rfc: smp server cluster

2026-08-30 14:08:22 +00:00 · 2024-12-16 10:52:52 +00:00
215 changed files with 10765 additions and 29455 deletions
@@ -1,44 +0,0 @@
-name: 'Set Swap Space'
-description: 'Add moar swap'
-branding:
-  icon: 'crop'
-  color: 'orange'
-inputs:
-  swap-size-gb:
-    description: 'Swap space to create, in Gigabytes.'
-    required: false
-    default: '10'
-runs:
-  using: "composite"
-  steps:
-    - name: Swap space report before modification
-      shell: bash
-      run: |
-        echo "Memory and swap:"
-        free -h
-        echo
-        swapon --show
-        echo
-    - name: Set Swap
-      shell: bash
-      run: |
-          export SWAP_FILE=$(swapon --show=NAME | tail -n 1)
-          echo "Swap file: $SWAP_FILE"
-          if [ -z "$SWAP_FILE" ]; then
-            SWAP_FILE=/opt/swapfile
-          else
-            sudo swapoff $SWAP_FILE
-            sudo rm $SWAP_FILE
-          fi
-          sudo fallocate -l ${{ inputs.swap-size-gb }}G $SWAP_FILE
-          sudo chmod 600 $SWAP_FILE
-          sudo mkswap $SWAP_FILE
-          sudo swapon $SWAP_FILE
-    - name: Swap space report after modification
-      shell: bash
-      run: |
-        echo "Memory and swap:"
-        free -h
-        echo
-        swapon --show
-        echo
@@ -10,25 +10,62 @@ on:
  pull_request:

 jobs:
-
-# =============================
-#       Create release
-# =============================
-
-# Create release, but only if it's triggered by tag push.
-# On pull requests/commits push, this job will always complete.
-
-  maybe-release:
-    runs-on: ubuntu-latest
+  build:
+    name: build-${{ matrix.os }}-${{ matrix.ghc }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-20.04
+            platform_name: 20_04-x86-64
+            ghc: "8.10.7"
+          - os: ubuntu-20.04
+            platform_name: 20_04-x86-64
+            ghc: "9.6.3"
+          - os: ubuntu-22.04
+            platform_name: 22_04-x86-64
+            ghc: "9.6.3"
    steps:
      - name: Clone project
-        if: startsWith(github.ref, 'refs/tags/v')
        uses: actions/checkout@v3

-      - name: Build changelog
-        id: build_changelog
+      - name: Setup Haskell
+        uses: haskell-actions/setup@v2
+        with:
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: "3.10.1.0"
+
+      - name: Cache dependencies
+        uses: actions/cache@v2
+        with:
+          path: |
+            ~/.cabal/store
+            dist-newstyle
+          key: ${{ matrix.os }}-${{ hashFiles('cabal.project', 'simplexmq.cabal') }}
+
+      - name: Build
+        shell: bash
+        run: cabal build --enable-tests
+
+      - name: Test
+        timeout-minutes: 40
+        shell: bash
+        run: cabal test --test-show-details=direct
+
+      - name: Prepare binaries
        if: startsWith(github.ref, 'refs/tags/v')
-        uses: simplex-chat/release-changelog-builder-action@v5
+        shell: bash
+        run: |
+          mv $(cabal list-bin smp-server) smp-server-ubuntu-${{ matrix.platform_name}}
+          mv $(cabal list-bin ntf-server) ntf-server-ubuntu-${{ matrix.platform_name}}
+          mv $(cabal list-bin xftp-server) xftp-server-ubuntu-${{ matrix.platform_name}}
+          mv $(cabal list-bin xftp) xftp-ubuntu-${{ matrix.platform_name}}
+
+      - name: Build changelog
+        if: startsWith(github.ref, 'refs/tags/v')
+        id: build_changelog
+        uses: mikepenz/release-changelog-builder-action@v1
        with:
          configuration: .github/changelog_conf.json
          failOnError: true
@@ -38,8 +75,8 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: simplex-chat/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.ghc != '8.10.7'
+        uses: softprops/action-gh-release@v1
        with:
          body: |
            See full changelog [here](https://github.com/simplex-chat/simplexmq/blob/master/CHANGELOG.md).
@@ -49,241 +86,10 @@ jobs:
          prerelease: true
          files: |
            LICENSE
+            smp-server-ubuntu-${{ matrix.platform_name}}
+            ntf-server-ubuntu-${{ matrix.platform_name}}
+            xftp-server-ubuntu-${{ matrix.platform_name}}
+            xftp-ubuntu-${{ matrix.platform_name}}
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-# =============================
-#        Main build job
-# =============================
-
-  build:
-    name: "ubuntu-${{ matrix.os }}-${{ matrix.arch }}, GHC: ${{ matrix.ghc }}"
-    needs: maybe-release
-    env:
-      apps: "smp-server xftp-server ntf-server xftp"
-    runs-on: ${{ matrix.runner }}
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_HOST_AUTH_METHOD: trust # Allows passwordless access
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-        ports:
-          # Maps tcp port 5432 on service container to the host
-          - 5432:5432
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: 22.04
-            os_underscore: 22_04
-            arch: x86-64
-            runner: "ubuntu-22.04"
-            ghc: "8.10.7"
-            should_run: ${{ !(github.ref == 'refs/heads/stable' || startsWith(github.ref, 'refs/tags/v')) }}
-          - os: 22.04
-            os_underscore: 22_04
-            arch: x86-64
-            runner: "ubuntu-22.04"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 24.04
-            os_underscore: 24_04
-            arch: x86-64
-            runner: "ubuntu-24.04"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 22.04
-            os_underscore: 22_04
-            arch: aarch64
-            runner: "ubuntu-22.04-arm"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 24.04
-            os_underscore: 24_04
-            arch: aarch64
-            runner: "ubuntu-24.04-arm"
-            ghc: "9.6.3"
-            should_run: true
-    steps:
-      - name: Clone project
-        if: matrix.should_run == true
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        if: matrix.should_run == true
-        uses: simplex-chat/docker-setup-buildx-action@v3
-
-      - name: Setup swap
-        if: matrix.ghc == '8.10.7' && matrix.should_run == true
-        uses: ./.github/actions/swap
-        with:
-          swap-size-gb: 20
-
-      - name: Install PostgreSQL 15 client tools
-        if: matrix.os == '22.04' && matrix.should_run == true
-        shell: bash
-        run: |
-          # Import the repository signing key
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          # Add the PostgreSQL APT repository
-          sudo sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-          # Update repository and install postgresql tools
-          sudo apt update
-          sudo apt -y install postgresql-client-15
-
-      - name: Build and cache Docker image
-        if: matrix.should_run == true
-        uses: simplex-chat/docker-build-push-action@v6
-        with:
-          context: .
-          load: true
-          file: Dockerfile.build
-          tags: build/${{ matrix.os }}:latest
-          build-args: |
-            TAG=${{ matrix.os }}
-            GHC=${{ matrix.ghc }}
-
-      - name: Cache dependencies
-        if: matrix.should_run == true
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cabal/store
-            dist-newstyle
-          key: ubuntu-${{ matrix.os }}-${{ matrix.arch }}-ghc${{ matrix.ghc }}-${{ hashFiles('cabal.project', 'simplexmq.cabal') }}
-
-      - name: Start container
-        if: matrix.should_run == true
-        shell: bash
-        run: |
-          docker run -t -d \
-            --device /dev/fuse \
-            --cap-add SYS_ADMIN \
-            --security-opt apparmor:unconfined \
-            --name builder \
-            -v ~/.cabal:/root/.cabal \
-            -v /home/runner/work/_temp:/home/runner/work/_temp \
-            -v ${{ github.workspace }}:/project \
-            build/${{ matrix.os }}:latest
-
-      - name: Build smp-server (postgresql) and tests
-        if: matrix.should_run == true
-        shell: docker exec -t builder sh -eu {0}
-        run: |
-          chmod -fR 777 ~/.cabal ./dist-newstyle || :; git config --global --add safe.directory '*'
-          cabal clean
-          cabal update
-          cabal build --jobs=$(nproc) --enable-tests -fserver_postgres
-          mkdir -p /out
-          for i in smp-server simplexmq-test; do
-            bin=$(find /project/dist-newstyle -name "$i" -type f -executable)
-            chmod +x "$bin"
-            mv "$bin" /out/
-          done
-          strip /out/smp-server
-
-      - name: Copy simplexmq-test from container
-        if: matrix.should_run == true
-        shell: bash
-        run: |
-          docker cp builder:/out/simplexmq-test .
-
-      - name: Copy smp-server (postgresql) from container and prepare it
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        id: prepare-postgres
-        shell: bash
-        run: |
-          name="smp-server-postgres-ubuntu-${{ matrix.os_underscore }}-${{ matrix.arch }}"
-          docker cp builder:/out/smp-server $name
-
-          path="${{ github.workspace }}/$name"
-          echo "bin=$path" >> $GITHUB_OUTPUT
-
-          hash="SHA2-256($name)= $(openssl sha256 $path | cut -d' ' -f 2)"
-          printf 'hash=%s' "$hash" >> $GITHUB_OUTPUT
-
-      - name: Build everything else (standard)
-        if: matrix.should_run == true
-        shell: docker exec -t builder sh -eu {0}
-        run: |
-          cabal build --jobs=$(nproc)
-          mkdir -p /out
-          for i in ${{ env.apps }}; do
-            bin=$(find /project/dist-newstyle -name "$i" -type f -executable)
-            strip "$bin"
-            chmod +x "$bin"
-            mv "$bin" /out/
-          done
-
-      - name: Copy binaries from container and prepare them
-        id: prepare-regular
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        shell: bash
-        run: |
-          docker cp builder:/out .
-
-          printf 'bins<<EOF\n' > bins.output
-          printf 'hashes<<EOF\n' > hashes.output
-          for i in ${{ env.apps }}; do
-            name="$i-ubuntu-${{ matrix.os_underscore }}-${{ matrix.arch }}"
-
-            mv ./out/$i ./$name
-
-            path="${{ github.workspace }}/$name"
-            hash="SHA2-256($name)= $(openssl sha256 $path | cut -d' ' -f 2)"
-
-            printf '%s\n' "$path" >> bins.output
-            printf '%s\n\n' "$hash" >> hashes.output
-          done
-          printf 'EOF\n' >> bins.output
-          printf 'EOF\n' >> hashes.output
-
-          cat bins.output >> "$GITHUB_OUTPUT"
-          cat hashes.output >> "$GITHUB_OUTPUT"
-
-      - name: Upload binaries
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        uses: simplex-chat/action-gh-release@v2
-        with:
-          append_body: true
-          prerelease: true
-          fail_on_unmatched_files: true
-          body: |
-            ${{ steps.prepare-regular.outputs.hashes }}
-            ${{ steps.prepare-postgres.outputs.hash }}
-          files: |
-            ${{ steps.prepare-regular.outputs.bins }}
-            ${{ steps.prepare-postgres.outputs.bin }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Test
-        if: matrix.should_run == true && matrix.arch == 'x86-64'
-        timeout-minutes: 120
-        shell: bash
-        env:
-          PGHOST: localhost
-        run: |
-          i=1
-          attempts=1
-          ${{ (github.ref == 'refs/heads/stable' || startsWith(github.ref, 'refs/tags/v')) }} && attempts=3
-          while [ "$i" -le "$attempts" ]; do
-            if ./simplexmq-test; then
-              break
-            else
-              echo "Attempt $i failed, retrying..."
-              i=$((i + 1))
-              sleep 1
-            fi
-          done
-          if [ "$i" -gt "$attempts" ]; then
-            echo "All "$attempts" attempts failed."
-            exit 1
-          fi
@@ -14,22 +14,22 @@ jobs:
      matrix:
        include:
          - app: smp-server
-            app_port: "443 5223"
+            app_port: 5223
          - app: xftp-server
-            app_port: 443
+            app_port: 443 
    steps:
      - name: Clone project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3

      - name: Log in to Docker Hub
-        uses: simplex-chat/docker-login-action@v3
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Extract metadata for Docker image
        id: meta
-        uses: simplex-chat/docker-metadata-action@v5
+        uses: docker/metadata-action@v4
        with:
          images: ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.app }}
          flavor: |
@@ -40,7 +40,7 @@ jobs:
            type=semver,pattern=v{{major}}

      - name: Build and push Docker image
-        uses: simplex-chat/docker-build-push-action@v6
+        uses: docker/build-push-action@v4
        with:
          push: true
          build-args: |
@@ -1,45 +0,0 @@
-name: Reproduce latest release
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 2 * * *' # every day at 02:00 night
-
-jobs:
-  reproduce:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Get latest release
-        shell: bash
-        run: |
-          curl --proto '=https' \
-               --tlsv1.2 \
-               -sSf -L \
-               'https://api.github.com/repos/simplex-chat/simplexmq/releases/latest' \
-               2>/dev/null | \
-          grep -i "tag_name" | \
-          awk -F \" '{print "TAG="$4}' >> $GITHUB_ENV
-
-      - name: Execute reproduce script
-        run: |
-          ${GITHUB_WORKSPACE}/scripts/simplexmq-reproduce-builds.sh "$TAG" || :
-
-      - name: Check if build has been reproduced
-        env:
-          url: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_URL }}
-          user: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_USER }}
-          pass: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_PASS }}
-        run: |
-          if [ -f "${GITHUB_WORKSPACE}/${TAG}-simplexmq/_sha256sums" ]; then
-            exit 0
-          else
-            curl --proto '=https' --tlsv1.2 -sSf \
-              -u "${user}:${pass}" \
-              -H 'Content-Type: application/json' \
-              -d '{"title": "👾 GitHub: Runner", "description": "⛔️ '"$TAG"' did not reproduce."}' \
-              "$url"
-            exit 1
-          fi
@@ -1,111 +1,3 @@
-# 6.4.4
-
-Servers:
- fix server pages when source code is not specified.
- include commit SHA in printed version and in web page (#1608).
-
-SMP server:
- support short SimpleX addresses in server information page (#1600).
- wrap all queries in transactions (#1603).
-
-SMP agent:
- chat relay address type for short links (#1602).
- extend xrcp certificate validity 1 hour in the past, to allow out of sync clocks (#1601).
-
-# 6.4.3
-
-SMP agent:
- fix some connection errors by updating contact request server hosts to match server in short link (#1597).
-
-SMP server:
- support short link URI as queue identifier in control port commands (#1596).
-
-# 6.4.2
-
-SMP server:
- fix memory leak when connection interrupts straight after client connects.
- do not include repeated queue blocking into stats/quota.
-
-XFTP server:
- prometheus metrics
-
-# 6.4.1
-
-SMP protocol:
- create notification credentials via NEW command that creates the queue (#1586)
-
-SMP server:
- control port session improvements (#1591)
- additional stat counter for ntf credentials created together with the queue (#1589)
-
-# 6.4.0
-
-SMP protocol (server/client):
- support associated queue data and short connection links (see [RFC](./rfcs/2025-03-16-smp-queues.md)).
- service certificates to optimize subscriptions.
-
-SMP agent:
- support retries for interactive connection handshakes.
- use web port 443 by default for preset servers.
- use static RNG function to avoid creating dynamic C stubs when generating sntrup keys (it was detected as Dynamic Code Loading in GrapheneOS).
- different timeouts for interactive and background operations.
-
-Ntf server:
- PostgreSQL storage.
- Prometheus metrics.
- use service certificates.
- fix repeat token registration.
-
-# 6.3.2
-
-Servers:
- enable store log by default (#1501).
-
-SMP server:
- reduce memory usage (#1498)
-
-SMP agent:
- handle client/agent version downgrades after connection was established (#1508).
-
-# 6.3.1
-
-Servers:
- handle ECONNABORTED error on client connections.
- reproducible builds.
- blocking records for content moderation.
- update script (simplex-servers-update) downloads scripts from the specified or the latest stable tag.
-
-SMP server:
- support for PostgreSQL database for queue records for higher traffic servers.
- fix old clients sending messages to new servers (#1443)
- remove empty journals when opening message queues and expiring idle queues (#1456, #1458).
- additional start options (#1465):
-  - `maintenance` to run all start/stop operations without starting server.
-  - `skip-warnings` to ignore the last corrupted line in store log (can happen on abnormal termination).
-
-Ntf server:
- record date of last token activity, to allow expiring inactive tokens.
- additional token invalidation reasons in logs.
-
-SMP agent:
- store message sent to multiple connections only once, to reduce storage when sending to groups (#1453).
- encrypt messages on delivery, to reduce database writes (#1446).
- don't block method calls on congested sockets for better concurrency (#1454).
- check notification token status on client connection.
- option to skip SQLite vacuum on migrations.
-
-# 6.3.0
-
-SMP agent: fix joining connection after failure by using the same ratchet.
-
-# 6.2.2
-
-SMP server:
- add optional Prometheus metrics (#1411).
-
-Build:
- remove three modules from client library.
-
 # 6.2.0

 Version 6.2.0.7
@@ -132,7 +24,7 @@ Servers: more reliable restoring of state.

 SMP server: reduced memory usage and faster start.

-Notifications: compensate for iOS notifications being dropped by Apple while device is offline (#1378):
+Notifications: compensate for iOS notifications being droppted by Apple while device is offline (#1378):
 - Ntf server: send multiple SMP notifications in one iOS notification.
 - Agent: get multiple messages for one iOS notification.

@@ -1,20 +1,15 @@
-# syntax=docker/dockerfile:1.7.0-labs
-ARG TAG=24.04
+ARG TAG=22.04

 FROM ubuntu:${TAG} AS build

 ### Build stage

 # Install curl and git and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-18 llvm-18-dev libnuma-dev libssl-dev
+RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev libssl-dev

 # Specify bootstrap Haskell versions
 ENV BOOTSTRAP_HASKELL_GHC_VERSION=9.6.3
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.12.1.0
-
-# Do not install Stack
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK=true
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=true
+ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.10.1.0

 # Install ghcup
 RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
@@ -26,42 +21,26 @@ ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"
 RUN ghcup set ghc "${BOOTSTRAP_HASKELL_GHC_VERSION}" && \
    ghcup set cabal "${BOOTSTRAP_HASKELL_CABAL_VERSION}"

-# Copy only the source code
-COPY apps /project/apps/
-COPY cbits /project/cbits/
-COPY src /project/src/
-
-COPY cabal.project Setup.hs simplexmq.cabal LICENSE /project
-
+COPY . /project
 WORKDIR /project

-# Debug
-#ARG CACHEBUST=1
-
-#ADD --chmod=755 https://github.com/MShekow/directory-checksum/releases/download/v1.4.6/directory-checksum_1.4.6_linux_amd64 /usr/local/bin/directory-checksum
-#RUN directory-checksum --max-depth 2 .
-
-# Set build arguments and check if they exist
 ARG APP
-RUN if [ -z "$APP" ]; then printf "Please spcify \$APP build-arg.\n"; exit 1; fi
+ARG APP_PORT
+RUN if [ -z "$APP" ] || [ -z "$APP_PORT" ]; then printf "Please spcify \$APP and \$APP_PORT build-arg.\n"; exit 1; fi

 # Compile app
 RUN cabal update
 RUN cabal build exe:$APP

-# Copy scripts
-COPY scripts /project/scripts/
-
 # Create new path containing all files needed
 RUN mkdir /final
 WORKDIR /final

 # Strip the binary from debug symbols to reduce size
-RUN bin="$(find /project/dist-newstyle -name "$APP" -type f -executable)" && \
+RUN bin=$(find /project/dist-newstyle -name "$APP" -type f -executable) && \
    mv "$bin" ./ && \
    strip ./"$APP" &&\
-    mv /project/scripts/docker/entrypoint-"$APP" ./entrypoint &&\
-    mv /project/scripts/main/simplex-servers-stopscript ./simplex-servers-stopscript
+    mv /project/scripts/docker/entrypoint-"$APP" ./entrypoint

 ### Final stage
 FROM ubuntu:${TAG}
@@ -74,8 +53,6 @@ COPY --from=build /final /usr/local/bin/

 # Open app listening port
 ARG APP_PORT
-RUN if [ -z "$APP_PORT" ]; then printf "Please spcify \$APP_PORT build-arg.\n"; exit 1; fi
-
 EXPOSE $APP_PORT

 # simplexmq requires using SIGINT to correctly preserve undelivered messages and restore them on restart
@@ -1,31 +0,0 @@
-# syntax=docker/dockerfile:1.7.0-labs
-ARG TAG=24.04
-FROM ubuntu:${TAG} AS build
-
-### Build stage
-
-ARG GHC=9.6.3
-ARG CABAL=3.14.1.1
-
-# Install curl, git and and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl libpq-dev git sqlite3 libsqlite3-dev build-essential libgmp3-dev zlib1g-dev llvm llvm-dev libnuma-dev libssl-dev
-
-# Specify bootstrap Haskell versions
-ENV BOOTSTRAP_HASKELL_GHC_VERSION=${GHC}
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=${CABAL}
-
-# Do not install Stack
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK=true
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=true
-
-# Install ghcup
-RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
-
-# Adjust PATH
-ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"
-
-# Set both as default
-RUN ghcup set ghc "${GHC}" && \
-    ghcup set cabal "${CABAL}"
-
-WORKDIR /project
@@ -1,6 +1,6 @@
 # SimpleXMQ

-[![GitHub build](https://github.com/simplex-chat/simplexmq/actions/workflows/build.yml/badge.svg)](https://github.com/simplex-chat/simplexmq/actions/workflows/build.yml)
+[![GitHub build](https://github.com/simplex-chat/simplexmq/workflows/build/badge.svg)](https://github.com/simplex-chat/simplexmq/actions?query=workflow%3Abuild)
 [![GitHub release](https://img.shields.io/github/v/release/simplex-chat/simplexmq)](https://github.com/simplex-chat/simplexmq/releases)

 📢 SimpleXMQ v1 is released - with many security, privacy and efficiency improvements, new functionality - see [release notes](https://github.com/simplex-chat/simplexmq/releases/tag/v1.0.0).
@@ -116,7 +116,7 @@ On Linux, you can deploy smp and xftp server using Docker. This will download im
 2. Run your Docker container.

   - `smp-server`
-
+   
     You must change **your_ip_or_domain**. `-e "pass=password"` is optional variable to password-protect your `smp` server:
     ```sh
     docker run -d \
@@ -129,7 +129,7 @@ On Linux, you can deploy smp and xftp server using Docker. This will download im
     ```

   - `xftp-server`
-
+   
     You must change **your_ip_or_domain** and **maximum_storage**.
     ```sh
     docker run -d \
@@ -187,7 +187,7 @@ On Linux, you can build smp server using Docker.
 3. Run your Docker container.

   - `smp-server`
-
+   
     You must change **your_ip_or_domain**. `-e "pass=password"` is optional variable to password-protect your `smp` server:
     ```sh
     docker run -d \
@@ -200,7 +200,7 @@ On Linux, you can build smp server using Docker.
     ```

   - `xftp-server`
-
+   
     You must change **your_ip_or_domain** and **maximum_storage**.
     ```sh
     docker run -d \
@@ -247,7 +247,7 @@ On Linux, you can build smp server using Docker.

   `xftp-server`
   ```sh
-   cabal list-bin exe:xftp-server
+   cabal list-bin exe:xftp-server 
   ```

 - Initialize SMP server with `smp-server init [-l] -n <fqdn>` or `smp-server init [-l] --ip <ip>` - depending on how you initialize it, either FQDN or IP will be used for server's address.
@@ -15,6 +15,7 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}

 main :: IO ()
 main = do
+  setLogLevel LogInfo
  cfgPath <- getEnvPath "NTF_SERVER_CFG_PATH" defaultCfgPath
  logPath <- getEnvPath "NTF_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ ntfServerCLI cfgPath logPath
@@ -16,6 +16,7 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}

 main :: IO ()
 main = do
+  setLogLevel LogDebug
  cfgPath <- getEnvPath "SMP_SERVER_CFG_PATH" defaultCfgPath
  logPath <- getEnvPath "SMP_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ smpServerCLI_ Static.generateSite Static.serveStaticFiles Static.attachStaticFiles cfgPath logPath
@@ -1,49 +0,0 @@
-{
-  "applinks": {
-    "details": [
-      {
-        "appIDs": [
-          "5NN7GUYB6T.chat.simplex.app"
-        ],
-        "components": [
-          {
-            "/": "/contact/*"
-          },
-          {
-            "/": "/contact"
-          },
-          {
-            "/": "/invitation/*"
-          },
-          {
-            "/": "/invitation"
-          },
-          {
-            "/": "/a/*"
-          },
-          {
-            "/": "/a"
-          },
-          {
-            "/": "/c/*"
-          },
-          {
-            "/": "/c"
-          },
-          {
-            "/": "/g/*"
-          },
-          {
-            "/": "/g"
-          },
-          {
-            "/": "/i/*"
-          },
-          {
-            "/": "/i"
-          }
-        ]
-      }
-    ]
-  }
-}
@@ -1,16 +0,0 @@
-[
-    {
-        "relation": [
-            "delegate_permission/common.handle_all_urls"
-        ],
-        "target": {
-            "namespace": "android_app",
-            "package_name": "chat.simplex.app",
-            "sha256_cert_fingerprints": [
-                "5E:3E:DC:C2:00:FB:A8:D5:F4:88:F3:CA:4C:32:5B:05:78:C5:6A:9C:03:A1:CC:B5:92:9C:D7:5C:7E:57:E2:4D",
-                "3C:52:C4:FD:3C:AD:1C:07:C9:B0:0A:70:80:E3:58:FA:B9:FE:FC:B8:AF:5A:EC:14:77:65:F1:6D:0F:21:AD:85",
-                "AE:C1:95:DC:FD:46:14:BD:3A:91:EC:26:D1:D5:14:C8:75:71:C5:CC:8D:CF:48:08:3F:92:83:14:3C:A2:B9:A6"
-            ]
-        }
-    }
-]
@@ -1 +0,0 @@
-../link.html
@@ -1 +0,0 @@
-../link.html
@@ -1 +0,0 @@
-../link.html
@@ -223,14 +223,11 @@
            <table id="public-info">
              <tr class="text-grey-black dark:text-white text-base">
                <td>Server version:</td>
-                <td>${version}<x-commit> / <a href="${commitSourceCode}/commit/${commit}" target="_blank">${shortCommit}</a></x-commit></td>
+                <td>${version}</td>
              </tr>
              <tr class="text-grey-black dark:text-white text-base">
                <td>Source code:</td>
-                <td>
-                  <x-sourceCode><a href="${sourceCode}" target="_blank">${sourceCode}</a></x-sourceCode>
-                  <x-noSourceCode>add to smp-server.ini (required by <a href="https://github.com/simplex-chat/simplexmq/blob/stable/LICENSE" target="_blank">AGPLv3</a>)</x-noSourceCode>
-                </td>
+                <td><a href="${sourceCode}" target="_blank">${sourceCode}</a></td>
              </tr>
              <x-website>
                <tr class="text-grey-black dark:text-white text-base">
@@ -142,7 +142,8 @@
    class="hidden xl:block h-screen pt-[66px] bg-white dark:bg-gradient-radial-mobile dark:lg:bg-gradient-radial">
    <div class="container m-auto h-full flex items-center justify-between px-5">
      <div class="flex flex-col items-start justify-center w-full">
-        <h1 class="text-[38px] leading-[43px] font-bold max-w-[500px] mb-[30px] primary-header-contact">This is a one-time link of the SimpleX&nbsp;network user</h1>
+        <h1 class="text-[38px] leading-[43px] font-bold max-w-[500px] mb-[30px] primary-header-contact">You received a
+          1-time link to connect on SimpleX Chat</h1>
        <h2
          class="text-[20px] leading-[28px] text-[#606C71] dark:text-white font-bold max-w-[475px] mb-[80px] secondary-header-contact">
          Scan the QR code with the SimpleX Chat app on your phone or tablet.</h2>
@@ -183,8 +184,10 @@
    class="block xl:hidden pt-[106px] py-[90px] bg-white dark:bg-gradient-radial-mobile dark:lg:bg-gradient-radial">
    <div class="container m-auto px-5">
      <div class="flex flex-col items-center">
-        <h1 class="text-[28px] font-bold text-center max-w-[602px] mb-[40px] primary-header-contact">This is a one-time link of the SimpleX&nbsp;network user</h1>
-        <p class="text-[20px] leading-[28px] text-grey-black dark:text-white font-medium mb-[30px]">To make a connection:</p>
+        <h1 class="text-[28px] font-bold text-center max-w-[602px] mb-[40px] primary-header-contact">You received a
+          1-time link to connect on SimpleX Chat</h1>
+        <p class="text-[20px] leading-[28px] text-grey-black dark:text-white font-medium mb-[30px]">To make a
+          connection:</p>
        <div
          class="flex flex-col justify-center items-center p-4 w-full max-w-[468px] min-h-[131px] rounded-[30px] border-[1px] border-[#A8B0B4] dark:border-white border-opacity-60 mb-6 relative">
          <p class="text-xl font-medium text-grey-black dark:text-white mb-4">Install SimpleX app</p>
@@ -503,17 +506,13 @@
    const url = window.location.href
    const messageElements = document.getElementsByClassName('primary-header-contact')

-    for (let element of messageElements) {
-      if (url.includes('/g') || url.includes('&data=%7B%22groupLinkId%22%3A')) {
-        element.innerHTML = 'This is a public group address on SimpleX&nbsp;network'
-      } else if (url.includes('/a') || url.includes('/contact')) {
-        element.innerHTML = 'This is a public address of the SimpleX&nbsp;network user'
-      } else if (url.includes('/i') || url.includes('/invitation')) {
-        element.innerHTML = 'This is a one-time link of the SimpleX&nbsp;network user'
-      } else if (url.includes('/c')) {
-        element.innerHTML = 'This is a public channel address on SimpleX&nbsp;network'
-      } else if (url.includes('/r')) {
-        element.innerHTML = 'This is a chat relay address on SimpleX&nbsp;network'
+    if (url.includes('/invitation')) {
+      for (let element of messageElements) {
+        element.textContent = 'You received a 1-time link to connect on SimpleX Chat'
+      }
+    } else {
+      for (let element of messageElements) {
+        element.textContent = 'You received an address to connect on SimpleX Chat'
      }
    }
  </script>
@@ -20,18 +20,7 @@
    parsedURI.pathname = "/" + action
    connURI = parsedURI.toString()
    console.log("connection URI: ", connURI)
-    const hash = parsedURI.hash
-    const hostname = parsedURI.hostname
-    let appURI = "simplex:" + parsedURI.pathname
-    appURI += action.length > 1 // not short link
-              ? hash
-              : !hash.includes("?") // otherwise add server hostname
-              ? hash + "?h=" + hostname // no parameters
-              : !hash.includes("?h=") && !hash.includes("&h=")
-              ? hash + "&h=" + hostname // no "h" parameter
-              : hash.replace(/([?&])h=([^&]+)/, `$1h=${hostname},$2`) // add as the first hostname to "h" parameter
-    mobileConnURIanchor.href = appURI
-    console.log("app URI: ", appURI)
+    mobileConnURIanchor.href = "simplex:" + parsedURI.pathname + parsedURI.hash
    connURIel.innerText = "/c " + connURI
    for (const connQRCode of connQRCodes) {
      try {
@@ -12,20 +12,17 @@ import Data.Char (toUpper)
 import Data.IORef (readIORef)
 import Data.Maybe (fromMaybe)
 import Data.String (fromString)
-import qualified Data.Text as T
 import Data.Text.Encoding (encodeUtf8)
 import Network.Socket (getPeerName)
-import Network.Wai (Application, Request (..))
-import Network.Wai.Application.Static (StaticSettings (..))
+import Network.Wai (Application)
 import qualified Network.Wai.Application.Static as S
 import qualified Network.Wai.Handler.Warp as W
 import qualified Network.Wai.Handler.Warp.Internal as WI
 import qualified Network.Wai.Handler.WarpTLS as WT
 import Simplex.Messaging.Encoding.String (strEncode)
 import Simplex.Messaging.Server (AttachHTTP)
-import Simplex.Messaging.Server.CLI (simplexmqCommit)
 import Simplex.Messaging.Server.Information
-import Simplex.Messaging.Server.Main (EmbeddedWebParams (..), WebHttpsParams (..), simplexmqSource)
+import Simplex.Messaging.Server.Main (EmbeddedWebParams (..), WebHttpsParams (..))
 import Simplex.Messaging.Transport (simplexMQVersion)
 import Simplex.Messaging.Transport.Client (TransportHost (..))
 import Simplex.Messaging.Util (tshow)
@@ -34,13 +31,12 @@ import System.Directory (createDirectoryIfMissing)
 import System.FilePath
 import UnliftIO.Concurrent (forkFinally)
 import UnliftIO.Exception (bracket, finally)
-import qualified WaiAppStatic.Types as WAT

 serveStaticFiles :: EmbeddedWebParams -> IO ()
 serveStaticFiles EmbeddedWebParams {webStaticPath, webHttpPort, webHttpsParams} = do
  forM_ webHttpPort $ \port -> flip forkFinally (\e -> logError $ "HTTP server crashed: " <> tshow e) $ do
    logInfo $ "Serving static site on port " <> tshow port
-    W.runSettings (mkSettings port) app
+    W.runSettings (mkSettings port) (S.staticApp $ S.defaultFileServerSettings webStaticPath)
  forM_ webHttpsParams $ \WebHttpsParams {port, cert, key} -> flip forkFinally (\e -> logError $ "HTTPS server crashed: " <> tshow e) $ do
    logInfo $ "Serving static site on port " <> tshow port <> " (TLS)"
    WT.runTLS (WT.tlsSettings cert key) (mkSettings port) app
@@ -76,50 +72,28 @@ warpSettings :: W.Settings
 warpSettings = W.setGracefulShutdownTimeout (Just 1) W.defaultSettings

 staticFiles :: FilePath -> Application
-staticFiles root = S.staticApp settings . changeWellKnownPath
+staticFiles root = S.staticApp settings
  where
-    settings = defSettings {ssListing = Nothing, ssGetMimeType = getMimeType}
-    defSettings = S.defaultFileServerSettings root
-    getMimeType f
-      | WAT.fromPiece (WAT.fileName f) == "apple-app-site-association" = pure "application/json"
-      | otherwise = (ssGetMimeType defSettings) f
-    changeWellKnownPath req = case pathInfo req of
-      ".well-known" : rest ->
-        req
-          { pathInfo = "well-known" : rest,
-            rawPathInfo = "/well-known/" <> B.drop pfxLen (rawPathInfo req)
-          }
-      _ -> req
-    pfxLen = B.length "/.well-known/"
+    settings = (S.defaultFileServerSettings root)
+      { S.ssListing = Nothing
+      }

 generateSite :: ServerInformation -> Maybe TransportHost -> FilePath -> IO ()
 generateSite si onionHost sitePath = do
  createDirectoryIfMissing True sitePath
  B.writeFile (sitePath </> "index.html") $ serverInformation si onionHost
-  copyDir "media" E.mediaContent
-  -- `.well-known` path is re-written in changeWellKnownPath,
-  -- staticApp does not allow hidden folders.
-  copyDir "well-known" E.wellKnown
-  createLinkPage "contact"
-  createLinkPage "invitation"
-  createLinkPage "a"
-  createLinkPage "c"
-  createLinkPage "g"
-  createLinkPage "r"
-  createLinkPage "i"
+  createDirectoryIfMissing True $ sitePath </> "media"
+  forM_ E.mediaContent $ \(path, bs) -> B.writeFile (sitePath </> "media" </> path) bs
+  createDirectoryIfMissing True $ sitePath </> "contact"
+  B.writeFile (sitePath </> "contact" </> "index.html") E.linkHtml
+  createDirectoryIfMissing True $ sitePath </> "invitation"
+  B.writeFile (sitePath </> "invitation" </> "index.html") E.linkHtml
  logInfo $ "Generated static site contents at " <> tshow sitePath
-  where
-    copyDir dir content = do
-      createDirectoryIfMissing True $ sitePath </> dir
-      forM_ content $ \(path, s) -> B.writeFile (sitePath </> dir </> path) s
-    createLinkPage path = do
-      createDirectoryIfMissing True $ sitePath </> path
-      B.writeFile (sitePath </> path </> "index.html") E.linkHtml

 serverInformation :: ServerInformation -> Maybe TransportHost -> ByteString
 serverInformation ServerInformation {config, information} onionHost = render E.indexHtml substs
  where
-    substs = substConfig <> substInfo <> [("onionHost", strEncode <$> onionHost)]
+    substs = substConfig <> maybe [] substInfo information <> [("onionHost", strEncode <$> onionHost)]
    substConfig =
      [ ( "persistence",
          Just $ case persistence config of
@@ -134,7 +108,7 @@ serverInformation ServerInformation {config, information} onionHost = render E.i
      ]
    yesNo True = "Yes"
    yesNo False = "No"
-    substInfo =
+    substInfo spi =
      concat
        [ basic,
          maybe [("usageConditions", Nothing), ("usageAmendments", Nothing)] conds (usageConditions spi),
@@ -146,16 +120,10 @@ serverInformation ServerInformation {config, information} onionHost = render E.i
        ]
      where
        basic =
-          [ ("sourceCode", if T.null sc then Nothing else Just (encodeUtf8 sc)),
-            ("noSourceCode", if T.null sc then Just "none" else Nothing),
+          [ ("sourceCode", Just . encodeUtf8 $ sourceCode spi),
            ("version", Just $ B.pack simplexMQVersion),
-            ("commitSourceCode", Just $ encodeUtf8 $ maybe (T.pack simplexmqSource) sourceCode information),
-            ("shortCommit", Just $ B.pack $ take 7 simplexmqCommit),
-            ("commit", Just $ B.pack simplexmqCommit),
            ("website", encodeUtf8 <$> website spi)
          ]
-        spi = fromMaybe (emptyServerInfo "") information
-        sc = sourceCode spi
        conds ServerConditions {conditions, amendments} =
          [ ("usageConditions", Just $ encodeUtf8 conditions),
            ("usageAmendments", encodeUtf8 <$> amendments)
@@ -237,8 +205,8 @@ section_ label content' src =
        (inside, next') ->
          let next = B.drop (B.length endMarker) next'
           in case content' of
-                Just content | not (B.null content) -> before <> item_ label content inside <> section_ label content' next
-                _ -> before <> next -- collapse section
+                Nothing -> before <> next -- collapse section
+                Just content -> before <> item_ label content inside <> section_ label content' next
  where
    startMarker = "<x-" <> label <> ">"
    endMarker = "</x-" <> label <> ">"
@@ -13,6 +13,3 @@ linkHtml = $(embedFile "apps/smp-server/static/link.html")

 mediaContent :: [(FilePath, ByteString)]
 mediaContent = $(embedDir "apps/smp-server/static/media/")
-
-wellKnown :: [(FilePath, ByteString)]
-wellKnown = $(embedDir "apps/smp-server/static/.well-known/")
@@ -4,7 +4,6 @@ packages: .
 -- packages: . ../http2
 -- packages: . ../network-transport

-- uncomment two sections below to run tests with coverage
 -- package *
   -- coverage: True
   -- library-coverage: True
@@ -0,0 +1,85 @@
+# SMP server cluster
+
+## Problem
+
+Currently we can only scale servers on a given address vertically, which has 2 problems:
+
+1. There are some limits to vertical scalability, with lower limits for cost-efficient scalability.
+2. Hard to manage resource exhaustion attacks.
+3. Creating new queue can fail and require address change.
+
+## Proposed solution
+
+While we don't need to implement clusters right now, we could continue evolving this design, and take some of the considerations to the design of short links.
+
+Server cluster can allow:
+1. Balance load on a given address horizontally, by adding servers to the cluster.
+2. Manage attacks by adding servers to cluster.
+3. Possibly, there may be approach to server-side redundancy.
+
+To group servers into a cluster we need to map requests to specific servers. This can be done in one of two ways:
+- additional server ID in the cluster added to transmissions.
+- map the first two letters in base64 encoding of queue ID to the server ID.
+
+The second approach makes it easy to migrate  parts of the state between servers in the cluster, as message queues are already grouped in folder with the top level having 2 letters in folder name. This would allow to have up to 4096 servers in the cluster.
+
+The proxy would then choose a random server from the list of servers to create a queue, and the server would have to be configured to use specific 2 letters in base64 encoding of queue addresses. For existing queues, the server will be choosed based on the queue ID.
+
+A separate question is how to map other queue IDs (sender, notifier, link) to the recipient ID. Two approaches are possible:
+- additional protocol commands used only by load-balancing proxy to create references to servers that have the actual queue from other IDs.
+- use the same 2 letters for all IDs.
+
+The latter approach is simpler, but it it cannot be used if some of the IDs are generated client-side and some IDs are generated server-side - we would need to generate all IDs in one place. Alternatively, the client can generate some IDs with the same 2 letters in the ID, and the server in the cluster will be chosen to match this ID.
+
+If we decide on the second approach, and add client-generated IDs, we already may start rejecting IDs that contain different first 2 letters. It would effectively reduce ID entropy from 192 to 180 bits which could be a better tradeoff than additional protocol commands and requests to find the queue, that would add to the request latency.
+
+The advantage of the first approach is that it is more generic, and does not impose any restriction on IDs, and making additional requests within the operators network would add a small fraction to the latency, compared with much larger latency to the end user. The balancing proxy could cache the results of dereferencing requests.
+
+**The sequence of requests to create new queue**:
+
+- client -> proxy: NEW
+- proxy -> server 1, choosen randomly: NEW
+- proxy <- server 1 (recipient ID should be one of IDs allowed for this server, based on cluster mapping): QID
+- proxy -> server 2 chosen based on sender ID: SET_SREF
+- proxy <- server 2: OK
+- proxy -> server 3 chosen based on notifier ID: SET_NREF
+- proxy <- server 3: OK
+- client <- proxy: QID
+
+SET_SREF and SET_NREF are new protocol commands to create references from sender and notifier IDs to recipient ID, or it may be sufficient to have the reference to cluster ID, as the server with queue would have to dereference it again in its local storage.
+
+**The sequence of requests to subscribe to receive messages**:
+
+- client -> proxy: SUB
+- proxy -> mapped server based on queue ID: SUB
+- proxy <- server: OK or MSG
+- client <- proxy: OK or MSG
+
+For subscriptions to work both the socket with the client and the socket with the server should remain open, and proxy should route the messages based on this session mapping.
+
+There are two possible mappings of sockets:
+- for each client socket the proxy creates a separate socket with the server. In this case response and message routing is simpler, and based purely on sockets.
+- proxy reuses connection to server and mixes all client requests into one connection with server. In this case response and message routing is more complex, and should take queue ID into account.
+
+**The sequence of requests to send the message**:
+
+- client -> proxy: SEND
+- proxy -> mapped server 1 based on sender ID: GET_SREF
+- proxy <- server 1: SREF
+- proxy -> mapped server 2 based on recipient ID (or cluster ID) in SREF: SEND
+- proxy <- server 2: OK
+- client <- proxy: OK
+
+SREF is the response containing the reference to find the server with the queue.
+
+## Proxy implementation
+
+It needs to be based on some general purpose proxy allowing TLS on both sides so that it can do protocol inspection.
+
+We considered haproxy and we have POC with open-resty (a fork of nginx with Lua scripting): https://github.com/epoberezkin/openresty-request-inspection
+
+There may be some other proxies with scripting and TCP protocol inspection that can be used, e.g. the search suggested: nginx, varnish, envoy, mitmproxy, caddy, apache traffic server, squid, traefik.
+
+As we also encrypt traffic inside TLS using client and server session keys, this traffic decryption and encryption of responses should happen in proxy, so the proxy should support encryption via openssl.
+
+Out of all options Apache Traffic Server looks attractive, as it supports plugins written in C/C++.
@@ -1,290 +0,0 @@
-# Protocol changes for creating and connecting to SMP queues
-
-## Problems
-
-This change is related to these problems:
- differentiating queue retention time,
- supporting MITM-resistant short connection links,
-
-This RFC is based on the previous discussions about short links, blob storage and notifications ([1](./2024-06-21-short-links.md), [2](./2024-09-09-smp-blobs.md), [3](./2024-11-25-queue-blobs-2.md), [4](./2024-09-25-ios-notifications-2.md)).
-
-SMP protocol supports two types of queues - queues to send messages (messaging queues) and queues to send invitations to connect (contact queues). While SMP protocol was originally "unaware" of these queue types, it could differentiate it by message flow, and with the recent addition of SKEY command to allow securing the queue by the sender this difference became persistent.
-
-Simply designating queue types would allow to use this information to decide for how long to retain queues, and potentially extending it:
- unsecured 1-time invitation queues with sndSecure (support of securing by sender) - e.g., 3 months.
- contact address queues without sndSecure - e.g., 3 years without activity.
- Possibly, "queues" that prohibit messages and used only as blob storage - they would be used to store group profiles and super-peer addresses for the group.
-
-## Design objectives
-
-We want to achieve these objectives for short links and associated queue data:
-1. no possibility to provide incorrect SenderId inside link data (e.g. from another queue).
-2. link data cannot be accessed by the server unless it has the link.
-3. prevent MITM attack by the server, including the server that obtained the link.
-4. prevent changing of connection request by the user (to prevent MITM via break-in attack in the originating client).
-5. for one-time links, prevent accessing link data by link observers who did not compromise the server.
-6. allow changing the user-defined part of link data.
-7. avoid changing the link when user-defined part of link data changes, while preventing MITM attack by the server on user-defined part, even if it has the link.
-8. retain the quality that it is impossible to check the existence of secured queue from having any of its temporary visible IDs (sender ID and link ID in 1-time invitations) - it requires that these IDs remain server-generated (contrary to the previous RFCs).
-
-To achieve these objectives the queue data will include fixed (immutable) and user-defined (mutable) parts.
-
-Fixed part would include:
- full connection request (the current long link with all keys, including PQ keys). This includes SenderId that must match server response.
- public signature key to verify mutable part of link data.
-
-Signed mutable part would include:
- any links to chat relays that should be contacted instead of this queue (not in this RFC), to allow delegating group connections and contact request connections to prevent spam, hiding online presence, etc.
- and user-defined data - user profile or group profile, chat preferences, welcome message, etc.
-
-The link itself should include both the key and auth tag from the encryption of immutable part. Accessing one-time link data should require providing sender key and signing the command (`LKEY`).
-
-## Solution
-
-Current NEW and NKEY commands:
-
-```haskell
-NEW :: RcvPublicAuthKey -> RcvPublicDhKey -> Maybe BasicAuth -> SubscriptionMode -> SenderCanSecure -> Command Recipient
-
-- | Queue IDs and keys, returned in IDS response
-data QueueIdsKeys = QIK
-  { rcvId :: RecipientId,
-    sndId :: SenderId,
-    rcvPublicDhKey :: RcvPublicDhKey,
-    sndSecure :: SenderCanSecure
-  }
-```
-
-Proposed NEW command replaces SenderCanSecure with QueueMode, adds link data, and combines NKEY command:
-
-```haskell
-NEW :: NewQueueRequest -> Command Recipient
-
-data NewQueueReq = NewQueueReq
-  { rcvAuthKey :: RcvPublicAuthKey,
-    rcvDhKey :: RcvPublicDhKey,
-    auth_ :: Maybe BasicAuth,
-    subMode :: SubscriptionMode,
-    queueReqData :: Maybe QueueReqData,
-  }
-
-- QRMessaging implies that sender can secure the queue.
-- LinkId is not used with QRMessaging, to prevent the possibility of checking when connection is established by re-using the same link ID when creating another queue – the creating would have to fail if it is used.
-- LinkId is required with QRContact, to have shorter link - it will be derived from the link_uri. And in this case we do not need to prevent checks that this queue exists.
-data QueueReqData
-  = QRMessaging (Maybe (SenderId, QueueLinkData))
-  | QRContact (Maybe (LinkId, (SenderId, QueueLinkData)))
-
-- SenderId should be computed client-side as the first 24 bytes of sha3-384(correlation_id),
-- The server must verify it and reject if it is not.
-- It allows to include sender ID inside encrypted associated link data as part of full connection URI without requesting it from the server, but prevents checking if a given sender ID exists (queue creation would fail for a duplicate sender ID), as sha3-384 derivation is not reversible.
-type QueueLinkData = (EncFixedLinkData, EncUserDataBytes)
-
-type EncFixedLinkData = ByteString
-
-type EncUserDataBytes = ByteString
-
-- We need to use binary encoding for ConnectionRequestUri to reduce its size
-- The clients would reject changed immutable data and
-- ConnectionRequestUri where server or SenderId of the queue do not match.
-data FixedLinkData c = FixedLinkData
-  { agentVRange :: VersionRangeSMPA,
-    rootKey :: C.PublicKeyEd25519,
-    connReq :: ConnectionRequestUri c
-  }
-
-data ConnLinkData c where
-  InvitationLinkData :: VersionRangeSMPA -> UserLinkData -> ConnLinkData 'CMInvitation
-  ContactLinkData ::
-    { agentVRange :: VersionRangeSMPA,
-      -- direct connection via connReq in fixed data is allowed.
-      direct :: Bool,
-      -- additional owner keys to sign changes of mutable data.
-      owners :: [OwnerAuth],
-      -- alternative addresses of chat relays that receive requests for this contact address.
-      relays :: [ConnShortLink 'CMContact],
-      userData :: UserLinkData
-    } -> ConnLinkData 'CMContact
-
-newtype UserLinkData = UserLinkData ByteString
-
-- | Updated queue IDs and keys, returned in IDS response
-data QueueIdsKeys = QIK
-  { rcvId :: RecipientId, -- server-generated
-    sndId :: SenderId, -- server-generated
-    rcvPublicDhKey :: RcvPublicDhKey,
-    sndSecure :: SenderCanSecure, -- possibly, can be removed? or implied?
-    linkId :: Maybe LinkId -- server-generated
-  }
-```
-
-In addition to that we add the command allowing to update and also to retrieve and secure the queue and get link data in one request, to have only one request:
-
-```haskell
-- This command allows to set all data or to update mutable part of contact address queue.
-- This command should fail on queues that support sndSecure and also on new queues created with QRMessaging.
-- This should fail if LinkId or immutable part of data is changed with the update, but will succeed if only mutable part is updated, so it can be retried.
-- Entity ID is RecipientId.
-- The response to this command is `OK`.
-LSET :: LinkId -> QueueLinkData -> Command Recipient
-
-- Delete should link and associated data
-- Entity ID is RecipientId
-LDEL :: Command Recipient
-
-- To be used with 1-time links.
-- Sender's key provided on the first request prevents observers from undetectably accessing 1-time link data.
-- If queue mode is QRContact (and queue does NOT allow sndSecure) the command will fail, same as SKEY.
-- Once queue is secured, the key must be the same in subsequent requests - to allow retries in case of network failures, and to prevent passive attacks.
-- The difference with securing queues is that queues allow sending unsecured messages to queues that allow sndSecure (for backwards compatibility), and 1-time links will NOT allow retrieving link data without securing the queue at the same time, preventing undetected access by observers.
-- Entity ID is LinkId
-LKEY :: SndPublicAuthKey -> Command Sender
-
-- If queue mode is QRMessaging the command will fail.
-- Entity ID is LinkId
-LGET :: Command Sender
-
-- Response to LGET and LSET
-- Entity ID is the same as in the command
-LNK :: SenderId -> QueueLinkData -> BrokerMsg
-```
-
-To both include sender_id into the full link before the server response, and to prevent "oracle attack" when a failure to create the queue with the supplied `sender_id` can be used as a proof of queue existence, it is proposed that `sender_id` is computed client-side as the first 24 bytes of 48 in `sha3-384(correlation_id)` and validated server-side, where `corelation_id` is the transmission correlation ID.
-
-To allow retries, every time the command is sent a new random `correlation_id` and new `sender_id` (and for contact queue, also `link_id`, which would be random as it is derived from hash of fixed link data that includes a random signature key) should be used on each attempt, because other IDs would be generated randomly on the server, and in case the previous command succeeded on the server but failed to be communicated to the client, the retry will fail if the same ID is used.
-
-Alternative solutions that would allow retries that were considered and rejected:
- additional request to save queue data, after `sender_id` is returned by the server. The scenarios that require short links are interactive - creating user addresses and 1-time invitations - so making two requests instead of one would make the UX worse.
- include empty sender_id in the immutable data and have it replaced by the accepting party with `sender_id` received in `LINK` response - both a weird design, and might create possibility for some attacks via server, especially for contact addresses.
- making NEW commands idempotent. Doing it would require generating all IDs client-side, not only `sender_id`. It increases complexity, and it is not really necessary as the only scenarios when retries are needed are async NEW commands, that do not require short links. For future short links of chat relays the retries are much less likely, as chat relays will have good network connections.
-
-## Algorithm to prepare and to interpret queue link data.
-
-For contact addresses this approach follows the design proposed in [Short links](./2024-06-21-short-links.md) RFC - when link id is derived from the same random binary as key. For 1-time invitations link ID is independent and server-generated, to prevent existence checks (oracle attack).
-
-This scheme results in 32 byte binary size for contact addresses and 56 bytes for 1-time invitation links.
-
-For fixed link data.
-
-1. Generate random `nonce` (also used as a correlation ID for server command) and signature key (public `rootKey` included in fixed data).
-2. Compute sender ID from `nonce` as the first 24 bytes of sha3-384 of `nonce`.
-3. Generate other keys for queue address, including queue e2e encryption keys and double ratchet connection e2e encryption keys.
-4. Construct the full connection address to be included in fixed data.
-5. `link_key = SHA3-256(fixed_data)` - used as part of the link, and to derive the key to encrypt content.
-6. HKDF:
-  1) contact address: `(link_id, key) = HKDF(link_key, 56 bytes)`.
-  2) 1-time invitation: `key = HKDF(link_key, 32 bytes)`, `link-id` - server-generated.
-7. Encrypt: `(ct1, tag1) = secret_box(fixed_data, key, nonce1)`, where `nonce1` is a random nonce
-5. Store: `(nonce1, ct1, tag1)` stored as fixed link data.
-
-For mutable user data:
-
-1. Random `nonce2` and the same key are used.
-2. Sign `user_data` with key included in `fixed_data`.
-3. Encrypt: `(ct2, tag2) = secret_box(signed_used_data, key, nonce2)`.
-4. Store: `(nonce2, ct2, tag2)`
-
-Link recipient:
-
-1. Receives `link_key` in the link, for 1-time invitations also `link_id`.
-2. HKDF:
-  1) contact address: `(link_id, key) = HKDF(link_key, 56 bytes)`.
-  2) 1-time invitation: `key = HKDF(link_key, 32 bytes)`.
-3. Retrieves via `link_id`: `(nonce1, ct1, tag1)` and `(nonce2, ct2, tag2)`:
-  1) contact address: `LGET` command, that allows retrieving link data multiple times.
-  2) 1-time invitation: `LKEY` command, that non-optionally secures the queue, and only allows repeated link data retrievals if the same sender's key is provided and signs the transmission. This prevents link data retrieval by link observers.
-4. Decrypt: `(signature1, fixed_data) = decrypt (nonce1, ct1, tag1)`.
-5. Verify: `SHA3-256(fixed_data) == link_key`, abort if not.
-6. Decrypt: `(signature2, used_data) = decrypt(nonce2, ct2, tag2)`.
-7. Verify signatures using key in the fixed data, abort if they don't match.
-
-While using content hash as encryption key is unconventional, it is not completely unusual - e.g., it is used in convergent encryption (although in our case using random nonce makes it not convergent, but other use cases suggest that this approach preserves encryption security). It is particularly acceptable for our use case, as `fixed_data` contains mostly random keys.
-
-## Threat model
-
-**Compromised SMP server**
-
-can:
- delete link data.
- hide link data selectively for some or for all requests.
-
-cannot:
- undetectably replace link data, even if it has the link (objective 3).
- access unencrypted link data, whether it was or was not accessed by the accepting party, provided it has no link (objective 2).
- observe IP addresses of the users accessing link data, if private routing is used.
-
-**Passive observer who observed short link**:
-
-can:
- access original unencrypted link data for contact address links.
-
-cannot:
- undetectably access observed 1-time link data, accessing the link would make the link inaccessible to the sender (objective 5).
- undetectably check the existence of messaging queue or 1-time link (objective 8).
- replace or delete the link data.
-
-**Queue owner who did not compromise the server**:
-
-cannot:
- redirect connecting user to another queue, on the same or on another server (objective 1).
- replace connection request in the link (objective 4).
-
-## Correlation of design objectives with design elements
-
-1. The presence of `SenderId` in `LNK` response from the server.
-2. Encryption of link data with crypto_box.
-3. Deriving encryption key from the hash of fixed data prevents it being modified by the server - any change would be detected and rejected by the client, as the hash of fixed data won't match the link. Signature verification with the key from fixed data, and signing of mutable data prevents server modification of mutable data.
-4. No server command to change fixed data once it's set. Also, changing fixed data would require changing the link.
-5. 1-time link data can only be accessed with `LKEY` command, that while allows retries to mitigate network failures, will require the same key for retries.
-6. `LSET` command.
-7. The link is derived from fixed data only, so it does not change when mutable link data changes. Mutable part is signed preventing server MITM attacks.
-8. SenderId is derived from request correlation ID, so it cannot be arbitrary defined to check existence of some known queue. LinkId for 1-time invitation is generated server-side, so it cannot be provided by the client when creating the queues to check if these IDs are used.
-
-## Syntax for short links
-
-The syntax:
-
-```abnf
-shortConnectionLink = uriAuthority "/" linkUri [ "?" param *( "&" param ) ]
-uriAuthority = %s"https://" smpServerHost / "simplex:" ; using simplex: scheme requires including host in the parameter hostParam
-smpServerHost = <hostname> ; RFC1123, RFC5891
-linkUri = %s"i#" oneTimeLink / contactType "#" contactLink
-contactType = %s"a" / %s"g" / %s"c" ; contact / group / channel address, respectively
-oneTimeLink = <base64url(linkId)> "/" <base64url(linkKey)> ; 56 bytes / 75 base64 encoded characters
-contactLink = <base64url(linkKey)> ; 32 bytes / 43 base64 encoded characters
-; linkId - 192 bits/24 bytes
-; linkKey - 256 bits/32 bytes
-
-param = hostsParam / portParam / certHashParam
-hostsParam = %s"h=" host *("," host) ; additional hostnames, e.g. onion
-portParam = %s"p=" 1*DIGIT ; server port
-certHashParam = %s"c=" <base64url(server offline certificate fingerprint)>
-```
-
-To have shorter links fingerprint and additional server hostnames do not need to be specified for pre-configured servers, even if they are disabled - they can be used from the client code. Any user defined servers will require including additional hosts and server fingerprint.
-
-Example one-time link for preset server (104 characters):
-
-```
-https://smp12.simplex.im/i#abcdefghij0123456789abcdefghij01/23456789abcdefghij0123456789abcdefghij01234
-```
-
-Example contact link for preset server (71 characters):
-
-```
-https://smp12.simplex.im/c#abcdefghij0123456789abcdefghij0123456789abc
-```
-
-Example contact link for user-defined server (with fingerprint, but without onion hostname - 117 characters):
-
-```
-https://smp1.example.com/c#abcdefghij0123456789abcdefghij0123456789abc?c=0YuTwO05YJWS8rkjn9eLJDjQhFKvIYd8d4xG8X1blIU
-```
-
-Example contact link for user-defined server (with fingerprint ant onion hostname - 182 characters):
-
-```
-https://smp1.example.com/c#abcdefghij0123456789abcdefghij0123456789abc?c=0YuTwO05YJWS8rkjn9eLJDjQhFKvIYd8d4xG8X1blIU&h=beccx4yfxxbvyhqypaavemqurytl6hozr47wfc7uuecacjqdvwpw2xid.onion
-```
-
-For the links to work in the browser the servers must provide server pages.
@@ -1,93 +0,0 @@
-# New notifications protocol
-
-## Problem
-
-iOS notifications have these problems:
- iOS notification service crashes exceeding memory limit. This is being addressed by changes in GHC RTS.
- there is a large number of connections, because each member in a group requires individual connection. This will improve with chat relays when each group would require 2-3 connections.
- some notification may be not shown if notification with reply/mention is skipped, and instead some other message is delivered, which may be muted. This would not improve without some changes, as notifications may be skipped anyway.
- client devices delay communication with ntf server because it is done in background, and by that time the app may be suspended.
- notification server represents a bottleneck, as it has to be owned by the app vendor, and the current design when ntf server subscribes to notifications scales very badly.
-
-This RFC is based on the previous [RFC related to notifications](./2024-09-25-ios-notifications-2.md).
-
-## Solution
-
-As notification server has to know client token and currently it associates subscriptions with this token anyway, we are not gaining any privacy and security by using per-subscription keys - both authorization and encryption keys of notification subscription can be dropped.
-
-We still need to store the list of queue IDs associated with the token on the notification server, but we do not need any per-queue keys on the notification server, and we don't need subscriptions - it's effectively a simple set of IDs, with no other information.
-
-In this case, when queue is created the client would supply notifier ID - it has to be derived from correlation ID, to prevent existense check (see previous RFC). As we also supply sender ID, instead of deriving it as sha3-192 of correlation ID, they both can be derived as sha3-384 and split to two IDs - 24 bytes each.
-
-The notification server will maintain a rotating list of server keys with the latest key communicated to the client every time the token is registered and checked. The keys would expire after, say, 1 week or 1 month, and removed from notification server on expiration.
-
-The packet containing association between notifier queue ID and token will be crypto_box encrypted using key agreement between identified notification server master key and an ephemeral per packet (effectively, per-queue) client-key.
-
-Deleting the queue may also include encrypted packet that would verify that the client deleted the queue.
-
-Instead of notification server subscribing to the notifications creating a lot of traffic for the queues without messages, the SMP server would push notifications via NTF server connection (whether via NTF or via SMP protocol). This could be used as a mechanism to migrate existing queues when with the next subscription the notification server would communicate it's address to SMP server and this association would be stored together with the queue.
-
-## Protocol design
-
-Additional/changed SMP commands:
-
-```haskell
-- register notification server
-- should be signed with server key
-NSRV :: NtfServerCreds -> Command NtfServer
-
-- response
-NSID :: NtfServerId -> BrokerMsg
-
-- to communicate which server is responsible for the queue
-- should be signed with queue key
-NSUB :: Maybe NtfServerId -> Command Notifier
-
-- subscribe to notificaions from all queues associated with the server
-- should be signed with server key
-- entity ID - NtfServerId
-NSSUB :: Command NtfServer
-
-data NtfServerCreds = NtfServerCreds
-  { server :: NtfServer,
-    -- NTF server certificate chain that should match fingerpring in address
-    cert :: X.CertificateChain,
-    -- server autorizatio key to sign server subscription requests
-    authKey :: X.SignedExact X.PubKey
-  }
-
-- entity ID is recipient ID
-NSKEY :: NtfSubscription -> Command Recipient 
-
-data NtfSubscription = NtfSubscription
-  -- key to encrypt notifications e2e with the client
-  { ntfPubDbKey :: RcvNtfPublicDhKey,
-    ntfServer :: NtfServer,
-    -- should be linked to correlation ID to prevent existense check
-    -- the ID sent to notification server could be its hash?
-    ntfId :: NotifierId,
-    encNtfTokenAssoc :: EncDataBytes
-  }
-
-- before the encryption - equivalent to NSUB command, but without key to authorize requests to specific queue
-data NtfTokenAssoc = NtfTokenAssoc
-  { signature :: SignatureEd25519,
-    tknId :: NtfTokenId,
-    ntfQueue :: SMPQueueNtf
-  }
-```
-
-SMP server will need to maintain the list of Ntf servers and their credentials, and when NSSUB arrives to make only one subscription. When message arrives it would deliver notification to the correct connection via queue / ntf server association.
-
-Ntf server needs to maintain three indices to the same data:
- `(smpServer, queueId) -> tokenId` - to deliver notification to the correct token
- `tokenId -> [smpServer -> [queueId]]` - to remove all queues when token is removed, and to store/update these associations effficiently - store log may have one compact line per token (after compacting), or per token/server combination.
- `[smpServer]` - array of SMP servers to subscribe to.
-
-## Mention notifications
-
-Currently we are marking messages with T (true) for messages that require notifications and F (false) for messages that don't require. Sender does not know whether the recipient has notifications disabled, enabled or in mentions-only mode.
-
-The proposal is to:
- add additional values to this metadata, e.g. 2 (priority) and 3 (high priority) (and T/F could be sent as 0/1 respectively) - that is, to deliver notifications even if notifications are generally disabled (they can still be further filtered by the client).
- instead of deleting notification credentials when notifications are disabled - which is costly - communicate to SMP server the change of notificaion priority level, e.g. the client could set minimal notification priority to deliver notifications, where 0 would mean disabling it completely, 1 enable for all, 2 for priority 2+, 3 for priority 3. The downside here is that it could be used for timing correlation of queues in the group, but it already can be used on bulk deletions of ntf credentials for these queues and when sending messages.
@@ -1,159 +0,0 @@
-# Using short links as group links
-
-## Problem
-
-To use the short links for groups these problems has to be / can be solved:
-1. recognizing link as a group link.
-2. permanent link with the ability to change chat relays.
-3. binding owners signatures to the link.
-4. allowing to add/remove owners, both to share ownership and for reliability in case of one owner losing keys/access.
-
-While current short links solve problems 1-3 (via contact type, and via extension of user data in the link), the problem 4 is solved only partially.
-
-We could include the current list of root owners in the user data, and we could send any history of ownership changes from this baseline as a short blockchain on joining the group, we still requrie one master owner to retain access to the queue associated with the group.
-
-## Possible solution approaches
-
-1. "Kick this can down the road" - ignore this problem until there is a namespace, and a group name can be associated with multiple queues.
-
-Pros: simple and reasonable, and it suggests postponing multisig for owners too. The users can still see the list of owners and their keys in user data of the link, and receive admin roster signed by owners on joining.
-
-Cons: if this "master owner" loses the access to the device, no further changes to group profile will be possible.
-
-2. The queue access can be shared by sharing the key and recipient IDs with all owners.
-
-The problems:
- preventing MITM attack between owners (this protect exists for other solutions too).
- protecting these credentials from chat relays. So somehow there should be direct key agreement between members allowing to send e2e encrypted message inaccessible to chat relays.
-
-Pros: simpler than alternatives, and still provides protection against losing the key.
-Cons:
- quite clunky, and requires the new primitive anyway (e2e encryption).
- no multisig
-
-This could possibly be evolved into the requirement to have a direct connection with other owners, and verifying the security code before they have access to group.
-
-3. Allow "joint management" of SMP queues.
-
-SMP servers can support multiple recipients for contact queues:\
- subscription would be possible to the "subscriber recipient".
- all other changes (update data, change subscriber recipient, add or remove recipients) would require multiple recipient signatures on SMP command in line with n-of-m multisig rules, that the command sender would have to collect out-of-band (from SMP protocol point of view).
-
-Pros: allows joint ownership, and protects from losing access to master owner device.
-Cons:
- complicates queue abstraction with approach that is not needed for most queues.
- still retains the server as a single point of failure.
-
-4. Introduce "group" as a new type of entity managed by SMP servers.
-
-SMP servers would provide a separate set of commands for managing group records that would include in an encrypted container:
- the group profile
- the list of chat relay links
- the list of owner member IDs with their public keys
- multisig rules
- alternative group entity locations
- possibly, a globally unique group identity (as the hash of the initial/seed group data).
-
-While the server domain would be used as the hostname in group link, it may contain alternative hosts (not just hostnames of the same server), both in the link and in the group record data.
-
-Pros: separates additional complexity to where it is needed, allowing reliability and redundancy for group ownership.
-Cons: complexity, coupling between SMP and chat protocol.
-
-## Design for channel/group as a separate queue mode
-
-Option 1.
-
-A queue mode "channel" when owners are represented by their individual queues (either a separate mode, or a submode of "channel", or just normal contact address queues). In this case sending message to channel queue would broadcast message to queue owners, without exposing even the number of owners.
-
-Pros:
- allows chat relays to send messages to all owners (e.g., channel can be secured with the list of snd keys, one per relay).
- quite easy to evolve from the current design.
- extensible.
-Cons:
- close to "solution in search of a problem".
- does not require data model changes - channel queue would simply have a list of owner "recipient IDs", and each owner queue would also point to channel.
-
-Option 2.
-
-Also a separate queue mode "channel", but instead of having a linked owner queues, it would simply maintain a list of owner keys to maintain the data. In this case, messages cannot be sent to this "queue" at all.
-
-Pros:
- simpler design.
- we could allow sending messages to it too, with the "main" owner receiving them. This could be negotiated in the protocol.
- it may be easier to migrate the current groups, as the admin link would be this queue (although for public groups in directory it would have to be recreated anyway).
- Possibly, when queue is created there should be a flag whether it should accept unsigned messages - then contact addresses would be created with unsigned messages ON, messages queues, once SKEY is universally supported, with unsigned messages OFF, and channel queues with unsigned messages OFF too for new public queues.
-Cons:
- if no messages are accepted, this is not even a queue.
- no way to directly contact owners (maybe it is not a downside, as for relays there would be a communication channel anyway as part of the group).
-
-Option 2 looks more simple and attractive, implementing server broadcast for SMP seems unnecessary, as while it could have been used for simple groups, it does not solve such problems as spam and pre-moderation anyway - it requires a higher level protocol.
-
-The command to update owner keys would be `RKEY` with the list of keys, and we can make `NEW` accept multiple keys too, although the use case here is less clear.
-
-## Multiple owners managing queue data.
-
-Option 1: Use the same keys in SMP as when signing queue data.
-
-Option 2: Use different keys.
-
-The value here could be that the server could validate these signatures too, and also maintain the chain of key changes. While tempting, it is probably unnecessary, and this chain of ownership is better to be maintained on chat relay level, as there are no size constraints on the size of this chain. Also, it is better for metadata privacy to not couple transport and chat protocol keys.
-
-We still need to bind the mutable data updates to the "genesis" signature key (the one included in the immutable data).
-
-The proposed design:
-
- when mutable data is signed by genesis key, then it is bound, and no changes is needed.
- mutable data may be signed by the key of the new owner, in which case mutable part itself must contain the binding. We could also use ring signature to sign the mutable data, concealing which owner signed the data - that would increase the signature size from 64 bytes to `32 * (n + 1)` bytes.
-
-Current mutable data:
-
-```haskell
-data UserLinkData = UserLinkData
-  { agentVRange :: VersionRangeSMPA,
-    userData :: ConnInfo
-  }
-```
-
-Proposed mutable data:
-
-```haskell
-data UserLinkData = UserLinkData
-  { agentVRange :: VersionRangeSMPA,
-    owners :: [OwnerInfo]
-    userData :: ConnInfo
-  }
-
-type OwnerId = ByteString
-
-data OwnerInfo = OwnerInfo
-  { ownerId :: OwnerId, -- unique in the list, application specific - e.g., MemberId
-    ownerKey :: PublicKeyEd25519,
-    -- owner signature of sender ID,
-    -- confirms that the owner agreed with being the owner,
-    -- prevents a member being added as an owner without consent.
-    ownerSig :: SignatureEd25519,
-    -- owner authorization, sig(ownerId || ownerKey, prevKey), where prevKey is either a "genesis key" or some other key previously signed by the genesis key.
-    authOwnerId :: OwnerId, -- null for "genesis"
-    authOwnerSig :: SignatureEd25519
-  }
-```
-
-The size of the OwnerInfo record encoding is:
- ownerId: 1 + 12
- ownerKey: 1 + 32
- ownerSig: 1 + 64
- ownerAuthId: 1 + 12
- ownerAuthSig: 1 + 64
-
-~189 bytes, so we should practically limit the number of owners to say 8 - 1 original + 7 addiitonal. Original creator could use a different key as a "genesis" key, to conceal creator identity from other members, and it needs to include the record with memberId anyway.
-
-The structure is simplified, and it does not allow arbitrary ownership changes. Its purpose is not to comprehensively manage ownership changes - while it is possible with a generic blockchain, it seems not appropriate at this stage, - but rather to ensure access continuity and that the server cannot modify the data (although nothing prevents the server from removing the data completely or from serving the previous version of the data).
-
-For example it would only allow any given owner to remove subsequenty added owners, preserving the group link and identity, but it won't allow removing owners that signed this owner authorization. So owners are not equal, with the creator having the highest rank and being able to remove all additional owners, and owners authorise by creator can remove all other owners but themselves and creator, and so on - they have to maintain the chain that authorized themselves, at least. We could explicitely include owner rank into OwnerInfo, or we could require that they are sorted by rank, or the rank can be simply derived from signatures.
-
-When additional owners want to be added to the group, they would have to provide any of the current owners:
- the key for SMP commands authorization - this will be passed to SMP server together with other keys. There could be either RKEY to pass all keys (some risk to miss some, or of race conditions), or RADD/RGET/RDEL to add and remove recipient keys, which has no risk of race conditions.
- the signature of the immutable data by their member key included in their profile.
- the current owner would then include their member key into the queue data, and update it with LSET command. In any case there should be some simple consensus protocol between owners for owner changes, and it has to be maintained as a blockchain by owners and by chat relays, as otherwise it may lead to race conditions with LSET command.
-
-Potentially, there could be one command to update keys and link data, so that they are consistent.
@@ -1,142 +0,0 @@
-# Service certificates for high volume servers and services connecting to SMP servers
-
-## Problem
-
-The absense of user and client identification benefits privacy, but it requires separately authorizing subscription for each messaging queue, that doesn't scale when a high volume server or service acts as a client for SMP server even for the current traffic and network size.
-
-These servers/services include:
- operators' chat relays (aka super-peers),
- notification servers,
- high-traffic service chat bots,
- high-traffic business support clients.
-
-The future chat relays would reduce the number of subscriptions required for the usual clients, by replacing connections with each group member to 1-3 connections with chat relays per group/community, it would shift the burden to the chat relays, that are also clients.
-
-Self-hosted chat relays may want to retain privacy, so they will not use client certificates, but this privacy is not needed (and counter-productive) for the chat relays provided by network operators.
-
-Even today, directory service subscribing to all queues may take 15-20 minutes, which is experienced as downtime by the end users.
-
-Notification servers also acting as clients to messaging servers also take 15-20 minutes to subscribe to all notifications, during which time notifications are not delivered.
-
-Not only these subscription take a lot of time, they also consume a large amount of memory both in the clients and in the servers, as association between clients and queues is currently session-scoped and not persisted anywhere (and it should not be, because end-users' clients do need privacy).
-
-## Solution
-
-High volume "clients" (operators' chat relays, directory service, SimpleX Chat team support client, SimpleX Status bot, etc.) that don't need privacy will identify themselves to the messaging servers at a point of connection by providing client sertificate, both in TLS handshake and in SMP handshake (the same certificate must be provided).
-
-All the new queues and subscriptions made in this session will be creating a permanent association of the messaging queue with the client, and on subsequent reconnections the client can "subscribe" to all their queues with a single client subscription command.
-
-This will save a lot of time subscribing and resubscribing on server and client restarts, servers' bandwidth, servers' traffic spikes, and memory of both clients and servers.
-
-## Protocol
-
-An ephemeral per-session signature key signed by long-term client certificate is used for client authorization – this session signature key will be passed in SMP handshake.
-
-To transition existing queues, the subscription command will have to be double-signed - by the queue key, and then by client key.
-
-When server receives such "hand-over" subscription it would create a permanent association between the client certificate and the queue, and on subsequent re-connections the client can subscribe to all the existing queues still associated with the client with one command.
-
-The server will respond to the client with the number of queues it was subscribed to - it would both inform the client that it has to re-connect in case of interruption, and can be used for client and server statistics.
-
-When client creates a new queue, it would also sign the request with both keys, per-queue and client's. Other queue operations (e.g., deletion, or changing associated queue data for short links) would still require two signatures, both the queue key and the client key.
-
-The open question is whether there is any value in allowing to remove the association between the client and the queue. Probably not, as threat model should assume that the server would retain this information, and the use-case for users controlling their servers is narrow.
-
-## Protocol connection handshake
-
-Currently, the types for handshakes are:
-
-```haskell
-data ServerHandshake = ServerHandshake
-  { smpVersionRange :: VersionRangeSMP,
-    sessionId :: SessionId,
-    -- pub key to agree shared secrets for command authorization and entity ID encryption.
-    -- todo C.PublicKeyX25519
-    authPubKey :: Maybe (X.CertificateChain, X.SignedExact X.PubKey)
-  }
-
-data ClientHandshake = ClientHandshake
-  { -- | agreed SMP server protocol version
-    smpVersion :: VersionSMP,
-    -- | server identity - CA certificate fingerprint
-    keyHash :: C.KeyHash,
-    -- | pub key to agree shared secret for entity ID encryption, shared secret for command authorization is agreed using per-queue keys.
-    authPubKey :: Maybe C.PublicKeyX25519,
-    -- | Whether connecting client is a proxy server (send from SMP v12).
-    -- This property, if True, disables additional transport encrytion inside TLS.
-    -- (Proxy server connection already has additional encryption, so this layer is not needed there).
-    proxyServer :: Bool
-  }
-```
-
-`ServerHandshake` already contains `authPubKey` with the server certificate chain and the signed key for connection encryption and creating a shared secret for denable authorization (with client entity key) and session encryption layer.
-
-`ClientHandshake` contains only ephemeral `authPubKey` to compute a shared secret for session encryption layer, so we need an additional field for an optional client certificate:
-
-```haskell
-serviceCertKey :: Maybe (X.CertificateChain, X.SignedExact X.PubKey)
-```
-
-Certificate here defines client identity. The actual key to be used to sign commands is session-scoped, and is signed by the certificate key. In case of notification server it MUST be the same certificate that is used for server TLS connections.
-
-For operators' clients we may optionally include operators' certificate in the chain, and that would allow servers to identify operators if either wants to. This would improve end-user security, as not only the server would validate that its certificate matches the address, but it would also validate that it is operated by SimpleX Chat or by Flux, preventing any server impersonation (e.g., via DNS manipulations) - the client could then report that the files are hosted on SimpleX Chat servers, but then can stop and show additional warning in case certificate does not match the domain - same as the browsers do with CA stores in the client.
-
-## Protocol transmissions
-
-Each transport block can contain one or several protocol transmissions.
-
-Each transmission has this structure:
-
-```abnf
-transmission = authenticator authorized
-; authenticator - Ed25519 signature for recipients or X25519 authenticator for senders, to provide repudiation.
-; authenticator authorizes the rest of the transmission.
-authorized = sessId corrId entityId command.
-; sessId is tls-unique channel binding, its presense in the transmission prevents replay attacks.
-```
-
-The proposed change would replace authenticator with exactly one or two authenticators, where the first one will remain resource-level authorization (queue key), and the optional second one will be client authorization with the client key.
-
-```abnf
-authenticator = queue_authenticator ("0" / "1" service_authenticator)
-; "0" and "1" characters (digit characters, not x00 or x01) are conventionally used for Maybe types in the protocol.
-```
-
-In case service_authenticator is present, queue_authenticator should authorize over `fingerprint authorized` (concatenation of service identity certificate fingerprint and the rest of the transmission).
-
-All queues created with client key will have to be double-authorized with both the queue key and the client key - both the client and the server would have to maintain this knowledge, whether the queue is associated with the client or not.
-
-Asymmetric retries have to be supported - the first request creating this association may succeed on the server and timeout on the client.
-
-## Subscription
-
-To subscribe to all associated queues the client has to send a single command authorized with the client key passed in handshake.
-
-The command and response:
-
-```haskell
-SUBS :: Command Recipient -- to enable all client subscriptions, empty entity ID in the transmission, signed by client key - it must be the same as was used in handover subscription signature.
-NSUBS :: Command Recipient -- notification subscription
-SOK :: Maybe ServiceId -- new subscription response
-SOKS :: Int64 -> BrokerMsg -- response from the server, includes the number of subscribed queues
-ENDS :: Int64 -> BrokerMsg -- when another session subscribes with the same certificate
-```
-
-Open questions:
- What should used as an entity ID for `SUBS` transmission - certificate fingerprint or an empty string?
- Should there be a command to get the list of all associated queues? It is likely to be useful for debugging?
- What should happen when `SUB` is sent for a single already associated queue? What if it is signed with the correct session key, but that is different from existing association? The current approach is that once associated, this associaiton would require authorization for single subscriptions, with the same certificate as already associated.
-
-## Ephemeral client-session association
-
-This was considered to reduce costs for the usual clients to re-subscribe. Currently it's a big problem, because of groups, and with transition to chat relays it won't be.
-
-For some very busy end-user clients it may help.
-
-Given that server has access to an ephemeral association between recipient client session and queues anyway (even with clients connecting via Tor, unless per-connection transport isolation is used), introducing `sessionPubKey` to allow resubscription to the previously subscribed queues may reduce the traffic. This won't change threat model as the server would only keep this association in memory, and not persist it. Clients on another hand may safely persist this association for fast resubscription on client restarts.
-
-This is not planned for the forseable future, as migrating to chat relays would solve most of the problem.
-
-Assuming an average active user has 20 contacts and 20 groups, and they would need ~3 subscriptions for each (for redundancy), so about 120 subscription to reconnect. The single 16kb transport block allows to send ~136 subscriptions. Which means that ephemeral sessions would create no value for clients at all, unless they are super active.
-
-Further, improving transport efficiency for super-active non-identified clients may help network abuse, so ephemeral sessions may have negative value.
@@ -1,104 +0,0 @@
-# Using the same profile from multiple devices
-
-## Problem
-
-Double Ratchet algorithm makes it hard to send/receive messages sent to the user from different devices, as each message changes the state of Double Ratchet keys, and these state changes must be strictly sequential and they cannot be reversed (although skipping is possible).
-
-Traditional approach for multi-device converts each direct conversation into a group, where each device participates as a member. Likewise, for group conversations each device also participates as a member. While these members *look* as if they are the same user to others, a very simple client app modification may show device ID for each message, and the communication peers, both in direct chats and in groups would know how many devices a user has and which device the user sent the message from. In addition to that, with this approach communication peers can send different messages to different devices (it can be prevented by provider who would request that only message key is encrypted with DR, while the encrypted message is the same) or withheld from some devices (it cannot be prevented by provider, as it cannot add key to the communication in case it is missing, and cannot withhold the message completely too). These opens various vectors for targeted attacks, e.g.:
- tracking movements of the user: once each devices is identified as "desk" and "phone" it would allow to know where the user is at a given time.
- manipulating information by sending messages to one device (to have proof it was sent) and withholding from others, or sending different messages if the protocol allows it.
-
-In addition to that, the specific implementation of this approach in Signal compromises break-in recovery property (aka post-compromise security) of Double-Ratchet algorithm, making its design ineffective - the only reason to have the second ratchet in DR algorithm is to provide break-in recovery, without it a much simpler design with a single ratchet is sufficient. See [this paper](https://eprint.iacr.org/2021/626.pdf) for details.
-
-While this limitation can be addressed with notifications when a new device is added and per-device keys, we still find the remaining attack vectors on user security and privacy to be unacceptable, and opening unsuspecting users to various criminal actions - and it is wrong to say that would only affect security conscious users, and most people would not be affected by these risks. Allowing potential criminals in groups to know which device you are currently using is a real risk for all users.
-
-Another approach was offered by Threema that is ["mediator" server](https://threema.com/en/blog/md-architectural-overview) where the state of encryption ratchets is stored server-side. While it protects the user from their communication peers, it increases required level of trust to the servers, and in case of SimpleX network it would expose the knowledge of who communicates to whom. So while the idea of server-side storage of encryption state is promising, it has to be per-connection, to retain "no-accounts" property of SimpleX messaging network.
-
-Also see [FAQ](https://simplex.chat/faq/#why-cant-i-use-the-same-profile-on-different-devices) and [this issue](https://github.com/simplex-chat/simplex-chat/issues/444#issuecomment-3066968358).
-
-## Proposed solution
-
-One of the ideas presented in FAQ - to store the state of Double Ratchet algorithm in the encrypted container on the server seems promising. The RFC develops this idea.
-
-### Considerations for the design
-
-1. The largest ratchet state size with the current implementation is less than 8kb (which is achieved when both sides shared PQ keys and ciphertexts), so while it cannot fit in the same transport blocks together with sent and received messages, it would fit in one transport block.
-
-2. Protocol commands and events may be changed (even if at the cost of slightly reducing message size) can fit the hash of the ratchet state (32 bytes sha256 would be sufficient), so that the client can determine whether it has the most recent ratchet state or if it needs to retrieve the latest copy. Message size reduction won't affect the users because we use compression, and there is a substantial reserve.
-
-3. Client commands that modify ratchet state would include the hash of the previous ratchet state so that the server can reject or ignore the command in case the previous ratchet state is different or in case command is repeated in case of lost response).
-
-4. The client does not need to retrieve message state for each encryption and decryption operation - it can "speculatively" use the ratchet state it has, and receive correct ratchet state in the "error" response after attempting encryption based on incorrect ratchet state.
-
-## Proposed protocol design
-
-Ratchet state will be stored on the same server that stores message queue, as part of message queue record. 8kb is a sufficient size for this blob (the actual max size is 7800 bytes). The server would also store the hashes of the current and, possibly, the previous ratchet states (TBC).
-
-While ratchet is used for duplex connection, the connection still has primary queue, and with redundancy the same ratchet state can be stored on all secondary queues.
-
-Ratchet state will be encrypted using secret_box - a symmetric encryption scheme, so PQ-resistant. If ratchet state is stored on more than one server, it has to be encrypted with a different key for each server.
-
-Questions: how to rotate the key used to store ratchet? Should key used to encrypt ratchet rotate at the same time when queue is rotated? The latter is a logical option, as it prevents additional complexity and solves the problem anyway. A possible option is to have "ratchet version" that will be used to advance the key used to encrypt ratchet via HKDF.
-
-Security considerations: the scheme may reduce break-in recovery to the points queues are rotated, unless there is some randomness mixed-in into the key derivation (the key used to encrypt ratchet state). But including randomness would defeat the purpose, as other devices wouldn't be able to access the ratchets. Another approach would be to have each device use its own key for encryption, and encrypt to all keys of all devices (or to encrypt key, to avoid size increase). Having multiple encryptions would show how many devices use the queue, but servers already can observe it, so it is a better tradeoff. Another idea would be to rotate the key used to authorize queue commands - we already support multiple recipient keys, and it can be used for multi-device scenario. That would partially mitigate break-in attacks as the attacker who obtained the key from ratchet state would be able to decrypt it, but won't be able to decrypt it (the attacker collusion with the server is not mitigated). Yet another idea would be for each party (device) to share its private (or encapsulation) key and to have a symmetric key (used to encrypt the ratchet state) encrypted (encapsulated) separately for each device. This would reduce the size of the stored data to `ratchet size` + `encrypted key size` * N, so even in case of PQ encryption (e.g. sntrup) the size required to store the ratchet would be under transport block size, while limiting it to say 4-8 devices, which is sufficient.
-
-To participate in multi-device scheme the devices would join the usual group that will be used to share public (encapsulation) device keys and to communicate updates to conversations that were received by the currently "active" device. "Active" means the device that received or sent and processed the message, and while only one device can receive messages from a given queue, device "active" state may be determined per queue, allowing concurrent usage.
-
-The scheme must be resilient to state updates being lost, and in case of direct messages it would result in some messages not being shown (or shown as skipped), while conversation preference and profile updates can be re-requested from peers, while the current profile of the user would become the latest. Likewise, for groups state updates ca be requested from super-peers or for decentralized groups - from owners. Maintaining chat state consistency is an important consideration, but is not a focus of this RFC - the focus is managing message delivery and DR encryption for multiple devices. Other multi-device schemes have the same issues with state consistency. Partially, the profile state consistency can be improved by using a single shared queue (or set of queues) to store user's profile and chat preferences to synchronize profile updates asynchronously between the devices.
-
-## The protocol to send the message
-
-`rsi` - ratchet state on device `i`.
-
-`enc(rs)` - current authoritative ratchet state on the server.
-
-`pt` and `ct` - plaintext and ciphertext messages.
-
-Encryption is a state transition function ratchetEnc: `(ct, rs') = ratchetEnc(pt, rs)`.
-
-1. Device encrypts the message using the stored ratchet state: `(ct, rsi') = ratchetEnc(pt, rsi)`
-
-2. Device sends modified encrypted ratchet state and the hash of the previous encrypted state to the server that stores the queue: `RSET (hash(enc(rsi)), enc(rsi'))`.
-
-3. If the hash of the previous state matches state stored on the server (`hash(enc(rsi)) == hash(enc(rs))`), the server updates the state and responds with `ratchet_ok` (that may include the current state or it's hash, for validation). If the hash is different, the server responds with `bad_ratchet(enc(rs))` message that includes the correct ratchet state. These updates must be atomic. In this case device has to update the local ratchet state (provided it can decrypt it), and repeat encryption attempt. If device cannot decrypt the provided ratchet state, it means that the connection is disrupted (possibly, device is removed from device group, but missed the notifications).
-
-4. After successful state update in primary receiving queue, the device would update it in secondary receiving queues.
-
-5. Device sends encrypted message as usual, via proxy that must be different both from the server that stores the ratchet and from the destination server.
-
-6. Device broadcasts sent message and new ratchet state to other devices in the device group.
-
-This protocol is simple, and it minimizes requests when sending the message to one additional request to update ratchet state in most cases, only requiring two requests when device state was not updated via device group prior to message sending attempt.
-
-## The protocol to receive the message
-
-Decryption is also a state transition function: `(pt, rs') = ratchetDec(ct, rs)`
-
-1. Server sends the message to the device (can be in response to SUB or ACK commands, or with active subscription). Pushed message would include the hash of the currently stored ratchet state: `hash(enc(rs))`.
-
-2. If device has the ratchet state with the same hash (`hash(enc(rs)) == hash(enc(rsi))`), it decrypts the message: `(pt, rsi') = ratchetDec(ct, rsi)`.
-
-3. If device has ratchet state with a different hash, it requests ratchet from the server with additional protocol command `RGET` with response `RCHT (enc(rs))` and updates the local state.
-
-4. Device decrypts the message `(pt, rsi') = ratchetDec(ct, rsi)` and processes it as usual.
-
-5. Device sends acknowledgement to the server as usual, but now it includes the new ratchet state and the hash of the previous state: `ACK msgId (hash(enc(rsi)), enc(rsi'))`
-
-6. The server compares ratchet state with stored state hash, and in case it matches it processes `ACK` and responds with `OK` as usual (or `NO_MSG` in case msgId is incorrect, also as usual - it would happen in repeated ACK requests). If ratchet state hash does not match, the server would respond with `bad_ratchet(enc(rs))` - which means that the message was already processed by another device and ratchet was advanced. This is a complex scenario, as the client has to either revert the change from message processing or somehow combine the change with the updates communicated via device group (as a side note, device group can simply re-broadcast messages, not state updates, but it will result in state divergence between devices when different messages are lost).
-
-Unlike sending messages, this flow does not require any additional requests in most cases, only requiring requesting message state reconciliation when the same message was received and processed by more than one client, but it does not require re-acknowledgement.
-
-## Challenges
-
-This is an idea of the design rather than the actual design, as it requires more thinking about:
- how to handle concurrent ratchet state updates,
- "active" status transitions per queue,
- avoiding concurrent subscriptions to queues from multiple devices,
- state updates and synchronization between devices,
- handling skipped messages,
- costs to update ratchets in bulk send scenario - this scheme would substantially increase costs of preparing large broadcasts, and it makes this scheme not acceptable for chat relays. Which means that "profile" on desktop used as chat relay won't be synched to other devices.
- etc.
-
-## Advantages
-
-The communication peers won't know how many devices the user has, and which device was used to send the message. Also, the communication peers won't be able to send different messages to different user's devices, or to withhold messages from some devices.
@@ -1,67 +0,0 @@
-name: SimpleX Chat - smp-server
-
-services:
-  oneshot:
-    image: ubuntu:latest
-    environment:
-      CADDYCONF: |
-        ${CADDY_OPTS:-}
-
-        http://{$$ADDR} {
-            redir https://{$$ADDR}{uri} permanent
-        }
-
-        {$$ADDR}:8443 {
-            tls {
-                key_type rsa4096
-            }
-        }
-    command: sh -c 'if [ ! -f /etc/caddy/Caddyfile ]; then printf "$${CADDYCONF}" > /etc/caddy/Caddyfile; fi'
-    volumes:
-      - ./caddy_conf:/etc/caddy
-
-  caddy:
-    image: caddy:latest
-    depends_on:
-      oneshot:
-        condition: service_completed_successfully
-    cap_add:
-      - NET_ADMIN
-    environment:
-      ADDR: ${ADDR?"Please specify the domain."}
-    volumes:
-      - ./caddy_conf:/etc/caddy
-      - caddy_data:/data
-      - caddy_config:/config
-    ports:
-      - 80:80
-    restart: unless-stopped
-    healthcheck:
-      test: "test -d /data/caddy/certificates/${CERT_PATH:-acme-v02.api.letsencrypt.org-directory}/${ADDR} || exit 1"
-      interval: 1s
-      retries: 60
-
-  smp-server:
-    image: ${SIMPLEX_IMAGE:-simplexchat/smp-server:latest}
-    depends_on:
-      caddy:
-        condition: service_healthy
-    environment:
-      ADDR: ${ADDR?"Please specify the domain."}
-      PASS: ${PASS:-}
-    volumes:
-      - ./smp_configs:/etc/opt/simplex
-      - ./smp_state:/var/opt/simplex
-      - type: volume
-        source: caddy_data
-        target: /certificates
-        volume:
-          subpath: "caddy/certificates/${CERT_PATH:-acme-v02.api.letsencrypt.org-directory}/${ADDR}"
-    ports:
-      - 443:443
-      - 5223:5223
-    restart: unless-stopped
-
-volumes:
-  caddy_data:
-  caddy_config:
@@ -1,15 +0,0 @@
-name: SimpleX Chat - smp-server
-
-services:
-  smp-server:
-    image: ${SIMPLEX_IMAGE:-simplexchat/smp-server:latest}
-    environment:
-      WEB_MANUAL: ${WEB_MANUAL:-1}
-      ADDR: ${ADDR?"Please specify the domain."}
-      PASS: ${PASS:-}
-    volumes:
-      - ./smp_configs:/etc/opt/simplex
-      - ./smp_state:/var/opt/simplex
-    ports:
-      - 5223:5223
-    restart: unless-stopped
@@ -1,11 +0,0 @@
-# Mandatory
-ADDR=your_ip_or_addr
-
-# Optional
-#PASS='123123'
-#WEB_MANUAL=1
-
-# Debug
-#SIMPLEX_SMP_IMAGE=smp-server-dev
-#CERT_PATH=acme-staging-v02.api.letsencrypt.org-directory
-#CADDY_OPTS='{\n    acme_ca https://acme-staging-v02.api.letsencrypt.org/directory\n}'
@@ -1,9 +0,0 @@
-# Mandatory
-ADDR=your_ip_or_addr
-QUOTA=120gb
-
-# Optional
-#PASS='123123'
-
-# Debug
-#SIMPLEX_XFTP_IMAGE=xftp-server-dev
@@ -1,16 +0,0 @@
-name: SimpleX Chat - xftp-server
-
-services:
-  xftp-server:
-    image: ${SIMPLEX_XFTP_IMAGE:-simplexchat/xftp-server:latest}
-    environment:
-      ADDR: ${ADDR?"Please specify the domain."}
-      QUOTA: ${QUOTA?"Please specify disk quota."}
-      PASS: ${PASS:-}
-    volumes:
-      - ./xftp_configs:/etc/opt/simplex-xftp
-      - ./xftp_state:/var/opt/simplex-xftp
-      - ./xftp_files:/srv/xftp
-    ports:
-      - 443:443
-    restart: unless-stopped
@@ -1,87 +1,48 @@
 #!/usr/bin/env sh
-set -e
-
 confd='/etc/opt/simplex'
-cert_path='/certificates'
+logd='/var/opt/simplex/'

 # Check if server has been initialized
 if [ ! -f "${confd}/smp-server.ini" ]; then
  # If not, determine ip or domain
  case "${ADDR}" in
-    '')
-      printf 'Please specify $ADDR environment variable.\n'
-      exit 1
-      ;;
-
-    # Determine domain or IPv6
+    '') printf 'Please specify $ADDR environment variable.\n'; exit 1 ;;
    *[a-zA-Z]*)
      case "${ADDR}" in
-        # IPv6
-        *:*)
-          set -- --ip "${ADDR}"
-          ;;
-
-        # Domain
-        *)
-          case "${ADDR}" in
-            # It's in domain format
-            *.*)
-              # Determine the base domain
-              ADDR_BASE="$(printf '%s' "$ADDR" | awk -F. '{print $(NF-1)"."$NF}')"
-              set -- --fqdn "${ADDR}" --own-domains="${ADDR_BASE}"
-              ;;
-
-            # Incorrect domain
-            *)
-              printf 'Incorrect $ADDR environment variable. Please specify the correct one in format: smp1.example.org / example.org \n'
-              exit 1
-              ;;
-          esac
+        *:*) set -- --ip "${ADDR}" ;;
+        *) set -- -n "${ADDR}" ;;
      esac
      ;;
-
-    # Assume everything else is IPv4
-    *)
-      set -- --ip "${ADDR}" ;;
+    *) set -- --ip "${ADDR}" ;;
  esac

  # Optionally, set password
  case "${PASS}" in
-    # Empty value = no password
-    '')
-      set -- "$@" --no-password
-      ;;
-
-    # Assume that everything else is a password
-    *)
-      set -- "$@" --password "${PASS}"
-      ;;
+    '') set -- "$@" --no-password ;;
+    *) set -- "$@" --password "${PASS}" ;;
  esac

  # And init certificates and configs
-  smp-server init --yes \
-                  --store-log \
-                  --daily-stats \
-                  --source-code \
-                  "$@" > /dev/null 2>&1
-
-  # Fix path to certificates
-  if [ -n "${WEB_MANUAL}" ]; then
-    sed -i -e 's|^[^#]*https: |#&|' \
-           -e 's|^[^#]*cert: |#&|' \
-           -e 's|^[^#]*key: |#&|' \
-           -e 's|^port:.*|port: 5223|' \
-           "${confd}/smp-server.ini"
-  else
-    sed -i -e "s|cert: /etc/opt/simplex/web.crt|cert: $cert_path/$ADDR.crt|" \
-           -e "s|key: /etc/opt/simplex/web.key|key: $cert_path/$ADDR.key|" \
-           "${confd}/smp-server.ini"
-  fi
+  smp-server init -y -l "$@"
 fi

 # Backup store log just in case
-DOCKER=true /usr/local/bin/simplex-servers-stopscript smp-server
+#
+# Uses the UTC (universal) time zone and this
+# format: YYYY-mm-dd'T'HH:MM:SS
+# year, month, day, letter T, hour, minute, second
+#
+# This is the ISO 8601 format without the time zone at the end.
+#
+_file="${logd}/smp-server-store.log"
+if [ -f "${_file}" ]; then
+  _backup_extension="$(date -u '+%Y-%m-%dT%H:%M:%S')"
+  cp -v -p "${_file}" "${_file}.${_backup_extension:-date-failed}"
+  unset -v _backup_extension
+fi
+unset -v _file

 # Finally, run smp-sever. Notice that "exec" here is important:
 # smp-server replaces our helper script, so that it can catch INT signal
 exec smp-server start +RTS -N -RTS
+
@@ -1,90 +1,50 @@
 #!/usr/bin/env sh
-set -eu
-
 confd='/etc/opt/simplex-xftp'
+logd='/var/opt/simplex-xftp'

 # Check if server has been initialized
 if [ ! -f "${confd}/file-server.ini" ]; then
  # If not, determine ip or domain
  case "${ADDR}" in
-    '')
-      printf 'Please specify $ADDR environment variable.\n'
-      exit 1
-      ;;
-
-    # Determine domain or IPv6
+    '') printf 'Please specify $ADDR environment variable.\n'; exit 1 ;;
    *[a-zA-Z]*)
      case "${ADDR}" in
-        # IPv6
-        *:*)
-          set -- --ip "${ADDR}"
-          ;;
-
-        # Domain
-        *)
-          case "${ADDR}" in
-            # Check if format is correct
-            *.*)
-              set -- --fqdn "${ADDR}"
-              ;;
-
-            # Incorrect domain
-            *)
-              printf 'Incorrect $ADDR environment variable. Please specify the correct one in format: smp1.example.org / example.org \n'
-              exit 1
-              ;;
-          esac
-          ;;
+        *:*) set -- --ip "${ADDR}" ;;
+        *) set -- -n "${ADDR}" ;;
      esac
      ;;
-
-    # Assume everything else is IPv4
-    *)
-      set -- --ip "${ADDR}"
-      ;;
+    *) set -- --ip "${ADDR}" ;;
  esac

-  # Set global disk quota
+  # Set quota
  case "${QUOTA}" in
-    '')
-      printf 'Please specify $QUOTA environment variable.\n'
-      exit 1
-      ;;
-
-    # Incorrect format in uppercase, but automagically workaround this, replacing characters to lowercase
-    *GB)
-      QUOTA="$(printf '%s' "${QUOTA}" | tr '[:upper:]' '[:lower:]')"
-      set -- "$@" --quota "${QUOTA}"
-      ;;
-
-    # Correct format  
-    *gb)
-      set -- "$@" --quota "${QUOTA}"
-      ;;
-
-    # Incorrect format
-    *)
-      printf 'Wrong format. Format should be: 1gb, 10gb, 100gb.\n'
-      exit 1
-      ;;
+    '') printf 'Please specify $QUOTA environment variable.\n'; exit 1 ;;
+    *GB) QUOTA="$(printf ${QUOTA} | tr '[:upper:]' '[:lower:]')"; set -- "$@" --quota "${QUOTA}" ;;
+    *gb) set -- "$@" --quota "${QUOTA}" ;;
+    *) printf 'Wrong format. Format should be: 1gb, 10gb, 100gb.\n'; exit 1 ;;
  esac

  # Init the certificates and configs
-  xftp-server init --store-log \
-                   --path /srv/xftp \
-                   "$@" > /dev/null 2>&1
-
-  # Optionally, set password
-  if [ -n "${PASS}" ]; then
-    sed -i -e "/^# create_password:/a create_password: $PASS" \
-           "${confd}/file-server.ini"
-  fi
+  xftp-server init -l -p /srv/xftp "$@"
 fi

 # Backup store log just in case
-
-DOCKER=true /usr/local/bin/simplex-servers-stopscript xftp-server
+#
+# Uses the UTC (universal) time zone and this
+# format: YYYY-mm-dd'T'HH:MM:SS
+# year, month, day, letter T, hour, minute, second
+#
+# This is the ISO 8601 format without the time zone at the end.
+#
+_file="${logd}/file-server-store.log"
+if [ -f "${_file}" ]; then
+  _backup_extension="$(date -u '+%Y-%m-%dT%H:%M:%S')"
+  cp -v -p "${_file}" "${_file}.${_backup_extension:-date-failed}"
+  unset -v _backup_extension
+fi
+unset -v _file

 # Finally, run xftp-sever. Notice that "exec" here is important:
 # smp-server replaces our helper script, so that it can catch INT signal
 exec xftp-server start +RTS -N -RTS
+
@@ -148,10 +148,8 @@ xftp_cleanup() {

 main() {
 	type="${1:-}"
-
-  if [ -z "${DOCKER+x}" ]; then
-  	checks
-  fi
+  
+	checks

 	case "$type" in
 		smp-server)
@@ -1,8 +1,13 @@
 #!/usr/bin/env sh
 set -eu

-# Make sure that PATH variable contains /usr/local/bin
-PATH="/usr/local/bin:$PATH"
+# Links to scripts/configs
+scripts="https://raw.githubusercontent.com/simplex-chat/simplexmq/stable/scripts/main"
+scripts_systemd_smp="$scripts/smp-server.service"
+scripts_systemd_xftp="$scripts/xftp-server.service"
+scripts_update="$scripts/simplex-servers-update"
+scripts_uninstall="$scripts/simplex-servers-uninstall"
+scripts_stopscript="$scripts/simplex-servers-stopscript"

 # Default installation paths
 path_bin="/usr/local/bin"
@@ -17,9 +22,7 @@ path_systemd_smp="$path_systemd/smp-server.service"
 path_systemd_xftp="$path_systemd/xftp-server.service"

 # Temporary paths
-path_tmp_bin="/tmp/simplex-servers"
-path_tmp_bin_smp="$path_tmp_bin/smp-server"
-path_tmp_bin_xftp="$path_tmp_bin/xftp-server"
+path_tmp_bin="$(mktemp -d)"
 path_tmp_bin_update="$path_tmp_bin/simplex-servers-update"
 path_tmp_bin_uninstall="$path_tmp_bin/simplex-servers-uninstall"
 path_tmp_bin_stopscript="$path_tmp_bin/simplex-servers-stopscript"
@@ -34,549 +37,203 @@ BLU='\033[1;36m'
 YLW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m'
-BLD='\033[1m'
-UNDRL='\033[4m'
-
-NL='
-'
-
-# Set VER globally and only once
-VER="${VER:-latest}"

 # Currently, XFTP default to v0.1.0, so it doesn't make sense to check its version

-######################
-### Misc functions ###
-######################
+os_test() {
+ . /etc/os-release

-# Checks "sanity" of downloaded thing, e.g. if it's really a script or binary
-check_sanity() {
-  path="$1"
-  criteria="$2"
+ case "$VERSION_ID" in
+  20.04|22.04) : ;;
+  24.04) VERSION_ID='22.04' ;;
+  *) printf "${RED}Unsupported Ubuntu version!${NC}\nPlease file Github issue with request to support Ubuntu %s: https://github.com/simplex-chat/simplexmq/issues/new\n" "$VERSION_ID" && exit 1 ;;
+ esac

-  case "$criteria" in
-    string:*)
-      pattern="$(printf '%s' "$criteria" | awk '{print $2}')"
-      
-      if grep -q "$pattern" "$path"; then
-        sane=0
-      else
-        sane=1
-      fi
-      ;;
-    file:*)
-      pattern="$(printf '%s' "$criteria" | awk '{print $2}')"
+ version="$(printf '%s' "$VERSION_ID" | tr '.' '_')"
+ arch="$(uname -p)"

-      if file "$path" | grep -q "$pattern"; then
-        sane=0
-      else
-        sane=1
-      fi
-      ;;
-    *) printf 'Unknown criteria.\n'; sane=1 ;;
-  esac
+ case "$arch" in
+  x86_64) arch="$(printf '%s' "$arch" | tr '_' '-')" ;;
+  *)  printf "${RED}Unsupported architecture!${NC}\nPlease file Github issue with request to support %s architecture: https://github.com/simplex-chat/simplexmq/issues/new" "$arch" && exit 1 ;;
+ esac

-  unset path string
-
-  return "$sane"
+ bin_smp="$bin/smp-server-ubuntu-${version}-${arch}"
+ bin_xftp="$bin/xftp-server-ubuntu-${version}-${arch}"
 }

-# Checks if old thing and new thing is different
-change_check() {
-  old="$1"
-  new="$2"
-
-  if [ -x "$new" ] || [ -f "$new" ]; then
-    type="$(file $new)"
-  else
-    type='string'
-  fi
-
-  case "$type" in
-    *script*|*text*)
-      if diff -q "$old" "$new" > /dev/null 2>&1; then
-        changed=1
-      else
-        changed=0
-      fi
-      ;;
-    string)
-      if [ "$old" = "$new" ]; then
-        changed=1
-      else
-        changed=0
-      fi
-      ;;
-  esac
-
-  return "$changed"
-}
-
-##########################
-### Misc functions END ###
-##########################
-
-#########################
-### Support functions ###
-#########################
-
-# Sets local/remote versions and "apps" variables
-check_versions() {
-  # Sets:
-  # - ver
-  # - bin_url
-  # - remote_version
-  # - local_version
-  # - apps
-
-  case "$VER" in 
-    latest)
-      remote_version="$(curl --proto '=https' --tlsv1.2 -sSf -L https://api.github.com/repos/simplex-chat/simplexmq/releases/latest 2>/dev/null | grep -i "tag_name" | awk -F \" '{print $4}')"
-
-      if [ -z "$remote_version" ]; then
-        printf "${RED}Something went wrong when ${YLW}resolving the lastest version${NC}: either you don't have connection to Github or you're rate-limited.\n"
-        exit 1
-      fi
-      ;;
-    *)
-      # Check if this version really exist
-      ver_check="https://github.com/simplex-chat/simplexmq/releases/tag/${VER}"
-      
-      if curl -o /dev/null --proto '=https' --tlsv1.2 -sf -L "${ver_check}"; then
-        remote_version="${VER}"
-      else
-        printf "Provided version ${BLU}%s${NC} ${RED}doesn't exist${NC}! Switching to ${BLU}latest${NC}.\n" "${VER}"
-        VER='latest'
-
-        # Re-execute check
-        check_versions
-
-        # Everything has been done, so return from the function
-        return 0
-      fi
-      ;;
-  esac
-
-  # Links to scripts/configs
-  bin_url="https://github.com/simplex-chat/simplexmq/releases/download/${remote_version}"
-  scripts_url="https://raw.githubusercontent.com/simplex-chat/simplexmq/refs/tags/${remote_version}/scripts/main"
-  scripts_url_systemd_smp="$scripts_url/smp-server.service"
-  scripts_url_systemd_xftp="$scripts_url/xftp-server.service"
-  scripts_url_update="$scripts_url/simplex-servers-update"
-  scripts_url_uninstall="$scripts_url/simplex-servers-uninstall"
-  scripts_url_stopscript="$scripts_url/simplex-servers-stopscript"
-
+installed_test() {
  set +u
-  for i in smp xftp; do
-    # Only check local directory where binaries are installed by the script
-    if command -v "/usr/local/bin/$i-server" >/dev/null; then
-      apps="$i $apps"
+  for i in $path_conf_etc/*; do
+    if [ -d "$i" ]; then
+      case "$i" in
+        *simplex) apps="smp $apps" ;;
+        *simplex-xftp) apps="xftp $apps" ;;
+      esac
    fi
  done
  set -u
-
-  if [ -z "$apps" ]; then
-    printf "${RED}No simplex servers installed! Aborting.${NC}\n"
-    exit 1
-  fi
-
-  for server in $apps; do
-    # Check if info file is present
-    if [ -f "$path_conf_info/release" ]; then
-      # If present, source it
-      . "$path_conf_info/release" 2>/dev/null
-
-      # Check if line containing local version exists in file
-      if grep -q "local_version_${server}" "$path_conf_info/release"; then
-        # if exists, set the var
-        eval "local_version=\$local_version_${server}"
-      else
-        # If it doesn't, append it to file
-        printf "local_version_${server}=unset\n" >> "$path_conf_info/release"
-        # And set it in script (so we don't have to re-source the file)
-        eval "local_version_${server}=unset"
-      fi
-    else
-      # If there isn't info file, populate it
-      printf "local_version_${server}=unset\n" >> "$path_conf_info/release"
-    fi
-  done
-
-  # Return 
-  return 0
 }

-# Checks the distro and sets the urls variables
-check_distro() {
-  . /etc/os-release
+set_version() {
+  ver="${VER:-latest}"

-  case "$VERSION_ID" in
-    20.04|22.04) : ;;
-    24.04) VERSION_ID='22.04' ;;
-    *) printf "${RED}Unsupported Ubuntu version!${NC}\nPlease file Github issue with request to support Ubuntu %s: https://github.com/simplex-chat/simplexmq/issues/new\n" "$VERSION_ID" && exit 1 ;;
+  case "$ver" in 
+    latest)
+      bin="https://github.com/simplex-chat/simplexmq/releases/latest/download"
+      remote_version="$(curl --proto '=https' --tlsv1.2 -sSf -L https://api.github.com/repos/simplex-chat/simplexmq/releases/latest | grep -i "tag_name" | awk -F \" '{print $4}')"
+      ;;
+    *)
+      bin="https://github.com/simplex-chat/simplexmq/releases/download/${ver}"
+      remote_version="${ver}"
+      ;;
  esac
-
-  version="$(printf '%s' "$VERSION_ID" | tr '.' '_')"
-  arch="$(uname -p)"
-
-  case "$arch" in
-    x86_64) arch="$(printf '%s' "$arch" | tr '_' '-')" ;;
-    *)  printf "${RED}Unsupported architecture!${NC}\nPlease file Github issue with request to support %s architecture: https://github.com/simplex-chat/simplexmq/issues/new" "$arch" && exit 1 ;;
-  esac
-
-  bin_url_smp="$bin_url/smp-server-ubuntu-${version}-${arch}"
-  bin_url_xftp="$bin_url/xftp-server-ubuntu-${version}-${arch}"
-
-  return 0
 }

-# General checks that must be performed on the initial execution of script
-checks() {
-  if [ "$(id -u)" -ne 0 ]; then
-    printf "This script is intended to be run with root privileges. Please re-run script using sudo.\n"
-    exit 1
+update_scripts() {
+  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_update" -o "$path_tmp_bin_update" && chmod +x "$path_tmp_bin_update"
+  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_uninstall" -o "$path_tmp_bin_uninstall" && chmod +x "$path_tmp_bin_uninstall"
+  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_stopscript" -o "$path_tmp_bin_stopscript" && chmod +x "$path_tmp_bin_stopscript"
+
+  if diff -q "$path_bin_uninstall" "$path_tmp_bin_uninstall" > /dev/null 2>&1; then
+    printf -- "- ${YLW}Uninstall script is up-to-date${NC}.\n"
+    rm "$path_tmp_bin_uninstall"
+  else
+    printf -- "- Updating uninstall script..."
+    mv "$path_tmp_bin_uninstall" "$path_bin_uninstall"
+    printf "${GRN}Done!${NC}\n"
  fi

-  check_versions
-  check_distro
+  if diff -q "$path_bin_stopscript" "$path_tmp_bin_stopscript" > /dev/null 2>&1; then
+    printf -- "- ${YLW}Stopscript script is up-to-date${NC}.\n"
+    rm "$path_tmp_bin_stopscript"
+  else
+    printf -- "- Updating stopscript script..."
+    mv "$path_tmp_bin_stopscript" "$path_bin_stopscript"
+    printf "${GRN}Done!${NC}\n"
+  fi

-  mkdir -p $path_conf_info $path_tmp_bin
-
-  return 0
+  if diff -q "$path_bin_update" "$path_tmp_bin_update" > /dev/null 2>&1; then
+    printf -- "- ${YLW}Update script is up-to-date${NC}.\n"
+    rm "$path_tmp_bin_update"
+  else
+    printf -- "- Updating update script..."
+    mv "$path_tmp_bin_update" "$path_bin_update"
+    printf "${GRN}Done!${NC}\n"
+    printf -- "- Re-executing Update script with latest updates..."
+    exec sh "$path_bin_update" "continue"
+  fi
 }

-#############################
-### Support functions END ###
-#############################
-
-######################
-### Main functions ###
-######################
-
-# Downloads thing to directory and checks its sanity
-download_thing() {
-  thing="$1"
-  path="$2"
-  check_pattern="$3"
-  err_msg="$4"
-  
-  if ! curl --proto '=https' --tlsv1.2 -sSf -L "$thing" -o "$path"; then
-    printf "${RED}Something went wrong when downloading ${YLW}%s${NC}: either you don't have connection to Github or you're rate-limited.\n" "$err_msg"
-    exit 1
-  fi
-
-  type="$(file "$path")"
-
-  case "$type" in
-    *script*|*executable*) chmod +x "$path" ;;
-  esac
-
-  if ! check_sanity "$path" "$check_pattern"; then
-    printf "${RED}Something went wrong with downloaded ${YLW}%s${NC}: file is corrupted.\n" "$err_msg"
-    exit 1
-  fi
-
-  return 0
-}
-
-# Downloads all necessary files to temp dir and set update messages for the menu
-download_all() {
-  download_thing "$scripts_url_update" "$path_tmp_bin_update" 'string: /usr/bin/env' 'Update script'
-  if change_check "$path_tmp_bin_update" "$path_bin_update"; then
-    msg_scripts="${msg_scripts+$msg_scripts, }${YLW}simplex-servers-update${NC}"
-    msg_scripts_raw="${msg_scripts_raw+$msg_scripts_raw/}update"
-  fi
-
-  download_thing "$scripts_url_stopscript" "$path_tmp_bin_stopscript" 'string: /usr/bin/env' 'Stop script'
-  if change_check "$path_tmp_bin_stopscript" "$path_bin_stopscript"; then
-    msg_scripts="${msg_scripts+$msg_scripts, }${YLW}simplex-servers-stopscript${NC}"
-    msg_scripts_raw="${msg_scripts_raw+$msg_scripts_raw/}stop"
-  fi
-
-  download_thing "$scripts_url_uninstall" "$path_tmp_bin_uninstall" 'string: /usr/bin/env' 'Uninstall script'
-  if change_check "$path_tmp_bin_uninstall" "$path_bin_uninstall"; then
-    msg_scripts="${msg_scripts+$msg_scripts, }${YLW}simplex-servers-uninstall${NC}"
-    msg_scripts_raw="${msg_scripts_raw+$msg_scripts_raw/}uninstall"
-  fi
-
-  for i in $apps; do
-    service="${i}-server"
-    eval "scripts_url_systemd_final=\$scripts_url_systemd_${i}"
-    eval "path_tmp_systemd_final=\$path_tmp_systemd_${i}"
-    eval "path_systemd_final=\$path_systemd_${i}"
+update_systemd() {
+  service="${1}-server"
+  eval "scripts_systemd=\$scripts_systemd_${1}"
+  eval "path_systemd=\$path_systemd_${1}"
+  eval "path_tmp_systemd=\$path_tmp_systemd_${1}"
   
-    download_thing "$scripts_url_systemd_final" "$path_tmp_systemd_final" 'string: [Unit]' "$service systemd service"
-    if change_check "$path_tmp_systemd_final" "$path_systemd_final"; then
-      msg_services="${msg_services+$msg_services, }${YLW}$service.service${NC}"
-      msg_services_raw="${msg_services_raw+$msg_services_raw/}$service"
-    fi
-  done
-
-  for i in $apps; do
-    service="${i}-server"
-    eval "local_version=\$local_version_${i}"
-
-    if change_check "$local_version" "$remote_version"; then
-      msg_bins="${msg_bins+$msg_bins$NL}  - ${YLW}$service${NC}: from ${BLU}$local_version${NC} to ${BLU}$remote_version${NC}"
-      msg_bins_alt="${msg_bins_alt+$msg_bins_alt, }${YLW}$service${NC}"
-      msg_bins_raw="${msg_bins_raw+$msg_bins_raw/}$service"
-    fi
-  done
-
-  return 0
-}
-
-# Updates systemd and scripts. This function depends om variables from "download_all"
-update_misc() {
-  OLD_IFS="$IFS"
-
-  IFS='/'
-  for script in ${msg_scripts_raw:-}; do
-    case "$script" in
-      update)
-        printf -- "- Updating update script..."
-        mv "$path_tmp_bin_update" "$path_bin_update"
-        printf "${GRN}Done!${NC}\n"
-        printf -- "- Re-executing Update script..."
-        exec env UPDATE_SCRIPT_DONE=1 VER="$remote_version" "$path_bin_update" "${selection}"
-        ;;
-      stop)
-        printf -- "- Updating stopscript script..."
-        mv "$path_tmp_bin_stopscript" "$path_bin_stopscript"
-        printf "${GRN}Done!${NC}\n"
-        ;;
-      uninstall)
-        printf -- "- Updating uninstall script..."
-        mv "$path_tmp_bin_uninstall" "$path_bin_uninstall"
-        printf "${GRN}Done!${NC}\n"
-        ;;
-    esac
-  done
-
-  for service in ${msg_services_raw:-}; do
-    app="${service%%-*}"
-    eval "path_systemd=\$path_systemd_${app}"
-    eval "path_tmp_systemd=\$path_tmp_systemd_${app}"
+  curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_systemd" -o "$path_tmp_systemd"

+  if diff -q "$path_systemd" "$path_tmp_systemd" > /dev/null 2>&1; then
+    printf -- "- ${YLW}%s service is up-to-date${NC}.\n" "$service"
+    rm "$path_tmp_systemd"
+  else
    printf -- "- Updating %s service..." "$service"
    mv "$path_tmp_systemd" "$path_systemd"
    systemctl daemon-reload
    printf "${GRN}Done!${NC}\n"
-  done
+  fi

-  IFS="$OLD_IFS"
-  return 0
+  unset service scripts_systemd path_systemd path_tmp_systemd
 }

-# Updates binaries. This function depends on variables from "download_all"
 update_bins() {
-  OLD_IFS="$IFS"
+  service="${1}-server"
+  eval "bin=\$bin_${1}"
+  eval "path_bin=\$path_bin_${1}"

-  IFS='/'
-  for service in ${msg_bins_raw:-}; do
-    app="${service%%-*}"
-    eval "local_version=\$local_version_${app}"
-    eval "bin_url_final=\$bin_url_${app}"
-    eval "path_tmp_bin_final=\$path_tmp_bin_${app}"
-    eval "path_bin_final=\$path_bin_${app}"
+  set_ver() {
+    local_version='unset'
+    sed -i -- "s/local_version_${1}=.*/local_version_${1}='${remote_version}'/" "$path_conf_info/release"
+  }

-    # If systemd service is active
+  if [ -f "$path_conf_info/release" ]; then
+    . "$path_conf_info/release" 2>/dev/null
+
+    set +u
+    eval "local_version=\$local_version_${1}"
+    set -u
+
+    if [ -z "${local_version}" ]; then
+            set_ver "$1"
+    fi
+  else
+    printf 'local_version_xftp=\nlocal_version_smp=\n' > "$path_conf_info/release"
+    set_ver "$1"
+  fi
+
+  if [ "$local_version" != "$remote_version" ]; then
    if systemctl is-active --quiet "$service"; then
      printf -- "- Stopping %s service..." "$service"
      systemctl stop "$service"
      printf "${GRN}Done!${NC}\n"

-      printf -- "- Updating ${YLW}%s${NC} from ${BLU}%s${NC} to ${BLU}%s${NC}..." "$service" "$local_version" "$remote_version"
-      download_thing "$bin_url_final" "$path_tmp_bin_final" 'file: ELF' "$service"
-      mv "$path_tmp_bin_final" "$path_bin_final"
+      printf -- "- Updating %s to %s..." "$service" "$remote_version"
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin" -o "$path_bin" && chmod +x "$path_bin"
      printf "${GRN}Done!${NC}\n"
      
      printf -- "- Starting %s service..." "$service"
      systemctl start "$service"
      printf "${GRN}Done!${NC}\n"
    else
-      # If systemd service is NOT active
-      printf -- "- Updating ${YLW}%s${NC} from ${BLU}%s${NC} to ${BLU}%s${NC}..." "$service" "$local_version" "$remote_version"
-      download_thing "$bin_url_final" "$path_tmp_bin_final" 'file: ELF' "$service"
-      mv "$path_tmp_bin_final" "$path_bin_final"
+      printf -- "- Updating %s to %s..." "$service" "$remote_version"
+      curl --proto '=https' --tlsv1.2 -sSf -L "$bin" -o "$path_bin" && chmod +x "$path_bin"
      printf "${GRN}Done!${NC}\n"
    fi
-
-    # Don't forget to set version
-    sed -i -- "s|local_version_${app}=.*|local_version_${app}='${remote_version}'|" "$path_conf_info/release"
-  done
-
-  IFS="$OLD_IFS"
-  return 0
-}
-
-# Just download binaries
-download_bins() {
-  OLD_IFS="$IFS"
-
-  IFS='/'
-  for service in ${msg_bins_raw:-}; do
-    app="${service%%-*}"
-    eval "local_version=\$local_version_${app}"
-    eval "bin_url_final=\$bin_url_${app}"
-    eval "path_tmp_bin_final=\$path_tmp_bin_${app}"
-    eval "path_bin_final=\$path_bin_${app}"
-
-    printf -- "- Downloading ${YLW}%s${NC} binary..." "$service"
-    download_thing "$bin_url_final" "$path_tmp_bin_final" 'file: ELF' "$service"
-    printf "${GRN}Done!${NC}\n"
-  done
-
-  IFS="$OLD_IFS"
-  return 0
-}
-
-menu_init_help() {
-  menu_help="Update script for SimpleX servers and scripts.${NL}${NL}"
-  menu_help="${menu_help}${BLD}${UNDRL}Usage:${NC} [<VARIABLE>] ${BLD}simplex-servers-update${NC}${NL}       [<VARIABLE>] ${BLD}simplex-servers-update${NC} [<SUBCOMMAND>]${NL}${NL}"
-  menu_help="${menu_help}${BLD}${UNDRL}Subcommands:${NC}${NL}"
-  menu_help_sub="  ${BLD}[a]ll${NC}		Update everything without confirmation${NL}"
-  menu_help_sub="${menu_help_sub}  ${BLD}[b]inaries${NC}	Update binaries only without confirmation${NL}"
-  menu_help_sub="${menu_help_sub}  ${BLD}[d]ownload${NC}	Download everything without updating${NL}"
-  menu_help_sub="${menu_help_sub}  ${BLD}[h]elp${NC}	Print this message${NL}${NL}"
-  menu_help="${menu_help}${menu_help_sub}"
-  menu_help="${menu_help}${BLD}${UNDRL}Variables:${NC}${NL}"
-  menu_help="${menu_help}  ${BLD}VER=v3.2.1-beta.0${NC}	Update binaries to specified version${NL}"
-
-  return 0
-}
-
-menu_init() {
-  menu_end="${RED}x${NC}) Exit${NL}${NL}Selection: "
-  menu_option_download="${GRN}d${NC}) Download files only${NL}"
-
-  if [ -n "${msg_scripts:-}" ]; then
-    menu_option_misc_raw="${menu_option_misc_raw+${menu_option_misc_raw}${NL}}  - script(s): ${msg_scripts}"
+  else
+    printf -- "- ${YLW}%s is up-to-date${NC}.\n" "$service"
  fi

-  if [ -n "${msg_services:-}" ]; then
-    menu_option_misc_raw="${menu_option_misc_raw+${menu_option_misc_raw}${NL}}  - systemd service file(s): ${msg_services}"
-  fi
+  set_ver "$1"

-  menu_option_all="${GRN}a${NC}) Update all: ${BLU}(recommended)${NC}${NL}${menu_option_misc_raw+${menu_option_misc_raw}${NL}}${msg_bins+${msg_bins}${NL}}"
-
-  if [ -n "${msg_bins:-}" ]; then
-    menu_option_bins="${GRN}b${NC}) Update server binaries: ${msg_bins_alt}${NL}"
-  fi
-
-  # Abort early if there's neither update binaries, nor update scripts options
-  if [ -z "${menu_option_bins:-}" ] && [ -z "${menu_option_misc_raw:-}" ]; then
-    printf "${YLW}Everything is up-to-date${NC}.\n"
-    exit 0
-  fi
-
-  menu="${menu_option_all}${menu_option_bins:-}${menu_option_download}${menu_end}"
-
-  return 0
+  unset service bin path_bin local_version
 }

-options_parse() {
-  selection="$1"
-  
-  case "$selection" in
-    a|all)
-      check=0
-      if [ -z "${menu_option_misc_raw:-}" ] && [ -z "${menu_option_bins:-}" ]; then
-        printf "${YLW}Everything is up-to-date${NC}.\n"
-      else
-        if [ -n "${menu_option_misc_raw:-}" ]; then
-          update_misc
-        fi
-        if [ -n "${menu_option_bins:-}" ]; then
-          update_bins
-        fi
-      fi
-      ;;
-    b|binaries)
-      check=0
-      if [ -n "${menu_option_bins:-}" ]; then
-        update_bins
-      else
-        printf "${YLW}Binaries is up-to-date${NC}.\n"
-      fi
-      ;;
-    d|download)
-      check=0
-      if [ -n "${menu_option_bins:-}" ]; then
-        download_bins
-      fi
+checks() {
+  if [ "$(id -u)" -ne 0 ]; then
+    printf "This script is intended to be run with root privileges. Please re-run script using sudo.\n"
+    exit 1
+  fi

-      printf "\n${YLW}Scripts${NC}/${YLW}services${NC}/${YLW}binaries${NC} has been downloaded to ${BLU}%s${NC}\n" "$path_tmp_bin"
-      ;;
-    x)
-      check=0
-      ;;
-    *)
-      check=1
-      ;;
-  esac
+  set_version
+  os_test
+  installed_test

-  return "$check"
+  mkdir -p $path_conf_info
 }

-##########################
-### Main functions END ###
-##########################
-
-############
-### Init ###
-############
-
 main() {
-  # Early hook to print Done after script re-execution
-  if [ -n "${UPDATE_SCRIPT_DONE:-}" ]; then
+  checks
+
+  set +u
+  if [ "$1" != "continue" ]; then
+    set -u
+    printf "Updating scripts...\n"
+    update_scripts
+  else
+    set -u
    printf "${GRN}Done!${NC}\n"
  fi

-  # Early help menu
-  menu_init_help
-
-  case "${1:-}" in
-    h|help)
-      printf '%b' "$menu_help"
-      exit 0
-      ;;
-  esac
-
-  checks
-  download_all
-  menu_init
-
-  onetime=0
-  while true; do
-    if [ "$onetime" = 0 ]; then
-      onetime=1
-
-      if [ -n "${1:-}" ]; then
-        selection="$1"
-      else
-        printf '%b' "$menu"
-        read selection
-      fi
-    else
-      read selection
-    fi
-    
-    if options_parse "$selection"; then
-      break
-    else
-      # Rerender whole menu if the first non-interactive option was bogus
-      if [ -n "${1:-}" ]; then
-        onetime=0
-        shift 1
-      else
-        # Erase last line
-        printf '\e[A\e[K'
-        # Only rerended selection
-        printf 'Selection: '
-      fi
-    fi
+  printf "Updating systemd services...\n"
+  for i in $apps; do
+    update_systemd "$i"
  done
+  
+  printf "Updating simplex servers...\n"
+  for i in $apps; do
+    update_bins "$i"
+  done
+
+  rm -rf "$path_tmp_bin"
 }

 main "$@"
@@ -5,21 +5,12 @@ Description=SMP server
 User=smp
 Group=smp
 Type=simple
-
 ExecStart=/usr/local/bin/smp-server start +RTS -N -RTS 
 ExecStopPost=/usr/local/bin/simplex-servers-stopscript smp-server
-
 LimitNOFILE=65535
 KillSignal=SIGINT
-
 TimeoutStartSec=infinity
 TimeoutStopSec=infinity
-
-Restart=on-failure
-RestartSec=10s
-StartLimitBurst=3
-StartLimitInterval=60s
-
 AmbientCapabilities=CAP_NET_BIND_SERVICE

 [Install]
@@ -5,21 +5,12 @@ Description=XFTP server
 User=xftp
 Group=xftp
 Type=simple
-
 ExecStart=/usr/local/bin/xftp-server start +RTS -N -RTS
 ExecStopPost=/usr/local/bin/simplex-servers-stopscript xftp-server
-
 LimitNOFILE=65535
 KillSignal=SIGINT
-
 TimeoutStartSec=infinity
 TimeoutStopSec=infinity
-
-Restart=on-failure
-RestartSec=10s
-StartLimitBurst=3
-StartLimitInterval=60s
-
 AmbientCapabilities=CAP_NET_BIND_SERVICE
   
 [Install]
@@ -1,139 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-TAG="$1"
-
-tempdir="$(mktemp -d)"
-init_dir="$PWD"
-
-repo_name="simplexmq"
-repo="https://github.com/simplex-chat/${repo_name}"
-export DOCKER_BUILDKIT=1
-
-cleanup() {
-	docker exec -t builder sh -c 'rm -rf ./dist-newstyle' 2>/dev/null || :
-	rm -rf -- "$tempdir"
-	docker rm --force builder 2>/dev/null || :
-	docker image rm local 2>/dev/null || :
-	cd "$init_dir"
-}
-trap 'cleanup' EXIT INT
-
-mkdir -p "$init_dir/$TAG-$repo_name/from-source" "$init_dir/$TAG-$repo_name/prebuilt"
-
-git -C "$tempdir" clone "$repo.git" &&\
-	cd "$tempdir/${repo_name}" &&\
-	git checkout "$TAG"
-
-for os in 22.04 24.04; do
-	os_url="$(printf '%s' "$os" | tr '.' '_')"
-
-	# Build image
-	docker build \
-		--no-cache \
-		--build-arg TAG=${os} \
-		--build-arg GHC=9.6.3 \
-		-f "$tempdir/simplexmq/Dockerfile.build" \
-		-t local \
-		.
-
-	# Run container in background
-	docker run -t -d \
-		--name builder \
-		-v "$tempdir/${repo_name}:/project" \
-		local
-
-	# PostgreSQL build (only smp-server)
-	docker exec \
-		-t \
-		builder \
-		sh -c 'git config --global --add safe.directory \*; cabal update && cabal build --jobs=$(nproc) --enable-tests -fserver_postgres && mkdir -p /out && for i in smp-server simplexmq-test; do bin=$(find /project/dist-newstyle -name "$i" -type f -executable) && chmod +x "$bin" && mv "$bin" /out/; done && strip /out/smp-server'
-
-	# Copy smp-server postgresql binary and prepare it
-	docker cp \
-		builder:/out/smp-server \
-		"$init_dir/$TAG-$repo_name/from-source/smp-server-postgres-ubuntu-${os_url}-x86-64"
-
-	# Download prebuilt postgresql binary
-	curl -L \
-		--output-dir "$init_dir/$TAG-$repo_name/prebuilt/" \
-		-O \
-		"$repo/releases/download/${TAG}/smp-server-postgres-ubuntu-${os_url}-x86-64"
-	
-	# Regular build (all)
-	apps='smp-server xftp-server ntf-server xftp'
-
-	docker exec \
-		-t \
-		-e apps="$apps" \
-		builder \
-		sh -c 'cabal build --jobs=$(nproc) && mkdir -p /out && for i in $apps; do bin=$(find /project/dist-newstyle -name "$i" -type f -executable) && strip "$bin" && chmod +x "$bin" && mv "$bin" /out/; done'
-
-	# Copy regular binaries
-	docker cp \
-		builder:/out \
-		out-${os}
-	
-	# Prepare regular binaries and download the prebuilt ones
-	for app in $apps; do
-		curl -L \
-			--output-dir "$init_dir/$TAG-$repo_name/prebuilt/" \
-			-O \
-		       	"$repo/releases/download/${TAG}/${app}-ubuntu-${os_url}-x86-64"
-
-		mv "./out-${os}/$app" "$init_dir/$TAG-$repo_name/from-source/${app}-ubuntu-${os_url}-x86-64"
-	done
-
-	# Important! Remove dist-newstyle for the next interation
-	docker exec \
-		-t \
-		builder \
-		sh -c 'rm -rf ./dist-newstyle'
-
-	# Also restore git to previous state 
-	git reset --hard && git clean -dfx
-
-	# Stop containers, delete images
-	docker stop builder
-	docker rm --force builder
-	docker image rm local
-done
-
-# Cleanup
-rm -rf -- "$tempdir"
-cd "$init_dir"
-
-# Final stage: compare hashes
-
-# Path to binaries
-path_bin="$init_dir/$TAG-$repo_name"
-
-# Assume everything is okay for now
-bad=0
-
-# Check hashes for all binaries
-for file in "$path_bin"/from-source/*; do
-	# Extract binary name
-	app="$(basename $file)"
-
-	# Compute hash for compiled binary
-	compiled=$(sha256sum "$path_bin/from-source/$app" | awk '{print $1}')
-	# Compute hash for prebuilt binary
-	prebuilt=$(sha256sum "$path_bin/prebuilt/$app" | awk '{print $1}')
-
-	# Compare
-	if [ "$compiled" != "$prebuilt" ]; then
-		# If hashes doesn't match, set bad...
-		bad=1
-
-		# ... and print affected binary
-		printf "%s - sha256sum hash doesn't match\n" "$app"
-	fi
-done
-
-# If everything is still okay, compute checksums file
-if [ "$bad" = 0 ]; then
-	sha256sum "$path_bin"/from-source/* | sed -e "s|$PWD/||g" -e 's|from-source/||g' -e "s|-$repo_name||g" > "$path_bin/_sha256sums"
-
-	printf 'Checksums computed - %s\n' "$path_bin/_sha256sums"
-fi
@@ -1,7 +1,7 @@
 cabal-version: 1.12

 name:           simplexmq
-version:        6.5.0.3
+version:        6.2.0.7
 synopsis:       SimpleXMQ message broker
 description:    This package includes <./docs/Simplex-Messaging-Server.html server>,
                <./docs/Simplex-Messaging-Client.html client> and
@@ -67,16 +67,6 @@ flag client_library
  manual: True
  default: False

-flag client_postgres
-  description: Build with PostgreSQL instead of SQLite.
-  manual: True
-  default: False
-
-flag server_postgres
-  description: Build server with support of PostgreSQL.
-  manual: True
-  default: False
-
 library
  exposed-modules:
      Simplex.FileTransfer.Agent
@@ -100,16 +90,47 @@ library
      Simplex.Messaging.Agent.RetryInterval
      Simplex.Messaging.Agent.Stats
      Simplex.Messaging.Agent.Store
-      Simplex.Messaging.Agent.Store.AgentStore
-      Simplex.Messaging.Agent.Store.Common
-      Simplex.Messaging.Agent.Store.DB
-      Simplex.Messaging.Agent.Store.Entity
-      Simplex.Messaging.Agent.Store.Interface
-      Simplex.Messaging.Agent.Store.Migrations
-      Simplex.Messaging.Agent.Store.Migrations.App
-      Simplex.Messaging.Agent.Store.Postgres.Options
-      Simplex.Messaging.Agent.Store.Shared
-      Simplex.Messaging.Agent.TSessionSubs
+      Simplex.Messaging.Agent.Store.SQLite
+      Simplex.Messaging.Agent.Store.SQLite.Common
+      Simplex.Messaging.Agent.Store.SQLite.DB
+      Simplex.Messaging.Agent.Store.SQLite.Migrations
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220608_v2
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220625_v2_ntf_mode
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220811_onion_hosts
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220817_connection_ntfs
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220905_commands
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220915_connection_queues
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230110_users
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230117_fkey_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230120_delete_errors
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230217_server_key_hash
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230223_files
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230320_retry_state
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240417_rcv_files_approved_relays
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240624_snd_secure
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240702_servers_stats
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240930_ntf_tokens_to_delete
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241007_rcv_queues_last_broker_ts
+      Simplex.Messaging.Agent.TRcvQueues
      Simplex.Messaging.Client
      Simplex.Messaging.Client.Agent
      Simplex.Messaging.Compression
@@ -122,7 +143,6 @@ library
      Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines
      Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
      Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG
-      Simplex.Messaging.Crypto.ShortLink
      Simplex.Messaging.Encoding
      Simplex.Messaging.Encoding.String
      Simplex.Messaging.Notifications.Client
@@ -131,13 +151,10 @@ library
      Simplex.Messaging.Notifications.Types
      Simplex.Messaging.Parsers
      Simplex.Messaging.Protocol
-      Simplex.Messaging.Protocol.Types
      Simplex.Messaging.Server.Expiration
-      Simplex.Messaging.Server.QueueStore.Postgres.Config
      Simplex.Messaging.Server.QueueStore.QueueInfo
      Simplex.Messaging.ServiceScheme
      Simplex.Messaging.Session
-      Simplex.Messaging.SystemTime
      Simplex.Messaging.TMap
      Simplex.Messaging.Transport
      Simplex.Messaging.Transport.Buffer
@@ -149,7 +166,6 @@ library
      Simplex.Messaging.Transport.HTTP2.Server
      Simplex.Messaging.Transport.KeepAlive
      Simplex.Messaging.Transport.Server
-      Simplex.Messaging.Transport.Shared
      Simplex.Messaging.Util
      Simplex.Messaging.Version
      Simplex.Messaging.Version.Internal
@@ -158,71 +174,6 @@ library
      Simplex.RemoteControl.Discovery.Multicast
      Simplex.RemoteControl.Invitation
      Simplex.RemoteControl.Types
-  if flag(client_postgres)
-      exposed-modules:
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.App
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20241210_initial
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250203_msg_bodies
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250322_short_links
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250702_conn_invitations_remove_cascade_delete
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251009_queue_to_subscribe
-          Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251010_client_notices
-  else
-      exposed-modules:
-          Simplex.Messaging.Agent.Store.SQLite
-          Simplex.Messaging.Agent.Store.SQLite.Common
-          Simplex.Messaging.Agent.Store.SQLite.DB
-          Simplex.Messaging.Agent.Store.SQLite.Migrations
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.App
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220608_v2
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220625_v2_ntf_mode
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220811_onion_hosts
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220817_connection_ntfs
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220905_commands
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220915_connection_queues
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230110_users
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230117_fkey_indexes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230120_delete_errors
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230217_server_key_hash
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230223_files
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230320_retry_state
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240417_rcv_files_approved_relays
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240624_snd_secure
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240702_servers_stats
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240930_ntf_tokens_to_delete
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241007_rcv_queues_last_broker_ts
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241224_ratchet_e2e_snd_params
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250203_msg_bodies
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250322_short_links
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250702_conn_invitations_remove_cascade_delete
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251009_queue_to_subscribe
-          Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251010_client_notices
-  if flag(client_postgres) || flag(server_postgres)
-      exposed-modules:
-          Simplex.Messaging.Agent.Store.Postgres
-          Simplex.Messaging.Agent.Store.Postgres.Common
-          Simplex.Messaging.Agent.Store.Postgres.DB
-          Simplex.Messaging.Agent.Store.Postgres.Migrations
-          Simplex.Messaging.Agent.Store.Postgres.Util
  if !flag(client_library)
      exposed-modules:
          Simplex.FileTransfer.Client.Main
@@ -230,53 +181,35 @@ library
          Simplex.FileTransfer.Server.Control
          Simplex.FileTransfer.Server.Env
          Simplex.FileTransfer.Server.Main
-          Simplex.FileTransfer.Server.Prometheus
          Simplex.FileTransfer.Server.Stats
          Simplex.FileTransfer.Server.Store
          Simplex.FileTransfer.Server.StoreLog
+          Simplex.Messaging.Notifications.Server
+          Simplex.Messaging.Notifications.Server.Control
+          Simplex.Messaging.Notifications.Server.Env
+          Simplex.Messaging.Notifications.Server.Main
+          Simplex.Messaging.Notifications.Server.Push.APNS
+          Simplex.Messaging.Notifications.Server.Push.APNS.Internal
+          Simplex.Messaging.Notifications.Server.Stats
+          Simplex.Messaging.Notifications.Server.Store
+          Simplex.Messaging.Notifications.Server.StoreLog
          Simplex.Messaging.Server
          Simplex.Messaging.Server.CLI
          Simplex.Messaging.Server.Control
          Simplex.Messaging.Server.Env.STM
          Simplex.Messaging.Server.Information
          Simplex.Messaging.Server.Main
-          Simplex.Messaging.Server.Main.GitCommit
-          Simplex.Messaging.Server.Main.Init
          Simplex.Messaging.Server.MsgStore
          Simplex.Messaging.Server.MsgStore.Journal
-          Simplex.Messaging.Server.MsgStore.Journal.SharedLock
          Simplex.Messaging.Server.MsgStore.STM
          Simplex.Messaging.Server.MsgStore.Types
          Simplex.Messaging.Server.NtfStore
-          Simplex.Messaging.Server.Prometheus
          Simplex.Messaging.Server.QueueStore
          Simplex.Messaging.Server.QueueStore.STM
-          Simplex.Messaging.Server.QueueStore.Types
          Simplex.Messaging.Server.Stats
          Simplex.Messaging.Server.StoreLog
-          Simplex.Messaging.Server.StoreLog.ReadWrite
          Simplex.Messaging.Server.StoreLog.Types
          Simplex.Messaging.Transport.WebSockets
-      if flag(server_postgres)
-          exposed-modules:
-              Simplex.Messaging.Notifications.Server
-              Simplex.Messaging.Notifications.Server.Control
-              Simplex.Messaging.Notifications.Server.Env
-              Simplex.Messaging.Notifications.Server.Main
-              Simplex.Messaging.Notifications.Server.Prometheus
-              Simplex.Messaging.Notifications.Server.Push
-              Simplex.Messaging.Notifications.Server.Push.APNS
-              Simplex.Messaging.Notifications.Server.Push.WebPush
-              Simplex.Messaging.Notifications.Server.Push.APNS.Internal
-              Simplex.Messaging.Notifications.Server.Stats
-              Simplex.Messaging.Notifications.Server.Store
-              Simplex.Messaging.Notifications.Server.Store.Migrations
-              Simplex.Messaging.Notifications.Server.Store.Postgres
-              Simplex.Messaging.Notifications.Server.Store.Types
-              Simplex.Messaging.Notifications.Server.StoreLog
-              Simplex.Messaging.Server.MsgStore.Postgres
-              Simplex.Messaging.Server.QueueStore.Postgres
-              Simplex.Messaging.Server.QueueStore.Postgres.Migrations
  other-modules:
      Paths_simplexmq
  hs-source-dirs:
@@ -299,7 +232,6 @@ library
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , binary ==0.8.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
@@ -309,12 +241,13 @@ library
    , crypton-x509-validation ==1.6.*
    , cryptostore ==0.3.*
    , data-default ==0.7.*
+    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
    , hourglass ==0.2.*
-    , http-client ==0.7.*
    , http-types ==0.12.*
    , http2 >=4.2.2 && <4.3
+    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
    , memory ==0.18.*
@@ -323,11 +256,14 @@ library
    , network-info ==0.2.*
    , network-transport ==0.5.6
    , network-udp ==0.0.*
+    , optparse-applicative >=0.15 && <0.17
+    , process ==1.6.*
    , random >=1.1 && <1.3
-    , scientific ==0.3.7.*
    , simple-logger ==0.1.*
    , socks ==0.6.*
+    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
+    , temporary ==1.3.*
    , time ==1.12.*
    , time-manager ==0.0.*
    , tls >=1.9.0 && <1.10
@@ -343,45 +279,19 @@ library
    build-depends:
        case-insensitive ==1.2.*
      , hashable ==1.4.*
-      , ini ==0.4.1
-      , http-client-tls ==0.3.6.*
-      , optparse-applicative >=0.15 && <0.17
-      , process ==1.6.*
-      , temporary ==1.3.*
      , websockets ==0.12.*
-  if flag(client_postgres) || flag(server_postgres)
-    build-depends:
-        postgresql-libpq >=0.10.0.0
-      , postgresql-simple ==0.7.*
-      , raw-strings-qq ==1.1.*
-  if flag(client_postgres)
-    cpp-options: -DdbPostgres
-  else
-    build-depends:
-        direct-sqlcipher ==2.3.*
-      , sqlcipher-simple ==0.4.*
-  if flag(server_postgres)
-    cpp-options: -DdbServerPostgres
-    build-depends:
-        hex-text ==0.1.*
  if impl(ghc >= 9.6.2)
    build-depends:
        bytestring ==0.11.*
-      , template-haskell ==2.20.*
      , text >=2.0.1 && <2.2
  if impl(ghc < 9.6.2)
    build-depends:
        bytestring ==0.10.*
-      , template-haskell ==2.16.*
      , text >=1.2.3.0 && <1.3

 executable ntf-server
  if flag(client_library)
      buildable: False
-  if flag(server_postgres)
-    cpp-options: -DdbServerPostgres
-  else
-    buildable: False
  main-is: Main.hs
  other-modules:
      Paths_simplexmq
@@ -399,8 +309,6 @@ executable ntf-server
 executable smp-server
  if flag(client_library)
      buildable: False
-  if flag(server_postgres)
-    cpp-options: -DdbServerPostgres
  main-is: Main.hs
  other-modules:
      Static
@@ -474,8 +382,10 @@ test-suite simplexmq-test
      AgentTests.EqInstances
      AgentTests.FunctionalAPITests
      AgentTests.MigrationTests
+      AgentTests.NotificationTests
+      AgentTests.SchemaDump
      AgentTests.ServerChoice
-      AgentTests.ShortLinkTests
+      AgentTests.SQLiteTests
      CLITests
      CoreTests.BatchingTests
      CoreTests.CryptoFileTests
@@ -485,10 +395,12 @@ test-suite simplexmq-test
      CoreTests.RetryIntervalTests
      CoreTests.SOCKSSettings
      CoreTests.StoreLogTests
-      CoreTests.TSessionSubs
+      CoreTests.TRcvQueuesTests
      CoreTests.UtilTests
      CoreTests.VersionRangeTests
      FileDescriptionTests
+      NtfClient
+      NtfServerTests
      RemoteControl
      ServerTests
      SMPAgentClient
@@ -502,26 +414,11 @@ test-suite simplexmq-test
      Static
      Static.Embedded
      Paths_simplexmq
-  if flag(client_postgres)
-      other-modules:
-          Fixtures
-  else
-      other-modules:
-          AgentTests.SchemaDump
-          AgentTests.SQLiteTests
-  if flag(server_postgres)
-      other-modules:
-          AgentTests.NotificationTests
-          NtfClient
-          NtfServerTests
-          NtfWPTests
-          PostgresSchemaDump
  hs-source-dirs:
      tests
      apps/smp-server/web
  default-extensions:
      StrictData
-  -- add -fhpc to ghc-options to run tests with coverage
  ghc-options: -Weverything -Wno-missing-exported-signatures -Wno-missing-import-lists -Wno-missed-specialisations -Wno-all-missed-specialisations -Wno-unsafe -Wno-safe -Wno-missing-local-signatures -Wno-missing-kind-signatures -Wno-missing-deriving-strategies -Wno-monomorphism-restriction -Wno-prepositive-qualified-module -Wno-implicit-prelude -Wno-missing-safe-haskell-mode -Wno-missing-export-lists -Wno-partial-fields -Wcompat -Werror=incomplete-record-updates -Werror=incomplete-patterns -Werror=incomplete-uni-patterns -Werror=missing-methods -Werror=tabs -Wredundant-constraints -Wincomplete-record-updates -Wunused-type-patterns -O2 -threaded -rtsopts -with-rtsopts=-A64M -with-rtsopts=-N1
  build-depends:
      base
@@ -534,13 +431,13 @@ test-suite simplexmq-test
    , crypton-x509
    , crypton-x509-store
    , crypton-x509-validation
+    , deepseq ==1.4.*
    , directory
    , file-embed
    , filepath
    , generic-random ==1.5.*
    , hashable
    , hspec ==2.11.*
-    , hspec-core ==2.11.*
    , http-client
    , http-types
    , http2
@@ -548,13 +445,16 @@ test-suite simplexmq-test
    , ini
    , iso8601-time
    , main-tester ==0.2.*
+    , memory
    , mtl
    , network
+    , process
    , QuickCheck ==2.14.*
    , random
    , silently ==1.2.*
    , simple-logger
    , simplexmq
+    , sqlcipher-simple
    , stm
    , text
    , time
@@ -569,18 +469,3 @@ test-suite simplexmq-test
    , warp-tls
    , yaml
  default-language: Haskell2010
-  if flag(server_postgres)
-    cpp-options: -DdbServerPostgres
-  if flag(client_postgres)
-    cpp-options: -DdbPostgres
-  else
-    build-depends:
-        memory
-      , sqlcipher-simple
-  if !flag(client_postgres) || flag(client_postgres) || flag(server_postgres)
-    build-depends:
-        deepseq ==1.4.*
-      , process
-  if flag(client_postgres) || flag(server_postgres)
-    build-depends:
-        postgresql-simple ==0.7.*
@@ -65,8 +65,8 @@ import Simplex.Messaging.Agent.Env.SQLite
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Agent.Stats
-import Simplex.Messaging.Agent.Store.AgentStore
-import qualified Simplex.Messaging.Agent.Store.DB as DB
+import Simplex.Messaging.Agent.Store.SQLite
+import qualified Simplex.Messaging.Agent.Store.SQLite.DB as DB
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Crypto.File (CryptoFile (..), CryptoFileArgs)
 import qualified Simplex.Messaging.Crypto.File as CF
@@ -75,7 +75,7 @@ import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String (strDecode, strEncode)
 import Simplex.Messaging.Protocol (ProtocolServer, ProtocolType (..), XFTPServer)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (allFinally, catchAll_, catchAllErrors, liftError, tshow, unlessM, whenM)
+import Simplex.Messaging.Util (catchAll_, liftError, tshow, unlessM, whenM)
 import System.FilePath (takeFileName, (</>))
 import UnliftIO
 import UnliftIO.Directory
@@ -198,10 +198,10 @@ runXFTPRcvWorker c srv Worker {doWork} = do
            liftIO $ waitForUserNetwork c
            atomically $ incXFTPServerStat c userId srv downloadAttempts
            downloadFileChunk fc replica approvedRelays
-              `catchAllErrors` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
+              `catchAgentError` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAllErrors (\_ -> pure ()) $ do
+              flip catchAgentError (\_ -> pure ()) $ do
                when (serverHostError e) $ notify c (fromMaybe rcvFileEntityId redirectEntityId_) (RFWARN e)
                liftIO $ closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateRcvChunkReplicaDelay db rcvChunkReplicaId replicaDelay
@@ -280,7 +280,7 @@ runXFTPRcvLocalWorker c Worker {doWork} = do
    runXFTPOperation AgentConfig {rcvFilesTTL} =
      withWork c doWork (`getNextRcvFileToDecrypt` rcvFilesTTL) $
        \f@RcvFile {rcvFileId, rcvFileEntityId, tmpPath, redirect} ->
-          decryptFile f `catchAllErrors` rcvWorkerInternalError c rcvFileId rcvFileEntityId (redirectEntityId <$> redirect) tmpPath
+          decryptFile f `catchAgentError` rcvWorkerInternalError c rcvFileId rcvFileEntityId (redirectEntityId <$> redirect) tmpPath
    decryptFile :: RcvFile -> AM ()
    decryptFile RcvFile {rcvFileId, rcvFileEntityId, size, digest, key, nonce, tmpPath, saveFile, status, chunks, redirect} = do
      let CryptoFile savePath cfArgs = saveFile
@@ -307,7 +307,7 @@ runXFTPRcvLocalWorker c Worker {doWork} = do
          liftIO $ waitUntilForeground c
          withStore' c (`updateRcvFileComplete` rcvFileId)
          -- proceed with redirect
-          yaml <- liftError (FILE . FILE_IO . show) (CF.readFile $ CryptoFile fsSavePath cfArgs) `allFinally` (lift $ toFSFilePath fsSavePath >>= removePath)
+          yaml <- liftError (FILE . FILE_IO . show) (CF.readFile $ CryptoFile fsSavePath cfArgs) `agentFinally` (lift $ toFSFilePath fsSavePath >>= removePath)
          next@FileDescription {chunks = nextChunks} <- case strDecode (LB.toStrict yaml) of
            -- TODO switch to another error constructor
            Left _ -> throwE . FILE $ REDIRECT "decode error"
@@ -399,7 +399,7 @@ runXFTPSndPrepareWorker c Worker {doWork} = do
    runXFTPOperation cfg@AgentConfig {sndFilesTTL} =
      withWork c doWork (`getNextSndFileToPrepare` sndFilesTTL) $
        \f@SndFile {sndFileId, sndFileEntityId, prefixPath} ->
-          prepareFile cfg f `catchAllErrors` sndWorkerInternalError c sndFileId sndFileEntityId prefixPath
+          prepareFile cfg f `catchAgentError` sndWorkerInternalError c sndFileId sndFileEntityId prefixPath
    prepareFile :: AgentConfig -> SndFile -> AM ()
    prepareFile _ SndFile {prefixPath = Nothing} =
      throwE $ INTERNAL "no prefix path"
@@ -468,11 +468,11 @@ runXFTPSndPrepareWorker c Worker {doWork} = do
                liftIO $ waitForUserNetwork c
                let triedAllSrvs = n > userSrvCount
                createWithNextSrv triedHosts
-                  `catchAllErrors` \e -> retryOnError "XFTP prepare worker" (retryLoop loop triedAllSrvs e) (throwE e) e
+                  `catchAgentError` \e -> retryOnError "XFTP prepare worker" (retryLoop loop triedAllSrvs e) (throwE e) e
              where
                -- we don't do closeXFTPServerClient here to not risk closing connection for concurrent chunk upload
                retryLoop loop triedAllSrvs e = do
-                  flip catchAllErrors (\_ -> pure ()) $ do
+                  flip catchAgentError (\_ -> pure ()) $ do
                    when (triedAllSrvs && serverHostError e) $ notify c sndFileEntityId $ SFWARN e
                  liftIO $ assertAgentForeground c
                  loop
@@ -508,10 +508,10 @@ runXFTPSndWorker c srv Worker {doWork} = do
            liftIO $ waitForUserNetwork c
            atomically $ incXFTPServerStat c userId srv uploadAttempts
            uploadFileChunk cfg fc replica
-              `catchAllErrors` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
+              `catchAgentError` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAllErrors (\_ -> pure ()) $ do
+              flip catchAgentError (\_ -> pure ()) $ do
                when (serverHostError e) $ notify c sndFileEntityId $ SFWARN e
                liftIO $ closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateSndChunkReplicaDelay db sndChunkReplicaId replicaDelay
@@ -681,10 +681,10 @@ runXFTPDelWorker c srv Worker {doWork} = do
            liftIO $ waitForUserNetwork c
            atomically $ incXFTPServerStat c userId srv deleteAttempts
            deleteChunkReplica
-              `catchAllErrors` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
+              `catchAgentError` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchAllErrors (\_ -> pure ()) $ do
+              flip catchAgentError (\_ -> pure ()) $ do
                when (serverHostError e) $ notify c "" $ SFWARN e
                liftIO $ closeXFTPServerClient c userId server chunkDigest
                withStore' c $ \db -> updateDeletedSndChunkReplicaDelay db deletedSndChunkReplicaId replicaDelay
@@ -31,22 +31,18 @@ import qualified Data.X509 as X
 import qualified Data.X509.Validation as XV
 import qualified Network.HTTP.Types as N
 import qualified Network.HTTP2.Client as H
-import Network.Socket (HostName)
 import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Protocol
 import Simplex.FileTransfer.Transport
 import Simplex.Messaging.Client
  ( NetworkConfig (..),
-    NetworkRequestMode (..),
    ProtocolClientError (..),
    TransportSession,
-    netTimeoutInt,
    chooseTransportHost,
    defaultNetworkConfig,
    transportClientConfig,
    clientSocksCredentials,
    unexpectedResponse,
-    useWebPort,
  )
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
@@ -59,11 +55,9 @@ import Simplex.Messaging.Protocol
    RecipientId,
    SenderId,
    pattern NoEntity,
-    NetworkError (..),
-    toNetworkError,
  )
-import Simplex.Messaging.Transport (ALPN, CertChainPubKey (..), HandshakeError (..), THandleAuth (..), THandleParams (..), TransportError (..), TransportPeer (..), defaultSupportedParams)
-import Simplex.Messaging.Transport.Client (TransportClientConfig (..), TransportHost)
+import Simplex.Messaging.Transport (ALPN, HandshakeError (..), THandleAuth (..), THandleParams (..), TransportError (..), TransportPeer (..), defaultSupportedParams)
+import Simplex.Messaging.Transport.Client (TransportClientConfig, TransportHost, alpn)
 import Simplex.Messaging.Transport.HTTP2
 import Simplex.Messaging.Transport.HTTP2.Client
 import Simplex.Messaging.Transport.HTTP2.File
@@ -105,16 +99,15 @@ defaultXFTPClientConfig =
  XFTPClientConfig
    { xftpNetworkConfig = defaultNetworkConfig,
      serverVRange = supportedFileServerVRange,
-      clientALPN = Just alpnSupportedXFTPhandshakes
+      clientALPN = Just supportedXFTPhandshakes
    }

-getXFTPClient :: TransportSession FileResponse -> XFTPClientConfig -> [HostName] -> UTCTime -> (XFTPClient -> IO ()) -> IO (Either XFTPClientError XFTPClient)
-getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {clientALPN, xftpNetworkConfig, serverVRange} presetDomains proxySessTs disconnected = runExceptT $ do
+getXFTPClient :: TransportSession FileResponse -> XFTPClientConfig -> UTCTime -> (XFTPClient -> IO ()) -> IO (Either XFTPClientError XFTPClient)
+getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {clientALPN, xftpNetworkConfig, serverVRange} proxySessTs disconnected = runExceptT $ do
  let socksCreds = clientSocksCredentials xftpNetworkConfig proxySessTs transportSession
      ProtocolServer _ host port keyHash = srv
-      useALPN = if useWebPort xftpNetworkConfig presetDomains srv then Just [httpALPN11] else clientALPN
  useHost <- liftEither $ chooseTransportHost xftpNetworkConfig host
-  let tcConfig = transportClientConfig xftpNetworkConfig NRMBackground useHost False useALPN
+  let tcConfig = (transportClientConfig xftpNetworkConfig useHost False) {alpn = clientALPN}
      http2Config = xftpHTTP2Config tcConfig config
  clientVar <- newTVarIO Nothing
  let usePort = if null port then "443" else port
@@ -123,11 +116,10 @@ getXFTPClient transportSession@(_, srv, _) config@XFTPClientConfig {clientALPN,
  let HTTP2Client {sessionId, sessionALPN} = http2Client
      v = VersionXFTP 1
      thServerVRange = versionToRange v
-      thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = v, thServerVRange, thAuth = Nothing, implySessId = False, encryptBlock = Nothing, batch = True, serviceAuth = False}
+      thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = v, thServerVRange, thAuth = Nothing, implySessId = False, encryptBlock = Nothing, batch = True}
  logDebug $ "Client negotiated handshake protocol: " <> tshow sessionALPN
  thParams@THandleParams {thVersion} <- case sessionALPN of
-    Just alpn | alpn == xftpALPNv1 || alpn == httpALPN11 ->
-      xftpClientHandshakeV1 serverVRange keyHash http2Client thParams0
+    Just "xftp/1" -> xftpClientHandshakeV1 serverVRange keyHash http2Client thParams0
    _ -> pure thParams0
  logDebug $ "Client negotiated protocol: " <> tshow thVersion
  let c = XFTPClient {http2Client, thParams, transportSession, config}
@@ -140,8 +132,7 @@ xftpClientHandshakeV1 serverVRange keyHash@(C.KeyHash kh) c@HTTP2Client {session
  (vr, sk) <- processServerHandshake shs
  let v = maxVersion vr
  sendClientHandshake XFTPClientHandshake {xftpVersion = v, keyHash}
-  let thAuth = Just THAuthClient {peerServerPubKey = sk, peerServerCertKey = ck, clientService = Nothing, sessSecret = Nothing}
-  pure thParams0 {thAuth, thVersion = v, thServerVRange = vr}
+  pure thParams0 {thAuth = Just THAuthClient {serverPeerPubKey = sk, serverCertKey = ck, sessSecret = Nothing}, thVersion = v, thServerVRange = vr}
  where
    getServerHandshake :: ExceptT XFTPClientError IO XFTPServerHandshake
    getServerHandshake = do
@@ -156,12 +147,12 @@ xftpClientHandshakeV1 serverVRange keyHash@(C.KeyHash kh) c@HTTP2Client {session
        Nothing -> throwE $ PCETransportError TEVersion
        Just (Compatible vr) ->
          fmap (vr,) . liftTransportErr (TEHandshake BAD_AUTH) $ do
-            let CertChainPubKey (X.CertificateChain cert) exact = serverAuth
+            let (X.CertificateChain cert, exact) = serverAuth
            case cert of
              [_leaf, ca] | XV.Fingerprint kh == XV.getFingerprint ca X.HashSHA256 -> pure ()
              _ -> throwError "bad certificate"
            pubKey <- maybe (throwError "bad server key type") (`C.verifyX509` exact) serverKey
-            C.x509ToPublic' pubKey
+            C.x509ToPublic (pubKey, []) >>= C.pubKey
    sendClientHandshake :: XFTPClientHandshake -> ExceptT XFTPClientError IO ()
    sendClientHandshake chs = do
      chs' <- liftTransportErr TELargeMsg $ C.pad (smpEncode chs) xftpBlockSize
@@ -186,14 +177,14 @@ xftpHTTP2Config transportConfig XFTPClientConfig {xftpNetworkConfig = NetworkCon
  defaultHTTP2ClientConfig
    { bodyHeadSize = xftpBlockSize,
      suportedTLSParams = defaultSupportedParams,
-      connTimeout = netTimeoutInt tcpConnectTimeout NRMBackground,
+      connTimeout = tcpConnectTimeout,
      transportConfig
    }

 xftpClientError :: HTTP2ClientError -> XFTPClientError
 xftpClientError = \case
  HCResponseTimeout -> PCEResponseTimeout
-  HCNetworkError e -> PCENetworkError e
+  HCNetworkError -> PCENetworkError
  HCIOError e -> PCEIOError e

 sendXFTPCommand :: forall p. FilePartyI p => XFTPClient -> C.APrivateAuthKey -> XFTPFileId -> FileCommand p -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
@@ -212,7 +203,7 @@ sendXFTPTransmission XFTPClient {config, thParams, http2Client} t chunkSpec_ = d
  HTTP2Response {respBody = body@HTTP2Body {bodyHead}} <- withExceptT xftpClientError . ExceptT $ sendRequest http2Client req (Just reqTimeout)
  when (B.length bodyHead /= xftpBlockSize) $ throwE $ PCEResponseError BLOCK
  -- TODO validate that the file ID is the same as in the request?
-  (_, _fId, respOrErr) <-liftEither $ first PCEResponseError $ xftpDecodeTClient thParams bodyHead
+  (_, _, (_, _fId, respOrErr)) <- liftEither . first PCEResponseError $ xftpDecodeTransmission thParams bodyHead
  case respOrErr of
    Right r -> case protocolError r of
      Just e -> throwE $ PCEProtocolError e
@@ -263,9 +254,9 @@ downloadXFTPChunk g c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {
        ExceptT (sequence <$> (t `timeout` (download cbState `catches` errors))) >>= maybe (throwE PCEResponseTimeout) pure
        where
          errors =
-            [ Handler $ \(e :: H.HTTP2Error) -> pure $ Left $ PCENetworkError $ NEConnectError $ displayException e,
-              Handler $ \(e :: IOException) -> pure $ Left $ PCEIOError e,
-              Handler $ \(e :: SomeException) -> pure $ Left $ PCENetworkError $ toNetworkError e
+            [ Handler $ \(_e :: H.HTTP2Error) -> pure $ Left PCENetworkError,
+              Handler $ \(e :: IOException) -> pure $ Left (PCEIOError e),
+              Handler $ \(_e :: SomeException) -> pure $ Left PCENetworkError
            ]
          download cbState =
            runExceptT . withExceptT PCEResponseError $
@@ -276,11 +267,11 @@ downloadXFTPChunk g c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {

 xftpReqTimeout :: XFTPClientConfig -> Maybe Word32 -> Int
 xftpReqTimeout cfg@XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpTimeout}} chunkSize_ =
-  maybe (netTimeoutInt tcpTimeout NRMBackground) (chunkTimeout cfg) chunkSize_
+  maybe tcpTimeout (chunkTimeout cfg) chunkSize_

 chunkTimeout :: XFTPClientConfig -> Word32 -> Int
 chunkTimeout XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpTimeout, tcpTimeoutPerKb}} sz =
-  netTimeoutInt tcpTimeout NRMBackground + fromIntegral (min ((fromIntegral sz `div` 1024) * tcpTimeoutPerKb) (fromIntegral (maxBound :: Int)))
+  tcpTimeout + fromIntegral (min ((fromIntegral sz `div` 1024) * tcpTimeoutPerKb) (fromIntegral (maxBound :: Int)))

 deleteXFTPChunk :: XFTPClient -> C.APrivateAuthKey -> SenderId -> ExceptT XFTPClientError IO ()
 deleteXFTPChunk c spKey sId = sendXFTPCommand c spKey sId FDEL Nothing >>= okResponse
@@ -19,7 +19,7 @@ import Data.Text.Encoding (decodeUtf8)
 import Data.Time.Clock (UTCTime, getCurrentTime)
 import Simplex.FileTransfer.Client
 import Simplex.Messaging.Agent.RetryInterval
-import Simplex.Messaging.Client (NetworkConfig (..), NetworkRequestMode (..), ProtocolClientError (..), netTimeoutInt, temporaryClientError)
+import Simplex.Messaging.Client (NetworkConfig (..), ProtocolClientError (..), temporaryClientError)
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtocolServer (..), XFTPServer)
 import Simplex.Messaging.TMap (TMap)
@@ -71,7 +71,7 @@ getXFTPServerClient XFTPClientAgent {xftpClients, startedAt, config} srv = do
    connectClient =
      ExceptT $
        first (XFTPClientAgentError srv)
-          <$> getXFTPClient (1, srv, Nothing) (xftpConfig config) [] startedAt clientDisconnected
+          <$> getXFTPClient (1, srv, Nothing) (xftpConfig config) startedAt clientDisconnected

    clientDisconnected :: XFTPClient -> IO ()
    clientDisconnected _ = do
@@ -90,7 +90,7 @@ getXFTPServerClient XFTPClientAgent {xftpClients, startedAt, config} srv = do
    waitForXFTPClient :: XFTPClientVar -> ME XFTPClient
    waitForXFTPClient clientVar = do
      let XFTPClientConfig {xftpNetworkConfig = NetworkConfig {tcpConnectTimeout}} = xftpConfig config
-      client_ <- liftIO $ netTimeoutInt tcpConnectTimeout NRMBackground `timeout` atomically (readTMVar clientVar)
+      client_ <- liftIO $ tcpConnectTimeout `timeout` atomically (readTMVar clientVar)
      liftEither $ case client_ of
        Just (Right c) -> Right c
        Just (Left e) -> Left e
@@ -127,6 +127,6 @@ closeXFTPServerClient XFTPClientAgent {xftpClients, config} srv =
  where
    closeClient cVar = do
      let NetworkConfig {tcpConnectTimeout} = xftpNetworkConfig $ xftpConfig config
-      netTimeoutInt tcpConnectTimeout NRMBackground `timeout` atomically (readTMVar cVar) >>= \case
+      tcpConnectTimeout `timeout` atomically (readTMVar cVar) >>= \case
        Just (Right client) -> closeXFTPClient client `catchAll_` pure ()
        _ -> pure ()
@@ -280,7 +280,7 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
      let chunkSpecs = prepareChunkSpecs encPath chunkSizes
          fdRcv = FileDescription {party = SFRecipient, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = [], redirect = Nothing}
          fdSnd = FileDescription {party = SFSender, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = [], redirect = Nothing}
-      logDebug $ "encrypted file to " <> tshow encPath
+      logInfo $ "encrypted file to " <> tshow encPath
      pure (encPath, fdRcv, fdSnd, chunkSpecs, encSize)
    uploadFile :: TVar ChaChaDRG -> [XFTPChunkSpec] -> TVar [Int64] -> Int64 -> ExceptT CLIError IO [SentFileChunk]
    uploadFile g chunks uploadedChunks encSize = do
@@ -293,14 +293,14 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
      -- TODO shuffle/unshuffle chunks
      -- the reason we don't do pooled downloads here within one server is that http2 library doesn't handle cleint concurrency, even though
      -- upload doesn't allow other requests within the same client until complete (but download does allow).
-      logDebug $ "uploading " <> tshow (length chunks) <> " chunks..."
+      logInfo $ "uploading " <> tshow (length chunks) <> " chunks..."
      (errs, rs) <- partitionEithers . concat <$> liftIO (pooledForConcurrentlyN 16 chunks' . mapM $ runExceptT . uploadFileChunk a)
      mapM_ throwE errs
      pure $ map snd (sortOn fst rs)
      where
        uploadFileChunk :: XFTPClientAgent -> (Int, XFTPChunkSpec, XFTPServerWithAuth) -> ExceptT CLIError IO (Int, SentFileChunk)
        uploadFileChunk a (chunkNo, chunkSpec@XFTPChunkSpec {chunkSize}, ProtoServerWithAuth xftpServer auth) = do
-          logDebug $ "uploading chunk " <> tshow chunkNo <> " to " <> showServer xftpServer <> "..."
+          logInfo $ "uploading chunk " <> tshow chunkNo <> " to " <> showServer xftpServer <> "..."
          (sndKey, spKey) <- atomically $ C.generateAuthKeyPair C.SEd25519 g
          rKeys <- atomically $ L.fromList <$> replicateM numRecipients (C.generateAuthKeyPair C.SEd25519 g)
          digest <- liftIO $ getChunkDigest chunkSpec
@@ -308,7 +308,7 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
          c <- withRetry retryCount $ getXFTPServerClient a xftpServer
          (sndId, rIds) <- withRetry retryCount $ createXFTPChunk c spKey ch (L.map fst rKeys) auth
          withReconnect a xftpServer retryCount $ \c' -> uploadXFTPChunk c' spKey sndId chunkSpec
-          logDebug $ "uploaded chunk " <> tshow chunkNo
+          logInfo $ "uploaded chunk " <> tshow chunkNo
          uploaded <- atomically . stateTVar uploadedChunks $ \cs ->
            let cs' = fromIntegral chunkSize : cs in (sum cs', cs')
          liftIO $ do
@@ -418,11 +418,11 @@ cliReceiveFile ReceiveOptions {fileDescription, filePath, retryCount, tempPath,
    downloadFileChunk :: TVar ChaChaDRG -> XFTPClientAgent -> FilePath -> FileSize Int64 -> TVar [Int64] -> FileChunk -> ExceptT CLIError IO (Int, FilePath)
    downloadFileChunk g a encPath (FileSize encSize) downloadedChunks FileChunk {chunkNo, chunkSize, digest, replicas = replica : _} = do
      let FileChunkReplica {server, replicaId, replicaKey} = replica
-      logDebug $ "downloading chunk " <> tshow chunkNo <> " from " <> showServer server <> "..."
+      logInfo $ "downloading chunk " <> tshow chunkNo <> " from " <> showServer server <> "..."
      chunkPath <- uniqueCombine encPath $ show chunkNo
      let chunkSpec = XFTPRcvChunkSpec chunkPath (unFileSize chunkSize) (unFileDigest digest)
      withReconnect a server retryCount $ \c -> downloadXFTPChunk g c replicaKey (unChunkReplicaId replicaId) chunkSpec
-      logDebug $ "downloaded chunk " <> tshow chunkNo <> " to " <> T.pack chunkPath
+      logInfo $ "downloaded chunk " <> tshow chunkNo <> " to " <> T.pack chunkPath
      downloaded <- atomically . stateTVar downloadedChunks $ \cs ->
        let cs' = fromIntegral (unFileSize chunkSize) : cs in (sum cs', cs')
      liftIO $ do
@@ -467,7 +467,7 @@ cliDeleteFile DeleteOptions {fileDescription, retryCount, yes} = do
    deleteFileChunk a FileChunk {chunkNo, replicas = replica : _} = do
      let FileChunkReplica {server, replicaId, replicaKey} = replica
      withReconnect a server retryCount $ \c -> deleteXFTPChunk c replicaKey (unChunkReplicaId replicaId)
-      logDebug $ "deleted chunk " <> tshow chunkNo <> " from " <> showServer server
+      logInfo $ "deleted chunk " <> tshow chunkNo <> " from " <> showServer server
    deleteFileChunk _ _ = throwE $ CLIError "chunk has no replicas"

 cliFileDescrInfo :: InfoOptions -> ExceptT CLIError IO ()
@@ -9,7 +9,6 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE StandaloneDeriving #-}
 {-# LANGUAGE TemplateHaskell #-}
 {-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

@@ -67,10 +66,11 @@ import Data.Text (Text)
 import Data.Text.Encoding (encodeUtf8)
 import Data.Word (Word32)
 import qualified Data.Yaml as Y
+import Database.SQLite.Simple.FromField (FromField (..))
+import Database.SQLite.Simple.ToField (ToField (..))
 import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Protocol
 import Simplex.Messaging.Agent.QueryString
-import Simplex.Messaging.Agent.Store.DB (Binary (..), FromField (..), ToField (..))
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (defaultJSON, parseAll)
@@ -113,9 +113,6 @@ fdSeparator = "################################\n"

 newtype FileDigest = FileDigest {unFileDigest :: ByteString}
  deriving (Eq, Show)
-  deriving newtype (FromField)
-
-instance ToField FileDigest where toField (FileDigest s) = toField $ Binary s

 instance StrEncoding FileDigest where
  strEncode (FileDigest fd) = strEncode fd
@@ -129,6 +126,10 @@ instance ToJSON FileDigest where
  toJSON = strToJSON
  toEncoding = strToJEncoding

+instance FromField FileDigest where fromField f = FileDigest <$> fromField f
+
+instance ToField FileDigest where toField (FileDigest s) = toField s
+
 data FileChunk = FileChunk
  { chunkNo :: Int,
    chunkSize :: FileSize Word32,
@@ -306,9 +307,9 @@ instance (Integral a, Show a) => StrEncoding (FileSize a) where
 instance (Integral a, Show a) => IsString (FileSize a) where
  fromString = either error id . strDecode . B.pack

-deriving newtype instance FromField a => FromField (FileSize a)
+instance FromField a => FromField (FileSize a) where fromField f = FileSize <$> fromField f

-deriving newtype instance ToField a => ToField (FileSize a)
+instance ToField a => ToField (FileSize a) where toField (FileSize s) = toField s

 groupReplicasByServer :: FileSize Word32 -> [FileChunk] -> [NonEmpty FileServerReplica]
 groupReplicasByServer defChunkSize =
@@ -25,7 +25,7 @@ import Data.List.NonEmpty (NonEmpty (..))
 import Data.Maybe (isNothing)
 import Data.Type.Equality
 import Data.Word (Word32)
-import Simplex.FileTransfer.Transport (XFTPErrorType (..), XFTPVersion, blockedFilesXFTPVersion, xftpClientHandshakeStub)
+import Simplex.FileTransfer.Transport (XFTPErrorType (..), XFTPVersion, xftpClientHandshakeStub)
 import Simplex.Messaging.Client (authTransmission)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding
@@ -44,9 +44,8 @@ import Simplex.Messaging.Protocol
    EntityId (..),
    RecipientId,
    SenderId,
-    RawTransmission,
    SentRawTransmission,
-    SignedTransmissionOrError,
+    SignedTransmission,
    SndPublicAuthKey,
    Transmission,
    TransmissionForAuth (..),
@@ -54,8 +53,7 @@ import Simplex.Messaging.Protocol
    encodeTransmission,
    encodeTransmissionForAuth,
    messageTagP,
-    tDecodeServer,
-    tDecodeClient,
+    tDecodeParseValidate,
    tEncodeBatch1,
    tParse,
  )
@@ -146,15 +144,10 @@ instance Protocol XFTPVersion XFTPErrorType FileResponse where
  type ProtoCommand FileResponse = FileCmd
  type ProtoType FileResponse = 'PXFTP
  protocolClientHandshake = xftpClientHandshakeStub
-  {-# INLINE protocolClientHandshake #-}
-  useServiceAuth _ = False
-  {-# INLINE useServiceAuth #-}
  protocolPing = FileCmd SFRecipient PING
-  {-# INLINE protocolPing #-}
  protocolError = \case
    FRErr e -> Just e
    _ -> Nothing
-  {-# INLINE protocolError #-}

 data FileCommand (p :: FileParty) where
  FNEW :: FileInfo -> NonEmpty RcvPublicAuthKey -> Maybe BasicAuth -> FileCommand FSender
@@ -199,7 +192,7 @@ instance FilePartyI p => ProtocolEncoding XFTPVersion XFTPErrorType (FileCommand
  fromProtocolError = fromProtocolError @XFTPVersion @XFTPErrorType @FileResponse
  {-# INLINE fromProtocolError #-}

-  checkCredentials auth (EntityId fileId) cmd = case cmd of
+  checkCredentials (auth, _, EntityId fileId, _) cmd = case cmd of
    -- FNEW must not have signature and chunk ID
    FNEW {}
      | isNothing auth -> Left $ CMD NO_AUTH
@@ -233,8 +226,7 @@ instance ProtocolEncoding XFTPVersion XFTPErrorType FileCmd where
  fromProtocolError = fromProtocolError @XFTPVersion @XFTPErrorType @FileResponse
  {-# INLINE fromProtocolError #-}

-  checkCredentials tAuth entId (FileCmd p c) = FileCmd p <$> checkCredentials tAuth entId c
-  {-# INLINE checkCredentials #-}
+  checkCredentials t (FileCmd p c) = FileCmd p <$> checkCredentials t c

 instance Encoding FileInfo where
  smpEncode FileInfo {sndKey, size, digest} = smpEncode (sndKey, size, digest)
@@ -284,14 +276,12 @@ data FileResponse

 instance ProtocolEncoding XFTPVersion XFTPErrorType FileResponse where
  type Tag FileResponse = FileResponseTag
-  encodeProtocol v = \case
+  encodeProtocol _v = \case
    FRSndIds fId rIds -> e (FRSndIds_, ' ', fId, rIds)
    FRRcvIds rIds -> e (FRRcvIds_, ' ', rIds)
    FRFile rDhKey nonce -> e (FRFile_, ' ', rDhKey, nonce)
    FROk -> e FROk_
-    FRErr err -> case err of
-      BLOCKED _ | v < blockedFilesXFTPVersion -> e (FRErr_, ' ', AUTH)
-      _ -> e (FRErr_, ' ', err)
+    FRErr err -> e (FRErr_, ' ', err)
    FRPong -> e FRPong_
    where
      e :: Encoding a => a -> ByteString
@@ -312,7 +302,7 @@ instance ProtocolEncoding XFTPVersion XFTPErrorType FileResponse where
    PEBlock -> BLOCK
  {-# INLINE fromProtocolError #-}

-  checkCredentials _ (EntityId entId) cmd = case cmd of
+  checkCredentials (_, _, EntityId entId, _) cmd = case cmd of
    FRSndIds {} -> noEntity
    -- ERR response does not always have entity ID
    FRErr _ -> Right cmd
@@ -337,35 +327,25 @@ checkParty' c = case testEquality (sFileParty @p) (sFileParty @p') of
  Just Refl -> Just c
  _ -> Nothing

-xftpEncodeAuthTransmission :: ProtocolEncoding XFTPVersion XFTPErrorType c => THandleParams XFTPVersion 'TClient -> C.APrivateAuthKey -> Transmission c -> Either TransportError ByteString
-xftpEncodeAuthTransmission thParams@THandleParams {thAuth} pKey t@(corrId, _, _) = do
-  let TransmissionForAuth {tForAuth, tToSend} = encodeTransmissionForAuth thParams t
-  xftpEncodeBatch1 . (,tToSend) =<< authTransmission thAuth False (Just pKey) (C.cbNonce $ bs corrId) tForAuth
+xftpEncodeAuthTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion 'TClient -> C.APrivateAuthKey -> Transmission c -> Either TransportError ByteString
+xftpEncodeAuthTransmission thParams@THandleParams {thAuth} pKey (corrId, fId, msg) = do
+  let TransmissionForAuth {tForAuth, tToSend} = encodeTransmissionForAuth thParams (corrId, fId, msg)
+  xftpEncodeBatch1 . (,tToSend) =<< authTransmission thAuth (Just pKey) (C.cbNonce $ bs corrId) tForAuth

-xftpEncodeTransmission :: ProtocolEncoding XFTPVersion XFTPErrorType c => THandleParams XFTPVersion p -> Transmission c -> Either TransportError ByteString
-xftpEncodeTransmission thParams t = xftpEncodeBatch1 (Nothing, encodeTransmission thParams t)
+xftpEncodeTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion p -> Transmission c -> Either TransportError ByteString
+xftpEncodeTransmission thParams (corrId, fId, msg) = do
+  let t = encodeTransmission thParams (corrId, fId, msg)
+  xftpEncodeBatch1 (Nothing, t)

 -- this function uses batch syntax but puts only one transmission in the batch
 xftpEncodeBatch1 :: SentRawTransmission -> Either TransportError ByteString
-xftpEncodeBatch1 t = first (const TELargeMsg) $ C.pad (tEncodeBatch1 False t) xftpBlockSize
+xftpEncodeBatch1 t = first (const TELargeMsg) $ C.pad (tEncodeBatch1 t) xftpBlockSize

-xftpDecodeTServer :: THandleParams XFTPVersion 'TServer -> ByteString -> Either XFTPErrorType (SignedTransmissionOrError XFTPErrorType FileCmd)
-xftpDecodeTServer = xftpDecodeTransmission tDecodeServer
-{-# INLINE xftpDecodeTServer #-}
-
-xftpDecodeTClient :: THandleParams XFTPVersion 'TClient -> ByteString -> Either XFTPErrorType (Transmission (Either XFTPErrorType FileResponse))
-xftpDecodeTClient = xftpDecodeTransmission tDecodeClient
-{-# INLINE xftpDecodeTClient #-}
-
-xftpDecodeTransmission ::
-  (THandleParams XFTPVersion p -> Either TransportError RawTransmission -> r) ->
-  THandleParams XFTPVersion p ->
-  ByteString ->
-  Either XFTPErrorType r
-xftpDecodeTransmission tDecode thParams t = do
+xftpDecodeTransmission :: ProtocolEncoding XFTPVersion e c => THandleParams XFTPVersion p -> ByteString -> Either XFTPErrorType (SignedTransmission e c)
+xftpDecodeTransmission thParams t = do
  t' <- first (const BLOCK) $ C.unPad t
  case tParse thParams t' of
-    t'' :| [] -> Right $ tDecode thParams t''
+    t'' :| [] -> Right $ tDecodeParseValidate thParams t''
    _ -> Left BLOCK

 $(J.deriveJSON (enumJSON $ dropPrefix "F") ''FileParty)
@@ -26,12 +26,12 @@ import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Int (Int64)
+import Data.List (intercalate)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
 import Data.Maybe (fromMaybe, isJust)
 import qualified Data.Text as T
-import qualified Data.Text.IO as T
 import Data.Time.Clock (UTCTime (..), diffTimeToPicoseconds, getCurrentTime)
 import Data.Time.Format.ISO8601 (iso8601Show)
 import Data.Word (Word32)
@@ -45,7 +45,6 @@ import Network.Socket
 import Simplex.FileTransfer.Protocol
 import Simplex.FileTransfer.Server.Control
 import Simplex.FileTransfer.Server.Env
-import Simplex.FileTransfer.Server.Prometheus
 import Simplex.FileTransfer.Server.Stats
 import Simplex.FileTransfer.Server.Store
 import Simplex.FileTransfer.Server.StoreLog
@@ -54,16 +53,15 @@ import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BlockingInfo, EntityId (..), RcvPublicAuthKey, RcvPublicDhKey, RecipientId, SignedTransmission, pattern NoEntity)
-import Simplex.Messaging.Server (controlPortAuth, dummyVerifyCmd, verifyCmdAuthorization)
+import Simplex.Messaging.Protocol (CorrId (..), EntityId (..), RcvPublicAuthKey, RcvPublicDhKey, RecipientId, TransmissionAuth, pattern NoEntity)
+import Simplex.Messaging.Server (dummyVerifyCmd, verifyCmdAuthorization)
 import Simplex.Messaging.Server.Control (CPClientRole (..))
 import Simplex.Messaging.Server.Expiration
-import Simplex.Messaging.Server.QueueStore (ServerEntityStatus (..))
+import Simplex.Messaging.Server.QueueStore (RoundedSystemTime, getRoundedSystemTime)
 import Simplex.Messaging.Server.Stats
-import Simplex.Messaging.SystemTime
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Transport (CertChainPubKey (..), SessionId, THandleAuth (..), THandleParams (..), TransportPeer (..), defaultSupportedParams)
+import Simplex.Messaging.Transport (ALPN, SessionId, THandleAuth (..), THandleParams (..), TransportPeer (..), defaultSupportedParams)
 import Simplex.Messaging.Transport.Buffer (trimCR)
 import Simplex.Messaging.Transport.HTTP2
 import Simplex.Messaging.Transport.HTTP2.File (fileBlockSize)
@@ -71,7 +69,6 @@ import Simplex.Messaging.Transport.HTTP2.Server
 import Simplex.Messaging.Transport.Server (runLocalTCPServer)
 import Simplex.Messaging.Util
 import Simplex.Messaging.Version
-import System.Environment (lookupEnv)
 import System.Exit (exitFailure)
 import System.FilePath ((</>))
 import System.IO (hPrint, hPutStrLn, universalNewlineMode)
@@ -95,46 +92,39 @@ data XFTPTransportRequest = XFTPTransportRequest
 runXFTPServer :: XFTPServerConfig -> IO ()
 runXFTPServer cfg = do
  started <- newEmptyTMVarIO
-  runXFTPServerBlocking started cfg
+  runXFTPServerBlocking started cfg $ Just supportedXFTPhandshakes

-runXFTPServerBlocking :: TMVar Bool -> XFTPServerConfig -> IO ()
-runXFTPServerBlocking started cfg = newXFTPServerEnv cfg >>= runReaderT (xftpServer cfg started)
+runXFTPServerBlocking :: TMVar Bool -> XFTPServerConfig -> Maybe [ALPN] -> IO ()
+runXFTPServerBlocking started cfg alpn_ = newXFTPServerEnv cfg >>= runReaderT (xftpServer cfg started alpn_)

 data Handshake
  = HandshakeSent C.PrivateKeyX25519
  | HandshakeAccepted (THandleParams XFTPVersion 'TServer)

-xftpServer :: XFTPServerConfig -> TMVar Bool -> M ()
-xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpiration, fileExpiration, xftpServerVRange} started = do
+xftpServer :: XFTPServerConfig -> TMVar Bool -> Maybe [ALPN] -> M ()
+xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpiration, fileExpiration, xftpServerVRange} started alpn_ = do
  mapM_ (expireServerFiles Nothing) fileExpiration
  restoreServerStats
-  raceAny_
-    ( runServer
-        : expireFilesThread_ cfg
-          <> serverStatsThread_ cfg
-          <> prometheusMetricsThread_ cfg
-          <> controlPortThread_ cfg
-    )
-    `finally` stopServer
+  raceAny_ (runServer : expireFilesThread_ cfg <> serverStatsThread_ cfg <> controlPortThread_ cfg) `finally` stopServer
  where
    runServer :: M ()
    runServer = do
      srvCreds@(chain, pk) <- asks tlsServerCreds
-      signKey <- liftIO $ case C.x509ToPrivate' pk of
+      signKey <- liftIO $ case C.x509ToPrivate (pk, []) >>= C.privKey of
        Right pk' -> pure pk'
-        Left e -> putStrLn ("Server has no valid key: " <> show e) >> exitFailure
+        Left e -> putStrLn ("servers has no valid key: " <> show e) >> exitFailure
      env <- ask
      sessions <- liftIO TM.emptyIO
      let cleanup sessionId = atomically $ TM.delete sessionId sessions
-      liftIO . runHTTP2Server started xftpPort defaultHTTP2BufferSize defaultSupportedParams srvCreds transportConfig inactiveClientExpiration cleanup $ \sessionId sessionALPN r sendResponse -> do
+      liftIO . runHTTP2Server started xftpPort defaultHTTP2BufferSize defaultSupportedParams srvCreds alpn_ transportConfig inactiveClientExpiration cleanup $ \sessionId sessionALPN r sendResponse -> do
        reqBody <- getHTTP2Body r xftpBlockSize
        let v = VersionXFTP 1
            thServerVRange = versionToRange v
-            thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = v, thServerVRange, thAuth = Nothing, implySessId = False, encryptBlock = Nothing, batch = True, serviceAuth = False}
+            thParams0 = THandleParams {sessionId, blockSize = xftpBlockSize, thVersion = v, thServerVRange, thAuth = Nothing, implySessId = False, encryptBlock = Nothing, batch = True}
            req0 = XFTPTransportRequest {thParams = thParams0, request = r, reqBody, sendResponse}
        flip runReaderT env $ case sessionALPN of
          Nothing -> processRequest req0
-          Just alpn | alpn == xftpALPNv1 || alpn == httpALPN11 ->
+          Just "xftp/1" ->
            xftpServerHandshakeV1 chain signKey sessions req0 >>= \case
              Nothing -> pure () -- handshake response sent
              Just thParams -> processRequest req0 {thParams} -- proceed with new version (XXX: may as well switch the request handler here)
@@ -152,7 +142,7 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
          unless (B.null bodyHead) $ throwE HANDSHAKE
          (k, pk) <- atomically . C.generateKeyPair =<< asks random
          atomically $ TM.insert sessionId (HandshakeSent pk) sessions
-          let authPubKey = CertChainPubKey chain (C.signX509 serverSignKey $ C.publicToX509 k)
+          let authPubKey = (chain, C.signX509 serverSignKey $ C.publicToX509 k)
          let hs = XFTPServerHandshake {xftpVersionRange = xftpServerVRange, sessionId, authPubKey}
          shs <- encodeXftp hs
 #ifdef slow_servers
@@ -168,7 +158,7 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
          unless (keyHash == kh) $ throwE HANDSHAKE
          case compatibleVRange' xftpServerVRange v of
            Just (Compatible vr) -> do
-              let auth = THAuthServer {serverPrivKey = pk, peerClientService = Nothing, sessSecret' = Nothing}
+              let auth = THAuthServer {serverPrivKey = pk, sessSecret' = Nothing}
                  thParams = thParams0 {thAuth = Just auth, thVersion = v, thServerVRange = vr}
              atomically $ TM.insert sessionId (HandshakeAccepted thParams) sessions
 #ifdef slow_servers
@@ -191,7 +181,7 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
    stopServer = do
      withFileLog closeStoreLog
      saveServerStats
-      logNote "Server stopped"
+      logInfo "Server stopped"

    expireFilesThread_ :: XFTPServerConfig -> [M ()]
    expireFilesThread_ XFTPServerConfig {fileExpiration = Just fileExp} = [expireFiles fileExp]
@@ -231,49 +221,25 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
          fileDownloadAcks' <- atomicSwapIORef fileDownloadAcks 0
          filesCount' <- readIORef filesCount
          filesSize' <- readIORef filesSize
-          T.hPutStrLn h $
-            T.intercalate
+          hPutStrLn h $
+            intercalate
              ","
-              [ T.pack $ iso8601Show $ utctDay fromTime',
-                tshow filesCreated',
-                tshow fileRecipients',
-                tshow filesUploaded',
-                tshow filesDeleted',
+              [ iso8601Show $ utctDay fromTime',
+                show filesCreated',
+                show fileRecipients',
+                show filesUploaded',
+                show filesDeleted',
                dayCount files,
                weekCount files,
                monthCount files,
-                tshow fileDownloads',
-                tshow fileDownloadAcks',
-                tshow filesCount',
-                tshow filesSize',
-                tshow filesExpired'
+                show fileDownloads',
+                show fileDownloadAcks',
+                show filesCount',
+                show filesSize',
+                show filesExpired'
              ]
        liftIO $ threadDelay' interval

-    prometheusMetricsThread_ :: XFTPServerConfig -> [M ()]
-    prometheusMetricsThread_ XFTPServerConfig {prometheusInterval = Just interval, prometheusMetricsFile} =
-      [savePrometheusMetrics interval prometheusMetricsFile]
-    prometheusMetricsThread_ _ = []
-
-    savePrometheusMetrics :: Int -> FilePath -> M ()
-    savePrometheusMetrics saveInterval metricsFile = do
-      labelMyThread "savePrometheusMetrics"
-      liftIO $ putStrLn $ "Prometheus metrics saved every " <> show saveInterval <> " seconds to " <> metricsFile
-      ss <- asks serverStats
-      rtsOpts <- liftIO $ maybe ("set " <> rtsOptionsEnv) T.pack <$> lookupEnv (T.unpack rtsOptionsEnv)
-      let interval = 1000000 * saveInterval
-      liftIO $ forever $ do
-        threadDelay interval
-        ts <- getCurrentTime
-        sm <- getFileServerMetrics ss rtsOpts
-        T.writeFile metricsFile $ xftpPrometheusMetrics sm ts
-
-    getFileServerMetrics :: FileServerStats -> T.Text -> IO FileServerMetrics
-    getFileServerMetrics ss rtsOptions = do
-      d <- getFileServerStatsData ss
-      let fd = periodStatDataCounts $ _filesDownloaded d
-      pure FileServerMetrics {statsData = d, filesDownloadedPeriods = fd, rtsOptions}
-
    controlPortThread_ :: XFTPServerConfig -> [M ()]
    controlPortThread_ XFTPServerConfig {controlPort = Just port} = [runCPServer port]
    controlPortThread_ _ = []
@@ -311,22 +277,21 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
                  CPSkip -> False
                  _ -> True
            processCP h role = \case
-              CPAuth auth -> controlPortAuth h user admin role auth
+              CPAuth auth -> atomically $ writeTVar role $! newRole cfg
                where
-                  XFTPServerConfig {controlPortUserAuth = user, controlPortAdminAuth = admin} = cfg
+                  newRole XFTPServerConfig {controlPortUserAuth = user, controlPortAdminAuth = admin}
+                    | Just auth == admin = CPRAdmin
+                    | Just auth == user = CPRUser
+                    | otherwise = CPRNone
              CPStatsRTS -> E.tryAny getRTSStats >>= either (hPrint h) (hPrint h)
              CPDelete fileId -> withUserRole $ unliftIO u $ do
                fs <- asks store
                r <- runExceptT $ do
-                  (fr, _) <- ExceptT $ atomically $ getFile fs SFRecipient fileId
+                  let asSender = ExceptT . atomically $ getFile fs SFSender fileId
+                  let asRecipient = ExceptT . atomically $ getFile fs SFRecipient fileId
+                  (fr, _) <- asSender `catchError` const asRecipient
                  ExceptT $ deleteServerFile_ fr
                liftIO . hPutStrLn h $ either (\e -> "error: " <> show e) (\() -> "ok") r
-              CPBlock fileId info -> withUserRole $ unliftIO u $ do
-                fs <- asks store
-                r <- runExceptT $ do
-                  (fr, _) <- ExceptT $ atomically $ getFile fs SFRecipient fileId
-                  ExceptT $ blockServerFile fr info
-                liftIO . hPutStrLn h $ either (\e -> "error: " <> show e) (\() -> "ok") r
              CPHelp -> hPutStrLn h "commands: stats-rts, delete, help, quit"
              CPQuit -> pure ()
              CPSkip -> pure ()
@@ -348,20 +313,22 @@ data ServerFile = ServerFile
 processRequest :: XFTPTransportRequest -> M ()
 processRequest XFTPTransportRequest {thParams, reqBody = body@HTTP2Body {bodyHead}, sendResponse}
  | B.length bodyHead /= xftpBlockSize = sendXFTPResponse ("", NoEntity, FRErr BLOCK) Nothing
-  | otherwise =
-      case xftpDecodeTServer thParams bodyHead of
-        Right (Right t@(_, _, (corrId, fId, _))) -> do
-          let THandleParams {thAuth} = thParams
-          verifyXFTPTransmission thAuth t >>= \case
-            VRVerified req -> uncurry send =<< processXFTPRequest body req
-            VRFailed e -> send (FRErr e) Nothing
+  | otherwise = do
+      case xftpDecodeTransmission thParams bodyHead of
+        Right (sig_, signed, (corrId, fId, cmdOrErr)) ->
+          case cmdOrErr of
+            Right cmd -> do
+              let THandleParams {thAuth} = thParams
+              verifyXFTPTransmission ((,C.cbNonce (bs corrId)) <$> thAuth) sig_ signed fId cmd >>= \case
+                VRVerified req -> uncurry send =<< processXFTPRequest body req
+                VRFailed -> send (FRErr AUTH) Nothing
+            Left e -> send (FRErr e) Nothing
          where
            send resp = sendXFTPResponse (corrId, fId, resp)
-        Right (Left (corrId, fId, e)) -> sendXFTPResponse (corrId, fId, FRErr e) Nothing
        Left e -> sendXFTPResponse ("", NoEntity, FRErr e) Nothing
  where
-    sendXFTPResponse t' serverFile_ = do
-      let t_ = xftpEncodeTransmission thParams t'
+    sendXFTPResponse (corrId, fId, resp) serverFile_ = do
+      let t_ = xftpEncodeTransmission thParams (corrId, fId, resp)
 #ifdef slow_servers
      randomDelay
 #endif
@@ -388,10 +355,10 @@ randomDelay = do
    threadDelay $ (d * (1000 + pc)) `div` 1000
 #endif

-data VerificationResult = VRVerified XFTPRequest | VRFailed XFTPErrorType
+data VerificationResult = VRVerified XFTPRequest | VRFailed

-verifyXFTPTransmission :: Maybe (THandleAuth 'TServer) -> SignedTransmission FileCmd -> M VerificationResult
-verifyXFTPTransmission thAuth (tAuth, authorized, (corrId, fId, cmd)) =
+verifyXFTPTransmission :: Maybe (THandleAuth 'TServer, C.CbNonce) -> Maybe TransmissionAuth -> ByteString -> XFTPFileId -> FileCmd -> M VerificationResult
+verifyXFTPTransmission auth_ tAuth authorized fId cmd =
  case cmd of
    FileCmd SFSender (FNEW file rcps auth') -> pure $ XFTPReqNew file rcps auth' `verifyWith` sndKey file
    FileCmd SFRecipient PING -> pure $ VRVerified XFTPReqPing
@@ -400,19 +367,13 @@ verifyXFTPTransmission thAuth (tAuth, authorized, (corrId, fId, cmd)) =
    verifyCmd :: SFileParty p -> M VerificationResult
    verifyCmd party = do
      st <- asks store
-      atomically $ verify =<< getFile st party fId
+      atomically $ verify <$> getFile st party fId
      where
        verify = \case
-          Right (fr, k) -> result <$> readTVar (fileStatus fr)
-            where
-              result = \case
-                EntityActive -> XFTPReqCmd fId fr cmd `verifyWith` k
-                EntityBlocked info -> VRFailed $ BLOCKED info
-                EntityOff -> noFileAuth
-          Left _ -> pure noFileAuth
-        noFileAuth = dummyVerifyCmd thAuth tAuth authorized corrId `seq` VRFailed AUTH
+          Right (fr, k) -> XFTPReqCmd fId fr cmd `verifyWith` k
+          _ -> maybe False (dummyVerifyCmd Nothing authorized) tAuth `seq` VRFailed
    -- TODO verify with DH authorization
-    req `verifyWith` k = if verifyCmdAuthorization thAuth tAuth authorized corrId k then VRVerified req else VRFailed AUTH
+    req `verifyWith` k = if verifyCmdAuthorization auth_ tAuth authorized k then VRVerified req else VRFailed

 processXFTPRequest :: HTTP2Body -> XFTPRequest -> M (FileResponse, Maybe ServerFile)
 processXFTPRequest HTTP2Body {bodyPart} = \case
@@ -429,7 +390,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
    FACK -> noFile =<< ackFileReception fId fr
    -- it should never get to the commands below, they are passed in other constructors of XFTPRequest
    FNEW {} -> noFile $ FRErr INTERNAL
-    PING -> noFile $ FRErr INTERNAL
+    PING -> noFile FRPong
  XFTPReqPing -> noFile FRPong
  where
    noFile resp = pure (resp, Nothing)
@@ -444,7 +405,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
        sId <- ExceptT $ addFileRetry st file 3 ts
        rcps <- mapM (ExceptT . addRecipientRetry st 3 sId) rks
        lift $ withFileLog $ \sl -> do
-          logAddFile sl sId file ts EntityActive
+          logAddFile sl sId file ts
          logAddRecipients sl sId rcps
        stats <- asks serverStats
        lift $ incFileStat filesCreated
@@ -452,10 +413,10 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
        let rIds = L.map (\(FileRecipient rId _) -> rId) rcps
        pure $ FRSndIds sId rIds
      pure $ either FRErr id r
-    addFileRetry :: FileStore -> FileInfo -> Int -> RoundedFileTime -> M (Either XFTPErrorType XFTPFileId)
+    addFileRetry :: FileStore -> FileInfo -> Int -> RoundedSystemTime -> M (Either XFTPErrorType XFTPFileId)
    addFileRetry st file n ts =
      retryAdd n $ \sId -> runExceptT $ do
-        ExceptT $ addFile st sId file ts EntityActive
+        ExceptT $ addFile st sId file ts
        pure sId
    addRecipientRetry :: FileStore -> Int -> XFTPFileId -> RcvPublicAuthKey -> M (Either XFTPErrorType FileRecipient)
    addRecipientRetry st n sId rpk =
@@ -557,31 +518,22 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
      pure FROk

 deleteServerFile_ :: FileRec -> M (Either XFTPErrorType ())
-deleteServerFile_ fr@FileRec {senderId} = do
+deleteServerFile_ FileRec {senderId, fileInfo, filePath} = do
  withFileLog (`logDeleteFile` senderId)
-  deleteOrBlockServerFile_ fr filesDeleted (`deleteFile` senderId)
-
-- this also deletes the file from storage, but doesn't include it in delete statistics
-blockServerFile :: FileRec -> BlockingInfo -> M (Either XFTPErrorType ())
-blockServerFile fr@FileRec {senderId} info = do
-  withFileLog $ \sl -> logBlockFile sl senderId info
-  deleteOrBlockServerFile_ fr filesBlocked $ \st -> blockFile st senderId info True
-
-deleteOrBlockServerFile_ :: FileRec -> (FileServerStats -> IORef Int) -> (FileStore -> STM (Either XFTPErrorType ())) -> M (Either XFTPErrorType ())
-deleteOrBlockServerFile_ FileRec {filePath, fileInfo} stat storeAction = runExceptT $ do
-  path <- readTVarIO filePath
-  stats <- asks serverStats
-  ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
-  st <- asks store
-  void $ atomically $ storeAction st
-  lift $ incFileStat stat
+  runExceptT $ do
+    path <- readTVarIO filePath
+    stats <- asks serverStats
+    ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
+    st <- asks store
+    void $ atomically $ deleteFile st senderId
+    lift $ incFileStat filesDeleted
  where
    deletedStats stats = do
      liftIO $ atomicModifyIORef'_ (filesCount stats) (subtract 1)
      liftIO $ atomicModifyIORef'_ (filesSize stats) (subtract $ fromIntegral $ size fileInfo)

-getFileTime :: IO RoundedFileTime
-getFileTime = getRoundedSystemTime
+getFileTime :: IO RoundedSystemTime
+getFileTime = getRoundedSystemTime fileTimePrecision

 expireServerFiles :: Maybe Int -> ExpirationConfig -> M ()
 expireServerFiles itemDelay expCfg = do
@@ -589,13 +541,13 @@ expireServerFiles itemDelay expCfg = do
  usedStart <- readTVarIO $ usedStorage st
  old <- liftIO $ expireBeforeEpoch expCfg
  files' <- readTVarIO (files st)
-  logNote $ "Expiration check: " <> tshow (M.size files') <> " files"
+  logInfo $ "Expiration check: " <> tshow (M.size files') <> " files"
  forM_ (M.keys files') $ \sId -> do
    mapM_ threadDelay itemDelay
    atomically (expiredFilePath st sId old)
      >>= mapM_ (maybeRemove $ delete st sId)
  usedEnd <- readTVarIO $ usedStorage st
-  logNote $ "Used " <> mbs usedStart <> " -> " <> mbs usedEnd <> ", " <> mbs (usedStart - usedEnd) <> " reclaimed."
+  logInfo $ "Used " <> mbs usedStart <> " -> " <> mbs usedEnd <> ", " <> mbs (usedStart - usedEnd) <> " reclaimed."
  where
    mbs bs = tshow (bs `div` 1048576) <> "mb"
    maybeRemove del = maybe del (remove del)
@@ -629,15 +581,15 @@ saveServerStats =
    >>= mapM_ (\f -> asks serverStats >>= liftIO . getFileServerStatsData >>= liftIO . saveStats f)
  where
    saveStats f stats = do
-      logNote $ "saving server stats to file " <> T.pack f
+      logInfo $ "saving server stats to file " <> T.pack f
      B.writeFile f $ strEncode stats
-      logNote "server stats saved"
+      logInfo "server stats saved"

 restoreServerStats :: M ()
 restoreServerStats = asks (serverStatsBackupFile . config) >>= mapM_ restoreStats
  where
    restoreStats f = whenM (doesFileExist f) $ do
-      logNote $ "restoring server stats from file " <> T.pack f
+      logInfo $ "restoring server stats from file " <> T.pack f
      liftIO (strDecode <$> B.readFile f) >>= \case
        Right d@FileServerStatsData {_filesCount = statsFilesCount, _filesSize = statsFilesSize} -> do
          s <- asks serverStats
@@ -646,10 +598,10 @@ restoreServerStats = asks (serverStatsBackupFile . config) >>= mapM_ restoreStat
          _filesSize <- readTVarIO usedStorage
          liftIO $ setFileServerStats s d {_filesCount, _filesSize}
          renameFile f $ f <> ".bak"
-          logNote "server stats restored"
+          logInfo "server stats restored"
          when (statsFilesCount /= _filesCount) $ logWarn $ "Files count differs: stats: " <> tshow statsFilesCount <> ", store: " <> tshow _filesCount
          when (statsFilesSize /= _filesSize) $ logWarn $ "Files size differs: stats: " <> tshow statsFilesSize <> ", store: " <> tshow _filesSize
-          logNote $ "Restored " <> tshow (_filesSize `div` 1048576) <> " MBs in " <> tshow _filesCount <> " files"
+          logInfo $ "Restored " <> tshow (_filesSize `div` 1048576) <> " MBs in " <> tshow _filesCount <> " files"
        Left e -> do
-          logNote $ "error restoring server stats: " <> T.pack e
+          logInfo $ "error restoring server stats: " <> T.pack e
          liftIO exitFailure
@@ -6,13 +6,12 @@ module Simplex.FileTransfer.Server.Control where
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Simplex.FileTransfer.Protocol (XFTPFileId)
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BasicAuth, BlockingInfo)
+import Simplex.Messaging.Protocol (BasicAuth)

 data ControlProtocol
  = CPAuth BasicAuth
  | CPStatsRTS
  | CPDelete XFTPFileId
-  | CPBlock XFTPFileId BlockingInfo
  | CPHelp
  | CPQuit
  | CPSkip
@@ -22,7 +21,6 @@ instance StrEncoding ControlProtocol where
    CPAuth tok -> "auth " <> strEncode tok
    CPStatsRTS -> "stats-rts"
    CPDelete fId -> strEncode (Str "delete", fId)
-    CPBlock fId info -> strEncode (Str "block", fId, info)
    CPHelp -> "help"
    CPQuit -> "quit"
    CPSkip -> ""
@@ -31,7 +29,6 @@ instance StrEncoding ControlProtocol where
      "auth" -> CPAuth <$> _strP
      "stats-rts" -> pure CPStatsRTS
      "delete" -> CPDelete <$> _strP
-      "block" -> CPBlock <$> _strP <*> _strP
      "help" -> pure CPHelp
      "quit" -> pure CPQuit
      "" -> pure CPSkip
@@ -64,8 +64,6 @@ data XFTPServerConfig = XFTPServerConfig
    logStatsStartTime :: Int64,
    serverStatsLogFile :: FilePath,
    serverStatsBackupFile :: Maybe FilePath,
-    prometheusInterval :: Maybe Int,
-    prometheusMetricsFile :: FilePath,
    transportConfig :: TransportServerConfig,
    responseDelay :: Int
  }
@@ -105,8 +103,8 @@ newXFTPServerEnv config@XFTPServerConfig {storeLogFile, fileSizeQuota, xftpCrede
  used <- countUsedStorage <$> readTVarIO (files store)
  atomically $ writeTVar (usedStorage store) used
  forM_ fileSizeQuota $ \quota -> do
-    logNote $ "Total / available storage: " <> tshow quota <> " / " <> tshow (quota - used)
-    when (quota < used) $ logWarn "WARNING: storage quota is less than used storage, no files can be uploaded!"
+    logInfo $ "Total / available storage: " <> tshow quota <> " / " <> tshow (quota - used)
+    when (quota < used) $ logInfo "WARNING: storage quota is less than used storage, no files can be uploaded!"
  tlsServerCreds <- loadServerCredential xftpCredentials
  Fingerprint fp <- loadFingerprint xftpCredentials
  serverStats <- newFileServerStats =<< getCurrentTime
@@ -1,4 +1,3 @@
-{-# LANGUAGE ApplicativeDo #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
@@ -21,16 +20,16 @@ import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Description (FileSize (..))
 import Simplex.FileTransfer.Server (runXFTPServer)
 import Simplex.FileTransfer.Server.Env (XFTPServerConfig (..), defFileExpirationHours, defaultFileExpiration, defaultInactiveClientExpiration)
-import Simplex.FileTransfer.Transport (supportedFileServerVRange, alpnSupportedXFTPhandshakes)
+import Simplex.FileTransfer.Transport (supportedFileServerVRange)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), pattern XFTPServer)
 import Simplex.Messaging.Server.CLI
 import Simplex.Messaging.Server.Expiration
+import Simplex.Messaging.Transport (simplexMQVersion)
 import Simplex.Messaging.Transport.Client (TransportHost (..))
-import Simplex.Messaging.Transport.HTTP2 (httpALPN)
-import Simplex.Messaging.Transport.Server (ServerCredentials (..), mkTransportServerConfig)
-import Simplex.Messaging.Util (eitherToMaybe, safeDecodeUtf8, tshow)
+import Simplex.Messaging.Transport.Server (ServerCredentials (..), TransportServerConfig (..), defaultTransportServerConfig)
+import Simplex.Messaging.Util (safeDecodeUtf8, tshow)
 import System.Directory (createDirectoryIfMissing, doesFileExist)
 import System.FilePath (combine)
 import System.IO (BufferMode (..), hSetBuffering, stderr, stdout)
@@ -60,7 +59,7 @@ xftpServerCLI cfgPath logPath = do
      putStrLn "Deleted configuration and log files"
  where
    iniFile = combine cfgPath "file-server.ini"
-    serverVersion = "SimpleX XFTP server v" <> simplexmqVersionCommit
+    serverVersion = "SimpleX XFTP server v" <> simplexMQVersion
    defaultServerPort = "443"
    executableName = "file-server"
    storeLogFilePath = combine logPath "file-server-store.log"
@@ -89,9 +88,6 @@ xftpServerCLI cfgPath logPath = do
            <> "# Expire files after the specified number of hours.\n"
            <> ("expire_files_hours: " <> tshow defFileExpirationHours <> "\n\n")
            <> "log_stats: off\n\
-               \\n\
-               \# Log interval for real-time Prometheus metrics\n\
-               \# prometheus_interval: 60\n\
               \\n\
               \[AUTH]\n\
               \# Set new_files option to off to completely prohibit uploading new files.\n\
@@ -191,13 +187,10 @@ xftpServerCLI cfgPath logPath = do
              logStatsStartTime = 0, -- seconds from 00:00 UTC
              serverStatsLogFile = combine logPath "file-server-stats.daily.log",
              serverStatsBackupFile = logStats $> combine logPath "file-server-stats.log",
-              prometheusInterval = eitherToMaybe $ read . T.unpack <$> lookupValue "STORE_LOG" "prometheus_interval" ini,
-              prometheusMetricsFile = combine logPath "xftp-server-metrics.txt",
              transportConfig =
-                mkTransportServerConfig
-                  (fromMaybe False $ iniOnOff "TRANSPORT" "log_tls_errors" ini)
-                  (Just $ alpnSupportedXFTPhandshakes <> httpALPN)
-                  False,
+                defaultTransportServerConfig
+                  { logTLSErrors = fromMaybe False $ iniOnOff "TRANSPORT" "log_tls_errors" ini
+                  },
              responseDelay = 0
            }

@@ -227,19 +220,14 @@ cliCommandP cfgPath logPath iniFile =
    )
  where
    initP :: Parser InitOptions
-    initP = do
-      enableStoreLog <-
-        flag' False
-          ( long "disable-store-log"
-              <> help "Disable store log for persistence (enabled by default)"
+    initP =
+      InitOptions
+        <$> switch
+          ( long "store-log"
+              <> short 'l'
+              <> help "Enable store log for persistence"
          )
-          <|> flag True True
-            ( long "store-log"
-                <> short 'l'
-                <> help "Enable store log for persistence (DEPRECATED, enabled by default)"
-            )
-      signAlgorithm <-
-        option
+        <*> option
          (maybeReader readMaybe)
          ( long "sign-algorithm"
              <> short 'a'
@@ -248,8 +236,7 @@ cliCommandP cfgPath logPath iniFile =
              <> showDefault
              <> metavar "ALG"
          )
-      ip <-
-        strOption
+        <*> strOption
          ( long "ip"
              <> help
                "Server IP address, used as Common Name for TLS online certificate if FQDN is not supplied"
@@ -257,26 +244,22 @@ cliCommandP cfgPath logPath iniFile =
              <> showDefault
              <> metavar "IP"
          )
-      fqdn <-
-        (optional . strOption)
+        <*> (optional . strOption)
          ( long "fqdn"
              <> short 'n'
              <> help "Server FQDN used as Common Name for TLS online certificate"
              <> showDefault
              <> metavar "FQDN"
          )
-      filesPath <-
-        strOption
+        <*> strOption
          ( long "path"
              <> short 'p'
              <> help "Path to the directory to store files"
              <> metavar "PATH"
          )
-      fileSizeQuota <-
-        strOption
+        <*> strOption
          ( long "quota"
              <> short 'q'
              <> help "File storage quota (e.g. 100gb)"
              <> metavar "QUOTA"
          )
-      pure InitOptions {enableStoreLog, signAlgorithm, ip, fqdn, filesPath, fileSizeQuota}
@@ -1,134 +0,0 @@
-{-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE TypeApplications #-}
-{-# OPTIONS_GHC -fno-warn-unrecognised-pragmas #-}
-
-module Simplex.FileTransfer.Server.Prometheus where
-
-import Data.Int (Int64)
-import Data.Text (Text)
-import qualified Data.Text as T
-import Data.Time.Clock (UTCTime (..), diffUTCTime)
-import Data.Time.Clock.System (systemEpochDay)
-import Data.Time.Format.ISO8601 (iso8601Show)
-import Simplex.FileTransfer.Server.Stats
-import Simplex.Messaging.Server.Stats (PeriodStatCounts (..))
-import Simplex.Messaging.Transport (simplexMQVersion)
-import Simplex.Messaging.Util (tshow)
-
-data FileServerMetrics = FileServerMetrics
-  { statsData :: FileServerStatsData,
-    filesDownloadedPeriods :: PeriodStatCounts,
-    rtsOptions :: Text
-  }
-
-rtsOptionsEnv :: Text
-rtsOptionsEnv = "XFTP_RTS_OPTIONS"
-
-{-# FOURMOLU_DISABLE\n#-}
-xftpPrometheusMetrics :: FileServerMetrics -> UTCTime -> Text
-xftpPrometheusMetrics sm ts =
-  time <> files <> info
-  where
-    FileServerMetrics {statsData, filesDownloadedPeriods, rtsOptions} = sm
-    FileServerStatsData
-      { _fromTime,
-        _filesCreated,
-        _fileRecipients,
-        _filesUploaded,
-        _filesExpired,
-        _filesDeleted,
-        _filesBlocked,
-        _fileDownloads,
-        _fileDownloadAcks,
-        _filesCount,
-        _filesSize
-      } = statsData
-    time =
-      "# Recorded at: " <> T.pack (iso8601Show ts) <> "\n\
-      \# Stats from: " <> T.pack (iso8601Show _fromTime) <> "\n\
-      \\n"
-    files =
-      "# Files\n\
-      \# -----\n\
-      \\n\
-      \# HELP simplex_xftp_files_created Created files\n\
-      \# TYPE simplex_xftp_files_created counter\n\
-      \simplex_xftp_files_created " <> mshow _filesCreated <> "\n\
-      \# filesCreated\n\
-      \\n\
-      \# HELP simplex_xftp_files_recipients Files recipients\n\
-      \# TYPE simplex_xftp_files_recipients counter\n\
-      \simplex_xftp_files_recipients " <> mshow _fileRecipients <> "\n\
-      \# fileRecipients\n\
-      \\n\
-      \# HELP simplex_xftp_files_uploaded Uploaded files\n\
-      \# TYPE simplex_xftp_files_uploaded counter\n\
-      \simplex_xftp_files_uploaded " <> mshow _filesUploaded <> "\n\
-      \# filesUploaded\n\
-      \\n\
-      \# HELP simplex_xftp_files_expired Expired files\n\
-      \# TYPE simplex_xftp_files_expired counter\n\
-      \simplex_xftp_files_expired " <> mshow _filesExpired <> "\n\
-      \# filesExpired\n\
-      \\n\
-      \# HELP simplex_xftp_files_deleted Deleted files\n\
-      \# TYPE simplex_xftp_files_deleted counter\n\
-      \simplex_xftp_files_deleted " <> mshow _filesDeleted <> "\n\
-      \# filesDeleted\n\
-      \\n\
-      \# HELP simplex_xftp_files_blocked Blocked files\n\
-      \# TYPE simplex_xftp_files_blocked counter\n\
-      \simplex_xftp_files_blocked " <> mshow _filesBlocked <> "\n\
-      \# filesBlocked\n\
-      \\n\
-      \# HELP simplex_xftp_file_downloads File downloads\n\
-      \# TYPE simplex_xftp_file_downloads counter\n\
-      \simplex_xftp_file_downloads " <> mshow _fileDownloads <> "\n\
-      \# fileDownloads\n\
-      \\n\
-      \# HELP simplex_xftp_file_download_acks File download ACKs\n\
-      \# TYPE simplex_xftp_file_download_acks counter\n\
-      \simplex_xftp_file_download_acks " <> mshow _fileDownloadAcks <> "\n\
-      \# fileDownloadAcks\n\
-      \\n\
-      \# HELP simplex_xftp_files_count_total Total files count \n\
-      \# TYPE simplex_xftp_files_count_total gauge\n\
-      \simplex_xftp_files_count_total " <> mshow _filesCount <> "\n\
-      \# filesCount\n\
-      \\n\
-      \# HELP simplex_xftp_files_size Size of files \n\
-      \# TYPE simplex_xftp_files_size gauge\n\
-      \simplex_xftp_files_size " <> mshow _filesSize <> "\n\
-      \# filesSize \n\
-      \\n\
-      \# HELP simplex_xftp_files_count_daily Daily files count\n\
-      \# TYPE simplex_xftp_files_count_daily gauge\n\
-      \simplex_xftp_files_count_daily " <> mstr (dayCount filesDownloadedPeriods) <> "\n\
-      \# filesDownloaded.dayCount\n\
-      \\n\
-      \# HELP simplex_xftp_files_count_weekly Weekly files count\n\
-      \# TYPE simplex_xftp_files_count_weekly gauge\n\
-      \simplex_xftp_files_count_weekly " <> mstr (weekCount filesDownloadedPeriods) <> "\n\
-      \# filesDownloaded.weekCount\n\
-      \\n\
-      \# HELP simplex_xftp_files_count_monthly Monthly files count\n\
-      \# TYPE simplex_xftp_files_count_monthly gauge\n\
-      \simplex_xftp_files_count_monthly " <> mstr (monthCount filesDownloadedPeriods) <> "\n\
-      \# filesDownloaded.monthCount\n\
-      \\n"
-    info =
-      "# Info\n\
-      \# ----\n\
-      \\n\
-      \# HELP simplex_xftp_info Server information. RTS options have to be passed via " <> rtsOptionsEnv <> " env var\n\
-      \# TYPE simplex_xftp_info gauge\n\
-      \simplex_xftp_info{version=\"" <> T.pack simplexMQVersion <> "\",rts_options=\"" <> rtsOptions <> "\"} 1\n\
-      \\n"
-    mstr a = a <> " " <> tsEpoch
-    mshow :: Show a => a -> Text
-    mshow = mstr . tshow
-    tsEpoch = tshow @Int64 $ floor @Double $ realToFrac (ts `diffUTCTime` epoch) * 1000
-    epoch = UTCTime systemEpochDay 0
-{-# FOURMOLU_ENABLE\n#-}
@@ -20,7 +20,6 @@ data FileServerStats = FileServerStats
    filesUploaded :: IORef Int,
    filesExpired :: IORef Int,
    filesDeleted :: IORef Int,
-    filesBlocked :: IORef Int,
    filesDownloaded :: PeriodStats,
    fileDownloads :: IORef Int,
    fileDownloadAcks :: IORef Int,
@@ -35,7 +34,6 @@ data FileServerStatsData = FileServerStatsData
    _filesUploaded :: Int,
    _filesExpired :: Int,
    _filesDeleted :: Int,
-    _filesBlocked :: Int,
    _filesDownloaded :: PeriodStatsData,
    _fileDownloads :: Int,
    _fileDownloadAcks :: Int,
@@ -52,13 +50,12 @@ newFileServerStats ts = do
  filesUploaded <- newIORef 0
  filesExpired <- newIORef 0
  filesDeleted <- newIORef 0
-  filesBlocked <- newIORef 0
  filesDownloaded <- newPeriodStats
  fileDownloads <- newIORef 0
  fileDownloadAcks <- newIORef 0
  filesCount <- newIORef 0
  filesSize <- newIORef 0
-  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesBlocked, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}
+  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}

 getFileServerStatsData :: FileServerStats -> IO FileServerStatsData
 getFileServerStatsData s = do
@@ -68,13 +65,12 @@ getFileServerStatsData s = do
  _filesUploaded <- readIORef $ filesUploaded s
  _filesExpired <- readIORef $ filesExpired s
  _filesDeleted <- readIORef $ filesDeleted s
-  _filesBlocked <- readIORef $ filesBlocked s
  _filesDownloaded <- getPeriodStatsData $ filesDownloaded s
  _fileDownloads <- readIORef $ fileDownloads s
  _fileDownloadAcks <- readIORef $ fileDownloadAcks s
  _filesCount <- readIORef $ filesCount s
  _filesSize <- readIORef $ filesSize s
-  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesBlocked, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
+  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}

 -- this function is not thread safe, it is used on server start only
 setFileServerStats :: FileServerStats -> FileServerStatsData -> IO ()
@@ -85,7 +81,6 @@ setFileServerStats s d = do
  writeIORef (filesUploaded s) $! _filesUploaded d
  writeIORef (filesExpired s) $! _filesExpired d
  writeIORef (filesDeleted s) $! _filesDeleted d
-  writeIORef (filesBlocked s) $! _filesBlocked d
  setPeriodStats (filesDownloaded s) $! _filesDownloaded d
  writeIORef (fileDownloads s) $! _fileDownloads d
  writeIORef (fileDownloadAcks s) $! _fileDownloadAcks d
@@ -93,7 +88,7 @@ setFileServerStats s d = do
  writeIORef (filesSize s) $! _filesSize d

 instance StrEncoding FileServerStatsData where
-  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesBlocked, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize} =
+  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize} =
    B.unlines
      [ "fromTime=" <> strEncode _fromTime,
        "filesCreated=" <> strEncode _filesCreated,
@@ -101,7 +96,6 @@ instance StrEncoding FileServerStatsData where
        "filesUploaded=" <> strEncode _filesUploaded,
        "filesExpired=" <> strEncode _filesExpired,
        "filesDeleted=" <> strEncode _filesDeleted,
-        "filesBlocked=" <> strEncode _filesBlocked,
        "filesCount=" <> strEncode _filesCount,
        "filesSize=" <> strEncode _filesSize,
        "filesDownloaded:",
@@ -116,12 +110,9 @@ instance StrEncoding FileServerStatsData where
    _filesUploaded <- "filesUploaded=" *> strP <* A.endOfLine
    _filesExpired <- "filesExpired=" *> strP <* A.endOfLine <|> pure 0
    _filesDeleted <- "filesDeleted=" *> strP <* A.endOfLine
-    _filesBlocked <- opt "filesBlocked="
    _filesCount <- "filesCount=" *> strP <* A.endOfLine <|> pure 0
    _filesSize <- "filesSize=" *> strP <* A.endOfLine <|> pure 0
    _filesDownloaded <- "filesDownloaded:" *> A.endOfLine *> strP <* A.endOfLine
    _fileDownloads <- "fileDownloads=" *> strP <* A.endOfLine
    _fileDownloadAcks <- "fileDownloadAcks=" *> strP <* A.endOfLine
-    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesBlocked, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
-    where
-      opt s = A.string s *> strP <* A.endOfLine <|> pure 0
+    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
@@ -1,4 +1,3 @@
-{-# LANGUAGE DataKinds #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
@@ -9,13 +8,11 @@ module Simplex.FileTransfer.Server.Store
  ( FileStore (..),
    FileRec (..),
    FileRecipient (..),
-    RoundedFileTime,
    newFileStore,
    addFile,
    setFilePath,
    addRecipient,
    deleteFile,
-    blockFile,
    deleteRecipient,
    expiredFilePath,
    getFile,
@@ -25,7 +22,6 @@ module Simplex.FileTransfer.Server.Store
 where

 import Control.Concurrent.STM
-import Control.Monad
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Int (Int64)
 import Data.Set (Set)
@@ -34,9 +30,8 @@ import Simplex.FileTransfer.Protocol (FileInfo (..), SFileParty (..), XFTPFileId
 import Simplex.FileTransfer.Transport (XFTPErrorType (..))
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BlockingInfo, RcvPublicAuthKey, RecipientId, SenderId)
-import Simplex.Messaging.Server.QueueStore (ServerEntityStatus (..))
-import Simplex.Messaging.SystemTime
+import Simplex.Messaging.Protocol (RcvPublicAuthKey, RecipientId, SenderId)
+import Simplex.Messaging.Server.QueueStore (RoundedSystemTime (..))
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Util (ifM, ($>>=))
@@ -52,12 +47,9 @@ data FileRec = FileRec
    fileInfo :: FileInfo,
    filePath :: TVar (Maybe FilePath),
    recipientIds :: TVar (Set RecipientId),
-    createdAt :: RoundedFileTime,
-    fileStatus :: TVar ServerEntityStatus
+    createdAt :: RoundedSystemTime
  }

-type RoundedFileTime = RoundedSystemTime 3600
-
 fileTimePrecision :: Int64
 fileTimePrecision = 3600 -- truncate creation time to 1 hour

@@ -75,19 +67,18 @@ newFileStore = do
  usedStorage <- newTVarIO 0
  pure FileStore {files, recipients, usedStorage}

-addFile :: FileStore -> SenderId -> FileInfo -> RoundedFileTime -> ServerEntityStatus -> STM (Either XFTPErrorType ())
-addFile FileStore {files} sId fileInfo createdAt status =
+addFile :: FileStore -> SenderId -> FileInfo -> RoundedSystemTime -> STM (Either XFTPErrorType ())
+addFile FileStore {files} sId fileInfo createdAt =
  ifM (TM.member sId files) (pure $ Left DUPLICATE_) $ do
-    f <- newFileRec sId fileInfo createdAt status
+    f <- newFileRec sId fileInfo createdAt
    TM.insert sId f files
    pure $ Right ()

-newFileRec :: SenderId -> FileInfo -> RoundedFileTime -> ServerEntityStatus -> STM FileRec
-newFileRec senderId fileInfo createdAt status = do
+newFileRec :: SenderId -> FileInfo -> RoundedSystemTime -> STM FileRec
+newFileRec senderId fileInfo createdAt = do
  recipientIds <- newTVar S.empty
  filePath <- newTVar Nothing
-  fileStatus <- newTVar status
-  pure FileRec {senderId, fileInfo, filePath, recipientIds, createdAt, fileStatus}
+  pure FileRec {senderId, fileInfo, filePath, recipientIds, createdAt}

 setFilePath :: FileStore -> SenderId -> FilePath -> STM (Either XFTPErrorType ())
 setFilePath st sId fPath =
@@ -118,14 +109,6 @@ deleteFile FileStore {files, recipients, usedStorage} senderId = do
      pure $ Right ()
    _ -> pure $ Left AUTH

-- this function must be called after the file is deleted from the file system
-blockFile :: FileStore -> SenderId -> BlockingInfo -> Bool -> STM (Either XFTPErrorType ())
-blockFile st@FileStore {usedStorage} senderId info deleted =
-  withFile st senderId $ \FileRec {fileInfo, fileStatus} -> do
-    when deleted $ modifyTVar' usedStorage $ subtract (fromIntegral $ size fileInfo)
-    writeTVar fileStatus $! EntityBlocked info
-    pure $ Right ()
-
 deleteRecipient :: FileStore -> RecipientId -> FileRec -> STM ()
 deleteRecipient FileStore {recipients} rId FileRec {recipientIds} = do
  TM.delete rId recipients
@@ -14,18 +14,16 @@ module Simplex.FileTransfer.Server.StoreLog
    logPutFile,
    logAddRecipients,
    logDeleteFile,
-    logBlockFile,
    logAckFile,
  )
 where

-import Control.Applicative ((<|>))
 import Control.Concurrent.STM
 import Control.Monad.Except
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
-import Data.Composition ((.:), (.::))
+import Data.Composition ((.:), (.:.))
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
 import Data.Map.Strict (Map)
@@ -33,44 +31,41 @@ import qualified Data.Map.Strict as M
 import Simplex.FileTransfer.Protocol (FileInfo (..))
 import Simplex.FileTransfer.Server.Store
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BlockingInfo, RcvPublicAuthKey, RecipientId, SenderId)
-import Simplex.Messaging.Server.QueueStore (ServerEntityStatus (..))
+import Simplex.Messaging.Protocol (RcvPublicAuthKey, RecipientId, SenderId)
+import Simplex.Messaging.Server.QueueStore (RoundedSystemTime)
 import Simplex.Messaging.Server.StoreLog
 import Simplex.Messaging.Util (bshow)
 import System.IO

 data FileStoreLogRecord
-  = AddFile SenderId FileInfo RoundedFileTime ServerEntityStatus
+  = AddFile SenderId FileInfo RoundedSystemTime
  | PutFile SenderId FilePath
  | AddRecipients SenderId (NonEmpty FileRecipient)
  | DeleteFile SenderId
-  | BlockFile SenderId BlockingInfo
-  | AckFile RecipientId -- TODO add senderId as well?
+  | AckFile RecipientId
  deriving (Show)

 instance StrEncoding FileStoreLogRecord where
  strEncode = \case
-    AddFile sId file createdAt status -> strEncode (Str "FNEW", sId, file, createdAt, status)
+    AddFile sId file createdAt -> strEncode (Str "FNEW", sId, file, createdAt)
    PutFile sId path -> strEncode (Str "FPUT", sId, path)
    AddRecipients sId rcps -> strEncode (Str "FADD", sId, rcps)
    DeleteFile sId -> strEncode (Str "FDEL", sId)
-    BlockFile sId info -> strEncode (Str "FBLK", sId, info)
    AckFile rId -> strEncode (Str "FACK", rId)
  strP =
    A.choice
-      [ "FNEW " *> (AddFile <$> strP_ <*> strP_ <*> strP <*> (_strP <|> pure EntityActive)),
+      [ "FNEW " *> (AddFile <$> strP_ <*> strP_ <*> strP),
        "FPUT " *> (PutFile <$> strP_ <*> strP),
        "FADD " *> (AddRecipients <$> strP_ <*> strP),
        "FDEL " *> (DeleteFile <$> strP),
-        "FBLK " *> (BlockFile <$> strP_ <*> strP),
        "FACK " *> (AckFile <$> strP)
      ]

 logFileStoreRecord :: StoreLog 'WriteMode -> FileStoreLogRecord -> IO ()
 logFileStoreRecord = writeStoreLogRecord

-logAddFile :: StoreLog 'WriteMode -> SenderId -> FileInfo -> RoundedFileTime -> ServerEntityStatus -> IO ()
-logAddFile s = logFileStoreRecord s .:: AddFile
+logAddFile :: StoreLog 'WriteMode -> SenderId -> FileInfo -> RoundedSystemTime -> IO ()
+logAddFile s = logFileStoreRecord s .:. AddFile

 logPutFile :: StoreLog 'WriteMode -> SenderId -> FilePath -> IO ()
 logPutFile s = logFileStoreRecord s .: PutFile
@@ -81,9 +76,6 @@ logAddRecipients s = logFileStoreRecord s .: AddRecipients
 logDeleteFile :: StoreLog 'WriteMode -> SenderId -> IO ()
 logDeleteFile s = logFileStoreRecord s . DeleteFile

-logBlockFile :: StoreLog 'WriteMode -> SenderId -> BlockingInfo -> IO ()
-logBlockFile s fId = logFileStoreRecord s . BlockFile fId
-
 logAckFile :: StoreLog 'WriteMode -> RecipientId -> IO ()
 logAckFile s = logFileStoreRecord s . AckFile

@@ -100,11 +92,10 @@ readFileStore f st = mapM_ (addFileLogRecord . LB.toStrict) . LB.lines =<< LB.re
          Left e -> B.putStrLn $ "Log processing error (" <> bshow e <> "): " <> B.take 100 s
          _ -> pure ()
    addToStore = \case
-      AddFile sId file createdAt status -> addFile st sId file createdAt status
+      AddFile sId file createdAt -> addFile st sId file createdAt
      PutFile qId path -> setFilePath st qId path
      AddRecipients sId rcps -> runExceptT $ addRecipients sId rcps
      DeleteFile sId -> deleteFile st sId
-      BlockFile sId info -> blockFile st sId info True
      AckFile rId -> ackFile st rId
    addRecipients sId rcps = mapM_ (ExceptT . addRecipient st sId) rcps

@@ -114,9 +105,8 @@ writeFileStore s FileStore {files, recipients} = do
  readTVarIO files >>= mapM_ (logFile allRcps)
  where
    logFile :: Map RecipientId (SenderId, RcvPublicAuthKey) -> FileRec -> IO ()
-    logFile allRcps FileRec {senderId, fileInfo, filePath, recipientIds, createdAt, fileStatus} = do
-      status <- readTVarIO fileStatus
-      logAddFile s senderId fileInfo createdAt status
+    logFile allRcps FileRec {senderId, fileInfo, filePath, recipientIds, createdAt} = do
+      logAddFile s senderId fileInfo createdAt
      (rcpErrs, rcps) <- M.mapEither getRcp . M.fromSet id <$> readTVarIO recipientIds
      mapM_ (logAddRecipients s senderId) $ L.nonEmpty $ M.elems rcps
      mapM_ (B.putStrLn . ("Error storing log: " <>)) rcpErrs
@@ -11,10 +11,8 @@
 module Simplex.FileTransfer.Transport
  ( supportedFileServerVRange,
    authCmdsXFTPVersion,
-    blockedFilesXFTPVersion,
    xftpClientHandshakeStub,
-    alpnSupportedXFTPhandshakes,
-    xftpALPNv1,
+    supportedXFTPhandshakes,
    XFTPClientHandshake (..),
    -- xftpClientHandshake,
    XFTPServerHandshake (..),
@@ -35,6 +33,7 @@ module Simplex.FileTransfer.Transport
  )
 where

+import Control.Applicative ((<|>))
 import qualified Control.Exception as E
 import Control.Logger.Simple
 import Control.Monad
@@ -43,7 +42,7 @@ import Control.Monad.IO.Class
 import Control.Monad.Trans.Except
 import qualified Data.Aeson.TH as J
 import qualified Data.Attoparsec.ByteString.Char8 as A
-import Data.Bifunctor (first)
+import Data.Bifunctor (bimap, first)
 import qualified Data.ByteArray as BA
 import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
@@ -51,14 +50,15 @@ import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Functor (($>))
 import Data.Word (Word16, Word32)
+import qualified Data.X509 as X
 import Network.HTTP2.Client (HTTP2Error)
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers
-import Simplex.Messaging.Protocol (BlockingInfo, CommandError)
-import Simplex.Messaging.Transport (ALPN, CertChainPubKey, ServiceCredentials, SessionId, THandle (..), THandleParams (..), TransportError (..), TransportPeer (..))
+import Simplex.Messaging.Protocol (CommandError)
+import Simplex.Messaging.Transport (ALPN, SessionId, THandle (..), THandleParams (..), TransportError (..), TransportPeer (..))
 import Simplex.Messaging.Transport.HTTP2.File
 import Simplex.Messaging.Util (bshow, tshow)
 import Simplex.Messaging.Version
@@ -92,30 +92,24 @@ initialXFTPVersion = VersionXFTP 1
 authCmdsXFTPVersion :: VersionXFTP
 authCmdsXFTPVersion = VersionXFTP 2

-blockedFilesXFTPVersion :: VersionXFTP
-blockedFilesXFTPVersion = VersionXFTP 3
-
 currentXFTPVersion :: VersionXFTP
-currentXFTPVersion = VersionXFTP 3
+currentXFTPVersion = VersionXFTP 2

 supportedFileServerVRange :: VersionRangeXFTP
 supportedFileServerVRange = mkVersionRange initialXFTPVersion currentXFTPVersion

 -- XFTP protocol does not use this handshake method
-xftpClientHandshakeStub :: c 'TClient -> Maybe C.KeyPairX25519 -> C.KeyHash -> VersionRangeXFTP -> Bool -> Maybe (ServiceCredentials, C.KeyPairEd25519) -> ExceptT TransportError IO (THandle XFTPVersion c 'TClient)
-xftpClientHandshakeStub _c _ks _keyHash _xftpVRange _proxyServer _serviceKeys = throwE TEVersion
+xftpClientHandshakeStub :: c -> Maybe C.KeyPairX25519 -> C.KeyHash -> VersionRangeXFTP -> ExceptT TransportError IO (THandle XFTPVersion c 'TClient)
+xftpClientHandshakeStub _c _ks _keyHash _xftpVRange = throwE TEVersion

-alpnSupportedXFTPhandshakes :: [ALPN]
-alpnSupportedXFTPhandshakes = [xftpALPNv1]
-
-xftpALPNv1 :: ALPN
-xftpALPNv1 = "xftp/1"
+supportedXFTPhandshakes :: [ALPN]
+supportedXFTPhandshakes = ["xftp/1"]

 data XFTPServerHandshake = XFTPServerHandshake
  { xftpVersionRange :: VersionRangeXFTP,
    sessionId :: SessionId,
    -- | pub key to agree shared secrets for command authorization and entity ID encryption.
-    authPubKey :: CertChainPubKey
+    authPubKey :: (X.CertificateChain, X.SignedExact X.PubKey)
  }

 data XFTPClientHandshake = XFTPClientHandshake
@@ -135,12 +129,15 @@ instance Encoding XFTPClientHandshake where

 instance Encoding XFTPServerHandshake where
  smpEncode XFTPServerHandshake {xftpVersionRange, sessionId, authPubKey} =
-    smpEncode (xftpVersionRange, sessionId, authPubKey)
+    smpEncode (xftpVersionRange, sessionId, auth)
+    where
+      auth = bimap C.encodeCertChain C.SignedObject authPubKey
  smpP = do
    (xftpVersionRange, sessionId) <- smpP
-    authPubKey <- smpP
+    cert <- C.certChainP
+    C.SignedObject key <- smpP
    Tail _compat <- smpP
-    pure XFTPServerHandshake {xftpVersionRange, sessionId, authPubKey}
+    pure XFTPServerHandshake {xftpVersionRange, sessionId, authPubKey = (cert, key)}

 sendEncFile :: Handle -> (Builder -> IO ()) -> LC.SbState -> Word32 -> IO ()
 sendEncFile h send = go
@@ -214,8 +211,6 @@ data XFTPErrorType
    CMD {cmdErr :: CommandError}
  | -- | command authorization error - bad signature or non-existing SMP queue
    AUTH
-  | -- | command with the entity that was blocked
-    BLOCKED {blockInfo :: BlockingInfo}
  | -- | incorrent file size
    SIZE
  | -- | storage quota exceeded
@@ -236,46 +231,15 @@ data XFTPErrorType
    INTERNAL
  | -- | used internally, never returned by the server (to be removed)
    DUPLICATE_ -- not part of SMP protocol, used internally
-  deriving (Eq, Show)
+  deriving (Eq, Read, Show)

 instance StrEncoding XFTPErrorType where
  strEncode = \case
-    BLOCK -> "BLOCK"
-    SESSION -> "SESSION"
-    HANDSHAKE -> "HANDSHAKE"
    CMD e -> "CMD " <> bshow e
-    AUTH -> "AUTH"
-    BLOCKED info -> "BLOCKED " <> strEncode info
-    SIZE -> "SIZE"
-    QUOTA -> "QUOTA"
-    DIGEST -> "DIGEST"
-    CRYPTO -> "CRYPTO"
-    NO_FILE -> "NO_FILE"
-    HAS_FILE -> "HAS_FILE"
-    FILE_IO -> "FILE_IO"
-    TIMEOUT -> "TIMEOUT"
-    INTERNAL -> "INTERNAL"
-    DUPLICATE_ -> "DUPLICATE_"
-
+    e -> bshow e
  strP =
-    A.takeTill (== ' ') >>= \case
-      "BLOCK" -> pure BLOCK
-      "SESSION" -> pure SESSION
-      "HANDSHAKE" -> pure HANDSHAKE
-      "CMD" -> CMD <$> parseRead1
-      "AUTH" -> pure AUTH
-      "BLOCKED" -> BLOCKED <$> _strP
-      "SIZE" -> pure SIZE
-      "QUOTA" -> pure QUOTA
-      "DIGEST" -> pure DIGEST
-      "CRYPTO" -> pure CRYPTO
-      "NO_FILE" -> pure NO_FILE
-      "HAS_FILE" -> pure HAS_FILE
-      "FILE_IO" -> pure FILE_IO
-      "TIMEOUT" -> pure TIMEOUT
-      "INTERNAL" -> pure INTERNAL
-      "DUPLICATE_" -> pure DUPLICATE_
-      _ -> fail "bad error type"
+    "CMD " *> (CMD <$> parseRead1)
+      <|> parseRead1

 instance Encoding XFTPErrorType where
  smpEncode = \case
@@ -284,7 +248,6 @@ instance Encoding XFTPErrorType where
    HANDSHAKE -> "HANDSHAKE"
    CMD err -> "CMD " <> smpEncode err
    AUTH -> "AUTH"
-    BLOCKED info -> "BLOCKED " <> smpEncode info
    SIZE -> "SIZE"
    QUOTA -> "QUOTA"
    DIGEST -> "DIGEST"
@@ -303,7 +266,6 @@ instance Encoding XFTPErrorType where
      "HANDSHAKE" -> pure HANDSHAKE
      "CMD" -> CMD <$> _smpP
      "AUTH" -> pure AUTH
-      "BLOCKED" -> BLOCKED <$> _smpP
      "SIZE" -> pure SIZE
      "QUOTA" -> pure QUOTA
      "DIGEST" -> pure DIGEST
@@ -13,9 +13,10 @@ import Data.Int (Int64)
 import qualified Data.Text as T
 import Data.Text.Encoding (encodeUtf8)
 import Data.Word (Word32)
+import Database.SQLite.Simple.FromField (FromField (..))
+import Database.SQLite.Simple.ToField (ToField (..))
 import Simplex.FileTransfer.Client (XFTPChunkSpec (..))
 import Simplex.FileTransfer.Description
-import Simplex.Messaging.Agent.Store.DB (FromField (..), ToField (..), fromTextField_)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Crypto.File (CryptoFile (..))
 import Simplex.Messaging.Encoding
@@ -27,6 +27,11 @@ module Simplex.Messaging.Agent.Env.SQLite
    serverHosts,
    defaultAgentConfig,
    defaultReconnectInterval,
+    tryAgentError,
+    tryAgentError',
+    catchAgentError,
+    catchAgentError',
+    agentFinally,
    Env (..),
    newSMPAgentEnv,
    createAgentStore,
@@ -40,12 +45,14 @@ module Simplex.Messaging.Agent.Env.SQLite
 where

 import Control.Concurrent (ThreadId)
+import Control.Exception (BlockedIndefinitelyOnSTM (..), SomeException, fromException)
 import Control.Monad.Except
 import Control.Monad.IO.Unlift
 import Control.Monad.Reader
 import Crypto.Random
 import Data.Aeson (FromJSON (..), ToJSON (..))
 import qualified Data.Aeson.TH as JQ
+import Data.ByteArray (ScrubbedBytes)
 import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.List.NonEmpty as L
@@ -61,10 +68,8 @@ import Numeric.Natural
 import Simplex.FileTransfer.Client (XFTPClientConfig (..), defaultXFTPClientConfig)
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval
-import Simplex.Messaging.Agent.Store (createStore)
-import Simplex.Messaging.Agent.Store.Common (DBStore)
-import Simplex.Messaging.Agent.Store.Interface (DBOpts)
-import Simplex.Messaging.Agent.Store.Shared (MigrationConfig (..), MigrationError (..))
+import Simplex.Messaging.Agent.Store.SQLite
+import qualified Simplex.Messaging.Agent.Store.SQLite.Migrations as Migrations
 import Simplex.Messaging.Client
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Crypto.Ratchet (VersionRangeE2E, supportedE2EEncryptVRange)
@@ -77,6 +82,7 @@ import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport (SMPVersion)
 import Simplex.Messaging.Transport.Client (TransportHost)
+import Simplex.Messaging.Util (allFinally, catchAllErrors, catchAllErrors', tryAllErrors, tryAllErrors')
 import System.Mem.Weak (Weak)
 import System.Random (StdGen, newStdGen)
 import UnliftIO.STM
@@ -89,9 +95,7 @@ data InitialAgentServers = InitialAgentServers
  { smp :: Map UserId (NonEmpty (ServerCfg 'PSMP)),
    ntf :: [NtfServer],
    xftp :: Map UserId (NonEmpty (ServerCfg 'PXFTP)),
-    netCfg :: NetworkConfig,
-    presetDomains :: [HostName],
-    presetServers :: [SMPServer]
+    netCfg :: NetworkConfig
  }

 data ServerCfg p = ServerCfg
@@ -167,7 +171,6 @@ data AgentConfig = AgentConfig
    ntfBatchSize :: Int,
    ntfSubFirstCheckInterval :: NominalDiffTime,
    ntfSubCheckInterval :: NominalDiffTime,
-    maxPendingSubscriptions :: Int,
    caCertificateFile :: FilePath,
    privateKeyFile :: FilePath,
    certificateFile :: FilePath,
@@ -239,7 +242,6 @@ defaultAgentConfig =
      ntfBatchSize = 150,
      ntfSubFirstCheckInterval = nominalDay,
      ntfSubCheckInterval = 3 * nominalDay,
-      maxPendingSubscriptions = 35000,
      -- CA certificate private key is not needed for initialization
      -- ! we do not generate these
      caCertificateFile = "/etc/opt/simplex-agent/ca.crt",
@@ -252,7 +254,7 @@ defaultAgentConfig =

 data Env = Env
  { config :: AgentConfig,
-    store :: DBStore,
+    store :: SQLiteStore,
    random :: TVar ChaChaDRG,
    randomServer :: TVar StdGen,
    ntfSupervisor :: NtfSupervisor,
@@ -260,7 +262,7 @@ data Env = Env
    multicastSubscribers :: TMVar Int
  }

-newSMPAgentEnv :: AgentConfig -> DBStore -> IO Env
+newSMPAgentEnv :: AgentConfig -> SQLiteStore -> IO Env
 newSMPAgentEnv config store = do
  random <- C.newRandom
  randomServer <- newTVarIO =<< liftIO newStdGen
@@ -269,8 +271,8 @@ newSMPAgentEnv config store = do
  multicastSubscribers <- newTMVarIO 0
  pure Env {config, store, random, randomServer, ntfSupervisor, xftpAgent, multicastSubscribers}

-createAgentStore :: DBOpts -> MigrationConfig -> IO (Either MigrationError DBStore)
-createAgentStore = createStore
+createAgentStore :: FilePath -> ScrubbedBytes -> Bool -> MigrationConfirmation -> IO (Either MigrationError SQLiteStore)
+createAgentStore dbFilePath dbKey keepKey = createSQLiteStore dbFilePath dbKey keepKey Migrations.app

 data NtfSupervisor = NtfSupervisor
  { ntfTkn :: TVar (Maybe NtfToken),
@@ -308,6 +310,33 @@ newXFTPAgent = do
  xftpDelWorkers <- TM.emptyIO
  pure XFTPAgent {xftpWorkDir, xftpRcvWorkers, xftpSndWorkers, xftpDelWorkers}

+tryAgentError :: AM a -> AM (Either AgentErrorType a)
+tryAgentError = tryAllErrors mkInternal
+{-# INLINE tryAgentError #-}
+
+-- unlike runExceptT, this ensures we catch IO exceptions as well
+tryAgentError' :: AM a -> AM' (Either AgentErrorType a)
+tryAgentError' = tryAllErrors' mkInternal
+{-# INLINE tryAgentError' #-}
+
+catchAgentError :: AM a -> (AgentErrorType -> AM a) -> AM a
+catchAgentError = catchAllErrors mkInternal
+{-# INLINE catchAgentError #-}
+
+catchAgentError' :: AM a -> (AgentErrorType -> AM' a) -> AM' a
+catchAgentError' = catchAllErrors' mkInternal
+{-# INLINE catchAgentError' #-}
+
+agentFinally :: AM a -> AM b -> AM a
+agentFinally = allFinally mkInternal
+{-# INLINE agentFinally #-}
+
+mkInternal :: SomeException -> AgentErrorType
+mkInternal e = case fromException e of
+  Just BlockedIndefinitelyOnSTM -> CRITICAL True "Thread blocked indefinitely in STM transaction"
+  _ -> INTERNAL $ show e
+{-# INLINE mkInternal #-}
+
 data Worker = Worker
  { workerId :: Int,
    doWork :: TMVar (),
@@ -6,7 +6,6 @@ module Simplex.Messaging.Agent.Lock
    withLock',
    withGetLock,
    withGetLocks,
-    getPutLock,
  )
 where

@@ -16,12 +15,11 @@ import Control.Monad.IO.Unlift
 import Data.Functor (($>))
 import Data.Set (Set)
 import qualified Data.Set as S
-import Data.Text (Text)
 import UnliftIO.Async (forConcurrently)
 import qualified UnliftIO.Exception as E
 import UnliftIO.STM

-type Lock = TMVar Text
+type Lock = TMVar String

 createLock :: STM Lock
 createLock = newEmptyTMVar
@@ -31,24 +29,24 @@ createLockIO :: IO Lock
 createLockIO = newEmptyTMVarIO
 {-# INLINE createLockIO #-}

-withLock :: MonadUnliftIO m => Lock -> Text -> ExceptT e m a -> ExceptT e m a
+withLock :: MonadUnliftIO m => Lock -> String -> ExceptT e m a -> ExceptT e m a
 withLock lock name = ExceptT . withLock' lock name . runExceptT
 {-# INLINE withLock #-}

-withLock' :: MonadUnliftIO m => Lock -> Text -> m a -> m a
+withLock' :: MonadUnliftIO m => Lock -> String -> m a -> m a
 withLock' lock name =
  E.bracket_
    (atomically $ putTMVar lock name)
    (void . atomically $ takeTMVar lock)

-withGetLock :: MonadUnliftIO m => (k -> STM Lock) -> k -> Text -> m a -> m a
+withGetLock :: MonadUnliftIO m => (k -> STM Lock) -> k -> String -> m a -> m a
 withGetLock getLock key name a =
  E.bracket
    (atomically $ getPutLock getLock key name)
    (atomically . takeTMVar)
    (const a)

-withGetLocks :: MonadUnliftIO m => (k -> STM Lock) -> Set k -> Text -> m a -> m a
+withGetLocks :: MonadUnliftIO m => (k -> STM Lock) -> Set k -> String -> m a -> m a
 withGetLocks getLock keys name = E.bracket holdLocks releaseLocks . const
  where
    holdLocks = forConcurrently (S.toList keys) $ \key -> atomically $ getPutLock getLock key name
@@ -56,5 +54,5 @@ withGetLocks getLock keys name = E.bracket holdLocks releaseLocks . const

 -- getLock and putTMVar can be in one transaction on the assumption that getLock doesn't write in case the lock already exists,
 -- and in case it is created and added to some shared resource (we use TMap) it also helps avoid contention for the newly created lock.
-getPutLock :: (k -> STM Lock) -> k -> Text -> STM Lock
+getPutLock :: (k -> STM Lock) -> k -> String -> STM Lock
 getPutLock getLock key name = getLock key >>= \l -> putTMVar l name $> l
@@ -14,7 +14,6 @@ module Simplex.Messaging.Agent.NtfSubSupervisor
    nsUpdateToken,
    nsRemoveNtfToken,
    sendNtfSubCommand,
-    hasInstantNotifications,
    instantNotifications,
    deleteToken,
    closeNtfSupervisor,
@@ -44,15 +43,14 @@ import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Agent.Stats
 import Simplex.Messaging.Agent.Store
-import Simplex.Messaging.Agent.Store.AgentStore
-import qualified Simplex.Messaging.Agent.Store.DB as DB
-import Simplex.Messaging.Client (NetworkRequestMode (..))
+import Simplex.Messaging.Agent.Store.SQLite
+import qualified Simplex.Messaging.Agent.Store.SQLite.DB as DB
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Notifications.Protocol
 import Simplex.Messaging.Notifications.Types
 import Simplex.Messaging.Protocol (NtfServer, sameSrvAddr)
 import qualified Simplex.Messaging.Protocol as SMP
-import Simplex.Messaging.Util (catchAllErrors, diffToMicroseconds, threadDelay', tryAllErrors, tshow, whenM)
+import Simplex.Messaging.Util (diffToMicroseconds, threadDelay', tshow)
 import System.Random (randomR)
 import UnliftIO
 import UnliftIO.Concurrent (forkIO)
@@ -217,7 +215,7 @@ runNtfWorker c srv Worker {doWork} =
    runNtfOperation :: AM ()
    runNtfOperation = do
      ntfBatchSize <- asks $ ntfBatchSize . config
-      withWorkItems c doWork (withStore' c $ \db -> getNextNtfSubNTFActions db srv ntfBatchSize) $ \nextSubs -> do
+      withWorkItems c doWork (\db -> getNextNtfSubNTFActions db srv ntfBatchSize) $ \nextSubs -> do
        logInfo $ "runNtfWorker - length nextSubs = " <> tshow (length nextSubs)
        currTs <- liftIO getCurrentTime
        let (creates, checks, deletes, rotates) = splitActions currTs nextSubs
@@ -357,7 +355,7 @@ runNtfWorker c srv Worker {doWork} =
    runCatching :: (NtfSubscription -> AM (Maybe NtfSubscription)) -> NtfSubscription -> AM' (Maybe NtfSubscription)
    runCatching action sub@NtfSubscription {connId} =
      fromRight Nothing
-        <$> runExceptT (action sub `catchAllErrors` \e -> workerInternalError c connId (show e) $> Nothing)
+        <$> runExceptT (action sub `catchAgentError` \e -> workerInternalError c connId (show e) $> Nothing)
    -- deleteNtfSub is only used in NSADelete and NSARotate, so also deprecated
    deleteNtfSub :: NtfSubscription -> AM () -> AM (Maybe NtfSubscription)
    deleteNtfSub sub@NtfSubscription {userId, ntfSubId} continue = case ntfSubId of
@@ -365,7 +363,7 @@ runNtfWorker c srv Worker {doWork} =
        lift getNtfToken >>= \case
          Just tkn@NtfToken {ntfServer} -> do
            atomically $ incNtfServerStat c userId ntfServer ntfDelAttempts
-            tryAllErrors (agentNtfDeleteSubscription c nSubId tkn) >>= \case
+            tryAgentError (agentNtfDeleteSubscription c nSubId tkn) >>= \case
              Right _ -> do
                atomically $ incNtfServerStat c userId ntfServer ntfDeleted
                continue'
@@ -385,7 +383,7 @@ runNtfSMPWorker c srv Worker {doWork} = forever $ do
    runNtfSMPOperation :: AM ()
    runNtfSMPOperation = do
      ntfBatchSize <- asks $ ntfBatchSize . config
-      withWorkItems c doWork (withStore' c $ \db -> getNextNtfSubSMPActions db srv ntfBatchSize) $ \nextSubs -> do
+      withWorkItems c doWork (\db -> getNextNtfSubSMPActions db srv ntfBatchSize) $ \nextSubs -> do
        logInfo $ "runNtfSMPWorker - length nextSubs = " <> tshow (length nextSubs)
        let (creates, deletes) = splitActions nextSubs
        retrySubActions c creates createNotifierKeys
@@ -513,7 +511,7 @@ notifyInternalError' AgentClient {subQ} internalErrStr = atomically $ writeTBQue
 {-# INLINE notifyInternalError' #-}

 notifyErrs :: MonadIO m => AgentClient -> [(ConnId, AgentErrorType)] -> m ()
-notifyErrs c = mapM_ (notifySub c . ERRS) . L.nonEmpty
+notifyErrs AgentClient {subQ} connErrs = unless (null connErrs) $ atomically $ writeTBQueue subQ ("", "", AEvt SAENone $ ERRS connErrs)
 {-# INLINE notifyErrs #-}

 getNtfToken :: AM' (Maybe NtfToken)
@@ -527,19 +525,15 @@ nsUpdateToken ns tkn = writeTVar (ntfTkn ns) $ Just tkn
 nsRemoveNtfToken :: NtfSupervisor -> STM ()
 nsRemoveNtfToken ns = writeTVar (ntfTkn ns) Nothing

-sendNtfSubCommand :: NtfSupervisor -> (NtfSupervisorCommand, NonEmpty ConnId) -> IO ()
-sendNtfSubCommand ns cmd =
-  whenM (hasInstantNotifications ns) $ atomically $ writeTBQueue (ntfSubQ ns) cmd
+sendNtfSubCommand :: NtfSupervisor -> (NtfSupervisorCommand, NonEmpty ConnId) -> STM ()
+sendNtfSubCommand ns cmd = do
+  tkn <- readTVar (ntfTkn ns)
+  when (instantNotifications tkn) $ writeTBQueue (ntfSubQ ns) cmd

-hasInstantNotifications :: NtfSupervisor -> IO Bool
-hasInstantNotifications ns = do
-  tkn <- readTVarIO $ ntfTkn ns
-  pure $ maybe False instantNotifications tkn
-
-instantNotifications :: NtfToken -> Bool
-instantNotifications NtfToken {ntfTknStatus = NTActive, ntfMode = NMInstant} = True
-instantNotifications _ = False
-{-# INLINE instantNotifications #-}
+instantNotifications :: Maybe NtfToken -> Bool
+instantNotifications = \case
+  Just NtfToken {ntfTknStatus = NTActive, ntfMode = NMInstant} -> True
+  _ -> False

 deleteToken :: AgentClient -> NtfToken -> AM ()
 deleteToken c tkn@NtfToken {ntfServer, ntfTokenId, ntfPrivKey} = do
@@ -567,7 +561,7 @@ runNtfTknDelWorker c srv Worker {doWork} =
          withRetryInterval ri $ \_ loop -> do
            liftIO $ waitWhileSuspended c
            liftIO $ waitForUserNetwork c
-            processTknToDelete nextTknToDelete `catchAllErrors` retryTmpError loop nextTknToDelete
+            processTknToDelete nextTknToDelete `catchAgentError` retryTmpError loop nextTknToDelete
    retryTmpError :: AM () -> NtfTokenToDelete -> AgentErrorType -> AM ()
    retryTmpError loop (tknDbId, _, _) e = do
      logError $ "ntf tkn del error: " <> tshow e
@@ -578,7 +572,7 @@ runNtfTknDelWorker c srv Worker {doWork} =
          notifyInternalError' c (show e)
    processTknToDelete :: NtfTokenToDelete -> AM ()
    processTknToDelete (tknDbId, ntfPrivKey, tknId) = do
-      agentNtfDeleteToken c NRMBackground srv ntfPrivKey tknId
+      agentNtfDeleteToken c srv ntfPrivKey tknId
      withStore' c $ \db -> deleteNtfTokenToDelete db tknDbId

 closeNtfSupervisor :: NtfSupervisor -> IO ()
@@ -10,10 +10,11 @@ import qualified Data.Aeson.TH as J
 import Data.Int (Int64)
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
+import Database.SQLite.Simple.FromField (FromField (..))
+import Database.SQLite.Simple.ToField (ToField (..))
 import Simplex.Messaging.Agent.Protocol (UserId)
-import Simplex.Messaging.Agent.Store.DB (FromField (..), ToField (..), fromTextField_)
-import Simplex.Messaging.Parsers (defaultJSON)
-import Simplex.Messaging.Protocol (NtfServer, SMPServer, XFTPServer)
+import Simplex.Messaging.Parsers (defaultJSON, fromTextField_)
+import Simplex.Messaging.Protocol (SMPServer, XFTPServer, NtfServer)
 import Simplex.Messaging.Util (decodeJSON, encodeJSON)
 import UnliftIO.STM

@@ -29,13 +29,8 @@ import Data.Time (UTCTime)
 import Data.Type.Equality
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval (RI2State)
-import Simplex.Messaging.Agent.Store.Entity
-import Simplex.Messaging.Agent.Store.Common
-import Simplex.Messaging.Agent.Store.Interface (createDBStore)
-import Simplex.Messaging.Agent.Store.Migrations.App (appMigrations)
-import Simplex.Messaging.Agent.Store.Shared (MigrationConfig (..), MigrationError (..))
 import qualified Simplex.Messaging.Crypto as C
-import Simplex.Messaging.Crypto.Ratchet (MsgEncryptKeyX448, PQEncryption, PQSupport, RatchetX448)
+import Simplex.Messaging.Crypto.Ratchet (PQEncryption, PQSupport, RatchetX448)
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol
  ( MsgBody,
@@ -44,27 +39,36 @@ import Simplex.Messaging.Protocol
    NotifierId,
    NtfPrivateAuthKey,
    NtfPublicAuthKey,
-    QueueMode,
    RcvDhSecret,
    RcvNtfDhSecret,
    RcvPrivateAuthKey,
    SndPrivateAuthKey,
+    SndPublicAuthKey,
+    SenderCanSecure,
    VersionSMPC,
  )
 import qualified Simplex.Messaging.Protocol as SMP
-import Simplex.Messaging.Util (AnyError (..), bshow)
-
-createStore :: DBOpts -> MigrationConfig -> IO (Either MigrationError DBStore)
-createStore dbOpts = createDBStore dbOpts appMigrations

 -- * Queue types

-type RcvQueue = StoredRcvQueue 'DBStored
+data QueueStored = QSStored | QSNew

-type NewRcvQueue = StoredRcvQueue 'DBNew
+data SQueueStored (q :: QueueStored) where
+  SQSStored :: SQueueStored 'QSStored
+  SQSNew :: SQueueStored 'QSNew
+
+data DBQueueId (q :: QueueStored) where
+  DBQueueId :: Int64 -> DBQueueId 'QSStored
+  DBNewQueue :: DBQueueId 'QSNew
+
+deriving instance Show (DBQueueId q)
+
+type RcvQueue = StoredRcvQueue 'QSStored
+
+type NewRcvQueue = StoredRcvQueue 'QSNew

 -- | A receive queue. SMP queue through which the agent receives messages from a sender.
-data StoredRcvQueue (q :: DBStored) = RcvQueue
+data StoredRcvQueue (q :: QueueStored) = RcvQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
@@ -81,19 +85,11 @@ data StoredRcvQueue (q :: DBStored) = RcvQueue
    -- | sender queue ID
    sndId :: SMP.SenderId,
    -- | sender can secure the queue
-    queueMode :: Maybe QueueMode,
-    -- | short link ID and credentials
-    shortLink :: Maybe ShortLinkCreds,
-    -- | associated client service
-    clientService :: Maybe (StoredClientService q),
+    sndSecure :: SenderCanSecure,
    -- | queue status
    status :: QueueStatus,
-    -- | to enable notifications for this queue - this field is duplicated from ConnData
-    enableNtfs :: Bool,
-    -- | client notice
-    clientNoticeId :: Maybe NoticeId,
    -- | database queue ID (within connection)
-    dbQueueId :: DBEntityId' q,
+    dbQueueId :: DBQueueId q,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | database queue ID to replace, Nothing if this queue is not replacing another, `Just Nothing` is used for replacing old queues
@@ -107,40 +103,9 @@ data StoredRcvQueue (q :: DBStored) = RcvQueue
  }
  deriving (Show)

-data RcvQueueSub = RcvQueueSub
-  { userId :: UserId,
-    connId :: ConnId,
-    server :: SMPServer,
-    rcvId :: SMP.RecipientId,
-    rcvPrivateKey :: RcvPrivateAuthKey,
-    status :: QueueStatus,
-    enableNtfs :: Bool,
-    clientNoticeId :: Maybe NoticeId,
-    dbQueueId :: Int64,
-    primary :: Bool,
-    dbReplaceQueueId :: Maybe Int64
-  }
-  deriving (Show)
-
-rcvQueueSub :: RcvQueue -> RcvQueueSub
-rcvQueueSub RcvQueue {userId, connId, server, rcvId, rcvPrivateKey, status, enableNtfs, clientNoticeId, dbQueueId = DBEntityId dbQueueId, primary, dbReplaceQueueId} =
-  RcvQueueSub {userId, connId, server, rcvId, rcvPrivateKey, status, enableNtfs, clientNoticeId, dbQueueId, primary, dbReplaceQueueId}
-
-data ShortLinkCreds = ShortLinkCreds
-  { shortLinkId :: SMP.LinkId,
-    shortLinkKey :: LinkKey,
-    linkPrivSigKey :: C.PrivateKeyEd25519,
-    linkEncFixedData :: SMP.EncFixedDataBytes
-  }
-  deriving (Show)
-
-clientServiceId :: RcvQueue -> Maybe ClientServiceId
-clientServiceId = fmap dbServiceId . clientService
-{-# INLINE clientServiceId #-}
-
-rcvSMPQueueAddress :: RcvQueue -> SMPQueueAddress
-rcvSMPQueueAddress RcvQueue {server, sndId, e2ePrivKey, queueMode} =
-  SMPQueueAddress server sndId (C.publicKey e2ePrivKey) queueMode
+rcvQueueInfo :: RcvQueue -> RcvQueueInfo
+rcvQueueInfo rq@RcvQueue {server, rcvSwchStatus} =
+  RcvQueueInfo {rcvServer = server, rcvSwitchStatus = rcvSwchStatus, canAbortSwitch = canAbortRcvSwitch rq}

 canAbortRcvSwitch :: RcvQueue -> Bool
 canAbortRcvSwitch = maybe False canAbort . rcvSwchStatus
@@ -165,32 +130,22 @@ data ClientNtfCreds = ClientNtfCreds
  }
  deriving (Show)

-- This record is stored in inv_short_links table.
-- It is needed only for 1-time invitation links because of "secure-on-read" property of link data,
-- that prevents undetected access to link data from link observers.
-data InvShortLink = InvShortLink
-  { server :: SMPServer,
-    linkId :: SMP.LinkId,
-    linkKey :: LinkKey,
-    sndPrivateKey :: SndPrivateAuthKey, -- stored to allow retries
-    sndId :: Maybe SMP.SenderId
-  }
-  deriving (Show)
+type SndQueue = StoredSndQueue 'QSStored

-type SndQueue = StoredSndQueue 'DBStored
-
-type NewSndQueue = StoredSndQueue 'DBNew
+type NewSndQueue = StoredSndQueue 'QSNew

 -- | A send queue. SMP queue through which the agent sends messages to a recipient.
-data StoredSndQueue (q :: DBStored) = SndQueue
+data StoredSndQueue (q :: QueueStored) = SndQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
    -- | sender queue ID
    sndId :: SMP.SenderId,
    -- | sender can secure the queue
-    queueMode :: Maybe QueueMode,
-    -- | sender key used to authorize transmissions
+    sndSecure :: SenderCanSecure,
+    -- | key pair used by the sender to authorize transmissions
+    -- TODO combine keys to key pair so that types match
+    sndPublicKey :: SndPublicAuthKey,
    sndPrivateKey :: SndPrivateAuthKey,
    -- | DH public key used to negotiate per-queue e2e encryption
    e2ePubKey :: Maybe C.PublicKeyX25519,
@@ -199,7 +154,7 @@ data StoredSndQueue (q :: DBStored) = SndQueue
    -- | queue status
    status :: QueueStatus,
    -- | database queue ID (within connection)
-    dbQueueId :: DBEntityId' q,
+    dbQueueId :: DBQueueId q,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | ID of the queue this one is replacing
@@ -210,6 +165,10 @@ data StoredSndQueue (q :: DBStored) = SndQueue
  }
  deriving (Show)

+sndQueueInfo :: SndQueue -> SndQueueInfo
+sndQueueInfo SndQueue {server, sndSwchStatus} =
+  SndQueueInfo {sndServer = server, sndSwitchStatus = sndSwchStatus}
+
 instance SMPQueue RcvQueue where
  qServer RcvQueue {server} = server
  {-# INLINE qServer #-}
@@ -222,12 +181,6 @@ instance SMPQueue NewRcvQueue where
  queueId RcvQueue {rcvId} = rcvId
  {-# INLINE queueId #-}

-instance SMPQueue RcvQueueSub where
-  qServer RcvQueueSub {server} = server
-  {-# INLINE qServer #-}
-  queueId RcvQueueSub {rcvId} = rcvId
-  {-# INLINE queueId #-}
-
 instance SMPQueue SndQueue where
  qServer SndQueue {server} = server
  {-# INLINE qServer #-}
@@ -267,7 +220,6 @@ class SMPQueue q => SMPQueueRec q where
  qUserId :: q -> UserId
  qConnId :: q -> ConnId
  dbQId :: q -> Int64
-  qPrimary :: q -> Bool
  dbReplaceQId :: q -> Maybe Int64

 instance SMPQueueRec RcvQueue where
@@ -275,48 +227,21 @@ instance SMPQueueRec RcvQueue where
  {-# INLINE qUserId #-}
  qConnId RcvQueue {connId} = connId
  {-# INLINE qConnId #-}
-  dbQId RcvQueue {dbQueueId = DBEntityId qId} = qId
+  dbQId RcvQueue {dbQueueId = DBQueueId qId} = qId
  {-# INLINE dbQId #-}
-  qPrimary RcvQueue {primary} = primary
-  {-# INLINE qPrimary #-}
  dbReplaceQId RcvQueue {dbReplaceQueueId} = dbReplaceQueueId
  {-# INLINE dbReplaceQId #-}

-instance SMPQueueRec RcvQueueSub where
-  qUserId RcvQueueSub {userId} = userId
-  {-# INLINE qUserId #-}
-  qConnId RcvQueueSub {connId} = connId
-  {-# INLINE qConnId #-}
-  dbQId RcvQueueSub {dbQueueId} = dbQueueId
-  {-# INLINE dbQId #-}
-  qPrimary RcvQueueSub {primary} = primary
-  {-# INLINE qPrimary #-}
-  dbReplaceQId RcvQueueSub {dbReplaceQueueId} = dbReplaceQueueId
-  {-# INLINE dbReplaceQId #-}
-
 instance SMPQueueRec SndQueue where
  qUserId SndQueue {userId} = userId
  {-# INLINE qUserId #-}
  qConnId SndQueue {connId} = connId
  {-# INLINE qConnId #-}
-  dbQId SndQueue {dbQueueId = DBEntityId qId} = qId
+  dbQId SndQueue {dbQueueId = DBQueueId qId} = qId
  {-# INLINE dbQId #-}
-  qPrimary SndQueue {primary} = primary
-  {-# INLINE qPrimary #-}
  dbReplaceQId SndQueue {dbReplaceQueueId} = dbReplaceQueueId
  {-# INLINE dbReplaceQId #-}

-class SMPQueueRec q => SomeRcvQueue q where
-  rcvAuthKey :: q -> RcvPrivateAuthKey
-
-instance SomeRcvQueue RcvQueue where
-  rcvAuthKey RcvQueue {rcvPrivateKey} = rcvPrivateKey
-  {-# INLINE rcvAuthKey #-}
-
-instance SomeRcvQueue RcvQueueSub where
-  rcvAuthKey RcvQueueSub {rcvPrivateKey} = rcvPrivateKey
-  {-# INLINE rcvAuthKey #-}
-
 -- * Connection types

 -- | Type of a connection.
@@ -332,18 +257,16 @@ data ConnType = CNew | CRcv | CSnd | CDuplex | CContact deriving (Eq, Show)
 --
 -- - DuplexConnection is a connection that has both receive and send queues set up,
 --   typically created by upgrading a receive or a send connection with a missing queue.
-data Connection' (d :: ConnType) rq sq where
-  NewConnection :: ConnData -> Connection' CNew rq sq
-  RcvConnection :: ConnData -> rq -> Connection' CRcv rq sq
-  SndConnection :: ConnData -> sq -> Connection' CSnd rq sq
-  DuplexConnection :: ConnData -> NonEmpty rq -> NonEmpty sq -> Connection' CDuplex rq sq
-  ContactConnection :: ConnData -> rq -> Connection' CContact rq sq
+data Connection (d :: ConnType) where
+  NewConnection :: ConnData -> Connection CNew
+  RcvConnection :: ConnData -> RcvQueue -> Connection CRcv
+  SndConnection :: ConnData -> SndQueue -> Connection CSnd
+  DuplexConnection :: ConnData -> NonEmpty RcvQueue -> NonEmpty SndQueue -> Connection CDuplex
+  ContactConnection :: ConnData -> RcvQueue -> Connection CContact

-deriving instance (Show rq, Show sq) => Show (Connection' d rq sq)
+deriving instance Show (Connection d)

-type Connection d = Connection' d RcvQueue SndQueue
-
-toConnData :: Connection' d rq sq -> ConnData
+toConnData :: Connection d -> ConnData
 toConnData = \case
  NewConnection cData -> cData
  RcvConnection cData _ -> cData
@@ -351,7 +274,7 @@ toConnData = \case
  DuplexConnection cData _ _ -> cData
  ContactConnection cData _ -> cData

-updateConnection :: ConnData -> Connection' d rq sq -> Connection' d rq sq
+updateConnection :: ConnData -> Connection d -> Connection d
 updateConnection cData = \case
  NewConnection _ -> NewConnection cData
  RcvConnection _ rq -> RcvConnection cData rq
@@ -384,13 +307,9 @@ instance TestEquality SConnType where

 -- | Connection of an unknown type.
 -- Used to refer to an arbitrary connection when retrieving from store.
-data SomeConn' rq sq = forall d. SomeConn (SConnType d) (Connection' d rq sq)
+data SomeConn = forall d. SomeConn (SConnType d) (Connection d)

-deriving instance (Show rq, Show sq) => Show (SomeConn' rq sq)
-
-type SomeConn = SomeConn' RcvQueue SndQueue
-
-type SomeConnSub = SomeConn' RcvQueueSub SndQueue
+deriving instance Show SomeConn

 data ConnData = ConnData
  { connId :: ConnId,
@@ -404,8 +323,6 @@ data ConnData = ConnData
  }
  deriving (Eq, Show)

-type NoticeId = Int64
-
 -- this function should be mirrored in the clients
 ratchetSyncAllowed :: ConnData -> Bool
 ratchetSyncAllowed ConnData {ratchetSyncState, connAgentVersion} =
@@ -569,7 +486,7 @@ data NewInvitation = NewInvitation

 data Invitation = Invitation
  { invitationId :: InvitationId,
-    contactConnId_ :: Maybe ConnId,
+    contactConnId :: ConnId,
    connReq :: ConnectionRequestUri 'CMInvitation,
    recipientConnInfo :: ConnInfo,
    ownConnInfo :: Maybe ConnInfo,
@@ -619,17 +536,9 @@ data SndMsgData = SndMsgData
    msgBody :: MsgBody,
    pqEncryption :: PQEncryption,
    internalHash :: MsgHash,
-    prevMsgHash :: MsgHash,
-    sndMsgPrepData_ :: Maybe SndMsgPrepData
+    prevMsgHash :: MsgHash
  }

-data SndMsgPrepData = SndMsgPrepData
-  { encryptKey :: MsgEncryptKeyX448,
-    paddedLen :: Int,
-    sndMsgBodyId :: Int64
-  }
-  deriving (Show)
-
 data SndMsg = SndMsg
  { internalId :: InternalId,
    internalSndId :: InternalSndId,
@@ -645,17 +554,7 @@ data PendingMsgData = PendingMsgData
    msgBody :: MsgBody,
    pqEncryption :: PQEncryption,
    msgRetryState :: Maybe RI2State,
-    internalTs :: InternalTs,
-    internalSndId :: InternalSndId,
-    prevMsgHash :: PrevSndMsgHash,
-    pendingMsgPrepData_ :: Maybe PendingMsgPrepData
-  }
-  deriving (Show)
-
-data PendingMsgPrepData = PendingMsgPrepData
-  { encryptKey :: MsgEncryptKeyX448,
-    paddedLen :: Int,
-    sndMsgBody :: AMessage
+    internalTs :: InternalTs
  }
  deriving (Show)

@@ -720,13 +619,13 @@ data StoreError
    SESndQueueExists
  | -- | Wrong connection type, e.g. "send" connection when "receive" or "duplex" is expected, or vice versa.
    -- 'upgradeRcvConnToDuplex' and 'upgradeSndConnToDuplex' do not allow duplex connections - they would also return this error.
-    SEBadConnType String ConnType
+    SEBadConnType ConnType
  | -- | Confirmation not found.
    SEConfirmationNotFound
  | -- | Invitation not found
    SEInvitationNotFound String InvitationId
  | -- | Message not found
-    SEMsgNotFound String
+    SEMsgNotFound
  | -- | Command not found
    SECmdNotFound
  | -- | Currently not used. The intention was to pass current expected queue status in methods,
@@ -746,20 +645,7 @@ data StoreError
  | -- | XFTP Deleted snd chunk replica not found.
    SEDeletedSndChunkReplicaNotFound
  | -- | Error when reading work item that suspends worker - do not use!
-    SEWorkItemError {errContext :: String}
+    SEWorkItemError ByteString
  | -- | Servers stats not found.
    SEServersStatsNotFound
  deriving (Eq, Show, Exception)
-
-instance AnyError StoreError where
-  fromSomeException = SEInternal . bshow
-
-class (Show e, AnyError e) => AnyStoreError e where
-  isWorkItemError :: e -> Bool
-  mkWorkItemError :: String -> e
-
-instance AnyStoreError StoreError where
-  isWorkItemError = \case
-    SEWorkItemError {} -> True
-    _ -> False
-  mkWorkItemError errContext = SEWorkItemError {errContext}
@@ -1,14 +0,0 @@
-{-# LANGUAGE CPP #-}
-
-module Simplex.Messaging.Agent.Store.Common
-#if defined(dbPostgres)
-  ( module Simplex.Messaging.Agent.Store.Postgres.Common,
-  )
-  where
-import Simplex.Messaging.Agent.Store.Postgres.Common
-#else
-  ( module Simplex.Messaging.Agent.Store.SQLite.Common,
-  )
-  where
-import Simplex.Messaging.Agent.Store.SQLite.Common
-#endif
@@ -1,18 +0,0 @@
-{-# LANGUAGE CPP #-}
-
-module Simplex.Messaging.Agent.Store.DB
-#if defined(dbPostgres)
-  ( module Simplex.Messaging.Agent.Store.Postgres.DB,
-    FromField (..),
-    ToField (..),
-  )
-  where
-import Simplex.Messaging.Agent.Store.Postgres.DB
-#else
-  ( module Simplex.Messaging.Agent.Store.SQLite.DB,
-    FromField (..),
-    ToField (..),
-  )
-  where
-import Simplex.Messaging.Agent.Store.SQLite.DB
-#endif
@@ -1,72 +0,0 @@
-{-# LANGUAGE CPP #-}
-{-# LANGUAGE DataKinds #-}
-{-# LANGUAGE FlexibleInstances #-}
-{-# LANGUAGE GADTs #-}
-{-# LANGUAGE KindSignatures #-}
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE StandaloneDeriving #-}
-{-# LANGUAGE TypeApplications #-}
-
-module Simplex.Messaging.Agent.Store.Entity where
-
-import Data.Aeson (FromJSON (..), ToJSON (..))
-import qualified Data.Aeson as J
-import qualified Data.Aeson.Encoding as JE
-import Data.Int (Int64)
-import Data.Scientific (floatingOrInteger)
-import Simplex.Messaging.Agent.Store.DB (FromField (..), ToField (..))
-
-data DBStored = DBStored | DBNew
-
-data SDBStored (s :: DBStored) where
-  SDBStored :: SDBStored 'DBStored
-  SDBNew :: SDBStored 'DBNew
-
-deriving instance Show (SDBStored s)
-
-class DBStoredI s where sdbStored :: SDBStored s
-
-instance DBStoredI 'DBStored where sdbStored = SDBStored
-
-instance DBStoredI 'DBNew where sdbStored = SDBNew
-
-data DBEntityId' (s :: DBStored) where
-  DBEntityId :: Int64 -> DBEntityId' 'DBStored
-  DBNewEntity :: DBEntityId' 'DBNew
-
-deriving instance Show (DBEntityId' s)
-
-deriving instance Eq (DBEntityId' s)
-
-type DBEntityId = DBEntityId' 'DBStored
-
-type DBNewEntity = DBEntityId' 'DBNew
-
-instance ToJSON (DBEntityId' s) where
-  toEncoding = \case
-    DBEntityId i -> toEncoding i
-    DBNewEntity -> JE.null_
-  toJSON = \case
-    DBEntityId i -> toJSON i
-    DBNewEntity -> J.Null
-
-instance DBStoredI s => FromJSON (DBEntityId' s) where
-  parseJSON v = case (v, sdbStored @s) of
-    (J.Null, SDBNew) -> pure DBNewEntity
-    (J.Number n, SDBStored) -> case floatingOrInteger n of
-      Left (_ :: Double) -> fail "bad DBEntityId"
-      Right i -> pure $ DBEntityId (fromInteger i)
-    _ -> fail "bad DBEntityId"
-  omittedField = case sdbStored @s of
-    SDBStored -> Nothing
-    SDBNew -> Just DBNewEntity
-
-instance FromField DBEntityId where
-#if defined(dbPostgres)
-  fromField x dat = DBEntityId <$> fromField x dat
-#else
-  fromField x = DBEntityId <$> fromField x
-#endif
-
-instance ToField DBEntityId where toField (DBEntityId i) = toField i
@@ -1,14 +0,0 @@
-{-# LANGUAGE CPP #-}
-
-module Simplex.Messaging.Agent.Store.Interface
-#if defined(dbPostgres)
-  ( module Simplex.Messaging.Agent.Store.Postgres,
-  )
-  where
-import Simplex.Messaging.Agent.Store.Postgres
-#else
-  ( module Simplex.Messaging.Agent.Store.SQLite,
-  )
-  where
-import Simplex.Messaging.Agent.Store.SQLite
-#endif
@@ -1,78 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-
-module Simplex.Messaging.Agent.Store.Migrations
-  ( Migration (..),
-    MigrationsToRun (..),
-    DownMigration (..),
-    DBMigrate (..),
-    sharedMigrateSchema,
-    -- for tests
-    migrationsToRun,
-    toDownMigration,
-  )
-where
-
-import Control.Monad
-import Data.Char (toLower)
-import Data.Functor (($>))
-import Data.Maybe (isJust, isNothing, mapMaybe)
-import Simplex.Messaging.Agent.Store.Shared
-import System.Exit (exitFailure)
-import System.IO (hFlush, stdout)
-
-migrationsToRun :: [Migration] -> [Migration] -> Either MTRError MigrationsToRun
-migrationsToRun [] [] = Right MTRNone
-migrationsToRun appMs [] = Right $ MTRUp appMs
-migrationsToRun [] dbMs
-  | length dms == length dbMs = Right $ MTRDown dms
-  | otherwise = Left $ MTRENoDown $ mapMaybe nameNoDown dbMs
-  where
-    dms = mapMaybe toDownMigration dbMs
-    nameNoDown m = if isNothing (down m) then Just $ name m else Nothing
-migrationsToRun (a : as) (d : ds)
-  | name a == name d = migrationsToRun as ds
-  | otherwise = Left $ MTREDifferent (name a) (name d)
-
-data DBMigrate = DBMigrate
-  { initialize :: IO (),
-    getCurrent :: IO [Migration],
-    run :: MigrationsToRun -> IO (),
-    backup :: Maybe (IO ())
-  }
-
-sharedMigrateSchema :: DBMigrate -> Bool -> [Migration] -> MigrationConfirmation -> IO (Either MigrationError ())
-sharedMigrateSchema dbm dbNew' migrations confirmMigrations = do
-  initialize dbm
-  currentMs <- getCurrent dbm
-  case migrationsToRun migrations currentMs of
-    Left e -> do
-      when (confirmMigrations == MCConsole) $ confirmOrExit ("Database state error: " <> mtrErrorDescription e)
-      pure . Left $ MigrationError e
-    Right MTRNone -> pure $ Right ()
-    Right ms@(MTRUp ums)
-      | dbNew' -> run dbm ms $> Right ()
-      | otherwise -> case confirmMigrations of
-          MCYesUp -> runWithBackup ms
-          MCYesUpDown -> runWithBackup ms
-          MCConsole -> confirm' err >> runWithBackup ms
-          MCError -> pure $ Left err
-      where
-        err = MEUpgrade $ map upMigration ums -- "The app has a newer version than the database.\nConfirm to back up and upgrade using these migrations: " <> intercalate ", " (map name ums)
-    Right ms@(MTRDown dms) -> case confirmMigrations of
-      MCYesUpDown -> runWithBackup ms
-      MCConsole -> confirm' err >> runWithBackup ms
-      MCYesUp -> pure $ Left err
-      MCError -> pure $ Left err
-      where
-        err = MEDowngrade $ map downName dms
-  where
-    runWithBackup ms = sequence (backup dbm) >> run dbm ms $> Right ()
-    confirm' err = confirmOrExit $ migrationErrorDescription (isJust $ backup dbm) err
-
-confirmOrExit :: String -> IO ()
-confirmOrExit s = do
-  putStrLn s
-  putStr "Continue (y/N): "
-  hFlush stdout
-  ok <- getLine
-  when (map toLower ok /= "y") exitFailure
@@ -1,14 +0,0 @@
-{-# LANGUAGE CPP #-}
-
-module Simplex.Messaging.Agent.Store.Migrations.App
-#if defined(dbPostgres)
-  ( module Simplex.Messaging.Agent.Store.Postgres.Migrations.App,
-  )
-  where
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.App
-#else
-  ( module Simplex.Messaging.Agent.Store.SQLite.Migrations.App,
-  )
-  where
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.App
-#endif
@@ -1,137 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-
-module Simplex.Messaging.Agent.Store.Postgres
-  ( DBOpts (..),
-    Migrations.getCurrentMigrations,
-    checkSchemaExists,
-    migrateDBSchema,
-    createDBStore,
-    closeDBStore,
-    reopenDBStore,
-    execSQL,
-  )
-where
-
-import Control.Concurrent.STM
-import Control.Exception (finally, onException, throwIO, uninterruptibleMask_)
-import Control.Logger.Simple (logError)
-import Control.Monad
-import Data.ByteString (ByteString)
-import Data.Functor (($>))
-import Data.Text (Text)
-import Database.PostgreSQL.Simple (Only (..))
-import Database.PostgreSQL.Simple.Types (Query (..))
-import qualified Database.PostgreSQL.Simple as PSQL
-import Database.PostgreSQL.Simple.SqlQQ (sql)
-import Simplex.Messaging.Agent.Store.Migrations (DBMigrate (..), sharedMigrateSchema)
-import qualified Simplex.Messaging.Agent.Store.Postgres.Migrations as Migrations
-import Simplex.Messaging.Agent.Store.Postgres.Common
-import qualified Simplex.Messaging.Agent.Store.Postgres.DB as DB
-import Simplex.Messaging.Agent.Store.Shared (Migration (..), MigrationConfig (..), MigrationError (..))
-import Simplex.Messaging.Util (ifM, safeDecodeUtf8)
-import System.Exit (exitFailure)
-
-- | Create a new Postgres DBStore with the given connection string, schema name and migrations.
-- If passed schema does not exist in connectInfo database, it will be created.
-- Applies necessary migrations to schema.
-createDBStore :: DBOpts -> [Migration] -> MigrationConfig -> IO (Either MigrationError DBStore)
-createDBStore opts migrations migrationConfig = do
-  st <- connectPostgresStore opts
-  r <- migrateDBSchema st opts Nothing migrations migrationConfig `onException` closeDBStore st
-  case r of
-    Right () -> pure $ Right st
-    Left e -> closeDBStore st $> Left e
-
-migrateDBSchema :: DBStore -> DBOpts -> Maybe Query -> [Migration] -> MigrationConfig -> IO (Either MigrationError ())
-migrateDBSchema st _opts migrationsTable migrations MigrationConfig {confirm} =
-  let initialize = Migrations.initialize st migrationsTable
-      getCurrent = withTransaction st $ Migrations.getCurrentMigrations migrationsTable
-      run = Migrations.run st migrationsTable
-      dbm = DBMigrate {initialize, getCurrent, run, backup = Nothing}
-   in sharedMigrateSchema dbm (dbNew st) migrations confirm
-
-connectPostgresStore :: DBOpts -> IO DBStore
-connectPostgresStore DBOpts {connstr, schema, poolSize, createSchema} = do
-  dbPriorityPool <- newDBStorePool poolSize
-  dbPool <- newDBStorePool poolSize
-  dbClosed <- newTVarIO True
-  let dbConnect = fst <$> connectDB connstr schema False
-      st = DBStore {dbConnstr = connstr, dbSchema = schema, dbPoolSize = fromIntegral poolSize, dbPriorityPool, dbPool, dbConnect, dbNew = False, dbClosed}
-  dbNew <- connectStore st createSchema
-  pure st {dbNew}
-
-- uninterruptibleMask_ here and below is used here so that it is not interrupted half-way,
-- it relies on the assumption that when dbClosed = True, the queue is empty,
-- and when it is False, the queue is full (or will have connections returned to it by the threads that use them).
-connectStore :: DBStore -> Bool -> IO Bool
-connectStore DBStore {dbConnstr, dbSchema, dbPoolSize, dbPriorityPool, dbPool, dbClosed} createSchema = uninterruptibleMask_ $ do
-  (conn, dbNew) <- connectDB dbConnstr dbSchema createSchema -- TODO [postgres] analogue for dbBusyLoop?
-  writeConns dbPriorityPool . (conn :) =<< mkConns (dbPoolSize - 1)
-  writeConns dbPool =<< mkConns dbPoolSize
-  atomically $ writeTVar dbClosed False
-  pure dbNew
-  where
-    writeConns pool conns = mapM_ (atomically . writeTBQueue (dbPoolConns pool)) conns
-    mkConns n = replicateM n $ fst <$> connectDB dbConnstr dbSchema False
-
-connectDB :: ByteString -> ByteString -> Bool -> IO (DB.Connection, Bool)
-connectDB connstr schema createSchema = do
-  db <- PSQL.connectPostgreSQL connstr
-  dbNew <- prepare db `onException` PSQL.close db
-  pure (db, dbNew)
-  where
-    prepare db = do
-      void $ PSQL.execute_ db "SET client_min_messages TO WARNING"
-      dbNew <- not <$> doesSchemaExist db schema
-      when dbNew $
-        if createSchema
-          then void $ PSQL.execute_ db $ Query $ "CREATE SCHEMA " <> schema
-          else do
-            logError $ "connectPostgresStore, schema " <> safeDecodeUtf8 schema <> " does not exist, exiting."
-            PSQL.close db
-            exitFailure
-      void $ PSQL.execute_ db $ Query $ "SET search_path TO " <> schema
-      pure dbNew
-
-checkSchemaExists :: ByteString -> ByteString -> IO Bool
-checkSchemaExists connstr schema = do
-  db <- PSQL.connectPostgreSQL connstr
-  doesSchemaExist db schema `finally` DB.close db
-
-doesSchemaExist :: DB.Connection -> ByteString -> IO Bool
-doesSchemaExist db schema = do
-  [Only schemaExists] <-
-    PSQL.query
-      db
-      [sql|
-        SELECT EXISTS (
-          SELECT 1 FROM pg_catalog.pg_namespace
-          WHERE nspname = ?
-        )
-      |]
-      (Only schema)
-  pure schemaExists
-
-closeDBStore :: DBStore -> IO ()
-closeDBStore DBStore {dbPoolSize, dbPriorityPool, dbPool, dbClosed} =
-  ifM (readTVarIO dbClosed) (putStrLn "closeDBStore: already closed") $ uninterruptibleMask_ $ do
-    closePool dbPriorityPool
-    closePool dbPool
-    atomically $ writeTVar dbClosed True
-  where
-    closePool pool = replicateM_ dbPoolSize $ atomically (readTBQueue $ dbPoolConns pool) >>= DB.close
-
-reopenDBStore :: DBStore -> IO ()
-reopenDBStore st =
-  ifM
-    (readTVarIO $ dbClosed st)
-    (void $ connectStore st False)
-    (putStrLn "reopenDBStore: already opened")
-
-- not used with postgres client (used for ExecAgentStoreSQL, ExecChatStoreSQL)
-execSQL :: PSQL.Connection -> Text -> IO [Text]
-execSQL _db _query = throwIO (userError "not implemented")
@@ -1,93 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TupleSections #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Common
-  ( DBStore (..),
-    DBStorePool (..),
-    DBOpts (..),
-    newDBStorePool,
-    withConnection,
-    withConnection',
-    withTransaction,
-    withTransaction',
-    withTransactionPriority,
-  )
-where
-
-import Control.Concurrent.MVar
-import Control.Concurrent.STM
-import qualified Control.Exception as E
-import Data.ByteString (ByteString)
-import qualified Database.PostgreSQL.Simple as PSQL
-import Numeric.Natural (Natural)
-import Simplex.Messaging.Agent.Store.Postgres.Options
-
-- TODO [postgres] use log_min_duration_statement instead of custom slow queries (SQLite's Connection type)
-data DBStore = DBStore
-  { dbConnstr :: ByteString,
-    dbSchema :: ByteString,
-    dbPoolSize :: Int,
-    dbPriorityPool :: DBStorePool,
-    dbPool :: DBStorePool,
-    dbConnect :: IO PSQL.Connection,
-    dbClosed :: TVar Bool,
-    dbNew :: Bool
-  }
-
-newDBStorePool :: Natural -> IO DBStorePool
-newDBStorePool poolSize = do
-  dbSem <- newMVar ()
-  dbPoolConns <- newTBQueueIO poolSize
-  pure DBStorePool {dbSem, dbPoolConns}
-
-data DBStorePool = DBStorePool
-  { dbPoolConns :: TBQueue PSQL.Connection,
-    -- MVar is needed for fair pool distribution, without STM retry contention.
-    -- Only one thread can be blocked on STM read.
-    dbSem :: MVar ()
-  }
-
-withConnectionPriority :: DBStore -> Bool -> (PSQL.Connection -> IO a) -> IO a
-withConnectionPriority DBStore {dbPriorityPool, dbPool, dbConnect} priority =
-  withConnectionPool (if priority then dbPriorityPool else dbPool) dbConnect
-{-# INLINE withConnectionPriority #-}
-
-withConnectionPool :: DBStorePool -> IO PSQL.Connection -> (PSQL.Connection -> IO a) -> IO a
-withConnectionPool DBStorePool {dbPoolConns, dbSem} dbConnect action =
-  E.mask $ \restore -> do
-    conn <- withMVar dbSem $ \_ -> atomically $ readTBQueue dbPoolConns
-    r <- restore (action conn) `E.onException` reset conn
-    atomically $ writeTBQueue dbPoolConns conn
-    pure r
-  where
-    reset conn = do
-      conn' <- E.try dbConnect >>= \case
-        Right conn' -> PSQL.close conn >> pure conn'
-        Left (_ :: E.SomeException) -> pure conn
-      atomically $ writeTBQueue dbPoolConns conn'
-
-withConnection :: DBStore -> (PSQL.Connection -> IO a) -> IO a
-withConnection st = withConnectionPriority st False
-{-# INLINE withConnection #-}
-
-withConnection' :: DBStore -> (PSQL.Connection -> IO a) -> IO a
-withConnection' = withConnection
-{-# INLINE withConnection' #-}
-
-withTransaction' :: DBStore -> (PSQL.Connection -> IO a) -> IO a
-withTransaction' = withTransaction
-{-# INLINE withTransaction' #-}
-
-withTransaction :: DBStore -> (PSQL.Connection -> IO a) -> IO a
-withTransaction st = withTransactionPriority st False
-{-# INLINE withTransaction #-}
-
-- TODO [postgres] analogue for dbBusyLoop?
-withTransactionPriority :: DBStore -> Bool -> (PSQL.Connection -> IO a) -> IO a
-withTransactionPriority st priority action = withConnectionPriority st priority transaction
-  where
-    transaction conn = PSQL.withTransaction conn $ action conn
@@ -1,89 +0,0 @@
-{-# LANGUAGE ScopedTypeVariables #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.DB
-  ( BoolInt (..),
-    PSQL.Binary (..),
-    PSQL.Connection,
-    FromField (..),
-    ToField (..),
-    PSQL.connect,
-    PSQL.close,
-    execute,
-    execute_,
-    executeMany,
-    PSQL.query,
-    PSQL.query_,
-    blobFieldDecoder,
-    fromTextField_,
-  )
-where
-
-import Control.Monad (void)
-import Data.ByteString.Char8 (ByteString)
-import Data.Int (Int64)
-import Data.Text (Text)
-import Data.Text.Encoding (decodeUtf8)
-import Data.Typeable (Typeable)
-import Data.Word (Word16, Word32)
-import Database.PostgreSQL.Simple (ResultError (..))
-import qualified Database.PostgreSQL.Simple as PSQL
-import Database.PostgreSQL.Simple.FromField (Field (..), FieldParser, FromField (..), returnError)
-import Database.PostgreSQL.Simple.ToField (ToField (..))
-import Database.PostgreSQL.Simple.TypeInfo.Static (textOid, varcharOid)
-
-newtype BoolInt = BI {unBI :: Bool}
-
-instance FromField BoolInt where
-  fromField field dat = BI . (/= (0 :: Int)) <$> fromField field dat
-  {-# INLINE fromField #-}
-
-instance ToField BoolInt where
-  toField (BI b) = toField ((if b then 1 else 0) :: Int)
-  {-# INLINE toField #-}
-
-execute :: PSQL.ToRow q => PSQL.Connection -> PSQL.Query -> q -> IO ()
-execute db q qs = void $ PSQL.execute db q qs
-{-# INLINE execute #-}
-
-execute_ :: PSQL.Connection -> PSQL.Query -> IO ()
-execute_ db q = void $ PSQL.execute_ db q
-{-# INLINE execute_ #-}
-
-executeMany :: PSQL.ToRow q => PSQL.Connection -> PSQL.Query -> [q] -> IO ()
-executeMany db q qs = void $ PSQL.executeMany db q qs
-{-# INLINE executeMany #-}
-
-- orphan instances
-
-- used in FileSize
-instance FromField Word32 where
-  fromField field dat = do
-    i :: Int64 <- fromField field dat
-    if i >= 0 && i <= fromIntegral (maxBound :: Word32)
-      then pure (fromIntegral i :: Word32)
-      else returnError ConversionFailed field "Negative value can't be converted to Word32"
-
-- used in Version
-instance FromField Word16 where
-  fromField field dat = do
-    i :: Int64 <- fromField field dat
-    if i >= 0 && i <= fromIntegral (maxBound :: Word16)
-      then pure (fromIntegral i :: Word16)
-      else returnError ConversionFailed field "Negative value can't be converted to Word16"
-
-blobFieldDecoder :: Typeable k => (ByteString -> Either String k) -> FieldParser k
-blobFieldDecoder dec f val = do
-  x <- fromField f val
-  case dec x of
-    Right k -> pure k
-    Left e -> returnError ConversionFailed f ("couldn't parse field: " ++ e)
-
-fromTextField_ :: Typeable a => (Text -> Maybe a) -> FieldParser a
-fromTextField_ fromText f val =
-  if typeOid f `elem` [textOid, varcharOid]
-    then case val of
-      Just t -> case fromText $ decodeUtf8 t of
-        Just x -> pure x
-        _ -> returnError ConversionFailed f "invalid text value"
-      Nothing -> returnError UnexpectedNull f "NULL value found for non-NULL field"
-    else returnError Incompatible f "expecting TEXT or VARCHAR column type"
@@ -1,63 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-{-# LANGUAGE TupleSections #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations
-  ( initialize,
-    run,
-    getCurrentMigrations,
-  )
-where
-
-import Control.Exception (throwIO)
-import Control.Monad (void)
-import qualified Data.ByteString.Char8 as B
-import Data.Maybe (fromMaybe)
-import qualified Data.Text as T
-import qualified Data.Text.Encoding as TE
-import Data.Time.Clock (getCurrentTime)
-import qualified Database.PostgreSQL.LibPQ as LibPQ
-import Database.PostgreSQL.Simple (Only (..), Query)
-import qualified Database.PostgreSQL.Simple as PSQL
-import Database.PostgreSQL.Simple.Internal (Connection (..))
-import Simplex.Messaging.Agent.Store.Postgres.Common
-import Simplex.Messaging.Agent.Store.Shared
-import Simplex.Messaging.Util (($>>=))
-import UnliftIO.MVar
-
-initialize :: DBStore -> Maybe Query -> IO ()
-initialize st migrationsTable = withTransaction' st $ \db ->
-  void $ PSQL.execute_ db $
-    "CREATE TABLE IF NOT EXISTS "
-      <> fromMaybe "migrations" migrationsTable
-      <> " (name TEXT NOT NULL PRIMARY KEY, ts TIMESTAMP NOT NULL, down TEXT)"
-
-run :: DBStore -> Maybe Query -> MigrationsToRun -> IO ()
-run st migrationsTable = \case
-  MTRUp [] -> pure ()
-  MTRUp ms -> mapM_ runUp ms
-  MTRDown ms -> mapM_ runDown $ reverse ms
-  MTRNone -> pure ()
-  where
-    table = fromMaybe "migrations" migrationsTable
-    runUp Migration {name, up, down} = withTransaction' st $ \db -> do
-      insert db
-      execSQL db up
-      where
-        insert db = void $ PSQL.execute db ("INSERT INTO " <> table <> " (name, down, ts) VALUES (?,?,?)") . (name,down,) =<< getCurrentTime
-    runDown DownMigration {downName, downQuery} = withTransaction' st $ \db -> do
-      execSQL db downQuery
-      void $ PSQL.execute db ("DELETE FROM " <> table <> " WHERE name = ?") (Only downName)
-    execSQL db query =
-      withMVar (connectionHandle db) $ \pqConn ->
-        LibPQ.exec pqConn (TE.encodeUtf8 query) $>>= LibPQ.resultErrorMessage >>= \case
-          Just e | not (B.null e) -> throwIO $ userError $ B.unpack e
-          _ -> pure ()
-
-getCurrentMigrations :: Maybe Query -> PSQL.Connection -> IO [Migration]
-getCurrentMigrations migrationsTable db = map toMigration <$> PSQL.query_ db ("SELECT name, down FROM " <> table <> " ORDER BY name ASC;")
-  where
-    table = fromMaybe "migrations" migrationsTable
-    toMigration (name, down) = Migration {name, up = T.pack "", down}
@@ -1,29 +0,0 @@
-{-# LANGUAGE NamedFieldPuns #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.App (appMigrations) where
-
-import Data.List (sortOn)
-import Data.Text (Text)
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20241210_initial
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250203_msg_bodies
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250322_short_links
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250702_conn_invitations_remove_cascade_delete
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251009_queue_to_subscribe
-import Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251010_client_notices
-import Simplex.Messaging.Agent.Store.Shared (Migration (..))
-
-schemaMigrations :: [(String, Text, Maybe Text)]
-schemaMigrations =
-  [ ("20241210_initial", m20241210_initial, Nothing),
-    ("20250203_msg_bodies", m20250203_msg_bodies, Just down_m20250203_msg_bodies),
-    ("20250322_short_links", m20250322_short_links, Just down_m20250322_short_links),
-    ("20250702_conn_invitations_remove_cascade_delete", m20250702_conn_invitations_remove_cascade_delete, Just down_m20250702_conn_invitations_remove_cascade_delete),
-    ("20251009_queue_to_subscribe", m20251009_queue_to_subscribe, Just down_m20251009_queue_to_subscribe),
-    ("20251010_client_notices", m20251010_client_notices, Just down_m20251010_client_notices)
-  ]
-
-- | The list of migrations in ascending order by date
-appMigrations :: [Migration]
-appMigrations = sortOn name $ map migration schemaMigrations
-  where
-    migration (name, up, down) = Migration {name, up, down = down}
@@ -1,544 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20241210_initial where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20241210_initial :: Text
-m20241210_initial =
-  [r|
-CREATE TABLE users(
-  user_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  deleted SMALLINT NOT NULL DEFAULT 0
-);
-CREATE TABLE servers(
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  key_hash BYTEA NOT NULL,
-  PRIMARY KEY(host, port)
-);
-CREATE TABLE connections(
-  conn_id BYTEA NOT NULL PRIMARY KEY,
-  conn_mode TEXT NOT NULL,
-  last_internal_msg_id BIGINT NOT NULL DEFAULT 0,
-  last_internal_rcv_msg_id BIGINT NOT NULL DEFAULT 0,
-  last_internal_snd_msg_id BIGINT NOT NULL DEFAULT 0,
-  last_external_snd_msg_id BIGINT NOT NULL DEFAULT 0,
-  last_rcv_msg_hash BYTEA NOT NULL DEFAULT ''::BYTEA,
-  last_snd_msg_hash BYTEA NOT NULL DEFAULT ''::BYTEA,
-  smp_agent_version INTEGER NOT NULL DEFAULT 1,
-  duplex_handshake SMALLINT NULL DEFAULT 0,
-  enable_ntfs SMALLINT,
-  deleted SMALLINT NOT NULL DEFAULT 0,
-  user_id BIGINT NOT NULL REFERENCES users ON DELETE CASCADE,
-  ratchet_sync_state TEXT NOT NULL DEFAULT 'ok',
-  deleted_at_wait_delivery TIMESTAMPTZ,
-  pq_support SMALLINT NOT NULL DEFAULT 0
-);
-CREATE TABLE rcv_queues(
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  rcv_id BYTEA NOT NULL,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  rcv_private_key BYTEA NOT NULL,
-  rcv_dh_secret BYTEA NOT NULL,
-  e2e_priv_key BYTEA NOT NULL,
-  e2e_dh_secret BYTEA,
-  snd_id BYTEA NOT NULL,
-  snd_key BYTEA,
-  status TEXT NOT NULL,
-  smp_server_version INTEGER NOT NULL DEFAULT 1,
-  smp_client_version INTEGER,
-  ntf_public_key BYTEA,
-  ntf_private_key BYTEA,
-  ntf_id BYTEA,
-  rcv_ntf_dh_secret BYTEA,
-  rcv_queue_id BIGINT NOT NULL,
-  rcv_primary SMALLINT NOT NULL,
-  replace_rcv_queue_id BIGINT NULL,
-  delete_errors BIGINT NOT NULL DEFAULT 0,
-  server_key_hash BYTEA,
-  switch_status TEXT,
-  deleted SMALLINT NOT NULL DEFAULT 0,
-  snd_secure SMALLINT NOT NULL DEFAULT 0,
-  last_broker_ts TIMESTAMPTZ,
-  PRIMARY KEY(host, port, rcv_id),
-  FOREIGN KEY(host, port) REFERENCES servers
-  ON DELETE RESTRICT ON UPDATE CASCADE,
-  UNIQUE(host, port, snd_id)
-);
-CREATE TABLE snd_queues(
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  snd_id BYTEA NOT NULL,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  snd_private_key BYTEA NOT NULL,
-  e2e_dh_secret BYTEA NOT NULL,
-  status TEXT NOT NULL,
-  smp_server_version INTEGER NOT NULL DEFAULT 1,
-  smp_client_version INTEGER NOT NULL DEFAULT 1,
-  snd_public_key BYTEA,
-  e2e_pub_key BYTEA,
-  snd_queue_id BIGINT NOT NULL,
-  snd_primary SMALLINT NOT NULL,
-  replace_snd_queue_id BIGINT NULL,
-  server_key_hash BYTEA,
-  switch_status TEXT,
-  snd_secure SMALLINT NOT NULL DEFAULT 0,
-  PRIMARY KEY(host, port, snd_id),
-  FOREIGN KEY(host, port) REFERENCES servers
-  ON DELETE RESTRICT ON UPDATE CASCADE
-);
-CREATE TABLE messages(
-  conn_id BYTEA NOT NULL REFERENCES connections(conn_id)
-  ON DELETE CASCADE,
-  internal_id BIGINT NOT NULL,
-  internal_ts TIMESTAMPTZ NOT NULL,
-  internal_rcv_id BIGINT,
-  internal_snd_id BIGINT,
-  msg_type BYTEA NOT NULL,
-  msg_body BYTEA NOT NULL DEFAULT ''::BYTEA,
-  msg_flags TEXT NULL,
-  pq_encryption SMALLINT NOT NULL DEFAULT 0,
-  PRIMARY KEY(conn_id, internal_id)
-);
-CREATE TABLE rcv_messages(
-  conn_id BYTEA NOT NULL,
-  internal_rcv_id BIGINT NOT NULL,
-  internal_id BIGINT NOT NULL,
-  external_snd_id BIGINT NOT NULL,
-  broker_id BYTEA NOT NULL,
-  broker_ts TIMESTAMPTZ NOT NULL,
-  internal_hash BYTEA NOT NULL,
-  external_prev_snd_hash BYTEA NOT NULL,
-  integrity BYTEA NOT NULL,
-  user_ack SMALLINT NULL DEFAULT 0,
-  rcv_queue_id BIGINT NOT NULL,
-  PRIMARY KEY(conn_id, internal_rcv_id),
-  FOREIGN KEY(conn_id, internal_id) REFERENCES messages
-  ON DELETE CASCADE
-);
-ALTER TABLE messages
-ADD CONSTRAINT fk_messages_rcv_messages
-  FOREIGN KEY (conn_id, internal_rcv_id) REFERENCES rcv_messages
-  ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED;
-CREATE TABLE snd_messages(
-  conn_id BYTEA NOT NULL,
-  internal_snd_id BIGINT NOT NULL,
-  internal_id BIGINT NOT NULL,
-  internal_hash BYTEA NOT NULL,
-  previous_msg_hash BYTEA NOT NULL DEFAULT ''::BYTEA,
-  retry_int_slow BIGINT,
-  retry_int_fast BIGINT,
-  rcpt_internal_id BIGINT,
-  rcpt_status TEXT,
-  PRIMARY KEY(conn_id, internal_snd_id),
-  FOREIGN KEY(conn_id, internal_id) REFERENCES messages
-  ON DELETE CASCADE
-);
-ALTER TABLE messages
-ADD CONSTRAINT fk_messages_snd_messages
-  FOREIGN KEY (conn_id, internal_snd_id) REFERENCES snd_messages
-  ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED;
-CREATE TABLE conn_confirmations(
-  confirmation_id BYTEA NOT NULL PRIMARY KEY,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  e2e_snd_pub_key BYTEA NOT NULL,
-  sender_key BYTEA,
-  ratchet_state BYTEA NOT NULL,
-  sender_conn_info BYTEA NOT NULL,
-  accepted SMALLINT NOT NULL,
-  own_conn_info BYTEA,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  smp_reply_queues BYTEA NULL,
-  smp_client_version INTEGER
-);
-CREATE TABLE conn_invitations(
-  invitation_id BYTEA NOT NULL PRIMARY KEY,
-  contact_conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  cr_invitation BYTEA NOT NULL,
-  recipient_conn_info BYTEA NOT NULL,
-  accepted SMALLINT NOT NULL DEFAULT 0,
-  own_conn_info BYTEA,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE ratchets(
-  conn_id BYTEA NOT NULL PRIMARY KEY REFERENCES connections
-  ON DELETE CASCADE,
-  x3dh_priv_key_1 BYTEA,
-  x3dh_priv_key_2 BYTEA,
-  ratchet_state BYTEA,
-  e2e_version INTEGER NOT NULL DEFAULT 1,
-  x3dh_pub_key_1 BYTEA,
-  x3dh_pub_key_2 BYTEA,
-  pq_priv_kem BYTEA,
-  pq_pub_kem BYTEA
-);
-CREATE TABLE skipped_messages(
-  skipped_message_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  conn_id BYTEA NOT NULL REFERENCES ratchets
-  ON DELETE CASCADE,
-  header_key BYTEA NOT NULL,
-  msg_n BIGINT NOT NULL,
-  msg_key BYTEA NOT NULL
-);
-CREATE TABLE ntf_servers(
-  ntf_host TEXT NOT NULL,
-  ntf_port TEXT NOT NULL,
-  ntf_key_hash BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  PRIMARY KEY(ntf_host, ntf_port)
-);
-CREATE TABLE ntf_tokens(
-  provider TEXT NOT NULL,
-  device_token TEXT NOT NULL,
-  ntf_host TEXT NOT NULL,
-  ntf_port TEXT NOT NULL,
-  tkn_id BYTEA,
-  tkn_pub_key BYTEA NOT NULL,
-  tkn_priv_key BYTEA NOT NULL,
-  tkn_pub_dh_key BYTEA NOT NULL,
-  tkn_priv_dh_key BYTEA NOT NULL,
-  tkn_dh_secret BYTEA,
-  tkn_status TEXT NOT NULL,
-  tkn_action BYTEA,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  ntf_mode BYTEA NULL,
-  PRIMARY KEY(provider, device_token, ntf_host, ntf_port),
-  FOREIGN KEY(ntf_host, ntf_port) REFERENCES ntf_servers
-  ON DELETE RESTRICT ON UPDATE CASCADE
-);
-CREATE TABLE ntf_subscriptions(
-  conn_id BYTEA NOT NULL,
-  smp_host TEXT NULL,
-  smp_port TEXT NULL,
-  smp_ntf_id BYTEA,
-  ntf_host TEXT NOT NULL,
-  ntf_port TEXT NOT NULL,
-  ntf_sub_id BYTEA,
-  ntf_sub_status TEXT NOT NULL,
-  ntf_sub_action BYTEA,
-  ntf_sub_smp_action BYTEA,
-  ntf_sub_action_ts TIMESTAMPTZ,
-  updated_by_supervisor SMALLINT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  smp_server_key_hash BYTEA,
-  ntf_failed SMALLINT DEFAULT 0,
-  smp_failed SMALLINT DEFAULT 0,
-  PRIMARY KEY(conn_id),
-  FOREIGN KEY(smp_host, smp_port) REFERENCES servers(host, port)
-  ON DELETE SET NULL ON UPDATE CASCADE,
-  FOREIGN KEY(ntf_host, ntf_port) REFERENCES ntf_servers
-  ON DELETE RESTRICT ON UPDATE CASCADE
-);
-CREATE TABLE commands(
-  command_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  host TEXT,
-  port TEXT,
-  corr_id BYTEA NOT NULL,
-  command_tag BYTEA NOT NULL,
-  command BYTEA NOT NULL,
-  agent_version INTEGER NOT NULL DEFAULT 1,
-  server_key_hash BYTEA,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT '1970-01-01 00:00:00',
-  failed SMALLINT DEFAULT 0,
-  FOREIGN KEY(host, port) REFERENCES servers
-  ON DELETE RESTRICT ON UPDATE CASCADE
-);
-CREATE TABLE snd_message_deliveries(
-  snd_message_delivery_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  snd_queue_id BIGINT NOT NULL,
-  internal_id BIGINT NOT NULL,
-  failed SMALLINT DEFAULT 0,
-  FOREIGN KEY(conn_id, internal_id) REFERENCES messages ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED
-);
-CREATE TABLE xftp_servers(
-  xftp_server_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  xftp_host TEXT NOT NULL,
-  xftp_port TEXT NOT NULL,
-  xftp_key_hash BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  UNIQUE(xftp_host, xftp_port, xftp_key_hash)
-);
-CREATE TABLE rcv_files(
-  rcv_file_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  rcv_file_entity_id BYTEA NOT NULL,
-  user_id BIGINT NOT NULL REFERENCES users ON DELETE CASCADE,
-  size BIGINT NOT NULL,
-  digest BYTEA NOT NULL,
-  key BYTEA NOT NULL,
-  nonce BYTEA NOT NULL,
-  chunk_size BIGINT NOT NULL,
-  prefix_path TEXT NOT NULL,
-  tmp_path TEXT,
-  save_path TEXT NOT NULL,
-  status TEXT NOT NULL,
-  deleted SMALLINT NOT NULL DEFAULT 0,
-  error TEXT,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  save_file_key BYTEA,
-  save_file_nonce BYTEA,
-  failed SMALLINT DEFAULT 0,
-  redirect_id BIGINT REFERENCES rcv_files ON DELETE SET NULL,
-  redirect_entity_id BYTEA,
-  redirect_size BIGINT,
-  redirect_digest BYTEA,
-  approved_relays SMALLINT NOT NULL DEFAULT 0,
-  UNIQUE(rcv_file_entity_id)
-);
-CREATE TABLE rcv_file_chunks(
-  rcv_file_chunk_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  rcv_file_id BIGINT NOT NULL REFERENCES rcv_files ON DELETE CASCADE,
-  chunk_no BIGINT NOT NULL,
-  chunk_size BIGINT NOT NULL,
-  digest BYTEA NOT NULL,
-  tmp_path TEXT,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE rcv_file_chunk_replicas(
-  rcv_file_chunk_replica_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  rcv_file_chunk_id BIGINT NOT NULL REFERENCES rcv_file_chunks ON DELETE CASCADE,
-  replica_number BIGINT NOT NULL,
-  xftp_server_id BIGINT NOT NULL REFERENCES xftp_servers ON DELETE CASCADE,
-  replica_id BYTEA NOT NULL,
-  replica_key BYTEA NOT NULL,
-  received SMALLINT NOT NULL DEFAULT 0,
-  delay BIGINT,
-  retries BIGINT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE snd_files(
-  snd_file_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  snd_file_entity_id BYTEA NOT NULL,
-  user_id BIGINT NOT NULL REFERENCES users ON DELETE CASCADE,
-  num_recipients BIGINT NOT NULL,
-  digest BYTEA,
-  key BYTEA NOT NUll,
-  nonce BYTEA NOT NUll,
-  path TEXT NOT NULL,
-  prefix_path TEXT,
-  status TEXT NOT NULL,
-  deleted SMALLINT NOT NULL DEFAULT 0,
-  error TEXT,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  src_file_key BYTEA,
-  src_file_nonce BYTEA,
-  failed SMALLINT DEFAULT 0,
-  redirect_size BIGINT,
-  redirect_digest BYTEA
-);
-CREATE TABLE snd_file_chunks(
-  snd_file_chunk_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  snd_file_id BIGINT NOT NULL REFERENCES snd_files ON DELETE CASCADE,
-  chunk_no BIGINT NOT NULL,
-  chunk_offset BIGINT NOT NULL,
-  chunk_size BIGINT NOT NULL,
-  digest BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE snd_file_chunk_replicas(
-  snd_file_chunk_replica_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  snd_file_chunk_id BIGINT NOT NULL REFERENCES snd_file_chunks ON DELETE CASCADE,
-  replica_number BIGINT NOT NULL,
-  xftp_server_id BIGINT NOT NULL REFERENCES xftp_servers ON DELETE CASCADE,
-  replica_id BYTEA NOT NULL,
-  replica_key BYTEA NOT NULL,
-  replica_status TEXT NOT NULL,
-  delay BIGINT,
-  retries BIGINT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE snd_file_chunk_replica_recipients(
-  snd_file_chunk_replica_recipient_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  snd_file_chunk_replica_id BIGINT NOT NULL REFERENCES snd_file_chunk_replicas ON DELETE CASCADE,
-  rcv_replica_id BYTEA NOT NULL,
-  rcv_replica_key BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE deleted_snd_chunk_replicas(
-  deleted_snd_chunk_replica_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  user_id BIGINT NOT NULL REFERENCES users ON DELETE CASCADE,
-  xftp_server_id BIGINT NOT NULL REFERENCES xftp_servers ON DELETE CASCADE,
-  replica_id BYTEA NOT NULL,
-  replica_key BYTEA NOT NULL,
-  chunk_digest BYTEA NOT NULL,
-  delay BIGINT,
-  retries BIGINT NOT NULL DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  failed SMALLINT DEFAULT 0
-);
-CREATE TABLE encrypted_rcv_message_hashes(
-  encrypted_rcv_message_hash_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  hash BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE processed_ratchet_key_hashes(
-  processed_ratchet_key_hash_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  conn_id BYTEA NOT NULL REFERENCES connections ON DELETE CASCADE,
-  hash BYTEA NOT NULL,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE TABLE servers_stats(
-  servers_stats_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  servers_stats TEXT,
-  started_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now()),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-INSERT INTO servers_stats DEFAULT VALUES;
-CREATE TABLE ntf_tokens_to_delete(
-  ntf_token_to_delete_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  ntf_host TEXT NOT NULL,
-  ntf_port TEXT NOT NULL,
-  ntf_key_hash BYTEA NOT NULL,
-  tkn_id BYTEA NOT NULL,
-  tkn_priv_key BYTEA NOT NULL,
-  del_failed SMALLINT DEFAULT 0,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT (now())
-);
-CREATE UNIQUE INDEX idx_rcv_queues_ntf ON rcv_queues(host, port, ntf_id);
-CREATE UNIQUE INDEX idx_rcv_queue_id ON rcv_queues(conn_id, rcv_queue_id);
-CREATE UNIQUE INDEX idx_snd_queue_id ON snd_queues(conn_id, snd_queue_id);
-CREATE INDEX idx_snd_message_deliveries ON snd_message_deliveries(
-  conn_id,
-  snd_queue_id
-);
-CREATE INDEX idx_connections_user ON connections(user_id);
-CREATE INDEX idx_commands_conn_id ON commands(conn_id);
-CREATE INDEX idx_commands_host_port ON commands(host, port);
-CREATE INDEX idx_conn_confirmations_conn_id ON conn_confirmations(conn_id);
-CREATE INDEX idx_conn_invitations_contact_conn_id ON conn_invitations(
-  contact_conn_id
-);
-CREATE INDEX idx_messages_conn_id_internal_snd_id ON messages(
-  conn_id,
-  internal_snd_id
-);
-CREATE INDEX idx_messages_conn_id_internal_rcv_id ON messages(
-  conn_id,
-  internal_rcv_id
-);
-CREATE INDEX idx_messages_conn_id ON messages(conn_id);
-CREATE INDEX idx_ntf_subscriptions_ntf_host_ntf_port ON ntf_subscriptions(
-  ntf_host,
-  ntf_port
-);
-CREATE INDEX idx_ntf_subscriptions_smp_host_smp_port ON ntf_subscriptions(
-  smp_host,
-  smp_port
-);
-CREATE INDEX idx_ntf_tokens_ntf_host_ntf_port ON ntf_tokens(
-  ntf_host,
-  ntf_port
-);
-CREATE INDEX idx_ratchets_conn_id ON ratchets(conn_id);
-CREATE INDEX idx_rcv_messages_conn_id_internal_id ON rcv_messages(
-  conn_id,
-  internal_id
-);
-CREATE INDEX idx_skipped_messages_conn_id ON skipped_messages(conn_id);
-CREATE INDEX idx_snd_message_deliveries_conn_id_internal_id ON snd_message_deliveries(
-  conn_id,
-  internal_id
-);
-CREATE INDEX idx_snd_messages_conn_id_internal_id ON snd_messages(
-  conn_id,
-  internal_id
-);
-CREATE INDEX idx_snd_queues_host_port ON snd_queues(host, port);
-CREATE INDEX idx_rcv_files_user_id ON rcv_files(user_id);
-CREATE INDEX idx_rcv_file_chunks_rcv_file_id ON rcv_file_chunks(rcv_file_id);
-CREATE INDEX idx_rcv_file_chunk_replicas_rcv_file_chunk_id ON rcv_file_chunk_replicas(
-  rcv_file_chunk_id
-);
-CREATE INDEX idx_rcv_file_chunk_replicas_xftp_server_id ON rcv_file_chunk_replicas(
-  xftp_server_id
-);
-CREATE INDEX idx_snd_files_user_id ON snd_files(user_id);
-CREATE INDEX idx_snd_file_chunks_snd_file_id ON snd_file_chunks(snd_file_id);
-CREATE INDEX idx_snd_file_chunk_replicas_snd_file_chunk_id ON snd_file_chunk_replicas(
-  snd_file_chunk_id
-);
-CREATE INDEX idx_snd_file_chunk_replicas_xftp_server_id ON snd_file_chunk_replicas(
-  xftp_server_id
-);
-CREATE INDEX idx_snd_file_chunk_replica_recipients_snd_file_chunk_replica_id ON snd_file_chunk_replica_recipients(
-  snd_file_chunk_replica_id
-);
-CREATE INDEX idx_deleted_snd_chunk_replicas_user_id ON deleted_snd_chunk_replicas(
-  user_id
-);
-CREATE INDEX idx_deleted_snd_chunk_replicas_xftp_server_id ON deleted_snd_chunk_replicas(
-  xftp_server_id
-);
-CREATE INDEX idx_rcv_file_chunk_replicas_pending ON rcv_file_chunk_replicas(
-  received,
-  replica_number
-);
-CREATE INDEX idx_snd_file_chunk_replicas_pending ON snd_file_chunk_replicas(
-  replica_status,
-  replica_number
-);
-CREATE INDEX idx_deleted_snd_chunk_replicas_pending ON deleted_snd_chunk_replicas(
-  created_at
-);
-CREATE INDEX idx_encrypted_rcv_message_hashes_hash ON encrypted_rcv_message_hashes(
-  conn_id,
-  hash
-);
-CREATE INDEX idx_processed_ratchet_key_hashes_hash ON processed_ratchet_key_hashes(
-  conn_id,
-  hash
-);
-CREATE INDEX idx_snd_messages_rcpt_internal_id ON snd_messages(
-  conn_id,
-  rcpt_internal_id
-);
-CREATE INDEX idx_processed_ratchet_key_hashes_created_at ON processed_ratchet_key_hashes(
-  created_at
-);
-CREATE INDEX idx_encrypted_rcv_message_hashes_created_at ON encrypted_rcv_message_hashes(
-  created_at
-);
-CREATE INDEX idx_messages_internal_ts ON messages(internal_ts);
-CREATE INDEX idx_commands_server_commands ON commands(
-  host,
-  port,
-  created_at,
-  command_id
-);
-CREATE INDEX idx_rcv_files_status_created_at ON rcv_files(status, created_at);
-CREATE INDEX idx_snd_files_status_created_at ON snd_files(status, created_at);
-CREATE INDEX idx_snd_files_snd_file_entity_id ON snd_files(snd_file_entity_id);
-CREATE INDEX idx_messages_snd_expired ON messages(
-  conn_id,
-  internal_snd_id,
-  internal_ts
-);
-CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(
-  conn_id,
-  snd_queue_id,
-  failed,
-  internal_id
-);
-CREATE INDEX idx_rcv_files_redirect_id on rcv_files(redirect_id);
-|]
@@ -1,35 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250203_msg_bodies where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20250203_msg_bodies :: Text
-m20250203_msg_bodies =
-  [r|
-ALTER TABLE snd_messages ADD COLUMN msg_encrypt_key BYTEA;
-ALTER TABLE snd_messages ADD COLUMN padded_msg_len BIGINT;
-
-
-CREATE TABLE snd_message_bodies (
-  snd_message_body_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  agent_msg BYTEA NOT NULL DEFAULT ''::BYTEA
-);
-ALTER TABLE snd_messages ADD COLUMN snd_message_body_id BIGINT REFERENCES snd_message_bodies ON DELETE SET NULL;
-CREATE INDEX idx_snd_messages_snd_message_body_id ON snd_messages(snd_message_body_id);
-|]
-
-
-down_m20250203_msg_bodies :: Text
-down_m20250203_msg_bodies =
-  [r|
-DROP INDEX idx_snd_messages_snd_message_body_id;
-ALTER TABLE snd_messages DROP COLUMN snd_message_body_id;
-DROP TABLE snd_message_bodies;
-
-
-ALTER TABLE snd_messages DROP COLUMN msg_encrypt_key;
-ALTER TABLE snd_messages DROP COLUMN padded_msg_len;
-|]
@@ -1,61 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250322_short_links where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20250322_short_links :: Text
-m20250322_short_links =
-  [r|
-ALTER TABLE rcv_queues ADD COLUMN link_id BYTEA;
-ALTER TABLE rcv_queues ADD COLUMN link_key BYTEA;
-ALTER TABLE rcv_queues ADD COLUMN link_priv_sig_key BYTEA;
-ALTER TABLE rcv_queues ADD COLUMN link_enc_fixed_data BYTEA;
-
-CREATE UNIQUE INDEX idx_rcv_queues_link_id ON rcv_queues(host, port, link_id);
-
-ALTER TABLE rcv_queues ADD COLUMN queue_mode TEXT;
-UPDATE rcv_queues SET queue_mode = 'M' WHERE snd_secure = 1;
-ALTER TABLE rcv_queues DROP COLUMN snd_secure;
-
-ALTER TABLE snd_queues ADD COLUMN queue_mode TEXT;
-UPDATE snd_queues SET queue_mode = 'M' WHERE snd_secure = 1;
-ALTER TABLE snd_queues DROP COLUMN snd_secure;
-
-CREATE TABLE inv_short_links(
-  inv_short_link_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  server_key_hash BYTEA,
-  link_id BYTEA NOT NULL,
-  link_key BYTEA NOT NULL,
-  snd_private_key BYTEA NOT NULL,
-  snd_id BYTEA,
-  FOREIGN KEY(host, port) REFERENCES servers ON DELETE RESTRICT ON UPDATE CASCADE
-);
-
-CREATE UNIQUE INDEX idx_inv_short_links_link_id ON inv_short_links(host, port, link_id);
-|]
-
-down_m20250322_short_links :: Text
-down_m20250322_short_links =
-  [r|
-DROP INDEX idx_rcv_queues_link_id;
-ALTER TABLE rcv_queues DROP COLUMN link_id;
-ALTER TABLE rcv_queues DROP COLUMN link_key;
-ALTER TABLE rcv_queues DROP COLUMN link_priv_sig_key;
-ALTER TABLE rcv_queues DROP COLUMN link_enc_fixed_data;
-
-DROP INDEX idx_inv_short_links_link_id;
-DROP TABLE inv_short_links;
-
-ALTER TABLE rcv_queues ADD COLUMN snd_secure INTEGER NOT NULL DEFAULT 0;
-UPDATE rcv_queues SET snd_secure = 1 WHERE queue_mode = 'M';
-ALTER TABLE rcv_queues DROP COLUMN queue_mode;
-
-ALTER TABLE snd_queues ADD COLUMN snd_secure INTEGER NOT NULL DEFAULT 0;
-UPDATE snd_queues SET snd_secure = 1 WHERE queue_mode = 'M';
-ALTER TABLE snd_queues DROP COLUMN queue_mode;
-|]
@@ -1,35 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20250702_conn_invitations_remove_cascade_delete where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20250702_conn_invitations_remove_cascade_delete :: Text
-m20250702_conn_invitations_remove_cascade_delete =
-  [r|
-ALTER TABLE conn_invitations DROP CONSTRAINT conn_invitations_contact_conn_id_fkey;
-
-ALTER TABLE conn_invitations ALTER COLUMN contact_conn_id DROP NOT NULL;
-
-ALTER TABLE conn_invitations
-  ADD CONSTRAINT conn_invitations_contact_conn_id_fkey
-  FOREIGN KEY (contact_conn_id)
-  REFERENCES connections(conn_id)
-  ON DELETE SET NULL;
-|]
-
-down_m20250702_conn_invitations_remove_cascade_delete :: Text
-down_m20250702_conn_invitations_remove_cascade_delete =
-  [r|
-ALTER TABLE conn_invitations DROP CONSTRAINT conn_invitations_contact_conn_id_fkey;
-
-ALTER TABLE conn_invitations ALTER COLUMN contact_conn_id SET NOT NULL;
-
-ALTER TABLE conn_invitations
-  ADD CONSTRAINT conn_invitations_contact_conn_id_fkey
-  FOREIGN KEY (contact_conn_id)
-  REFERENCES connections(conn_id)
-  ON DELETE CASCADE;
-|]
@@ -1,21 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251009_queue_to_subscribe where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20251009_queue_to_subscribe :: Text
-m20251009_queue_to_subscribe =
-  [r|
-ALTER TABLE rcv_queues ADD COLUMN to_subscribe SMALLINT NOT NULL DEFAULT 0;
-CREATE INDEX idx_rcv_queues_to_subscribe ON rcv_queues(to_subscribe);
-|]
-
-down_m20251009_queue_to_subscribe :: Text
-down_m20251009_queue_to_subscribe =
-  [r|
-DROP INDEX idx_rcv_queues_to_subscribe;
-ALTER TABLE rcv_queues DROP COLUMN to_subscribe;
-|]
@@ -1,40 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Migrations.M20251010_client_notices where
-
-import Data.Text (Text)
-import Text.RawString.QQ (r)
-
-m20251010_client_notices :: Text
-m20251010_client_notices =
-  [r|
-CREATE TABLE client_notices(
-  client_notice_id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
-  protocol TEXT NOT NULL,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  entity_id BYTEA NOT NULL,
-  server_key_hash BYTEA,
-  notice_ttl BIGINT,
-  created_at BIGINT NOT NULL,
-  updated_at BIGINT NOT NULL
-);
-
-CREATE UNIQUE INDEX idx_client_notices_entity ON client_notices(protocol, host, port, entity_id);
-
-ALTER TABLE rcv_queues ADD COLUMN client_notice_id BIGINT
-REFERENCES client_notices ON UPDATE RESTRICT ON DELETE SET NULL;
-
-CREATE INDEX idx_rcv_queues_client_notice_id ON rcv_queues(client_notice_id);
-|]
-
-down_m20251010_client_notices :: Text
-down_m20251010_client_notices =
-  [r|
-DROP INDEX idx_rcv_queues_client_notice_id;
-ALTER TABLE rcv_queues DROP COLUMN client_notice_id;
-
-DROP INDEX idx_client_notices_entity;
-DROP TABLE client_notices;
-|]
@@ -1,12 +0,0 @@
-module Simplex.Messaging.Agent.Store.Postgres.Options where
-
-import Data.ByteString (ByteString)
-import Numeric.Natural
-
-data DBOpts = DBOpts
-  { connstr :: ByteString,
-    schema :: ByteString,
-    poolSize :: Natural,
-    createSchema :: Bool
-  }
-  deriving (Show)
@@ -1,100 +0,0 @@
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE QuasiQuotes #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-
-module Simplex.Messaging.Agent.Store.Postgres.Util
-  ( createDBAndUserIfNotExists,
-    dropSchema,
-    dropAllSchemasExceptSystem,
-    dropDatabaseAndUser,
-  )
-where
-
-import Control.Exception (bracket)
-import Control.Monad (forM_, unless, void, when)
-import Data.String (fromString)
-import Database.PostgreSQL.Simple (ConnectInfo (..), Only (..), defaultConnectInfo)
-import qualified Database.PostgreSQL.Simple as PSQL
-import Database.PostgreSQL.Simple.SqlQQ (sql)
-
-createDBAndUserIfNotExists :: ConnectInfo -> IO ()
-createDBAndUserIfNotExists ConnectInfo {connectUser = user, connectDatabase = dbName} = do
-  -- connect to the default "postgres" maintenance database
-  bracket (PSQL.connect defaultConnectInfo {connectUser = "postgres", connectDatabase = "postgres"}) PSQL.close $
-    \postgresDB -> do
-      void $ PSQL.execute_ postgresDB "SET client_min_messages TO WARNING"
-      -- check if the user exists, create if not
-      [Only userExists] <-
-        PSQL.query
-          postgresDB
-          [sql|
-            SELECT EXISTS (
-              SELECT 1 FROM pg_catalog.pg_roles
-              WHERE rolname = ?
-            )
-          |]
-          (Only user)
-      unless userExists $ void $ PSQL.execute_ postgresDB (fromString $ "CREATE USER " <> user)
-      -- check if the database exists, create if not
-      dbExists <- checkDBExists postgresDB dbName
-      unless dbExists $ void $ PSQL.execute_ postgresDB (fromString $ "CREATE DATABASE " <> dbName <> " OWNER " <> user)
-
-checkDBExists :: PSQL.Connection -> String -> IO Bool
-checkDBExists postgresDB dbName = do
-  [Only dbExists] <-
-    PSQL.query
-      postgresDB
-      [sql|
-        SELECT EXISTS (
-          SELECT 1 FROM pg_catalog.pg_database
-          WHERE datname = ?
-        )
-      |]
-      (Only dbName)
-  pure dbExists
-
-dropSchema :: ConnectInfo -> String -> IO ()
-dropSchema connectInfo schema =
-  bracket (PSQL.connect connectInfo) PSQL.close $
-    \db -> do
-      void $ PSQL.execute_ db "SET client_min_messages TO WARNING"
-      void $ PSQL.execute_ db (fromString $ "DROP SCHEMA IF EXISTS " <> schema <> " CASCADE")
-
-dropAllSchemasExceptSystem :: ConnectInfo -> IO ()
-dropAllSchemasExceptSystem connectInfo =
-  bracket (PSQL.connect connectInfo) PSQL.close $
-    \db -> do
-      void $ PSQL.execute_ db "SET client_min_messages TO WARNING"
-      schemaNames :: [Only String] <-
-        PSQL.query_
-          db
-          [sql|
-            SELECT schema_name
-            FROM information_schema.schemata
-            WHERE schema_name NOT IN ('public', 'pg_catalog', 'information_schema')
-          |]
-      forM_ schemaNames $ \(Only schema) ->
-        PSQL.execute_ db (fromString $ "DROP SCHEMA " <> schema <> " CASCADE")
-
-dropDatabaseAndUser :: ConnectInfo -> IO ()
-dropDatabaseAndUser ConnectInfo {connectUser = user, connectDatabase = dbName} =
-  bracket (PSQL.connect defaultConnectInfo {connectUser = "postgres", connectDatabase = "postgres"}) PSQL.close $
-    \postgresDB -> do
-      void $ PSQL.execute_ postgresDB "SET client_min_messages TO WARNING"
-      dbExists <- checkDBExists postgresDB dbName
-      when dbExists $ do
-        void $ PSQL.execute_ postgresDB (fromString $ "ALTER DATABASE " <> dbName <> " WITH ALLOW_CONNECTIONS false")
-        -- terminate all connections to the database
-        _r :: [Only Bool] <-
-          PSQL.query
-            postgresDB
-            [sql|
-              SELECT pg_terminate_backend(pg_stat_activity.pid)
-              FROM pg_stat_activity
-              WHERE datname = ?
-                AND pid <> pg_backend_pid()
-            |]
-            (Only dbName)
-        void $ PSQL.execute_ postgresDB (fromString $ "DROP DATABASE " <> dbName)
-      void $ PSQL.execute_ postgresDB (fromString $ "DROP USER IF EXISTS " <> user)
@@ -4,8 +4,7 @@
 {-# LANGUAGE ScopedTypeVariables #-}

 module Simplex.Messaging.Agent.Store.SQLite.Common
-  ( DBStore (..),
-    DBOpts (..),
+  ( SQLiteStore (..),
    withConnection,
    withConnection',
    withTransaction,
@@ -31,7 +30,7 @@ import UnliftIO.STM
 storeKey :: ScrubbedBytes -> Bool -> Maybe ScrubbedBytes
 storeKey key keepKey = if keepKey || BA.null key then Just key else Nothing

-data DBStore = DBStore
+data SQLiteStore = SQLiteStore
  { dbFilePath :: FilePath,
    dbKey :: TVar (Maybe ScrubbedBytes),
    dbSem :: TVar Int,
@@ -40,16 +39,8 @@ data DBStore = DBStore
    dbNew :: Bool
  }

-data DBOpts = DBOpts
-  { dbFilePath :: FilePath,
-    dbKey :: ScrubbedBytes,
-    keepKey :: Bool,
-    vacuum :: Bool,
-    track :: DB.TrackQueries
-  }
-
-withConnectionPriority :: DBStore -> Bool -> (DB.Connection -> IO a) -> IO a
-withConnectionPriority DBStore {dbSem, dbConnection} priority action
+withConnectionPriority :: SQLiteStore -> Bool -> (DB.Connection -> IO a) -> IO a
+withConnectionPriority SQLiteStore {dbSem, dbConnection} priority action
  | priority = E.bracket_ signal release $ withMVar dbConnection action
  | otherwise = lowPriority
  where
@@ -59,20 +50,20 @@ withConnectionPriority DBStore {dbSem, dbConnection} priority action
    wait = unlessM free $ atomically $ unlessM ((0 ==) <$> readTVar dbSem) retry
    free = (0 ==) <$> readTVarIO dbSem

-withConnection :: DBStore -> (DB.Connection -> IO a) -> IO a
+withConnection :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
 withConnection st = withConnectionPriority st False

-withConnection' :: DBStore -> (SQL.Connection -> IO a) -> IO a
+withConnection' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
 withConnection' st action = withConnection st $ action . DB.conn

-withTransaction' :: DBStore -> (SQL.Connection -> IO a) -> IO a
+withTransaction' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
 withTransaction' st action = withTransaction st $ action . DB.conn

-withTransaction :: DBStore -> (DB.Connection -> IO a) -> IO a
+withTransaction :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
 withTransaction st = withTransactionPriority st False
 {-# INLINE withTransaction #-}

-withTransactionPriority :: DBStore -> Bool -> (DB.Connection -> IO a) -> IO a
+withTransactionPriority :: SQLiteStore -> Bool -> (DB.Connection -> IO a) -> IO a
 withTransactionPriority st priority action = withConnectionPriority st priority $ dbBusyLoop . transaction
  where
    transaction db@DB.Connection {conn} = SQL.withImmediateTransaction conn $ action db
@@ -1,69 +1,45 @@
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DerivingStrategies #-}
-{-# LANGUAGE GeneralizedNewtypeDeriving #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE StrictData #-}
 {-# LANGUAGE TemplateHaskell #-}

 module Simplex.Messaging.Agent.Store.SQLite.DB
-  ( BoolInt (..),
-    Binary (..),
-    Connection (..),
+  ( Connection (..),
    SlowQueryStats (..),
-    TrackQueries (..),
-    FromField (..),
-    ToField (..),
    open,
    close,
    execute,
    execute_,
+    executeNamed,
    executeMany,
    query,
    query_,
-    blobFieldDecoder,
-    fromTextField_,
+    queryNamed,
  )
 where

 import Control.Concurrent.STM
-import Control.Exception
 import Control.Monad (when)
+import Control.Exception
 import qualified Data.Aeson.TH as J
-import Data.ByteString (ByteString)
 import Data.Int (Int64)
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
 import Data.Text (Text)
-import qualified Data.Text as T
 import Data.Time (diffUTCTime, getCurrentTime)
-import Data.Typeable (Typeable)
-import Database.SQLite.Simple (FromRow, ResultError (..), Query, SQLData (..), ToRow)
+import Database.SQLite.Simple (FromRow, NamedParam, Query, ToRow)
 import qualified Database.SQLite.Simple as SQL
-import Database.SQLite.Simple.FromField (FieldParser, FromField (..), returnError)
-import Database.SQLite.Simple.Internal (Field (..))
-import Database.SQLite.Simple.Ok (Ok (Ok))
-import Database.SQLite.Simple.ToField (ToField (..))
 import Simplex.Messaging.Parsers (defaultJSON)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (diffToMicroseconds, tshow)
-
-newtype BoolInt = BI {unBI :: Bool}
-  deriving newtype (FromField, ToField)
-
-newtype Binary a = Binary {fromBinary :: a}
-  deriving newtype (FromField, ToField)
+import Simplex.Messaging.Util (diffToMilliseconds, tshow)

 data Connection = Connection
  { conn :: SQL.Connection,
-    track :: TrackQueries,
    slow :: TMap Query SlowQueryStats
  }

-data TrackQueries = TQAll | TQSlow Int64 | TQOff
-  deriving (Eq)
-
 data SlowQueryStats = SlowQueryStats
  { count :: Int64,
    timeMax :: Int64,
@@ -72,29 +48,21 @@ data SlowQueryStats = SlowQueryStats
  }
  deriving (Show)

-timeIt :: Connection -> Query -> IO a -> IO a
-timeIt Connection {slow, track} sql a
-  | track == TQOff = makeQuery
-  | otherwise = do
-      t <- getCurrentTime
-      r <- makeQuery
-      t' <- getCurrentTime
-      let diff = diffToMicroseconds $ diffUTCTime t' t
-      when (trackQuery diff) $ atomically $ TM.alter (updateQueryStats diff) sql slow
-      pure r
+timeIt :: TMap Query SlowQueryStats -> Query -> IO a -> IO a
+timeIt slow sql a = do
+  t <- getCurrentTime
+  r <- a `catch` \e -> do
+    atomically $ TM.alter (Just . updateQueryErrors e) sql slow
+    throwIO e
+  t' <- getCurrentTime
+  let diff = diffToMilliseconds $ diffUTCTime t' t
+  when (diff > 1) $ atomically $ TM.alter (updateQueryStats diff) sql slow
+  pure r
  where
-    makeQuery =
-      a `catch` \e -> do
-        atomically $ TM.alter (Just . updateQueryErrors e) sql slow
-        throwIO e
-    trackQuery diff = case track of
-      TQOff -> False
-      TQSlow t -> diff > t
-      TQAll -> True
    updateQueryErrors :: SomeException -> Maybe SlowQueryStats -> SlowQueryStats
    updateQueryErrors e Nothing = SlowQueryStats 0 0 0 $ M.singleton (tshow e) 1
-    updateQueryErrors e (Just st@SlowQueryStats {errs}) =
-      st {errs = M.alter (Just . maybe 1 (+ 1)) (tshow e) errs}
+    updateQueryErrors e (Just stats@SlowQueryStats {errs}) =
+      stats {errs = M.alter (Just . maybe 1 (+ 1)) (tshow e) errs}
    updateQueryStats :: Int64 -> Maybe SlowQueryStats -> Maybe SlowQueryStats
    updateQueryStats diff Nothing = Just $ SlowQueryStats 1 diff diff M.empty
    updateQueryStats diff (Just SlowQueryStats {count, timeMax, timeAvg, errs}) =
@@ -106,49 +74,41 @@ timeIt Connection {slow, track} sql a
            errs
          }

-open :: String -> TrackQueries -> IO Connection
-open f track = do
+open :: String -> IO Connection
+open f = do
  conn <- SQL.open f
  slow <- TM.emptyIO
-  pure Connection {conn, slow, track}
+  pure Connection {conn, slow}

 close :: Connection -> IO ()
 close = SQL.close . conn

 execute :: ToRow q => Connection -> Query -> q -> IO ()
-execute c sql = timeIt c sql . SQL.execute (conn c) sql
+execute Connection {conn, slow} sql = timeIt slow sql . SQL.execute conn sql
 {-# INLINE execute #-}

 execute_ :: Connection -> Query -> IO ()
-execute_ c sql = timeIt c sql $ SQL.execute_ (conn c) sql
+execute_ Connection {conn, slow} sql = timeIt slow sql $ SQL.execute_ conn sql
 {-# INLINE execute_ #-}

+executeNamed :: Connection -> Query -> [NamedParam] -> IO ()
+executeNamed Connection {conn, slow} sql = timeIt slow sql . SQL.executeNamed conn sql
+{-# INLINE executeNamed #-}
+
 executeMany :: ToRow q => Connection -> Query -> [q] -> IO ()
-executeMany c sql = timeIt c sql . SQL.executeMany (conn c) sql
+executeMany Connection {conn, slow} sql = timeIt slow sql . SQL.executeMany conn sql
 {-# INLINE executeMany #-}

 query :: (ToRow q, FromRow r) => Connection -> Query -> q -> IO [r]
-query c sql = timeIt c sql . SQL.query (conn c) sql
+query Connection {conn, slow} sql = timeIt slow sql . SQL.query conn sql
 {-# INLINE query #-}

 query_ :: FromRow r => Connection -> Query -> IO [r]
-query_ c sql = timeIt c sql $ SQL.query_ (conn c) sql
+query_ Connection {conn, slow} sql = timeIt slow sql $ SQL.query_ conn sql
 {-# INLINE query_ #-}

-blobFieldDecoder :: Typeable k => (ByteString -> Either String k) -> FieldParser k
-blobFieldDecoder dec = \case
-  f@(Field (SQLBlob b) _) ->
-    case dec b of
-      Right k -> Ok k
-      Left e -> returnError ConversionFailed f ("couldn't parse field: " ++ e)
-  f -> returnError ConversionFailed f "expecting SQLBlob column type"
-
-fromTextField_ :: Typeable a => (Text -> Maybe a) -> Field -> Ok a
-fromTextField_ fromText = \case
-  f@(Field (SQLText t) _) ->
-    case fromText t of
-      Just x -> Ok x
-      _ -> returnError ConversionFailed f ("invalid text: " <> T.unpack t)
-  f -> returnError ConversionFailed f "expecting SQLText column type"
+queryNamed :: FromRow r => Connection -> Query -> [NamedParam] -> IO [r]
+queryNamed Connection {conn, slow} sql = timeIt slow sql . SQL.queryNamed conn sql
+{-# INLINE queryNamed #-}

 $(J.deriveJSON defaultJSON ''SlowQueryStats)
@@ -5,77 +5,210 @@
 {-# LANGUAGE QuasiQuotes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE StrictData #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TupleSections #-}

 module Simplex.Messaging.Agent.Store.SQLite.Migrations
-  ( initialize,
+  ( Migration (..),
+    MigrationsToRun (..),
+    MTRError (..),
+    DownMigration (..),
+    app,
+    initialize,
+    get,
    run,
-    getCurrentMigrations,
+    getCurrent,
+    mtrErrorDescription,
+    -- for unit tests
+    migrationsToRun,
+    toDownMigration,
  )
 where

 import Control.Monad (forM_, when)
+import qualified Data.Aeson.TH as J
+import Data.List (intercalate, sortOn)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.Map.Strict as M
-import Data.Maybe (fromMaybe)
+import Data.Maybe (isNothing, mapMaybe)
 import Data.Text (Text)
 import Data.Text.Encoding (decodeLatin1)
 import Data.Time.Clock (getCurrentTime)
-import Database.SQLite.Simple (Only (..), Query (..))
-import qualified Database.SQLite.Simple as SQL
+import Database.SQLite.Simple (Connection, Only (..), Query (..))
+import qualified Database.SQLite.Simple as DB
+import Database.SQLite.Simple.QQ (sql)
 import qualified Database.SQLite3 as SQLite3
 import Simplex.Messaging.Agent.Protocol (extraSMPServerHosts)
-import qualified Simplex.Messaging.Agent.Store.DB as DB
 import Simplex.Messaging.Agent.Store.SQLite.Common
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220608_v2
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220625_v2_ntf_mode
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220811_onion_hosts
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220817_connection_ntfs
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220905_commands
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220915_connection_queues
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230110_users
-import Simplex.Messaging.Agent.Store.Shared
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230117_fkey_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230120_delete_errors
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230217_server_key_hash
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230223_files
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230320_retry_state
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240417_rcv_files_approved_relays
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240624_snd_secure
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240702_servers_stats
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240930_ntf_tokens_to_delete
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241007_rcv_queues_last_broker_ts
 import Simplex.Messaging.Encoding.String
+import Simplex.Messaging.Parsers (dropPrefix, sumTypeJSON)
 import Simplex.Messaging.Transport.Client (TransportHost)

-getCurrentMigrations :: Maybe Query -> DB.Connection -> IO [Migration]
-getCurrentMigrations migrationsTable DB.Connection {DB.conn} =
-  map toMigration
-    <$> SQL.query_ conn ("SELECT name, down FROM " <> table <> " ORDER BY name ASC;")
+data Migration = Migration {name :: String, up :: Text, down :: Maybe Text}
+  deriving (Eq, Show)
+
+schemaMigrations :: [(String, Query, Maybe Query)]
+schemaMigrations =
+  [ ("20220101_initial", m20220101_initial, Nothing),
+    ("20220301_snd_queue_keys", m20220301_snd_queue_keys, Nothing),
+    ("20220322_notifications", m20220322_notifications, Nothing),
+    ("20220607_v2", m20220608_v2, Nothing),
+    ("m20220625_v2_ntf_mode", m20220625_v2_ntf_mode, Nothing),
+    ("m20220811_onion_hosts", m20220811_onion_hosts, Nothing),
+    ("m20220817_connection_ntfs", m20220817_connection_ntfs, Nothing),
+    ("m20220905_commands", m20220905_commands, Nothing),
+    ("m20220915_connection_queues", m20220915_connection_queues, Nothing),
+    ("m20230110_users", m20230110_users, Nothing),
+    ("m20230117_fkey_indexes", m20230117_fkey_indexes, Nothing),
+    ("m20230120_delete_errors", m20230120_delete_errors, Nothing),
+    ("m20230217_server_key_hash", m20230217_server_key_hash, Nothing),
+    ("m20230223_files", m20230223_files, Just down_m20230223_files),
+    ("m20230320_retry_state", m20230320_retry_state, Just down_m20230320_retry_state),
+    ("m20230401_snd_files", m20230401_snd_files, Just down_m20230401_snd_files),
+    ("m20230510_files_pending_replicas_indexes", m20230510_files_pending_replicas_indexes, Just down_m20230510_files_pending_replicas_indexes),
+    ("m20230516_encrypted_rcv_message_hashes", m20230516_encrypted_rcv_message_hashes, Just down_m20230516_encrypted_rcv_message_hashes),
+    ("m20230531_switch_status", m20230531_switch_status, Just down_m20230531_switch_status),
+    ("m20230615_ratchet_sync", m20230615_ratchet_sync, Just down_m20230615_ratchet_sync),
+    ("m20230701_delivery_receipts", m20230701_delivery_receipts, Just down_m20230701_delivery_receipts),
+    ("m20230720_delete_expired_messages", m20230720_delete_expired_messages, Just down_m20230720_delete_expired_messages),
+    ("m20230722_indexes", m20230722_indexes, Just down_m20230722_indexes),
+    ("m20230814_indexes", m20230814_indexes, Just down_m20230814_indexes),
+    ("m20230829_crypto_files", m20230829_crypto_files, Just down_m20230829_crypto_files),
+    ("m20231222_command_created_at", m20231222_command_created_at, Just down_m20231222_command_created_at),
+    ("m20231225_failed_work_items", m20231225_failed_work_items, Just down_m20231225_failed_work_items),
+    ("m20240121_message_delivery_indexes", m20240121_message_delivery_indexes, Just down_m20240121_message_delivery_indexes),
+    ("m20240124_file_redirect", m20240124_file_redirect, Just down_m20240124_file_redirect),
+    ("m20240223_connections_wait_delivery", m20240223_connections_wait_delivery, Just down_m20240223_connections_wait_delivery),
+    ("m20240225_ratchet_kem", m20240225_ratchet_kem, Just down_m20240225_ratchet_kem),
+    ("m20240417_rcv_files_approved_relays", m20240417_rcv_files_approved_relays, Just down_m20240417_rcv_files_approved_relays),
+    ("m20240624_snd_secure", m20240624_snd_secure, Just down_m20240624_snd_secure),
+    ("m20240702_servers_stats", m20240702_servers_stats, Just down_m20240702_servers_stats),
+    ("m20240930_ntf_tokens_to_delete", m20240930_ntf_tokens_to_delete, Just down_m20240930_ntf_tokens_to_delete),
+    ("m20241007_rcv_queues_last_broker_ts", m20241007_rcv_queues_last_broker_ts, Just down_m20241007_rcv_queues_last_broker_ts)
+  ]
+
+-- | The list of migrations in ascending order by date
+app :: [Migration]
+app = sortOn name $ map migration schemaMigrations
+  where
+    migration (name, up, down) = Migration {name, up = fromQuery up, down = fromQuery <$> down}
+
+get :: SQLiteStore -> [Migration] -> IO (Either MTRError MigrationsToRun)
+get st migrations = migrationsToRun migrations <$> withTransaction' st getCurrent
+
+getCurrent :: Connection -> IO [Migration]
+getCurrent db = map toMigration <$> DB.query_ db "SELECT name, down FROM migrations ORDER BY name ASC;"
  where
-    table = fromMaybe "migrations" migrationsTable
    toMigration (name, down) = Migration {name, up = "", down}

-run :: DBStore -> Maybe Query -> Bool -> MigrationsToRun -> IO ()
-run st migrationsTable vacuum = \case
+run :: SQLiteStore -> MigrationsToRun -> IO ()
+run st = \case
  MTRUp [] -> pure ()
-  MTRUp ms -> do
-    mapM_ runUp ms
-    when vacuum $ withConnection' st (`execSQL` "VACUUM;")
+  MTRUp ms -> mapM_ runUp ms >> withConnection' st (`execSQL` "VACUUM;")
  MTRDown ms -> mapM_ runDown $ reverse ms
  MTRNone -> pure ()
  where
-    table = fromMaybe "migrations" migrationsTable
    runUp Migration {name, up, down} = withTransaction' st $ \db -> do
      when (name == "m20220811_onion_hosts") $ updateServers db
      insert db >> execSQL db up'
      where
-        insert db = SQL.execute db ("INSERT INTO " <> table <> " (name, down, ts) VALUES (?,?,?)") . (name,down,) =<< getCurrentTime
+        insert db = DB.execute db "INSERT INTO migrations (name, down, ts) VALUES (?,?,?)" . (name,down,) =<< getCurrentTime
        up'
          | dbNew st && name == "m20230110_users" = fromQuery new_m20230110_users
          | otherwise = up
        updateServers db = forM_ (M.assocs extraSMPServerHosts) $ \(h, h') ->
          let hs = decodeLatin1 . strEncode $ ([h, h'] :: NonEmpty TransportHost)
-           in SQL.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
+           in DB.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
    runDown DownMigration {downName, downQuery} = withTransaction' st $ \db -> do
      execSQL db downQuery
-      SQL.execute db ("DELETE FROM " <> table <> " WHERE name = ?") (Only downName)
-    execSQL db = SQLite3.exec $ SQL.connectionHandle db
+      DB.execute db "DELETE FROM migrations WHERE name = ?" (Only downName)
+    execSQL db = SQLite3.exec $ DB.connectionHandle db

-initialize :: DBStore -> Maybe Query -> IO ()
-initialize st migrationsTable = withTransaction' st $ \db -> do
-  cs :: [Text] <- map fromOnly <$> SQL.query_ db ("SELECT name FROM pragma_table_info('" <> table <> "')")
+initialize :: SQLiteStore -> IO ()
+initialize st = withTransaction' st $ \db -> do
+  cs :: [Text] <- map fromOnly <$> DB.query_ db "SELECT name FROM pragma_table_info('migrations')"
  case cs of
    [] -> createMigrations db
-    _ -> when ("down" `notElem` cs) $ SQL.execute_ db $ "ALTER TABLE " <> table <> " ADD COLUMN down TEXT"
+    _ -> when ("down" `notElem` cs) $ DB.execute_ db "ALTER TABLE migrations ADD COLUMN down TEXT"
  where
-    table = fromMaybe "migrations" migrationsTable
    createMigrations db =
-      SQL.execute_ db $
-        "CREATE TABLE IF NOT EXISTS "
-          <> table
-          <> " (name TEXT NOT NULL PRIMARY KEY, ts TEXT NOT NULL, down TEXT)"
+      DB.execute_
+        db
+        [sql|
+          CREATE TABLE IF NOT EXISTS migrations (
+            name TEXT NOT NULL,
+            ts TEXT NOT NULL,
+            down TEXT,
+            PRIMARY KEY (name)
+          );
+        |]
+
+data DownMigration = DownMigration {downName :: String, downQuery :: Text}
+  deriving (Eq, Show)
+
+toDownMigration :: Migration -> Maybe DownMigration
+toDownMigration Migration {name, down} = DownMigration name <$> down
+
+data MigrationsToRun = MTRUp [Migration] | MTRDown [DownMigration] | MTRNone
+  deriving (Eq, Show)
+
+data MTRError
+  = MTRENoDown {dbMigrations :: [String]}
+  | MTREDifferent {appMigration :: String, dbMigration :: String}
+  deriving (Eq, Show)
+
+mtrErrorDescription :: MTRError -> String
+mtrErrorDescription = \case
+  MTRENoDown ms -> "database version is newer than the app, but no down migration for: " <> intercalate ", " ms
+  MTREDifferent a d -> "different migration in the app/database: " <> a <> " / " <> d
+
+migrationsToRun :: [Migration] -> [Migration] -> Either MTRError MigrationsToRun
+migrationsToRun [] [] = Right MTRNone
+migrationsToRun appMs [] = Right $ MTRUp appMs
+migrationsToRun [] dbMs
+  | length dms == length dbMs = Right $ MTRDown dms
+  | otherwise = Left $ MTRENoDown $ mapMaybe nameNoDown dbMs
+  where
+    dms = mapMaybe toDownMigration dbMs
+    nameNoDown m = if isNothing (down m) then Just $ name m else Nothing
+migrationsToRun (a : as) (d : ds)
+  | name a == name d = migrationsToRun as ds
+  | otherwise = Left $ MTREDifferent (name a) (name d)
+
+$(J.deriveJSON (sumTypeJSON $ dropPrefix "MTRE") ''MTRError)
@@ -1,101 +0,0 @@
-{-# LANGUAGE NamedFieldPuns #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.App (appMigrations) where
-
-import Data.List (sortOn)
-import Database.SQLite.Simple (Query (..))
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220608_v2
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220625_v2_ntf_mode
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220811_onion_hosts
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220817_connection_ntfs
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220905_commands
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220915_connection_queues
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230110_users
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230117_fkey_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230120_delete_errors
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230217_server_key_hash
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230223_files
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230320_retry_state
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230401_snd_files
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_replicas_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240124_file_redirect
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240223_connections_wait_delivery
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240225_ratchet_kem
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240417_rcv_files_approved_relays
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240624_snd_secure
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240702_servers_stats
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240930_ntf_tokens_to_delete
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241007_rcv_queues_last_broker_ts
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241224_ratchet_e2e_snd_params
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250203_msg_bodies
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250322_short_links
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250702_conn_invitations_remove_cascade_delete
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251009_queue_to_subscribe
-import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251010_client_notices
-import Simplex.Messaging.Agent.Store.Shared (Migration (..))
-
-schemaMigrations :: [(String, Query, Maybe Query)]
-schemaMigrations =
-  [ ("20220101_initial", m20220101_initial, Nothing),
-    ("20220301_snd_queue_keys", m20220301_snd_queue_keys, Nothing),
-    ("20220322_notifications", m20220322_notifications, Nothing),
-    ("20220607_v2", m20220608_v2, Nothing),
-    ("m20220625_v2_ntf_mode", m20220625_v2_ntf_mode, Nothing),
-    ("m20220811_onion_hosts", m20220811_onion_hosts, Nothing),
-    ("m20220817_connection_ntfs", m20220817_connection_ntfs, Nothing),
-    ("m20220905_commands", m20220905_commands, Nothing),
-    ("m20220915_connection_queues", m20220915_connection_queues, Nothing),
-    ("m20230110_users", m20230110_users, Nothing),
-    ("m20230117_fkey_indexes", m20230117_fkey_indexes, Nothing),
-    ("m20230120_delete_errors", m20230120_delete_errors, Nothing),
-    ("m20230217_server_key_hash", m20230217_server_key_hash, Nothing),
-    ("m20230223_files", m20230223_files, Just down_m20230223_files),
-    ("m20230320_retry_state", m20230320_retry_state, Just down_m20230320_retry_state),
-    ("m20230401_snd_files", m20230401_snd_files, Just down_m20230401_snd_files),
-    ("m20230510_files_pending_replicas_indexes", m20230510_files_pending_replicas_indexes, Just down_m20230510_files_pending_replicas_indexes),
-    ("m20230516_encrypted_rcv_message_hashes", m20230516_encrypted_rcv_message_hashes, Just down_m20230516_encrypted_rcv_message_hashes),
-    ("m20230531_switch_status", m20230531_switch_status, Just down_m20230531_switch_status),
-    ("m20230615_ratchet_sync", m20230615_ratchet_sync, Just down_m20230615_ratchet_sync),
-    ("m20230701_delivery_receipts", m20230701_delivery_receipts, Just down_m20230701_delivery_receipts),
-    ("m20230720_delete_expired_messages", m20230720_delete_expired_messages, Just down_m20230720_delete_expired_messages),
-    ("m20230722_indexes", m20230722_indexes, Just down_m20230722_indexes),
-    ("m20230814_indexes", m20230814_indexes, Just down_m20230814_indexes),
-    ("m20230829_crypto_files", m20230829_crypto_files, Just down_m20230829_crypto_files),
-    ("m20231222_command_created_at", m20231222_command_created_at, Just down_m20231222_command_created_at),
-    ("m20231225_failed_work_items", m20231225_failed_work_items, Just down_m20231225_failed_work_items),
-    ("m20240121_message_delivery_indexes", m20240121_message_delivery_indexes, Just down_m20240121_message_delivery_indexes),
-    ("m20240124_file_redirect", m20240124_file_redirect, Just down_m20240124_file_redirect),
-    ("m20240223_connections_wait_delivery", m20240223_connections_wait_delivery, Just down_m20240223_connections_wait_delivery),
-    ("m20240225_ratchet_kem", m20240225_ratchet_kem, Just down_m20240225_ratchet_kem),
-    ("m20240417_rcv_files_approved_relays", m20240417_rcv_files_approved_relays, Just down_m20240417_rcv_files_approved_relays),
-    ("m20240624_snd_secure", m20240624_snd_secure, Just down_m20240624_snd_secure),
-    ("m20240702_servers_stats", m20240702_servers_stats, Just down_m20240702_servers_stats),
-    ("m20240930_ntf_tokens_to_delete", m20240930_ntf_tokens_to_delete, Just down_m20240930_ntf_tokens_to_delete),
-    ("m20241007_rcv_queues_last_broker_ts", m20241007_rcv_queues_last_broker_ts, Just down_m20241007_rcv_queues_last_broker_ts),
-    ("m20241224_ratchet_e2e_snd_params", m20241224_ratchet_e2e_snd_params, Just down_m20241224_ratchet_e2e_snd_params),
-    ("m20250203_msg_bodies", m20250203_msg_bodies, Just down_m20250203_msg_bodies),
-    ("m20250322_short_links", m20250322_short_links, Just down_m20250322_short_links),
-    ("m20250702_conn_invitations_remove_cascade_delete", m20250702_conn_invitations_remove_cascade_delete, Just down_m20250702_conn_invitations_remove_cascade_delete),
-    ("m20251009_queue_to_subscribe", m20251009_queue_to_subscribe, Just down_m20251009_queue_to_subscribe),
-    ("m20251010_client_notices", m20251010_client_notices, Just down_m20251010_client_notices)
-  ]
-
-- | The list of migrations in ascending order by date
-appMigrations :: [Migration]
-appMigrations = sortOn name $ map migration schemaMigrations
-  where
-    migration (name, up, down) = Migration {name, up = fromQuery up, down = fromQuery <$> down}
@@ -1,18 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20241224_ratchet_e2e_snd_params where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20241224_ratchet_e2e_snd_params :: Query
-m20241224_ratchet_e2e_snd_params =
-    [sql|
-ALTER TABLE ratchets ADD COLUMN pq_pub_kem BLOB;
-|]
-
-down_m20241224_ratchet_e2e_snd_params :: Query
-down_m20241224_ratchet_e2e_snd_params =
-    [sql|
-ALTER TABLE ratchets DROP COLUMN pq_pub_kem;
-|]
@@ -1,33 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250203_msg_bodies where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20250203_msg_bodies :: Query
-m20250203_msg_bodies =
-    [sql|
-ALTER TABLE snd_messages ADD COLUMN msg_encrypt_key BLOB;
-ALTER TABLE snd_messages ADD COLUMN padded_msg_len INTEGER;
-
-
-CREATE TABLE snd_message_bodies (
-  snd_message_body_id INTEGER PRIMARY KEY,
-  agent_msg BLOB NOT NULL DEFAULT x''
-);
-ALTER TABLE snd_messages ADD COLUMN snd_message_body_id INTEGER REFERENCES snd_message_bodies ON DELETE SET NULL;
-CREATE INDEX idx_snd_messages_snd_message_body_id ON snd_messages(snd_message_body_id);
-|]
-
-down_m20250203_msg_bodies :: Query
-down_m20250203_msg_bodies =
-    [sql|
-DROP INDEX idx_snd_messages_snd_message_body_id;
-ALTER TABLE snd_messages DROP COLUMN snd_message_body_id;
-DROP TABLE snd_message_bodies;
-
-
-ALTER TABLE snd_messages DROP COLUMN msg_encrypt_key;
-ALTER TABLE snd_messages DROP COLUMN padded_msg_len;
-|]
@@ -1,60 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250322_short_links where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20250322_short_links :: Query
-m20250322_short_links =
-  [sql|
-ALTER TABLE rcv_queues ADD COLUMN link_id BLOB;
-ALTER TABLE rcv_queues ADD COLUMN link_key BLOB;
-ALTER TABLE rcv_queues ADD COLUMN link_priv_sig_key BLOB;
-ALTER TABLE rcv_queues ADD COLUMN link_enc_fixed_data BLOB;
-
-CREATE UNIQUE INDEX idx_rcv_queues_link_id ON rcv_queues(host, port, link_id);
-
-ALTER TABLE rcv_queues ADD COLUMN queue_mode TEXT;
-UPDATE rcv_queues SET queue_mode = 'M' WHERE snd_secure = 1;
-ALTER TABLE rcv_queues DROP COLUMN snd_secure;
-
-ALTER TABLE snd_queues ADD COLUMN queue_mode TEXT;
-UPDATE snd_queues SET queue_mode = 'M' WHERE snd_secure = 1;
-ALTER TABLE snd_queues DROP COLUMN snd_secure;
-
-CREATE TABLE inv_short_links(
-  inv_short_link_id INTEGER PRIMARY KEY AUTOINCREMENT,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  server_key_hash BLOB,
-  link_id BLOB NOT NULL,
-  link_key BLOB NOT NULL,
-  snd_private_key BLOB NOT NULL,
-  snd_id BLOB,
-  FOREIGN KEY(host, port) REFERENCES servers ON DELETE RESTRICT ON UPDATE CASCADE
-);
-
-CREATE UNIQUE INDEX idx_inv_short_links_link_id ON inv_short_links(host, port, link_id);
-  |]
-
-down_m20250322_short_links :: Query
-down_m20250322_short_links =
-  [sql|
-DROP INDEX idx_rcv_queues_link_id;
-ALTER TABLE rcv_queues DROP COLUMN link_id;
-ALTER TABLE rcv_queues DROP COLUMN link_key;
-ALTER TABLE rcv_queues DROP COLUMN link_priv_sig_key;
-ALTER TABLE rcv_queues DROP COLUMN link_enc_fixed_data;
-
-DROP INDEX idx_inv_short_links_link_id;
-DROP TABLE inv_short_links;
-
-ALTER TABLE rcv_queues ADD COLUMN snd_secure INTEGER NOT NULL DEFAULT 0;
-UPDATE rcv_queues SET snd_secure = 1 WHERE queue_mode = 'M';
-ALTER TABLE rcv_queues DROP COLUMN queue_mode;
-
-ALTER TABLE snd_queues ADD COLUMN snd_secure INTEGER NOT NULL DEFAULT 0;
-UPDATE snd_queues SET snd_secure = 1 WHERE queue_mode = 'M';
-ALTER TABLE snd_queues DROP COLUMN queue_mode;
-  |]
@@ -1,40 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250517_service_certs where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-- TODO move date forward, create migration for postgres
-m20250517_service_certs :: Query
-m20250517_service_certs =
-  [sql|
-CREATE TABLE server_certs(
-  server_cert_id INTEGER PRIMARY KEY AUTOINCREMENT,
-  user_id INTEGER NOT NULL REFERENCES users ON UPDATE RESTRICT ON DELETE CASCADE,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  certificate BLOB NOT NULL,
-  priv_key BLOB NOT NULL,
-  service_id BLOB,
-  FOREIGN KEY(host, port) REFERENCES servers ON UPDATE CASCADE ON DELETE RESTRICT,
-);
-
-CREATE UNIQUE INDEX idx_server_certs_user_id_host_port ON server_certs(user_id, host, port);
-
-CREATE INDEX idx_server_certs_host_port ON server_certs(host, port);
-
-ALTER TABLE rcv_queues ADD COLUMN rcv_service_id BLOB;
-  |]
-
-down_m20250517_service_certs :: Query
-down_m20250517_service_certs =
-  [sql|
-ALTER TABLE rcv_queues DROP COLUMN rcv_service_id;
-
-DROP INDEX idx_server_certs_host_port;
-
-DROP INDEX idx_server_certs_user_id_host_port;
-
-DROP TABLE server_certs;
-  |]
@@ -1,38 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20250702_conn_invitations_remove_cascade_delete where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20250702_conn_invitations_remove_cascade_delete :: Query
-m20250702_conn_invitations_remove_cascade_delete =
-  [sql|
-PRAGMA writable_schema=1;
-
-UPDATE sqlite_master
-SET sql = replace(
-            sql,
-            'contact_conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE',
-            'contact_conn_id BLOB REFERENCES connections ON DELETE SET NULL'
-          )
-WHERE name = 'conn_invitations' AND type = 'table';
-
-PRAGMA writable_schema=0;
-|]
-
-down_m20250702_conn_invitations_remove_cascade_delete :: Query
-down_m20250702_conn_invitations_remove_cascade_delete =
-  [sql|
-PRAGMA writable_schema=1;
-
-UPDATE sqlite_master
-SET sql = replace(
-            sql,
-            'contact_conn_id BLOB REFERENCES connections ON DELETE SET NULL',
-            'contact_conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE'
-          )
-WHERE name = 'conn_invitations' AND type = 'table';
-
-PRAGMA writable_schema=0;
-|]
@@ -1,20 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251009_queue_to_subscribe where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20251009_queue_to_subscribe :: Query
-m20251009_queue_to_subscribe =
-  [sql|
-ALTER TABLE rcv_queues ADD COLUMN to_subscribe INTEGER NOT NULL DEFAULT 0;
-CREATE INDEX idx_rcv_queues_to_subscribe ON rcv_queues(to_subscribe);
-|]
-
-down_m20251009_queue_to_subscribe :: Query
-down_m20251009_queue_to_subscribe =
-  [sql|
-DROP INDEX idx_rcv_queues_to_subscribe;
-ALTER TABLE rcv_queues DROP COLUMN to_subscribe;
-|]
@@ -1,39 +0,0 @@
-{-# LANGUAGE QuasiQuotes #-}
-
-module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20251010_client_notices where
-
-import Database.SQLite.Simple (Query)
-import Database.SQLite.Simple.QQ (sql)
-
-m20251010_client_notices :: Query
-m20251010_client_notices =
-  [sql|
-CREATE TABLE client_notices(
-  client_notice_id INTEGER PRIMARY KEY AUTOINCREMENT,
-  protocol TEXT NOT NULL,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  entity_id BLOB NOT NULL,
-  server_key_hash BLOB,
-  notice_ttl INTEGER,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-);
-
-CREATE UNIQUE INDEX idx_client_notices_entity ON client_notices(protocol, host, port, entity_id);
-
-ALTER TABLE rcv_queues ADD COLUMN client_notice_id INTEGER
-REFERENCES client_notices ON UPDATE RESTRICT ON DELETE SET NULL;
-
-CREATE INDEX idx_rcv_queues_client_notice_id ON rcv_queues(client_notice_id);
-|]
-
-down_m20251010_client_notices :: Query
-down_m20251010_client_notices =
-  [sql|
-DROP INDEX idx_rcv_queues_client_notice_id;
-ALTER TABLE rcv_queues DROP COLUMN client_notice_id;
-
-DROP INDEX idx_client_notices_entity;
-DROP TABLE client_notices;
-|]
@@ -1,7 +1,8 @@
 CREATE TABLE migrations(
-  name TEXT NOT NULL PRIMARY KEY,
+  name TEXT NOT NULL,
  ts TEXT NOT NULL,
-  down TEXT
+  down TEXT,
+  PRIMARY KEY(name)
 );
 CREATE TABLE servers(
  host TEXT NOT NULL,
@@ -54,15 +55,8 @@ CREATE TABLE rcv_queues(
  server_key_hash BLOB,
  switch_status TEXT,
  deleted INTEGER NOT NULL DEFAULT 0,
+  snd_secure INTEGER NOT NULL DEFAULT 0,
  last_broker_ts TEXT,
-  link_id BLOB,
-  link_key BLOB,
-  link_priv_sig_key BLOB,
-  link_enc_fixed_data BLOB,
-  queue_mode TEXT,
-  to_subscribe INTEGER NOT NULL DEFAULT 0,
-  client_notice_id INTEGER
-  REFERENCES client_notices ON UPDATE RESTRICT ON DELETE SET NULL,
  PRIMARY KEY(host, port, rcv_id),
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE,
@@ -85,7 +79,7 @@ CREATE TABLE snd_queues(
  replace_snd_queue_id INTEGER NULL,
  server_key_hash BLOB,
  switch_status TEXT,
-  queue_mode TEXT,
+  snd_secure INTEGER NOT NULL DEFAULT 0,
  PRIMARY KEY(host, port, snd_id),
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE
@@ -133,9 +127,6 @@ CREATE TABLE snd_messages(
  retry_int_fast INTEGER,
  rcpt_internal_id INTEGER,
  rcpt_status TEXT,
-  msg_encrypt_key BLOB,
-  padded_msg_len INTEGER,
-  snd_message_body_id INTEGER REFERENCES snd_message_bodies ON DELETE SET NULL,
  PRIMARY KEY(conn_id, internal_snd_id),
  FOREIGN KEY(conn_id, internal_id) REFERENCES messages
  ON DELETE CASCADE
@@ -156,7 +147,7 @@ CREATE TABLE conn_confirmations(
 ) WITHOUT ROWID;
 CREATE TABLE conn_invitations(
  invitation_id BLOB NOT NULL PRIMARY KEY,
-  contact_conn_id BLOB REFERENCES connections ON DELETE SET NULL,
+  contact_conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
  cr_invitation BLOB NOT NULL,
  recipient_conn_info BLOB NOT NULL,
  accepted INTEGER NOT NULL DEFAULT 0,
@@ -175,8 +166,7 @@ CREATE TABLE ratchets(
  ,
  x3dh_pub_key_1 BLOB,
  x3dh_pub_key_2 BLOB,
-  pq_priv_kem BLOB,
-  pq_pub_kem BLOB
+  pq_priv_kem BLOB
 ) WITHOUT ROWID;
 CREATE TABLE skipped_messages(
  skipped_message_id INTEGER PRIMARY KEY,
@@ -424,32 +414,6 @@ CREATE TABLE ntf_tokens_to_delete(
 del_failed INTEGER DEFAULT 0,
 created_at TEXT NOT NULL DEFAULT(datetime('now'))
 );
-CREATE TABLE snd_message_bodies(
-  snd_message_body_id INTEGER PRIMARY KEY,
-  agent_msg BLOB NOT NULL DEFAULT x''
-);
-CREATE TABLE inv_short_links(
-  inv_short_link_id INTEGER PRIMARY KEY AUTOINCREMENT,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  server_key_hash BLOB,
-  link_id BLOB NOT NULL,
-  link_key BLOB NOT NULL,
-  snd_private_key BLOB NOT NULL,
-  snd_id BLOB,
-  FOREIGN KEY(host, port) REFERENCES servers ON DELETE RESTRICT ON UPDATE CASCADE
-);
-CREATE TABLE client_notices(
-  client_notice_id INTEGER PRIMARY KEY AUTOINCREMENT,
-  protocol TEXT NOT NULL,
-  host TEXT NOT NULL,
-  port TEXT NOT NULL,
-  entity_id BLOB NOT NULL,
-  server_key_hash BLOB,
-  notice_ttl INTEGER,
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
-);
 CREATE UNIQUE INDEX idx_rcv_queues_ntf ON rcv_queues(host, port, ntf_id);
 CREATE UNIQUE INDEX idx_rcv_queue_id ON rcv_queues(conn_id, rcv_queue_id);
 CREATE UNIQUE INDEX idx_snd_queue_id ON snd_queues(conn_id, snd_queue_id);
@@ -576,20 +540,3 @@ CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(
  internal_id
 );
 CREATE INDEX idx_rcv_files_redirect_id on rcv_files(redirect_id);
-CREATE INDEX idx_snd_messages_snd_message_body_id ON snd_messages(
-  snd_message_body_id
-);
-CREATE UNIQUE INDEX idx_rcv_queues_link_id ON rcv_queues(host, port, link_id);
-CREATE UNIQUE INDEX idx_inv_short_links_link_id ON inv_short_links(
-  host,
-  port,
-  link_id
-);
-CREATE INDEX idx_rcv_queues_to_subscribe ON rcv_queues(to_subscribe);
-CREATE UNIQUE INDEX idx_client_notices_entity ON client_notices(
-  protocol,
-  host,
-  port,
-  entity_id
-);
-CREATE INDEX idx_rcv_queues_client_notice_id ON rcv_queues(client_notice_id);
@@ -1,101 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE TemplateHaskell #-}
-
-module Simplex.Messaging.Agent.Store.Shared
-  ( Migration (..),
-    MigrationsToRun (..),
-    DownMigration (..),
-    MTRError (..),
-    mtrErrorDescription,
-    MigrationConfig (..),
-    MigrationConfirmation (..),
-    MigrationError (..),
-    UpMigration (..),
-    migrationErrorDescription,
-    -- for tests
-    toDownMigration,
-    upMigration,
-  )
-where
-
-import qualified Data.Aeson.TH as J
-import qualified Data.Attoparsec.ByteString.Char8 as A
-import Data.List (intercalate)
-import Data.Maybe (isJust)
-import Data.Text (Text)
-import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (defaultJSON, dropPrefix, sumTypeJSON)
-
-data Migration = Migration {name :: String, up :: Text, down :: Maybe Text}
-  deriving (Eq, Show)
-
-data DownMigration = DownMigration {downName :: String, downQuery :: Text}
-  deriving (Eq, Show)
-
-toDownMigration :: Migration -> Maybe DownMigration
-toDownMigration Migration {name, down} = DownMigration name <$> down
-
-data MigrationsToRun = MTRUp [Migration] | MTRDown [DownMigration] | MTRNone
-  deriving (Eq, Show)
-
-data MTRError
-  = MTRENoDown {dbMigrations :: [String]}
-  | MTREDifferent {appMigration :: String, dbMigration :: String}
-  deriving (Eq, Show)
-
-mtrErrorDescription :: MTRError -> String
-mtrErrorDescription = \case
-  MTRENoDown ms -> "database version is newer than the app, but no down migration for: " <> intercalate ", " ms
-  MTREDifferent a d -> "different migration in the app/database: " <> a <> " / " <> d
-
-data MigrationError
-  = MEUpgrade {upMigrations :: [UpMigration]}
-  | MEDowngrade {downMigrations :: [String]}
-  | MigrationError {mtrError :: MTRError}
-  deriving (Eq, Show)
-
-migrationErrorDescription :: Bool -> MigrationError -> String
-migrationErrorDescription withBackup = \case
-  MEUpgrade ums ->
-    "The app has a newer version than the database.\nConfirm to " <> backupStr <> "upgrade using these migrations: " <> intercalate ", " (map upName ums)
-  MEDowngrade dms ->
-    "Database version is newer than the app.\nConfirm to " <> backupStr <> "downgrade using these migrations: " <> intercalate ", " dms
-  MigrationError err -> mtrErrorDescription err
-  where
-    backupStr = if withBackup then "back up and " else ""
-
-data UpMigration = UpMigration {upName :: String, withDown :: Bool}
-  deriving (Eq, Show)
-
-upMigration :: Migration -> UpMigration
-upMigration Migration {name, down} = UpMigration name $ isJust down
-
-data MigrationConfig = MigrationConfig
-  { confirm :: MigrationConfirmation,
-    backupPath :: Maybe FilePath -- Nothing - no backup, empty string - the same folder
-  }
-
-data MigrationConfirmation = MCYesUp | MCYesUpDown | MCConsole | MCError
-  deriving (Eq, Show)
-
-instance StrEncoding MigrationConfirmation where
-  strEncode = \case
-    MCYesUp -> "yesUp"
-    MCYesUpDown -> "yesUpDown"
-    MCConsole -> "console"
-    MCError -> "error"
-  strP =
-    A.takeByteString >>= \case
-      "yesUp" -> pure MCYesUp
-      "yesUpDown" -> pure MCYesUpDown
-      "console" -> pure MCConsole
-      "error" -> pure MCError
-      _ -> fail "invalid MigrationConfirmation"
-
-$(J.deriveJSON (sumTypeJSON $ dropPrefix "MTRE") ''MTRError)
-
-$(J.deriveJSON defaultJSON ''UpMigration)
-
-$(J.deriveToJSON (sumTypeJSON $ dropPrefix "ME") ''MigrationError)
@@ -0,0 +1,120 @@
+{-# LANGUAGE FlexibleInstances #-}
+{-# LANGUAGE LambdaCase #-}
+
+module Simplex.Messaging.Agent.TRcvQueues
+  ( TRcvQueues (getRcvQueues, getConnections),
+    Queue (..),
+    empty,
+    clear,
+    deleteConn,
+    hasConn,
+    addQueue,
+    batchAddQueues,
+    deleteQueue,
+    hasSessQueues,
+    getSessQueues,
+    getDelSessQueues,
+  )
+where
+
+import Control.Concurrent.STM
+import Data.Foldable (foldl')
+import Data.List.NonEmpty (NonEmpty (..), (<|))
+import qualified Data.List.NonEmpty as L
+import qualified Data.Map.Strict as M
+import Simplex.Messaging.Agent.Protocol (ConnId, UserId)
+import Simplex.Messaging.Agent.Store (RcvQueue, StoredRcvQueue (..))
+import Simplex.Messaging.Protocol (RecipientId, SMPServer)
+import Simplex.Messaging.TMap (TMap)
+import qualified Simplex.Messaging.TMap as TM
+import Simplex.Messaging.Transport
+
+class Queue q where
+  connId' :: q -> ConnId
+  qKey :: q -> (UserId, SMPServer, RecipientId)
+
+-- the fields in this record have the same data with swapped keys for lookup efficiency,
+-- and all methods must maintain this invariant.
+data TRcvQueues q = TRcvQueues
+  { getRcvQueues :: TMap (UserId, SMPServer, RecipientId) q,
+    getConnections :: TMap ConnId (NonEmpty (UserId, SMPServer, RecipientId))
+  }
+
+empty :: IO (TRcvQueues q)
+empty = TRcvQueues <$> TM.emptyIO <*> TM.emptyIO
+
+clear :: TRcvQueues q -> STM ()
+clear (TRcvQueues qs cs) = TM.clear qs >> TM.clear cs
+
+deleteConn :: ConnId -> TRcvQueues q -> STM ()
+deleteConn cId (TRcvQueues qs cs) =
+  TM.lookupDelete cId cs >>= \case
+    Just ks -> modifyTVar' qs $ \qs' -> foldl' (flip M.delete) qs' ks
+    Nothing -> pure ()
+
+hasConn :: ConnId -> TRcvQueues q -> STM Bool
+hasConn cId (TRcvQueues _ cs) = TM.member cId cs
+
+addQueue :: Queue q => q -> TRcvQueues q -> STM ()
+addQueue rq (TRcvQueues qs cs) = do
+  TM.insert k rq qs
+  TM.alter addQ (connId' rq) cs
+  where
+    addQ = Just . maybe (k :| []) (k <|)
+    k = qKey rq
+
+-- Save time by aggregating modifyTVar'
+batchAddQueues :: (Foldable t, Queue q) => TRcvQueues q -> t q -> STM ()
+batchAddQueues (TRcvQueues qs cs) rqs = do
+  modifyTVar' qs $ \now -> foldl' (\rqs' rq -> M.insert (qKey rq) rq rqs') now rqs
+  modifyTVar' cs $ \now -> foldl' (\cs' rq -> M.alter (addQ $ qKey rq) (connId' rq) cs') now rqs
+  where
+    addQ k = Just . maybe (k :| []) (k <|)
+
+deleteQueue :: RcvQueue -> TRcvQueues RcvQueue -> STM ()
+deleteQueue rq (TRcvQueues qs cs) = do
+  TM.delete k qs
+  TM.update delQ (connId rq) cs
+  where
+    delQ = L.nonEmpty . L.filter (/= k)
+    k = qKey rq
+
+hasSessQueues :: (UserId, SMPServer, Maybe ConnId) -> TRcvQueues RcvQueue -> STM Bool
+hasSessQueues tSess (TRcvQueues qs _) = any (`isSession` tSess) <$> readTVar qs
+
+getSessQueues :: (UserId, SMPServer, Maybe ConnId) -> TRcvQueues RcvQueue -> IO [RcvQueue]
+getSessQueues tSess (TRcvQueues qs _) = M.foldl' addQ [] <$> readTVarIO qs
+  where
+    addQ qs' rq = if rq `isSession` tSess then rq : qs' else qs'
+
+getDelSessQueues :: (UserId, SMPServer, Maybe ConnId) -> SessionId -> TRcvQueues (SessionId, RcvQueue) -> STM ([RcvQueue], [ConnId])
+getDelSessQueues tSess sessId' (TRcvQueues qs cs) = do
+  (removedQs, qs'') <- (\qs' -> M.foldl' delQ ([], qs') qs') <$> readTVar qs
+  writeTVar qs $! qs''
+  removedConns <- stateTVar cs $ \cs' -> foldl' delConn ([], cs') removedQs
+  pure (removedQs, removedConns)
+  where
+    delQ acc@(removed, qs') (sessId, rq)
+      | rq `isSession` tSess && sessId == sessId' = (rq : removed, M.delete (qKey rq) qs')
+      | otherwise = acc
+    delConn :: ([ConnId], M.Map ConnId (NonEmpty (UserId, SMPServer, RecipientId))) -> RcvQueue -> ([ConnId], M.Map ConnId (NonEmpty (UserId, SMPServer, RecipientId)))
+    delConn (removed, cs') rq = M.alterF f cId cs'
+      where
+        cId = connId rq
+        f = \case
+          Just ks -> case L.nonEmpty $ L.filter (qKey rq /=) ks of
+            Just ks' -> (removed, Just ks')
+            Nothing -> (cId : removed, Nothing)
+          Nothing -> (removed, Nothing) -- "impossible" in invariant holds, because we get keys from the known queues
+
+isSession :: RcvQueue -> (UserId, SMPServer, Maybe ConnId) -> Bool
+isSession rq (uId, srv, connId_) =
+  userId rq == uId && server rq == srv && maybe True (connId rq ==) connId_
+
+instance Queue RcvQueue where
+  connId' = connId
+  qKey rq = (userId rq, server rq, rcvId rq)
+
+instance Queue (SessionId, RcvQueue) where
+  connId' = connId . snd
+  qKey = qKey . snd
@@ -1,201 +0,0 @@
-{-# LANGUAGE FlexibleInstances #-}
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-
-module Simplex.Messaging.Agent.TSessionSubs
-  ( TSessionSubs (sessionSubs),
-    SessSubs (..),
-    emptyIO,
-    clear,
-    hasActiveSub,
-    hasPendingSub,
-    addPendingSub,
-    setSessionId,
-    addActiveSub,
-    batchAddActiveSubs,
-    batchAddPendingSubs,
-    deletePendingSub,
-    batchDeletePendingSubs,
-    deleteSub,
-    batchDeleteSubs,
-    hasPendingSubs,
-    getPendingSubs,
-    getActiveSubs,
-    setSubsPending,
-    updateClientNotices,
-    foldSessionSubs,
-    mapSubs,
-  )
-where
-
-import Control.Concurrent.STM
-import Control.Monad
-import Data.Int (Int64)
-import Data.List (foldl')
-import Data.Map.Strict (Map)
-import qualified Data.Map.Strict as M
-import Data.Maybe (isJust)
-import qualified Data.Set as S
-import Simplex.Messaging.Agent.Protocol (SMPQueue (..))
-import Simplex.Messaging.Agent.Store (RcvQueueSub (..), SomeRcvQueue)
-import Simplex.Messaging.Client (SMPTransportSession, TransportSessionMode (..))
-import Simplex.Messaging.Protocol (RecipientId)
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Transport
-import Simplex.Messaging.Util (($>>=))
-
-data TSessionSubs = TSessionSubs
-  { sessionSubs :: TMap SMPTransportSession SessSubs
-  }
-
-data SessSubs = SessSubs
-  { subsSessId :: TVar (Maybe SessionId),
-    activeSubs :: TMap RecipientId RcvQueueSub,
-    pendingSubs :: TMap RecipientId RcvQueueSub
-  }
-
-emptyIO :: IO TSessionSubs
-emptyIO = TSessionSubs <$> TM.emptyIO
-{-# INLINE emptyIO #-}
-
-clear :: TSessionSubs -> STM ()
-clear = TM.clear . sessionSubs
-{-# INLINE clear #-}
-
-lookupSubs :: SMPTransportSession -> TSessionSubs -> STM (Maybe SessSubs)
-lookupSubs tSess = TM.lookup tSess . sessionSubs
-{-# INLINE lookupSubs #-}
-
-getSessSubs :: SMPTransportSession -> TSessionSubs -> STM SessSubs
-getSessSubs tSess ss = lookupSubs tSess ss >>= maybe new pure
-  where
-    new = do
-      s <- SessSubs <$> newTVar Nothing <*> newTVar M.empty <*> newTVar M.empty
-      TM.insert tSess s $ sessionSubs ss
-      pure s
-
-hasActiveSub :: SMPTransportSession -> RecipientId -> TSessionSubs -> STM Bool
-hasActiveSub = hasQueue_ activeSubs
-{-# INLINE hasActiveSub #-}
-
-hasPendingSub :: SMPTransportSession -> RecipientId -> TSessionSubs -> STM Bool
-hasPendingSub = hasQueue_ pendingSubs
-{-# INLINE hasPendingSub #-}
-
-hasQueue_ :: (SessSubs -> TMap RecipientId RcvQueueSub) -> SMPTransportSession -> RecipientId -> TSessionSubs -> STM Bool
-hasQueue_ subs tSess rId ss = isJust <$> (lookupSubs tSess ss $>>= TM.lookup rId . subs)
-{-# INLINE hasQueue_ #-}
-
-addPendingSub :: SMPTransportSession -> RcvQueueSub -> TSessionSubs -> STM ()
-addPendingSub tSess rq ss = getSessSubs tSess ss >>= TM.insert (rcvId rq) rq . pendingSubs
-
-setSessionId :: SMPTransportSession -> SessionId -> TSessionSubs -> STM ()
-setSessionId tSess sessId ss = do
-  s <- getSessSubs tSess ss
-  readTVar (subsSessId s) >>= \case
-    Nothing -> writeTVar (subsSessId s) (Just sessId)
-    Just sessId' -> unless (sessId == sessId') $ void $ setSubsPending_ s $ Just sessId
-
-addActiveSub :: SMPTransportSession -> SessionId -> RcvQueueSub -> TSessionSubs -> STM ()
-addActiveSub tSess sessId rq ss = do
-  s <- getSessSubs tSess ss
-  sessId' <- readTVar $ subsSessId s
-  let rId = rcvId rq
-  if Just sessId == sessId'
-    then do
-      TM.insert rId rq $ activeSubs s
-      TM.delete rId $ pendingSubs s
-    else TM.insert rId rq $ pendingSubs s
-
-batchAddActiveSubs :: SMPTransportSession -> SessionId -> [RcvQueueSub] -> TSessionSubs -> STM ()
-batchAddActiveSubs tSess sessId rqs ss = do
-  s <- getSessSubs tSess ss
-  sessId' <- readTVar $ subsSessId s
-  let qs = M.fromList $ map (\rq -> (rcvId rq, rq)) rqs
-  if Just sessId == sessId'
-    then do
-      TM.union qs $ activeSubs s
-      modifyTVar' (pendingSubs s) (`M.difference` qs)
-    else TM.union qs $ pendingSubs s
-
-batchAddPendingSubs :: SMPTransportSession -> [RcvQueueSub] -> TSessionSubs -> STM ()
-batchAddPendingSubs tSess rqs ss = do
-  s <- getSessSubs tSess ss
-  modifyTVar' (pendingSubs s) $ M.union $ M.fromList $ map (\rq -> (rcvId rq, rq)) rqs
-
-deletePendingSub :: SMPTransportSession -> RecipientId -> TSessionSubs -> STM ()
-deletePendingSub tSess rId = lookupSubs tSess >=> mapM_ (TM.delete rId . pendingSubs)
-
-batchDeletePendingSubs :: SMPTransportSession -> S.Set RecipientId -> TSessionSubs -> STM ()
-batchDeletePendingSubs tSess rIds = lookupSubs tSess >=> mapM_ (delete . pendingSubs)
-  where
-    delete = (`modifyTVar'` (`M.withoutKeys` rIds))
-
-deleteSub :: SMPTransportSession -> RecipientId -> TSessionSubs -> STM ()
-deleteSub tSess rId = lookupSubs tSess >=> mapM_ (\s -> TM.delete rId (activeSubs s) >> TM.delete rId (pendingSubs s))
-
-batchDeleteSubs :: SomeRcvQueue q => SMPTransportSession -> [q] -> TSessionSubs -> STM ()
-batchDeleteSubs tSess rqs = lookupSubs tSess >=> mapM_ (\s -> delete (activeSubs s) >> delete (pendingSubs s))
-  where
-    rIds = S.fromList $ map queueId rqs
-    delete = (`modifyTVar'` (`M.withoutKeys` rIds))
-
-hasPendingSubs :: SMPTransportSession -> TSessionSubs -> STM Bool
-hasPendingSubs tSess = lookupSubs tSess >=> maybe (pure False) (fmap (not . null) . readTVar . pendingSubs)
-
-getPendingSubs :: SMPTransportSession -> TSessionSubs -> STM (Map RecipientId RcvQueueSub)
-getPendingSubs = getSubs_ pendingSubs
-{-# INLINE getPendingSubs #-}
-
-getActiveSubs :: SMPTransportSession -> TSessionSubs -> STM (Map RecipientId RcvQueueSub)
-getActiveSubs = getSubs_ activeSubs
-{-# INLINE getActiveSubs #-}
-
-getSubs_ :: (SessSubs -> TMap RecipientId RcvQueueSub) -> SMPTransportSession -> TSessionSubs -> STM (Map RecipientId RcvQueueSub)
-getSubs_ subs tSess = lookupSubs tSess >=> maybe (pure M.empty) (readTVar . subs)
-
-setSubsPending :: TransportSessionMode -> SMPTransportSession -> SessionId -> TSessionSubs -> STM (Map RecipientId RcvQueueSub)
-setSubsPending mode tSess@(uId, srv, connId_) sessId tss@(TSessionSubs ss)
-  | entitySession == isJust connId_ =
-      TM.lookup tSess ss >>= withSessSubs (`setSubsPending_` Nothing)
-  | otherwise =
-      TM.lookupDelete tSess ss >>= withSessSubs setPendingChangeMode
-  where
-    entitySession = mode == TSMEntity
-    sessEntId = if entitySession then Just else const Nothing
-    withSessSubs run = \case
-      Nothing -> pure M.empty
-      Just s -> do
-        sessId' <- readTVar $ subsSessId s
-        if Just sessId == sessId' then run s else pure M.empty
-    setPendingChangeMode s = do
-      subs <- M.union <$> readTVar (activeSubs s) <*> readTVar (pendingSubs s)
-      unless (null subs) $
-        forM_ subs $ \rq -> addPendingSub (uId, srv, sessEntId (connId rq)) rq tss
-      pure subs
-
-setSubsPending_ :: SessSubs -> Maybe SessionId -> STM (Map RecipientId RcvQueueSub)
-setSubsPending_ s sessId_ = do
-  writeTVar (subsSessId s) sessId_
-  let as = activeSubs s
-  subs <- readTVar as
-  unless (null subs) $ do
-    writeTVar as M.empty
-    modifyTVar' (pendingSubs s) $ M.union subs
-  pure subs
-
-updateClientNotices :: SMPTransportSession -> [(RecipientId, Maybe Int64)] -> TSessionSubs -> STM ()
-updateClientNotices tSess noticeIds ss = do
-  s <- getSessSubs tSess ss
-  modifyTVar' (pendingSubs s) $ \m -> foldl' (\m' (rcvId, clientNoticeId) -> M.adjust (\rq -> rq {clientNoticeId}) rcvId m') m noticeIds
-
-foldSessionSubs :: (a -> (SMPTransportSession, SessSubs) -> IO a) -> a -> TSessionSubs -> IO a
-foldSessionSubs f a = foldM f a . M.assocs <=< readTVarIO . sessionSubs
-
-mapSubs :: (Map RecipientId RcvQueueSub -> a) -> SessSubs -> IO (a, a)
-mapSubs f s = do
-  active <- readTVarIO $ activeSubs s
-  pending <- readTVarIO $ pendingSubs s
-  pure (f active, f pending)
--- a/Show More
+++ b/Show More