unshuffle chunks
      -- the reason we don't do pooled downloads here within one server is that http2 library doesn't handle cleint concurrency, even though
      -- upload doesn't allow other requests within the same client until complete (but download does allow).
      logInfo $ "uploading " <> tshow (length chunks) <> " chunks..."
-      (errs, rs) <- partitionEithers . concat <$> liftIO (pooledForConcurrentlyN 16 chunks' . mapM $ runExceptT . uploadFileChunk a)
-      mapM_ throwError errs
-      pure $ map snd (sortOn fst rs)
+      map snd . sortOn fst . concat <$> pooledForConcurrentlyN 16 chunks' (mapM $ uploadFileChunk a)
      where
        uploadFileChunk :: XFTPClientAgent -> (Int, XFTPChunkSpec, XFTPServerWithAuth) -> ExceptT CLIError IO (Int, SentFileChunk)
        uploadFileChunk a (chunkNo, chunkSpec@XFTPChunkSpec {chunkSize}, ProtoServerWithAuth xftpServer auth) = do
          logInfo $ "uploading chunk " <> tshow chunkNo <> " to " <> showServer xftpServer <> "..."
-          (sndKey, spKey) <- atomically $ C.generateAuthKeyPair C.SEd25519 g
-          rKeys <- atomically $ L.fromList <$> replicateM numRecipients (C.generateAuthKeyPair C.SEd25519 g)
+          (sndKey, spKey) <- liftIO $ C.generateSignatureKeyPair C.SEd25519
+          rKeys <- liftIO $ L.fromList <$> replicateM numRecipients (C.generateSignatureKeyPair C.SEd25519)
          digest <- liftIO $ getChunkDigest chunkSpec
          let ch = FileInfo {sndKey, size = fromIntegral chunkSize, digest}
          c <- withRetry retryCount $ getXFTPServerClient a xftpServer
@@ -371,7 +368,7 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
        rcvChunks :: [[FileChunk]]
        rcvChunks = map (sortChunks . M.elems) $ M.elems $ foldl' addRcvChunk M.empty rcvReplicas
        sortChunks :: [FileChunk] -> [FileChunk]
-        sortChunks = map reverseReplicas . sortOn (\FileChunk {chunkNo} -> chunkNo)
+        sortChunks = map reverseReplicas . sortOn (chunkNo :: FileChunk -> Int)
        reverseReplicas ch@FileChunk {replicas} = (ch :: FileChunk) {replicas = reverse replicas}
        addRcvChunk :: Map Int (Map Int FileChunk) -> SentRecipientReplica -> Map Int (Map Int FileChunk)
        addRcvChunk m SentRecipientReplica {chunkNo, server, rcvNo, replicaId, replicaKey, digest, chunkSize} =
@@ -398,7 +395,7 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
            sentChunks
        -- SentFileChunk having sndId and sndPrivateKey represents the current implementation's limitation
        -- that sender uploads each chunk only to one server, so we can use the first replica's server for FileChunkReplica
-        sndReplicas :: [SentFileChunkReplica] -> ChunkReplicaId -> C.APrivateAuthKey -> [FileChunkReplica]
+        sndReplicas :: [SentFileChunkReplica] -> ChunkReplicaId -> C.APrivateSignKey -> [FileChunkReplica]
        sndReplicas [] _ _ = []
        sndReplicas (SentFileChunkReplica {server} : _) replicaId replicaKey = [FileChunkReplica {server, replicaId, replicaKey}]
    writeFileDescriptions :: String -> [FileDescription 'FRecipient] -> FileDescription 'FSender -> IO ([FilePath], FilePath)
@@ -417,46 +414,40 @@ getChunkDigest :: XFTPChunkSpec -> IO ByteString
 getChunkDigest XFTPChunkSpec {filePath = chunkPath, chunkOffset, chunkSize} =
  withFile chunkPath ReadMode $ \h -> do
    hSeek h AbsoluteSeek $ fromIntegral chunkOffset
-    chunk <- LB.hGet h (fromIntegral chunkSize)
-    pure $! LC.sha256Hash chunk
+    LC.sha256Hash <$> LB.hGet h (fromIntegral chunkSize)

 cliReceiveFile :: ReceiveOptions -> ExceptT CLIError IO ()
 cliReceiveFile ReceiveOptions {fileDescription, filePath, retryCount, tempPath, verbose, yes} =
-  getFileDescription' fileDescription >>= receive
+  getFileDescription' fileDescription >>= receiveFile
  where
-    receive :: ValidFileDescription 'FRecipient -> ExceptT CLIError IO ()
-    receive (ValidFileDescription FileDescription {size, digest, key, nonce, chunks}) = do
+    receiveFile :: ValidFileDescription 'FRecipient -> ExceptT CLIError IO ()
+    receiveFile (ValidFileDescription FileDescription {size, digest, key, nonce, chunks}) = do
      encPath <- getEncPath tempPath "xftp"
      createDirectory encPath
      a <- atomically $ newXFTPAgent defaultXFTPClientAgentConfig
      liftIO $ printNoNewLine "Downloading file..."
      downloadedChunks <- newTVarIO []
-      let srv FileChunk {replicas} = case replicas of
-            [] -> error "empty FileChunk.replicas"
-            FileChunkReplica {server} : _ -> server
-          srvChunks = groupAllOn srv chunks
-      g <- liftIO C.newRandom
-      (errs, rs) <- partitionEithers . concat <$> liftIO (pooledForConcurrentlyN 16 srvChunks $ mapM $ runExceptT . downloadFileChunk g a encPath size downloadedChunks)
-      mapM_ throwError errs
-      let chunkPaths = map snd $ sortOn fst rs
+      let srv FileChunk {replicas} = server (head replicas :: FileChunkReplica)
+          srvChunks = groupBy ((==) `on` srv) $ sortOn srv chunks
+      chunkPaths <- map snd . sortOn fst . concat <$> pooledForConcurrentlyN 16 srvChunks (mapM $ downloadFileChunk a encPath size downloadedChunks)
      encDigest <- liftIO $ LC.sha512Hash <$> readChunks chunkPaths
      when (encDigest /= unFileDigest digest) $ throwError $ CLIError "File digest mismatch"
      encSize <- liftIO $ foldM (\s path -> (s +) . fromIntegral <$> getFileSize path) 0 chunkPaths
      when (FileSize encSize /= size) $ throwError $ CLIError "File size mismatch"
      liftIO $ printNoNewLine "Decrypting file..."
-      CryptoFile path _ <- withExceptT cliCryptoError $ decryptChunks encSize chunkPaths key nonce $ fmap CF.plain . getFilePath
+      path <- withExceptT cliCryptoError $ decryptChunks encSize chunkPaths key nonce getFilePath
      forM_ chunks $ acknowledgeFileChunk a
      whenM (doesPathExist encPath) $ removeDirectoryRecursive encPath
      liftIO $ do
        printNoNewLine $ "File downloaded: " <> path
        removeFD yes fileDescription
-    downloadFileChunk :: TVar ChaChaDRG -> XFTPClientAgent -> FilePath -> FileSize Int64 -> TVar [Int64] -> FileChunk -> ExceptT CLIError IO (Int, FilePath)
-    downloadFileChunk g a encPath (FileSize encSize) downloadedChunks FileChunk {chunkNo, chunkSize, digest, replicas = replica : _} = do
+    downloadFileChunk :: XFTPClientAgent -> FilePath -> FileSize Int64 -> TVar [Int64] -> FileChunk -> ExceptT CLIError IO (Int, FilePath)
+    downloadFileChunk a encPath (FileSize encSize) downloadedChunks FileChunk {chunkNo, chunkSize, digest, replicas = replica : _} = do
      let FileChunkReplica {server, replicaId, replicaKey} = replica
      logInfo $ "downloading chunk " <> tshow chunkNo <> " from " <> showServer server <> "..."
      chunkPath <- uniqueCombine encPath $ show chunkNo
      let chunkSpec = XFTPRcvChunkSpec chunkPath (unFileSize chunkSize) (unFileDigest digest)
-      withReconnect a server retryCount $ \c -> downloadXFTPChunk g c replicaKey (unChunkReplicaId replicaId) chunkSpec
+      withReconnect a server retryCount $ \c -> downloadXFTPChunk c replicaKey (unChunkReplicaId replicaId) chunkSpec
      logInfo $ "downloaded chunk " <> tshow chunkNo <> " to " <> T.pack chunkPath
      downloaded <- atomically . stateTVar downloadedChunks $ \cs ->
        let cs' = fromIntegral (unFileSize chunkSize) : cs in (sum cs', cs')
@@ -464,7 +455,7 @@ cliReceiveFile ReceiveOptions {fileDescription, filePath, retryCount, tempPath,
        printProgress "Downloaded" downloaded encSize
        when verbose $ putStrLn ""
      pure (chunkNo, chunkPath)
-    downloadFileChunk _ _ _ _ _ _ = throwError $ CLIError "chunk has no replicas"
+    downloadFileChunk _ _ _ _ _ = throwError $ CLIError "chunk has no replicas"
    getFilePath :: String -> ExceptT String IO FilePath
    getFilePath name =
      case filePath of
@@ -514,9 +505,10 @@ cliFileDescrInfo InfoOptions {fileDescription} = do
        printParty
        putStrLn $ "File download size: " <> strEnc size
        putStrLn "File server(s):"
-        forM_ replicas $ \srvReplicas@(FileServerReplica {server} :| _) -> do
-          let chSizes = fmap (\FileServerReplica {chunkSize = chSize_} -> unFileSize $ fromMaybe chunkSize chSize_) srvReplicas
-          putStrLn $ strEnc server <> ": " <> strEnc (FileSize $ sum chSizes)
+        forM_ replicas $ \srvReplicas -> do
+          let srv = replicaServer $ head srvReplicas
+              chSizes = map (\FileServerReplica {chunkSize = chSize_} -> unFileSize $ fromMaybe chunkSize chSize_) srvReplicas
+          putStrLn $ strEnc srv <> ": " <> strEnc (FileSize $ sum chSizes)
      where
        printParty :: IO ()
        printParty = case party of
@@ -535,19 +527,10 @@ getFileDescription' path =
  getFileDescription path >>= \case
    AVFD fd -> either (throwError . CLIError) pure $ checkParty fd

-singleChunkSize :: Int64 -> Maybe Word32
-singleChunkSize size' =
-  listToMaybe $ dropWhile (< chunkSize) serverChunkSizes
-  where
-    chunkSize = fromIntegral size'
-
 prepareChunkSizes :: Int64 -> [Word32]
 prepareChunkSizes size' = prepareSizes size'
  where
-    (smallSize, bigSize)
-      | size' > size34 chunkSize3 = (chunkSize2, chunkSize3)
-      | size' > size34 chunkSize2 = (chunkSize1, chunkSize2)
-      | otherwise = (chunkSize0, chunkSize1)
+    (smallSize, bigSize) = if size' > size34 chunkSize3 then (chunkSize2, chunkSize3) else (chunkSize1, chunkSize2)
    size34 sz = (fromIntegral sz * 3) `div` 4
    prepareSizes 0 = []
    prepareSizes size
@@ -590,11 +573,11 @@ withRetry retryCount = withRetry' retryCount . withExceptT (CLIError . show)
 removeFD :: Bool -> FilePath -> IO ()
 removeFD yes fd
  | yes = do
-      removeFile fd
-      putStrLn $ "\nFile description " <> fd <> " is deleted."
+    removeFile fd
+    putStrLn $ "\nFile description " <> fd <> " is deleted."
  | otherwise = do
-      y <- liftIO . getConfirmation $ "\nFile description " <> fd <> " can't be used again. Delete it"
-      when y $ removeFile fd
+    y <- liftIO . getConfirmation $ "\nFile description " <> fd <> " can't be used again. Delete it"
+    when y $ removeFile fd

 getConfirmation :: String -> IO Bool
 getConfirmation prompt = do
@@ -613,8 +596,7 @@ cliRandomFile RandomFileOptions {filePath, fileSize = FileSize size} = do
  putStrLn $ "File created: " <> filePath
  where
    saveRandomFile h sz = do
-      g <- C.newRandom
-      bytes <- atomically $ C.randomBytes (fromIntegral $ min mb' sz) g
+      bytes <- getRandomBytes $ fromIntegral $ min mb' sz
      B.hPut h bytes
      when (sz > mb') $ saveRandomFile h (sz - mb')
    mb' = mb 1
@@ -6,7 +6,6 @@

 module Simplex.FileTransfer.Crypto where

-import Control.Monad
 import Control.Monad.Except
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
@@ -17,8 +16,6 @@ import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Int (Int64)
 import Simplex.FileTransfer.Types (FileHeader (..), authTagSize)
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.File (CryptoFile (..), FTCryptoError (..))
-import qualified Simplex.Messaging.Crypto.File as CF
 import Simplex.Messaging.Crypto.Lazy (LazyByteString)
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
@@ -26,55 +23,54 @@ import Simplex.Messaging.Util (liftEitherWith)
 import UnliftIO
 import UnliftIO.Directory (removeFile)

-encryptFile :: CryptoFile -> ByteString -> C.SbKey -> C.CbNonce -> Int64 -> Int64 -> FilePath -> ExceptT FTCryptoError IO ()
-encryptFile srcFile fileHdr key nonce fileSize' encSize encFile = do
+encryptFile :: FilePath -> ByteString -> C.SbKey -> C.CbNonce -> Int64 -> Int64 -> FilePath -> ExceptT FTCryptoError IO ()
+encryptFile filePath fileHdr key nonce fileSize' encSize encFile = do
  sb <- liftEitherWith FTCECryptoError $ LC.sbInit key nonce
-  CF.withFile srcFile ReadMode $ \r -> ExceptT . withFile encFile WriteMode $ \w -> runExceptT $ do
+  withFile filePath ReadMode $ \r -> withFile encFile WriteMode $ \w -> do
    let lenStr = smpEncode fileSize'
        (hdr, !sb') = LC.sbEncryptChunk sb $ lenStr <> fileHdr
        padLen = encSize - authTagSize - fileSize' - 8
    liftIO $ B.hPut w hdr
    sb2 <- encryptChunks r w (sb', fileSize' - fromIntegral (B.length fileHdr))
-    CF.hGetTag r
    sb3 <- encryptPad w (sb2, padLen)
    let tag = BA.convert $ LC.sbAuth sb3
    liftIO $ B.hPut w tag
  where
-    encryptChunks r = encryptChunks_ $ liftIO . CF.hGet r . fromIntegral
+    encryptChunks r = encryptChunks_ $ liftIO . B.hGet r . fromIntegral
    encryptPad = encryptChunks_ $ \sz -> pure $ B.replicate (fromIntegral sz) '#'
    encryptChunks_ :: (Int64 -> IO ByteString) -> Handle -> (LC.SbState, Int64) -> ExceptT FTCryptoError IO LC.SbState
    encryptChunks_ get w (!sb, !len)
      | len == 0 = pure sb
      | otherwise = do
-          let chSize = min len 65536
-          ch <- liftIO $ get chSize
-          when (B.length ch /= fromIntegral chSize) $ throwError $ FTCEFileIOError "encrypting file: unexpected EOF"
-          let (ch', sb') = LC.sbEncryptChunk sb ch
-          liftIO $ B.hPut w ch'
-          encryptChunks_ get w (sb', len - chSize)
+        let chSize = min len 65536
+        ch <- liftIO $ get chSize
+        when (B.length ch /= fromIntegral chSize) $ throwError $ FTCEFileIOError "encrypting file: unexpected EOF"
+        let (ch', sb') = LC.sbEncryptChunk sb ch
+        liftIO $ B.hPut w ch'
+        encryptChunks_ get w (sb', len - chSize)

-decryptChunks :: Int64 -> [FilePath] -> C.SbKey -> C.CbNonce -> (String -> ExceptT String IO CryptoFile) -> ExceptT FTCryptoError IO CryptoFile
+decryptChunks :: Int64 -> [FilePath] -> C.SbKey -> C.CbNonce -> (String -> ExceptT String IO String) -> ExceptT FTCryptoError IO FilePath
 decryptChunks _ [] _ _ _ = throwError $ FTCEInvalidHeader "empty"
-decryptChunks encSize (chPath : chPaths) key nonce getDestFile = case reverse chPaths of
+decryptChunks encSize (chPath : chPaths) key nonce getFilePath = case reverse chPaths of
  [] -> do
    (!authOk, !f) <- liftEither . first FTCECryptoError . LC.sbDecryptTailTag key nonce (encSize - authTagSize) =<< liftIO (LB.readFile chPath)
    unless authOk $ throwError FTCEInvalidAuthTag
    (FileHeader {fileName}, !f') <- parseFileHeader f
-    destFile <- withExceptT FTCEFileIOError $ getDestFile fileName
-    CF.writeFile destFile f'
-    pure destFile
+    path <- withExceptT FTCEFileIOError $ getFilePath fileName
+    liftIO $ LB.writeFile path f'
+    pure path
  lastPath : chPaths' -> do
    (state, expectedLen, ch) <- decryptFirstChunk
    (FileHeader {fileName}, ch') <- parseFileHeader ch
-    destFile@(CryptoFile path _) <- withExceptT FTCEFileIOError $ getDestFile fileName
-    authOk <- CF.withFile destFile WriteMode $ \h -> liftIO $ do
-      CF.hPut h ch'
+    path <- withExceptT FTCEFileIOError $ getFilePath fileName
+    authOk <- liftIO . withFile path WriteMode $ \h -> do
+      liftIO $ LB.hPut h ch'
      state' <- foldM (decryptChunk h) state $ reverse chPaths'
      decryptLastChunk h state' expectedLen
    unless authOk $ do
      removeFile path
      throwError FTCEInvalidAuthTag
-    pure destFile
+    pure path
    where
      decryptFirstChunk = do
        sb <- liftEitherWith FTCECryptoError $ LC.sbInit key nonce
@@ -87,7 +83,7 @@ decryptChunks encSize (chPath : chPaths) key nonce getDestFile = case reverse ch
        ch <- LB.readFile chPth
        let len' = len + LB.length ch
            (ch', sb') = LC.sbDecryptChunkLazy sb ch
-        CF.hPut h ch'
+        LB.hPut h ch'
        pure (sb', len')
      decryptLastChunk h (!sb, !len) expectedLen = do
        ch <- LB.readFile lastPath
@@ -97,8 +93,7 @@ decryptChunks encSize (chPath : chPaths) key nonce getDestFile = case reverse ch
            len' = len + LB.length ch2
            ch3 = LB.take (LB.length ch2 - len' + expectedLen) ch2
            tag :: ByteString = BA.convert (LC.sbAuth sb')
-        CF.hPut h ch3
-        CF.hPutTag h
+        LB.hPut h ch3
        pure $ B.length tag'' == 16 && BA.constEq tag'' tag
  where
    parseFileHeader :: LazyByteString -> ExceptT FTCryptoError IO (FileHeader, LazyByteString)
@@ -111,3 +106,10 @@ decryptChunks encSize (chPath : chPaths) key nonce getDestFile = case reverse ch

 readChunks :: [FilePath] -> IO LB.ByteString
 readChunks = foldM (\s path -> (s <>) <$> LB.readFile path) ""
+
+data FTCryptoError
+  = FTCECryptoError C.CryptoError
+  | FTCEInvalidHeader String
+  | FTCEInvalidAuthTag
+  | FTCEFileIOError String
+  deriving (Show, Eq, Exception)
@@ -1,5 +1,6 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
@@ -7,12 +8,9 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TemplateHaskell #-}
-{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Description
  ( FileDescription (..),
-    RedirectFileInfo (..),
    AFileDescription (..),
    ValidFileDescription, -- constructor is not exported, use pattern
    pattern ValidFileDescription,
@@ -27,14 +25,11 @@ module Simplex.FileTransfer.Description
    YAMLServerReplicas (..), -- for tests
    validateFileDescription,
    groupReplicasByServer,
+    replicaServer,
    fdSeparator,
    kb,
    mb,
    gb,
-    FileDescriptionURI (..),
-    FileClientData,
-    fileDescriptionURI,
-    qrSizeLimit,
  )
 where

@@ -42,35 +37,29 @@ import Control.Applicative (optional)
 import Control.Monad ((<=<))
 import Data.Aeson (FromJSON, ToJSON)
 import qualified Data.Aeson as J
-import qualified Data.Aeson.TH as J
 import Data.Attoparsec.ByteString.Char8 (Parser)
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
+import Data.Function (on)
 import Data.Int (Int64)
-import Data.List (foldl', sortOn)
-import Data.List.NonEmpty (NonEmpty (..))
-import qualified Data.List.NonEmpty as L
+import Data.List (foldl', groupBy, sortOn)
 import Data.Map (Map)
 import qualified Data.Map as M
 import Data.Maybe (fromMaybe)
 import Data.String
-import Data.Text (Text)
-import Data.Text.Encoding (encodeUtf8)
 import Data.Word (Word32)
 import qualified Data.Yaml as Y
 import Database.SQLite.Simple.FromField (FromField (..))
 import Database.SQLite.Simple.ToField (ToField (..))
-import Simplex.FileTransfer.Chunks
+import GHC.Generics (Generic)
 import Simplex.FileTransfer.Protocol
-import Simplex.Messaging.Agent.QueryString
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (defaultJSON, parseAll)
+import Simplex.Messaging.Parsers (parseAll)
 import Simplex.Messaging.Protocol (XFTPServer)
-import Simplex.Messaging.ServiceScheme (ServiceScheme (..))
-import Simplex.Messaging.Util (bshow, safeDecodeUtf8, (<$?>))
+import Simplex.Messaging.Util (bshow, (<$?>))

 data FileDescription (p :: FileParty) = FileDescription
  { party :: SFileParty p,
@@ -79,14 +68,7 @@ data FileDescription (p :: FileParty) = FileDescription
    key :: C.SbKey,
    nonce :: C.CbNonce,
    chunkSize :: FileSize Word32,
-    chunks :: [FileChunk],
-    redirect :: Maybe RedirectFileInfo
-  }
-  deriving (Eq, Show)
-
-data RedirectFileInfo = RedirectFileInfo
-  { size :: FileSize Int64,
-    digest :: FileDigest
+    chunks :: [FileChunk]
  }
  deriving (Eq, Show)

@@ -135,7 +117,7 @@ data FileChunk = FileChunk
 data FileChunkReplica = FileChunkReplica
  { server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey
+    replicaKey :: C.APrivateSignKey
  }
  deriving (Eq, Show)

@@ -164,42 +146,34 @@ data YAMLFileDescription = YAMLFileDescription
    key :: C.SbKey,
    nonce :: C.CbNonce,
    chunkSize :: String,
-    replicas :: [YAMLServerReplicas],
-    redirect :: Maybe RedirectFileInfo
+    replicas :: [YAMLServerReplicas]
  }
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic, FromJSON)
+
+instance ToJSON YAMLFileDescription where
+  toJSON = J.genericToJSON J.defaultOptions
+  toEncoding = J.genericToEncoding J.defaultOptions

 data YAMLServerReplicas = YAMLServerReplicas
  { server :: XFTPServer,
    chunks :: [String]
  }
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic, FromJSON)
+
+instance ToJSON YAMLServerReplicas where
+  toJSON = J.genericToJSON J.defaultOptions
+  toEncoding = J.genericToEncoding J.defaultOptions

 data FileServerReplica = FileServerReplica
  { chunkNo :: Int,
    server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
+    replicaKey :: C.APrivateSignKey,
    digest :: Maybe FileDigest,
    chunkSize :: Maybe (FileSize Word32)
  }
  deriving (Show)

-newtype FileSize a = FileSize {unFileSize :: a}
-  deriving (Eq, Show)
-
-instance FromJSON a => FromJSON (FileSize a) where
-  parseJSON v = FileSize <$> Y.parseJSON v
-
-instance ToJSON a => ToJSON (FileSize a) where
-  toJSON = Y.toJSON . unFileSize
-
-$(J.deriveJSON defaultJSON ''YAMLServerReplicas)
-
-$(J.deriveJSON defaultJSON ''RedirectFileInfo)
-
-$(J.deriveJSON defaultJSON ''YAMLFileDescription)
-
 instance FilePartyI p => StrEncoding (ValidFileDescription p) where
  strEncode (ValidFD fd) = strEncode fd
  strDecode s = strDecode s >>= (\(AVFD fd) -> checkParty fd)
@@ -226,11 +200,11 @@ validateFileDescription fd@FileDescription {size, chunks}
  | chunksSize chunks /= unFileSize size = Left "chunks total size is different than file size"
  | otherwise = Right $ ValidFD fd
  where
-    chunkNos = map (\FileChunk {chunkNo} -> chunkNo) chunks
-    chunksSize = foldl' (\(s :: Int64) FileChunk {chunkSize} -> s + fromIntegral (unFileSize chunkSize)) 0
+    chunkNos = map (chunkNo :: FileChunk -> Int) chunks
+    chunksSize = fromIntegral . foldl' (\s FileChunk {chunkSize} -> s + unFileSize chunkSize) 0

 encodeFileDescription :: FileDescription p -> YAMLFileDescription
-encodeFileDescription FileDescription {party, size, digest, key, nonce, chunkSize, chunks, redirect} =
+encodeFileDescription FileDescription {party, size, digest, key, nonce, chunkSize, chunks} =
  YAMLFileDescription
    { party = toFileParty party,
      size = B.unpack $ strEncode size,
@@ -238,39 +212,12 @@ encodeFileDescription FileDescription {party, size, digest, key, nonce, chunkSiz
      key,
      nonce,
      chunkSize = B.unpack $ strEncode chunkSize,
-      replicas = encodeFileReplicas chunkSize chunks,
-      redirect
+      replicas = encodeFileReplicas chunkSize chunks
    }

-data FileDescriptionURI = FileDescriptionURI
-  { scheme :: ServiceScheme,
-    description :: ValidFileDescription 'FRecipient,
-    clientData :: Maybe FileClientData -- JSON-encoded extensions to pass in a link
-  }
+newtype FileSize a = FileSize {unFileSize :: a}
  deriving (Eq, Show)

-type FileClientData = Text
-
-fileDescriptionURI :: ValidFileDescription 'FRecipient -> FileDescriptionURI
-fileDescriptionURI vfd = FileDescriptionURI SSSimplex vfd mempty
-
-instance StrEncoding FileDescriptionURI where
-  strEncode FileDescriptionURI {scheme, description, clientData} = mconcat [strEncode scheme, "/file", "#/?", queryStr]
-    where
-      queryStr = strEncode $ QSP QEscape qs
-      qs = ("desc", strEncode description) : maybe [] (\cd -> [("data", encodeUtf8 cd)]) clientData
-  strP = do
-    scheme <- strP
-    _ <- "/file" <* optional (A.char '/') <* "#/?"
-    query <- strP
-    description <- queryParam "desc" query
-    let clientData = safeDecodeUtf8 <$> queryParamStr "data" query
-    pure FileDescriptionURI {scheme, description, clientData}
-
-- | URL length in QR code before jumping up to a next size.
-qrSizeLimit :: Int
-qrSizeLimit = 1002 -- ~2 chunks in URLencoded YAML with some spare size for server hosts
-
 instance (Integral a, Show a) => StrEncoding (FileSize a) where
  strEncode (FileSize b)
    | b' /= 0 = bshow b
@@ -290,27 +237,44 @@ instance (Integral a, Show a) => StrEncoding (FileSize a) where
          A.decimal
        ]

+kb :: Integral a => a -> a
+kb n = 1024 * n
+{-# INLINE kb #-}
+
+mb :: Integral a => a -> a
+mb n = 1024 * kb n
+{-# INLINE mb #-}
+
+gb :: Integral a => a -> a
+gb n = 1024 * mb n
+{-# INLINE gb #-}
+
 instance (Integral a, Show a) => IsString (FileSize a) where
  fromString = either error id . strDecode . B.pack

-instance FromField a => FromField (FileSize a) where fromField f = FileSize <$> fromField f
+instance (FromField a) => FromField (FileSize a) where fromField f = FileSize <$> fromField f

-instance ToField a => ToField (FileSize a) where toField (FileSize s) = toField s
+instance (ToField a) => ToField (FileSize a) where toField (FileSize s) = toField s

-groupReplicasByServer :: FileSize Word32 -> [FileChunk] -> [NonEmpty FileServerReplica]
+groupReplicasByServer :: FileSize Word32 -> [FileChunk] -> [[FileServerReplica]]
 groupReplicasByServer defChunkSize =
-  L.groupAllWith (\FileServerReplica {server} -> server) . unfoldChunksToReplicas defChunkSize
+  groupBy ((==) `on` replicaServer)
+    . sortOn replicaServer
+    . unfoldChunksToReplicas defChunkSize

 encodeFileReplicas :: FileSize Word32 -> [FileChunk] -> [YAMLServerReplicas]
 encodeFileReplicas defChunkSize =
  map encodeServerReplicas . groupReplicasByServer defChunkSize
  where
-    encodeServerReplicas fs@(FileServerReplica {server} :| _) =
+    encodeServerReplicas fs =
      YAMLServerReplicas
-        { server,
-          chunks = map (B.unpack . encodeServerReplica) $ L.toList fs
+        { server = replicaServer $ head fs, -- groupBy guarantees that fs is not empty
+          chunks = map (B.unpack . encodeServerReplica) fs
        }

+replicaServer :: FileServerReplica -> XFTPServer
+replicaServer = server
+
 encodeServerReplica :: FileServerReplica -> ByteString
 encodeServerReplica FileServerReplica {chunkNo, replicaId, replicaKey, digest, chunkSize} =
  bshow chunkNo
@@ -341,13 +305,13 @@ unfoldChunksToReplicas defChunkSize = concatMap chunkReplicas
       in FileServerReplica {chunkNo, server, replicaId, replicaKey, digest = digest', chunkSize = chunkSize'}

 decodeFileDescription :: YAMLFileDescription -> Either String AFileDescription
-decodeFileDescription YAMLFileDescription {party, size, digest, key, nonce, chunkSize, replicas, redirect} = do
+decodeFileDescription YAMLFileDescription {party, size, digest, key, nonce, chunkSize, replicas} = do
  size' <- strDecode $ B.pack size
  chunkSize' <- strDecode $ B.pack chunkSize
  replicas' <- decodeFileParts replicas
  chunks <- foldReplicasToChunks chunkSize' replicas'
  pure $ case aFileParty party of
-    AFP party' -> AFD FileDescription {party = party', size = size', digest, key, nonce, chunkSize = chunkSize', chunks, redirect}
+    AFP party' -> AFD FileDescription {party = party', size = size', digest, key, nonce, chunkSize = chunkSize', chunks}
  where
    decodeFileParts = fmap concat . mapM decodeYAMLServerReplicas

@@ -362,7 +326,7 @@ foldReplicasToChunks :: FileSize Word32 -> [FileServerReplica] -> Either String
 foldReplicasToChunks defChunkSize fs = do
  sd <- foldSizesDigests fs
  -- TODO validate (check that chunks match) or in separate function
-  sortOn (\FileChunk {chunkNo} -> chunkNo) . map reverseReplicas . M.elems <$> foldChunks sd fs
+  sortOn (chunkNo :: FileChunk -> Int) . map reverseReplicas . M.elems <$> foldChunks sd fs
  where
    foldSizesDigests :: [FileServerReplica] -> Either String (Map Int (FileSize Word32), Map Int FileDigest)
    foldSizesDigests = foldl' addSizeDigest $ Right (M.empty, M.empty)
@@ -1,22 +1,22 @@
 {-# LANGUAGE DataKinds #-}
-{-# LANGUAGE FlexibleContexts #-}
+{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE StandaloneDeriving #-}
-{-# LANGUAGE TemplateHaskell #-}
-{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
 {-# LANGUAGE TypeFamilies #-}
 {-# OPTIONS_GHC -fno-warn-unticked-promoted-constructors #-}

 module Simplex.FileTransfer.Protocol where

-import qualified Data.Aeson.TH as J
+import Control.Applicative ((<|>))
+import Data.Aeson (FromJSON, ToJSON)
+import qualified Data.Aeson as J
+import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
@@ -25,11 +25,12 @@ import Data.List.NonEmpty (NonEmpty (..))
 import Data.Maybe (isNothing)
 import Data.Type.Equality
 import Data.Word (Word32)
-import Simplex.FileTransfer.Transport (XFTPErrorType (..), XFTPVersion, xftpClientHandshakeStub)
-import Simplex.Messaging.Client (authTransmission)
+import GHC.Generics (Generic)
+import Generic.Random (genericArbitraryU)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
+import Simplex.Messaging.Notifications.Transport (ntfClientHandshake)
 import Simplex.Messaging.Parsers
 import Simplex.Messaging.Protocol
  ( BasicAuth,
@@ -39,31 +40,43 @@ import Simplex.Messaging.Protocol
    ProtocolErrorType (..),
    ProtocolMsgTag (..),
    ProtocolType (..),
-    RcvPublicAuthKey,
    RcvPublicDhKey,
+    RcvPublicVerifyKey,
    RecipientId,
    SenderId,
    SentRawTransmission,
    SignedTransmission,
-    SndPublicAuthKey,
+    SndPublicVerifyKey,
    Transmission,
-    TransmissionForAuth (..),
    encodeTransmission,
-    encodeTransmissionForAuth,
    messageTagP,
    tDecodeParseValidate,
-    tEncodeBatch1,
+    tEncode,
+    tEncodeBatch,
    tParse,
+    _smpP,
  )
-import Simplex.Messaging.Transport (THandleParams (..), TransportError (..), TransportPeer (..))
-import Simplex.Messaging.Util ((<$?>))
+import Simplex.Messaging.Transport (SessionId, TransportError (..))
+import Simplex.Messaging.Util (bshow, (<$?>))
+import Simplex.Messaging.Version
+import Test.QuickCheck (Arbitrary (..))
+
+currentXFTPVersion :: Version
+currentXFTPVersion = 1

 xftpBlockSize :: Int
 xftpBlockSize = 16384

 -- | File protocol clients
 data FileParty = FRecipient | FSender
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic)
+
+instance FromJSON FileParty where
+  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "F"
+
+instance ToJSON FileParty where
+  toJSON = J.genericToJSON . enumJSON $ dropPrefix "F"
+  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "F"

 data SFileParty :: FileParty -> Type where
  SFRecipient :: SFileParty FRecipient
@@ -138,18 +151,18 @@ instance ProtocolMsgTag FileCmdTag where
 instance FilePartyI p => ProtocolMsgTag (FileCommandTag p) where
  decodeTag s = decodeTag s >>= (\(FCT _ t) -> checkParty' t)

-instance Protocol XFTPVersion XFTPErrorType FileResponse where
+instance Protocol XFTPErrorType FileResponse where
  type ProtoCommand FileResponse = FileCmd
  type ProtoType FileResponse = 'PXFTP
-  protocolClientHandshake = xftpClientHandshakeStub
+  protocolClientHandshake = ntfClientHandshake
  protocolPing = FileCmd SFRecipient PING
  protocolError = \case
    FRErr e -> Just e
    _ -> Nothing

 data FileCommand (p :: FileParty) where
-  FNEW :: FileInfo -> NonEmpty RcvPublicAuthKey -> Maybe BasicAuth -> FileCommand FSender
-  FADD :: NonEmpty RcvPublicAuthKey -> FileCommand FSender
+  FNEW :: FileInfo -> NonEmpty RcvPublicVerifyKey -> Maybe BasicAuth -> FileCommand FSender
+  FADD :: NonEmpty RcvPublicVerifyKey -> FileCommand FSender
  FPUT :: FileCommand FSender
  FDEL :: FileCommand FSender
  FGET :: RcvPublicDhKey -> FileCommand FRecipient
@@ -163,15 +176,15 @@ data FileCmd = forall p. FilePartyI p => FileCmd (SFileParty p) (FileCommand p)
 deriving instance Show FileCmd

 data FileInfo = FileInfo
-  { sndKey :: SndPublicAuthKey,
+  { sndKey :: SndPublicVerifyKey,
    size :: Word32,
    digest :: ByteString
  }
-  deriving (Show)
+  deriving (Eq, Show)

 type XFTPFileId = ByteString

-instance FilePartyI p => ProtocolEncoding XFTPVersion XFTPErrorType (FileCommand p) where
+instance FilePartyI p => ProtocolEncoding XFTPErrorType (FileCommand p) where
  type Tag (FileCommand p) = FileCommandTag p
  encodeProtocol _v = \case
    FNEW file rKeys auth_ -> e (FNEW_, ' ', file, rKeys, auth_)
@@ -187,24 +200,24 @@ instance FilePartyI p => ProtocolEncoding XFTPVersion XFTPErrorType (FileCommand

  protocolP v tag = (\(FileCmd _ c) -> checkParty c) <$?> protocolP v (FCT (sFileParty @p) tag)

-  fromProtocolError = fromProtocolError @XFTPVersion @XFTPErrorType @FileResponse
+  fromProtocolError = fromProtocolError @XFTPErrorType @FileResponse
  {-# INLINE fromProtocolError #-}

-  checkCredentials (auth, _, fileId, _) cmd = case cmd of
+  checkCredentials (sig, _, fileId, _) cmd = case cmd of
    -- FNEW must not have signature and chunk ID
    FNEW {}
-      | isNothing auth -> Left $ CMD NO_AUTH
+      | isNothing sig -> Left $ CMD NO_AUTH
      | not (B.null fileId) -> Left $ CMD HAS_AUTH
      | otherwise -> Right cmd
    PING
-      | isNothing auth && B.null fileId -> Right cmd
+      | isNothing sig && B.null fileId -> Right cmd
      | otherwise -> Left $ CMD HAS_AUTH
    -- other client commands must have both signature and queue ID
    _
-      | isNothing auth || B.null fileId -> Left $ CMD NO_AUTH
+      | isNothing sig || B.null fileId -> Left $ CMD NO_AUTH
      | otherwise -> Right cmd

-instance ProtocolEncoding XFTPVersion XFTPErrorType FileCmd where
+instance ProtocolEncoding XFTPErrorType FileCmd where
  type Tag FileCmd = FileCmdTag
  encodeProtocol _v (FileCmd _ c) = encodeProtocol _v c

@@ -221,7 +234,7 @@ instance ProtocolEncoding XFTPVersion XFTPErrorType FileCmd where
        FACK_ -> pure FACK
        PING_ -> pure PING

-  fromProtocolError = fromProtocolError @XFTPVersion @XFTPErrorType @FileResponse
+  fromProtocolError = fromProtocolError @XFTPErrorType @FileResponse
  {-# INLINE fromProtocolError #-}

  checkCredentials t (FileCmd p c) = FileCmd p <$> checkCredentials t c
@@ -272,7 +285,7 @@ data FileResponse
  | FRPong
  deriving (Show)

-instance ProtocolEncoding XFTPVersion XFTPErrorType FileResponse where
+instance ProtocolEncoding XFTPErrorType FileResponse where
  type Tag FileResponse = FileResponseTag
  encodeProtocol _v = \case
    FRSndIds fId rIds -> e (FRSndIds_, ' ', fId, rIds)
@@ -315,6 +328,80 @@ instance ProtocolEncoding XFTPVersion XFTPErrorType FileResponse where
        | B.null entId = Right cmd
        | otherwise = Left $ CMD HAS_AUTH

+data XFTPErrorType
+  = -- | incorrect block format, encoding or signature size
+    BLOCK
+  | -- | incorrect SMP session ID (TLS Finished message / tls-unique binding RFC5929)
+    SESSION
+  | -- | SMP command is unknown or has invalid syntax
+    CMD {cmdErr :: CommandError}
+  | -- | command authorization error - bad signature or non-existing SMP queue
+    AUTH
+  | -- | incorrent file size
+    SIZE
+  | -- | storage quota exceeded
+    QUOTA
+  | -- | incorrent file digest
+    DIGEST
+  | -- | file encryption/decryption failed
+    CRYPTO
+  | -- | no expected file body in request/response or no file on the server
+    NO_FILE
+  | -- | unexpected file body
+    HAS_FILE
+  | -- | file IO error
+    FILE_IO
+  | -- | internal server error
+    INTERNAL
+  | -- | used internally, never returned by the server (to be removed)
+    DUPLICATE_ -- not part of SMP protocol, used internally
+  deriving (Eq, Generic, Read, Show)
+
+instance ToJSON XFTPErrorType where
+  toJSON = J.genericToJSON $ sumTypeJSON id
+  toEncoding = J.genericToEncoding $ sumTypeJSON id
+
+instance StrEncoding XFTPErrorType where
+  strEncode = \case
+    CMD e -> "CMD " <> bshow e
+    e -> bshow e
+  strP = "CMD " *> (CMD <$> parseRead1) <|> parseRead1
+
+instance Arbitrary XFTPErrorType where arbitrary = genericArbitraryU
+
+instance Encoding XFTPErrorType where
+  smpEncode = \case
+    BLOCK -> "BLOCK"
+    SESSION -> "SESSION"
+    CMD err -> "CMD " <> smpEncode err
+    AUTH -> "AUTH"
+    SIZE -> "SIZE"
+    QUOTA -> "QUOTA"
+    DIGEST -> "DIGEST"
+    CRYPTO -> "CRYPTO"
+    NO_FILE -> "NO_FILE"
+    HAS_FILE -> "HAS_FILE"
+    FILE_IO -> "FILE_IO"
+    INTERNAL -> "INTERNAL"
+    DUPLICATE_ -> "DUPLICATE_"
+
+  smpP =
+    A.takeTill (== ' ') >>= \case
+      "BLOCK" -> pure BLOCK
+      "SESSION" -> pure SESSION
+      "CMD" -> CMD <$> _smpP
+      "AUTH" -> pure AUTH
+      "SIZE" -> pure SIZE
+      "QUOTA" -> pure QUOTA
+      "DIGEST" -> pure DIGEST
+      "CRYPTO" -> pure CRYPTO
+      "NO_FILE" -> pure NO_FILE
+      "HAS_FILE" -> pure HAS_FILE
+      "FILE_IO" -> pure FILE_IO
+      "INTERNAL" -> pure INTERNAL
+      "DUPLICATE_" -> pure DUPLICATE_
+      _ -> fail "bad error type"
+
 checkParty :: forall t p p'. (FilePartyI p, FilePartyI p') => t p' -> Either String (t p)
 checkParty c = case testEquality (sFileParty @p) (sFileParty @p') of
  Just Refl -> Right c
@@ -325,25 +412,23 @@ checkParty' c = case testEquality (sFileParty @p) (sFileParty @p') of
  Just Refl -> Just c
  _ -> Nothing

-xftpEncodeAuthTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion 'TClient -> C.APrivateAuthKey -> Transmission c -> Either TransportError ByteString
-xftpEncodeAuthTransmission thParams@THandleParams {thAuth} pKey (corrId, fId, msg) = do
-  let TransmissionForAuth {tForAuth, tToSend} = encodeTransmissionForAuth thParams (corrId, fId, msg)
-  xftpEncodeBatch1 . (,tToSend) =<< authTransmission thAuth (Just pKey) corrId tForAuth
-
-xftpEncodeTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion p -> Transmission c -> Either TransportError ByteString
-xftpEncodeTransmission thParams (corrId, fId, msg) = do
-  let t = encodeTransmission thParams (corrId, fId, msg)
-  xftpEncodeBatch1 (Nothing, t)
+xftpEncodeTransmission :: ProtocolEncoding e c => SessionId -> Maybe C.APrivateSignKey -> Transmission c -> Either TransportError ByteString
+xftpEncodeTransmission sessionId pKey (corrId, fId, msg) = do
+  let t = encodeTransmission currentXFTPVersion sessionId (corrId, fId, msg)
+  xftpEncodeBatch1 $ signTransmission t
+  where
+    signTransmission :: ByteString -> SentRawTransmission
+    signTransmission t = ((`C.sign` t) <$> pKey, t)

 -- this function uses batch syntax but puts only one transmission in the batch
-xftpEncodeBatch1 :: SentRawTransmission -> Either TransportError ByteString
-xftpEncodeBatch1 t = first (const TELargeMsg) $ C.pad (tEncodeBatch1 t) xftpBlockSize
+xftpEncodeBatch1 :: (Maybe C.ASignature, ByteString) -> Either TransportError ByteString
+xftpEncodeBatch1 (sig, t) =
+  let t' = tEncodeBatch 1 . smpEncode . Large $ tEncode (sig, t)
+   in first (const TELargeMsg) $ C.pad t' xftpBlockSize

-xftpDecodeTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion p -> ByteString -> Either XFTPErrorType (SignedTransmission e c)
-xftpDecodeTransmission thParams t = do
+xftpDecodeTransmission :: ProtocolEncoding e c => SessionId -> ByteString -> Either XFTPErrorType (SignedTransmission e c)
+xftpDecodeTransmission sessionId t = do
  t' <- first (const BLOCK) $ C.unPad t
-  case tParse thParams t' of
-    t'' :| [] -> Right $ tDecodeParseValidate thParams t''
+  case tParse True t' of
+    t'' :| [] -> Right $ tDecodeParseValidate sessionId currentXFTPVersion t''
    _ -> Left BLOCK
-
-$(J.deriveJSON (enumJSON $ dropPrefix "F") ''FileParty)
@@ -3,44 +3,38 @@
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE MultiWayIf #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE NumericUnderscores #-}
 {-# LANGUAGE OverloadedLists #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TupleSections #-}

 module Simplex.FileTransfer.Server where

 import Control.Logger.Simple
-import Control.Monad
 import Control.Monad.Except
+import Control.Monad.IO.Unlift (MonadUnliftIO)
 import Control.Monad.Reader
+import Crypto.Random (getRandomBytes)
 import Data.Bifunctor (first)
 import qualified Data.ByteString.Base64.URL as B64
-import Data.ByteString.Builder (Builder, byteString)
+import Data.ByteString.Builder (byteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
+import Data.Functor (($>))
 import Data.Int (Int64)
 import Data.List (intercalate)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
-import Data.Maybe (fromMaybe, isJust)
 import qualified Data.Text as T
 import Data.Time.Clock (UTCTime (..), diffTimeToPicoseconds, getCurrentTime)
 import Data.Time.Clock.System (SystemTime (..), getSystemTime)
 import Data.Time.Format.ISO8601 (iso8601Show)
 import Data.Word (Word32)
-import qualified Data.X509 as X
-import GHC.IO.Handle (hSetNewlineMode)
-import GHC.Stats (getRTSStats)
 import qualified Network.HTTP.Types as N
 import qualified Network.HTTP2.Server as H
-import Network.Socket
 import Simplex.FileTransfer.Protocol
-import Simplex.FileTransfer.Server.Control
 import Simplex.FileTransfer.Server.Env
 import Simplex.FileTransfer.Server.Stats
 import Simplex.FileTransfer.Server.Store
@@ -48,39 +42,25 @@ import Simplex.FileTransfer.Server.StoreLog
 import Simplex.FileTransfer.Transport
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
-import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (CorrId (..), RcvPublicAuthKey, RcvPublicDhKey, RecipientId, TransmissionAuth)
-import Simplex.Messaging.Server (dummyVerifyCmd, verifyCmdAuthorization)
+import Simplex.Messaging.Protocol (CorrId, RcvPublicDhKey, RcvPublicVerifyKey, RecipientId)
+import Simplex.Messaging.Server (dummyVerifyCmd, verifyCmdSignature)
 import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Server.Stats
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Transport (SessionId, THandleAuth (..), THandleParams (..), TransportPeer (..))
-import Simplex.Messaging.Transport.Buffer (trimCR)
 import Simplex.Messaging.Transport.HTTP2
-import Simplex.Messaging.Transport.HTTP2.File (fileBlockSize)
 import Simplex.Messaging.Transport.HTTP2.Server
-import Simplex.Messaging.Transport.Server (runTCPServer, tlsServerCredentials)
 import Simplex.Messaging.Util
-import Simplex.Messaging.Version (isCompatible)
 import System.Exit (exitFailure)
 import System.FilePath ((</>))
-import System.IO (hPrint, hPutStrLn, universalNewlineMode)
-import UnliftIO
+import System.IO (BufferMode (..), hPutStrLn, hSetBuffering)
+import UnliftIO (IOMode (..), withFile)
 import UnliftIO.Concurrent (threadDelay)
 import UnliftIO.Directory (doesFileExist, removeFile, renameFile)
-import qualified UnliftIO.Exception as E
+import UnliftIO.Exception
+import UnliftIO.STM

 type M a = ReaderT XFTPEnv IO a

-data XFTPTransportRequest = XFTPTransportRequest
-  { thParams :: THandleParamsXFTP 'TServer,
-    reqBody :: HTTP2Body,
-    request :: H.Request,
-    sendResponse :: H.Response -> IO ()
-  }
-
 runXFTPServer :: XFTPServerConfig -> IO ()
 runXFTPServer cfg = do
  started <- newEmptyTMVarIO
@@ -89,75 +69,19 @@ runXFTPServer cfg = do
 runXFTPServerBlocking :: TMVar Bool -> XFTPServerConfig -> IO ()
 runXFTPServerBlocking started cfg = newXFTPServerEnv cfg >>= runReaderT (xftpServer cfg started)

-data Handshake
-  = HandshakeSent C.PrivateKeyX25519
-  | HandshakeAccepted (THandleAuth 'TServer) VersionXFTP
-
 xftpServer :: XFTPServerConfig -> TMVar Bool -> M ()
-xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpiration, fileExpiration} started = do
-  mapM_ (expireServerFiles Nothing) fileExpiration
+xftpServer cfg@XFTPServerConfig {xftpPort, logTLSErrors} started = do
  restoreServerStats
-  raceAny_ (runServer : expireFilesThread_ cfg <> serverStatsThread_ cfg <> controlPortThread_ cfg) `finally` stopServer
+  raceAny_ (runServer : expireFilesThread_ cfg <> serverStatsThread_ cfg) `finally` stopServer
  where
    runServer :: M ()
    runServer = do
      serverParams <- asks tlsServerParams
-      let (chain, pk) = tlsServerCredentials serverParams
-      signKey <- liftIO $ case C.x509ToPrivate (pk, []) >>= C.privKey of
-        Right pk' -> pure pk'
-        Left e -> putStrLn ("servers has no valid key: " <> show e) >> exitFailure
      env <- ask
-      sessions <- atomically TM.empty
-      let cleanup sessionId = atomically $ TM.delete sessionId sessions
-      liftIO . runHTTP2Server started xftpPort defaultHTTP2BufferSize serverParams transportConfig inactiveClientExpiration cleanup $ \sessionId sessionALPN r sendResponse -> do
-        reqBody <- getHTTP2Body r xftpBlockSize
-        let thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = VersionXFTP 1, thAuth = Nothing, implySessId = False, batch = True}
-            req0 = XFTPTransportRequest {thParams = thParams0, request = r, reqBody, sendResponse}
-        flip runReaderT env $ case sessionALPN of
-          Nothing -> processRequest req0
-          Just "xftp/1" ->
-            xftpServerHandshakeV1 chain signKey sessions req0 >>= \case
-              Nothing -> pure () -- handshake response sent
-              Just thParams -> processRequest req0 {thParams} -- proceed with new version (XXX: may as well switch the request handler here)
-          _ -> liftIO . sendResponse $ H.responseNoBody N.ok200 [] -- shouldn't happen: means server picked handshake protocol it doesn't know about
-    xftpServerHandshakeV1 :: X.CertificateChain -> C.APrivateSignKey -> TMap SessionId Handshake -> XFTPTransportRequest -> M (Maybe (THandleParams XFTPVersion 'TServer))
-    xftpServerHandshakeV1 chain serverSignKey sessions XFTPTransportRequest {thParams = thParams@THandleParams {sessionId}, reqBody = HTTP2Body {bodyHead}, sendResponse} = do
-      s <- atomically $ TM.lookup sessionId sessions
-      r <- runExceptT $ case s of
-        Nothing -> processHello
-        Just (HandshakeSent pk) -> processClientHandshake pk
-        Just (HandshakeAccepted auth v) -> pure $ Just thParams {thAuth = Just auth, thVersion = v}
-      either sendError pure r
-      where
-        processHello = do
-          unless (B.null bodyHead) $ throwError HANDSHAKE
-          (k, pk) <- atomically . C.generateKeyPair =<< asks random
-          atomically $ TM.insert sessionId (HandshakeSent pk) sessions
-          let authPubKey = (chain, C.signX509 serverSignKey $ C.publicToX509 k)
-          let hs = XFTPServerHandshake {xftpVersionRange = supportedFileServerVRange, sessionId, authPubKey}
-          shs <- encodeXftp hs
-          liftIO . sendResponse $ H.responseBuilder N.ok200 [] shs
-          pure Nothing
-        processClientHandshake pk = do
-          unless (B.length bodyHead == xftpBlockSize) $ throwError HANDSHAKE
-          body <- liftHS $ C.unPad bodyHead
-          XFTPClientHandshake {xftpVersion, keyHash} <- liftHS $ smpDecode body
-          kh <- asks serverIdentity
-          unless (keyHash == kh) $ throwError HANDSHAKE
-          unless (xftpVersion `isCompatible` supportedFileServerVRange) $ throwError HANDSHAKE
-          let auth = THAuthServer {serverPrivKey = pk, sessSecret' = Nothing}
-          atomically $ TM.insert sessionId (HandshakeAccepted auth xftpVersion) sessions
-          liftIO . sendResponse $ H.responseNoBody N.ok200 []
-          pure Nothing
-        sendError :: XFTPErrorType -> M (Maybe (THandleParams XFTPVersion 'TServer))
-        sendError err = do
-          runExceptT (encodeXftp err) >>= \case
-            Right bs -> liftIO . sendResponse $ H.responseBuilder N.ok200 [] bs
-            Left _ -> logError $ "Error encoding handshake error: " <> tshow err
-          pure Nothing
-        encodeXftp :: Encoding a => a -> ExceptT XFTPErrorType (ReaderT XFTPEnv IO) Builder
-        encodeXftp a = byteString <$> liftHS (C.pad (smpEncode a) xftpBlockSize)
-        liftHS = liftEitherWith (const HANDSHAKE)
+      liftIO $
+        runHTTP2Server started xftpPort defaultHTTP2BufferSize serverParams logTLSErrors $ \sessionId r sendResponse -> do
+          reqBody <- getHTTP2Body r xftpBlockSize
+          processRequest HTTP2Request {sessionId, request = r, reqBody, sendResponse} `runReaderT` env

    stopServer :: M ()
    stopServer = do
@@ -170,10 +94,25 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira

    expireFiles :: ExpirationConfig -> M ()
    expireFiles expCfg = do
+      st <- asks store
      let interval = checkInterval expCfg * 1000000
      forever $ do
        liftIO $ threadDelay' interval
-        expireServerFiles (Just 100000) expCfg
+        old <- liftIO $ expireBeforeEpoch expCfg
+        sIds <- M.keysSet <$> readTVarIO (files st)
+        forM_ sIds $ \sId -> do
+          threadDelay 100000
+          atomically (expiredFilePath st sId old)
+            >>= mapM_ (remove $ delete st sId)
+      where
+        remove del filePath =
+          ifM
+            (doesFileExist filePath)
+            (removeFile filePath >> del `catch` \(e :: SomeException) -> logError $ "failed to remove expired file " <> tshow filePath <> ": " <> tshow e)
+            del
+        delete st sId = do
+          withFileLog (`logDeleteFile` sId)
+          void $ atomically $ deleteFile st sId

    serverStatsThread_ :: XFTPServerConfig -> [M ()]
    serverStatsThread_ XFTPServerConfig {logStatsInterval = Just interval, logStatsStartTime, serverStatsLogFile} =
@@ -185,7 +124,7 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
      initialDelay <- (startAt -) . fromIntegral . (`div` 1000000_000000) . diffTimeToPicoseconds . utctDayTime <$> liftIO getCurrentTime
      liftIO $ putStrLn $ "server stats log enabled: " <> statsFilePath
      liftIO $ threadDelay' $ 1_000_000 * (initialDelay + if initialDelay < 0 then 86_400 else 0)
-      FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize} <- asks serverStats
+      FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize} <- asks serverStats
      let interval = 1_000_000 * logInterval
      forever $ do
        withFile statsFilePath AppendMode $ \h -> liftIO $ do
@@ -195,13 +134,12 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
          filesCreated' <- atomically $ swapTVar filesCreated 0
          fileRecipients' <- atomically $ swapTVar fileRecipients 0
          filesUploaded' <- atomically $ swapTVar filesUploaded 0
-          filesExpired' <- atomically $ swapTVar filesExpired 0
          filesDeleted' <- atomically $ swapTVar filesDeleted 0
          files <- atomically $ periodStatCounts filesDownloaded ts
          fileDownloads' <- atomically $ swapTVar fileDownloads 0
          fileDownloadAcks' <- atomically $ swapTVar fileDownloadAcks 0
-          filesCount' <- readTVarIO filesCount
-          filesSize' <- readTVarIO filesSize
+          filesCount' <- atomically $ swapTVar filesCount 0
+          filesSize' <- atomically $ swapTVar filesSize 0
          hPutStrLn h $
            intercalate
              ","
@@ -216,100 +154,35 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
                show fileDownloads',
                show fileDownloadAcks',
                show filesCount',
-                show filesSize',
-                show filesExpired'
+                show filesSize'
              ]
        liftIO $ threadDelay' interval

-    controlPortThread_ :: XFTPServerConfig -> [M ()]
-    controlPortThread_ XFTPServerConfig {controlPort = Just port} = [runCPServer port]
-    controlPortThread_ _ = []
-
-    runCPServer :: ServiceName -> M ()
-    runCPServer port = do
-      cpStarted <- newEmptyTMVarIO
-      u <- askUnliftIO
-      liftIO $ do
-        labelMyThread "control port server"
-        runTCPServer cpStarted port $ runCPClient u
-      where
-        runCPClient :: UnliftIO (ReaderT XFTPEnv IO) -> Socket -> IO ()
-        runCPClient u sock = do
-          labelMyThread "control port client"
-          h <- socketToHandle sock ReadWriteMode
-          hSetBuffering h LineBuffering
-          hSetNewlineMode h universalNewlineMode
-          hPutStrLn h "XFTP server control port\n'help' for supported commands"
-          role <- newTVarIO CPRNone
-          cpLoop h role
-          where
-            cpLoop h role = do
-              s <- trimCR <$> B.hGetLine h
-              case strDecode s of
-                Right CPQuit -> hClose h
-                Right cmd -> logCmd s cmd >> processCP h role cmd >> cpLoop h role
-                Left err -> hPutStrLn h ("error: " <> err) >> cpLoop h role
-            logCmd s cmd = when shouldLog $ logWarn $ "ControlPort: " <> tshow s
-              where
-                shouldLog = case cmd of
-                  CPAuth _ -> False
-                  CPHelp -> False
-                  CPQuit -> False
-                  CPSkip -> False
-                  _ -> True
-            processCP h role = \case
-              CPAuth auth -> atomically $ writeTVar role $! newRole cfg
-                where
-                  newRole XFTPServerConfig {controlPortUserAuth = user, controlPortAdminAuth = admin}
-                    | Just auth == admin = CPRAdmin
-                    | Just auth == user = CPRUser
-                    | otherwise = CPRNone
-              CPStatsRTS -> E.tryAny getRTSStats >>= either (hPrint h) (hPrint h)
-              CPDelete fileId -> withUserRole $ unliftIO u $ do
-                fs <- asks store
-                r <- runExceptT $ do
-                  let asSender = ExceptT . atomically $ getFile fs SFSender fileId
-                  let asRecipient = ExceptT . atomically $ getFile fs SFRecipient fileId
-                  (fr, _) <- asSender `catchError` const asRecipient
-                  ExceptT $ deleteServerFile_ fr
-                liftIO . hPutStrLn h $ either (\e -> "error: " <> show e) (\() -> "ok") r
-              CPHelp -> hPutStrLn h "commands: stats-rts, delete, help, quit"
-              CPQuit -> pure ()
-              CPSkip -> pure ()
-              where
-                withUserRole action =
-                  readTVarIO role >>= \case
-                    CPRAdmin -> action
-                    CPRUser -> action
-                    _ -> do
-                      logError "Unauthorized control port command"
-                      hPutStrLn h "AUTH"
-
 data ServerFile = ServerFile
  { filePath :: FilePath,
    fileSize :: Word32,
    sbState :: LC.SbState
  }

-processRequest :: XFTPTransportRequest -> M ()
-processRequest XFTPTransportRequest {thParams, reqBody = body@HTTP2Body {bodyHead}, sendResponse}
+processRequest :: HTTP2Request -> M ()
+processRequest HTTP2Request {sessionId, reqBody = body@HTTP2Body {bodyHead}, sendResponse}
  | B.length bodyHead /= xftpBlockSize = sendXFTPResponse ("", "", FRErr BLOCK) Nothing
  | otherwise = do
-      case xftpDecodeTransmission thParams bodyHead of
-        Right (sig_, signed, (corrId, fId, cmdOrErr)) ->
-          case cmdOrErr of
-            Right cmd -> do
-              let THandleParams {thAuth} = thParams
-              verifyXFTPTransmission ((,C.cbNonce (bs corrId)) <$> thAuth) sig_ signed fId cmd >>= \case
-                VRVerified req -> uncurry send =<< processXFTPRequest body req
-                VRFailed -> send (FRErr AUTH) Nothing
-            Left e -> send (FRErr e) Nothing
-          where
-            send resp = sendXFTPResponse (corrId, fId, resp)
-        Left e -> sendXFTPResponse ("", "", FRErr e) Nothing
+    case xftpDecodeTransmission sessionId bodyHead of
+      Right (sig_, signed, (corrId, fId, cmdOrErr)) -> do
+        case cmdOrErr of
+          Right cmd -> do
+            verifyXFTPTransmission sig_ signed fId cmd >>= \case
+              VRVerified req -> uncurry send =<< processXFTPRequest body req
+              VRFailed -> send (FRErr AUTH) Nothing
+          Left e -> send (FRErr e) Nothing
+        where
+          send resp = sendXFTPResponse (corrId, fId, resp)
+      Left e -> sendXFTPResponse ("", "", FRErr e) Nothing
  where
+    sendXFTPResponse :: (CorrId, XFTPFileId, FileResponse) -> Maybe ServerFile -> M ()
    sendXFTPResponse (corrId, fId, resp) serverFile_ = do
-      let t_ = xftpEncodeTransmission thParams (corrId, fId, resp)
+      let t_ = xftpEncodeTransmission sessionId Nothing (corrId, fId, resp)
      liftIO $ sendResponse $ H.responseStreaming N.ok200 [] $ streamBody t_
      where
        streamBody t_ send done = do
@@ -326,10 +199,10 @@ processRequest XFTPTransportRequest {thParams, reqBody = body@HTTP2Body {bodyHea

 data VerificationResult = VRVerified XFTPRequest | VRFailed

-verifyXFTPTransmission :: Maybe (THandleAuth 'TServer, C.CbNonce) -> Maybe TransmissionAuth -> ByteString -> XFTPFileId -> FileCmd -> M VerificationResult
-verifyXFTPTransmission auth_ tAuth authorized fId cmd =
+verifyXFTPTransmission :: Maybe C.ASignature -> ByteString -> XFTPFileId -> FileCmd -> M VerificationResult
+verifyXFTPTransmission sig_ signed fId cmd =
  case cmd of
-    FileCmd SFSender (FNEW file rcps auth') -> pure $ XFTPReqNew file rcps auth' `verifyWith` sndKey file
+    FileCmd SFSender (FNEW file rcps auth) -> pure $ XFTPReqNew file rcps auth `verifyWith` sndKey file
    FileCmd SFRecipient PING -> pure $ VRVerified XFTPReqPing
    FileCmd party _ -> verifyCmd party
  where
@@ -340,9 +213,8 @@ verifyXFTPTransmission auth_ tAuth authorized fId cmd =
      where
        verify = \case
          Right (fr, k) -> XFTPReqCmd fId fr cmd `verifyWith` k
-          _ -> maybe False (dummyVerifyCmd Nothing authorized) tAuth `seq` VRFailed
-    -- TODO verify with DH authorization
-    req `verifyWith` k = if verifyCmdAuthorization auth_ tAuth authorized k then VRVerified req else VRFailed
+          _ -> maybe False (dummyVerifyCmd signed) sig_ `seq` VRFailed
+    req `verifyWith` k = if verifyCmdSignature sig_ signed k then VRVerified req else VRFailed

 processXFTPRequest :: HTTP2Body -> XFTPRequest -> M (FileResponse, Maybe ServerFile)
 processXFTPRequest HTTP2Body {bodyPart} = \case
@@ -363,7 +235,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
  XFTPReqPing -> noFile FRPong
  where
    noFile resp = pure (resp, Nothing)
-    createFile :: FileInfo -> NonEmpty RcvPublicAuthKey -> M FileResponse
+    createFile :: FileInfo -> NonEmpty RcvPublicVerifyKey -> M FileResponse
    createFile file rks = do
      st <- asks store
      r <- runExceptT $ do
@@ -373,7 +245,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
        -- TODO validate body empty
        sId <- ExceptT $ addFileRetry st file 3 ts
        rcps <- mapM (ExceptT . addRecipientRetry st 3 sId) rks
-        lift $ withFileLog $ \sl -> do
+        withFileLog $ \sl -> do
          logAddFile sl sId file ts
          logAddRecipients sl sId rcps
        stats <- asks serverStats
@@ -387,7 +259,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
      retryAdd n $ \sId -> runExceptT $ do
        ExceptT $ addFile st sId file ts
        pure sId
-    addRecipientRetry :: FileStore -> Int -> XFTPFileId -> RcvPublicAuthKey -> M (Either XFTPErrorType FileRecipient)
+    addRecipientRetry :: FileStore -> Int -> XFTPFileId -> RcvPublicVerifyKey -> M (Either XFTPErrorType FileRecipient)
    addRecipientRetry st n sId rpk =
      retryAdd n $ \rId -> runExceptT $ do
        let rcp = FileRecipient rId rpk
@@ -400,80 +272,79 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
      atomically (add fId) >>= \case
        Left DUPLICATE_ -> retryAdd (n - 1) add
        r -> pure r
-    addRecipients :: XFTPFileId -> NonEmpty RcvPublicAuthKey -> M FileResponse
+    addRecipients :: XFTPFileId -> NonEmpty RcvPublicVerifyKey -> M FileResponse
    addRecipients sId rks = do
      st <- asks store
      r <- runExceptT $ do
        rcps <- mapM (ExceptT . addRecipientRetry st 3 sId) rks
-        lift $ withFileLog $ \sl -> logAddRecipients sl sId rcps
+        withFileLog $ \sl -> logAddRecipients sl sId rcps
        stats <- asks serverStats
        atomically $ modifyTVar' (fileRecipients stats) (+ length rks)
        let rIds = L.map (\(FileRecipient rId _) -> rId) rcps
        pure $ FRRcvIds rIds
      pure $ either FRErr id r
    receiveServerFile :: FileRec -> M FileResponse
-    receiveServerFile FileRec {senderId, fileInfo = FileInfo {size, digest}, filePath} = case bodyPart of
+    receiveServerFile fr@FileRec {senderId, fileInfo} = case bodyPart of
+      -- TODO do not allow repeated file upload
      Nothing -> pure $ FRErr SIZE
-      -- TODO validate body size from request before downloading, once it's populated
-      Just getBody -> skipCommitted $ ifM reserve receive (pure $ FRErr QUOTA)
+      Just getBody -> do
+        -- TODO validate body size before downloading, once it's populated
+        path <- asks $ filesPath . config
+        let fPath = path </> B.unpack (B64.encode senderId)
+            FileInfo {size, digest} = fileInfo
+        withFileLog $ \sl -> logPutFile sl senderId fPath
+        st <- asks store
+        quota_ <- asks $ fileSizeQuota . config
+        -- TODO timeout file upload, remove partially uploaded files
+        stats <- asks serverStats
+        liftIO $
+          runExceptT (receiveFile getBody (XFTPRcvChunkSpec fPath size digest)) >>= \case
+            Right () -> do
+              used <- readTVarIO $ usedStorage st
+              if maybe False (used + fromIntegral size >) quota_
+                then remove fPath $> FRErr QUOTA
+                else do
+                  atomically (setFilePath' st fr fPath)
+                  atomically $ modifyTVar' (filesUploaded stats) (+ 1)
+                  atomically $ modifyTVar' (filesCount stats) (+ 1)
+                  atomically $ modifyTVar' (filesSize stats) (+ fromIntegral size)
+                  pure FROk
+            Left e -> remove fPath $> FRErr e
        where
-          -- having a filePath means the file is already uploaded and committed, must not change anything
-          skipCommitted = ifM (isJust <$> readTVarIO filePath) (liftIO $ drain $ fromIntegral size)
-            where
-              -- can't send FROk without reading the request body or a client will block on sending it
-              -- can't send any old error as the client would fail or restart indefinitely
-              drain s = do
-                bs <- B.length <$> getBody fileBlockSize
-                if
-                  | bs == s -> pure FROk
-                  | bs == 0 || bs > s -> pure $ FRErr SIZE
-                  | otherwise -> drain (s - bs)
-          reserve = do
-            us <- asks $ usedStorage . store
-            quota <- asks $ fromMaybe maxBound . fileSizeQuota . config
-            atomically . stateTVar us $
-              \used -> let used' = used + fromIntegral size in if used' <= quota then (True, used') else (False, used)
-          receive = do
-            path <- asks $ filesPath . config
-            let fPath = path </> B.unpack (B64.encode senderId)
-            receiveChunk (XFTPRcvChunkSpec fPath size digest) >>= \case
-              Right () -> do
-                stats <- asks serverStats
-                withFileLog $ \sl -> logPutFile sl senderId fPath
-                atomically $ writeTVar filePath (Just fPath)
-                atomically $ modifyTVar' (filesUploaded stats) (+ 1)
-                atomically $ modifyTVar' (filesCount stats) (+ 1)
-                atomically $ modifyTVar' (filesSize stats) (+ fromIntegral size)
-                pure FROk
-              Left e -> do
-                us <- asks $ usedStorage . store
-                atomically . modifyTVar' us $ subtract (fromIntegral size)
-                liftIO $ whenM (doesFileExist fPath) (removeFile fPath) `catch` logFileError
-                pure $ FRErr e
-          receiveChunk spec = do
-            t <- asks $ fileTimeout . config
-            liftIO $ fromMaybe (Left TIMEOUT) <$> timeout t (runExceptT (receiveFile getBody spec) `catchAll_` pure (Left FILE_IO))
+          remove fPath = whenM (doesFileExist fPath) (removeFile fPath) `catch` logFileError
+
    sendServerFile :: FileRec -> RcvPublicDhKey -> M (FileResponse, Maybe ServerFile)
    sendServerFile FileRec {senderId, filePath, fileInfo = FileInfo {size}} rDhKey = do
      readTVarIO filePath >>= \case
-        Just path -> ifM (doesFileExist path) sendFile (pure (FRErr AUTH, Nothing))
-          where
-            sendFile = do
-              g <- asks random
-              (sDhKey, spDhKey) <- atomically $ C.generateKeyPair g
-              let dhSecret = C.dh' rDhKey spDhKey
-              cbNonce <- atomically $ C.randomCbNonce g
-              case LC.cbInit dhSecret cbNonce of
-                Right sbState -> do
-                  stats <- asks serverStats
-                  atomically $ modifyTVar' (fileDownloads stats) (+ 1)
-                  atomically $ updatePeriodStats (filesDownloaded stats) senderId
-                  pure (FRFile sDhKey cbNonce, Just ServerFile {filePath = path, fileSize = size, sbState})
-                _ -> pure (FRErr INTERNAL, Nothing)
+        Just path -> do
+          (sDhKey, spDhKey) <- liftIO C.generateKeyPair'
+          let dhSecret = C.dh' rDhKey spDhKey
+          cbNonce <- liftIO C.randomCbNonce
+          case LC.cbInit dhSecret cbNonce of
+            Right sbState -> do
+              stats <- asks serverStats
+              atomically $ modifyTVar' (fileDownloads stats) (+ 1)
+              atomically $ updatePeriodStats (filesDownloaded stats) senderId
+              pure (FRFile sDhKey cbNonce, Just ServerFile {filePath = path, fileSize = size, sbState})
+            _ -> pure (FRErr INTERNAL, Nothing)
        _ -> pure (FRErr NO_FILE, Nothing)

    deleteServerFile :: FileRec -> M FileResponse
-    deleteServerFile fr = either FRErr (\() -> FROk) <$> deleteServerFile_ fr
+    deleteServerFile FileRec {senderId, fileInfo, filePath} = do
+      withFileLog (`logDeleteFile` senderId)
+      r <- runExceptT $ do
+        path <- readTVarIO filePath
+        stats <- asks serverStats
+        ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
+        st <- asks store
+        void $ atomically $ deleteFile st senderId
+        atomically $ modifyTVar' (filesDeleted stats) (+ 1)
+        pure FROk
+      either (pure . FRErr) pure r
+      where
+        deletedStats stats = do
+          atomically $ modifyTVar' (filesCount stats) (subtract 1)
+          atomically $ modifyTVar' (filesSize stats) (subtract $ fromIntegral $ size fileInfo)

    logFileError :: SomeException -> IO ()
    logFileError e = logError $ "Error deleting file: " <> tshow e
@@ -487,57 +358,15 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
      atomically $ modifyTVar' (fileDownloadAcks stats) (+ 1)
      pure FROk

-deleteServerFile_ :: FileRec -> M (Either XFTPErrorType ())
-deleteServerFile_ FileRec {senderId, fileInfo, filePath} = do
-  withFileLog (`logDeleteFile` senderId)
-  runExceptT $ do
-    path <- readTVarIO filePath
-    stats <- asks serverStats
-    ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
-    st <- asks store
-    void $ atomically $ deleteFile st senderId
-    atomically $ modifyTVar' (filesDeleted stats) (+ 1)
-  where
-    deletedStats stats = do
-      atomically $ modifyTVar' (filesCount stats) (subtract 1)
-      atomically $ modifyTVar' (filesSize stats) (subtract $ fromIntegral $ size fileInfo)
-
-expireServerFiles :: Maybe Int -> ExpirationConfig -> M ()
-expireServerFiles itemDelay expCfg = do
-  st <- asks store
-  usedStart <- readTVarIO $ usedStorage st
-  old <- liftIO $ expireBeforeEpoch expCfg
-  files' <- readTVarIO (files st)
-  logInfo $ "Expiration check: " <> tshow (M.size files') <> " files"
-  forM_ (M.keys files') $ \sId -> do
-    mapM_ threadDelay itemDelay
-    atomically (expiredFilePath st sId old)
-      >>= mapM_ (maybeRemove $ delete st sId)
-  usedEnd <- readTVarIO $ usedStorage st
-  logInfo $ "Used " <> mbs usedStart <> " -> " <> mbs usedEnd <> ", " <> mbs (usedStart - usedEnd) <> " reclaimed."
-  where
-    mbs bs = tshow (bs `div` 1048576) <> "mb"
-    maybeRemove del = maybe del (remove del)
-    remove del filePath =
-      ifM
-        (doesFileExist filePath)
-        ((removeFile filePath >> del) `catch` \(e :: SomeException) -> logError $ "failed to remove expired file " <> tshow filePath <> ": " <> tshow e)
-        del
-    delete st sId = do
-      withFileLog (`logDeleteFile` sId)
-      void . atomically $ deleteFile st sId -- will not update usedStorage if sId isn't in store
-      FileServerStats {filesExpired} <- asks serverStats
-      atomically $ modifyTVar' filesExpired (+ 1)
-
-randomId :: Int -> M ByteString
-randomId n = atomically . C.randomBytes n =<< asks random
+randomId :: (MonadUnliftIO m, MonadReader XFTPEnv m) => Int -> m ByteString
+randomId n = do
+  gVar <- asks idsDrg
+  atomically (C.pseudoRandomBytes n gVar)

 getFileId :: M XFTPFileId
-getFileId = do
-  size <- asks (fileIdSize . config)
-  atomically . C.randomBytes size =<< asks random
+getFileId = liftIO . getRandomBytes =<< asks (fileIdSize . config)

-withFileLog :: (StoreLog 'WriteMode -> IO a) -> M ()
+withFileLog :: (MonadIO m, MonadReader XFTPEnv m) => (StoreLog 'WriteMode -> IO a) -> m ()
 withFileLog action = liftIO . mapM_ action =<< asks storeLog

 incFileStat :: (FileServerStats -> TVar Int) -> M ()
@@ -561,17 +390,14 @@ restoreServerStats = asks (serverStatsBackupFile . config) >>= mapM_ restoreStat
    restoreStats f = whenM (doesFileExist f) $ do
      logInfo $ "restoring server stats from file " <> T.pack f
      liftIO (strDecode <$> B.readFile f) >>= \case
-        Right d@FileServerStatsData {_filesCount = statsFilesCount, _filesSize = statsFilesSize} -> do
+        Right d -> do
          s <- asks serverStats
-          FileStore {files, usedStorage} <- asks store
-          _filesCount <- M.size <$> readTVarIO files
-          _filesSize <- readTVarIO usedStorage
+          fs <- readTVarIO . files =<< asks store
+          let _filesCount = length $ M.keys fs
+              _filesSize = M.foldl' (\n -> (n +) . fromIntegral . size . fileInfo) 0 fs
          atomically $ setFileServerStats s d {_filesCount, _filesSize}
          renameFile f $ f <> ".bak"
          logInfo "server stats restored"
-          when (statsFilesCount /= _filesCount) $ logWarn $ "Files count differs: stats: " <> tshow statsFilesCount <> ", store: " <> tshow _filesCount
-          when (statsFilesSize /= _filesSize) $ logWarn $ "Files size differs: stats: " <> tshow statsFilesSize <> ", store: " <> tshow _filesSize
-          logInfo $ "Restored " <> tshow (_filesSize `div` 1048576) <> " MBs in " <> tshow _filesCount <> " files"
        Left e -> do
          logInfo $ "error restoring server stats: " <> T.pack e
          liftIO exitFailure
@@ -1,37 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE OverloadedStrings #-}
-
-module Simplex.FileTransfer.Server.Control where
-
-import qualified Data.Attoparsec.ByteString.Char8 as A
-import Data.ByteString (ByteString)
-import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BasicAuth)
-
-data CPClientRole = CPRNone | CPRUser | CPRAdmin
-
-data ControlProtocol
-  = CPAuth BasicAuth
-  | CPStatsRTS
-  | CPDelete ByteString
-  | CPHelp
-  | CPQuit
-  | CPSkip
-
-instance StrEncoding ControlProtocol where
-  strEncode = \case
-    CPAuth tok -> "auth " <> strEncode tok
-    CPStatsRTS -> "stats-rts"
-    CPDelete fId -> strEncode (Str "delete", fId)
-    CPHelp -> "help"
-    CPQuit -> "quit"
-    CPSkip -> ""
-  strP =
-    A.takeTill (== ' ') >>= \case
-      "auth" -> CPAuth <$> _strP
-      "stats-rts" -> pure CPStatsRTS
-      "delete" -> CPDelete <$> _strP
-      "help" -> pure CPHelp
-      "quit" -> pure CPQuit
-      "" -> pure CPSkip
-      _ -> fail "bad ControlProtocol command"
@@ -2,44 +2,37 @@
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
-{-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE StrictData #-}

 module Simplex.FileTransfer.Server.Env where

-import Control.Logger.Simple
+import Control.Logger.Simple (logInfo)
 import Control.Monad
 import Control.Monad.IO.Unlift
 import Crypto.Random
-import Data.Default (def)
 import Data.Int (Int64)
-import Data.List (find)
 import Data.List.NonEmpty (NonEmpty)
-import qualified Data.Map.Strict as M
-import Data.Maybe (fromMaybe)
 import Data.Time.Clock (getCurrentTime)
 import Data.Word (Word32)
 import Data.X509.Validation (Fingerprint (..))
 import Network.Socket
 import qualified Network.TLS as T
-import Simplex.FileTransfer.Protocol (FileCmd, FileInfo (..), XFTPFileId)
+import Simplex.FileTransfer.Protocol (FileCmd, FileInfo, XFTPFileId)
 import Simplex.FileTransfer.Server.Stats
 import Simplex.FileTransfer.Server.Store
 import Simplex.FileTransfer.Server.StoreLog
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Protocol (BasicAuth, RcvPublicAuthKey)
+import Simplex.Messaging.Protocol (BasicAuth, RcvPublicVerifyKey)
 import Simplex.Messaging.Server.Expiration
-import Simplex.Messaging.Transport (ALPN)
-import Simplex.Messaging.Transport.Server (TransportServerConfig (..), loadFingerprint, loadTLSServerParams)
+import Simplex.Messaging.Transport.Server (loadFingerprint, loadTLSServerParams)
 import Simplex.Messaging.Util (tshow)
 import System.IO (IOMode (..))
 import UnliftIO.STM

 data XFTPServerConfig = XFTPServerConfig
  { xftpPort :: ServiceName,
-    controlPort :: Maybe ServiceName,
    fileIdSize :: Int,
    storeLogFile :: Maybe FilePath,
    filesPath :: FilePath,
@@ -51,15 +44,8 @@ data XFTPServerConfig = XFTPServerConfig
    allowNewFiles :: Bool,
    -- | simple password that the clients need to pass in handshake to be able to create new files
    newFileBasicAuth :: Maybe BasicAuth,
-    -- | control port passwords,
-    controlPortUserAuth :: Maybe BasicAuth,
-    controlPortAdminAuth :: Maybe BasicAuth,
    -- | time after which the files can be removed and check interval, seconds
    fileExpiration :: Maybe ExpirationConfig,
-    -- | timeout to receive file
-    fileTimeout :: Int,
-    -- | time after which inactive clients can be disconnected and check interval, seconds
-    inactiveClientExpiration :: Maybe ExpirationConfig,
    -- CA certificate private key is not needed for initialization
    caCertificateFile :: FilePath,
    privateKeyFile :: FilePath,
@@ -69,21 +55,14 @@ data XFTPServerConfig = XFTPServerConfig
    logStatsStartTime :: Int64,
    serverStatsLogFile :: FilePath,
    serverStatsBackupFile :: Maybe FilePath,
-    transportConfig :: TransportServerConfig
+    logTLSErrors :: Bool
  }

-defaultInactiveClientExpiration :: ExpirationConfig
-defaultInactiveClientExpiration =
-  ExpirationConfig
-    { ttl = 43200, -- seconds, 12 hours
-      checkInterval = 3600 -- seconds, 1 hours
-    }
-
 data XFTPEnv = XFTPEnv
  { config :: XFTPServerConfig,
    store :: FileStore,
    storeLog :: Maybe (StoreLog 'WriteMode),
-    random :: TVar ChaChaDRG,
+    idsDrg :: TVar ChaChaDRG,
    serverIdentity :: C.KeyHash,
    tlsServerParams :: T.ServerParams,
    serverStats :: FileServerStats
@@ -99,38 +78,21 @@ defaultFileExpiration =
      checkInterval = 2 * 3600 -- seconds, 2 hours
    }

-supportedXFTPhandshakes :: [ALPN]
-supportedXFTPhandshakes = ["xftp/1"]
-
-newXFTPServerEnv :: XFTPServerConfig -> IO XFTPEnv
+newXFTPServerEnv :: (MonadUnliftIO m, MonadRandom m) => XFTPServerConfig -> m XFTPEnv
 newXFTPServerEnv config@XFTPServerConfig {storeLogFile, fileSizeQuota, caCertificateFile, certificateFile, privateKeyFile} = do
-  random <- liftIO C.newRandom
+  idsDrg <- drgNew >>= newTVarIO
  store <- atomically newFileStore
  storeLog <- liftIO $ mapM (`readWriteFileStore` store) storeLogFile
-  used <- countUsedStorage <$> readTVarIO (files store)
-  atomically $ writeTVar (usedStorage store) used
+  used <- readTVarIO (usedStorage store)
  forM_ fileSizeQuota $ \quota -> do
    logInfo $ "Total / available storage: " <> tshow quota <> " / " <> tshow (quota - used)
    when (quota < used) $ logInfo "WARNING: storage quota is less than used storage, no files can be uploaded!"
-  tlsServerParams' <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
-  let TransportServerConfig {alpn} = transportConfig config
-  let tlsServerParams = case alpn of
-        Nothing -> tlsServerParams'
-        Just supported ->
-          tlsServerParams'
-            { T.serverHooks =
-                def
-                  { T.onALPNClientSuggest = Just $ pure . fromMaybe "" . find (`elem` supported)
-                  }
-            }
+  tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
  Fingerprint fp <- liftIO $ loadFingerprint caCertificateFile
  serverStats <- atomically . newFileServerStats =<< liftIO getCurrentTime
-  pure XFTPEnv {config, store, storeLog, random, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}
-
-countUsedStorage :: M.Map k FileRec -> Int64
-countUsedStorage = M.foldl' (\acc FileRec {fileInfo = FileInfo {size}} -> acc + fromIntegral size) 0
+  pure XFTPEnv {config, store, storeLog, idsDrg, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}

 data XFTPRequest
-  = XFTPReqNew FileInfo (NonEmpty RcvPublicAuthKey) (Maybe BasicAuth)
+  = XFTPReqNew FileInfo (NonEmpty RcvPublicVerifyKey) (Maybe BasicAuth)
  | XFTPReqCmd XFTPFileId FileRec FileCmd
  | XFTPReqPing
@@ -16,23 +16,23 @@ import Data.Maybe (fromMaybe)
 import qualified Data.Text as T
 import Network.Socket (HostName)
 import Options.Applicative
-import Simplex.FileTransfer.Chunks
-import Simplex.FileTransfer.Description (FileSize (..))
+import Simplex.FileTransfer.Description (FileSize (..), kb, mb)
 import Simplex.FileTransfer.Server (runXFTPServer)
-import Simplex.FileTransfer.Server.Env (XFTPServerConfig (..), defFileExpirationHours, defaultFileExpiration, defaultInactiveClientExpiration, supportedXFTPhandshakes)
+import Simplex.FileTransfer.Server.Env (XFTPServerConfig (..), defaultFileExpiration, defFileExpirationHours)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), pattern XFTPServer)
 import Simplex.Messaging.Server.CLI
 import Simplex.Messaging.Server.Expiration
-import Simplex.Messaging.Transport (simplexMQVersion)
 import Simplex.Messaging.Transport.Client (TransportHost (..))
-import Simplex.Messaging.Transport.Server (TransportServerConfig (..), defaultTransportServerConfig)
 import System.Directory (createDirectoryIfMissing, doesFileExist)
 import System.FilePath (combine)
 import System.IO (BufferMode (..), hSetBuffering, stderr, stdout)
 import Text.Read (readMaybe)

+xftpServerVersion :: String
+xftpServerVersion = "1.0.0"
+
 xftpServerCLI :: FilePath -> FilePath -> IO ()
 xftpServerCLI cfgPath logPath = do
  getCliCommand' (cliCommandP cfgPath logPath iniFile) serverVersion >>= \case
@@ -40,10 +40,6 @@ xftpServerCLI cfgPath logPath = do
      doesFileExist iniFile >>= \case
        True -> exitError $ "Error: server is already initialized (" <> iniFile <> " exists).\nRun `" <> executableName <> " start`."
        _ -> initializeServer opts
-    OnlineCert certOpts ->
-      doesFileExist iniFile >>= \case
-        True -> genOnline cfgPath certOpts
-        _ -> exitError $ "Error: server is not initialized (" <> iniFile <> " does not exist).\nRun `" <> executableName <> " init`."
    Start ->
      doesFileExist iniFile >>= \case
        True -> readIniFile iniFile >>= either exitError runServer
@@ -55,7 +51,7 @@ xftpServerCLI cfgPath logPath = do
      putStrLn "Deleted configuration and log files"
  where
    iniFile = combine cfgPath "file-server.ini"
-    serverVersion = "SimpleX XFTP server v" <> simplexMQVersion
+    serverVersion = "SimpleX XFTP server v" <> xftpServerVersion
    defaultServerPort = "443"
    executableName = "file-server"
    storeLogFilePath = combine logPath "file-server-store.log"
@@ -97,24 +93,15 @@ xftpServerCLI cfgPath logPath = do
               \# with the users who you want to allow uploading files to your server.\n\
               \# create_password: password to upload files (any printable ASCII characters without whitespace, '@', ':' and '/')\n\
               \\n\
-               \# control_port_admin_password:\n\
-               \# control_port_user_password:\n\
               \[TRANSPORT]\n\
               \# host is only used to print server address on start\n"
            <> ("host: " <> host <> "\n")
            <> ("port: " <> defaultServerPort <> "\n")
            <> "log_tls_errors: off\n\
-               \# control_port: 5226\n\
               \\n\
               \[FILES]\n"
            <> ("path: " <> filesPath <> "\n")
            <> ("storage_quota: " <> B.unpack (strEncode fileSizeQuota) <> "\n")
-            <> "\n\
-               \[INACTIVE_CLIENTS]\n\
-               \# TTL and interval to check inactive clients\n\
-               \disconnect: off\n"
-            <> ("# ttl: " <> show (ttl defaultInactiveClientExpiration) <> "\n")
-            <> ("# check_interval: " <> show (checkInterval defaultInactiveClientExpiration) <> "\n")
    runServer ini = do
      hSetBuffering stdout LineBuffering
      hSetBuffering stderr LineBuffering
@@ -129,16 +116,13 @@ xftpServerCLI cfgPath logPath = do
        enableStoreLog = settingIsOn "STORE_LOG" "enable" ini
        logStats = settingIsOn "STORE_LOG" "log_stats" ini
        c = combine cfgPath . ($ defaultX509Config)
-        printXFTPConfig XFTPServerConfig {allowNewFiles, newFileBasicAuth, xftpPort, storeLogFile, fileExpiration, inactiveClientExpiration} = do
+        printXFTPConfig XFTPServerConfig {allowNewFiles, newFileBasicAuth, xftpPort, storeLogFile, fileExpiration} = do
          putStrLn $ case storeLogFile of
            Just f -> "Store log: " <> f
            _ -> "Store log disabled."
          putStrLn $ case fileExpiration of
            Just ExpirationConfig {ttl} -> "expiring files after " <> showTTL ttl
            _ -> "not expiring files"
-          putStrLn $ case inactiveClientExpiration of
-            Just ExpirationConfig {ttl, checkInterval} -> "expiring clients inactive for " <> show ttl <> " seconds every " <> show checkInterval <> " seconds"
-            _ -> "not expiring inactive clients"
          putStrLn $
            "Uploading new files "
              <> if allowNewFiles
@@ -149,28 +133,17 @@ xftpServerCLI cfgPath logPath = do
        serverConfig =
          XFTPServerConfig
            { xftpPort = T.unpack $ strictIni "TRANSPORT" "port" ini,
-              controlPort = either (const Nothing) (Just . T.unpack) $ lookupValue "TRANSPORT" "control_port" ini,
              fileIdSize = 16,
              storeLogFile = enableStoreLog $> storeLogFilePath,
              filesPath = T.unpack $ strictIni "FILES" "path" ini,
              fileSizeQuota = either error unFileSize <$> strDecodeIni "FILES" "storage_quota" ini,
-              allowedChunkSizes = serverChunkSizes,
+              allowedChunkSizes = [kb 256, mb 1, mb 4],
              allowNewFiles = fromMaybe True $ iniOnOff "AUTH" "new_files" ini,
              newFileBasicAuth = either error id <$> strDecodeIni "AUTH" "create_password" ini,
-              controlPortAdminAuth = either error id <$> strDecodeIni "AUTH" "control_port_admin_password" ini,
-              controlPortUserAuth = either error id <$> strDecodeIni "AUTH" "control_port_user_password" ini,
              fileExpiration =
-                Just
-                  defaultFileExpiration
-                    { ttl = 3600 * readIniDefault defFileExpirationHours "STORE_LOG" "expire_files_hours" ini
-                    },
-              fileTimeout = 10 * 60 * 1000000, -- 10 mins to send 4mb chunk
-              inactiveClientExpiration =
-                settingIsOn "INACTIVE_CLIENTS" "disconnect" ini
-                  $> ExpirationConfig
-                    { ttl = readStrictIni "INACTIVE_CLIENTS" "ttl" ini,
-                      checkInterval = readStrictIni "INACTIVE_CLIENTS" "check_interval" ini
-                    },
+                Just defaultFileExpiration
+                  { ttl = 3600 * readIniDefault defFileExpirationHours "STORE_LOG" "expire_files_hours" ini
+                  },
              caCertificateFile = c caCrtFile,
              privateKeyFile = c serverKeyFile,
              certificateFile = c serverCrtFile,
@@ -178,16 +151,11 @@ xftpServerCLI cfgPath logPath = do
              logStatsStartTime = 0, -- seconds from 00:00 UTC
              serverStatsLogFile = combine logPath "file-server-stats.daily.log",
              serverStatsBackupFile = logStats $> combine logPath "file-server-stats.log",
-              transportConfig =
-                defaultTransportServerConfig
-                  { logTLSErrors = fromMaybe False $ iniOnOff "TRANSPORT" "log_tls_errors" ini,
-                    alpn = Just supportedXFTPhandshakes
-                  }
+              logTLSErrors = fromMaybe False $ iniOnOff "TRANSPORT" "log_tls_errors" ini
            }

 data CliCommand
  = Init InitOptions
-  | OnlineCert CertOptions
  | Start
  | Delete

@@ -205,7 +173,6 @@ cliCommandP :: FilePath -> FilePath -> FilePath -> Parser CliCommand
 cliCommandP cfgPath logPath iniFile =
  hsubparser
    ( command "init" (info (Init <$> initP) (progDesc $ "Initialize server - creates " <> cfgPath <> " and " <> logPath <> " directories and configuration files"))
-        <> command "cert" (info (OnlineCert <$> certOptionsP) (progDesc $ "Generate new online TLS server credentials (configuration: " <> iniFile <> ")"))
        <> command "start" (info (pure Start) (progDesc $ "Start server (configuration: " <> iniFile <> ")"))
        <> command "delete" (info (pure Delete) (progDesc "Delete configuration and log files"))
    )
@@ -4,7 +4,6 @@

 module Simplex.FileTransfer.Server.Stats where

-import Control.Applicative ((<|>))
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
 import Data.Int (Int64)
@@ -19,7 +18,6 @@ data FileServerStats = FileServerStats
    filesCreated :: TVar Int,
    fileRecipients :: TVar Int,
    filesUploaded :: TVar Int,
-    filesExpired :: TVar Int,
    filesDeleted :: TVar Int,
    filesDownloaded :: PeriodStats SenderId,
    fileDownloads :: TVar Int,
@@ -33,7 +31,6 @@ data FileServerStatsData = FileServerStatsData
    _filesCreated :: Int,
    _fileRecipients :: Int,
    _filesUploaded :: Int,
-    _filesExpired :: Int,
    _filesDeleted :: Int,
    _filesDownloaded :: PeriodStatsData SenderId,
    _fileDownloads :: Int,
@@ -49,14 +46,13 @@ newFileServerStats ts = do
  filesCreated <- newTVar 0
  fileRecipients <- newTVar 0
  filesUploaded <- newTVar 0
-  filesExpired <- newTVar 0
  filesDeleted <- newTVar 0
  filesDownloaded <- newPeriodStats
  fileDownloads <- newTVar 0
  fileDownloadAcks <- newTVar 0
  filesCount <- newTVar 0
  filesSize <- newTVar 0
-  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}
+  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}

 getFileServerStatsData :: FileServerStats -> STM FileServerStatsData
 getFileServerStatsData s = do
@@ -64,14 +60,13 @@ getFileServerStatsData s = do
  _filesCreated <- readTVar $ filesCreated s
  _fileRecipients <- readTVar $ fileRecipients s
  _filesUploaded <- readTVar $ filesUploaded s
-  _filesExpired <- readTVar $ filesExpired s
  _filesDeleted <- readTVar $ filesDeleted s
  _filesDownloaded <- getPeriodStatsData $ filesDownloaded s
  _fileDownloads <- readTVar $ fileDownloads s
  _fileDownloadAcks <- readTVar $ fileDownloadAcks s
  _filesCount <- readTVar $ filesCount s
  _filesSize <- readTVar $ filesSize s
-  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
+  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}

 setFileServerStats :: FileServerStats -> FileServerStatsData -> STM ()
 setFileServerStats s d = do
@@ -79,7 +74,6 @@ setFileServerStats s d = do
  writeTVar (filesCreated s) $! _filesCreated d
  writeTVar (fileRecipients s) $! _fileRecipients d
  writeTVar (filesUploaded s) $! _filesUploaded d
-  writeTVar (filesExpired s) $! _filesExpired d
  writeTVar (filesDeleted s) $! _filesDeleted d
  setPeriodStats (filesDownloaded s) $! _filesDownloaded d
  writeTVar (fileDownloads s) $! _fileDownloads d
@@ -88,16 +82,13 @@ setFileServerStats s d = do
  writeTVar (filesSize s) $! _filesSize d

 instance StrEncoding FileServerStatsData where
-  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize} =
+  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks} =
    B.unlines
      [ "fromTime=" <> strEncode _fromTime,
        "filesCreated=" <> strEncode _filesCreated,
        "fileRecipients=" <> strEncode _fileRecipients,
        "filesUploaded=" <> strEncode _filesUploaded,
-        "filesExpired=" <> strEncode _filesExpired,
        "filesDeleted=" <> strEncode _filesDeleted,
-        "filesCount=" <> strEncode _filesCount,
-        "filesSize=" <> strEncode _filesSize,
        "filesDownloaded:",
        strEncode _filesDownloaded,
        "fileDownloads=" <> strEncode _fileDownloads,
@@ -108,11 +99,8 @@ instance StrEncoding FileServerStatsData where
    _filesCreated <- "filesCreated=" *> strP <* A.endOfLine
    _fileRecipients <- "fileRecipients=" *> strP <* A.endOfLine
    _filesUploaded <- "filesUploaded=" *> strP <* A.endOfLine
-    _filesExpired <- "filesExpired=" *> strP <* A.endOfLine <|> pure 0
    _filesDeleted <- "filesDeleted=" *> strP <* A.endOfLine
-    _filesCount <- "filesCount=" *> strP <* A.endOfLine <|> pure 0
-    _filesSize <- "filesSize=" *> strP <* A.endOfLine <|> pure 0
    _filesDownloaded <- "filesDownloaded:" *> A.endOfLine *> strP <* A.endOfLine
    _fileDownloads <- "fileDownloads=" *> strP <* A.endOfLine
    _fileDownloadAcks <- "fileDownloadAcks=" *> strP <* A.endOfLine
-    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
+    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount = 0, _filesSize = 0}
@@ -11,6 +11,7 @@ module Simplex.FileTransfer.Server.Store
    newFileStore,
    addFile,
    setFilePath,
+    setFilePath',
    addRecipient,
    deleteFile,
    deleteRecipient,
@@ -22,22 +23,22 @@ where

 import Control.Concurrent.STM
 import qualified Data.Attoparsec.ByteString.Char8 as A
+import Data.Functor (($>))
 import Data.Int (Int64)
 import Data.Set (Set)
 import qualified Data.Set as S
 import Data.Time.Clock.System (SystemTime (..))
-import Simplex.FileTransfer.Protocol (FileInfo (..), SFileParty (..), XFTPFileId)
-import Simplex.FileTransfer.Transport (XFTPErrorType (..))
+import Simplex.FileTransfer.Protocol (FileInfo (..), SFileParty (..), XFTPErrorType (..), XFTPFileId)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (RcvPublicAuthKey, RecipientId, SenderId)
+import Simplex.Messaging.Protocol (RcvPublicVerifyKey, RecipientId, SenderId)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Util (ifM, ($>>=))

 data FileStore = FileStore
  { files :: TMap SenderId FileRec,
-    recipients :: TMap RecipientId (SenderId, RcvPublicAuthKey),
+    recipients :: TMap RecipientId (SenderId, RcvPublicVerifyKey),
    usedStorage :: TVar Int64
  }

@@ -48,8 +49,9 @@ data FileRec = FileRec
    recipientIds :: TVar (Set RecipientId),
    createdAt :: SystemTime
  }
+  deriving (Eq)

-data FileRecipient = FileRecipient RecipientId RcvPublicAuthKey
+data FileRecipient = FileRecipient RecipientId RcvPublicVerifyKey

 instance StrEncoding FileRecipient where
  strEncode (FileRecipient rId rKey) = strEncode rId <> ":" <> strEncode rKey
@@ -77,10 +79,12 @@ newFileRec senderId fileInfo createdAt = do

 setFilePath :: FileStore -> SenderId -> FilePath -> STM (Either XFTPErrorType ())
 setFilePath st sId fPath =
-  withFile st sId $ \FileRec {fileInfo, filePath} -> do
-    writeTVar filePath (Just fPath)
-    modifyTVar' (usedStorage st) (+ fromIntegral (size fileInfo))
-    pure $ Right ()
+  withFile st sId $ \fr -> setFilePath' st fr fPath $> Right ()
+
+setFilePath' :: FileStore -> FileRec -> FilePath -> STM ()
+setFilePath' st FileRec {fileInfo, filePath} fPath = do
+  writeTVar filePath (Just fPath)
+  modifyTVar' (usedStorage st) (+ fromIntegral (size fileInfo))

 addRecipient :: FileStore -> SenderId -> FileRecipient -> STM (Either XFTPErrorType ())
 addRecipient st@FileStore {recipients} senderId (FileRecipient rId rKey) =
@@ -109,7 +113,7 @@ deleteRecipient FileStore {recipients} rId FileRec {recipientIds} = do
  TM.delete rId recipients
  modifyTVar' recipientIds $ S.delete rId

-getFile :: FileStore -> SFileParty p -> XFTPFileId -> STM (Either XFTPErrorType (FileRec, C.APublicAuthKey))
+getFile :: FileStore -> SFileParty p -> XFTPFileId -> STM (Either XFTPErrorType (FileRec, C.APublicVerifyKey))
 getFile st party fId = case party of
  SFSender -> withFile st fId $ pure . Right . (\f -> (f, sndKey $ fileInfo f))
  SFRecipient ->
@@ -117,12 +121,12 @@ getFile st party fId = case party of
      Just (sId, rKey) -> withFile st sId $ pure . Right . (,rKey)
      _ -> pure $ Left AUTH

-expiredFilePath :: FileStore -> XFTPFileId -> Int64 -> STM (Maybe (Maybe FilePath))
+expiredFilePath :: FileStore -> XFTPFileId -> Int64 -> STM (Maybe FilePath)
 expiredFilePath FileStore {files} sId old =
  TM.lookup sId files
    $>>= \FileRec {filePath, createdAt} ->
      if systemSeconds createdAt < old
-        then Just <$> readTVar filePath
+        then readTVar filePath
        else pure Nothing

 ackFile :: FileStore -> RecipientId -> STM (Either XFTPErrorType ())
@@ -22,7 +22,6 @@ import Control.Concurrent.STM
 import Control.Monad.Except
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
-import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Composition ((.:), (.:.))
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
@@ -32,7 +31,7 @@ import Data.Time.Clock.System (SystemTime)
 import Simplex.FileTransfer.Protocol (FileInfo (..))
 import Simplex.FileTransfer.Server.Store
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (RcvPublicAuthKey, RecipientId, SenderId)
+import Simplex.Messaging.Protocol (RcvPublicVerifyKey, RecipientId, SenderId)
 import Simplex.Messaging.Server.StoreLog
 import Simplex.Messaging.Util (bshow, whenM)
 import System.Directory (doesFileExist, renameFile)
@@ -89,7 +88,7 @@ readWriteFileStore f st = do
  pure s

 readFileStore :: FilePath -> FileStore -> IO ()
-readFileStore f st = mapM_ (addFileLogRecord . LB.toStrict) . LB.lines =<< LB.readFile f
+readFileStore f st = mapM_ addFileLogRecord . B.lines =<< B.readFile f
  where
    addFileLogRecord s = case strDecode s of
      Left e -> B.putStrLn $ "Log parsing error (" <> B.pack e <> "): " <> B.take 100 s
@@ -110,7 +109,7 @@ writeFileStore s FileStore {files, recipients} = do
  allRcps <- readTVarIO recipients
  readTVarIO files >>= mapM_ (logFile allRcps)
  where
-    logFile :: Map RecipientId (SenderId, RcvPublicAuthKey) -> FileRec -> IO ()
+    logFile :: Map RecipientId (SenderId, RcvPublicVerifyKey) -> FileRec -> IO ()
    logFile allRcps FileRec {senderId, fileInfo, filePath, recipientIds, createdAt} = do
      logAddFile s senderId fileInfo createdAt
      (rcpErrs, rcps) <- M.mapEither getRcp . M.fromSet id <$> readTVarIO recipientIds
@@ -1,63 +1,33 @@
-{-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiWayIf #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TemplateHaskell #-}

 module Simplex.FileTransfer.Transport
  ( supportedFileServerVRange,
-    authCmdsXFTPVersion,
-    xftpClientHandshakeStub,
-    XFTPClientHandshake (..),
-    -- xftpClientHandshake,
-    XFTPServerHandshake (..),
-    -- xftpServerHandshake,
-    THandleXFTP,
-    THandleParamsXFTP,
-    VersionXFTP,
-    VersionRangeXFTP,
-    XFTPVersion,
-    pattern VersionXFTP,
-    XFTPErrorType (..),
    XFTPRcvChunkSpec (..),
-    ReceiveFileError (..),
+    sendFile,
    receiveFile,
    sendEncFile,
    receiveEncFile,
-    receiveSbFile,
  )
 where

-import Control.Applicative ((<|>))
 import qualified Control.Exception as E
-import Control.Monad
 import Control.Monad.Except
-import Control.Monad.IO.Class
-import qualified Data.Aeson.TH as J
-import qualified Data.Attoparsec.ByteString.Char8 as A
-import Data.Bifunctor (bimap, first)
 import qualified Data.ByteArray as BA
 import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
-import Data.Word (Word16, Word32)
-import qualified Data.X509 as X
+import Data.Word (Word32)
+import GHC.IO.Handle.Internals (ioe_EOF)
+import Simplex.FileTransfer.Protocol (XFTPErrorType (..))
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
-import Simplex.Messaging.Encoding
-import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers
-import Simplex.Messaging.Protocol (CommandError)
-import Simplex.Messaging.Transport (HandshakeError (..), SessionId, THandle (..), THandleParams (..), TransportError (..), TransportPeer (..))
-import Simplex.Messaging.Transport.HTTP2.File
-import Simplex.Messaging.Util (bshow)
 import Simplex.Messaging.Version
-import Simplex.Messaging.Version.Internal
 import System.IO (Handle, IOMode (..), withFile)

 data XFTPRcvChunkSpec = XFTPRcvChunkSpec
@@ -67,69 +37,20 @@ data XFTPRcvChunkSpec = XFTPRcvChunkSpec
  }
  deriving (Show)

-data XFTPVersion
+supportedFileServerVRange :: VersionRange
+supportedFileServerVRange = mkVersionRange 1 1

-instance VersionScope XFTPVersion
+fileBlockSize :: Int
+fileBlockSize = 16 * 1024

-type VersionXFTP = Version XFTPVersion
-
-type VersionRangeXFTP = VersionRange XFTPVersion
-
-pattern VersionXFTP :: Word16 -> VersionXFTP
-pattern VersionXFTP v = Version v
-
-type THandleXFTP c p = THandle XFTPVersion c p
-type THandleParamsXFTP p = THandleParams XFTPVersion p
-
-initialXFTPVersion :: VersionXFTP
-initialXFTPVersion = VersionXFTP 1
-
-authCmdsXFTPVersion :: VersionXFTP
-authCmdsXFTPVersion = VersionXFTP 2
-
-currentXFTPVersion :: VersionXFTP
-currentXFTPVersion = VersionXFTP 2
-
-supportedFileServerVRange :: VersionRangeXFTP
-supportedFileServerVRange = mkVersionRange initialXFTPVersion currentXFTPVersion
-
-- XFTP protocol does not use this handshake method
-xftpClientHandshakeStub :: c -> Maybe C.KeyPairX25519 -> C.KeyHash -> VersionRangeXFTP -> ExceptT TransportError IO (THandle XFTPVersion c 'TClient)
-xftpClientHandshakeStub _c _ks _keyHash _xftpVRange = throwError $ TEHandshake VERSION
-
-data XFTPServerHandshake = XFTPServerHandshake
-  { xftpVersionRange :: VersionRangeXFTP,
-    sessionId :: SessionId,
-    -- | pub key to agree shared secrets for command authorization and entity ID encryption.
-    authPubKey :: (X.CertificateChain, X.SignedExact X.PubKey)
-  }
-
-data XFTPClientHandshake = XFTPClientHandshake
-  { -- | agreed XFTP server protocol version
-    xftpVersion :: VersionXFTP,
-    -- | server identity - CA certificate fingerprint
-    keyHash :: C.KeyHash
-  }
-
-instance Encoding XFTPClientHandshake where
-  smpEncode XFTPClientHandshake {xftpVersion, keyHash} =
-    smpEncode (xftpVersion, keyHash)
-  smpP = do
-    (xftpVersion, keyHash) <- smpP
-    Tail _compat <- smpP
-    pure XFTPClientHandshake {xftpVersion, keyHash}
-
-instance Encoding XFTPServerHandshake where
-  smpEncode XFTPServerHandshake {xftpVersionRange, sessionId, authPubKey} =
-    smpEncode (xftpVersionRange, sessionId, auth)
-    where
-      auth = bimap C.encodeCertChain C.SignedObject authPubKey
-  smpP = do
-    (xftpVersionRange, sessionId) <- smpP
-    cert <- C.certChainP
-    C.SignedObject key <- smpP
-    Tail _compat <- smpP
-    pure XFTPServerHandshake {xftpVersionRange, sessionId, authPubKey = (cert, key)}
+sendFile :: Handle -> (Builder -> IO ()) -> Word32 -> IO ()
+sendFile h send = go
+  where
+    go 0 = pure ()
+    go sz =
+      getFileChunk h sz >>= \ch -> do
+        send $ byteString ch
+        go $ sz - fromIntegral (B.length ch)

 sendEncFile :: Handle -> (Builder -> IO ()) -> LC.SbState -> Word32 -> IO ()
 sendEncFile h send = go
@@ -143,42 +64,46 @@ sendEncFile h send = go
        send (byteString encCh) `E.catch` \(e :: E.SomeException) -> print e >> E.throwIO e
        go sbState' $ sz - fromIntegral (B.length ch)

+getFileChunk :: Handle -> Word32 -> IO ByteString
+getFileChunk h sz =
+  B.hGet h fileBlockSize >>= \case
+    "" -> ioe_EOF
+    ch -> pure $ B.take (fromIntegral sz) ch -- sz >= xftpBlockSize
+
 receiveFile :: (Int -> IO ByteString) -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
 receiveFile getBody = receiveFile_ receive
  where
-    receive h sz = hReceiveFile getBody h sz >>= \sz' -> pure $ if sz' == 0 then Right () else Left SIZE
+    receive h sz = do
+      ch <- getBody fileBlockSize
+      let chSize = fromIntegral $ B.length ch
+      if
+          | chSize > sz -> pure $ Left SIZE
+          | chSize > 0 -> B.hPut h ch >> receive h (sz - chSize)
+          | sz == 0 -> pure $ Right ()
+          | otherwise -> pure $ Left SIZE

 receiveEncFile :: (Int -> IO ByteString) -> LC.SbState -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
 receiveEncFile getBody = receiveFile_ . receive
  where
-    receive sbState h sz = first err <$> receiveSbFile getBody h sbState sz
-    err RFESize = SIZE
-    err RFECrypto = CRYPTO
-
-data ReceiveFileError = RFESize | RFECrypto
-
-receiveSbFile :: (Int -> IO ByteString) -> Handle -> LC.SbState -> Word32 -> IO (Either ReceiveFileError ())
-receiveSbFile getBody h = receive
-  where
-    receive sbState sz = do
+    receive sbState h sz = do
      ch <- getBody fileBlockSize
      let chSize = fromIntegral $ B.length ch
      if
-        | chSize > sz + authSz -> pure $ Left RFESize
-        | chSize > 0 -> do
+          | chSize > sz + authSz -> pure $ Left SIZE
+          | chSize > 0 -> do
            let (ch', rest) = B.splitAt (fromIntegral sz) ch
                (decCh, sbState') = LC.sbDecryptChunk sbState ch'
                sz' = sz - fromIntegral (B.length ch')
            B.hPut h decCh
            if sz' > 0
-              then receive sbState' sz'
+              then receive sbState' h sz'
              else do
                let tag' = B.take C.authTagSize rest
                    tagSz = B.length tag'
                    tag = LC.sbAuth sbState'
                tag'' <- if tagSz == C.authTagSize then pure tag' else (tag' <>) <$> getBody (C.authTagSize - tagSz)
-                pure $ if BA.constEq tag'' tag then Right () else Left RFECrypto
-        | otherwise -> pure $ Left RFESize
+                pure $ if BA.constEq tag'' tag then Right () else Left CRYPTO
+          | otherwise -> pure $ Left SIZE
    authSz = fromIntegral C.authTagSize

 receiveFile_ :: (Handle -> Word32 -> IO (Either XFTPErrorType ())) -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
@@ -186,89 +111,3 @@ receiveFile_ receive XFTPRcvChunkSpec {filePath, chunkSize, chunkDigest} = do
  ExceptT $ withFile filePath WriteMode (`receive` chunkSize)
  digest' <- liftIO $ LC.sha256Hash <$> LB.readFile filePath
  when (digest' /= chunkDigest) $ throwError DIGEST
-
-data XFTPErrorType
-  = -- | incorrect block format, encoding or signature size
-    BLOCK
-  | -- | incorrect SMP session ID (TLS Finished message / tls-unique binding RFC5929)
-    SESSION
-  | -- | incorrect handshake command
-    HANDSHAKE
-  | -- | SMP command is unknown or has invalid syntax
-    CMD {cmdErr :: CommandError}
-  | -- | command authorization error - bad signature or non-existing SMP queue
-    AUTH
-  | -- | incorrent file size
-    SIZE
-  | -- | storage quota exceeded
-    QUOTA
-  | -- | incorrent file digest
-    DIGEST
-  | -- | file encryption/decryption failed
-    CRYPTO
-  | -- | no expected file body in request/response or no file on the server
-    NO_FILE
-  | -- | unexpected file body
-    HAS_FILE
-  | -- | file IO error
-    FILE_IO
-  | -- | file sending timeout
-    TIMEOUT
-  | -- | bad redirect data
-    REDIRECT {redirectError :: String}
-  | -- | internal server error
-    INTERNAL
-  | -- | used internally, never returned by the server (to be removed)
-    DUPLICATE_ -- not part of SMP protocol, used internally
-  deriving (Eq, Read, Show)
-
-instance StrEncoding XFTPErrorType where
-  strEncode = \case
-    CMD e -> "CMD " <> bshow e
-    REDIRECT e -> "REDIRECT " <> bshow e
-    e -> bshow e
-  strP =
-    "CMD " *> (CMD <$> parseRead1)
-      <|> "REDIRECT " *> (REDIRECT <$> parseRead A.takeByteString)
-      <|> parseRead1
-
-instance Encoding XFTPErrorType where
-  smpEncode = \case
-    BLOCK -> "BLOCK"
-    SESSION -> "SESSION"
-    HANDSHAKE -> "HANDSHAKE"
-    CMD err -> "CMD " <> smpEncode err
-    AUTH -> "AUTH"
-    SIZE -> "SIZE"
-    QUOTA -> "QUOTA"
-    DIGEST -> "DIGEST"
-    CRYPTO -> "CRYPTO"
-    NO_FILE -> "NO_FILE"
-    HAS_FILE -> "HAS_FILE"
-    FILE_IO -> "FILE_IO"
-    TIMEOUT -> "TIMEOUT"
-    REDIRECT err -> "REDIRECT " <> smpEncode err
-    INTERNAL -> "INTERNAL"
-    DUPLICATE_ -> "DUPLICATE_"
-
-  smpP =
-    A.takeTill (== ' ') >>= \case
-      "BLOCK" -> pure BLOCK
-      "SESSION" -> pure SESSION
-      "HANDSHAKE" -> pure HANDSHAKE
-      "CMD" -> CMD <$> _smpP
-      "AUTH" -> pure AUTH
-      "SIZE" -> pure SIZE
-      "QUOTA" -> pure QUOTA
-      "DIGEST" -> pure DIGEST
-      "CRYPTO" -> pure CRYPTO
-      "NO_FILE" -> pure NO_FILE
-      "HAS_FILE" -> pure HAS_FILE
-      "FILE_IO" -> pure FILE_IO
-      "TIMEOUT" -> pure TIMEOUT
-      "REDIRECT" -> REDIRECT <$> _smpP
-      "INTERNAL" -> pure INTERNAL
-      "DUPLICATE_" -> pure DUPLICATE_
-      _ -> fail "bad error type"
-
-$(J.deriveJSON (sumTypeJSON id) ''XFTPErrorType)
@@ -13,7 +13,6 @@ import Simplex.FileTransfer.Client (XFTPChunkSpec (..))
 import Simplex.FileTransfer.Description
 import Simplex.Messaging.Agent.Protocol (RcvFileId, SndFileId)
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.File (CryptoFile (..))
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (fromTextField_)
@@ -47,15 +46,14 @@ data RcvFile = RcvFile
    key :: C.SbKey,
    nonce :: C.CbNonce,
    chunkSize :: FileSize Word32,
-    redirect :: Maybe RcvFileRedirect,
    chunks :: [RcvFileChunk],
    prefixPath :: FilePath,
    tmpPath :: Maybe FilePath,
-    saveFile :: CryptoFile,
+    savePath :: FilePath,
    status :: RcvFileStatus,
    deleted :: Bool
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data RcvFileStatus
  = RFSReceiving
@@ -96,25 +94,18 @@ data RcvFileChunk = RcvFileChunk
    fileTmpPath :: FilePath,
    chunkTmpPath :: Maybe FilePath
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data RcvFileChunkReplica = RcvFileChunkReplica
  { rcvChunkReplicaId :: Int64,
    server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
+    replicaKey :: C.APrivateSignKey,
    received :: Bool,
    delay :: Maybe Int64,
    retries :: Int
  }
-  deriving (Show)
-
-data RcvFileRedirect = RcvFileRedirect
-  { redirectDbId :: DBRcvFileId,
-    redirectEntityId :: RcvFileId,
-    redirectFileInfo :: RedirectFileInfo
-  }
-  deriving (Show)
+  deriving (Eq, Show)

 -- Sending files

@@ -129,13 +120,12 @@ data SndFile = SndFile
    key :: C.SbKey,
    nonce :: C.CbNonce,
    chunks :: [SndFileChunk],
-    srcFile :: CryptoFile,
+    filePath :: FilePath,
    prefixPath :: Maybe FilePath,
    status :: SndFileStatus,
-    deleted :: Bool,
-    redirect :: Maybe RedirectFileInfo
+    deleted :: Bool
  }
-  deriving (Show)
+  deriving (Eq, Show)

 sndFileEncPath :: FilePath -> FilePath
 sndFileEncPath prefixPath = prefixPath </> "xftp.encrypted"
@@ -182,7 +172,7 @@ data SndFileChunk = SndFileChunk
    digest :: FileDigest,
    replicas :: [SndFileChunkReplica]
  }
-  deriving (Show)
+  deriving (Eq, Show)

 sndChunkSize :: SndFileChunk -> Word32
 sndChunkSize SndFileChunk {chunkSpec = XFTPChunkSpec {chunkSize}} = chunkSize
@@ -190,22 +180,22 @@ sndChunkSize SndFileChunk {chunkSpec = XFTPChunkSpec {chunkSize}} = chunkSize
 data NewSndChunkReplica = NewSndChunkReplica
  { server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
-    rcvIdsKeys :: [(ChunkReplicaId, C.APrivateAuthKey)]
+    replicaKey :: C.APrivateSignKey,
+    rcvIdsKeys :: [(ChunkReplicaId, C.APrivateSignKey)]
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data SndFileChunkReplica = SndFileChunkReplica
  { sndChunkReplicaId :: Int64,
    server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
-    rcvIdsKeys :: [(ChunkReplicaId, C.APrivateAuthKey)],
+    replicaKey :: C.APrivateSignKey,
+    rcvIdsKeys :: [(ChunkReplicaId, C.APrivateSignKey)],
    replicaStatus :: SndFileReplicaStatus,
    delay :: Maybe Int64,
    retries :: Int
  }
-  deriving (Show)
+  deriving (Eq, Show)

 data SndFileReplicaStatus
  = SFRSCreated
@@ -230,9 +220,9 @@ data DeletedSndChunkReplica = DeletedSndChunkReplica
    userId :: Int64,
    server :: XFTPServer,
    replicaId :: ChunkReplicaId,
-    replicaKey :: C.APrivateAuthKey,
+    replicaKey :: C.APrivateSignKey,
    chunkDigest :: FileDigest,
    delay :: Maybe Int64,
    retries :: Int
  }
-  deriving (Show)
+  deriving (Eq, Show)
@@ -6,32 +6,23 @@
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE NumericUnderscores #-}
 {-# LANGUAGE RankNTypes #-}
-{-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TypeApplications #-}
 {-# OPTIONS_GHC -fno-warn-unticked-promoted-constructors #-}

 module Simplex.Messaging.Agent.Env.SQLite
-  ( AM',
-    AM,
+  ( AgentMonad,
+    AgentMonad',
    AgentConfig (..),
    InitialAgentServers (..),
    NetworkConfig (..),
    defaultAgentConfig,
    defaultReconnectInterval,
-    tryAgentError,
-    tryAgentError',
-    catchAgentError,
-    catchAgentError',
-    agentFinally,
    Env (..),
    newSMPAgentEnv,
    createAgentStore,
    NtfSupervisor (..),
    NtfSupervisorCommand (..),
    XFTPAgent (..),
-    Worker (..),
-    RestartCount (..),
-    updateRestartCount,
  )
 where

@@ -39,12 +30,10 @@ import Control.Monad.Except
 import Control.Monad.IO.Unlift
 import Control.Monad.Reader
 import Crypto.Random
-import Data.ByteArray (ScrubbedBytes)
 import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty)
 import Data.Map (Map)
 import Data.Time.Clock (NominalDiffTime, nominalDay)
-import Data.Time.Clock.System (SystemTime (..))
 import Data.Word (Word16)
 import Network.Socket
 import Numeric.Natural
@@ -56,23 +45,21 @@ import qualified Simplex.Messaging.Agent.Store.SQLite.Migrations as Migrations
 import Simplex.Messaging.Client
 import Simplex.Messaging.Client.Agent ()
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.Ratchet (VersionRangeE2E, supportedE2EEncryptVRange)
-import Simplex.Messaging.Notifications.Client (defaultNTFClientConfig)
-import Simplex.Messaging.Notifications.Transport (NTFVersion)
+import Simplex.Messaging.Crypto.Ratchet (supportedE2EEncryptVRange)
 import Simplex.Messaging.Notifications.Types
-import Simplex.Messaging.Protocol (NtfServer, VersionRangeSMPC, XFTPServer, XFTPServerWithAuth, supportedSMPClientVRange)
+import Simplex.Messaging.Protocol (NtfServer, XFTPServer, XFTPServerWithAuth, supportedSMPClientVRange)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Transport (SMPVersion, TLS, Transport (..))
+import Simplex.Messaging.Transport (TLS, Transport (..))
 import Simplex.Messaging.Transport.Client (defaultSMPPort)
-import Simplex.Messaging.Util (allFinally, catchAllErrors, catchAllErrors', tryAllErrors, tryAllErrors')
+import Simplex.Messaging.Version
 import System.Random (StdGen, newStdGen)
-import UnliftIO (Async, SomeException)
+import UnliftIO (Async)
 import UnliftIO.STM

-type AM' a = ReaderT Env IO a
+type AgentMonad' m = (MonadUnliftIO m, MonadReader Env m)

-type AM a = ExceptT AgentErrorType (ReaderT Env IO) a
+type AgentMonad m = (AgentMonad' m, MonadError AgentErrorType m)

 data InitialAgentServers = InitialAgentServers
  { smp :: Map UserId (NonEmpty SMPServerWithAuth),
@@ -82,31 +69,23 @@ data InitialAgentServers = InitialAgentServers
  }

 data AgentConfig = AgentConfig
-  { tcpPort :: Maybe ServiceName,
-    rcvAuthAlg :: C.AuthAlg,
-    sndAuthAlg :: C.AuthAlg,
+  { tcpPort :: ServiceName,
+    cmdSignAlg :: C.SignAlg,
    connIdBytes :: Int,
    tbqSize :: Natural,
-    smpCfg :: ProtocolClientConfig SMPVersion,
-    ntfCfg :: ProtocolClientConfig NTFVersion,
+    smpCfg :: ProtocolClientConfig,
+    ntfCfg :: ProtocolClientConfig,
    xftpCfg :: XFTPClientConfig,
    reconnectInterval :: RetryInterval,
    messageRetryInterval :: RetryInterval2,
-    userNetworkInterval :: RetryInterval,
    messageTimeout :: NominalDiffTime,
-    connDeleteDeliveryTimeout :: NominalDiffTime,
    helloTimeout :: NominalDiffTime,
-    quotaExceededTimeout :: NominalDiffTime,
    initialCleanupDelay :: Int64,
    cleanupInterval :: Int64,
-    cleanupStepInterval :: Int,
-    maxWorkerRestartsPerMin :: Int,
-    maxSubscriptionTimeouts :: Int,
-    storedMsgDataTTL :: NominalDiffTime,
+    rcvMsgHashesTTL :: NominalDiffTime,
    rcvFilesTTL :: NominalDiffTime,
    sndFilesTTL :: NominalDiffTime,
    xftpNotifyErrsOnRetry :: Bool,
-    xftpConsecutiveRetries :: Int,
    xftpMaxRecipientsPerRequest :: Int,
    deleteErrorCount :: Int,
    ntfCron :: Word16,
@@ -117,9 +96,10 @@ data AgentConfig = AgentConfig
    caCertificateFile :: FilePath,
    privateKeyFile :: FilePath,
    certificateFile :: FilePath,
-    e2eEncryptVRange :: VersionRangeE2E,
-    smpAgentVRange :: VersionRangeSMPA,
-    smpClientVRange :: VersionRangeSMPC
+    e2eEncryptVRange :: VersionRange,
+    smpAgentVRange :: VersionRange,
+    smpClientVRange :: VersionRange,
+    initialClientId :: Int
  }

 defaultReconnectInterval :: RetryInterval
@@ -127,7 +107,7 @@ defaultReconnectInterval =
  RetryInterval
    { initialInterval = 2_000000,
      increaseAfter = 10_000000,
-      maxInterval = 60_000000
+      maxInterval = 180_000000
    }

 defaultMessageRetryInterval :: RetryInterval2
@@ -135,65 +115,48 @@ defaultMessageRetryInterval =
  RetryInterval2
    { riFast =
        RetryInterval
-          { initialInterval = 2_000000,
+          { initialInterval = 1_000000,
            increaseAfter = 10_000000,
            maxInterval = 60_000000
          },
      riSlow =
+        -- TODO: these timeouts can be increased in v5.0 once most clients are updated
+        -- to resume sending on QCONT messages.
+        -- After that local message expiration period should be also increased.
        RetryInterval
-          { initialInterval = 300_000000, -- 5 minutes
+          { initialInterval = 60_000000,
            increaseAfter = 60_000000,
-            maxInterval = 6 * 3600_000000 -- 6 hours
+            maxInterval = 3600_000000 -- 1 hour
          }
    }

-defaultUserNetworkInterval :: RetryInterval
-defaultUserNetworkInterval =
-  RetryInterval
-    { initialInterval = 1200_000000, -- 20 minutes
-      increaseAfter = 0,
-      maxInterval = 7200_000000 -- 2 hours
-    }
-
 defaultAgentConfig :: AgentConfig
 defaultAgentConfig =
  AgentConfig
-    { tcpPort = Just "5224",
-      -- while the current client version supports X25519, it can only be enabled once support for SMP v6 is dropped,
-      -- and all servers are required to support v7 to be compatible.
-      rcvAuthAlg = C.AuthAlg C.SEd25519, -- this will stay as Ed25519
-      sndAuthAlg = C.AuthAlg C.SEd25519, -- TODO replace with X25519 when switching to v7
+    { tcpPort = "5224",
+      cmdSignAlg = C.SignAlg C.SEd448,
      connIdBytes = 12,
      tbqSize = 64,
-      smpCfg = defaultSMPClientConfig {defaultTransport = (show defaultSMPPort, transport @TLS)},
-      ntfCfg = defaultNTFClientConfig {defaultTransport = ("443", transport @TLS)},
+      smpCfg = defaultClientConfig {defaultTransport = (show defaultSMPPort, transport @TLS)},
+      ntfCfg = defaultClientConfig {defaultTransport = ("443", transport @TLS)},
      xftpCfg = defaultXFTPClientConfig,
      reconnectInterval = defaultReconnectInterval,
      messageRetryInterval = defaultMessageRetryInterval,
-      userNetworkInterval = defaultUserNetworkInterval,
      messageTimeout = 2 * nominalDay,
-      connDeleteDeliveryTimeout = 2 * nominalDay,
      helloTimeout = 2 * nominalDay,
-      quotaExceededTimeout = 7 * nominalDay,
      initialCleanupDelay = 30 * 1000000, -- 30 seconds
      cleanupInterval = 30 * 60 * 1000000, -- 30 minutes
-      cleanupStepInterval = 200000, -- 200ms
-      maxWorkerRestartsPerMin = 5,
-      -- 3 consecutive subscription timeouts will result in alert to the user
-      -- this is a fallback, as the timeout set to 3x of expected timeout, to avoid potential locking.
-      maxSubscriptionTimeouts = 3,
-      storedMsgDataTTL = 21 * nominalDay,
+      rcvMsgHashesTTL = 30 * nominalDay,
      rcvFilesTTL = 2 * nominalDay,
      sndFilesTTL = nominalDay,
      xftpNotifyErrsOnRetry = True,
-      xftpConsecutiveRetries = 3,
      xftpMaxRecipientsPerRequest = 200,
      deleteErrorCount = 10,
      ntfCron = 20, -- minutes
      ntfWorkerDelay = 100000, -- microseconds
      ntfSMPWorkerDelay = 500000, -- microseconds
      ntfSubCheckInterval = nominalDay,
-      ntfMaxMessages = 3,
+      ntfMaxMessages = 4,
      -- CA certificate private key is not needed for initialization
      -- ! we do not generate these
      caCertificateFile = "/etc/opt/simplex-agent/ca.crt",
@@ -201,36 +164,37 @@ defaultAgentConfig =
      certificateFile = "/etc/opt/simplex-agent/agent.crt",
      e2eEncryptVRange = supportedE2EEncryptVRange,
      smpAgentVRange = supportedSMPAgentVRange,
-      smpClientVRange = supportedSMPClientVRange
+      smpClientVRange = supportedSMPClientVRange,
+      initialClientId = 0
    }

 data Env = Env
  { config :: AgentConfig,
    store :: SQLiteStore,
-    random :: TVar ChaChaDRG,
+    idsDrg :: TVar ChaChaDRG,
+    clientCounter :: TVar Int,
    randomServer :: TVar StdGen,
    ntfSupervisor :: NtfSupervisor,
-    xftpAgent :: XFTPAgent,
-    multicastSubscribers :: TMVar Int
+    xftpAgent :: XFTPAgent
  }

 newSMPAgentEnv :: AgentConfig -> SQLiteStore -> IO Env
-newSMPAgentEnv config store = do
-  random <- C.newRandom
+newSMPAgentEnv config@AgentConfig {initialClientId} store = do
+  idsDrg <- newTVarIO =<< liftIO drgNew
+  clientCounter <- newTVarIO initialClientId
  randomServer <- newTVarIO =<< liftIO newStdGen
  ntfSupervisor <- atomically . newNtfSubSupervisor $ tbqSize config
  xftpAgent <- atomically newXFTPAgent
-  multicastSubscribers <- newTMVarIO 0
-  pure Env {config, store, random, randomServer, ntfSupervisor, xftpAgent, multicastSubscribers}
+  pure Env {config, store, idsDrg, clientCounter, randomServer, ntfSupervisor, xftpAgent}

-createAgentStore :: FilePath -> ScrubbedBytes -> Bool -> MigrationConfirmation -> IO (Either MigrationError SQLiteStore)
-createAgentStore dbFilePath dbKey keepKey = createSQLiteStore dbFilePath dbKey keepKey Migrations.app
+createAgentStore :: FilePath -> String -> MigrationConfirmation -> IO (Either MigrationError SQLiteStore)
+createAgentStore dbFilePath dbKey = createSQLiteStore dbFilePath dbKey Migrations.app

 data NtfSupervisor = NtfSupervisor
  { ntfTkn :: TVar (Maybe NtfToken),
    ntfSubQ :: TBQueue (ConnId, NtfSupervisorCommand),
-    ntfWorkers :: TMap NtfServer Worker,
-    ntfSMPWorkers :: TMap SMPServer Worker
+    ntfWorkers :: TMap NtfServer (TMVar (), Async ()),
+    ntfSMPWorkers :: TMap SMPServer (TMVar (), Async ())
  }

 data NtfSupervisorCommand = NSCCreate | NSCDelete | NSCSmpDelete | NSCNtfWorker NtfServer | NSCNtfSMPWorker SMPServer
@@ -247,9 +211,9 @@ newNtfSubSupervisor qSize = do
 data XFTPAgent = XFTPAgent
  { -- if set, XFTP file paths will be considered as relative to this directory
    xftpWorkDir :: TVar (Maybe FilePath),
-    xftpRcvWorkers :: TMap (Maybe XFTPServer) Worker,
-    xftpSndWorkers :: TMap (Maybe XFTPServer) Worker,
-    xftpDelWorkers :: TMap XFTPServer Worker
+    xftpRcvWorkers :: TMap (Maybe XFTPServer) (TMVar (), Async ()),
+    xftpSndWorkers :: TMap (Maybe XFTPServer) (TMVar (), Async ()),
+    xftpDelWorkers :: TMap XFTPServer (TMVar (), Async ())
  }

 newXFTPAgent :: STM XFTPAgent
@@ -259,45 +223,3 @@ newXFTPAgent = do
  xftpSndWorkers <- TM.empty
  xftpDelWorkers <- TM.empty
  pure XFTPAgent {xftpWorkDir, xftpRcvWorkers, xftpSndWorkers, xftpDelWorkers}
-
-tryAgentError :: AM a -> AM (Either AgentErrorType a)
-tryAgentError = tryAllErrors mkInternal
-{-# INLINE tryAgentError #-}
-
-- unlike runExceptT, this ensures we catch IO exceptions as well
-tryAgentError' :: AM a -> AM' (Either AgentErrorType a)
-tryAgentError' = tryAllErrors' mkInternal
-{-# INLINE tryAgentError' #-}
-
-catchAgentError :: AM a -> (AgentErrorType -> AM a) -> AM a
-catchAgentError = catchAllErrors mkInternal
-{-# INLINE catchAgentError #-}
-
-catchAgentError' :: AM a -> (AgentErrorType -> AM' a) -> AM' a
-catchAgentError' = catchAllErrors' mkInternal
-{-# INLINE catchAgentError' #-}
-
-agentFinally :: AM a -> AM b -> AM a
-agentFinally = allFinally mkInternal
-{-# INLINE agentFinally #-}
-
-mkInternal :: SomeException -> AgentErrorType
-mkInternal = INTERNAL . show
-{-# INLINE mkInternal #-}
-
-data Worker = Worker
-  { workerId :: Int,
-    doWork :: TMVar (),
-    action :: TMVar (Maybe (Async ())),
-    restarts :: TVar RestartCount
-  }
-
-data RestartCount = RestartCount
-  { restartMinute :: Int64,
-    restartCount :: Int
-  }
-
-updateRestartCount :: SystemTime -> RestartCount -> RestartCount
-updateRestartCount t (RestartCount minute count) = do
-  let min' = systemSeconds t `div` 60
-   in RestartCount min' $ if minute == min' then count + 1 else 1
@@ -1,18 +1,10 @@
-module Simplex.Messaging.Agent.Lock
-  ( Lock,
-    createLock,
-    withLock,
-    withLock',
-    withGetLock,
-    withGetLocks,
-  )
-where
+{-# LANGUAGE NamedFieldPuns #-}
+
+module Simplex.Messaging.Agent.Lock where

 import Control.Monad (void)
-import Control.Monad.Except (ExceptT (..), runExceptT)
 import Control.Monad.IO.Unlift
 import Data.Functor (($>))
-import UnliftIO.Async (forConcurrently)
 import qualified UnliftIO.Exception as E
 import UnliftIO.STM

@@ -22,32 +14,15 @@ createLock :: STM Lock
 createLock = newEmptyTMVar
 {-# INLINE createLock #-}

-withLock :: MonadUnliftIO m => Lock -> String -> ExceptT e m a -> ExceptT e m a
-withLock lock name = ExceptT . withLock' lock name . runExceptT
-{-# INLINE withLock #-}
-
-withLock' :: MonadUnliftIO m => Lock -> String -> m a -> m a
-withLock' lock name =
+withLock :: MonadUnliftIO m => Lock -> String -> m a -> m a
+withLock lock name =
  E.bracket_
    (atomically $ putTMVar lock name)
    (void . atomically $ takeTMVar lock)

-withGetLock :: MonadUnliftIO m => (k -> STM Lock) -> k -> String -> m a -> m a
-withGetLock getLock key name a =
+withGetLock :: MonadUnliftIO m => STM Lock -> String -> m a -> m a
+withGetLock getLock name a =
  E.bracket
-    (atomically $ getPutLock getLock key name)
+    (atomically $ getLock >>= \l -> putTMVar l name $> l)
    (atomically . takeTMVar)
    (const a)
-
-withGetLocks :: MonadUnliftIO m => (k -> STM Lock) -> [k] -> String -> m a -> m a
-withGetLocks getLock keys name = E.bracket holdLocks releaseLocks . const
-  where
-    holdLocks = forConcurrently keys $ \key -> atomically $ getPutLock getLock key name
-    -- only this withGetLocks would be holding the locks,
-    -- so it's safe to combine all lock releases into one transaction
-    releaseLocks = atomically . mapM_ takeTMVar
-
-- getLock and putTMVar can be in one transaction on the assumption that getLock doesn't write in case the lock already exists,
-- and in case it is created and added to some shared resource (we use TMap) it also helps avoid contention for the newly created lock.
-getPutLock :: (k -> STM Lock) -> k -> String -> STM Lock
-getPutLock getLock key name = getLock key >>= \l -> putTMVar l name $> l
@@ -5,7 +5,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TupleSections #-}
-{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.Messaging.Agent.NtfSubSupervisor
  ( runNtfSupervisor,
@@ -18,6 +17,7 @@ module Simplex.Messaging.Agent.NtfSubSupervisor
  )
 where

+import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple (logError, logInfo)
 import Control.Monad
 import Control.Monad.Except
@@ -37,30 +37,32 @@ import Simplex.Messaging.Client.Agent ()
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Notifications.Protocol (NtfSubStatus (..), NtfTknStatus (..), SMPQueueNtf (..))
 import Simplex.Messaging.Notifications.Types
-import Simplex.Messaging.Protocol (NtfServer, SMPServer, sameSrvAddr)
+import Simplex.Messaging.Protocol (NtfServer, ProtocolServer, SMPServer, sameSrvAddr)
+import Simplex.Messaging.TMap (TMap)
+import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Util (diffToMicroseconds, threadDelay', tshow, unlessM)
 import System.Random (randomR)
 import UnliftIO
 import UnliftIO.Concurrent (forkIO, threadDelay)
 import qualified UnliftIO.Exception as E

-runNtfSupervisor :: AgentClient -> AM' ()
+runNtfSupervisor :: forall m. AgentMonad' m => AgentClient -> m ()
 runNtfSupervisor c = do
  ns <- asks ntfSupervisor
  forever $ do
    cmd@(connId, _) <- atomically . readTBQueue $ ntfSubQ ns
-    handleErr connId . agentOperationBracket c AONtfNetwork waitUntilActive $
+    handleError connId . agentOperationBracket c AONtfNetwork waitUntilActive $
      runExceptT (processNtfSub c cmd) >>= \case
        Left e -> notifyErr connId e
        Right _ -> return ()
  where
-    handleErr :: ConnId -> AM' () -> AM' ()
-    handleErr connId = E.handle $ \(e :: E.SomeException) -> do
+    handleError :: ConnId -> m () -> m ()
+    handleError connId = E.handle $ \(e :: E.SomeException) -> do
      logError $ "runNtfSupervisor error " <> tshow e
      notifyErr connId e
    notifyErr connId e = notifyInternalError c connId $ "runNtfSupervisor error " <> show e

-processNtfSub :: AgentClient -> (ConnId, NtfSupervisorCommand) -> AM ()
+processNtfSub :: forall m. AgentMonad m => AgentClient -> (ConnId, NtfSupervisorCommand) -> m ()
 processNtfSub c (connId, cmd) = do
  logInfo $ "processNtfSub - connId = " <> tshow connId <> " - cmd = " <> tshow cmd
  case cmd of
@@ -72,16 +74,16 @@ processNtfSub c (connId, cmd) = do
      logInfo $ "processNtfSub, NSCCreate - a = " <> tshow a
      case a of
        Nothing -> do
-          withTokenServer $ \ntfServer -> do
+          withNtfServer c $ \ntfServer -> do
            case clientNtfCreds of
              Just ClientNtfCreds {notifierId} -> do
                let newSub = newNtfSubscription connId smpServer (Just notifierId) ntfServer NASKey
                withStore c $ \db -> createNtfSubscription db newSub $ NtfSubNTFAction NSACreate
-                lift . void $ getNtfNTFWorker True c ntfServer
+                addNtfNTFWorker ntfServer
              Nothing -> do
                let newSub = newNtfSubscription connId smpServer Nothing ntfServer NASNew
                withStore c $ \db -> createNtfSubscription db newSub $ NtfSubSMPAction NSASmpKey
-                lift . void $ getNtfSMPWorker True c smpServer
+                addNtfSMPWorker smpServer
        (Just (sub@NtfSubscription {ntfSubStatus, ntfServer = subNtfServer, smpServer = smpServer', ntfQueueId}, action_)) -> do
          case (clientNtfCreds, ntfQueueId) of
            (Just ClientNtfCreds {notifierId}, Just ntfQueueId')
@@ -90,87 +92,96 @@ processNtfSub c (connId, cmd) = do
            (Nothing, Nothing) -> create
            _ -> rotate
          where
-            create :: AM ()
+            create :: m ()
            create = case action_ of
              -- action was set to NULL after worker internal error
              Nothing -> resetSubscription
              Just (action, _)
                -- subscription was marked for deletion / is being deleted
                | isDeleteNtfSubAction action -> do
-                    if ntfSubStatus == NASNew || ntfSubStatus == NASOff || ntfSubStatus == NASDeleted
-                      then resetSubscription
-                      else withTokenServer $ \ntfServer -> do
-                        withStore' c $ \db -> supervisorUpdateNtfSub db sub {ntfServer} (NtfSubNTFAction NSACreate)
-                        lift . void $ getNtfNTFWorker True c ntfServer
+                  if ntfSubStatus == NASNew || ntfSubStatus == NASOff || ntfSubStatus == NASDeleted
+                    then resetSubscription
+                    else withNtfServer c $ \ntfServer -> do
+                      withStore' c $ \db -> supervisorUpdateNtfSub db sub {ntfServer} (NtfSubNTFAction NSACreate)
+                      addNtfNTFWorker ntfServer
                | otherwise -> case action of
-                    NtfSubNTFAction _ -> lift . void $ getNtfNTFWorker True c subNtfServer
-                    NtfSubSMPAction _ -> lift . void $ getNtfSMPWorker True c smpServer
-            rotate :: AM ()
+                  NtfSubNTFAction _ -> addNtfNTFWorker subNtfServer
+                  NtfSubSMPAction _ -> addNtfSMPWorker smpServer
+            rotate :: m ()
            rotate = do
              withStore' c $ \db -> supervisorUpdateNtfSub db sub (NtfSubNTFAction NSARotate)
-              lift . void $ getNtfNTFWorker True c subNtfServer
-            resetSubscription :: AM ()
+              addNtfNTFWorker subNtfServer
+            resetSubscription :: m ()
            resetSubscription =
-              withTokenServer $ \ntfServer -> do
+              withNtfServer c $ \ntfServer -> do
                let sub' = sub {ntfQueueId = Nothing, ntfServer, ntfSubId = Nothing, ntfSubStatus = NASNew}
                withStore' c $ \db -> supervisorUpdateNtfSub db sub' (NtfSubSMPAction NSASmpKey)
-                lift . void $ getNtfSMPWorker True c smpServer
+                addNtfSMPWorker smpServer
    NSCDelete -> do
      sub_ <- withStore' c $ \db -> do
        supervisorUpdateNtfAction db connId (NtfSubNTFAction NSADelete)
        getNtfSubscription db connId
      logInfo $ "processNtfSub, NSCDelete - sub_ = " <> tshow sub_
      case sub_ of
-        (Just (NtfSubscription {ntfServer}, _)) -> lift . void $ getNtfNTFWorker True c ntfServer
+        (Just (NtfSubscription {ntfServer}, _)) -> addNtfNTFWorker ntfServer
        _ -> pure () -- err "NSCDelete - no subscription"
    NSCSmpDelete -> do
      withStore' c (`getPrimaryRcvQueue` connId) >>= \case
        Right rq@RcvQueue {server = smpServer} -> do
          logInfo $ "processNtfSub, NSCSmpDelete - rq = " <> tshow rq
          withStore' c $ \db -> supervisorUpdateNtfAction db connId (NtfSubSMPAction NSASmpDelete)
-          lift . void $ getNtfSMPWorker True c smpServer
+          addNtfSMPWorker smpServer
        _ -> notifyInternalError c connId "NSCSmpDelete - no rcv queue"
-    NSCNtfWorker ntfServer -> lift . void $ getNtfNTFWorker True c ntfServer
-    NSCNtfSMPWorker smpServer -> lift . void $ getNtfSMPWorker True c smpServer
+    NSCNtfWorker ntfServer -> addNtfNTFWorker ntfServer
+    NSCNtfSMPWorker smpServer -> addNtfSMPWorker smpServer
+  where
+    addNtfNTFWorker = addWorker ntfWorkers runNtfWorker
+    addNtfSMPWorker = addWorker ntfSMPWorkers runNtfSMPWorker
+    addWorker ::
+      (NtfSupervisor -> TMap (ProtocolServer s) (TMVar (), Async ())) ->
+      (AgentClient -> ProtocolServer s -> TMVar () -> m ()) ->
+      ProtocolServer s ->
+      m ()
+    addWorker wsSel runWorker srv = do
+      ws <- asks $ wsSel . ntfSupervisor
+      atomically (TM.lookup srv ws) >>= \case
+        Nothing -> do
+          doWork <- newTMVarIO ()
+          worker <- async $ runWorker c srv doWork `E.finally` atomically (TM.delete srv ws)
+          atomically $ TM.insert srv (doWork, worker) ws
+        Just (doWork, _) ->
+          void . atomically $ tryPutTMVar doWork ()

-getNtfNTFWorker :: Bool -> AgentClient -> NtfServer -> AM' Worker
-getNtfNTFWorker hasWork c server = do
-  ws <- asks $ ntfWorkers . ntfSupervisor
-  getAgentWorker "ntf_ntf" hasWork c server ws $ runNtfWorker c server
+withNtfServer :: AgentMonad' m => AgentClient -> (NtfServer -> m ()) -> m ()
+withNtfServer c action = getNtfServer c >>= mapM_ action

-getNtfSMPWorker :: Bool -> AgentClient -> SMPServer -> AM' Worker
-getNtfSMPWorker hasWork c server = do
-  ws <- asks $ ntfSMPWorkers . ntfSupervisor
-  getAgentWorker "ntf_smp" hasWork c server ws $ runNtfSMPWorker c server
-
-withTokenServer :: (NtfServer -> AM ()) -> AM ()
-withTokenServer action = lift getNtfToken >>= mapM_ (\NtfToken {ntfServer} -> action ntfServer)
-
-runNtfWorker :: AgentClient -> NtfServer -> Worker -> AM ()
-runNtfWorker c srv Worker {doWork} = do
+runNtfWorker :: forall m. AgentMonad m => AgentClient -> NtfServer -> TMVar () -> m ()
+runNtfWorker c srv doWork = do
  delay <- asks $ ntfWorkerDelay . config
  forever $ do
-    waitForWork doWork
-    ExceptT $ agentOperationBracket c AONtfNetwork throwWhenInactive $ runExceptT runNtfOperation
+    void . atomically $ readTMVar doWork
+    agentOperationBracket c AONtfNetwork throwWhenInactive runNtfOperation
    threadDelay delay
  where
-    runNtfOperation :: AM ()
-    runNtfOperation =
-      withWork c doWork (`getNextNtfSubNTFAction` srv) $
-        \nextSub@(NtfSubscription {connId}, _, _) -> do
-          logInfo $ "runNtfWorker, nextSub " <> tshow nextSub
+    runNtfOperation :: m ()
+    runNtfOperation = do
+      nextSub_ <- withStore' c (`getNextNtfSubNTFAction` srv)
+      logInfo $ "runNtfWorker, nextSub_ " <> tshow nextSub_
+      case nextSub_ of
+        Nothing -> noWorkToDo
+        Just a@(NtfSubscription {connId}, _, _) -> do
          ri <- asks $ reconnectInterval . config
-          withRetryInterval ri $ \_ loop -> do
-            lift $ waitForUserNetwork c
-            processSub nextSub
-              `catchAgentError` retryOnError c "NtfWorker" loop (workerInternalError c connId . show)
-    processSub :: (NtfSubscription, NtfSubNTFAction, NtfActionTs) -> AM ()
-    processSub (sub@NtfSubscription {connId, smpServer, ntfSubId}, action, actionTs) = do
+          withRetryInterval ri $ \_ loop ->
+            processAction a
+              `catchError` retryOnError c "NtfWorker" loop (workerInternalError c connId . show)
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    processAction :: (NtfSubscription, NtfSubNTFAction, NtfActionTs) -> m ()
+    processAction (sub@NtfSubscription {connId, smpServer, ntfSubId}, action, actionTs) = do
      ts <- liftIO getCurrentTime
-      unlessM (lift $ rescheduleAction doWork ts actionTs) $
+      unlessM (rescheduleAction doWork ts actionTs) $
        case action of
          NSACreate ->
-            lift getNtfToken >>= \case
+            getNtfToken >>= \case
              Just tkn@NtfToken {ntfTokenId = Just tknId, ntfTknStatus = NTActive, ntfMode = NMInstant} -> do
                RcvQueue {clientNtfCreds} <- withStore c (`getPrimaryRcvQueue` connId)
                case clientNtfCreds of
@@ -183,13 +194,13 @@ runNtfWorker c srv Worker {doWork} = do
                  _ -> workerInternalError c connId "NSACreate - no notifier queue credentials"
              _ -> workerInternalError c connId "NSACreate - no active token"
          NSACheck ->
-            lift getNtfToken >>= \case
+            getNtfToken >>= \case
              Just tkn ->
                case ntfSubId of
                  Just nSubId ->
                    agentNtfCheckSubscription c nSubId tkn >>= \case
                      NSAuth -> do
-                        lift (getNtfServer c) >>= \case
+                        getNtfServer c >>= \case
                          Just ntfServer -> do
                            withStore' c $ \db ->
                              updateNtfSubscription db sub {ntfServer, ntfQueueId = Nothing, ntfSubId = Nothing, ntfSubStatus = NASNew} (NtfSubSMPAction NSASmpKey) ts
@@ -201,8 +212,8 @@ runNtfWorker c srv Worker {doWork} = do
              _ -> workerInternalError c connId "NSACheck - no active token"
          NSADelete -> case ntfSubId of
            Just nSubId ->
-              (lift getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
-                `agentFinally` continueDeletion
+              (getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
+                `E.finally` continueDeletion
            _ -> continueDeletion
            where
              continueDeletion = do
@@ -212,8 +223,8 @@ runNtfWorker c srv Worker {doWork} = do
                atomically $ writeTBQueue (ntfSubQ ns) (connId, NSCNtfSMPWorker smpServer)
          NSARotate -> case ntfSubId of
            Just nSubId ->
-              (lift getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
-                `agentFinally` deleteCreate
+              (getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
+                `E.finally` deleteCreate
            _ -> deleteCreate
            where
              deleteCreate = do
@@ -229,38 +240,37 @@ runNtfWorker c srv Worker {doWork} = do
          withStore' c $ \db ->
            updateNtfSubscription db sub {ntfSubStatus = toStatus} toAction actionTs'

-runNtfSMPWorker :: AgentClient -> SMPServer -> Worker -> AM ()
-runNtfSMPWorker c srv Worker {doWork} = do
-  env <- ask
+runNtfSMPWorker :: forall m. AgentMonad m => AgentClient -> SMPServer -> TMVar () -> m ()
+runNtfSMPWorker c srv doWork = do
  delay <- asks $ ntfSMPWorkerDelay . config
  forever $ do
-    waitForWork doWork
-    ExceptT . liftIO . agentOperationBracket c AONtfNetwork throwWhenInactive $
-      runReaderT (runExceptT runNtfSMPOperation) env
+    void . atomically $ readTMVar doWork
+    agentOperationBracket c AONtfNetwork throwWhenInactive runNtfSMPOperation
    threadDelay delay
  where
-    runNtfSMPOperation =
-      withWork c doWork (`getNextNtfSubSMPAction` srv) $
-        \nextSub@(NtfSubscription {connId}, _, _) -> do
-          logInfo $ "runNtfSMPWorker, nextSub " <> tshow nextSub
+    runNtfSMPOperation = do
+      nextSub_ <- withStore' c (`getNextNtfSubSMPAction` srv)
+      logInfo $ "runNtfSMPWorker, nextSub_ " <> tshow nextSub_
+      case nextSub_ of
+        Nothing -> noWorkToDo
+        Just a@(NtfSubscription {connId}, _, _) -> do
          ri <- asks $ reconnectInterval . config
-          withRetryInterval ri $ \_ loop -> do
-            lift $ waitForUserNetwork c
-            processSub nextSub
-              `catchAgentError` retryOnError c "NtfSMPWorker" loop (workerInternalError c connId . show)
-    processSub :: (NtfSubscription, NtfSubSMPAction, NtfActionTs) -> AM ()
-    processSub (sub@NtfSubscription {connId, ntfServer}, smpAction, actionTs) = do
+          withRetryInterval ri $ \_ loop ->
+            processAction a
+              `catchError` retryOnError c "NtfSMPWorker" loop (workerInternalError c connId . show)
+    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    processAction :: (NtfSubscription, NtfSubSMPAction, NtfActionTs) -> m ()
+    processAction (sub@NtfSubscription {connId, ntfServer}, smpAction, actionTs) = do
      ts <- liftIO getCurrentTime
-      unlessM (lift $ rescheduleAction doWork ts actionTs) $
+      unlessM (rescheduleAction doWork ts actionTs) $
        case smpAction of
          NSASmpKey ->
-            lift getNtfToken >>= \case
+            getNtfToken >>= \case
              Just NtfToken {ntfTknStatus = NTActive, ntfMode = NMInstant} -> do
                rq <- withStore c (`getPrimaryRcvQueue` connId)
-                C.AuthAlg a <- asks (rcvAuthAlg . config)
-                g <- asks random
-                (ntfPublicKey, ntfPrivateKey) <- atomically $ C.generateAuthKeyPair a g
-                (rcvNtfPubDhKey, rcvNtfPrivDhKey) <- atomically $ C.generateKeyPair g
+                C.SignAlg a <- asks (cmdSignAlg . config)
+                (ntfPublicKey, ntfPrivateKey) <- liftIO $ C.generateSignatureKeyPair a
+                (rcvNtfPubDhKey, rcvNtfPrivDhKey) <- liftIO C.generateKeyPair'
                (notifierId, rcvNtfSrvPubDhKey) <- enableQueueNotifications c rq ntfPublicKey rcvNtfPubDhKey
                let rcvNtfDhSecret = C.dh' rcvNtfSrvPubDhKey rcvNtfPrivDhKey
                withStore' c $ \db -> do
@@ -276,17 +286,17 @@ runNtfSMPWorker c srv Worker {doWork} = do
            mapM_ (disableQueueNotifications c) rq_
            withStore' c $ \db -> deleteNtfSubscription db connId

-rescheduleAction :: TMVar () -> UTCTime -> UTCTime -> AM' Bool
+rescheduleAction :: AgentMonad' m => TMVar () -> UTCTime -> UTCTime -> m Bool
 rescheduleAction doWork ts actionTs
  | actionTs <= ts = pure False
  | otherwise = do
-      void . atomically $ tryTakeTMVar doWork
-      void . forkIO $ do
-        liftIO $ threadDelay' $ diffToMicroseconds $ diffUTCTime actionTs ts
-        atomically $ hasWorkToDo' doWork
-      pure True
+    void . atomically $ tryTakeTMVar doWork
+    void . forkIO $ do
+      liftIO $ threadDelay' $ diffToMicroseconds $ diffUTCTime actionTs ts
+      void . atomically $ tryPutTMVar doWork ()
+    pure True

-retryOnError :: AgentClient -> Text -> AM () -> (AgentErrorType -> AM ()) -> AgentErrorType -> AM ()
+retryOnError :: AgentMonad' m => AgentClient -> Text -> m () -> (AgentErrorType -> m ()) -> AgentErrorType -> m ()
 retryOnError c name loop done e = do
  logError $ name <> " error: " <> tshow e
  case e of
@@ -300,17 +310,16 @@ retryOnError c name loop done e = do
      atomically $ beginAgentOperation c AONtfNetwork
      loop

-workerInternalError :: AgentClient -> ConnId -> String -> AM ()
+workerInternalError :: AgentMonad m => AgentClient -> ConnId -> String -> m ()
 workerInternalError c connId internalErrStr = do
  withStore' c $ \db -> setNullNtfSubscriptionAction db connId
  notifyInternalError c connId internalErrStr

 -- TODO change error
-notifyInternalError :: MonadIO m => AgentClient -> ConnId -> String -> m ()
+notifyInternalError :: MonadUnliftIO m => AgentClient -> ConnId -> String -> m ()
 notifyInternalError AgentClient {subQ} connId internalErrStr = atomically $ writeTBQueue subQ ("", connId, APC SAEConn $ ERR $ INTERNAL internalErrStr)
-{-# INLINE notifyInternalError #-}

-getNtfToken :: AM' (Maybe NtfToken)
+getNtfToken :: AgentMonad' m => m (Maybe NtfToken)
 getNtfToken = do
  tkn <- asks $ ntfTkn . ntfSupervisor
  readTVarIO tkn
@@ -331,14 +340,17 @@ instantNotifications = \case
  Just NtfToken {ntfTknStatus = NTActive, ntfMode = NMInstant} -> True
  _ -> False

-closeNtfSupervisor :: NtfSupervisor -> IO ()
+closeNtfSupervisor :: MonadUnliftIO m => NtfSupervisor -> m ()
 closeNtfSupervisor ns = do
-  stopWorkers $ ntfWorkers ns
-  stopWorkers $ ntfSMPWorkers ns
-  where
-    stopWorkers workers = atomically (swapTVar workers M.empty) >>= mapM_ (liftIO . cancelWorker)
+  cancelNtfWorkers_ $ ntfWorkers ns
+  cancelNtfWorkers_ $ ntfSMPWorkers ns

-getNtfServer :: AgentClient -> AM' (Maybe NtfServer)
+cancelNtfWorkers_ :: MonadUnliftIO m => TMap (ProtocolServer s) (TMVar (), Async ()) -> m ()
+cancelNtfWorkers_ wsVar = do
+  ws <- atomically $ stateTVar wsVar (,M.empty)
+  mapM_ (uninterruptibleCancel . snd) ws
+
+getNtfServer :: AgentMonad' m => AgentClient -> m (Maybe NtfServer)
 getNtfServer c = do
  ntfServers <- readTVarIO $ ntfServers c
  case ntfServers of
@@ -1,5 +1,6 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}

 module Simplex.Messaging.Agent.RetryInterval
@@ -8,10 +9,8 @@ module Simplex.Messaging.Agent.RetryInterval
    RetryIntervalMode (..),
    RI2State (..),
    withRetryInterval,
-    withRetryIntervalCount,
    withRetryLock2,
    updateRetryInterval2,
-    nextRetryDelay,
  )
 where

@@ -50,18 +49,15 @@ data RetryIntervalMode = RISlow | RIFast
  deriving (Eq, Show)

 withRetryInterval :: forall m a. MonadIO m => RetryInterval -> (Int64 -> m a -> m a) -> m a
-withRetryInterval ri = withRetryIntervalCount ri . const
-
-withRetryIntervalCount :: forall m a. MonadIO m => RetryInterval -> (Int -> Int64 -> m a -> m a) -> m a
-withRetryIntervalCount ri action = callAction 0 0 $ initialInterval ri
+withRetryInterval ri action = callAction 0 $ initialInterval ri
  where
-    callAction :: Int -> Int64 -> Int64 -> m a
-    callAction n elapsed delay = action n delay loop
+    callAction :: Int64 -> Int64 -> m a
+    callAction elapsed delay = action delay loop
      where
        loop = do
          liftIO $ threadDelay' delay
          let elapsed' = elapsed + delay
-          callAction (n + 1) elapsed' $ nextRetryDelay elapsed' delay ri
+          callAction elapsed' $ nextDelay elapsed' delay ri

 -- This function allows action to toggle between slow and fast retry intervals.
 withRetryLock2 :: forall m. MonadIO m => RetryInterval2 -> TMVar () -> (RI2State -> (RetryIntervalMode -> m ()) -> m ()) -> m ()
@@ -77,7 +73,7 @@ withRetryLock2 RetryInterval2 {riSlow, riFast} lock action =
        run (elapsed, delay) ri call = do
          wait delay
          let elapsed' = elapsed + delay
-              delay' = nextRetryDelay elapsed' delay ri
+              delay' = nextDelay elapsed' delay ri
          call (elapsed', delay')
        wait delay = do
          waiting <- newTVarIO True
@@ -88,8 +84,8 @@ withRetryLock2 RetryInterval2 {riSlow, riFast} lock action =
            takeTMVar lock
            writeTVar waiting False

-nextRetryDelay :: Int64 -> Int64 -> RetryInterval -> Int64
-nextRetryDelay elapsed delay RetryInterval {increaseAfter, maxInterval} =
+nextDelay :: Int64 -> Int64 -> RetryInterval -> Int64
+nextDelay elapsed delay RetryInterval {increaseAfter, maxInterval} =
  if elapsed < increaseAfter || delay == maxInterval
    then delay
    else min (delay * 3 `div` 2) maxInterval
@@ -11,19 +11,19 @@ module Simplex.Messaging.Agent.Server
 where

 import Control.Logger.Simple (logInfo)
-import Control.Monad
+import Control.Monad.Except
+import Control.Monad.IO.Unlift (MonadUnliftIO)
 import Control.Monad.Reader
+import Crypto.Random (MonadRandom)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Text.Encoding (decodeUtf8)
-import Network.Socket (ServiceName)
 import Simplex.Messaging.Agent
-import Simplex.Messaging.Agent.Client (newAgentClient)
 import Simplex.Messaging.Agent.Env.SQLite
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.Store.SQLite (SQLiteStore)
 import Simplex.Messaging.Transport (ATransport (..), TProxy, Transport (..), simplexMQVersion)
-import Simplex.Messaging.Transport.Server (defaultTransportServerConfig, loadTLSServerParams, runTransportServer)
+import Simplex.Messaging.Transport.Server (loadTLSServerParams, runTransportServer)
 import Simplex.Messaging.Util (bshow)
 import UnliftIO.Async (race_)
 import qualified UnliftIO.Exception as E
@@ -32,54 +32,50 @@ import UnliftIO.STM
 -- | Runs an SMP agent as a TCP service using passed configuration.
 --
 -- See a full agent executable here: https://github.com/simplex-chat/simplexmq/blob/master/apps/smp-agent/Main.hs
-runSMPAgent :: ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> IO ()
+runSMPAgent :: (MonadRandom m, MonadUnliftIO m) => ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> m ()
 runSMPAgent t cfg initServers store =
-  runSMPAgentBlocking t cfg initServers store 0 =<< newEmptyTMVarIO
+  runSMPAgentBlocking t cfg initServers store =<< newEmptyTMVarIO

 -- | Runs an SMP agent as a TCP service using passed configuration with signalling.
 --
 -- This function uses passed TMVar to signal when the server is ready to accept TCP requests (True)
 -- and when it is disconnected from the TCP socket once the server thread is killed (False).
-runSMPAgentBlocking :: ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> Int -> TMVar Bool -> IO ()
-runSMPAgentBlocking (ATransport t) cfg@AgentConfig {tcpPort, caCertificateFile, certificateFile, privateKeyFile} initServers store initClientId started =
-  case tcpPort of
-    Just port -> newSMPAgentEnv cfg store >>= smpAgent t port
-    Nothing -> E.throwIO $ userError "no agent port"
+runSMPAgentBlocking :: (MonadRandom m, MonadUnliftIO m) => ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> TMVar Bool -> m ()
+runSMPAgentBlocking (ATransport t) cfg@AgentConfig {tcpPort, caCertificateFile, certificateFile, privateKeyFile} initServers store started = do
+  liftIO (newSMPAgentEnv cfg store) >>= runReaderT (smpAgent t)
  where
-    smpAgent :: forall c. Transport c => TProxy c -> ServiceName -> Env -> IO ()
-    smpAgent _ port env = do
+    smpAgent :: forall c m'. (Transport c, MonadUnliftIO m', MonadReader Env m') => TProxy c -> m' ()
+    smpAgent _ = do
      -- tlsServerParams is not in Env to avoid breaking functional API w/t key and certificate generation
-      tlsServerParams <- loadTLSServerParams caCertificateFile certificateFile privateKeyFile
-      clientId <- newTVarIO initClientId
-      runTransportServer started port tlsServerParams defaultTransportServerConfig $ \(h :: c) -> do
-        putLn h $ "Welcome to SMP agent v" <> B.pack simplexMQVersion
-        cId <- atomically $ stateTVar clientId $ \i -> (i + 1, i + 1)
-        c <- atomically $ newAgentClient cId initServers env
+      tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
+      runTransportServer started tcpPort tlsServerParams True $ \(h :: c) -> do
+        liftIO . putLn h $ "Welcome to SMP agent v" <> B.pack simplexMQVersion
+        c <- getAgentClient initServers
        logConnection c True
-        race_ (connectClient h c) (runAgentClient c `runReaderT` env)
-          `E.finally` (disconnectAgentClient c)
+        race_ (connectClient h c) (runAgentClient c)
+          `E.finally` disconnectAgentClient c

-connectClient :: Transport c => c -> AgentClient -> IO ()
+connectClient :: Transport c => MonadUnliftIO m => c -> AgentClient -> m ()
 connectClient h c = race_ (send h c) (receive h c)

-receive :: forall c. Transport c => c -> AgentClient -> IO ()
+receive :: forall c m. (Transport c, MonadUnliftIO m) => c -> AgentClient -> m ()
 receive h c@AgentClient {rcvQ, subQ} = forever $ do
  (corrId, entId, cmdOrErr) <- tGet SClient h
  case cmdOrErr of
    Right cmd -> write rcvQ (corrId, entId, cmd)
    Left e -> write subQ (corrId, entId, APC SAEConn $ ERR e)
  where
-    write :: TBQueue (ATransmission p) -> ATransmission p -> IO ()
+    write :: TBQueue (ATransmission p) -> ATransmission p -> m ()
    write q t = do
      logClient c "-->" t
      atomically $ writeTBQueue q t

-send :: Transport c => c -> AgentClient -> IO ()
+send :: (Transport c, MonadUnliftIO m) => c -> AgentClient -> m ()
 send h c@AgentClient {subQ} = forever $ do
  t <- atomically $ readTBQueue subQ
  tPut h t
  logClient c "<--" t

-logClient :: AgentClient -> ByteString -> ATransmission a -> IO ()
+logClient :: MonadUnliftIO m => AgentClient -> ByteString -> ATransmission a -> m ()
 logClient AgentClient {clientId} dir (corrId, connId, APC _ cmd) = do
  logInfo . decodeUtf8 $ B.unwords [bshow clientId, dir, "A :", corrId, connId, B.takeWhile (/= ' ') $ serializeCommand cmd]
@@ -1,9 +1,6 @@
-{-# LANGUAGE ConstraintKinds #-}
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE FlexibleContexts #-}
-{-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE LambdaCase #-}
@@ -24,58 +21,41 @@ import Data.Kind (Type)
 import Data.List (find)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
-import Data.Maybe (isJust)
 import Data.Time (UTCTime)
 import Data.Type.Equality
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval (RI2State)
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.Ratchet (RatchetX448, PQEncryption, PQSupport)
+import Simplex.Messaging.Crypto.Ratchet (RatchetX448)
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol
  ( MsgBody,
    MsgFlags,
    MsgId,
    NotifierId,
-    NtfPrivateAuthKey,
-    NtfPublicAuthKey,
+    NtfPrivateSignKey,
+    NtfPublicVerifyKey,
+    QueueId,
    RcvDhSecret,
    RcvNtfDhSecret,
-    RcvPrivateAuthKey,
-    SndPrivateAuthKey,
-    SndPublicAuthKey,
-    VersionSMPC,
+    RcvPrivateSignKey,
+    SndPrivateSignKey,
  )
 import qualified Simplex.Messaging.Protocol as SMP
 import Simplex.Messaging.Util ((<$?>))
+import Simplex.Messaging.Version

 -- * Queue types

-data QueueStored = QSStored | QSNew
-
-data SQueueStored (q :: QueueStored) where
-  SQSStored :: SQueueStored 'QSStored
-  SQSNew :: SQueueStored 'QSNew
-
-data DBQueueId (q :: QueueStored) where
-  DBQueueId :: Int64 -> DBQueueId 'QSStored
-  DBNewQueue :: DBQueueId 'QSNew
-
-deriving instance Show (DBQueueId q)
-
-type RcvQueue = StoredRcvQueue 'QSStored
-
-type NewRcvQueue = StoredRcvQueue 'QSNew
-
 -- | A receive queue. SMP queue through which the agent receives messages from a sender.
-data StoredRcvQueue (q :: QueueStored) = RcvQueue
+data RcvQueue = RcvQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
    -- | recipient queue ID
    rcvId :: SMP.RecipientId,
-    -- | key used by the recipient to authorize transmissions
-    rcvPrivateKey :: RcvPrivateAuthKey,
+    -- | key used by the recipient to sign transmissions
+    rcvPrivateKey :: RcvPrivateSignKey,
    -- | shared DH secret used to encrypt/decrypt message bodies from server to recipient
    rcvDhSecret :: RcvDhSecret,
    -- | private DH key related to public sent to sender out-of-band (to agree simple per-queue e2e)
@@ -86,96 +66,73 @@ data StoredRcvQueue (q :: QueueStored) = RcvQueue
    sndId :: SMP.SenderId,
    -- | queue status
    status :: QueueStatus,
-    -- | database queue ID (within connection)
-    dbQueueId :: DBQueueId q,
+    -- | database queue ID (within connection), can be Nothing for old queues
+    dbQueueId :: Int64,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | database queue ID to replace, Nothing if this queue is not replacing another, `Just Nothing` is used for replacing old queues
    dbReplaceQueueId :: Maybe Int64,
-    rcvSwchStatus :: Maybe RcvSwitchStatus,
    -- | SMP client version
-    smpClientVersion :: VersionSMPC,
+    smpClientVersion :: Version,
    -- | credentials used in context of notifications
    clientNtfCreds :: Maybe ClientNtfCreds,
    deleteErrors :: Int
  }
-  deriving (Show)
-
-rcvQueueInfo :: RcvQueue -> RcvQueueInfo
-rcvQueueInfo rq@RcvQueue {server, rcvSwchStatus} =
-  RcvQueueInfo {rcvServer = server, rcvSwitchStatus = rcvSwchStatus, canAbortSwitch = canAbortRcvSwitch rq}
-
-canAbortRcvSwitch :: RcvQueue -> Bool
-canAbortRcvSwitch = maybe False canAbort . rcvSwchStatus
-  where
-    canAbort = \case
-      RSSwitchStarted -> True
-      RSSendingQADD -> True
-      -- if switch is in RSSendingQUSE, a race condition with sender deleting the original queue is possible
-      RSSendingQUSE -> False
-      -- if switch is in RSReceivedMessage status, aborting switch (deleting new queue)
-      -- will break the connection because the sender would have original queue deleted
-      RSReceivedMessage -> False
+  deriving (Eq, Show)

 data ClientNtfCreds = ClientNtfCreds
-  { -- | key pair to be used by the notification server to authorize transmissions
-    ntfPublicKey :: NtfPublicAuthKey,
-    ntfPrivateKey :: NtfPrivateAuthKey,
+  { -- | key pair to be used by the notification server to sign transmissions
+    ntfPublicKey :: NtfPublicVerifyKey,
+    ntfPrivateKey :: NtfPrivateSignKey,
    -- | queue ID to be used by the notification server for NSUB command
    notifierId :: NotifierId,
    -- | shared DH secret used to encrypt/decrypt notification metadata (NMsgMeta) from server to recipient
    rcvNtfDhSecret :: RcvNtfDhSecret
  }
-  deriving (Show)
-
-type SndQueue = StoredSndQueue 'QSStored
-
-type NewSndQueue = StoredSndQueue 'QSNew
+  deriving (Eq, Show)

 -- | A send queue. SMP queue through which the agent sends messages to a recipient.
-data StoredSndQueue (q :: QueueStored) = SndQueue
+data SndQueue = SndQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
    -- | sender queue ID
    sndId :: SMP.SenderId,
-    -- | key pair used by the sender to authorize transmissions
-    -- TODO combine keys to key pair so that types match
-    sndPublicKey :: Maybe SndPublicAuthKey,
-    sndPrivateKey :: SndPrivateAuthKey,
+    -- | key pair used by the sender to sign transmissions
+    sndPublicKey :: Maybe C.APublicVerifyKey,
+    sndPrivateKey :: SndPrivateSignKey,
    -- | DH public key used to negotiate per-queue e2e encryption
    e2ePubKey :: Maybe C.PublicKeyX25519,
    -- | shared DH secret agreed for simple per-queue e2e encryption
    e2eDhSecret :: C.DhSecretX25519,
    -- | queue status
    status :: QueueStatus,
-    -- | database queue ID (within connection)
-    dbQueueId :: DBQueueId q,
+    -- | database queue ID (within connection), can be Nothing for old queues
+    dbQueueId :: Int64,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | ID of the queue this one is replacing
    dbReplaceQueueId :: Maybe Int64,
-    sndSwchStatus :: Maybe SndSwitchStatus,
    -- | SMP client version
-    smpClientVersion :: VersionSMPC
+    smpClientVersion :: Version
  }
-  deriving (Show)
-
-sndQueueInfo :: SndQueue -> SndQueueInfo
-sndQueueInfo SndQueue {server, sndSwchStatus} =
-  SndQueueInfo {sndServer = server, sndSwitchStatus = sndSwchStatus}
+  deriving (Eq, Show)

 instance SMPQueue RcvQueue where
  qServer RcvQueue {server} = server
  {-# INLINE qServer #-}
-  queueId RcvQueue {rcvId} = rcvId
-  {-# INLINE queueId #-}
+  qAddress RcvQueue {server, rcvId} = (server, rcvId)
+  {-# INLINE qAddress #-}
+  sameQueue addr q = sameQAddress addr (qAddress q)
+  {-# INLINE sameQueue #-}

 instance SMPQueue SndQueue where
  qServer SndQueue {server} = server
  {-# INLINE qServer #-}
-  queueId SndQueue {sndId} = sndId
-  {-# INLINE queueId #-}
+  qAddress SndQueue {server, sndId} = (server, sndId)
+  {-# INLINE qAddress #-}
+  sameQueue addr q = sameQAddress addr (qAddress q)
+  {-# INLINE sameQueue #-}

 findQ :: SMPQueue q => (SMPServer, SMP.QueueId) -> NonEmpty q -> Maybe q
 findQ = find . sameQueue
@@ -198,39 +155,26 @@ findRQ :: (SMPServer, SMP.SenderId) -> NonEmpty RcvQueue -> Maybe RcvQueue
 findRQ sAddr = find $ sameQAddress sAddr . sndAddress
 {-# INLINE findRQ #-}

-switchingRQ :: NonEmpty RcvQueue -> Maybe RcvQueue
-switchingRQ = find $ isJust . rcvSwchStatus
-{-# INLINE switchingRQ #-}
-
-updatedQs :: SMPQueueRec q => q -> NonEmpty q -> NonEmpty q
-updatedQs q = L.map $ \q' -> if dbQId q == dbQId q' then q else q'
-{-# INLINE updatedQs #-}
-
 class SMPQueue q => SMPQueueRec q where
  qUserId :: q -> UserId
  qConnId :: q -> ConnId
-  dbQId :: q -> Int64
-  dbReplaceQId :: q -> Maybe Int64
+  queueId :: q -> QueueId

 instance SMPQueueRec RcvQueue where
-  qUserId RcvQueue {userId} = userId
+  qUserId = userId
  {-# INLINE qUserId #-}
-  qConnId RcvQueue {connId} = connId
+  qConnId = connId
  {-# INLINE qConnId #-}
-  dbQId RcvQueue {dbQueueId = DBQueueId qId} = qId
-  {-# INLINE dbQId #-}
-  dbReplaceQId RcvQueue {dbReplaceQueueId} = dbReplaceQueueId
-  {-# INLINE dbReplaceQId #-}
+  queueId = rcvId
+  {-# INLINE queueId #-}

 instance SMPQueueRec SndQueue where
-  qUserId SndQueue {userId} = userId
+  qUserId = userId
  {-# INLINE qUserId #-}
-  qConnId SndQueue {connId} = connId
+  qConnId = connId
  {-# INLINE qConnId #-}
-  dbQId SndQueue {dbQueueId = DBQueueId qId} = qId
-  {-# INLINE dbQId #-}
-  dbReplaceQId SndQueue {dbReplaceQueueId} = dbReplaceQueueId
-  {-# INLINE dbReplaceQId #-}
+  queueId = sndId
+  {-# INLINE queueId #-}

 -- * Connection types

@@ -254,24 +198,18 @@ data Connection (d :: ConnType) where
  DuplexConnection :: ConnData -> NonEmpty RcvQueue -> NonEmpty SndQueue -> Connection CDuplex
  ContactConnection :: ConnData -> RcvQueue -> Connection CContact

+deriving instance Eq (Connection d)
+
 deriving instance Show (Connection d)

-toConnData :: Connection d -> ConnData
-toConnData = \case
+connData :: Connection d -> ConnData
+connData = \case
  NewConnection cData -> cData
  RcvConnection cData _ -> cData
  SndConnection cData _ -> cData
  DuplexConnection cData _ _ -> cData
  ContactConnection cData _ -> cData

-updateConnection :: ConnData -> Connection d -> Connection d
-updateConnection cData = \case
-  NewConnection _ -> NewConnection cData
-  RcvConnection _ rq -> RcvConnection cData rq
-  SndConnection _ sq -> SndConnection cData sq
-  DuplexConnection _ rqs sqs -> DuplexConnection cData rqs sqs
-  ContactConnection _ rq -> ContactConnection cData rq
-
 data SConnType :: ConnType -> Type where
  SCNew :: SConnType CNew
  SCRcv :: SConnType CRcv
@@ -286,6 +224,8 @@ connType SCSnd = CSnd
 connType SCDuplex = CDuplex
 connType SCContact = CContact

+deriving instance Eq (SConnType d)
+
 deriving instance Show (SConnType d)

 instance TestEquality SConnType where
@@ -299,33 +239,25 @@ instance TestEquality SConnType where
 -- Used to refer to an arbitrary connection when retrieving from store.
 data SomeConn = forall d. SomeConn (SConnType d) (Connection d)

+instance Eq SomeConn where
+  SomeConn d c == SomeConn d' c' = case testEquality d d' of
+    Just Refl -> c == c'
+    _ -> False
+
 deriving instance Show SomeConn

 data ConnData = ConnData
  { connId :: ConnId,
    userId :: UserId,
-    connAgentVersion :: VersionSMPA,
+    connAgentVersion :: Version,
    enableNtfs :: Bool,
-    lastExternalSndId :: PrevExternalSndId,
-    deleted :: Bool,
-    ratchetSyncState :: RatchetSyncState,
-    pqSupport :: PQSupport
+    duplexHandshake :: Maybe Bool, -- added in agent protocol v2
+    deleted :: Bool
  }
  deriving (Eq, Show)

-- this function should be mirrored in the clients
-ratchetSyncAllowed :: ConnData -> Bool
-ratchetSyncAllowed ConnData {ratchetSyncState, connAgentVersion} =
-  connAgentVersion >= ratchetSyncSMPAgentVersion && (ratchetSyncState `elem` ([RSAllowed, RSRequired] :: [RatchetSyncState]))
-
-- this function should be mirrored in the clients
-ratchetSyncSendProhibited :: ConnData -> Bool
-ratchetSyncSendProhibited ConnData {ratchetSyncState} =
-  ratchetSyncState `elem` ([RSRequired, RSStarted, RSAgreed] :: [RatchetSyncState])
-
 data PendingCommand = PendingCommand
-  { cmdId :: AsyncCmdId,
-    corrId :: ACorrId,
+  { corrId :: ACorrId,
    userId :: UserId,
    connId :: ConnId,
    command :: AgentCommand
@@ -373,11 +305,10 @@ instance StrEncoding AgentCommandTag where
 data InternalCommand
  = ICAck SMP.RecipientId MsgId
  | ICAckDel SMP.RecipientId MsgId InternalId
-  | ICAllowSecure SMP.RecipientId SMP.SndPublicAuthKey
-  | ICDuplexSecure SMP.RecipientId SMP.SndPublicAuthKey
+  | ICAllowSecure SMP.RecipientId SMP.SndPublicVerifyKey
+  | ICDuplexSecure SMP.RecipientId SMP.SndPublicVerifyKey
  | ICDeleteConn
-  | ICDeleteRcvQueue SMP.RecipientId
-  | ICQSecure SMP.RecipientId SMP.SndPublicAuthKey
+  | ICQSecure SMP.RecipientId SMP.SndPublicVerifyKey
  | ICQDelete SMP.RecipientId

 data InternalCommandTag
@@ -386,7 +317,6 @@ data InternalCommandTag
  | ICAllowSecure_
  | ICDuplexSecure_
  | ICDeleteConn_
-  | ICDeleteRcvQueue_
  | ICQSecure_
  | ICQDelete_
  deriving (Show)
@@ -398,7 +328,6 @@ instance StrEncoding InternalCommand where
    ICAllowSecure rId sndKey -> strEncode (ICAllowSecure_, rId, sndKey)
    ICDuplexSecure rId sndKey -> strEncode (ICDuplexSecure_, rId, sndKey)
    ICDeleteConn -> strEncode ICDeleteConn_
-    ICDeleteRcvQueue rId -> strEncode (ICDeleteRcvQueue_, rId)
    ICQSecure rId senderKey -> strEncode (ICQSecure_, rId, senderKey)
    ICQDelete rId -> strEncode (ICQDelete_, rId)
  strP =
@@ -408,7 +337,6 @@ instance StrEncoding InternalCommand where
      ICAllowSecure_ -> ICAllowSecure <$> _strP <*> _strP
      ICDuplexSecure_ -> ICDuplexSecure <$> _strP <*> _strP
      ICDeleteConn_ -> pure ICDeleteConn
-      ICDeleteRcvQueue_ -> ICDeleteRcvQueue <$> _strP
      ICQSecure_ -> ICQSecure <$> _strP <*> _strP
      ICQDelete_ -> ICQDelete <$> _strP

@@ -419,7 +347,6 @@ instance StrEncoding InternalCommandTag where
    ICAllowSecure_ -> "ALLOW_SECURE"
    ICDuplexSecure_ -> "DUPLEX_SECURE"
    ICDeleteConn_ -> "DELETE_CONN"
-    ICDeleteRcvQueue_ -> "DELETE_RCV_QUEUE"
    ICQSecure_ -> "QSECURE"
    ICQDelete_ -> "QDELETE"
  strP =
@@ -429,7 +356,6 @@ instance StrEncoding InternalCommandTag where
      "ALLOW_SECURE" -> pure ICAllowSecure_
      "DUPLEX_SECURE" -> pure ICDuplexSecure_
      "DELETE_CONN" -> pure ICDeleteConn_
-      "DELETE_RCV_QUEUE" -> pure ICDeleteRcvQueue_
      "QSECURE" -> pure ICQSecure_
      "QDELETE" -> pure ICQDelete_
      _ -> fail "bad InternalCommandTag"
@@ -446,7 +372,6 @@ internalCmdTag = \case
  ICAllowSecure {} -> ICAllowSecure_
  ICDuplexSecure {} -> ICDuplexSecure_
  ICDeleteConn -> ICDeleteConn_
-  ICDeleteRcvQueue {} -> ICDeleteRcvQueue_
  ICQSecure {} -> ICQSecure_
  ICQDelete _ -> ICQDelete_

@@ -510,10 +435,7 @@ data RcvMsgData = RcvMsgData
 data RcvMsg = RcvMsg
  { internalId :: InternalId,
    msgMeta :: MsgMeta,
-    msgType :: AgentMessageType,
    msgBody :: MsgBody,
-    internalHash :: MsgHash,
-    msgReceipt :: Maybe MsgReceipt, -- if this message is a delivery receipt
    userAck :: Bool
  }

@@ -524,25 +446,15 @@ data SndMsgData = SndMsgData
    msgType :: AgentMessageType,
    msgFlags :: MsgFlags,
    msgBody :: MsgBody,
-    pqEncryption :: PQEncryption,
    internalHash :: MsgHash,
    prevMsgHash :: MsgHash
  }

-data SndMsg = SndMsg
-  { internalId :: InternalId,
-    internalSndId :: InternalSndId,
-    msgType :: AgentMessageType,
-    internalHash :: MsgHash,
-    msgReceipt :: Maybe MsgReceipt
-  }
-
 data PendingMsgData = PendingMsgData
  { msgId :: InternalId,
    msgType :: AgentMessageType,
    msgFlags :: MsgFlags,
    msgBody :: MsgBody,
-    pqEncryption :: PQEncryption,
    msgRetryState :: Maybe RI2State,
    internalTs :: InternalTs
  }
@@ -603,8 +515,6 @@ data StoreError
    SEServerNotFound
  | -- | Connection already used.
    SEConnDuplicate
-  | -- | Confirmed snd queue already exists.
-    SESndQueueExists
  | -- | Wrong connection type, e.g. "send" connection when "receive" or "duplex" is expected, or vice versa.
    -- 'upgradeRcvConnToDuplex' and 'upgradeSndConnToDuplex' do not allow duplex connections - they would also return this error.
    SEBadConnType ConnType
@@ -632,6 +542,4 @@ data StoreError
    SEFileNotFound
  | -- | XFTP Deleted snd chunk replica not found.
    SEDeletedSndChunkReplicaNotFound
-  | -- | Error when reading work item that suspends worker - do not use!
-    SEWorkItemError ByteString
  deriving (Eq, Show, Exception)
@@ -1,79 +0,0 @@
-{-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Common
-  ( SQLiteStore (..),
-    withConnection,
-    withConnection',
-    withTransaction,
-    withTransaction',
-    withTransactionCtx,
-    dbBusyLoop,
-    storeKey,
-  )
-where
-
-import Control.Concurrent (threadDelay)
-import Data.ByteArray (ScrubbedBytes)
-import qualified Data.ByteArray as BA
-import Data.Time.Clock (diffUTCTime, getCurrentTime)
-import Database.SQLite.Simple (SQLError)
-import qualified Database.SQLite.Simple as SQL
-import qualified Simplex.Messaging.Agent.Store.SQLite.DB as DB
-import Simplex.Messaging.Util (diffToMilliseconds)
-import UnliftIO.Exception (bracket)
-import qualified UnliftIO.Exception as E
-import UnliftIO.STM
-
-storeKey :: ScrubbedBytes -> Bool -> Maybe ScrubbedBytes
-storeKey key keepKey = if keepKey || BA.null key then Just key else Nothing
-
-data SQLiteStore = SQLiteStore
-  { dbFilePath :: FilePath,
-    dbKey :: TVar (Maybe ScrubbedBytes),
-    dbConnection :: TMVar DB.Connection,
-    dbClosed :: TVar Bool,
-    dbNew :: Bool
-  }
-
-withConnection :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
-withConnection SQLiteStore {dbConnection} =
-  bracket
-    (atomically $ takeTMVar dbConnection)
-    (atomically . putTMVar dbConnection)
-
-withConnection' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
-withConnection' st action = withConnection st $ action . DB.conn
-
-withTransaction :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
-withTransaction = withTransactionCtx Nothing
-
-withTransaction' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
-withTransaction' st action = withTransaction st $ action . DB.conn
-
-withTransactionCtx :: Maybe String -> SQLiteStore -> (DB.Connection -> IO a) -> IO a
-withTransactionCtx ctx_ st action = withConnection st $ dbBusyLoop . transactionWithCtx
-  where
-    transactionWithCtx db@DB.Connection {conn} = case ctx_ of
-      Nothing -> SQL.withImmediateTransaction conn $ action db
-      Just ctx -> do
-        t1 <- getCurrentTime
-        r <- SQL.withImmediateTransaction conn $ action db
-        t2 <- getCurrentTime
-        putStrLn $ "withTransactionCtx start :: " <> show t1 <> " :: " <> ctx
-        putStrLn $ "withTransactionCtx end   :: " <> show t2 <> " :: " <> ctx <> " :: duration=" <> show (diffToMilliseconds $ diffUTCTime t2 t1)
-        pure r
-
-dbBusyLoop :: forall a. IO a -> IO a
-dbBusyLoop action = loop 500 3000000
-  where
-    loop :: Int -> Int -> IO a
-    loop t tLim =
-      action `E.catch` \(e :: SQLError) ->
-        let se = SQL.sqlError e in
-        if tLim > t && (se == SQL.ErrorBusy || se == SQL.ErrorLocked)
-          then do
-            threadDelay t
-            loop (t * 9 `div` 8) (tLim - t)
-          else E.throwIO e
@@ -1,101 +0,0 @@
-{-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE StrictData #-}
-{-# LANGUAGE TemplateHaskell #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.DB
-  ( Connection (..),
-    SlowQueryStats (..),
-    open,
-    close,
-    execute,
-    execute_,
-    executeNamed,
-    executeMany,
-    query,
-    query_,
-    queryNamed,
-  )
-where
-
-import Control.Concurrent.STM
-import Control.Monad (when)
-import qualified Data.Aeson.TH as J
-import Data.Int (Int64)
-import Data.Time (diffUTCTime, getCurrentTime)
-import Database.SQLite.Simple (FromRow, NamedParam, Query, ToRow)
-import qualified Database.SQLite.Simple as SQL
-import Simplex.Messaging.Parsers (defaultJSON)
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (diffToMilliseconds)
-
-data Connection = Connection
-  { conn :: SQL.Connection,
-    slow :: TMap Query SlowQueryStats
-  }
-
-data SlowQueryStats = SlowQueryStats
-  { count :: Int64,
-    timeMax :: Int64,
-    timeAvg :: Int64
-  }
-  deriving (Show)
-
-timeIt :: TMap Query SlowQueryStats -> Query -> IO a -> IO a
-timeIt slow sql a = do
-  t <- getCurrentTime
-  r <- a
-  t' <- getCurrentTime
-  let diff = diffToMilliseconds $ diffUTCTime t' t
-  atomically $ when (diff > 5) $ TM.alter (updateQueryStats diff) sql slow
-  pure r
-  where
-    updateQueryStats :: Int64 -> Maybe SlowQueryStats -> Maybe SlowQueryStats
-    updateQueryStats diff Nothing = Just $ SlowQueryStats 1 diff diff
-    updateQueryStats diff (Just SlowQueryStats {count, timeMax, timeAvg}) =
-      Just $
-        SlowQueryStats
-          { count = count + 1,
-            timeMax = max timeMax diff,
-            timeAvg = (timeAvg * count + diff) `div` (count + 1)
-          }
-
-open :: String -> IO Connection
-open f = do
-  conn <- SQL.open f
-  slow <- atomically $ TM.empty
-  pure Connection {conn, slow}
-
-close :: Connection -> IO ()
-close = SQL.close . conn
-
-execute :: ToRow q => Connection -> Query -> q -> IO ()
-execute Connection {conn, slow} sql = timeIt slow sql . SQL.execute conn sql
-{-# INLINE execute #-}
-
-execute_ :: Connection -> Query -> IO ()
-execute_ Connection {conn, slow} sql = timeIt slow sql $ SQL.execute_ conn sql
-{-# INLINE execute_ #-}
-
-executeNamed :: Connection -> Query -> [NamedParam] -> IO ()
-executeNamed Connection {conn, slow} sql = timeIt slow sql . SQL.executeNamed conn sql
-{-# INLINE executeNamed #-}
-
-executeMany :: ToRow q => Connection -> Query -> [q] -> IO ()
-executeMany Connection {conn, slow} sql = timeIt slow sql . SQL.executeMany conn sql
-{-# INLINE executeMany #-}
-
-query :: (ToRow q, FromRow r) => Connection -> Query -> q -> IO [r]
-query Connection {conn, slow} sql = timeIt slow sql . SQL.query conn sql
-{-# INLINE query #-}
-
-query_ :: FromRow r => Connection -> Query -> IO [r]
-query_ Connection {conn, slow} sql = timeIt slow sql $ SQL.query_ conn sql
-{-# INLINE query_ #-}
-
-queryNamed :: FromRow r => Connection -> Query -> [NamedParam] -> IO [r]
-queryNamed Connection {conn, slow} sql = timeIt slow sql . SQL.queryNamed conn sql
-{-# INLINE queryNamed #-}
-
-$(J.deriveJSON defaultJSON ''SlowQueryStats)
@@ -1,3 +1,4 @@
+{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedLists #-}
@@ -26,7 +27,8 @@ module Simplex.Messaging.Agent.Store.SQLite.Migrations
 where

 import Control.Monad (forM_, when)
-import qualified Data.Aeson.TH as J
+import Data.Aeson (ToJSON)
+import qualified Data.Aeson as J
 import Data.List (intercalate, sortOn)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.Map as M
@@ -38,8 +40,8 @@ import Database.SQLite.Simple (Connection, Only (..), Query (..))
 import qualified Database.SQLite.Simple as DB
 import Database.SQLite.Simple.QQ (sql)
 import qualified Database.SQLite3 as SQLite3
+import GHC.Generics (Generic)
 import Simplex.Messaging.Agent.Protocol (extraSMPServerHosts)
-import Simplex.Messaging.Agent.Store.SQLite.Common
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
@@ -58,19 +60,6 @@ import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230320_retry_state
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (dropPrefix, sumTypeJSON)
 import Simplex.Messaging.Transport.Client (TransportHost)
@@ -97,20 +86,7 @@ schemaMigrations =
    ("m20230320_retry_state", m20230320_retry_state, Just down_m20230320_retry_state),
    ("m20230401_snd_files", m20230401_snd_files, Just down_m20230401_snd_files),
    ("m20230510_files_pending_replicas_indexes", m20230510_files_pending_replicas_indexes, Just down_m20230510_files_pending_replicas_indexes),
-    ("m20230516_encrypted_rcv_message_hashes", m20230516_encrypted_rcv_message_hashes, Just down_m20230516_encrypted_rcv_message_hashes),
-    ("m20230531_switch_status", m20230531_switch_status, Just down_m20230531_switch_status),
-    ("m20230615_ratchet_sync", m20230615_ratchet_sync, Just down_m20230615_ratchet_sync),
-    ("m20230701_delivery_receipts", m20230701_delivery_receipts, Just down_m20230701_delivery_receipts),
-    ("m20230720_delete_expired_messages", m20230720_delete_expired_messages, Just down_m20230720_delete_expired_messages),
-    ("m20230722_indexes", m20230722_indexes, Just down_m20230722_indexes),
-    ("m20230814_indexes", m20230814_indexes, Just down_m20230814_indexes),
-    ("m20230829_crypto_files", m20230829_crypto_files, Just down_m20230829_crypto_files),
-    ("m20231222_command_created_at", m20231222_command_created_at, Just down_m20231222_command_created_at),
-    ("m20231225_failed_work_items", m20231225_failed_work_items, Just down_m20231225_failed_work_items),
-    ("m20240121_message_delivery_indexes", m20240121_message_delivery_indexes, Just down_m20240121_message_delivery_indexes),
-    ("m20240124_file_redirect", m20240124_file_redirect, Just down_m20240124_file_redirect),
-    ("m20240223_connections_wait_delivery", m20240223_connections_wait_delivery, Just down_m20240223_connections_wait_delivery),
-    ("m20240225_ratchet_kem", m20240225_ratchet_kem, Just down_m20240225_ratchet_kem)
+    ("m20230516_encrypted_rcv_message_hashes", m20230516_encrypted_rcv_message_hashes, Just down_m20230516_encrypted_rcv_message_hashes)
  ]

 -- | The list of migrations in ascending order by date
@@ -119,45 +95,44 @@ app = sortOn name $ map migration schemaMigrations
  where
    migration (name, up, down) = Migration {name, up = fromQuery up, down = fromQuery <$> down}

-get :: SQLiteStore -> [Migration] -> IO (Either MTRError MigrationsToRun)
-get st migrations = migrationsToRun migrations <$> withTransaction' st getCurrent
+get :: Connection -> [Migration] -> IO (Either MTRError MigrationsToRun)
+get db migrations = migrationsToRun migrations <$> getCurrent db

 getCurrent :: Connection -> IO [Migration]
 getCurrent db = map toMigration <$> DB.query_ db "SELECT name, down FROM migrations ORDER BY name ASC;"
  where
    toMigration (name, down) = Migration {name, up = "", down}

-run :: SQLiteStore -> MigrationsToRun -> IO ()
-run st = \case
+run :: Connection -> MigrationsToRun -> IO ()
+run db = \case
  MTRUp [] -> pure ()
-  MTRUp ms -> mapM_ runUp ms >> withConnection' st (`execSQL` "VACUUM;")
+  MTRUp ms -> mapM_ runUp ms >> execSQL "VACUUM;"
  MTRDown ms -> mapM_ runDown $ reverse ms
  MTRNone -> pure ()
  where
-    runUp Migration {name, up, down} = withTransaction' st $ \db -> do
-      when (name == "m20220811_onion_hosts") $ updateServers db
-      insert db >> execSQL db up'
+    runUp Migration {name, up, down} = do
+      when (name == "m20220811_onion_hosts") updateServers
+      DB.withImmediateTransaction db $ insert >> execSQL up
      where
-        insert db = DB.execute db "INSERT INTO migrations (name, down, ts) VALUES (?,?,?)" . (name,down,) =<< getCurrentTime
-        up'
-          | dbNew st && name == "m20230110_users" = fromQuery new_m20230110_users
-          | otherwise = up
-        updateServers db = forM_ (M.assocs extraSMPServerHosts) $ \(h, h') ->
-          let hs = decodeLatin1 . strEncode $ ([h, h'] :: NonEmpty TransportHost)
-           in DB.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
-    runDown DownMigration {downName, downQuery} = withTransaction' st $ \db -> do
-      execSQL db downQuery
-      DB.execute db "DELETE FROM migrations WHERE name = ?" (Only downName)
-    execSQL db = SQLite3.exec $ DB.connectionHandle db
+        insert = DB.execute db "INSERT INTO migrations (name, down, ts) VALUES (?,?,?)" . (name,down,) =<< getCurrentTime
+        updateServers = forM_ (M.assocs extraSMPServerHosts) $ \(h, h') ->
+          DB.withImmediateTransaction db $
+            let hs = decodeLatin1 . strEncode $ ([h, h'] :: NonEmpty TransportHost)
+             in DB.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
+    runDown DownMigration {downName, downQuery} = do
+      DB.withImmediateTransaction db $ do
+        execSQL downQuery
+        DB.execute db "DELETE FROM migrations WHERE name = ?" (Only downName)
+    execSQL = SQLite3.exec $ DB.connectionHandle db

-initialize :: SQLiteStore -> IO ()
-initialize st = withTransaction' st $ \db -> do
+initialize :: Connection -> IO ()
+initialize db = do
  cs :: [Text] <- map fromOnly <$> DB.query_ db "SELECT name FROM pragma_table_info('migrations')"
  case cs of
-    [] -> createMigrations db
+    [] -> createMigrations
    _ -> when ("down" `notElem` cs) $ DB.execute_ db "ALTER TABLE migrations ADD COLUMN down TEXT"
  where
-    createMigrations db =
+    createMigrations =
      DB.execute_
        db
        [sql|
@@ -181,7 +156,11 @@ data MigrationsToRun = MTRUp [Migration] | MTRDown [DownMigration] | MTRNone
 data MTRError
  = MTRENoDown {dbMigrations :: [String]}
  | MTREDifferent {appMigration :: String, dbMigration :: String}
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic)
+
+instance ToJSON MTRError where
+  toJSON = J.genericToJSON . sumTypeJSON $ dropPrefix "MTRE"
+  toEncoding = J.genericToEncoding . sumTypeJSON $ dropPrefix "MTRE"

 mtrErrorDescription :: MTRError -> String
 mtrErrorDescription = \case
@@ -200,5 +179,3 @@ migrationsToRun [] dbMs
 migrationsToRun (a : as) (d : ds)
  | name a == name d = migrationsToRun as ds
  | otherwise = Left $ MTREDifferent (name a) (name d)
-
-$(J.deriveJSON (sumTypeJSON $ dropPrefix "MTRE") ''MTRError)
@@ -27,24 +27,3 @@ UPDATE connections SET user_id = 1;

 PRAGMA ignore_check_constraints=OFF;
 |]
-
-- This is executed in the new database
-- It does not create new user record
-new_m20230110_users :: Query
-new_m20230110_users =
-  [sql|
-PRAGMA ignore_check_constraints=ON;
-
-CREATE TABLE users (
-  user_id INTEGER PRIMARY KEY AUTOINCREMENT
-);
-
-ALTER TABLE connections ADD COLUMN user_id INTEGER CHECK (user_id NOT NULL)
-REFERENCES users ON DELETE CASCADE;
-
-CREATE INDEX idx_connections_user ON connections(user_id);
-
-CREATE INDEX idx_commands_conn_id ON commands(conn_id);
-
-PRAGMA ignore_check_constraints=OFF;
-|]
@@ -1,22 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230531_switch_status :: Query
-m20230531_switch_status =
-  [sql|
-ALTER TABLE rcv_queues ADD COLUMN switch_status TEXT;
-ALTER TABLE rcv_queues ADD COLUMN deleted INTEGER NOT NULL DEFAULT 0;
-ALTER TABLE snd_queues ADD COLUMN switch_status TEXT;
-|]
-
-down_m20230531_switch_status :: Query
-down_m20230531_switch_status =
-  [sql|
-ALTER TABLE snd_queues DROP COLUMN switch_status;
-ALTER TABLE rcv_queues DROP COLUMN deleted;
-ALTER TABLE rcv_queues DROP COLUMN switch_status;
-|]
@@ -1,41 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-- Ratchet public keys are saved when ratchet re-synchronization is started - upon receiving other party's public keys,
-- keys are compared to determine ratchet initialization ordering for both parties.
-- This solves a possible race when both parties start ratchet re-synchronization at the same time.
-m20230615_ratchet_sync :: Query
-m20230615_ratchet_sync =
-  [sql|
-ALTER TABLE connections ADD COLUMN ratchet_sync_state TEXT NOT NULL DEFAULT 'ok';
-
-ALTER TABLE ratchets ADD COLUMN x3dh_pub_key_1 BLOB;
-ALTER TABLE ratchets ADD COLUMN x3dh_pub_key_2 BLOB;
-
-CREATE TABLE processed_ratchet_key_hashes(
-  processed_ratchet_key_hash_id INTEGER PRIMARY KEY,
-  conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
-  hash BLOB NOT NULL,
-  created_at TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX idx_processed_ratchet_key_hashes_hash ON processed_ratchet_key_hashes(conn_id, hash);
-|]
-
-down_m20230615_ratchet_sync :: Query
-down_m20230615_ratchet_sync =
-  [sql|
-DROP INDEX idx_processed_ratchet_key_hashes_hash;
-
-DROP TABLE processed_ratchet_key_hashes;
-
-ALTER TABLE ratchets DROP COLUMN x3dh_pub_key_2;
-ALTER TABLE ratchets DROP COLUMN x3dh_pub_key_1;
-
-ALTER TABLE connections DROP COLUMN ratchet_sync_state;
-|]
@@ -1,24 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230701_delivery_receipts :: Query
-m20230701_delivery_receipts =
-  [sql|
-ALTER TABLE snd_messages ADD COLUMN rcpt_internal_id INTEGER;
-ALTER TABLE snd_messages ADD COLUMN rcpt_status TEXT;
-
-CREATE INDEX idx_snd_messages_rcpt_internal_id ON snd_messages(conn_id, rcpt_internal_id);
-|]
-
-down_m20230701_delivery_receipts :: Query
-down_m20230701_delivery_receipts =
-  [sql|
-DROP INDEX idx_snd_messages_rcpt_internal_id;
-
-ALTER TABLE snd_messages DROP COLUMN rcpt_internal_id;
-ALTER TABLE snd_messages DROP COLUMN rcpt_status;
-|]
@@ -1,20 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230720_delete_expired_messages :: Query
-m20230720_delete_expired_messages =
-  [sql|
-CREATE INDEX idx_messages_internal_snd_id_ts ON messages(internal_snd_id, internal_ts);
-
-DELETE FROM messages WHERE internal_snd_id IS NOT NULL AND internal_ts < datetime('now', '-3 days');
-|]
-
-down_m20230720_delete_expired_messages :: Query
-down_m20230720_delete_expired_messages =
-  [sql|
-DROP INDEX idx_messages_internal_snd_id_ts;
-|]
@@ -1,20 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230722_indexes :: Query
-m20230722_indexes =
-  [sql|
-CREATE INDEX idx_processed_ratchet_key_hashes_created_at ON processed_ratchet_key_hashes(created_at);
-CREATE INDEX idx_encrypted_rcv_message_hashes_created_at ON encrypted_rcv_message_hashes(created_at);
-|]
-
-down_m20230722_indexes :: Query
-down_m20230722_indexes =
-  [sql|
-DROP INDEX idx_encrypted_rcv_message_hashes_created_at;
-DROP INDEX idx_processed_ratchet_key_hashes_created_at;
-|]
@@ -1,22 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230814_indexes :: Query
-m20230814_indexes =
-  [sql|
-DROP INDEX idx_messages_internal_snd_id_ts;
-
-CREATE INDEX idx_messages_internal_ts ON messages(internal_ts);
-|]
-
-down_m20230814_indexes :: Query
-down_m20230814_indexes =
-  [sql|
-DROP INDEX idx_messages_internal_ts;
-
-CREATE INDEX idx_messages_internal_snd_id_ts ON messages(internal_snd_id, internal_ts);
-|]
@@ -1,24 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20230829_crypto_files :: Query
-m20230829_crypto_files =
-  [sql|
-ALTER TABLE rcv_files ADD COLUMN save_file_key BLOB;
-ALTER TABLE rcv_files ADD COLUMN save_file_nonce BLOB;
-ALTER TABLE snd_files ADD COLUMN src_file_key BLOB;
-ALTER TABLE snd_files ADD COLUMN src_file_nonce BLOB;
-|]
-
-down_m20230829_crypto_files :: Query
-down_m20230829_crypto_files =
-  [sql|
-ALTER TABLE rcv_files DROP COLUMN save_file_key;
-ALTER TABLE rcv_files DROP COLUMN save_file_nonce;
-ALTER TABLE snd_files DROP COLUMN src_file_key;
-ALTER TABLE snd_files DROP COLUMN src_file_nonce;
-|]
@@ -1,20 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20231222_command_created_at :: Query
-m20231222_command_created_at =
-  [sql|
-ALTER TABLE commands ADD COLUMN created_at TEXT NOT NULL DEFAULT('1970-01-01 00:00:00');
-CREATE INDEX idx_commands_server_commands ON commands(host, port, created_at, command_id);
-|]
-
-down_m20231222_command_created_at :: Query
-down_m20231222_command_created_at =
-  [sql|
-DROP INDEX idx_commands_server_commands;
-ALTER TABLE commands DROP COLUMN created_at;
-|]
@@ -1,38 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20231225_failed_work_items :: Query
-m20231225_failed_work_items =
-    [sql|
-ALTER TABLE snd_message_deliveries ADD COLUMN failed INTEGER DEFAULT 0;
-ALTER TABLE commands ADD COLUMN failed INTEGER DEFAULT 0;
-ALTER TABLE ntf_subscriptions ADD COLUMN ntf_failed INTEGER DEFAULT 0;
-ALTER TABLE ntf_subscriptions ADD COLUMN smp_failed INTEGER DEFAULT 0;
-ALTER TABLE rcv_files ADD COLUMN failed INTEGER DEFAULT 0;
-ALTER TABLE snd_files ADD COLUMN failed INTEGER DEFAULT 0;
-ALTER TABLE deleted_snd_chunk_replicas ADD COLUMN failed INTEGER DEFAULT 0;
-
-CREATE INDEX idx_rcv_files_status_created_at ON rcv_files(status, created_at);
-CREATE INDEX idx_snd_files_status_created_at ON snd_files(status, created_at);
-CREATE INDEX idx_snd_files_snd_file_entity_id ON snd_files(snd_file_entity_id);
-|]
-
-down_m20231225_failed_work_items :: Query
-down_m20231225_failed_work_items =
-    [sql|
-DROP INDEX idx_rcv_files_status_created_at;
-DROP INDEX idx_snd_files_status_created_at;
-DROP INDEX idx_snd_files_snd_file_entity_id;
-
-ALTER TABLE snd_message_deliveries DROP COLUMN failed;
-ALTER TABLE commands DROP COLUMN failed;
-ALTER TABLE ntf_subscriptions DROP COLUMN ntf_failed;
-ALTER TABLE ntf_subscriptions DROP COLUMN smp_failed;
-ALTER TABLE rcv_files DROP COLUMN failed;
-ALTER TABLE snd_files DROP COLUMN failed;
-ALTER TABLE deleted_snd_chunk_replicas DROP COLUMN failed;
-|]
@@ -1,20 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20240121_message_delivery_indexes :: Query
-m20240121_message_delivery_indexes =
-    [sql|
-CREATE INDEX idx_messages_snd_expired ON messages(conn_id, internal_snd_id, internal_ts);
-CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(conn_id, snd_queue_id, failed, internal_id);
-|]
-
-down_m20240121_message_delivery_indexes :: Query
-down_m20240121_message_delivery_indexes =
-    [sql|
-DROP INDEX idx_messages_snd_expired;
-DROP INDEX idx_snd_message_deliveries_expired;
-|]
@@ -1,34 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20240124_file_redirect :: Query
-m20240124_file_redirect =
-    [sql|
-ALTER TABLE snd_files ADD COLUMN redirect_size INTEGER;
-ALTER TABLE snd_files ADD COLUMN redirect_digest BLOB;
-
-ALTER TABLE rcv_files ADD COLUMN redirect_id INTEGER REFERENCES rcv_files ON DELETE SET NULL;
-ALTER TABLE rcv_files ADD COLUMN redirect_entity_id BLOB;
-ALTER TABLE rcv_files ADD COLUMN redirect_size INTEGER;
-ALTER TABLE rcv_files ADD COLUMN redirect_digest BLOB;
-
-CREATE INDEX idx_rcv_files_redirect_id on rcv_files(redirect_id);
-|]
-
-down_m20240124_file_redirect :: Query
-down_m20240124_file_redirect =
-    [sql|
-DROP INDEX idx_rcv_files_redirect_id;
-
-ALTER TABLE snd_files DROP COLUMN redirect_size;
-ALTER TABLE snd_files DROP COLUMN redirect_digest;
-
-ALTER TABLE rcv_files DROP COLUMN redirect_id;
-ALTER TABLE rcv_files DROP COLUMN redirect_entity_id;
-ALTER TABLE rcv_files DROP COLUMN redirect_size;
-ALTER TABLE rcv_files DROP COLUMN redirect_digest;
-|]
@@ -1,18 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20240223_connections_wait_delivery :: Query
-m20240223_connections_wait_delivery =
-  [sql|
-ALTER TABLE connections ADD COLUMN deleted_at_wait_delivery TEXT;
-|]
-
-down_m20240223_connections_wait_delivery :: Query
-down_m20240223_connections_wait_delivery =
-  [sql|
-ALTER TABLE connections DROP COLUMN deleted_at_wait_delivery;
-|]
@@ -1,22 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20240225_ratchet_kem :: Query
-m20240225_ratchet_kem =
-    [sql|
-ALTER TABLE ratchets ADD COLUMN pq_priv_kem BLOB;
-ALTER TABLE connections ADD COLUMN pq_support INTEGER NOT NULL DEFAULT 0;
-ALTER TABLE messages ADD COLUMN pq_encryption INTEGER NOT NULL DEFAULT 0;
-|]
-
-down_m20240225_ratchet_kem :: Query
-down_m20240225_ratchet_kem =
-    [sql|
-ALTER TABLE ratchets DROP COLUMN pq_priv_kem;
-ALTER TABLE connections DROP COLUMN pq_support;
-ALTER TABLE messages DROP COLUMN pq_encryption;
-|]
@@ -25,10 +25,7 @@ CREATE TABLE connections(
  enable_ntfs INTEGER,
  deleted INTEGER DEFAULT 0 CHECK(deleted NOT NULL),
  user_id INTEGER CHECK(user_id NOT NULL)
-  REFERENCES users ON DELETE CASCADE,
-  ratchet_sync_state TEXT NOT NULL DEFAULT 'ok',
-  deleted_at_wait_delivery TEXT,
-  pq_support INTEGER NOT NULL DEFAULT 0
+  REFERENCES users ON DELETE CASCADE
 ) WITHOUT ROWID;
 CREATE TABLE rcv_queues(
  host TEXT NOT NULL,
@@ -53,8 +50,6 @@ CREATE TABLE rcv_queues(
  replace_rcv_queue_id INTEGER NULL,
  delete_errors INTEGER DEFAULT 0 CHECK(delete_errors NOT NULL),
  server_key_hash BLOB,
-  switch_status TEXT,
-  deleted INTEGER NOT NULL DEFAULT 0,
  PRIMARY KEY(host, port, rcv_id),
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE,
@@ -76,7 +71,6 @@ CREATE TABLE snd_queues(
  snd_primary INTEGER CHECK(snd_primary NOT NULL),
  replace_snd_queue_id INTEGER NULL,
  server_key_hash BLOB,
-  switch_status TEXT,
  PRIMARY KEY(host, port, snd_id),
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE
@@ -91,7 +85,6 @@ CREATE TABLE messages(
  msg_type BLOB NOT NULL, --(H)ELLO,(R)EPLY,(D)ELETE. Should SMP confirmation be saved too?
  msg_body BLOB NOT NULL DEFAULT x'',
  msg_flags TEXT NULL,
-  pq_encryption INTEGER NOT NULL DEFAULT 0,
  PRIMARY KEY(conn_id, internal_id),
  FOREIGN KEY(conn_id, internal_rcv_id) REFERENCES rcv_messages
  ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED,
@@ -122,8 +115,6 @@ CREATE TABLE snd_messages(
  previous_msg_hash BLOB NOT NULL DEFAULT x'',
  retry_int_slow INTEGER,
  retry_int_fast INTEGER,
-  rcpt_internal_id INTEGER,
-  rcpt_status TEXT,
  PRIMARY KEY(conn_id, internal_snd_id),
  FOREIGN KEY(conn_id, internal_id) REFERENCES messages
  ON DELETE CASCADE
@@ -160,10 +151,6 @@ CREATE TABLE ratchets(
  -- ratchet is initially empty on the receiving side(the side offering the connection)
  ratchet_state BLOB,
  e2e_version INTEGER NOT NULL DEFAULT 1
-  ,
-  x3dh_pub_key_1 BLOB,
-  x3dh_pub_key_2 BLOB,
-  pq_priv_kem BLOB
 ) WITHOUT ROWID;
 CREATE TABLE skipped_messages(
  skipped_message_id INTEGER PRIMARY KEY,
@@ -217,8 +204,6 @@ CREATE TABLE ntf_subscriptions(
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now')),
  smp_server_key_hash BLOB,
-  ntf_failed INTEGER DEFAULT 0,
-  smp_failed INTEGER DEFAULT 0,
  PRIMARY KEY(conn_id),
  FOREIGN KEY(smp_host, smp_port) REFERENCES servers(host, port)
  ON DELETE SET NULL ON UPDATE CASCADE,
@@ -235,8 +220,6 @@ CREATE TABLE commands(
  command BLOB NOT NULL,
  agent_version INTEGER NOT NULL DEFAULT 1,
  server_key_hash BLOB,
-  created_at TEXT NOT NULL DEFAULT('1970-01-01 00:00:00'),
-  failed INTEGER DEFAULT 0,
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE
 );
@@ -245,7 +228,6 @@ CREATE TABLE snd_message_deliveries(
  conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
  snd_queue_id INTEGER NOT NULL,
  internal_id INTEGER NOT NULL,
-  failed INTEGER DEFAULT 0,
  FOREIGN KEY(conn_id, internal_id) REFERENCES messages ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED
 );
 CREATE TABLE sqlite_sequence(name,seq);
@@ -280,13 +262,6 @@ CREATE TABLE rcv_files(
  error TEXT,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now')),
-  save_file_key BLOB,
-  save_file_nonce BLOB,
-  failed INTEGER DEFAULT 0,
-  redirect_id INTEGER REFERENCES rcv_files ON DELETE SET NULL,
-  redirect_entity_id BLOB,
-  redirect_size INTEGER,
-  redirect_digest BLOB,
  UNIQUE(rcv_file_entity_id)
 );
 CREATE TABLE rcv_file_chunks(
@@ -327,12 +302,6 @@ CREATE TABLE snd_files(
  error TEXT,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
-  ,
-  src_file_key BLOB,
-  src_file_nonce BLOB,
-  failed INTEGER DEFAULT 0,
-  redirect_size INTEGER,
-  redirect_digest BLOB
 );
 CREATE TABLE snd_file_chunks(
  snd_file_chunk_id INTEGER PRIMARY KEY,
@@ -376,8 +345,6 @@ CREATE TABLE deleted_snd_chunk_replicas(
  retries INTEGER NOT NULL DEFAULT 0,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
-  ,
-  failed INTEGER DEFAULT 0
 );
 CREATE TABLE encrypted_rcv_message_hashes(
  encrypted_rcv_message_hash_id INTEGER PRIMARY KEY,
@@ -386,13 +353,6 @@ CREATE TABLE encrypted_rcv_message_hashes(
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
 );
-CREATE TABLE processed_ratchet_key_hashes(
-  processed_ratchet_key_hash_id INTEGER PRIMARY KEY,
-  conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
-  hash BLOB NOT NULL,
-  created_at TEXT NOT NULL DEFAULT(datetime('now')),
-  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
-);
 CREATE UNIQUE INDEX idx_rcv_queues_ntf ON rcv_queues(host, port, ntf_id);
 CREATE UNIQUE INDEX idx_rcv_queue_id ON rcv_queues(conn_id, rcv_queue_id);
 CREATE UNIQUE INDEX idx_snd_queue_id ON snd_queues(conn_id, snd_queue_id);
@@ -483,39 +443,3 @@ CREATE INDEX idx_encrypted_rcv_message_hashes_hash ON encrypted_rcv_message_hash
  conn_id,
  hash
 );
-CREATE INDEX idx_processed_ratchet_key_hashes_hash ON processed_ratchet_key_hashes(
-  conn_id,
-  hash
-);
-CREATE INDEX idx_snd_messages_rcpt_internal_id ON snd_messages(
-  conn_id,
-  rcpt_internal_id
-);
-CREATE INDEX idx_processed_ratchet_key_hashes_created_at ON processed_ratchet_key_hashes(
-  created_at
-);
-CREATE INDEX idx_encrypted_rcv_message_hashes_created_at ON encrypted_rcv_message_hashes(
-  created_at
-);
-CREATE INDEX idx_messages_internal_ts ON messages(internal_ts);
-CREATE INDEX idx_commands_server_commands ON commands(
-  host,
-  port,
-  created_at,
-  command_id
-);
-CREATE INDEX idx_rcv_files_status_created_at ON rcv_files(status, created_at);
-CREATE INDEX idx_snd_files_status_created_at ON snd_files(status, created_at);
-CREATE INDEX idx_snd_files_snd_file_entity_id ON snd_files(snd_file_entity_id);
-CREATE INDEX idx_messages_snd_expired ON messages(
-  conn_id,
-  internal_snd_id,
-  internal_ts
-);
-CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(
-  conn_id,
-  snd_queue_id,
-  failed,
-  internal_id
-);
-CREATE INDEX idx_rcv_files_redirect_id on rcv_files(redirect_id);
@@ -0,0 +1,25 @@
+module Simplex.Messaging.Agent.TAsyncs where
+
+import Control.Concurrent.STM (stateTVar)
+import Control.Monad.IO.Unlift (MonadUnliftIO)
+import Simplex.Messaging.TMap (TMap)
+import qualified Simplex.Messaging.TMap as TM
+import UnliftIO.Async (Async, async)
+import UnliftIO.STM
+
+data TAsyncs = TAsyncs
+  { actionId :: TVar Int,
+    actions :: TMap Int (Async ())
+  }
+
+newTAsyncs :: STM TAsyncs
+newTAsyncs = TAsyncs <$> newTVar 0 <*> TM.empty
+
+newAsyncAction :: MonadUnliftIO m => (Int -> m ()) -> TAsyncs -> m ()
+newAsyncAction action as = do
+  aId <- atomically $ stateTVar (actionId as) $ \i -> (i + 1, i + 1)
+  a <- async $ action aId
+  atomically $ TM.insert aId a $ actions as
+
+removeAsyncAction :: Int -> TAsyncs -> STM ()
+removeAsyncAction aId = TM.delete aId . actions
@@ -1,100 +1,61 @@
-{-# LANGUAGE LambdaCase #-}
-
 module Simplex.Messaging.Agent.TRcvQueues
-  ( TRcvQueues (getRcvQueues, getConnections),
+  ( TRcvQueues,
    empty,
    clear,
    deleteConn,
    hasConn,
+    getConns,
    addQueue,
-    batchAddQueues,
    deleteQueue,
    getSessQueues,
    getDelSessQueues,
-    qKey,
  )
 where

 import Control.Concurrent.STM
-import Data.Foldable (foldl')
-import Data.List.NonEmpty (NonEmpty (..), (<|))
-import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
+import Data.Set (Set)
+import qualified Data.Set as S
 import Simplex.Messaging.Agent.Protocol (ConnId, UserId)
-import Simplex.Messaging.Agent.Store (RcvQueue, StoredRcvQueue (..))
+import Simplex.Messaging.Agent.Store (RcvQueue (..))
 import Simplex.Messaging.Protocol (RecipientId, SMPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM

-- the fields in this record have the same data with swapped keys for lookup efficiency,
-- and all methods must maintain this invariant.
-data TRcvQueues = TRcvQueues
-  { getRcvQueues :: TMap (UserId, SMPServer, RecipientId) RcvQueue,
-    getConnections :: TMap ConnId (NonEmpty (UserId, SMPServer, RecipientId))
-  }
+newtype TRcvQueues = TRcvQueues (TMap (UserId, SMPServer, RecipientId) RcvQueue)

 empty :: STM TRcvQueues
-empty = TRcvQueues <$> TM.empty <*> TM.empty
+empty = TRcvQueues <$> TM.empty

 clear :: TRcvQueues -> STM ()
-clear (TRcvQueues qs cs) = TM.clear qs >> TM.clear cs
+clear (TRcvQueues qs) = TM.clear qs

 deleteConn :: ConnId -> TRcvQueues -> STM ()
-deleteConn cId (TRcvQueues qs cs) =
-  TM.lookupDelete cId cs >>= \case
-    Just ks -> modifyTVar' qs $ \qs' -> foldl' (flip M.delete) qs' ks
-    Nothing -> pure ()
+deleteConn cId (TRcvQueues qs) = modifyTVar' qs $ M.filter (\rq -> cId /= connId rq)

 hasConn :: ConnId -> TRcvQueues -> STM Bool
-hasConn cId (TRcvQueues _ cs) = TM.member cId cs
+hasConn cId (TRcvQueues qs) = any (\rq -> cId == connId rq) <$> readTVar qs
+
+getConns :: TRcvQueues -> STM (Set ConnId)
+getConns (TRcvQueues qs) = M.foldr' (S.insert . connId) S.empty <$> readTVar qs

 addQueue :: RcvQueue -> TRcvQueues -> STM ()
-addQueue rq (TRcvQueues qs cs) = do
-  TM.insert k rq qs
-  TM.alter addQ (connId rq) cs
-  where
-    addQ = Just . maybe (k :| []) (k <|)
-    k = qKey rq
-
-- Save time by aggregating modifyTVar
-batchAddQueues :: Foldable t => TRcvQueues -> t RcvQueue -> STM ()
-batchAddQueues (TRcvQueues qs cs) rqs = do
-  modifyTVar' qs $ \now -> foldl' (\rqs' rq -> M.insert (qKey rq) rq rqs') now rqs
-  modifyTVar' cs $ \now -> foldl' (\cs' rq -> M.alter (addQ $ qKey rq) (connId rq) cs') now rqs
-  where
-    addQ k = Just . maybe (k :| []) (k <|)
+addQueue rq (TRcvQueues qs) = TM.insert (qKey rq) rq qs

 deleteQueue :: RcvQueue -> TRcvQueues -> STM ()
-deleteQueue rq (TRcvQueues qs cs) = do
-  TM.delete k qs
-  TM.update delQ (connId rq) cs
-  where
-    delQ = L.nonEmpty . L.filter (/= k)
-    k = qKey rq
+deleteQueue rq (TRcvQueues qs) = TM.delete (qKey rq) qs

 getSessQueues :: (UserId, SMPServer, Maybe ConnId) -> TRcvQueues -> STM [RcvQueue]
-getSessQueues tSess (TRcvQueues qs _) = M.foldl' addQ [] <$> readTVar qs
+getSessQueues tSess (TRcvQueues qs) = M.foldl' addQ [] <$> readTVar qs
  where
    addQ qs' rq = if rq `isSession` tSess then rq : qs' else qs'

-getDelSessQueues :: (UserId, SMPServer, Maybe ConnId) -> TRcvQueues -> STM ([RcvQueue], [ConnId])
-getDelSessQueues tSess (TRcvQueues qs cs) = do
-  (removedQs, qs'') <- (\qs' -> M.foldl' delQ ([], qs') qs') <$> readTVar qs
-  writeTVar qs $! qs''
-  removedConns <- stateTVar cs $ \cs' -> foldl' delConn ([], cs') removedQs
-  pure (removedQs, removedConns)
+getDelSessQueues :: (UserId, SMPServer, Maybe ConnId) -> TRcvQueues -> STM [RcvQueue]
+getDelSessQueues tSess (TRcvQueues qs) = stateTVar qs $ M.foldl' addQ ([], M.empty)
  where
-    delQ acc@(removed, qs') rq
-      | rq `isSession` tSess = (rq : removed, M.delete (qKey rq) qs')
-      | otherwise = acc
-    delConn (removed, cs') rq = M.alterF f cId cs'
-      where
-        cId = connId rq
-        f = \case
-          Just ks -> case L.nonEmpty $ L.filter (qKey rq /=) ks of
-            Just ks' -> (removed, Just ks')
-            Nothing -> (cId : removed, Nothing)
-          Nothing -> (removed, Nothing) -- "impossible" in invariant holds, because we get keys from the known queues
+    addQ (removed, qs') rq
+      | rq `isSession` tSess = (rq : removed, qs')
+      | otherwise = (removed, M.insert (qKey rq) rq qs')

 isSession :: RcvQueue -> (UserId, SMPServer, Maybe ConnId) -> Bool
 isSession rq (uId, srv, connId_) =
@@ -1,5 +1,6 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE GADTs #-}
@@ -9,8 +10,6 @@
 {-# LANGUAGE OverloadedLists #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TemplateHaskell #-}
-{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}

 -- |
@@ -28,7 +27,7 @@
 module Simplex.Messaging.Client
  ( -- * Connect (disconnect) client to (from) SMP server
    TransportSession,
-    ProtocolClient (thParams, sessionTs, sentSubs),
+    ProtocolClient (thVersion, sessionId, sessionTs),
    SMPClient,
    getProtocolClient,
    closeProtocolClient,
@@ -40,10 +39,8 @@ module Simplex.Messaging.Client
    createSMPQueue,
    subscribeSMPQueue,
    subscribeSMPQueues,
-    streamSubscribeSMPQueues,
    getSMPMessage,
    subscribeSMPQueueNotifications,
-    subscribeSMPQueuesNtfs,
    secureSMPQueue,
    enableSMPQueueNotifications,
    disableSMPQueueNotifications,
@@ -63,7 +60,6 @@ module Simplex.Messaging.Client
    NetworkConfig (..),
    TransportSessionMode (..),
    defaultClientConfig,
-    defaultSMPClientConfig,
    defaultNetworkConfig,
    transportClientConfig,
    chooseTransportHost,
@@ -71,12 +67,6 @@ module Simplex.Messaging.Client
    temporaryClientError,
    ServerTransmission,
    ClientCommand,
-
-    -- * For testing
-    PCTransmission,
-    mkTransmission,
-    authTransmission,
-    smpClientStub,
  )
 where

@@ -84,115 +74,68 @@ import Control.Concurrent.Async
 import Control.Concurrent.STM
 import Control.Exception
 import Control.Monad
-import Control.Monad.Except
 import Control.Monad.IO.Class (liftIO)
 import Control.Monad.Trans.Except
-import Crypto.Random (ChaChaDRG)
-import qualified Data.Aeson.TH as J
+import Data.Aeson (FromJSON (..), ToJSON (..))
+import qualified Data.Aeson as J
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
+import Data.Either (rights)
 import Data.Functor (($>))
 import Data.Int (Int64)
 import Data.List (find)
-import Data.List.NonEmpty (NonEmpty (..))
+import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
 import Data.Maybe (fromMaybe)
-import Data.Time.Clock (UTCTime (..), diffUTCTime, getCurrentTime)
+import Data.Time.Clock (UTCTime, getCurrentTime)
+import GHC.Generics (Generic)
 import Network.Socket (ServiceName)
 import Numeric.Natural
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (defaultJSON, dropPrefix, enumJSON)
-import Simplex.Messaging.Protocol
+import Simplex.Messaging.Parsers (dropPrefix, enumJSON)
+import Simplex.Messaging.Protocol as SMP
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport
-import Simplex.Messaging.Transport.Client (SocksProxy, TransportClientConfig (..), TransportHost (..), defaultTcpConnectTimeout, runTransportClient)
+import Simplex.Messaging.Transport.Client (SocksProxy, TransportClientConfig (..), TransportHost (..), runTransportClient)
 import Simplex.Messaging.Transport.KeepAlive
 import Simplex.Messaging.Transport.WebSockets (WS)
-import Simplex.Messaging.Util (bshow, diffToMicroseconds, raceAny_, threadDelay', whenM)
+import Simplex.Messaging.Util (bshow, raceAny_, threadDelay')
 import Simplex.Messaging.Version
 import System.Timeout (timeout)
-import UnliftIO (pooledMapConcurrentlyN)

 -- | 'SMPClient' is a handle used to send commands to a specific SMP server.
 --
 -- Use 'getSMPClient' to connect to an SMP server and create a client handle.
-data ProtocolClient v err msg = ProtocolClient
+data ProtocolClient err msg = ProtocolClient
  { action :: Maybe (Async ()),
-    thParams :: THandleParams v 'TClient,
+    sessionId :: SessionId,
    sessionTs :: UTCTime,
-    sentSubs :: TMap ByteString Bool, -- DEBUG: ConnId -> sub status
-    client_ :: PClient v err msg
+    thVersion :: Version,
+    client_ :: PClient err msg
  }

-data PClient v err msg = PClient
+data PClient err msg = PClient
  { connected :: TVar Bool,
    transportSession :: TransportSession msg,
    transportHost :: TransportHost,
    tcpTimeout :: Int,
-    rcvConcurrency :: Int,
-    sendPings :: TVar Bool,
-    lastReceived :: TVar UTCTime,
-    timeoutErrorCount :: TVar Int,
-    clientCorrId :: TVar ChaChaDRG,
+    pingErrorCount :: TVar Int,
+    clientCorrId :: TVar Natural,
    sentCommands :: TMap CorrId (Request err msg),
-    sndQ :: TBQueue (Maybe (TVar Bool), ByteString),
+    sndQ :: TBQueue (NonEmpty SentRawTransmission),
    rcvQ :: TBQueue (NonEmpty (SignedTransmission err msg)),
-    msgQ :: Maybe (TBQueue (ServerTransmission v msg))
+    msgQ :: Maybe (TBQueue (ServerTransmission msg))
  }

-smpClientStub :: TVar ChaChaDRG -> ByteString -> VersionSMP -> Maybe (THandleAuth 'TClient) -> STM SMPClient
-smpClientStub g sessionId thVersion thAuth = do
-  let ts = UTCTime (read "2024-03-31") 0
-  connected <- newTVar False
-  clientCorrId <- C.newRandomDRG g
-  sentCommands <- TM.empty
-  sendPings <- newTVar False
-  sentSubs <- TM.empty
-  lastReceived <- newTVar ts
-  timeoutErrorCount <- newTVar 0
-  sndQ <- newTBQueue 100
-  rcvQ <- newTBQueue 100
-  return
-    ProtocolClient
-      { action = Nothing,
-        thParams =
-          THandleParams
-            { sessionId,
-              thVersion,
-              thAuth,
-              blockSize = smpBlockSize,
-              implySessId = thVersion >= authCmdsSMPVersion,
-              batch = True
-            },
-        sessionTs = ts,
-        sentSubs,
-        client_ =
-          PClient
-            { connected,
-              transportSession = (1, "smp://LcJUMfVhwD8yxjAiSaDzzGF3-kLG4Uh0Fl_ZIjrRwjI=@localhost:5001", Nothing),
-              transportHost = "localhost",
-              tcpTimeout = 15_000_000,
-              rcvConcurrency = 8,
-              sendPings,
-              lastReceived,
-              timeoutErrorCount,
-              clientCorrId,
-              sentCommands,
-              sndQ,
-              rcvQ,
-              msgQ = Nothing
-            }
-      }
-
-type SMPClient = ProtocolClient SMPVersion ErrorType BrokerMsg
+type SMPClient = ProtocolClient ErrorType SMP.BrokerMsg

 -- | Type for client command data
-type ClientCommand msg = (Maybe C.APrivateAuthKey, EntityId, ProtoCommand msg)
+type ClientCommand msg = (Maybe C.APrivateSignKey, QueueId, ProtoCommand msg)

 -- | Type synonym for transmission from some SPM server queue.
-type ServerTransmission v msg = (TransportSession msg, Version v, SessionId, Bool, EntityId, msg)
+type ServerTransmission msg = (TransportSession msg, Version, SessionId, QueueId, msg)

 data HostMode
  = -- | prefer (or require) onion hosts when connecting via SOCKS proxy
@@ -201,7 +144,14 @@ data HostMode
    HMOnion
  | -- | prefer (or require) public hosts
    HMPublic
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic)
+
+instance FromJSON HostMode where
+  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "HM"
+
+instance ToJSON HostMode where
+  toJSON = J.genericToJSON . enumJSON $ dropPrefix "HM"
+  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "HM"

 -- | network configuration for the client
 data NetworkConfig = NetworkConfig
@@ -217,22 +167,29 @@ data NetworkConfig = NetworkConfig
    tcpConnectTimeout :: Int,
    -- | timeout of protocol commands (microseconds)
    tcpTimeout :: Int,
-    -- | additional timeout per kilobyte (1024 bytes) to be sent
-    tcpTimeoutPerKb :: Int64,
-    -- | break response timeouts into groups, so later responses get later deadlines
-    rcvConcurrency :: Int,
    -- | TCP keep-alive options, Nothing to skip enabling keep-alive
    tcpKeepAlive :: Maybe KeepAliveOpts,
    -- | period for SMP ping commands (microseconds, 0 to disable)
    smpPingInterval :: Int64,
-    -- | the count of timeout errors after which SMP client terminates (and will be reconnected), 0 to disable
+    -- | the count of PING errors after which SMP client terminates (and will be reconnected), 0 to disable
    smpPingCount :: Int,
    logTLSErrors :: Bool
  }
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic, FromJSON)
+
+instance ToJSON NetworkConfig where
+  toJSON = J.genericToJSON J.defaultOptions {J.omitNothingFields = True}
+  toEncoding = J.genericToEncoding J.defaultOptions {J.omitNothingFields = True}

 data TransportSessionMode = TSMUser | TSMEntity
-  deriving (Eq, Show)
+  deriving (Eq, Show, Generic)
+
+instance ToJSON TransportSessionMode where
+  toJSON = J.genericToJSON . enumJSON $ dropPrefix "TSM"
+  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "TSM"
+
+instance FromJSON TransportSessionMode where
+  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "TSM"

 defaultNetworkConfig :: NetworkConfig
 defaultNetworkConfig =
@@ -241,10 +198,8 @@ defaultNetworkConfig =
      hostMode = HMOnionViaSocks,
      requiredHostMode = False,
      sessionMode = TSMUser,
-      tcpConnectTimeout = defaultTcpConnectTimeout,
-      tcpTimeout = 15_000_000,
-      tcpTimeoutPerKb = 5_000,
-      rcvConcurrency = 8,
+      tcpConnectTimeout = 7_500_000,
+      tcpTimeout = 5_000_000,
      tcpKeepAlive = Just defaultKeepAliveOpts,
      smpPingInterval = 600_000_000, -- 10min
      smpPingCount = 3,
@@ -252,50 +207,37 @@ defaultNetworkConfig =
    }

 transportClientConfig :: NetworkConfig -> TransportClientConfig
-transportClientConfig NetworkConfig {socksProxy, tcpConnectTimeout, tcpKeepAlive, logTLSErrors} =
-  TransportClientConfig {socksProxy, tcpConnectTimeout, tcpKeepAlive, logTLSErrors, clientCredentials = Nothing, alpn = Nothing}
-{-# INLINE transportClientConfig #-}
+transportClientConfig NetworkConfig {socksProxy, tcpKeepAlive, logTLSErrors} =
+  TransportClientConfig {socksProxy, tcpKeepAlive, logTLSErrors}

 -- | protocol client configuration.
-data ProtocolClientConfig v = ProtocolClientConfig
+data ProtocolClientConfig = ProtocolClientConfig
  { -- | size of TBQueue to use for server commands and responses
    qSize :: Natural,
    -- | default server port if port is not specified in ProtocolServer
    defaultTransport :: (ServiceName, ATransport),
    -- | network configuration
    networkConfig :: NetworkConfig,
-    -- | client-server protocol version range
-    serverVRange :: VersionRange v,
-    -- | agree shared session secret (used in SMP proxy)
-    agreeSecret :: Bool
+    -- | SMP client-server protocol version range
+    smpServerVRange :: VersionRange
  }

 -- | Default protocol client configuration.
-defaultClientConfig :: VersionRange v -> ProtocolClientConfig v
-defaultClientConfig serverVRange =
+defaultClientConfig :: ProtocolClientConfig
+defaultClientConfig =
  ProtocolClientConfig
    { qSize = 64,
      defaultTransport = ("443", transport @TLS),
      networkConfig = defaultNetworkConfig,
-      serverVRange,
-      agreeSecret = False
+      smpServerVRange = supportedSMPServerVRange
    }
-{-# INLINE defaultClientConfig #-}
-
-defaultSMPClientConfig :: ProtocolClientConfig SMPVersion
-defaultSMPClientConfig = defaultClientConfig supportedClientSMPRelayVRange
-{-# INLINE defaultSMPClientConfig #-}

 data Request err msg = Request
-  { corrId :: CorrId,
-    entityId :: EntityId,
-    responseVar :: TMVar (Either (ProtocolClientError err) msg)
+  { queueId :: QueueId,
+    responseVar :: TMVar (Response err msg)
  }

-data Response err msg = Response
-  { entityId :: EntityId,
-    response :: Either (ProtocolClientError err) msg
-  }
+type Response err msg = Either (ProtocolClientError err) msg

 chooseTransportHost :: NetworkConfig -> NonEmpty TransportHost -> Either (ProtocolClientError err) TransportHost
 chooseTransportHost NetworkConfig {socksProxy, hostMode, requiredHostMode} hosts =
@@ -311,19 +253,16 @@ chooseTransportHost NetworkConfig {socksProxy, hostMode, requiredHostMode} hosts
    onionHost = find isOnionHost hosts
    publicHost = find (not . isOnionHost) hosts

-protocolClientServer :: ProtocolTypeI (ProtoType msg) => ProtocolClient v err msg -> String
+protocolClientServer :: ProtocolTypeI (ProtoType msg) => ProtocolClient err msg -> String
 protocolClientServer = B.unpack . strEncode . snd3 . transportSession . client_
  where
    snd3 (_, s, _) = s
-{-# INLINE protocolClientServer #-}

-transportHost' :: ProtocolClient v err msg -> TransportHost
+transportHost' :: ProtocolClient err msg -> TransportHost
 transportHost' = transportHost . client_
-{-# INLINE transportHost' #-}

-transportSession' :: ProtocolClient v err msg -> TransportSession msg
+transportSession' :: ProtocolClient err msg -> TransportSession msg
 transportSession' = transportSession . client_
-{-# INLINE transportSession' #-}

 type UserId = Int64

@@ -335,22 +274,20 @@ type TransportSession msg = (UserId, ProtoServer msg, Maybe EntityId)
 --
 -- A single queue can be used for multiple 'SMPClient' instances,
 -- as 'SMPServerTransmission' includes server information.
-getProtocolClient :: forall v err msg. Protocol v err msg => TVar ChaChaDRG -> TransportSession msg -> ProtocolClientConfig v -> Maybe (TBQueue (ServerTransmission v msg)) -> (ProtocolClient v err msg -> IO ()) -> IO (Either (ProtocolClientError err) (ProtocolClient v err msg))
-getProtocolClient g transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize, networkConfig, serverVRange, agreeSecret} msgQ disconnected = do
+getProtocolClient :: forall err msg. Protocol err msg => TransportSession msg -> ProtocolClientConfig -> Maybe (TBQueue (ServerTransmission msg)) -> (ProtocolClient err msg -> IO ()) -> IO (Either (ProtocolClientError err) (ProtocolClient err msg))
+getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize, networkConfig, smpServerVRange} msgQ disconnected = do
  case chooseTransportHost networkConfig (host srv) of
    Right useHost ->
-      (getCurrentTime >>= atomically . mkProtocolClient useHost >>= runClient useTransport useHost)
+      (atomically (mkProtocolClient useHost) >>= runClient useTransport useHost)
        `catch` \(e :: IOException) -> pure . Left $ PCEIOError e
    Left e -> pure $ Left e
  where
-    NetworkConfig {tcpConnectTimeout, tcpTimeout, rcvConcurrency, smpPingInterval} = networkConfig
-    mkProtocolClient :: TransportHost -> UTCTime -> STM (PClient v err msg)
-    mkProtocolClient transportHost ts = do
+    NetworkConfig {tcpConnectTimeout, tcpTimeout, smpPingInterval} = networkConfig
+    mkProtocolClient :: TransportHost -> STM (PClient err msg)
+    mkProtocolClient transportHost = do
      connected <- newTVar False
-      sendPings <- newTVar False
-      lastReceived <- newTVar ts
-      timeoutErrorCount <- newTVar 0
-      clientCorrId <- C.newRandomDRG g
+      pingErrorCount <- newTVar 0
+      clientCorrId <- newTVar 0
      sentCommands <- TM.empty
      sndQ <- newTBQueue qSize
      rcvQ <- newTBQueue qSize
@@ -360,18 +297,15 @@ getProtocolClient g transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize
            transportSession,
            transportHost,
            tcpTimeout,
-            sendPings,
-            lastReceived,
-            timeoutErrorCount,
+            pingErrorCount,
            clientCorrId,
            sentCommands,
-            rcvConcurrency,
            sndQ,
            rcvQ,
            msgQ
          }

-    runClient :: (ServiceName, ATransport) -> TransportHost -> PClient v err msg -> IO (Either (ProtocolClientError err) (ProtocolClient v err msg))
+    runClient :: (ServiceName, ATransport) -> TransportHost -> PClient err msg -> IO (Either (ProtocolClientError err) (ProtocolClient err msg))
    runClient (port', ATransport t) useHost c = do
      cVar <- newEmptyTMVarIO
      let tcConfig = transportClientConfig networkConfig
@@ -379,12 +313,12 @@ getProtocolClient g transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize
      action <-
        async $
          runTransportClient tcConfig (Just username) useHost port' (Just $ keyHash srv) (client t c cVar)
-            `finally` atomically (tryPutTMVar cVar $ Left PCENetworkError)
+            `finally` atomically (putTMVar cVar $ Left PCENetworkError)
      c_ <- tcpConnectTimeout `timeout` atomically (takeTMVar cVar)
-      case c_ of
-        Just (Right c') -> pure $ Right c' {action = Just action}
-        Just (Left e) -> pure $ Left e
-        Nothing -> cancel action $> Left PCENetworkError
+      pure $ case c_ of
+        Just (Right c') -> Right c' {action = Just action}
+        Just (Left e) -> Left e
+        Nothing -> Left PCENetworkError

    useTransport :: (ServiceName, ATransport)
    useTransport = case port srv of
@@ -392,90 +326,68 @@ getProtocolClient g transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize
      "80" -> ("80", transport @WS)
      p -> (p, transport @TLS)

-    client :: forall c. Transport c => TProxy c -> PClient v err msg -> TMVar (Either (ProtocolClientError err) (ProtocolClient v err msg)) -> c -> IO ()
-    client _ c cVar h = do
-      ks <- if agreeSecret then Just <$> atomically (C.generateKeyPair g) else pure Nothing
-      runExceptT (protocolClientHandshake @v @err @msg h ks (keyHash srv) serverVRange) >>= \case
+    client :: forall c. Transport c => TProxy c -> PClient err msg -> TMVar (Either (ProtocolClientError err) (ProtocolClient err msg)) -> c -> IO ()
+    client _ c cVar h =
+      runExceptT (protocolClientHandshake @err @msg h (keyHash srv) smpServerVRange) >>= \case
        Left e -> atomically . putTMVar cVar . Left $ PCETransportError e
-        Right th@THandle {params} -> do
+        Right th@THandle {sessionId, thVersion} -> do
          sessionTs <- getCurrentTime
-          sentSubs <- atomically TM.empty
-          let c' = ProtocolClient {action = Nothing, client_ = c, thParams = params, sessionTs, sentSubs}
-          atomically $ writeTVar (lastReceived c) sessionTs
+          let c' = ProtocolClient {action = Nothing, client_ = c, sessionId, thVersion, sessionTs}
          atomically $ do
            writeTVar (connected c) True
            putTMVar cVar $ Right c'
-          raceAny_ ([send c' th, process c', receive c' th] <> [monitor c' | smpPingInterval > 0])
+          raceAny_ ([send c' th, process c', receive c' th] <> [ping c' | smpPingInterval > 0])
            `finally` disconnected c'

-    send :: Transport c => ProtocolClient v err msg -> THandle v c 'TClient -> IO ()
-    send ProtocolClient {client_ = PClient {sndQ}} h = forever $ atomically (readTBQueue sndQ) >>= sendActive
-      where
-        sendActive (Nothing, s) = send_ s
-        sendActive (Just active, s) = whenM (readTVarIO active) $ send_ s
-        send_ = void . tPutLog h
+    send :: Transport c => ProtocolClient err msg -> THandle c -> IO ()
+    send ProtocolClient {client_ = PClient {sndQ}} h = forever $ atomically (readTBQueue sndQ) >>= tPut h

-    receive :: Transport c => ProtocolClient v err msg -> THandle v c 'TClient -> IO ()
-    receive ProtocolClient {client_ = PClient {rcvQ, lastReceived, timeoutErrorCount}} h = forever $ do
-      tGet h >>= atomically . writeTBQueue rcvQ
-      getCurrentTime >>= atomically . writeTVar lastReceived
-      atomically $ writeTVar timeoutErrorCount 0
+    receive :: Transport c => ProtocolClient err msg -> THandle c -> IO ()
+    receive ProtocolClient {client_ = PClient {rcvQ}} h = forever $ tGet h >>= atomically . writeTBQueue rcvQ

-    monitor :: ProtocolClient v err msg -> IO ()
-    monitor c@ProtocolClient {client_ = PClient {sendPings, lastReceived, timeoutErrorCount}} = loop smpPingInterval
+    ping :: ProtocolClient err msg -> IO ()
+    ping c@ProtocolClient {client_ = PClient {pingErrorCount}} = do
+      threadDelay' smpPingInterval
+      runExceptT (sendProtocolCommand c Nothing "" $ protocolPing @err @msg) >>= \case
+        Left PCEResponseTimeout -> do
+          cnt <- atomically $ stateTVar pingErrorCount $ \cnt -> (cnt + 1, cnt + 1)
+          when (maxCnt == 0 || cnt < maxCnt) $ ping c
+        _ -> ping c -- sendProtocolCommand resets pingErrorCount
      where
-        loop :: Int64 -> IO ()
-        loop delay = do
-          threadDelay' delay
-          diff <- diffUTCTime <$> getCurrentTime <*> readTVarIO lastReceived
-          let idle = diffToMicroseconds diff
-              remaining = smpPingInterval - idle
-          if remaining > 1_000_000 -- delay pings only for significant time
-            then loop remaining
-            else do
-              whenM (readTVarIO sendPings) $ void . runExceptT $ sendProtocolCommand c Nothing "" (protocolPing @v @err @msg)
-              -- sendProtocolCommand/getResponse updates counter for each command
-              cnt <- readTVarIO timeoutErrorCount
-              -- drop client when maxCnt of commands have timed out in sequence, but only after some time has passed after last received response
-              when (maxCnt == 0 || cnt < maxCnt || diff < recoverWindow) $ loop smpPingInterval
-        recoverWindow = 15 * 60 -- seconds
        maxCnt = smpPingCount networkConfig

-    process :: ProtocolClient v err msg -> IO ()
+    process :: ProtocolClient err msg -> IO ()
    process c = forever $ atomically (readTBQueue $ rcvQ $ client_ c) >>= mapM_ (processMsg c)

-    processMsg :: ProtocolClient v err msg -> SignedTransmission err msg -> IO ()
-    processMsg c@ProtocolClient {client_ = PClient {sentCommands}} (_, _, (corrId, entId, respOrErr))
-      | isResponse =
+    processMsg :: ProtocolClient err msg -> SignedTransmission err msg -> IO ()
+    processMsg c@ProtocolClient {client_ = PClient {sentCommands}} (_, _, (corrId, qId, respOrErr)) =
+      if B.null $ bs corrId
+        then sendMsg respOrErr
+        else do
          atomically (TM.lookup corrId sentCommands) >>= \case
            Nothing -> sendMsg respOrErr
-            Just Request {entityId, responseVar} -> atomically $ do
+            Just Request {queueId, responseVar} -> atomically $ do
              TM.delete corrId sentCommands
-              putTMVar responseVar $ response entityId
-      | otherwise = sendMsg respOrErr
+              putTMVar responseVar $
+                if queueId == qId
+                  then case respOrErr of
+                    Left e -> Left $ PCEResponseError e
+                    Right r -> case protocolError r of
+                      Just e -> Left $ PCEProtocolError e
+                      _ -> Right r
+                  else Left . PCEUnexpectedResponse $ bshow respOrErr
      where
-        isResponse = not $ B.null $ bs corrId
-        response entityId
-          | entityId == entId =
-              case respOrErr of
-                Left e -> Left $ PCEResponseError e
-                Right r -> case protocolError r of
-                  Just e -> Left $ PCEProtocolError e
-                  _ -> Right r
-          | otherwise = Left . PCEUnexpectedResponse $ bshow respOrErr
        sendMsg :: Either err msg -> IO ()
        sendMsg = \case
-          Right msg -> atomically $ mapM_ (`writeTBQueue` serverTransmission c isResponse entId msg) msgQ
+          Right msg -> atomically $ mapM_ (`writeTBQueue` serverTransmission c qId msg) msgQ
          Left e -> putStrLn $ "SMP client error: " <> show e

 proxyUsername :: TransportSession msg -> ByteString
 proxyUsername (userId, _, entityId_) = C.sha256Hash $ bshow userId <> maybe "" (":" <>) entityId_
-{-# INLINE proxyUsername #-}

 -- | Disconnects client from the server and terminates client threads.
-closeProtocolClient :: ProtocolClient v err msg -> IO ()
+closeProtocolClient :: ProtocolClient err msg -> IO ()
 closeProtocolClient = mapM_ uninterruptibleCancel . action
-{-# INLINE closeProtocolClient #-}

 -- | SMP client error type.
 data ProtocolClientError err
@@ -515,71 +427,54 @@ temporaryClientError = \case
  PCEResponseTimeout -> True
  PCEIOError _ -> True
  _ -> False
-{-# INLINE temporaryClientError #-}

 -- | Create a new SMP queue.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#create-queue-command
 createSMPQueue ::
  SMPClient ->
-  C.AAuthKeyPair -> -- SMP v6 - signature key pair, SMP v7 - DH key pair
+  RcvPrivateSignKey ->
+  RcvPublicVerifyKey ->
  RcvPublicDhKey ->
  Maybe BasicAuth ->
-  SubscriptionMode ->
  ExceptT SMPClientError IO QueueIdsKeys
-createSMPQueue c (rKey, rpKey) dhKey auth subMode =
-  sendSMPCommand c (Just rpKey) "" (NEW rKey dhKey auth subMode) >>= \case
+createSMPQueue c rpKey rKey dhKey auth =
+  sendSMPCommand c (Just rpKey) "" (NEW rKey dhKey auth) >>= \case
    IDS qik -> pure qik
    r -> throwE . PCEUnexpectedResponse $ bshow r

 -- | Subscribe to the SMP queue.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#subscribe-to-queue
-subscribeSMPQueue :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> ExceptT SMPClientError IO ()
-subscribeSMPQueue c@ProtocolClient {client_ = PClient {sendPings}} rpKey rId = do
-  liftIO . atomically $ writeTVar sendPings True
-  -- We are not expiring sending subscriptions even if it expires to increase chances of subscription
-  -- succeeding without retries - the subscription is registered in the agent when uncorrelated MSG response
-  -- is received via the active client for pending queue subscription - it also prevents unnecessary retries.
-  sendProtocolCommand' False c (Just rpKey) rId (Cmd SRecipient SUB) >>= \case
-    OK -> pure ()
+subscribeSMPQueue :: SMPClient -> RcvPrivateSignKey -> RecipientId -> ExceptT SMPClientError IO ()
+subscribeSMPQueue c rpKey rId =
+  sendSMPCommand c (Just rpKey) rId SUB >>= \case
+    OK -> return ()
    cmd@MSG {} -> liftIO $ writeSMPMessage c rId cmd
    r -> throwE . PCEUnexpectedResponse $ bshow r

 -- | Subscribe to multiple SMP queues batching commands if supported.
-subscribeSMPQueues :: SMPClient -> NonEmpty (RcvPrivateAuthKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
-subscribeSMPQueues c@ProtocolClient {client_ = PClient {sendPings}} qs = do
-  atomically $ writeTVar sendPings True
-  -- See comment in subscribeSMPQueue
-  sendProtocolCommands' False c cs >>= mapM (processSUBResponse c)
+subscribeSMPQueues :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
+subscribeSMPQueues c qs = sendProtocolCommands c cs >>= mapM response . L.zip qs
  where
    cs = L.map (\(rpKey, rId) -> (Just rpKey, rId, Cmd SRecipient SUB)) qs
-
-streamSubscribeSMPQueues :: SMPClient -> NonEmpty (RcvPrivateAuthKey, RecipientId) -> ([(RecipientId, Either SMPClientError ())] -> IO ()) -> IO ()
-streamSubscribeSMPQueues c qs cb = streamProtocolCommands c cs $ mapM process >=> cb
-  where
-    cs = L.map (\(rpKey, rId) -> (Just rpKey, rId, Cmd SRecipient SUB)) qs
-    process r@(Response rId _) = (rId,) <$> processSUBResponse c r
-
-processSUBResponse :: SMPClient -> Response ErrorType BrokerMsg -> IO (Either SMPClientError ())
-processSUBResponse c (Response rId r) = case r of
-  Right OK -> pure $ Right ()
-  Right SUBOK -> pure $ Right () -- from v8 of SMP protocol
-  Right cmd@MSG {} -> writeSMPMessage c rId cmd $> Right ()
-  Right r' -> pure . Left . PCEUnexpectedResponse $ bshow r'
-  Left e -> pure $ Left e
+    response ((_, rId), r) = case r of
+      Right OK -> pure $ Right ()
+      Right cmd@MSG {} -> writeSMPMessage c rId cmd $> Right ()
+      Right r' -> pure . Left . PCEUnexpectedResponse $ bshow r'
+      Left e -> pure $ Left e

 writeSMPMessage :: SMPClient -> RecipientId -> BrokerMsg -> IO ()
-writeSMPMessage c rId msg = atomically $ mapM_ (`writeTBQueue` serverTransmission c False rId msg) (msgQ $ client_ c)
+writeSMPMessage c rId msg = atomically $ mapM_ (`writeTBQueue` serverTransmission c rId msg) (msgQ $ client_ c)

-serverTransmission :: ProtocolClient v err msg -> Bool -> RecipientId -> msg -> ServerTransmission v msg
-serverTransmission ProtocolClient {thParams = THandleParams {thVersion, sessionId}, client_ = PClient {transportSession}} isResponse entityId message =
-  (transportSession, thVersion, sessionId, isResponse, entityId, message)
+serverTransmission :: ProtocolClient err msg -> RecipientId -> msg -> ServerTransmission msg
+serverTransmission ProtocolClient {thVersion, sessionId, client_ = PClient {transportSession}} entityId message =
+  (transportSession, thVersion, sessionId, entityId, message)

 -- | Get message from SMP queue. The server returns ERR PROHIBITED if a client uses SUB and GET via the same transport connection for the same queue
 --
 -- https://github.covm/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#receive-a-message-from-the-queue
-getSMPMessage :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> ExceptT SMPClientError IO (Maybe RcvMessage)
+getSMPMessage :: SMPClient -> RcvPrivateSignKey -> RecipientId -> ExceptT SMPClientError IO (Maybe RcvMessage)
 getSMPMessage c rpKey rId =
  sendSMPCommand c (Just rpKey) rId GET >>= \case
    OK -> pure Nothing
@@ -589,57 +484,48 @@ getSMPMessage c rpKey rId =
 -- | Subscribe to the SMP queue notifications.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#subscribe-to-queue-notifications
-subscribeSMPQueueNotifications :: SMPClient -> NtfPrivateAuthKey -> NotifierId -> ExceptT SMPClientError IO ()
+subscribeSMPQueueNotifications :: SMPClient -> NtfPrivateSignKey -> NotifierId -> ExceptT SMPClientError IO ()
 subscribeSMPQueueNotifications = okSMPCommand NSUB
-{-# INLINE subscribeSMPQueueNotifications #-}
-
-- | Subscribe to multiple SMP queues notifications batching commands if supported.
-subscribeSMPQueuesNtfs :: SMPClient -> NonEmpty (NtfPrivateAuthKey, NotifierId) -> IO (NonEmpty (Either SMPClientError ()))
-subscribeSMPQueuesNtfs = okSMPCommands NSUB
-{-# INLINE subscribeSMPQueuesNtfs #-}

 -- | Secure the SMP queue by adding a sender public key.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#secure-queue-command
-secureSMPQueue :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> SndPublicAuthKey -> ExceptT SMPClientError IO ()
+secureSMPQueue :: SMPClient -> RcvPrivateSignKey -> RecipientId -> SndPublicVerifyKey -> ExceptT SMPClientError IO ()
 secureSMPQueue c rpKey rId senderKey = okSMPCommand (KEY senderKey) c rpKey rId
-{-# INLINE secureSMPQueue #-}

 -- | Enable notifications for the queue for push notifications server.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#enable-notifications-command
-enableSMPQueueNotifications :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> NtfPublicAuthKey -> RcvNtfPublicDhKey -> ExceptT SMPClientError IO (NotifierId, RcvNtfPublicDhKey)
+enableSMPQueueNotifications :: SMPClient -> RcvPrivateSignKey -> RecipientId -> NtfPublicVerifyKey -> RcvNtfPublicDhKey -> ExceptT SMPClientError IO (NotifierId, RcvNtfPublicDhKey)
 enableSMPQueueNotifications c rpKey rId notifierKey rcvNtfPublicDhKey =
  sendSMPCommand c (Just rpKey) rId (NKEY notifierKey rcvNtfPublicDhKey) >>= \case
    NID nId rcvNtfSrvPublicDhKey -> pure (nId, rcvNtfSrvPublicDhKey)
    r -> throwE . PCEUnexpectedResponse $ bshow r

 -- | Enable notifications for the multiple queues for push notifications server.
-enableSMPQueuesNtfs :: SMPClient -> NonEmpty (RcvPrivateAuthKey, RecipientId, NtfPublicAuthKey, RcvNtfPublicDhKey) -> IO (NonEmpty (Either SMPClientError (NotifierId, RcvNtfPublicDhKey)))
-enableSMPQueuesNtfs c qs = L.map process <$> sendProtocolCommands c cs
+enableSMPQueuesNtfs :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId, NtfPublicVerifyKey, RcvNtfPublicDhKey) -> IO (NonEmpty (Either SMPClientError (NotifierId, RcvNtfPublicDhKey)))
+enableSMPQueuesNtfs c qs = L.map response <$> sendProtocolCommands c cs
  where
    cs = L.map (\(rpKey, rId, notifierKey, rcvNtfPublicDhKey) -> (Just rpKey, rId, Cmd SRecipient $ NKEY notifierKey rcvNtfPublicDhKey)) qs
-    process (Response _ r) = case r of
+    response = \case
      Right (NID nId rcvNtfSrvPublicDhKey) -> Right (nId, rcvNtfSrvPublicDhKey)
-      Right r' -> Left . PCEUnexpectedResponse $ bshow r'
+      Right r -> Left . PCEUnexpectedResponse $ bshow r
      Left e -> Left e

 -- | Disable notifications for the queue for push notifications server.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#disable-notifications-command
-disableSMPQueueNotifications :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> ExceptT SMPClientError IO ()
+disableSMPQueueNotifications :: SMPClient -> RcvPrivateSignKey -> RecipientId -> ExceptT SMPClientError IO ()
 disableSMPQueueNotifications = okSMPCommand NDEL
-{-# INLINE disableSMPQueueNotifications #-}

 -- | Disable notifications for multiple queues for push notifications server.
-disableSMPQueuesNtfs :: SMPClient -> NonEmpty (RcvPrivateAuthKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
+disableSMPQueuesNtfs :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
 disableSMPQueuesNtfs = okSMPCommands NDEL
-{-# INLINE disableSMPQueuesNtfs #-}

 -- | Send SMP message.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#send-message
-sendSMPMessage :: SMPClient -> Maybe SndPrivateAuthKey -> SenderId -> MsgFlags -> MsgBody -> ExceptT SMPClientError IO ()
+sendSMPMessage :: SMPClient -> Maybe SndPrivateSignKey -> SenderId -> MsgFlags -> MsgBody -> ExceptT SMPClientError IO ()
 sendSMPMessage c spKey sId flags msg =
  sendSMPCommand c spKey sId (SEND flags msg) >>= \case
    OK -> pure ()
@@ -648,7 +534,7 @@ sendSMPMessage c spKey sId flags msg =
 -- | Acknowledge message delivery (server deletes the message).
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#acknowledge-message-delivery
-ackSMPMessage :: SMPClient -> RcvPrivateAuthKey -> QueueId -> MsgId -> ExceptT SMPClientError IO ()
+ackSMPMessage :: SMPClient -> RcvPrivateSignKey -> QueueId -> MsgId -> ExceptT SMPClientError IO ()
 ackSMPMessage c rpKey rId msgId =
  sendSMPCommand c (Just rpKey) rId (ACK msgId) >>= \case
    OK -> return ()
@@ -659,160 +545,79 @@ ackSMPMessage c rpKey rId msgId =
 -- The existing messages from the queue will still be delivered.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#suspend-queue
-suspendSMPQueue :: SMPClient -> RcvPrivateAuthKey -> QueueId -> ExceptT SMPClientError IO ()
+suspendSMPQueue :: SMPClient -> RcvPrivateSignKey -> QueueId -> ExceptT SMPClientError IO ()
 suspendSMPQueue = okSMPCommand OFF
-{-# INLINE suspendSMPQueue #-}

 -- | Irreversibly delete SMP queue and all messages in it.
 --
 -- https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md#delete-queue
-deleteSMPQueue :: SMPClient -> RcvPrivateAuthKey -> RecipientId -> ExceptT SMPClientError IO ()
+deleteSMPQueue :: SMPClient -> RcvPrivateSignKey -> RecipientId -> ExceptT SMPClientError IO ()
 deleteSMPQueue = okSMPCommand DEL
-{-# INLINE deleteSMPQueue #-}

 -- | Delete multiple SMP queues batching commands if supported.
-deleteSMPQueues :: SMPClient -> NonEmpty (RcvPrivateAuthKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
+deleteSMPQueues :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
 deleteSMPQueues = okSMPCommands DEL
-{-# INLINE deleteSMPQueues #-}

-okSMPCommand :: PartyI p => Command p -> SMPClient -> C.APrivateAuthKey -> QueueId -> ExceptT SMPClientError IO ()
+okSMPCommand :: PartyI p => Command p -> SMPClient -> C.APrivateSignKey -> QueueId -> ExceptT SMPClientError IO ()
 okSMPCommand cmd c pKey qId =
  sendSMPCommand c (Just pKey) qId cmd >>= \case
    OK -> return ()
    r -> throwE . PCEUnexpectedResponse $ bshow r

-okSMPCommands :: PartyI p => Command p -> SMPClient -> NonEmpty (C.APrivateAuthKey, QueueId) -> IO (NonEmpty (Either SMPClientError ()))
-okSMPCommands cmd c qs = L.map process <$> sendProtocolCommands c cs
+okSMPCommands :: PartyI p => Command p -> SMPClient -> NonEmpty (C.APrivateSignKey, QueueId) -> IO (NonEmpty (Either SMPClientError ()))
+okSMPCommands cmd c qs = L.map response <$> sendProtocolCommands c cs
  where
    aCmd = Cmd sParty cmd
    cs = L.map (\(pKey, qId) -> (Just pKey, qId, aCmd)) qs
-    process (Response _ r) = case r of
+    response = \case
      Right OK -> Right ()
-      Right r' -> Left . PCEUnexpectedResponse $ bshow r'
+      Right r -> Left . PCEUnexpectedResponse $ bshow r
      Left e -> Left e

 -- | Send SMP command
-sendSMPCommand :: PartyI p => SMPClient -> Maybe C.APrivateAuthKey -> QueueId -> Command p -> ExceptT SMPClientError IO BrokerMsg
+sendSMPCommand :: PartyI p => SMPClient -> Maybe C.APrivateSignKey -> QueueId -> Command p -> ExceptT SMPClientError IO BrokerMsg
 sendSMPCommand c pKey qId cmd = sendProtocolCommand c pKey qId (Cmd sParty cmd)
-{-# INLINE sendSMPCommand #-}
-
-type PCTransmission err msg = (Either TransportError SentRawTransmission, Request err msg)

 -- | Send multiple commands with batching and collect responses
-sendProtocolCommands :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => ProtocolClient v err msg -> NonEmpty (ClientCommand msg) -> IO (NonEmpty (Response err msg))
-sendProtocolCommands = sendProtocolCommands' True
-{-# INLINE sendProtocolCommands #-}
-
-sendProtocolCommands' :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => Bool -> ProtocolClient v err msg -> NonEmpty (ClientCommand msg) -> IO (NonEmpty (Response err msg))
-sendProtocolCommands' expire c@ProtocolClient {thParams = THandleParams {batch, blockSize}} cs = do
-  bs <- batchTransmissions' batch blockSize <$> mapM (mkTransmission c) cs
-  validate . concat =<< mapM (sendBatch c expire) bs
-  where
-    validate :: [Response err msg] -> IO (NonEmpty (Response err msg))
-    validate rs
-      | diff == 0 = pure $ L.fromList rs
-      | diff > 0 = do
-          putStrLn "send error: fewer responses than expected"
-          pure $ L.fromList $ rs <> replicate diff (Response "" $ Left $ PCETransportError TEBadBlock)
-      | otherwise = do
-          putStrLn "send error: more responses than expected"
-          pure $ L.fromList $ take (L.length cs) rs
-      where
-        diff = L.length cs - length rs
-
-streamProtocolCommands :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => ProtocolClient v err msg -> NonEmpty (ClientCommand msg) -> ([Response err msg] -> IO ()) -> IO ()
-streamProtocolCommands c@ProtocolClient {thParams = THandleParams {batch, blockSize}} cs cb = do
-  bs <- batchTransmissions' batch blockSize <$> mapM (mkTransmission c) cs
-  mapM_ (cb <=< sendBatch c True) bs
-
-sendBatch :: ProtocolClient v err msg -> Bool -> TransportBatch (Request err msg) -> IO [Response err msg]
-sendBatch c@ProtocolClient {client_ = PClient {rcvConcurrency, sndQ}} expire b = do
-  case b of
-    TBError e Request {entityId} -> do
-      putStrLn "send error: large message"
-      pure [Response entityId $ Left $ PCETransportError e]
-    TBTransmissions s n rs
-      | n > 0 -> do
-          active <- mkActive_ expire
-          atomically $ writeTBQueue sndQ (active, s)
-          pooledMapConcurrentlyN rcvConcurrency (getResponse c active) rs
-      | otherwise -> pure []
-    TBTransmission s r -> do
-      active <- mkActive_ expire
-      atomically $ writeTBQueue sndQ (active, s)
-      (: []) <$> getResponse c active r
-
-mkActive_ :: Bool -> IO (Maybe (TVar Bool))
-mkActive_ True = Just <$> newTVarIO True
-mkActive_ False = pure Nothing
+sendProtocolCommands :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> NonEmpty (ClientCommand msg) -> IO (NonEmpty (Either (ProtocolClientError err) msg))
+sendProtocolCommands c@ProtocolClient {client_ = PClient {sndQ}} cs = do
+  ts <- mapM (runExceptT . mkTransmission c) cs
+  mapM_ (atomically . writeTBQueue sndQ . L.map fst) . L.nonEmpty . rights $ L.toList ts
+  forConcurrently ts $ \case
+    Right (_, r) -> withTimeout c $ atomically $ takeTMVar r
+    Left e -> pure $ Left e

 -- | Send Protocol command
-sendProtocolCommand :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => ProtocolClient v err msg -> Maybe C.APrivateAuthKey -> EntityId -> ProtoCommand msg -> ExceptT (ProtocolClientError err) IO msg
-sendProtocolCommand = sendProtocolCommand' True
-{-# INLINE sendProtocolCommand #-}
-
-sendProtocolCommand' :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => Bool -> ProtocolClient v err msg -> Maybe C.APrivateAuthKey -> EntityId -> ProtoCommand msg -> ExceptT (ProtocolClientError err) IO msg
-sendProtocolCommand' expire c@ProtocolClient {client_ = PClient {sndQ}, thParams = THandleParams {batch, blockSize}} pKey entId cmd =
-  ExceptT $ uncurry sendRecv =<< mkTransmission c (pKey, entId, cmd)
+sendProtocolCommand :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> Maybe C.APrivateSignKey -> QueueId -> ProtoCommand msg -> ExceptT (ProtocolClientError err) IO msg
+sendProtocolCommand c@ProtocolClient {client_ = PClient {sndQ}} pKey qId cmd = do
+  (t, r) <- mkTransmission c (pKey, qId, cmd)
+  ExceptT $ sendRecv t r
  where
    -- two separate "atomically" needed to avoid blocking
-    sendRecv :: Either TransportError SentRawTransmission -> Request err msg -> IO (Either (ProtocolClientError err) msg)
-    sendRecv t_ r = case t_ of
-      Left e -> pure . Left $ PCETransportError e
-      Right t
-        | B.length s > blockSize - 2 -> pure . Left $ PCETransportError TELargeMsg
-        | otherwise -> do
-            active <- mkActive_ expire
-            atomically (writeTBQueue sndQ (active, s))
-            response <$> getResponse c active r
-        where
-          s
-            | batch = tEncodeBatch1 t
-            | otherwise = tEncode t
+    sendRecv :: SentRawTransmission -> TMVar (Response err msg) -> IO (Response err msg)
+    sendRecv t r = atomically (writeTBQueue sndQ [t]) >> withTimeout c (atomically $ takeTMVar r)

-- TODO switch to timeout or TimeManager that supports Int64
-getResponse :: ProtocolClient v err msg -> Maybe (TVar Bool) -> Request err msg -> IO (Response err msg)
-getResponse ProtocolClient {client_ = PClient {tcpTimeout, timeoutErrorCount, sentCommands}} active Request {corrId, entityId, responseVar} = do
-  response <-
-    timeout tcpTimeout (atomically (takeTMVar responseVar)) >>= \case
-      Just r -> atomically (writeTVar timeoutErrorCount 0) $> r
-      Nothing -> do
-        atomically (mapM_ (`writeTVar` False) active >> TM.delete corrId sentCommands)
-        atomically $ modifyTVar' timeoutErrorCount (+ 1)
-        pure $ Left PCEResponseTimeout
-  pure Response {entityId, response}
+withTimeout :: ProtocolClient err msg -> IO (Either (ProtocolClientError err) msg) -> IO (Either (ProtocolClientError err) msg)
+withTimeout ProtocolClient {client_ = PClient {tcpTimeout, pingErrorCount}} a =
+  timeout tcpTimeout a >>= \case
+    Just r -> atomically (writeTVar pingErrorCount 0) >> pure r
+    _ -> pure $ Left PCEResponseTimeout

-mkTransmission :: forall v err msg. ProtocolEncoding v err (ProtoCommand msg) => ProtocolClient v err msg -> ClientCommand msg -> IO (PCTransmission err msg)
-mkTransmission ProtocolClient {thParams, client_ = PClient {clientCorrId, sentCommands}} (pKey_, entId, cmd) = do
-  corrId <- atomically getNextCorrId
-  let TransmissionForAuth {tForAuth, tToSend} = encodeTransmissionForAuth thParams (corrId, entId, cmd)
-      auth = authTransmission (thAuth thParams) pKey_ corrId tForAuth
-  r <- atomically $ mkRequest corrId
-  pure ((,tToSend) <$> auth, r)
+mkTransmission :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> ClientCommand msg -> ExceptT (ProtocolClientError err) IO (SentRawTransmission, TMVar (Response err msg))
+mkTransmission ProtocolClient {sessionId, thVersion, client_ = PClient {clientCorrId, sentCommands}} (pKey, qId, cmd) = do
+  corrId <- liftIO $ atomically getNextCorrId
+  let t = signTransmission $ encodeTransmission thVersion sessionId (corrId, qId, cmd)
+  r <- liftIO . atomically $ mkRequest corrId
+  pure (t, r)
  where
    getNextCorrId :: STM CorrId
-    getNextCorrId = CorrId <$> C.randomBytes 24 clientCorrId -- also used as nonce
-    mkRequest :: CorrId -> STM (Request err msg)
+    getNextCorrId = do
+      i <- stateTVar clientCorrId $ \i -> (i, i + 1)
+      pure . CorrId $ bshow i
+    signTransmission :: ByteString -> SentRawTransmission
+    signTransmission t = ((`C.sign` t) <$> pKey, t)
+    mkRequest :: CorrId -> STM (TMVar (Response err msg))
    mkRequest corrId = do
-      r <- Request corrId entId <$> newEmptyTMVar
-      TM.insert corrId r sentCommands
+      r <- newEmptyTMVar
+      TM.insert corrId (Request qId r) sentCommands
      pure r
-
-authTransmission :: Maybe (THandleAuth 'TClient) -> Maybe C.APrivateAuthKey -> CorrId -> ByteString -> Either TransportError (Maybe TransmissionAuth)
-authTransmission thAuth pKey_ (CorrId corrId) t = traverse authenticate pKey_
-  where
-    authenticate :: C.APrivateAuthKey -> Either TransportError TransmissionAuth
-    authenticate (C.APrivateAuthKey a pk) = case a of
-      C.SX25519 -> case thAuth of
-        Just THAuthClient {serverPeerPubKey = k} -> Right $ TAAuthenticator $ C.cbAuthenticate k pk (C.cbNonce corrId) t
-        Nothing -> Left TENoServerAuth
-      C.SEd25519 -> sign pk
-      C.SEd448 -> sign pk
-    sign :: forall a. (C.AlgorithmI a, C.SignatureAlgorithm a) => C.PrivateKey a -> Either TransportError TransmissionAuth
-    sign pk = Right $ TASignature $ C.ASignature (C.sAlgorithm @a) (C.sign' pk t)
-
-$(J.deriveJSON (enumJSON $ dropPrefix "HM") ''HostMode)
-
-$(J.deriveJSON (enumJSON $ dropPrefix "TSM") ''TransportSessionMode)
-
-$(J.deriveJSON defaultJSON ''NetworkConfig)
@@ -1,12 +1,10 @@
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE InstanceSigs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
 {-# OPTIONS_GHC -fno-warn-orphans #-}

@@ -15,50 +13,39 @@ module Simplex.Messaging.Client.Agent where
 import Control.Concurrent (forkIO)
 import Control.Concurrent.Async (Async, uninterruptibleCancel)
 import Control.Logger.Simple
-import Control.Monad
 import Control.Monad.Except
 import Control.Monad.IO.Unlift
 import Control.Monad.Trans.Except
-import Control.Monad.Trans.Reader
-import Crypto.Random (ChaChaDRG)
-import Data.Bifunctor (bimap, first)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
-import Data.Either (partitionEithers)
-import Data.List (partition)
-import Data.List.NonEmpty (NonEmpty)
-import qualified Data.List.NonEmpty as L
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
-import Data.Maybe (listToMaybe)
 import Data.Set (Set)
 import Data.Text.Encoding
-import Data.Tuple (swap)
 import Numeric.Natural
 import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Client
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BrokerMsg, NotifierId, NtfPrivateAuthKey, ProtocolServer (..), QueueId, RcvPrivateAuthKey, RecipientId, SMPServer)
-import Simplex.Messaging.Session
+import Simplex.Messaging.Protocol (BrokerMsg, ProtocolServer (..), QueueId, SMPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport
-import Simplex.Messaging.Util (catchAll_, toChunks, ($>>=))
+import Simplex.Messaging.Util (catchAll_, tryE, unlessM, ($>>=))
 import System.Timeout (timeout)
-import UnliftIO (async)
+import UnliftIO (async, forConcurrently_)
 import UnliftIO.Exception (Exception)
 import qualified UnliftIO.Exception as E
 import UnliftIO.STM

-type SMPClientVar = SessionVar (Either SMPClientError SMPClient)
+type SMPClientVar = TMVar (Either SMPClientError SMPClient)

 data SMPClientAgentEvent
  = CAConnected SMPServer
  | CADisconnected SMPServer (Set SMPSub)
  | CAReconnected SMPServer
-  | CAResubscribed SMPServer (NonEmpty SMPSub)
-  | CASubError SMPServer (NonEmpty (SMPSub, SMPClientError))
+  | CAResubscribed SMPServer SMPSub
+  | CASubError SMPServer SMPSub SMPClientError

 data SMPSubParty = SPRecipient | SPNotifier
  deriving (Eq, Ord, Show)
@@ -68,41 +55,37 @@ type SMPSub = (SMPSubParty, QueueId)
 -- type SMPServerSub = (SMPServer, SMPSub)

 data SMPClientAgentConfig = SMPClientAgentConfig
-  { smpCfg :: ProtocolClientConfig SMPVersion,
+  { smpCfg :: ProtocolClientConfig,
    reconnectInterval :: RetryInterval,
    msgQSize :: Natural,
-    agentQSize :: Natural,
-    agentSubsBatchSize :: Int
+    agentQSize :: Natural
  }

 defaultSMPClientAgentConfig :: SMPClientAgentConfig
 defaultSMPClientAgentConfig =
  SMPClientAgentConfig
-    { smpCfg = defaultSMPClientConfig {defaultTransport = ("5223", transport @TLS)},
+    { smpCfg = defaultClientConfig {defaultTransport = ("5223", transport @TLS)},
      reconnectInterval =
        RetryInterval
          { initialInterval = second,
            increaseAfter = 10 * second,
            maxInterval = 10 * second
          },
-      msgQSize = 256,
-      agentQSize = 256,
-      agentSubsBatchSize = 900
+      msgQSize = 64,
+      agentQSize = 64
    }
  where
    second = 1000000

 data SMPClientAgent = SMPClientAgent
  { agentCfg :: SMPClientAgentConfig,
-    msgQ :: TBQueue (ServerTransmission SMPVersion BrokerMsg),
+    msgQ :: TBQueue (ServerTransmission BrokerMsg),
    agentQ :: TBQueue SMPClientAgentEvent,
-    randomDrg :: TVar ChaChaDRG,
    smpClients :: TMap SMPServer SMPClientVar,
-    srvSubs :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey),
-    pendingSrvSubs :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey),
+    srvSubs :: TMap SMPServer (TMap SMPSub C.APrivateSignKey),
+    pendingSrvSubs :: TMap SMPServer (TMap SMPSub C.APrivateSignKey),
    reconnections :: TVar [Async ()],
-    asyncClients :: TVar [Async ()],
-    workerSeq :: TVar Int
+    asyncClients :: TVar [Async ()]
  }

 newtype InternalException e = InternalException {unInternalException :: e}
@@ -110,28 +93,15 @@ newtype InternalException e = InternalException {unInternalException :: e}

 instance Exception e => Exception (InternalException e)

-instance Exception e => MonadUnliftIO (ExceptT e IO) where
-  {-# INLINE withRunInIO #-}
-  withRunInIO :: ((forall a. ExceptT e IO a -> IO a) -> IO b) -> ExceptT e IO b
-  withRunInIO inner =
-    ExceptT . fmap (first unInternalException) . E.try $
-      withRunInIO $ \run ->
-        inner $ run . (either (E.throwIO . InternalException) pure <=< runExceptT)
-
-- as MonadUnliftIO instance for IO is `withRunInIO inner = inner id`,
-- the last two lines could be replaced with:
-- inner $ either (E.throwIO . InternalException) pure <=< runExceptT
-
-instance Exception e => MonadUnliftIO (ExceptT e (ReaderT r IO)) where
-  {-# INLINE withRunInIO #-}
-  withRunInIO :: ((forall a. ExceptT e (ReaderT r IO) a -> IO a) -> IO b) -> ExceptT e (ReaderT r IO) b
-  withRunInIO inner =
+instance (MonadUnliftIO m, Exception e) => MonadUnliftIO (ExceptT e m) where
+  withRunInIO :: ((forall a. ExceptT e m a -> IO a) -> IO b) -> ExceptT e m b
+  withRunInIO exceptToIO =
    withExceptT unInternalException . ExceptT . E.try $
      withRunInIO $ \run ->
-        inner $ run . (either (E.throwIO . InternalException) pure <=< runExceptT)
+        exceptToIO $ run . (either (E.throwIO . InternalException) return <=< runExceptT)

-newSMPClientAgent :: SMPClientAgentConfig -> TVar ChaChaDRG -> STM SMPClientAgent
-newSMPClientAgent agentCfg@SMPClientAgentConfig {msgQSize, agentQSize} randomDrg = do
+newSMPClientAgent :: SMPClientAgentConfig -> STM SMPClientAgent
+newSMPClientAgent agentCfg@SMPClientAgentConfig {msgQSize, agentQSize} = do
  msgQ <- newTBQueue msgQSize
  agentQ <- newTBQueue agentQSize
  smpClients <- TM.empty
@@ -139,74 +109,67 @@ newSMPClientAgent agentCfg@SMPClientAgentConfig {msgQSize, agentQSize} randomDrg
  pendingSrvSubs <- TM.empty
  reconnections <- newTVar []
  asyncClients <- newTVar []
-  workerSeq <- newTVar 0
-  pure
-    SMPClientAgent
-      { agentCfg,
-        msgQ,
-        agentQ,
-        randomDrg,
-        smpClients,
-        srvSubs,
-        pendingSrvSubs,
-        reconnections,
-        asyncClients,
-        workerSeq
-      }
+  pure SMPClientAgent {agentCfg, msgQ, agentQ, smpClients, srvSubs, pendingSrvSubs, reconnections, asyncClients}

 getSMPServerClient' :: SMPClientAgent -> SMPServer -> ExceptT SMPClientError IO SMPClient
-getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ, randomDrg, workerSeq} srv =
+getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ} srv =
  atomically getClientVar >>= either newSMPClient waitForSMPClient
  where
    getClientVar :: STM (Either SMPClientVar SMPClientVar)
-    getClientVar = getSessVar workerSeq srv smpClients
+    getClientVar = maybe (Left <$> newClientVar) (pure . Right) =<< TM.lookup srv smpClients
+
+    newClientVar :: STM SMPClientVar
+    newClientVar = do
+      smpVar <- newEmptyTMVar
+      TM.insert srv smpVar smpClients
+      pure smpVar

    waitForSMPClient :: SMPClientVar -> ExceptT SMPClientError IO SMPClient
-    waitForSMPClient v = do
+    waitForSMPClient smpVar = do
      let ProtocolClientConfig {networkConfig = NetworkConfig {tcpConnectTimeout}} = smpCfg agentCfg
-      smpClient_ <- liftIO $ tcpConnectTimeout `timeout` atomically (readTMVar $ sessionVar v)
+      smpClient_ <- liftIO $ tcpConnectTimeout `timeout` atomically (readTMVar smpVar)
      liftEither $ case smpClient_ of
        Just (Right smpClient) -> Right smpClient
        Just (Left e) -> Left e
        Nothing -> Left PCEResponseTimeout

    newSMPClient :: SMPClientVar -> ExceptT SMPClientError IO SMPClient
-    newSMPClient v = tryConnectClient pure (liftIO tryConnectAsync)
+    newSMPClient smpVar = tryConnectClient pure tryConnectAsync
      where
        tryConnectClient :: (SMPClient -> ExceptT SMPClientError IO a) -> ExceptT SMPClientError IO () -> ExceptT SMPClientError IO a
        tryConnectClient successAction retryAction =
-          tryE (connectClient v) >>= \r -> case r of
+          tryE connectClient >>= \r -> case r of
            Right smp -> do
              logInfo . decodeUtf8 $ "Agent connected to " <> showServer srv
-              atomically $ putTMVar (sessionVar v) r
+              atomically $ putTMVar smpVar r
              successAction smp
            Left e -> do
              if e == PCENetworkError || e == PCEResponseTimeout
                then retryAction
                else atomically $ do
-                  putTMVar (sessionVar v) (Left e)
-                  removeSessVar v srv smpClients
+                  putTMVar smpVar (Left e)
+                  TM.delete srv smpClients
              throwE e
-        tryConnectAsync :: IO ()
+        tryConnectAsync :: ExceptT SMPClientError IO ()
        tryConnectAsync = do
-          a <- async $ void $ runExceptT connectAsync
+          a <- async connectAsync
          atomically $ modifyTVar' (asyncClients ca) (a :)
        connectAsync :: ExceptT SMPClientError IO ()
        connectAsync =
          withRetryInterval (reconnectInterval agentCfg) $ \_ loop ->
            void $ tryConnectClient (const reconnectClient) loop

-    connectClient :: SMPClientVar -> ExceptT SMPClientError IO SMPClient
-    connectClient v = ExceptT $ getProtocolClient randomDrg (1, srv, Nothing) (smpCfg agentCfg) (Just msgQ) (clientDisconnected v)
+    connectClient :: ExceptT SMPClientError IO SMPClient
+    connectClient = ExceptT $ getProtocolClient (1, srv, Nothing) (smpCfg agentCfg) (Just msgQ) clientDisconnected

-    clientDisconnected :: SMPClientVar -> SMPClient -> IO ()
-    clientDisconnected v _ = do
-      removeClientAndSubs v >>= (`forM_` serverDown)
+    clientDisconnected :: SMPClient -> IO ()
+    clientDisconnected _ = do
+      removeClientAndSubs >>= (`forM_` serverDown)
      logInfo . decodeUtf8 $ "Agent disconnected from " <> showServer srv

-    removeClientAndSubs :: SMPClientVar -> IO (Maybe (Map SMPSub C.APrivateAuthKey))
-    removeClientAndSubs v = atomically $ do
-      removeSessVar v srv smpClients
+    removeClientAndSubs :: IO (Maybe (Map SMPSub C.APrivateSignKey))
+    removeClientAndSubs = atomically $ do
+      TM.delete srv smpClients
      TM.lookupDelete srv (srvSubs ca) >>= mapM updateSubs
      where
        updateSubs sVar = do
@@ -217,17 +180,17 @@ getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ, randomDrg, wo
        addPendingSubs sVar ss = do
          let ps = pendingSrvSubs ca
          TM.lookup srv ps >>= \case
-            Just ss' -> TM.union ss ss'
+            Just v -> TM.union ss v
            _ -> TM.insert srv sVar ps

-    serverDown :: Map SMPSub C.APrivateAuthKey -> IO ()
-    serverDown ss = unless (M.null ss) $ do
+    serverDown :: Map SMPSub C.APrivateSignKey -> IO ()
+    serverDown ss = unless (M.null ss) . void . runExceptT $ do
      notify . CADisconnected srv $ M.keysSet ss
      reconnectServer

-    reconnectServer :: IO ()
+    reconnectServer :: ExceptT SMPClientError IO ()
    reconnectServer = do
-      a <- async $ void $ runExceptT tryReconnectClient
+      a <- async tryReconnectClient
      atomically $ modifyTVar' (reconnections ca) (a :)

    tryReconnectClient :: ExceptT SMPClientError IO ()
@@ -238,50 +201,40 @@ getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ, randomDrg, wo
    reconnectClient :: ExceptT SMPClientError IO ()
    reconnectClient = do
      withSMP ca srv $ \smp -> do
-        liftIO $ notify $ CAReconnected srv
-        cs_ <- atomically $ mapM readTVar =<< TM.lookup srv (pendingSrvSubs ca)
-        forM_ cs_ $ \cs -> do
-          subs' <- filterM (fmap not . atomically . hasSub (srvSubs ca) srv . fst) $ M.assocs cs
-          let (nSubs, rSubs) = partition (isNotifier . fst . fst) subs'
-          subscribe_ smp SPNotifier nSubs
-          subscribe_ smp SPRecipient rSubs
+        notify $ CAReconnected srv
+        cs <- atomically $ mapM readTVar =<< TM.lookup srv (pendingSrvSubs ca)
+        forConcurrently_ (maybe [] M.assocs cs) $ \sub@(s, _) ->
+          unlessM (atomically $ hasSub (srvSubs ca) srv s) $
+            subscribe_ smp sub `catchE` handleError s
      where
-        isNotifier = \case
-          SPNotifier -> True
-          SPRecipient -> False
+        subscribe_ :: SMPClient -> (SMPSub, C.APrivateSignKey) -> ExceptT SMPClientError IO ()
+        subscribe_ smp sub@(s, _) = do
+          smpSubscribe smp sub
+          atomically $ addSubscription ca srv sub
+          notify $ CAResubscribed srv s

-        subscribe_ :: SMPClient -> SMPSubParty -> [(SMPSub, C.APrivateAuthKey)] -> ExceptT SMPClientError IO ()
-        subscribe_ smp party = mapM_ subscribeBatch . toChunks (agentSubsBatchSize agentCfg)
-          where
-            subscribeBatch subs' = do
-              let subs'' :: (NonEmpty (QueueId, C.APrivateAuthKey)) = L.map (first snd) subs'
-              rs <- liftIO $ smpSubscribeQueues party ca smp srv subs''
-              let rs' :: (NonEmpty ((SMPSub, C.APrivateAuthKey), Either SMPClientError ())) =
-                    L.zipWith (first . const) subs' rs
-                  rs'' :: [Either (SMPSub, SMPClientError) (SMPSub, C.APrivateAuthKey)] =
-                    map (\(sub, r) -> bimap (fst sub,) (const sub) r) $ L.toList rs'
-                  (errs, oks) = partitionEithers rs''
-                  (tempErrs, finalErrs) = partition (temporaryClientError . snd) errs
-              mapM_ (atomically . addSubscription ca srv) oks
-              mapM_ (liftIO . notify . CAResubscribed srv) $ L.nonEmpty $ map fst oks
-              mapM_ (atomically . removePendingSubscription ca srv . fst) finalErrs
-              mapM_ (liftIO . notify . CASubError srv) $ L.nonEmpty finalErrs
-              mapM_ (throwE . snd) $ listToMaybe tempErrs
+        handleError :: SMPSub -> SMPClientError -> ExceptT SMPClientError IO ()
+        handleError s = \case
+          e@PCEResponseTimeout -> throwE e
+          e@PCENetworkError -> throwE e
+          e -> do
+            notify $ CASubError srv s e
+            atomically $ removePendingSubscription ca srv s

-    notify :: SMPClientAgentEvent -> IO ()
+    notify :: SMPClientAgentEvent -> ExceptT SMPClientError IO ()
    notify evt = atomically $ writeTBQueue (agentQ ca) evt

-closeSMPClientAgent :: SMPClientAgent -> IO ()
-closeSMPClientAgent c = do
+closeSMPClientAgent :: MonadUnliftIO m => SMPClientAgent -> m ()
+closeSMPClientAgent c = liftIO $ do
  closeSMPServerClients c
  cancelActions $ reconnections c
  cancelActions $ asyncClients c

 closeSMPServerClients :: SMPClientAgent -> IO ()
-closeSMPServerClients c = atomically (smpClients c `swapTVar` M.empty) >>= mapM_ (forkIO . closeClient)
+closeSMPServerClients c = readTVarIO (smpClients c) >>= mapM_ (forkIO . closeClient)
  where
-    closeClient v =
-      atomically (readTMVar $ sessionVar v) >>= \case
+    closeClient smpVar =
+      atomically (readTMVar smpVar) >>= \case
        Right smp -> closeProtocolClient smp `catchAll_` pure ()
        _ -> pure ()

@@ -296,70 +249,40 @@ withSMP ca srv action = (getSMPServerClient' ca srv >>= action) `catchE` logSMPE
      liftIO $ putStrLn $ "SMP error (" <> show srv <> "): " <> show e
      throwE e

-subscribeQueue :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateAuthKey) -> ExceptT SMPClientError IO ()
+subscribeQueue :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateSignKey) -> ExceptT SMPClientError IO ()
 subscribeQueue ca srv sub = do
  atomically $ addPendingSubscription ca srv sub
-  withSMP ca srv $ \smp -> subscribe_ smp `catchE` handleErr
+  withSMP ca srv $ \smp -> subscribe_ smp `catchE` handleError
  where
    subscribe_ smp = do
      smpSubscribe smp sub
      atomically $ addSubscription ca srv sub

-    handleErr e = do
+    handleError e = do
      atomically . when (e /= PCENetworkError && e /= PCEResponseTimeout) $
-        removePendingSubscription ca srv (fst sub)
+        removePendingSubscription ca srv $ fst sub
      throwE e

-subscribeQueuesSMP :: SMPClientAgent -> SMPServer -> NonEmpty (RecipientId, RcvPrivateAuthKey) -> IO (NonEmpty (RecipientId, Either SMPClientError ()))
-subscribeQueuesSMP = subscribeQueues_ SPRecipient
-
-subscribeQueuesNtfs :: SMPClientAgent -> SMPServer -> NonEmpty (NotifierId, NtfPrivateAuthKey) -> IO (NonEmpty (NotifierId, Either SMPClientError ()))
-subscribeQueuesNtfs = subscribeQueues_ SPNotifier
-
-subscribeQueues_ :: SMPSubParty -> SMPClientAgent -> SMPServer -> NonEmpty (QueueId, C.APrivateAuthKey) -> IO (NonEmpty (QueueId, Either SMPClientError ()))
-subscribeQueues_ party ca srv subs = do
-  atomically $ forM_ subs $ addPendingSubscription ca srv . first (party,)
-  runExceptT (getSMPServerClient' ca srv) >>= \case
-    Left e -> pure $ L.map ((,Left e) . fst) subs
-    Right smp -> smpSubscribeQueues party ca smp srv subs
-
-smpSubscribeQueues :: SMPSubParty -> SMPClientAgent -> SMPClient -> SMPServer -> NonEmpty (QueueId, C.APrivateAuthKey) -> IO (NonEmpty (QueueId, Either SMPClientError ()))
-smpSubscribeQueues party ca smp srv subs = do
-  rs <- L.zip subs <$> subscribe smp (L.map swap subs)
-  atomically $ forM rs $ \(sub, r) ->
-    (fst sub,) <$> case r of
-      Right () -> do
-        addSubscription ca srv $ first (party,) sub
-        pure $ Right ()
-      Left e -> do
-        when (e /= PCENetworkError && e /= PCEResponseTimeout) $
-          removePendingSubscription ca srv (party, fst sub)
-        pure $ Left e
-  where
-    subscribe = case party of
-      SPRecipient -> subscribeSMPQueues
-      SPNotifier -> subscribeSMPQueuesNtfs
-
 showServer :: SMPServer -> ByteString
 showServer ProtocolServer {host, port} =
  strEncode host <> B.pack (if null port then "" else ':' : port)

-smpSubscribe :: SMPClient -> (SMPSub, C.APrivateAuthKey) -> ExceptT SMPClientError IO ()
+smpSubscribe :: SMPClient -> (SMPSub, C.APrivateSignKey) -> ExceptT SMPClientError IO ()
 smpSubscribe smp ((party, queueId), privKey) = subscribe_ smp privKey queueId
  where
    subscribe_ = case party of
      SPRecipient -> subscribeSMPQueue
      SPNotifier -> subscribeSMPQueueNotifications

-addSubscription :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateAuthKey) -> STM ()
+addSubscription :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateSignKey) -> STM ()
 addSubscription ca srv sub = do
  addSub_ (srvSubs ca) srv sub
  removePendingSubscription ca srv $ fst sub

-addPendingSubscription :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateAuthKey) -> STM ()
+addPendingSubscription :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateSignKey) -> STM ()
 addPendingSubscription = addSub_ . pendingSrvSubs

-addSub_ :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey) -> SMPServer -> (SMPSub, C.APrivateAuthKey) -> STM ()
+addSub_ :: TMap SMPServer (TMap SMPSub C.APrivateSignKey) -> SMPServer -> (SMPSub, C.APrivateSignKey) -> STM ()
 addSub_ subs srv (s, key) =
  TM.lookup srv subs >>= \case
    Just m -> TM.insert s key m
@@ -371,11 +294,11 @@ removeSubscription = removeSub_ . srvSubs
 removePendingSubscription :: SMPClientAgent -> SMPServer -> SMPSub -> STM ()
 removePendingSubscription = removeSub_ . pendingSrvSubs

-removeSub_ :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey) -> SMPServer -> SMPSub -> STM ()
+removeSub_ :: TMap SMPServer (TMap SMPSub C.APrivateSignKey) -> SMPServer -> SMPSub -> STM ()
 removeSub_ subs srv s = TM.lookup srv subs >>= mapM_ (TM.delete s)

-getSubKey :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey) -> SMPServer -> SMPSub -> STM (Maybe C.APrivateAuthKey)
+getSubKey :: TMap SMPServer (TMap SMPSub C.APrivateSignKey) -> SMPServer -> SMPSub -> STM (Maybe C.APrivateSignKey)
 getSubKey subs srv s = TM.lookup srv subs $>>= TM.lookup s

-hasSub :: TMap SMPServer (TMap SMPSub C.APrivateAuthKey) -> SMPServer -> SMPSub -> STM Bool
+hasSub :: TMap SMPServer (TMap SMPSub C.APrivateSignKey) -> SMPServer -> SMPSub -> STM Bool
 hasSub subs srv s = maybe (pure False) (TM.member s) =<< TM.lookup srv subs
@@ -1,45 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE OverloadedStrings #-}
-
-module Simplex.Messaging.Compression where
-
-import qualified Codec.Compression.Zstd as Z1
-import Data.ByteString (ByteString)
-import qualified Data.ByteString as B
-import Simplex.Messaging.Encoding
-
-data Compressed
-  = -- | Short messages are left intact to skip copying and FFI festivities.
-    Passthrough ByteString
-  | -- | Generic compression using no extra context.
-    Compressed Large
-
-- | Messages below this length are not encoded to avoid compression overhead.
-maxLengthPassthrough :: Int
-maxLengthPassthrough = 180 -- Sampled from real client data. Messages with length > 180 rapidly gain compression ratio.
-
-compressionLevel :: Num a => a
-compressionLevel = 3
-
-instance Encoding Compressed where
-  smpEncode = \case
-    Passthrough bytes -> "0" <> smpEncode bytes
-    Compressed bytes -> "1" <> smpEncode bytes
-  smpP =
-    smpP >>= \case
-      '0' -> Passthrough <$> smpP
-      '1' -> Compressed <$> smpP
-      x -> fail $ "unknown Compressed tag: " <> show x
-
-compress1 :: ByteString -> Compressed
-compress1 bs
-  | B.length bs <= maxLengthPassthrough = Passthrough bs
-  | otherwise = Compressed . Large $ Z1.compress compressionLevel bs
-
-decompress1 :: Compressed -> Either String ByteString
-decompress1 = \case
-  Passthrough bs -> Right bs
-  Compressed (Large bs) -> case Z1.decompress bs of
-    Z1.Error e -> Left e
-    Z1.Skip -> Right mempty
-    Z1.Decompress bs' -> Right bs'
@@ -3,12 +3,10 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
-{-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE RankNTypes #-}
@@ -37,13 +35,11 @@ module Simplex.Messaging.Crypto
    Algorithm (..),
    SAlgorithm (..),
    Alg (..),
-    AuthAlg (..),
+    SignAlg (..),
    DhAlg (..),
    DhAlgorithm,
    PrivateKey (..),
    PublicKey (..),
-    PrivateKeyEd25519,
-    PublicKeyEd25519,
    PrivateKeyX25519,
    PublicKeyX25519,
    PrivateKeyX448,
@@ -54,32 +50,20 @@ module Simplex.Messaging.Crypto
    APublicVerifyKey (..),
    APrivateDhKey (..),
    APublicDhKey (..),
-    APrivateAuthKey (..),
-    APublicAuthKey (..),
    CryptoPublicKey (..),
    CryptoPrivateKey (..),
-    AAuthKeyPair,
    KeyPair,
-    KeyPairX25519,
    ASignatureKeyPair,
    DhSecret (..),
    DhSecretX25519,
    ADhSecret (..),
    KeyHash (..),
-    newRandom,
-    newRandomDRG,
-    generateAKeyPair,
    generateKeyPair,
+    generateKeyPair',
    generateSignatureKeyPair,
-    generateAuthKeyPair,
    generateDhKeyPair,
    privateToX509,
-    x509ToPublic,
-    x509ToPrivate,
    publicKey,
-    signatureKeyPair,
-    publicToX509,
-    encodeASNObj,

    -- * key encoding/decoding
    encodePubKey,
@@ -94,20 +78,11 @@ module Simplex.Messaging.Crypto
    CryptoSignature (..),
    SignatureSize (..),
    SignatureAlgorithm,
-    AuthAlgorithm,
    AlgorithmI (..),
    sign,
-    sign',
    verify,
    verify',
    validSignatureSize,
-    checkAlgorithm,
-
-    -- * crypto_box authenticator, as discussed in https://groups.google.com/g/sci.crypt/c/73yb5a9pz2Y/m/LNgRO7IYXOwJ
-    CbAuthenticator (..),
-    cbAuthenticatorSize,
-    cbAuthenticate,
-    cbVerify,

    -- * DH derivation
    dh',
@@ -124,6 +99,7 @@ module Simplex.Messaging.Crypto
    decryptAESNoPad,
    authTagSize,
    randomAesKey,
+    randomIV,
    randomGCMIV,
    ivSize,
    gcmIVSize,
@@ -133,14 +109,11 @@ module Simplex.Messaging.Crypto
    CbNonce (unCbNonce),
    pattern CbNonce,
    cbEncrypt,
-    cbEncryptNoPad,
    cbEncryptMaxLenBS,
    cbDecrypt,
-    cbDecryptNoPad,
-    sbDecrypt_,
-    sbEncrypt_,
    cbNonce,
    randomCbNonce,
+    pseudoRandomCbNonce,

    -- * NaCl crypto_secretbox
    SbKey (unSbKey),
@@ -152,7 +125,7 @@ module Simplex.Messaging.Crypto
    randomSbKey,

    -- * pseudo-random bytes
-    randomBytes,
+    pseudoRandomBytes,

    -- * digests
    sha256Hash,
@@ -162,19 +135,6 @@ module Simplex.Messaging.Crypto
    pad,
    unPad,

-    -- * X509 Certificates
-    SignedCertificate,
-    Certificate,
-    signCertificate,
-    signX509,
-    verifyX509,
-    certificateFingerprint,
-    signedFingerprint,
-    SignatureAlgorithmX509 (..),
-    SignedObject (..),
-    encodeCertChain,
-    certChainP,
-
    -- * Cryptography error type
    CryptoError (..),

@@ -189,20 +149,19 @@ where

 import Control.Concurrent.STM
 import Control.Exception (Exception)
-import Control.Monad
 import Control.Monad.Except
 import Control.Monad.Trans.Except
 import Crypto.Cipher.AES (AES256)
 import qualified Crypto.Cipher.Types as AES
 import qualified Crypto.Cipher.XSalsa as XSalsa
 import qualified Crypto.Error as CE
-import Crypto.Hash (Digest, SHA256 (..), SHA512 (..), hash, hashDigestSize)
+import Crypto.Hash (Digest, SHA256, SHA512, hash)
 import qualified Crypto.MAC.Poly1305 as Poly1305
 import qualified Crypto.PubKey.Curve25519 as X25519
 import qualified Crypto.PubKey.Curve448 as X448
 import qualified Crypto.PubKey.Ed25519 as Ed25519
 import qualified Crypto.PubKey.Ed448 as Ed448
-import Crypto.Random (ChaChaDRG, MonadPseudoRandom, drgNew, randomBytesGenerate, withDRG)
+import Crypto.Random (ChaChaDRG, getRandomBytes, randomBytesGenerate)
 import Data.ASN1.BinaryEncoding
 import Data.ASN1.Encoding
 import Data.ASN1.Types
@@ -218,13 +177,11 @@ import qualified Data.ByteString.Char8 as B
 import Data.ByteString.Lazy (fromStrict, toStrict)
 import Data.Constraint (Dict (..))
 import Data.Kind (Constraint, Type)
-import qualified Data.List.NonEmpty as L
 import Data.String
 import Data.Type.Equality
 import Data.Typeable (Proxy (Proxy), Typeable)
 import Data.Word (Word32)
 import Data.X509
-import Data.X509.Validation (Fingerprint (..), getFingerprint)
 import Database.SQLite.Simple.FromField (FromField (..))
 import Database.SQLite.Simple.ToField (ToField (..))
 import GHC.TypeLits (ErrorMessage (..), KnownNat, Nat, TypeError, natVal, type (+))
@@ -244,14 +201,16 @@ data SAlgorithm :: Algorithm -> Type where
  SX25519 :: SAlgorithm X25519
  SX448 :: SAlgorithm X448

+deriving instance Eq (SAlgorithm a)
+
 deriving instance Show (SAlgorithm a)

 data Alg = forall a. AlgorithmI a => Alg (SAlgorithm a)

-data AuthAlg
+data SignAlg
  = forall a.
-    (AlgorithmI a, AuthAlgorithm a) =>
-    AuthAlg (SAlgorithm a)
+    (AlgorithmI a, SignatureAlgorithm a) =>
+    SignAlg (SAlgorithm a)

 data DhAlg
  = forall a.
@@ -296,16 +255,13 @@ data APublicKey
    AlgorithmI a =>
    APublicKey (SAlgorithm a) (PublicKey a)

-instance Encoding APublicKey where
-  smpEncode = smpEncode . encodePubKey
-  {-# INLINE smpEncode #-}
-  smpDecode = decodePubKey
-  {-# INLINE smpDecode #-}
+instance Eq APublicKey where
+  APublicKey a k == APublicKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False

 deriving instance Show APublicKey

-type PublicKeyEd25519 = PublicKey Ed25519
-
 type PublicKeyX25519 = PublicKey X25519

 type PublicKeyX448 = PublicKey X448
@@ -321,10 +277,6 @@ deriving instance Eq (PrivateKey a)

 deriving instance Show (PrivateKey a)

-- Do not enable, to avoid leaking key data
-- instance StrEncoding (PrivateKey Ed25519) where
-
-- Used in notification store log
 instance StrEncoding (PrivateKey X25519) where
  strEncode = strEncode . encodePrivKey
  {-# INLINE strEncode #-}
@@ -336,9 +288,12 @@ data APrivateKey
    AlgorithmI a =>
    APrivateKey (SAlgorithm a) (PrivateKey a)

-deriving instance Show APrivateKey
+instance Eq APrivateKey where
+  APrivateKey a k == APrivateKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False

-type PrivateKeyEd25519 = PrivateKey Ed25519
+deriving instance Show APrivateKey

 type PrivateKeyX25519 = PrivateKey X25519

@@ -361,6 +316,11 @@ data APrivateSignKey
    (AlgorithmI a, SignatureAlgorithm a) =>
    APrivateSignKey (SAlgorithm a) (PrivateKey a)

+instance Eq APrivateSignKey where
+  APrivateSignKey a k == APrivateSignKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False
+
 deriving instance Show APrivateSignKey

 instance Encoding APrivateSignKey where
@@ -380,6 +340,11 @@ data APublicVerifyKey
    (AlgorithmI a, SignatureAlgorithm a) =>
    APublicVerifyKey (SAlgorithm a) (PublicKey a)

+instance Eq APublicVerifyKey where
+  APublicVerifyKey a k == APublicVerifyKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False
+
 deriving instance Show APublicVerifyKey

 data APrivateDhKey
@@ -387,6 +352,11 @@ data APrivateDhKey
    (AlgorithmI a, DhAlgorithm a) =>
    APrivateDhKey (SAlgorithm a) (PrivateKey a)

+instance Eq APrivateDhKey where
+  APrivateDhKey a k == APrivateDhKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False
+
 deriving instance Show APrivateDhKey

 data APublicDhKey
@@ -394,6 +364,11 @@ data APublicDhKey
    (AlgorithmI a, DhAlgorithm a) =>
    APublicDhKey (SAlgorithm a) (PublicKey a)

+instance Eq APublicDhKey where
+  APublicDhKey a k == APublicDhKey a' k' = case testEquality a a' of
+    Just Refl -> k == k'
+    Nothing -> False
+
 deriving instance Show APublicDhKey

 data DhSecret (a :: Algorithm) where
@@ -423,57 +398,6 @@ dhAlgorithm = \case
  SX448 -> Just Dict
  _ -> Nothing

-data APrivateAuthKey
-  = forall a.
-    (AlgorithmI a, AuthAlgorithm a) =>
-    APrivateAuthKey (SAlgorithm a) (PrivateKey a)
-
-instance Eq APrivateAuthKey where
-  APrivateAuthKey a k == APrivateAuthKey a' k' = case testEquality a a' of
-    Just Refl -> k == k'
-    Nothing -> False
-
-deriving instance Show APrivateAuthKey
-
-instance Encoding APrivateAuthKey where
-  smpEncode = smpEncode . encodePrivKey
-  {-# INLINE smpEncode #-}
-  smpDecode = decodePrivKey
-  {-# INLINE smpDecode #-}
-
-instance StrEncoding APrivateAuthKey where
-  strEncode = strEncode . encodePrivKey
-  {-# INLINE strEncode #-}
-  strDecode = decodePrivKey
-  {-# INLINE strDecode #-}
-
-data APublicAuthKey
-  = forall a.
-    (AlgorithmI a, AuthAlgorithm a) =>
-    APublicAuthKey (SAlgorithm a) (PublicKey a)
-
-instance Eq APublicAuthKey where
-  APublicAuthKey a k == APublicAuthKey a' k' = case testEquality a a' of
-    Just Refl -> k == k'
-    Nothing -> False
-
-deriving instance Show APublicAuthKey
-
-- either X25519 or Ed algorithm that can be used to authorize commands to SMP server
-type family AuthAlgorithm (a :: Algorithm) :: Constraint where
-  AuthAlgorithm Ed25519 = ()
-  AuthAlgorithm Ed448 = ()
-  AuthAlgorithm X25519 = ()
-  AuthAlgorithm a =
-    (Int ~ Bool, TypeError (Text "Algorithm " :<>: ShowType a :<>: Text " cannot be used for authorization"))
-
-authAlgorithm :: SAlgorithm a -> Maybe (Dict (AuthAlgorithm a))
-authAlgorithm = \case
-  SEd25519 -> Just Dict
-  SEd448 -> Just Dict
-  SX25519 -> Just Dict
-  _ -> Nothing
-
 dhBytes' :: DhSecret a -> ByteString
 dhBytes' = \case
  DhSecretX25519 s -> BA.convert s
@@ -513,12 +437,6 @@ instance CryptoPublicKey APublicVerifyKey where
    Just Dict -> Right $ APublicVerifyKey a k
    _ -> Left "key does not support signature algorithms"

-instance CryptoPublicKey APublicAuthKey where
-  toPubKey f (APublicAuthKey _ k) = f k
-  pubKey (APublicKey a k) = case authAlgorithm a of
-    Just Dict -> Right $ APublicAuthKey a k
-    _ -> Left "key does not support auth algorithms"
-
 instance CryptoPublicKey APublicDhKey where
  toPubKey f (APublicDhKey _ k) = f k
  pubKey (APublicKey a k) = case dhAlgorithm a of
@@ -535,12 +453,6 @@ instance Encoding APublicVerifyKey where
  smpDecode = decodePubKey
  {-# INLINE smpDecode #-}

-instance Encoding APublicAuthKey where
-  smpEncode = smpEncode . encodePubKey
-  {-# INLINE smpEncode #-}
-  smpDecode = decodePubKey
-  {-# INLINE smpDecode #-}
-
 instance Encoding APublicDhKey where
  smpEncode = smpEncode . encodePubKey
  {-# INLINE smpEncode #-}
@@ -559,12 +471,6 @@ instance StrEncoding APublicVerifyKey where
  strDecode = decodePubKey
  {-# INLINE strDecode #-}

-instance StrEncoding APublicAuthKey where
-  strEncode = strEncode . encodePubKey
-  {-# INLINE strEncode #-}
-  strDecode = decodePubKey
-  {-# INLINE strDecode #-}
-
 instance StrEncoding APublicDhKey where
  strEncode = strEncode . encodePubKey
  {-# INLINE strEncode #-}
@@ -612,13 +518,6 @@ instance CryptoPrivateKey APrivateSignKey where
    Just Dict -> Right $ APrivateSignKey a k
    _ -> Left "key does not support signature algorithms"

-instance CryptoPrivateKey APrivateAuthKey where
-  type PublicKeyType APrivateAuthKey = APublicAuthKey
-  toPrivKey f (APrivateAuthKey _ k) = f k
-  privKey (APrivateKey a k) = case authAlgorithm a of
-    Just Dict -> Right $ APrivateAuthKey a k
-    _ -> Left "key does not support auth algorithms"
-
 instance CryptoPrivateKey APrivateDhKey where
  type PublicKeyType APrivateDhKey = APublicDhKey
  toPrivKey f (APrivateDhKey _ k) = f k
@@ -638,10 +537,6 @@ publicKey = \case
  PrivateKeyX25519 _ k -> PublicKeyX25519 k
  PrivateKeyX448 _ k -> PublicKeyX448 k

-- | Expand signature private key to a key pair.
-signatureKeyPair :: APrivateSignKey -> ASignatureKeyPair
-signatureKeyPair ak@(APrivateSignKey a k) = (APublicVerifyKey a (publicKey k), ak)
-
 encodePrivKey :: CryptoPrivateKey pk => pk -> ByteString
 encodePrivKey = toPrivKey $ encodeASNObj . privateToX509

@@ -662,40 +557,23 @@ type KeyPairType pk = (PublicKeyType pk, pk)

 type KeyPair a = KeyPairType (PrivateKey a)

-type KeyPairX25519 = KeyPair X25519
-
-- TODO narrow key pair types to have the same algorithm in both keys
 type AKeyPair = KeyPairType APrivateKey

 type ASignatureKeyPair = KeyPairType APrivateSignKey

 type ADhKeyPair = KeyPairType APrivateDhKey

-type AAuthKeyPair = KeyPairType APrivateAuthKey
+generateKeyPair :: AlgorithmI a => SAlgorithm a -> IO AKeyPair
+generateKeyPair a = bimap (APublicKey a) (APrivateKey a) <$> generateKeyPair'

-newRandom :: IO (TVar ChaChaDRG)
-newRandom = newTVarIO =<< drgNew
+generateSignatureKeyPair :: (AlgorithmI a, SignatureAlgorithm a) => SAlgorithm a -> IO ASignatureKeyPair
+generateSignatureKeyPair a = bimap (APublicVerifyKey a) (APrivateSignKey a) <$> generateKeyPair'

-newRandomDRG :: TVar ChaChaDRG -> STM (TVar ChaChaDRG)
-newRandomDRG g = newTVar =<< stateTVar g (`withDRG` drgNew)
+generateDhKeyPair :: (AlgorithmI a, DhAlgorithm a) => SAlgorithm a -> IO ADhKeyPair
+generateDhKeyPair a = bimap (APublicDhKey a) (APrivateDhKey a) <$> generateKeyPair'

-generateAKeyPair :: AlgorithmI a => SAlgorithm a -> TVar ChaChaDRG -> STM AKeyPair
-generateAKeyPair a g = bimap (APublicKey a) (APrivateKey a) <$> generateKeyPair g
-
-generateSignatureKeyPair :: (AlgorithmI a, SignatureAlgorithm a) => SAlgorithm a -> TVar ChaChaDRG -> STM ASignatureKeyPair
-generateSignatureKeyPair a g = bimap (APublicVerifyKey a) (APrivateSignKey a) <$> generateKeyPair g
-
-generateAuthKeyPair :: (AlgorithmI a, AuthAlgorithm a) => SAlgorithm a -> TVar ChaChaDRG -> STM AAuthKeyPair
-generateAuthKeyPair a g = bimap (APublicAuthKey a) (APrivateAuthKey a) <$> generateKeyPair g
-
-generateDhKeyPair :: (AlgorithmI a, DhAlgorithm a) => SAlgorithm a -> TVar ChaChaDRG -> STM ADhKeyPair
-generateDhKeyPair a g = bimap (APublicDhKey a) (APrivateDhKey a) <$> generateKeyPair g
-
-generateKeyPair :: forall a. AlgorithmI a => TVar ChaChaDRG -> STM (KeyPair a)
-generateKeyPair g = stateTVar g (`withDRG` generateKeyPair_)
-
-generateKeyPair_ :: forall a. AlgorithmI a => MonadPseudoRandom ChaChaDRG (KeyPair a)
-generateKeyPair_ = case sAlgorithm @a of
+generateKeyPair' :: forall a. AlgorithmI a => IO (KeyPair a)
+generateKeyPair' = case sAlgorithm @a of
  SEd25519 ->
    Ed25519.generateSecretKey >>= \pk ->
      let k = Ed25519.toPublic pk
@@ -717,10 +595,6 @@ instance ToField APrivateSignKey where toField = toField . encodePrivKey

 instance ToField APublicVerifyKey where toField = toField . encodePubKey

-instance ToField APrivateAuthKey where toField = toField . encodePrivKey
-
-instance ToField APublicAuthKey where toField = toField . encodePubKey
-
 instance ToField APrivateDhKey where toField = toField . encodePrivKey

 instance ToField APublicDhKey where toField = toField . encodePubKey
@@ -735,10 +609,6 @@ instance FromField APrivateSignKey where fromField = blobFieldDecoder decodePriv

 instance FromField APublicVerifyKey where fromField = blobFieldDecoder decodePubKey

-instance FromField APrivateAuthKey where fromField = blobFieldDecoder decodePrivKey
-
-instance FromField APublicAuthKey where fromField = blobFieldDecoder decodePubKey
-
 instance FromField APrivateDhKey where fromField = blobFieldDecoder decodePrivKey

 instance FromField APublicDhKey where fromField = blobFieldDecoder decodePubKey
@@ -749,13 +619,15 @@ instance (Typeable a, AlgorithmI a) => FromField (PublicKey a) where fromField =

 instance (Typeable a, AlgorithmI a) => FromField (DhSecret a) where fromField = blobFieldDecoder strDecode

-instance IsString ASignature where
+instance IsString (Maybe ASignature) where
  fromString = parseString $ decode >=> decodeSignature

 data Signature (a :: Algorithm) where
  SignatureEd25519 :: Ed25519.Signature -> Signature Ed25519
  SignatureEd448 :: Ed448.Signature -> Signature Ed448

+deriving instance Eq (Signature a)
+
 deriving instance Show (Signature a)

 data ASignature
@@ -763,6 +635,11 @@ data ASignature
    (AlgorithmI a, SignatureAlgorithm a) =>
    ASignature (SAlgorithm a) (Signature a)

+instance Eq ASignature where
+  ASignature a s == ASignature a' s' = case testEquality a a' of
+    Just Refl -> s == s'
+    _ -> False
+
 deriving instance Show ASignature

 class CryptoSignature s where
@@ -771,17 +648,13 @@ class CryptoSignature s where
  signatureBytes :: s -> ByteString
  decodeSignature :: ByteString -> Either String s

-instance CryptoSignature (Signature s) => StrEncoding (Signature s) where
-  strEncode = serializeSignature
-  strDecode = decodeSignature
-
 instance CryptoSignature ASignature where
  signatureBytes (ASignature _ sig) = signatureBytes sig
  decodeSignature s
    | B.length s == Ed25519.signatureSize =
-        ASignature SEd25519 . SignatureEd25519 <$> ed Ed25519.signature s
+      ASignature SEd25519 . SignatureEd25519 <$> ed Ed25519.signature s
    | B.length s == Ed448.signatureSize =
-        ASignature SEd448 . SignatureEd448 <$> ed Ed448.signature s
+      ASignature SEd448 . SignatureEd448 <$> ed Ed448.signature s
    | otherwise = Left "bad signature size"
    where
      ed alg = first show . CE.eitherCryptoError . alg
@@ -807,9 +680,6 @@ instance SignatureSize (Signature a) where
    SignatureEd25519 _ -> Ed25519.signatureSize
    SignatureEd448 _ -> Ed448.signatureSize

-instance SignatureSize ASignature where
-  signatureSize (ASignature _ s) = signatureSize s
-
 instance SignatureSize APrivateSignKey where
  signatureSize (APrivateSignKey _ k) = signatureSize k

@@ -847,8 +717,6 @@ data CryptoError
    CryptoHeaderError String
  | -- | no sending chain key in ratchet state
    CERatchetState
-  | -- | no decapsulation key in ratchet state
-    CERatchetKEMState
  | -- | header decryption error (could indicate that another key should be tried)
    CERatchetHeader
  | -- | too many skipped messages
@@ -932,13 +800,6 @@ instance StrEncoding KeyHash where
  strEncode = strEncode . unKeyHash
  strP = KeyHash <$> strP

-instance ToJSON KeyHash where
-  toEncoding = strToJEncoding
-  toJSON = strToJSON
-
-instance FromJSON KeyHash where
-  parseJSON = strParseJSON "KeyHash"
-
 instance IsString KeyHash where
  fromString = parseString $ parseAll strP

@@ -1067,11 +928,15 @@ initAEADGCM (Key aesKey) (GCMIV ivBytes) = cryptoFailable $ do
  AES.aeadInit AES.AEAD_GCM cipher ivBytes

 -- | Random AES256 key.
-randomAesKey :: TVar ChaChaDRG -> STM Key
-randomAesKey = fmap Key . randomBytes aesKeySize
+randomAesKey :: IO Key
+randomAesKey = Key <$> getRandomBytes aesKeySize

-randomGCMIV :: TVar ChaChaDRG -> STM GCMIV
-randomGCMIV = fmap GCMIV . randomBytes gcmIVSize
+-- | Random IV bytes for AES256 encryption.
+randomIV :: IO IV
+randomIV = IV <$> getRandomBytes (ivSize @AES256)
+
+randomGCMIV :: IO GCMIV
+randomGCMIV = GCMIV <$> getRandomBytes gcmIVSize

 ivSize :: forall c. AES.BlockCipher c => Int
 ivSize = AES.blockSize (undefined :: c)
@@ -1098,79 +963,6 @@ sign' (PrivateKeyEd448 pk k) msg = SignatureEd448 $ Ed448.sign pk k msg
 sign :: APrivateSignKey -> ByteString -> ASignature
 sign (APrivateSignKey a k) = ASignature a . sign' k

-signCertificate :: APrivateSignKey -> Certificate -> SignedCertificate
-signCertificate = signX509
-
-signX509 :: (ASN1Object o, Eq o, Show o) => APrivateSignKey -> o -> SignedExact o
-signX509 key = fst . objectToSignedExact f
-  where
-    f bytes =
-      ( signatureBytes $ sign key bytes,
-        signatureAlgorithmX509 key,
-        ()
-      )
-{-# INLINE signX509 #-}
-
-verifyX509 :: (ASN1Object o, Eq o, Show o) => APublicVerifyKey -> SignedExact o -> Either String o
-verifyX509 key exact = do
-  signature <- case signedAlg of
-    SignatureALG_IntrinsicHash PubKeyALG_Ed25519 -> ASignature SEd25519 <$> decodeSignature signedSignature
-    SignatureALG_IntrinsicHash PubKeyALG_Ed448 -> ASignature SEd448 <$> decodeSignature signedSignature
-    _ -> Left "unknown x509 signature algorithm"
-  if verify key signature $ getSignedData exact then Right signedObject else Left "bad signature"
-  where
-    Signed {signedObject, signedAlg, signedSignature} = getSigned exact
-{-# INLINE verifyX509 #-}
-
-certificateFingerprint :: SignedCertificate -> KeyHash
-certificateFingerprint = signedFingerprint
-
-signedFingerprint :: (ASN1Object o, Eq o, Show o) => SignedExact o -> KeyHash
-signedFingerprint o = KeyHash fp
-  where
-    Fingerprint fp = getFingerprint o HashSHA256
-
-class SignatureAlgorithmX509 a where
-  signatureAlgorithmX509 :: a -> SignatureALG
-
-instance SignatureAlgorithm a => SignatureAlgorithmX509 (SAlgorithm a) where
-  signatureAlgorithmX509 = \case
-    SEd25519 -> SignatureALG_IntrinsicHash PubKeyALG_Ed25519
-    SEd448 -> SignatureALG_IntrinsicHash PubKeyALG_Ed448
-
-instance SignatureAlgorithmX509 APrivateSignKey where
-  signatureAlgorithmX509 (APrivateSignKey a _) = signatureAlgorithmX509 a
-
-instance SignatureAlgorithmX509 APublicVerifyKey where
-  signatureAlgorithmX509 (APublicVerifyKey a _) = signatureAlgorithmX509 a
-
-- | An instance for 'ASignatureKeyPair' / ('PublicKeyType' pk, pk), without touching its type family.
-instance SignatureAlgorithmX509 pk => SignatureAlgorithmX509 (a, pk) where
-  signatureAlgorithmX509 = signatureAlgorithmX509 . snd
-
-- | A wrapper to marshall signed ASN1 objects, like certificates.
-newtype SignedObject a = SignedObject {getSignedExact :: SignedExact a}
-
-instance (Typeable a, Eq a, Show a, ASN1Object a) => FromField (SignedObject a) where
-  fromField = fmap SignedObject . blobFieldDecoder decodeSignedObject
-
-instance (Eq a, Show a, ASN1Object a) => ToField (SignedObject a) where
-  toField (SignedObject s) = toField $ encodeSignedObject s
-
-instance (Eq a, Show a, ASN1Object a) => Encoding (SignedObject a) where
-  smpEncode (SignedObject exact) = smpEncode . Large $ encodeSignedObject exact
-  smpP = fmap SignedObject . decodeSignedObject . unLarge <$?> smpP
-
-encodeCertChain :: CertificateChain -> L.NonEmpty Large
-encodeCertChain cc = L.fromList $ map Large blobs
-  where
-    CertificateChainRaw blobs = encodeCertificateChain cc
-
-certChainP :: A.Parser CertificateChain
-certChainP = do
-  rawChain <- CertificateChainRaw . map unLarge . L.toList <$> smpP
-  either (fail . show) pure $ decodeCertificateChain rawChain
-
 -- | Signature verification.
 --
 -- Used by SMP servers to authorize SMP commands and by SMP agents to verify messages.
@@ -1187,14 +979,10 @@ dh' :: DhAlgorithm a => PublicKey a -> PrivateKey a -> DhSecret a
 dh' (PublicKeyX25519 k) (PrivateKeyX25519 pk _) = DhSecretX25519 $ X25519.dh k pk
 dh' (PublicKeyX448 k) (PrivateKeyX448 pk _) = DhSecretX448 $ X448.dh k pk

-- | NaCl @crypto_box@ encrypt with padding with a shared DH secret and 192-bit nonce.
+-- | NaCl @crypto_box@ encrypt with a shared DH secret and 192-bit nonce.
 cbEncrypt :: DhSecret X25519 -> CbNonce -> ByteString -> Int -> Either CryptoError ByteString
 cbEncrypt (DhSecretX25519 secret) = sbEncrypt_ secret

-- | NaCl @crypto_box@ encrypt with a shared DH secret and 192-bit nonce (without padding).
-cbEncryptNoPad :: DhSecret X25519 -> CbNonce -> ByteString -> ByteString
-cbEncryptNoPad (DhSecretX25519 secret) (CbNonce nonce) = cryptoBox secret nonce
-
 -- | NaCl @secret_box@ encrypt with a symmetric 256-bit key and 192-bit nonce.
 sbEncrypt :: SbKey -> CbNonce -> ByteString -> Int -> Either CryptoError ByteString
 sbEncrypt (SbKey key) = sbEncrypt_ key
@@ -1216,43 +1004,21 @@ cryptoBox secret nonce s = BA.convert tag <> c
 cbDecrypt :: DhSecret X25519 -> CbNonce -> ByteString -> Either CryptoError ByteString
 cbDecrypt (DhSecretX25519 secret) = sbDecrypt_ secret

-- | NaCl @crypto_box@ decrypt with a shared DH secret and 192-bit nonce (without unpadding).
-cbDecryptNoPad :: DhSecret X25519 -> CbNonce -> ByteString -> Either CryptoError ByteString
-cbDecryptNoPad (DhSecretX25519 secret) = sbDecryptNoPad_ secret
-
 -- | NaCl @secret_box@ decrypt with a symmetric 256-bit key and 192-bit nonce.
 sbDecrypt :: SbKey -> CbNonce -> ByteString -> Either CryptoError ByteString
 sbDecrypt (SbKey key) = sbDecrypt_ key

 -- | NaCl @crypto_box@ decrypt with a shared DH secret and 192-bit nonce.
 sbDecrypt_ :: ByteArrayAccess key => key -> CbNonce -> ByteString -> Either CryptoError ByteString
-sbDecrypt_ secret nonce = unPad <=< sbDecryptNoPad_ secret nonce
-
-- | NaCl @crypto_box@ decrypt with a shared DH secret and 192-bit nonce (without unpadding).
-sbDecryptNoPad_ :: ByteArrayAccess key => key -> CbNonce -> ByteString -> Either CryptoError ByteString
-sbDecryptNoPad_ secret (CbNonce nonce) packet
+sbDecrypt_ secret (CbNonce nonce) packet
  | B.length packet < 16 = Left CBDecryptError
-  | BA.constEq tag' tag = Right msg
+  | BA.constEq tag' tag = unPad msg
  | otherwise = Left CBDecryptError
  where
    (tag', c) = B.splitAt 16 packet
    (rs, msg) = xSalsa20 secret nonce c
    tag = Poly1305.auth rs c

-- type for authentication scheme using NaCl @crypto_box@ over the sha512 digest of the message.
-newtype CbAuthenticator = CbAuthenticator ByteString deriving (Eq, Show)
-
-cbAuthenticatorSize :: Int
-cbAuthenticatorSize = hashDigestSize SHA512 + authTagSize -- 64 + 16 = 80 bytes
-
-- create crypto_box authenticator for a message.
-cbAuthenticate :: PublicKeyX25519 -> PrivateKeyX25519 -> CbNonce -> ByteString -> CbAuthenticator
-cbAuthenticate k pk nonce msg = CbAuthenticator $ cbEncryptNoPad (dh' k pk) nonce (sha512Hash msg)
-
-- verify crypto_box authenticator for a message.
-cbVerify :: PublicKeyX25519 -> PrivateKeyX25519 -> CbNonce -> CbAuthenticator -> ByteString -> Bool
-cbVerify k pk nonce (CbAuthenticator s) authorized = cbDecryptNoPad (dh' k pk) nonce s == Right (sha512Hash authorized)
-
 newtype CbNonce = CryptoBoxNonce {unCbNonce :: ByteString}
  deriving (Eq, Show)

@@ -1284,11 +1050,14 @@ cbNonce s
  where
    len = B.length s

-randomCbNonce :: TVar ChaChaDRG -> STM CbNonce
-randomCbNonce = fmap CryptoBoxNonce . randomBytes 24
+randomCbNonce :: IO CbNonce
+randomCbNonce = CryptoBoxNonce <$> getRandomBytes 24

-randomBytes :: Int -> TVar ChaChaDRG -> STM ByteString
-randomBytes n gVar = stateTVar gVar $ randomBytesGenerate n
+pseudoRandomCbNonce :: TVar ChaChaDRG -> STM CbNonce
+pseudoRandomCbNonce gVar = CryptoBoxNonce <$> pseudoRandomBytes 24 gVar
+
+pseudoRandomBytes :: Int -> TVar ChaChaDRG -> STM ByteString
+pseudoRandomBytes n gVar = stateTVar gVar $ randomBytesGenerate n

 instance Encoding CbNonce where
  smpEncode = unCbNonce
@@ -1325,8 +1094,8 @@ sbKey s
 unsafeSbKey :: ByteString -> SbKey
 unsafeSbKey s = either error id $ sbKey s

-randomSbKey :: TVar ChaChaDRG -> STM SbKey
-randomSbKey gVar = SecretBoxKey <$> randomBytes 32 gVar
+randomSbKey :: IO SbKey
+randomSbKey = SecretBoxKey <$> getRandomBytes 32

 xSalsa20 :: ByteArrayAccess key => key -> ByteString -> ByteString -> (ByteString, ByteString)
 xSalsa20 secret nonce msg = (rs, msg')
@@ -1,123 +0,0 @@
-{-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TemplateHaskell #-}
-
-module Simplex.Messaging.Crypto.File
-  ( CryptoFile (..),
-    CryptoFileArgs (..),
-    CryptoFileHandle (..),
-    FTCryptoError (..),
-    Simplex.Messaging.Crypto.File.readFile,
-    Simplex.Messaging.Crypto.File.writeFile,
-    withFile,
-    hPut,
-    hPutTag,
-    hGet,
-    hGetTag,
-    plain,
-    randomArgs,
-    getFileContentsSize,
-  )
-where
-
-import Control.Exception
-import Control.Monad
-import Control.Monad.Except
-import Crypto.Random (ChaChaDRG)
-import qualified Data.Aeson.TH as J
-import qualified Data.ByteArray as BA
-import Data.ByteString.Char8 (ByteString)
-import qualified Data.ByteString.Char8 as B
-import qualified Data.ByteString.Lazy as LB
-import Data.List.NonEmpty (NonEmpty (..))
-import Data.Maybe (isJust)
-import Simplex.Messaging.Client.Agent ()
-import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.Lazy (LazyByteString)
-import qualified Simplex.Messaging.Crypto.Lazy as LC
-import Simplex.Messaging.Parsers (defaultJSON)
-import Simplex.Messaging.Util (liftEitherWith)
-import System.Directory (getFileSize)
-import UnliftIO (Handle, IOMode (..), liftIO)
-import qualified UnliftIO as IO
-import UnliftIO.STM
-
-- Possibly encrypted local file
-data CryptoFile = CryptoFile {filePath :: FilePath, cryptoArgs :: Maybe CryptoFileArgs}
-  deriving (Eq, Show)
-
-data CryptoFileArgs = CFArgs {fileKey :: C.SbKey, fileNonce :: C.CbNonce}
-  deriving (Eq, Show)
-
-data CryptoFileHandle = CFHandle Handle (Maybe (TVar LC.SbState))
-
-readFile :: CryptoFile -> ExceptT FTCryptoError IO LazyByteString
-readFile (CryptoFile path cfArgs) = do
-  s <- liftIO $ LB.readFile path
-  case cfArgs of
-    Just (CFArgs (C.SbKey key) (C.CbNonce nonce)) -> do
-      let len = LB.length s - fromIntegral C.authTagSize
-      when (len < 0) $ throwError FTCEInvalidFileSize
-      let (s', tag') = LB.splitAt len s
-      (tag :| cs) <- liftEitherWith FTCECryptoError $ LC.secretBox LC.sbDecryptChunk key nonce s'
-      unless (BA.constEq (LB.toStrict tag') tag) $ throwError FTCEInvalidAuthTag
-      pure $ LB.fromChunks cs
-    Nothing -> pure s
-
-writeFile :: CryptoFile -> LazyByteString -> ExceptT FTCryptoError IO ()
-writeFile (CryptoFile path cfArgs) s = do
-  s' <- case cfArgs of
-    Just (CFArgs (C.SbKey key) (C.CbNonce nonce)) ->
-      liftEitherWith FTCECryptoError $ LB.fromChunks <$> LC.secretBoxTailTag LC.sbEncryptChunk key nonce s
-    Nothing -> pure s
-  liftIO $ LB.writeFile path s'
-
-withFile :: CryptoFile -> IOMode -> (CryptoFileHandle -> ExceptT FTCryptoError IO a) -> ExceptT FTCryptoError IO a
-withFile (CryptoFile path cfArgs) mode action = do
-  sb <- forM cfArgs $ \(CFArgs key nonce) ->
-    liftEitherWith FTCECryptoError (LC.sbInit key nonce) >>= newTVarIO
-  ExceptT . IO.withFile path mode $ \h -> runExceptT $ action $ CFHandle h sb
-
-hPut :: CryptoFileHandle -> LazyByteString -> IO ()
-hPut (CFHandle h sb_) s = LB.hPut h =<< maybe (pure s) encrypt sb_
-  where
-    encrypt sb = atomically $ stateTVar sb (`LC.sbEncryptChunkLazy` s)
-
-hPutTag :: CryptoFileHandle -> IO ()
-hPutTag (CFHandle h sb_) = forM_ sb_ $ B.hPut h . BA.convert . LC.sbAuth <=< readTVarIO
-
-hGet :: CryptoFileHandle -> Int -> IO ByteString
-hGet (CFHandle h sb_) n = B.hGet h n >>= maybe pure decrypt sb_
-  where
-    decrypt sb s = atomically $ stateTVar sb (`LC.sbDecryptChunk` s)
-
-- | Read and validate the auth tag.
-- This function should be called after reading the whole file, it assumes you know the file size and read only the needed bytes.
-hGetTag :: CryptoFileHandle -> ExceptT FTCryptoError IO ()
-hGetTag (CFHandle h sb_) = forM_ sb_ $ \sb -> do
-  tag <- liftIO $ B.hGet h C.authTagSize
-  tag' <- LC.sbAuth <$> readTVarIO sb
-  unless (BA.constEq tag tag') $ throwError FTCEInvalidAuthTag
-
-data FTCryptoError
-  = FTCECryptoError C.CryptoError
-  | FTCEInvalidHeader String
-  | FTCEInvalidFileSize
-  | FTCEInvalidAuthTag
-  | FTCEFileIOError String
-  deriving (Show, Eq, Exception)
-
-plain :: FilePath -> CryptoFile
-plain = (`CryptoFile` Nothing)
-
-randomArgs :: TVar ChaChaDRG -> STM CryptoFileArgs
-randomArgs g = CFArgs <$> C.randomSbKey g <*> C.randomCbNonce g
-
-getFileContentsSize :: CryptoFile -> IO Integer
-getFileContentsSize (CryptoFile path cfArgs) = do
-  size <- getFileSize path
-  pure $ if isJust cfArgs then size - fromIntegral C.authTagSize else size
-
-$(J.deriveJSON defaultJSON ''CryptoFileArgs)
-
-$(J.deriveJSON defaultJSON ''CryptoFile)
@@ -1,6 +1,7 @@
 {-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TupleSections #-}
@@ -14,16 +15,11 @@ module Simplex.Messaging.Crypto.Lazy
    sbEncrypt,
    sbDecrypt,
    sbEncryptTailTag,
-    kcbEncryptTailTag,
    sbDecryptTailTag,
-    kcbDecryptTailTag,
    fastReplicate,
-    secretBox,
-    secretBoxTailTag,
    SbState,
    cbInit,
    sbInit,
-    kcbInit,
    sbEncryptChunk,
    sbDecryptChunk,
    sbEncryptChunkLazy,
@@ -41,6 +37,7 @@ import qualified Crypto.MAC.Poly1305 as Poly1305
 import Data.Bifunctor (first)
 import Data.ByteArray (ByteArrayAccess)
 import qualified Data.ByteArray as BA
+import qualified Data.ByteString as S
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
@@ -50,7 +47,6 @@ import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty (..))
 import Foreign (sizeOf)
 import Simplex.Messaging.Crypto (CbNonce, CryptoError (..), DhSecret (..), DhSecretX25519, SbKey, pattern CbNonce, pattern SbKey)
-import Simplex.Messaging.Crypto.SNTRUP761 (KEMHybridSecret (..))
 import Simplex.Messaging.Encoding

 type LazyByteString = LB.ByteString
@@ -92,10 +88,10 @@ unPad = fmap snd . splitLen
 splitLen :: LazyByteString -> Either CryptoError (Int64, LazyByteString)
 splitLen padded
  | LB.length lenStr == 8 = case smpDecode $ LB.toStrict lenStr of
-      Right len
-        | len < 0 -> Left CryptoInvalidMsgError
-        | otherwise -> Right (len, LB.take len rest)
-      Left _ -> Left CryptoInvalidMsgError
+    Right len
+      | len < 0 -> Left CryptoInvalidMsgError
+      | otherwise -> Right (len, LB.take len rest)
+    Left _ -> Left CryptoInvalidMsgError
  | otherwise = Left CryptoInvalidMsgError
  where
    (lenStr, rest) = LB.splitAt 8 padded
@@ -114,10 +110,10 @@ sbDecrypt :: SbKey -> CbNonce -> LazyByteString -> Either CryptoError LazyByteSt
 sbDecrypt (SbKey key) (CbNonce nonce) packet
  | LB.length tag' < 16 = Left CBDecryptError
  | otherwise = case secretBox sbDecryptChunk key nonce c of
-      Right (tag :| cs)
-        | BA.constEq (LB.toStrict tag') tag -> unPad $ LB.fromChunks cs
-        | otherwise -> Left CBDecryptError
-      Left e -> Left e
+    Right (tag :| cs)
+      | BA.constEq (LB.toStrict tag') tag -> unPad $ LB.fromChunks cs
+      | otherwise -> Left CBDecryptError
+    Left e -> Left e
  where
    (tag', c) = LB.splitAt 16 packet

@@ -130,33 +126,13 @@ secretBox sbProcess secret nonce msg = run <$> sbInit_ secret nonce

 -- | NaCl @secret_box@ lazy encrypt with a symmetric 256-bit key and 192-bit nonce with appended auth tag (more efficient with large files).
 sbEncryptTailTag :: SbKey -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
-sbEncryptTailTag (SbKey key) = sbEncryptTailTag_ key
-{-# INLINE sbEncryptTailTag #-}
-
-- | NaCl @crypto_box@ lazy encrypt with with a shared hybrid KEM+DH 256-bit secret and 192-bit nonce with appended auth tag (more efficient with large strings/files).
-kcbEncryptTailTag :: KEMHybridSecret -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
-kcbEncryptTailTag (KEMHybridSecret key) = sbEncryptTailTag_ key
-{-# INLINE kcbEncryptTailTag #-}
-
-sbEncryptTailTag_ :: ByteArrayAccess key => key -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
-sbEncryptTailTag_ key (CbNonce nonce) msg len paddedLen =
+sbEncryptTailTag (SbKey key) (CbNonce nonce) msg len paddedLen =
  LB.fromChunks <$> (secretBoxTailTag sbEncryptChunk key nonce =<< pad msg len paddedLen)

 -- | NaCl @secret_box@ decrypt with a symmetric 256-bit key and 192-bit nonce with appended auth tag (more efficient with large files).
 -- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
 sbDecryptTailTag :: SbKey -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
-sbDecryptTailTag (SbKey key) = sbDecryptTailTag_ key
-{-# INLINE sbDecryptTailTag #-}
-
-- | NaCl @crypto_box@ lazy decrypt with a shared hybrid KEM+DH 256-bit secret and 192-bit nonce with appended auth tag (more efficient with large strings/files).
-- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
-kcbDecryptTailTag :: KEMHybridSecret -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
-kcbDecryptTailTag (KEMHybridSecret key) = sbDecryptTailTag_ key
-{-# INLINE kcbDecryptTailTag #-}
-
-- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
-sbDecryptTailTag_ :: ByteArrayAccess key => key -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
-sbDecryptTailTag_ key (CbNonce nonce) paddedLen packet =
+sbDecryptTailTag (SbKey key) (CbNonce nonce) paddedLen packet =
  case secretBox sbDecryptChunk key nonce c of
    Right (tag :| cs) ->
      let valid = LB.length tag' == 16 && BA.constEq (LB.toStrict tag') tag
@@ -174,7 +150,7 @@ secretBoxTailTag sbProcess secret nonce msg = run <$> sbInit_ secret nonce

 -- passes lazy bytestring via initialized secret box returning the reversed list of chunks
 secretBoxLazy_ :: (SbState -> ByteString -> (ByteString, SbState)) -> SbState -> LazyByteString -> ([ByteString], SbState)
-secretBoxLazy_ sbProcess state = LB.foldlChunks update ([], state)
+secretBoxLazy_ sbProcess state = foldlChunks update ([], state)
  where
    update (cs, st) chunk = let (!c, !st') = sbProcess st chunk in (c : cs, st')

@@ -188,10 +164,6 @@ sbInit :: SbKey -> CbNonce -> Either CryptoError SbState
 sbInit (SbKey secret) (CbNonce nonce) = sbInit_ secret nonce
 {-# INLINE sbInit #-}

-kcbInit :: KEMHybridSecret -> CbNonce -> Either CryptoError SbState
-kcbInit (KEMHybridSecret k) (CbNonce nonce) = sbInit_ k nonce
-{-# INLINE kcbInit #-}
-
 sbInit_ :: ByteArrayAccess key => key -> ByteString -> Either CryptoError SbState
 sbInit_ secret nonce = (state2,) <$> cryptoPassed (Poly1305.initialize rs)
  where
@@ -230,3 +202,10 @@ cryptoPassed :: CE.CryptoFailable b -> Either CryptoError b
 cryptoPassed = \case
  CE.CryptoPassed a -> Right a
  CE.CryptoFailed e -> Left $ CryptoPoly1305Error e
+
+foldlChunks :: (a -> S.ByteString -> a) -> a -> LazyByteString -> a
+foldlChunks f = go
+  where
+    go !a LB.Empty = a
+    go !a (LB.Chunk c cs) = go (f a c) cs
+{-# INLINE foldlChunks #-}
@@ -1,31 +0,0 @@
-{-# LANGUAGE DataKinds #-}
-{-# LANGUAGE GADTs #-}
-{-# LANGUAGE LambdaCase #-}
-
-module Simplex.Messaging.Crypto.SNTRUP761 where
-
-import Crypto.Hash (Digest, SHA256, hash)
-import Data.ByteArray (ScrubbedBytes)
-import qualified Data.ByteArray as BA
-import Data.ByteString (ByteString)
-import Simplex.Messaging.Crypto
-import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.SNTRUP761.Bindings
-
-- Hybrid shared secret for crypto_box is defined as SHA256(DHSecret || KEMSharedKey),
-- similar to https://datatracker.ietf.org/doc/draft-josefsson-ntruprime-hybrid/
-
-newtype KEMHybridSecret = KEMHybridSecret ScrubbedBytes
-
-- | NaCl @crypto_box@ decrypt with a shared hybrid DH + KEM secret and 192-bit nonce.
-kcbDecrypt :: KEMHybridSecret -> CbNonce -> ByteString -> Either CryptoError ByteString
-kcbDecrypt (KEMHybridSecret k) = sbDecrypt_ k
-
-- | NaCl @crypto_box@ encrypt with a shared hybrid DH + KEM secret and 192-bit nonce.
-kcbEncrypt :: KEMHybridSecret -> CbNonce -> ByteString -> Int -> Either CryptoError ByteString
-kcbEncrypt (KEMHybridSecret k) = sbEncrypt_ k
-
-kemHybridSecret :: PublicKeyX25519 -> PrivateKeyX25519 -> KEMSharedKey -> KEMHybridSecret
-kemHybridSecret k pk (KEMSharedKey kem) =
-  let DhSecretX25519 dh = C.dh' k pk
-   in KEMHybridSecret $ BA.convert (hash $ BA.convert dh <> kem :: Digest SHA256)
@@ -1,131 +0,0 @@
-{-# LANGUAGE TypeApplications #-}
-
-module Simplex.Messaging.Crypto.SNTRUP761.Bindings where
-
-import Control.Concurrent.STM
-import Crypto.Random (ChaChaDRG)
-import Data.Aeson (FromJSON (..), ToJSON (..))
-import Data.Bifunctor (bimap)
-import Data.ByteArray (ScrubbedBytes)
-import qualified Data.ByteArray as BA
-import Data.ByteString (ByteString)
-import Database.SQLite.Simple.FromField
-import Database.SQLite.Simple.ToField
-import Foreign (nullPtr)
-import Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines
-import Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
-import Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG (withDRG)
-import Simplex.Messaging.Encoding
-import Simplex.Messaging.Encoding.String
-
-newtype KEMPublicKey = KEMPublicKey ByteString
-  deriving (Eq, Show)
-
-newtype KEMSecretKey = KEMSecretKey ScrubbedBytes
-  deriving (Eq, Show)
-
-newtype KEMCiphertext = KEMCiphertext ByteString
-  deriving (Eq, Show)
-
-newtype KEMSharedKey = KEMSharedKey ScrubbedBytes
-  deriving (Eq, Show)
-
-unsafeRevealKEMSharedKey :: KEMSharedKey -> String
-unsafeRevealKEMSharedKey (KEMSharedKey scrubbed) = show (BA.convert scrubbed :: ByteString)
-{-# DEPRECATED unsafeRevealKEMSharedKey "unsafeRevealKEMSharedKey left in code" #-}
-
-type KEMKeyPair = (KEMPublicKey, KEMSecretKey)
-
-sntrup761Keypair :: TVar ChaChaDRG -> IO KEMKeyPair
-sntrup761Keypair drg =
-  bimap KEMPublicKey KEMSecretKey
-    <$> BA.allocRet
-      c_SNTRUP761_SECRETKEY_SIZE
-      ( \skPtr ->
-          BA.alloc c_SNTRUP761_PUBLICKEY_SIZE $ \pkPtr ->
-            withDRG drg $ c_sntrup761_keypair pkPtr skPtr nullPtr
-      )
-
-sntrup761Enc :: TVar ChaChaDRG -> KEMPublicKey -> IO (KEMCiphertext, KEMSharedKey)
-sntrup761Enc drg (KEMPublicKey pk) =
-  BA.withByteArray pk $ \pkPtr ->
-    bimap KEMCiphertext KEMSharedKey
-      <$> BA.allocRet
-        c_SNTRUP761_SIZE
-        ( \kPtr ->
-            BA.alloc c_SNTRUP761_CIPHERTEXT_SIZE $ \cPtr ->
-              withDRG drg $ c_sntrup761_enc cPtr kPtr pkPtr nullPtr
-        )
-
-sntrup761Dec :: KEMCiphertext -> KEMSecretKey -> IO KEMSharedKey
-sntrup761Dec (KEMCiphertext c) (KEMSecretKey sk) =
-  BA.withByteArray sk $ \skPtr ->
-    BA.withByteArray c $ \cPtr ->
-      KEMSharedKey
-        <$> BA.alloc c_SNTRUP761_SIZE (\kPtr -> c_sntrup761_dec kPtr cPtr skPtr)
-
-instance Encoding KEMSecretKey where
-  smpEncode (KEMSecretKey c) = smpEncode . Large $ BA.convert c
-  smpP = KEMSecretKey . BA.convert . unLarge <$> smpP
-
-instance StrEncoding KEMSecretKey where
-  strEncode (KEMSecretKey pk) = strEncode (BA.convert pk :: ByteString)
-  strP = KEMSecretKey . BA.convert <$> strP @ByteString
-
-instance Encoding KEMPublicKey where
-  smpEncode (KEMPublicKey pk) = smpEncode . Large $ BA.convert pk
-  smpP = KEMPublicKey . BA.convert . unLarge <$> smpP
-
-instance StrEncoding KEMPublicKey where
-  strEncode (KEMPublicKey pk) = strEncode (BA.convert pk :: ByteString)
-  strP = KEMPublicKey . BA.convert <$> strP @ByteString
-
-instance Encoding KEMCiphertext where
-  smpEncode (KEMCiphertext c) = smpEncode . Large $ BA.convert c
-  smpP = KEMCiphertext . BA.convert . unLarge <$> smpP
-
-instance Encoding KEMSharedKey where
-  smpEncode (KEMSharedKey c) = smpEncode (BA.convert c :: ByteString)
-  smpP = KEMSharedKey . BA.convert <$> smpP @ByteString
-
-instance StrEncoding KEMCiphertext where
-  strEncode (KEMCiphertext pk) = strEncode (BA.convert pk :: ByteString)
-  strP = KEMCiphertext . BA.convert <$> strP @ByteString
-
-instance StrEncoding KEMSharedKey where
-  strEncode (KEMSharedKey pk) = strEncode (BA.convert pk :: ByteString)
-  strP = KEMSharedKey . BA.convert <$> strP @ByteString
-
-instance ToJSON KEMSecretKey where
-  toJSON = strToJSON
-  toEncoding = strToJEncoding
-
-instance FromJSON KEMSecretKey where
-  parseJSON = strParseJSON "KEMSecretKey"
-
-instance ToJSON KEMPublicKey where
-  toJSON = strToJSON
-  toEncoding = strToJEncoding
-
-instance FromJSON KEMPublicKey where
-  parseJSON = strParseJSON "KEMPublicKey"
-
-instance ToJSON KEMCiphertext where
-  toJSON = strToJSON
-  toEncoding = strToJEncoding
-
-instance FromJSON KEMCiphertext where
-  parseJSON = strParseJSON "KEMCiphertext"
-
-instance ToField KEMSharedKey where
-  toField (KEMSharedKey k) = toField (BA.convert k :: ByteString)
-
-instance FromField KEMSharedKey where
-  fromField f = KEMSharedKey . BA.convert @ByteString <$> fromField f
-
-instance ToJSON KEMSharedKey where
-  toJSON = strToJSON
-  toEncoding = strToJEncoding
-
-instance FromJSON KEMSharedKey where
-  parseJSON = strParseJSON "KEMSharedKey"
@@ -1,15 +0,0 @@
-module Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines where
-
-#include "sntrup761.h"
-
-c_SNTRUP761_SECRETKEY_SIZE :: Int
-c_SNTRUP761_SECRETKEY_SIZE = #{const SNTRUP761_SECRETKEY_SIZE}
-
-c_SNTRUP761_PUBLICKEY_SIZE :: Int
-c_SNTRUP761_PUBLICKEY_SIZE = #{const SNTRUP761_PUBLICKEY_SIZE}
-
-c_SNTRUP761_CIPHERTEXT_SIZE :: Int
-c_SNTRUP761_CIPHERTEXT_SIZE = #{const SNTRUP761_CIPHERTEXT_SIZE}
-
-c_SNTRUP761_SIZE :: Int
-c_SNTRUP761_SIZE = #{const SNTRUP761_SIZE}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
spaced4ndy	cb46906aae	Merge branch 'master' into ep/test-coverage	2023-06-02 18:05:07 +04:00
Evgeny Poberezkin	1d87f8e420	test coverage	2023-05-29 09:36:37 +01:00