rename simplexmq-legacy into simplexmq-v0 (#270)

* rename simplexmq-legacy into simplexmq-v0

* split UnliftIO instance of ExceptT

.github/CODEOWNERS

@@ -1,4 +0,0 @@
-* @epoberezkin @spaced4ndy
-/Dockerfile @shumvgolove
-/scripts/docker/ @shumvgolove
-/scripts/main/ @shumvgolove

.github/FUNDING.yml

@@ -1,2 +1 @@
-github: simplex-chat
 open_collective: simplex-chat

.github/actions/swap/action.yml

@@ -1,44 +0,0 @@
-name: 'Set Swap Space'
-description: 'Add moar swap'
-branding:
-  icon: 'crop'
-  color: 'orange'
-inputs:
-  swap-size-gb:
-    description: 'Swap space to create, in Gigabytes.'
-    required: false
-    default: '10'
-runs:
-  using: "composite"
-  steps:
-    - name: Swap space report before modification
-      shell: bash
-      run: |
-        echo "Memory and swap:"
-        free -h
-        echo
-        swapon --show
-        echo
-    - name: Set Swap
-      shell: bash
-      run: |
-          export SWAP_FILE=$(swapon --show=NAME | tail -n 1)
-          echo "Swap file: $SWAP_FILE"
-          if [ -z "$SWAP_FILE" ]; then
-            SWAP_FILE=/opt/swapfile
-          else
-            sudo swapoff $SWAP_FILE
-            sudo rm $SWAP_FILE
-          fi
-          sudo fallocate -l ${{ inputs.swap-size-gb }}G $SWAP_FILE
-          sudo chmod 600 $SWAP_FILE
-          sudo mkswap $SWAP_FILE
-          sudo swapon $SWAP_FILE
-    - name: Swap space report after modification
-      shell: bash
-      run: |
-        echo "Memory and swap:"
-        free -h
-        echo
-        swapon --show
-        echo

.github/changelog_conf.json

@@ -1,4 +1,4 @@
 {
   "template": "${{UNCATEGORIZED}}",
-  "pr_template": "- ${{TITLE}}"
+  "pr_template": "- ${{TITLE}}\n"
 }

.github/workflows/build.yml

@@ -10,25 +10,36 @@ on:
   pull_request:
 
 jobs:
-
-# =============================
-#       Create release
-# =============================
-
-# Create release, but only if it's triggered by tag push.
-# On pull requests/commits push, this job will always complete.
-
-  maybe-release:
-    runs-on: ubuntu-latest
+  build:
+    runs-on: ubuntu-20.04
     steps:
       - name: Clone project
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
 
+      - name: Setup Stack
+        uses: haskell/actions/setup@v1
+        with:
+          ghc-version: '8.8.4'
+          enable-stack: true
+          stack-version: 'latest'
+
+      - name: Cache dependencies
+        uses: actions/cache@v2
+        with:
+          path: ~/.stack
+          key: ${{ hashFiles('stack.yaml') }}
+
+      - name: Build & test
+        id: build_test
+        run: |
+          stack build --test --force-dirty
+          install_root=$(stack path --local-install-root)
+          mv ${install_root}/bin/smp-server smp-server-ubuntu-20_04-x86-64
+      
       - name: Build changelog
-        id: build_changelog
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: simplex-chat/release-changelog-builder-action@v5
+        id: build_changelog
+        uses: mikepenz/release-changelog-builder-action@v1
         with:
           configuration: .github/changelog_conf.json
           failOnError: true
@@ -36,254 +47,18 @@ jobs:
           commitMode: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
+      
       - name: Create release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: simplex-chat/action-gh-release@v2
+        uses: softprops/action-gh-release@v1
         with:
           body: |
             See full changelog [here](https://github.com/simplex-chat/simplexmq/blob/master/CHANGELOG.md).
-
-            Commits:
+            Commits, chronological:
             ${{ steps.build_changelog.outputs.changelog }}
-          prerelease: true
           files: |
             LICENSE
+            smp-server-ubuntu-20_04-x86-64
           fail_on_unmatched_files: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-# =============================
-#        Main build job
-# =============================
-
-  build:
-    name: "ubuntu-${{ matrix.os }}-${{ matrix.arch }}, GHC: ${{ matrix.ghc }}"
-    needs: maybe-release
-    env:
-      apps: "smp-server xftp-server ntf-server xftp"
-    runs-on: ${{ matrix.runner }}
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_HOST_AUTH_METHOD: trust # Allows passwordless access
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-        ports:
-          # Maps tcp port 5432 on service container to the host
-          - 5432:5432
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: 22.04
-            os_underscore: 22_04
-            arch: x86-64
-            runner: "ubuntu-22.04"
-            ghc: "8.10.7"
-            should_run: ${{ !(github.ref == 'refs/heads/stable' || startsWith(github.ref, 'refs/tags/v')) }}
-          - os: 22.04
-            os_underscore: 22_04
-            arch: x86-64
-            runner: "ubuntu-22.04"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 24.04
-            os_underscore: 24_04
-            arch: x86-64
-            runner: "ubuntu-24.04"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 22.04
-            os_underscore: 22_04
-            arch: aarch64
-            runner: "ubuntu-22.04-arm"
-            ghc: "9.6.3"
-            should_run: true
-          - os: 24.04
-            os_underscore: 24_04
-            arch: aarch64
-            runner: "ubuntu-24.04-arm"
-            ghc: "9.6.3"
-            should_run: true
-    steps:
-      - name: Clone project
-        if: matrix.should_run == true
-        uses: actions/checkout@v3
-
-      - name: Set up Docker Buildx
-        if: matrix.should_run == true
-        uses: simplex-chat/docker-setup-buildx-action@v3
-
-      - name: Setup swap
-        if: matrix.ghc == '8.10.7' && matrix.should_run == true
-        uses: ./.github/actions/swap
-        with:
-          swap-size-gb: 20
-
-      - name: Install PostgreSQL 15 client tools
-        if: matrix.os == '22.04' && matrix.should_run == true
-        shell: bash
-        run: |
-          # Import the repository signing key
-          sudo install -d /usr/share/postgresql-common/pgdg
-          sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
-          # Add the PostgreSQL APT repository
-          sudo sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-          # Update repository and install postgresql tools
-          sudo apt update
-          sudo apt -y install postgresql-client-15
-
-      - name: Build and cache Docker image
-        if: matrix.should_run == true
-        uses: simplex-chat/docker-build-push-action@v6
-        with:
-          context: .
-          load: true
-          file: Dockerfile.build
-          tags: build/${{ matrix.os }}:latest
-          build-args: |
-            TAG=${{ matrix.os }}
-            GHC=${{ matrix.ghc }}
-
-      - name: Cache dependencies
-        if: matrix.should_run == true
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cabal/store
-            dist-newstyle
-          key: ubuntu-${{ matrix.os }}-${{ matrix.arch }}-ghc${{ matrix.ghc }}-${{ hashFiles('cabal.project', 'simplexmq.cabal') }}
-
-      - name: Start container
-        if: matrix.should_run == true
-        shell: bash
-        run: |
-          docker run -t -d \
-            --device /dev/fuse \
-            --cap-add SYS_ADMIN \
-            --security-opt apparmor:unconfined \
-            --name builder \
-            -v ~/.cabal:/root/.cabal \
-            -v /home/runner/work/_temp:/home/runner/work/_temp \
-            -v ${{ github.workspace }}:/project \
-            build/${{ matrix.os }}:latest
-
-      - name: Build smp-server (postgresql) and tests
-        if: matrix.should_run == true
-        shell: docker exec -t builder sh -eu {0}
-        run: |
-          chmod -fR 777 ~/.cabal ./dist-newstyle || :; git config --global --add safe.directory '*'
-          cabal clean
-          cabal update
-          cabal build --jobs=$(nproc) --enable-tests -fserver_postgres
-          mkdir -p /out
-          for i in smp-server simplexmq-test; do
-            bin=$(find /project/dist-newstyle -name "$i" -type f -executable)
-            chmod +x "$bin"
-            mv "$bin" /out/
-          done
-          strip /out/smp-server
-
-      - name: Copy simplexmq-test from container
-        if: matrix.should_run == true
-        shell: bash
-        run: |
-          docker cp builder:/out/simplexmq-test .
-
-      - name: Copy smp-server (postgresql) from container and prepare it
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        id: prepare-postgres
-        shell: bash
-        run: |
-          name="smp-server-postgres-ubuntu-${{ matrix.os_underscore }}-${{ matrix.arch }}"
-          docker cp builder:/out/smp-server $name
-
-          path="${{ github.workspace }}/$name"
-          echo "bin=$path" >> $GITHUB_OUTPUT
-
-          hash="SHA2-256($name)= $(openssl sha256 $path | cut -d' ' -f 2)"
-          printf 'hash=%s' "$hash" >> $GITHUB_OUTPUT
-
-      - name: Build everything else (standard)
-        if: matrix.should_run == true
-        shell: docker exec -t builder sh -eu {0}
-        run: |
-          cabal build --jobs=$(nproc)
-          mkdir -p /out
-          for i in ${{ env.apps }}; do
-            bin=$(find /project/dist-newstyle -name "$i" -type f -executable)
-            strip "$bin"
-            chmod +x "$bin"
-            mv "$bin" /out/
-          done
-
-      - name: Copy binaries from container and prepare them
-        id: prepare-regular
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        shell: bash
-        run: |
-          docker cp builder:/out .
-
-          printf 'bins<<EOF\n' > bins.output
-          printf 'hashes<<EOF\n' > hashes.output
-          for i in ${{ env.apps }}; do
-            name="$i-ubuntu-${{ matrix.os_underscore }}-${{ matrix.arch }}"
-
-            mv ./out/$i ./$name
-
-            path="${{ github.workspace }}/$name"
-            hash="SHA2-256($name)= $(openssl sha256 $path | cut -d' ' -f 2)"
-
-            printf '%s\n' "$path" >> bins.output
-            printf '%s\n\n' "$hash" >> hashes.output
-          done
-          printf 'EOF\n' >> bins.output
-          printf 'EOF\n' >> hashes.output
-
-          cat bins.output >> "$GITHUB_OUTPUT"
-          cat hashes.output >> "$GITHUB_OUTPUT"
-
-      - name: Upload binaries
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.should_run == true
-        uses: simplex-chat/action-gh-release@v2
-        with:
-          append_body: true
-          prerelease: true
-          fail_on_unmatched_files: true
-          body: |
-            ${{ steps.prepare-regular.outputs.hashes }}
-            ${{ steps.prepare-postgres.outputs.hash }}
-          files: |
-            ${{ steps.prepare-regular.outputs.bins }}
-            ${{ steps.prepare-postgres.outputs.bin }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Test
-        if: matrix.should_run == true && matrix.arch == 'x86-64'
-        timeout-minutes: 120
-        shell: bash
-        env:
-          PGHOST: localhost
-        run: |
-          i=1
-          attempts=1
-          ${{ (github.ref == 'refs/heads/stable' || startsWith(github.ref, 'refs/tags/v')) }} && attempts=3
-          while [ "$i" -le "$attempts" ]; do
-            if ./simplexmq-test; then
-              break
-            else
-              echo "Attempt $i failed, retrying..."
-              i=$((i + 1))
-              sleep 1
-            fi
-          done
-          if [ "$i" -gt "$attempts" ]; then
-            echo "All "$attempts" attempts failed."
-            exit 1
-          fi

.github/workflows/docker-image.yml

@@ -1,50 +0,0 @@
-name: Build and push Docker image to Docker Hub
-
-on:
-  push:
-    tags:
-      - "v*"
-
-jobs:
-  build-and-push:
-    name: Build and push Docker image
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - app: smp-server
-            app_port: "443 5223"
-          - app: xftp-server
-            app_port: 443
-    steps:
-      - name: Clone project
-        uses: actions/checkout@v4
-
-      - name: Log in to Docker Hub
-        uses: simplex-chat/docker-login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Extract metadata for Docker image
-        id: meta
-        uses: simplex-chat/docker-metadata-action@v5
-        with:
-          images: ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.app }}
-          flavor: |
-            latest=auto
-          tags: |
-            type=semver,pattern=v{{version}}
-            type=semver,pattern=v{{major}}.{{minor}}
-            type=semver,pattern=v{{major}}
-
-      - name: Build and push Docker image
-        uses: simplex-chat/docker-build-push-action@v6
-        with:
-          push: true
-          build-args: |
-            APP=${{ matrix.app }}
-            APP_PORT=${{ matrix.app_port }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/reproduce-schedule.yml

@@ -1,45 +0,0 @@
-name: Reproduce latest release
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 2 * * *' # every day at 02:00 night
-
-jobs:
-  reproduce:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Get latest release
-        shell: bash
-        run: |
-          curl --proto '=https' \
-               --tlsv1.2 \
-               -sSf -L \
-               'https://api.github.com/repos/simplex-chat/simplexmq/releases/latest' \
-               2>/dev/null | \
-          grep -i "tag_name" | \
-          awk -F \" '{print "TAG="$4}' >> $GITHUB_ENV
-
-      - name: Execute reproduce script
-        run: |
-          ${GITHUB_WORKSPACE}/scripts/simplexmq-reproduce-builds.sh "$TAG" || :
-
-      - name: Check if build has been reproduced
-        env:
-          url: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_URL }}
-          user: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_USER }}
-          pass: ${{ secrets.STATUS_SIMPLEX_WEBHOOK_PASS }}
-        run: |
-          if [ -f "${GITHUB_WORKSPACE}/${TAG}-simplexmq/_sha256sums" ]; then
-            exit 0
-          else
-            curl --proto '=https' --tlsv1.2 -sSf \
-              -u "${user}:${pass}" \
-              -H 'Content-Type: application/json' \
-              -d '{"title": "👾 GitHub: Runner", "description": "⛔️ '"$TAG"' did not reproduce."}' \
-              "$url"
-            exit 1
-          fi

.gitignore

@@ -2,12 +2,3 @@
 *.db
 *.db.bak
 *.session.sql
-tests/tmp
-dist-newstyle/
-
-cabal.project.local
-cabal.project.local~
-
-.hpc/
-*.tix
-.coverage

.hlint.yaml

@@ -1 +0,0 @@
-- ignore: {name: "Use underscore"}

CHANGELOG.md

@@ -1,843 +1,3 @@
-# 6.4.4
-
-Servers:
-- fix server pages when source code is not specified.
-- include commit SHA in printed version and in web page (#1608).
-
-SMP server:
-- support short SimpleX addresses in server information page (#1600).
-- wrap all queries in transactions (#1603).
-
-SMP agent:
-- chat relay address type for short links (#1602).
-- extend xrcp certificate validity 1 hour in the past, to allow out of sync clocks (#1601).
-
-# 6.4.3
-
-SMP agent:
-- fix some connection errors by updating contact request server hosts to match server in short link (#1597).
-
-SMP server:
-- support short link URI as queue identifier in control port commands (#1596).
-
-# 6.4.2
-
-SMP server:
-- fix memory leak when connection interrupts straight after client connects.
-- do not include repeated queue blocking into stats/quota.
-
-XFTP server:
-- prometheus metrics
-
-# 6.4.1
-
-SMP protocol:
-- create notification credentials via NEW command that creates the queue (#1586)
-
-SMP server:
-- control port session improvements (#1591)
-- additional stat counter for ntf credentials created together with the queue (#1589)
-
-# 6.4.0
-
-SMP protocol (server/client):
-- support associated queue data and short connection links (see [RFC](./rfcs/2025-03-16-smp-queues.md)).
-- service certificates to optimize subscriptions.
-
-SMP agent:
-- support retries for interactive connection handshakes.
-- use web port 443 by default for preset servers.
-- use static RNG function to avoid creating dynamic C stubs when generating sntrup keys (it was detected as Dynamic Code Loading in GrapheneOS).
-- different timeouts for interactive and background operations.
-
-Ntf server:
-- PostgreSQL storage.
-- Prometheus metrics.
-- use service certificates.
-- fix repeat token registration.
-
-# 6.3.2
-
-Servers:
-- enable store log by default (#1501).
-
-SMP server:
-- reduce memory usage (#1498)
-
-SMP agent:
-- handle client/agent version downgrades after connection was established (#1508).
-
-# 6.3.1
-
-Servers:
-- handle ECONNABORTED error on client connections.
-- reproducible builds.
-- blocking records for content moderation.
-- update script (simplex-servers-update) downloads scripts from the specified or the latest stable tag.
-
-SMP server:
-- support for PostgreSQL database for queue records for higher traffic servers.
-- fix old clients sending messages to new servers (#1443)
-- remove empty journals when opening message queues and expiring idle queues (#1456, #1458).
-- additional start options (#1465):
-  - `maintenance` to run all start/stop operations without starting server.
-  - `skip-warnings` to ignore the last corrupted line in store log (can happen on abnormal termination).
-
-Ntf server:
-- record date of last token activity, to allow expiring inactive tokens.
-- additional token invalidation reasons in logs.
-
-SMP agent:
-- store message sent to multiple connections only once, to reduce storage when sending to groups (#1453).
-- encrypt messages on delivery, to reduce database writes (#1446).
-- don't block method calls on congested sockets for better concurrency (#1454).
-- check notification token status on client connection.
-- option to skip SQLite vacuum on migrations.
-
-# 6.3.0
-
-SMP agent: fix joining connection after failure by using the same ratchet.
-
-# 6.2.2
-
-SMP server:
-- add optional Prometheus metrics (#1411).
-
-Build:
-- remove three modules from client library.
-
-# 6.2.0
-
-Version 6.2.0.7
-
-Build:
-- client_library flag to build only used modules in the clients, remove package yaml
-
-SMP server:
-- journal storage for messages (BETA).
-- prevent race condition when deleting queue and to avoid "orphan" messages (#1395).
-
-SMP agent:
-- support SMP and XFTP server roles (storage/proxy) and operators (#1343).
-- treat blocked STM and other critical errors that offer restart as temporary for message delivery (#1405).
-- fix inconsistent state after app restart while accepting contact request (#1412).
-
-# 6.1.3
-
-SMP server: fix restoring notification credentials.
-
-# 6.1.2
-
-Servers: more reliable restoring of state.
-
-SMP server: reduced memory usage and faster start.
-
-Notifications: compensate for iOS notifications being dropped by Apple while device is offline (#1378):
-- Ntf server: send multiple SMP notifications in one iOS notification.
-- Agent: get multiple messages for one iOS notification.
-
-# 6.1.1
-
-SMP:
-- stop server faster (#1371)
-- add STORE error (#1372)
-
-# 6.1.0
-
-Version 6.1.0.7
-
-SMP server and client:
-- transport block encryption (#1317).
-
-Agent:
-- batch and optimize iOS notifications processing (#1308, #1311, #1313, #1316, #1330, #1331, #1333, #1337, #1346).
-- allow receiving multiple messages from single iOS notification (#1355, #1362).
-- prepare connection to accept to avoid race condition with events (#1365).
-- transport isolation mode "Session" (default) to use new SOCKS credentials when client restarts or SOCKS proxy configuration changes (#1321).
-
-Ntf server:
-- control port (#1354).
-- enable pings on ntf subscriptions, to resubscribe on reconnection (#1353).
-
-SMP server:
-- support multiple server ports (#1319).
-- support serving HTTPS and SMP transport on the same port (#1326, #1327).
-- persist iOS notifications to avoid losing them when Ntf server is offline (#1336, #1339, #1350).
-- fix lost notification subscriptions (#1347).
-- reject SKEY with different key earlier, at verification step (#1366).
-- pass server information via CLI during server initialization (#1356).
-- show version on server page (#1341).
-- explicit graceful shutdown on SIGINT (#1360).
-
-XRCP (remote access protocol):
-- use SHA3-256 in hybrid key agreement (#1302).
-- session encryption with forward secrecy (#1328).
-
-# 6.0.5
-
-SMP agent:
-- support generic SOCKS proxy (without isolate-by-auth).
-- reduce max message sizes
-
-# 6.0.4
-
-SMP server:
-- better performance/memory: fewer map updates on re-subscriptions (#1297), split and reduce STM transactions (#1294)
-- send DELD when subscribed queue is deleted (#1312)
-- add created/updated/used date to queues to manage expiration (#1306)
-
-XFTP server: truncate file creation time to 1 hour (#1310)
-
-Servers:
-- bind control port only to 127.0.0.1 for better security in case of firewall misconfiguration (#1280)
-- reduce memory used for period stats (#1298)
-
-Agent: process last notification from list (#1307)
-- report receive file error with redirected file ID, when redirect is present (#1304)
-- special error when deleted user record is not in database (#1303)
-- fix race when sending a message to the deleted connection (#1296)
-- support for multiple messages in a single notification
-
-Ntf server:
-- only use SOCKS proxy for servers without public address (#1314)
-
-# 6.0.3
-
-Agent:
-- fix possible stuck queue rotation (#1290).
-
-SMP server:
-- batch END responses when subscribed client switches to reduce server and client traffic.
-- reduce STM transactions for better performance.
-- add stats for END events and for SUB/DEL event batches.
-- remove "expensive" stats to save memory.
-
-# 6.0.2
-
-SMP agent:
-- fix stuck connection commands when a server is not responding.
-- store query errors, reduce slow query threshold to 1ms.
-
-Notification server:
-- reduce PING interval to 1 minute.
-- fix subscriptions disabled on race condition (only mark subscriptions with END status when received via the active connection).
-
-# 6.0.1
-
-SMP agent:
-- support changing user of the new connection.
-- do not start delivery workers when there are no messages to deliver.
-- enable notifications for all connections.
-- combine database transactions when subscribing.
-
-SMP server:
-- safe compacting of store log.
-- fix possible race when creating client that might lead to memory leak.
-
-Dependencies: upgrade tls to 1.9
-
-# 6.0.0
-
-Version 6.0.0.8
-
-Agent:
-- enabled fast handshake support.
-- batch-send multiple messages in each connection.
-- resume subscriptions as soon as agent moves to foreground or as network connection resumes.
-- "known" servers to determine whether to use SMP proxy.
-- retry on SMP proxy NO_SESSION error.
-- fixes to notification subscriptions.
-- persistent server statistics.
-- better concurrency.
-
-SMP server:
-- reduce threads usage.
-- additional statistics.
-- improve disabling inactive clients.
-- additional control port commands for monitoring.
-
-Notification server:
-- support onion-only SMP servers.
-
-# 5.8.2
-
-Agent:
-- fast handshake support (disabled).
-- new statistics api.
-
-SMP server:
-- fast handshake support (SKEY command).
-- minor changes to reduce memory usage.
-
-# 5.8.1
-
-Agent:
-- API to reconnect one server.
-- Better error handling of file errors and remote control connection errors.
-- Only start uploading file once all chunks were registered on the servers.
-
-SMP server:
-- additional stats for sent message notifications.
-- fix server page layout.
-
-# 5.8.0
-
-Version 5.8.0.10
-
-SMP server and client:
-- protocol extension to forward messages to the destination servers, to protect sending client IP address and transport session.
-
-Agent:
-- process timed out subscription responses to reduce the number of resubscriptions.
-- avoid sending messages and commands when waiting for response timed out (except batched SUB and DEL commands).
-- fix issue with stuck message reception on slow connection (when response to ACK timed out, and the new message was not processed until resubscribed).
-- fix issue when temporary file sending or receiving error was treated as permanent.
-
-SMP server:
-- include OK responses to all batched SUB requests to reduce subscription timeouts.
-
-XFTP server:
-- report file upload timeout as TIMEOUT, to avoid delivery failure.
-
-# 5.7.6
-
-XFTP agent:
-- treat XFTP handshake timeouts and network errors as temporary, to retry file operations.
-
-# 5.7.5
-
-SMP agent:
-- fail if non-unique connection IDs are passed to sendMessages (to prevent client errors and deadlocks).
-
-# 5.7.4
-
-SMP agent:
-- remove re-subscription timeouts (as they are tracked per operation, and could cause failed subscriptions).
-- reconnect XFTP clients when network settings changes.
-- fix lock contention resulting in stuck subscriptions on network change.
-
-# 5.7.3
-
-SMP/NTF protocol:
-- add ALPN for handshake version negotiation, similar to XFTP (to preserve backwards compatibility with the old clients).
-- upgrade clients to versions v7/v2 of the protocols.
-
-SMP server:
-- faster responses to subscription requests.
-
-XFTP client:
-- fix network exception during file download treated as permanent file error.
-
-SMP agent:
-- do not report subscription timeouts while client is offline.
-
-# 5.7.2
-
-SMP agent:
-- fix connections failing when connecting via link due to race condition on slow network.
-- remove concurrency limit when waiting for connection subscription.
-- remove TLS timeout.
-
-# 5.7.1
-
-SMP agent:
-- increase timeout for TLS connection via SOCKS
-
-# 5.7.0
-
-Version 5.7.0.4
-
-_Please note_: the earliest SimpleX Chat clients supported by this version of the servers is 5.5.3 (released on February 11, 2024).
-
-SMP server:
-- increase max SMP protocol version to 7 (support for deniable authenticators).
-
-NTF server:
-- increase max NTF protocol version to 2 (support for deniable authenticators).
-
-XFTP server:
-- version handshake using ALPN.
-
-SMP agent:
-- increase timeouts for XFTP files.
-- don't send commands after timeout.
-- PQ encryption support.
-
-# 5.6.2
-
-Version 5.6.2.2.
-
-SMP agent:
-- Lower memory consumption (~20-25%).
-- More stable XFTP file uploads and downloads.
-- API to receive network connectivity changes from the apps.
-- to reduce battery consumption: connection attempts interval growing to every 2 hours when app reports as offline.
-- to reduce retries and traffic: 50% increased timeouts when on mobile network.
-
-XFTP server:
-- expire files on start.
-- version negotiation based on TLS ALPN and handshake.
-
-NTF server:
-- reduced downtime by ~100x faster start time.
-- exclude test tokens from statistics.
-
-# 5.6.1
-
-Version 5.6.1.0.
-
-- Much faster iOS notification server start time (fewer skipped notifications).
-- Fix SMP server stored message stats.
-- Prevent overwriting uploaded XFTP files with subsequent upload attempts.
-- Faster base64 encoding/parsing.
-- Control port audit log and authentication.
-
-# 5.6.0
-
-Version 5.6.0.4.
-
-SMP protocol/client/server:
-- support deniable sender command authorization (to be enabled in the next version).
-- remove support for SMP protocol versions (prior to v4, 07/2022).
-
-Agent:
-- optional post-quantum key agreement using sntrup761 in double ratchet protocol.
-- improve performance of deleting multiple connections and files by batching database operations.
-- delay connection deletion to deliver pending messages.
-- API to test for notifications server.
-- remove support for client protocols versions (prior to 10/2022).
-
-XFTP server:
-- restore storage quota in case of failed uploads.
-
-Performance and stability improvements.
-
-# 5.5.3
-
-Agent:
-- notification token API also returns active notifications server.
-- support file descriptions with redirection and file URIs.
-
-Servers:
-- CLI commands for online key and certificate rotation.
-- Configure config and log paths via environment variables.
-
-# 5.5.2
-
-Extensible handshake for clients and SMP/NTF servers (ignore extra data).
-
-# 5.5.1
-
-SMP servers:
-- do not keep stats file open
-- additional stats about currently stored messages
-
-Agent:
-- support multiple notification servers (only one can be used at a time).
-- expire messages after "quota exceeded" error after 7 days (instead of 21 days previously).
-- stabilize message delivery, remove unnecessary subscription retries and traffic.
-- improve database performance for message delivery.
-- fix sockets/memory leak - a very old bug "activated" by improvements in v5.5.0.
-
-# 5.5.0
-
-Code:
-- compatible with GHC 8.10.7 to support compilation for armv7a.
-- migrate to `crypton` from deprecated `cryptonite` (the seed for DRG is now sha512-hashed).
-- use ChaChaDRG for all random IDs, keys and nonces, only using hashed entropy as seed.
-- more efficient transaction batching in SMP protocol client and server.
-
-Agent:
-- stabilize message reception and delivery, migrate message delivery to database queue.
-- additional event MSGNTF confirming that message received via notification is processed.
-- efficient processing of messages sent to multiple recipients with batched database transactions.
-- new worker abstraction for all queued tasks resilient to race conditions and some database errors.
-- many fixed race conditions.
-- background mode for iOS NSE.
-- additional error reporting to client on critical errors (to be show as alert in the clients).
-- functional api to get worker statistics.
-
-SMP/XFTP servers:
-- fix socket and memory leak on servers with high load (inactive clients without subscriptions are disconnected after set time of inactivity).
-- control port improvements.
-- fix statistics for stored queues, messages and files.
-- make writing to store log atomic (fixes a rare bug in XFTP server).
-
-# 5.4.0
-
-Migrate to GHC 9.6.3
-
-Agent:
-- database improvements:
-  - track slow queries.
-  - better performance.
-  - "busy" error handling.
-  - create parent folder when needed.
-  - support closing and re-opening database.
-- SMP agent improvements
-  - streaming for batched SMP commands.
-  - fix asynchronous JOINing connection.
-  - handle repeating JOINs without failure.
-  - api to get subscribed connections.
-  - return simplex:/ links as invitations.
-  - fix memory leak.
-- XFTP improvements:
-  - suspend when agent is suspended.
-  - support locally encrypted files.
-  - fixes - create empty file, prevent permanent error treated as temporary.
-  - upgrade HTTP2 library (fixes error handling and flow control).
-- Remote control protocol (XRCP)
-
-SMP server:
-- control port commands for GHC threads introspection.
-- allow creating new queues without subscriptions (required for iOS).
-
-XFTP server:
-- allow 64kb file chunks.
-
-NTF server:
-- faster startup.
-
-# 5.3.0
-
-Agent:
-- improve performance, track slow database queries.
-- support delivery receipts.
-
-SMP server:
-- control port
-
-# 5.2.0 (NTF server 1.5.0)
-
-Agent:
-- treat agent INACTIVE error as temporary - fixes failed message delivery in some race conditions.
-- restore connection confirmations after client restart - fixes failed connections.
-- ratchet resynchronization protocol and API.
-- increase connection version to mutually supported by both peers on each received message.
-
-Client:
-- make timeout for batched functions dependent on the number of batches - fixes expiry on large batches.
-
-Servers:
-- add timeout in case of sending TCP traffic and in case of partial delivery of requested blocks to avoid resource leaks.
-
-# 5.1.2, 5.1.3 (NTF server 1.4.1, 1.4.2)
-
-Agent:
-- ACK message on decryption error (fixes stuck message delivery bug)
-- more robust connection switching logic, API to abort switching the address
-
-Notification server:
-- batch subscriptions to SMP servers
-
-# 5.1.1 (NTF server 1.4.0)
-
-Agent:
-- store and check hashes of previous encrypted messages to differentiate between duplicates and decryption errors
-
-Server:
-- larger processing queues
-- expire messages when restoring them
-
-# 5.1.0
-
-XFTP client:
-- check encrypted file exists when uploading
-- remove user ID from deletion API
-
-Agent:
-- vacuum database on migrations
-
-SMP server:
-- configure message expiration time in INI file
-
-# 5.0.0
-
-SimpleX File Transfer Protocol (XFTP):
-- XFTP server
-- XFTP CLI
-- support XFTP in the agent
-
-Other changes:
-- preserve retry interval for sending messages on agent restarts
-- support IPv6 in the servers and in the agent
-- support for 32-bit platforms
-
-Read more about XFTP in this post: https://simplex.chat/blog/20230301-simplex-file-transfer-protocol.html
-
-# 4.4.1
-
-SMP agent:
-
-- fix handling of server addresses.
-- prevent message delivery getting stuck on IO error in SMP client.
-
-# 4.4.0
-
-SMP agent:
-
-- support multiple user profiles with transport session isolation.
-- support optional transport isolation per connection.
-- batch connection deletion
-- improve asynchronous connection deletion – it may now be completed after the client is restarted as well.
-- improve subscription logic to retry if initial attempt fails.
-- end SMP client connection after a number of failed PINGs (default is 3).
-
-# 4.3.0
-
-SMP server:
-
-- additional server usage statistics.
-
-SMP agent:
-
-- increase retry interval when sending messages after ERR QUOTA.
-
-# 4.2.0
-
-SMP agent and server:
-
-- reduce sender traffic in cases when queue quota is exceeded:
-  - server sends quota exceeded message to the recipient when sender receives ERR QUOTA.
-  - recipient sends QCONT message to the send once the queue is drained (via reply queue).
-  - sender retry delays are increased, reducing traffic, but sender instantly resumes delivery where QCONT is received.
-
-SMP server:
-
-- increase internal queue sizes.
-
-SMP agent:
-
-- deduplicate connection IDs in connect/disconnect responses.
-- unit tests for Crypto.hs.
-- fix connection switch to another queue: correctly set primary send queue.
-
-Notification server (v1.3.0):
-
-- check token status when sending verification notification.
-
-# 4.1.0
-
-SMP agent and server:
-
-- option to toggle TLS handshake error logs (disabled by default).
-
-SMP agent:
-
-- include server address in BROKER error.
-- api to get hash of double ratchet associated data (for connection verification).
-- api to get agent statistics.
-
-# 4.0.0
-
-SMP server:
-
-- Basic authentication. The server address can now include an optional password that is required to create messaging queues, so the contacts who message you will not be able to receive messages via your server, unless you share with them the address with the password. It is recommended to enable basic authentication on all private servers by adding `create_password` parameter into AUTH section of server INI file (the previously deployed servers do not have this section, you need to add it).
-- Disable creating new queues completely with `new_queues: off` parameter in AUTH section of INI file - it can be used to simplify migrating the existing connections to another server.
-- Updated server CLI with changed defaults:
-  - interactive server initialization, use -y flag to initialize the server non-interactively.
-  - store log is now enabled by default, so messaging queues and messages are restored when the server is restarted (to restore undelivered messages the server needs to be stopped with SIGINT signal).
-  - a random password is now generated by default during the server initialization.
-
-SMP agent:
-
-- API to test SMP servers. It connects to the server, creates and deletes a messaging queue. The new SimpleX Chat client uses this API to allow you to test that you have the correct server address, with the valid certificate fingerprint and password, before enabling the new server.
-
-# 3.4.0
-
-SMP agent:
-
-- increase concurrency with connection-level locks
-- fix issues identified in security assessment (see the announcement: https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20221108-simplex-chat-v4.2-security-audit-new-website.md)
-- manual connection queue rotation
-- optional client data in connection requests links
-
-SMP server:
-
-- specialize monad stack to improve performance
-- log slow commands
-
-# 3.3.0
-
-SMP server:
-
-- allow repeated KEY command with the same key (to avoid failures on retries)
-
-SMP agent:
-
-- enable/disable connection notifications
-- asynchronous commands that retry on network error
-- use SQLCipher
-
-# 3.2.0
-
-SMP agent:
-
-- Support multiple server hostnames (including onion hostnames) in server addresses.
-- Network configuration options.
-- Options to define rules to choose server hostname.
-
-# 3.1.0
-
-SMP server and agent:
-
-- SMP protocol v4: batching multiple server commands/responses in a transport block.
-
-# 3.0.0
-
-SMP server:
-
-- restore undelivered messages when the server is restarted.
-- SMP protocol v3 to support push notification:
-  - updated SEND and MSG to add message flags (for notification flag that confirm whether the notification is sent and for any future extensions) and to move message meta-data sent to the recipient into the encrypted envelope.
-  - update NKEY and NID to add e2e encryption keys (for the notification meta-data encryption between SMP server and the client), and update NMSG to include this meta-data.
-  - update ACK command to include message ID (to avoid acknowledging unprocessed message).
-  - add NDEL commands to remove notification subscription credentials from SMP queue.
-  - add GET command to receive messages without subscription - to be used in iOS notification service extension to receive messages without terminating app subscriptions.
-
-SMP agent:
-
-- new protocol for duplex connection handshake reducing traffic and connection time.
-- support for SMP notifications server and managing device token.
-- remove redundant FQDN validation from TLS handshake to prepare for access via Tor.
-- support for fully stopping agent and for temporary suspending agent operations.
-- improve management of duplicate message delivery.
-
-SMP notifications server v1.0:
-
-- SMP notifications protocol with version negotiation during handshake.
-- device token registration and verification (via background notification).
-- SMP notification subscriptions and push notifications via APNS.
-- restoring notification subscriptions when the server is restarted.
-
-# 2.3.0
-
-SMP server:
-
-- Save and restore undelivered messages, to avoid losing them. To save messages the server has to be stopped with SIGINT signal, if it is stopped with SIGTERM undelivered messages would not be saved.
-
-# 2.2.0
-
-SMP server:
-
-- Fix sockets/threads/memory leak
-
-SMP agent:
-
-- Support stopping and resuming agent with `disconnectAgentClient` / `resumeAgentClient`
-
-# 2.1.1
-
-SMP server:
-
-- gracefully close sockets on client disconnection
-- CLI warning when deleting server configuration
-
-# 2.1.0
-
-SMP server:
-
-- configuration to expire inactive clients in ini file, increased TTL and check interval for client expiration
-
-# 2.0.0
-
-Push notifications server (beta):
-
-- supports APNS
-- manage device tokens verification via notification delivery
-- sending periodic background notification to check messages (not more frequent than every 20 min)
-
-SMP server:
-
-- disconnect inactive clients after some period
-- remove undelivered messages after 30 days
-- log aggregate usage daily stats: only the number of queues created/secured/deleted/used and messages sent/delivered is logged, as one line per day, so we can plan server capacity and diagnose any problems.
-
-SMP agent:
-
-- manage device tokens and notification server connection
-- DOWN/UP events to the agent user about server disconnections/reconnections are now sent once per server
-
-# 1.1.0
-
-SMP server:
-
-- message TTL and periodic deletion of old messages
-- configuration to prevent creation of the new queues
-
-SMP agent:
-
-- asynchronous connection handshake
-- configurable SMP servers at run-time
-- use TCP keep-alive for connection stability
-- improve stability of connection subscriptions
-- auto-vacuum DB to remove deleted records
-
-# 1.0.3
-
-SMP server:
-
-- Reduce server message queue quota to 128 messages.
-
-SMP agent:
-
-- Add "yes to migrations" option.
-- Make new SMP client attempt to reconnect on network error.
-- Reduce connection handshake expiration to 2 days.
-
-JSON encoding of types used in simplex-chat, some other minor adjustments.
-
-# 1.0.2
-
-General:
-
-- Enable TLS 1.3 parameters for TLS handshake (server and client).
-- Switch from hs-tls fork to original repo now that it supports getFinished and getPeerFinished APIs for both TLS 1.2 and TLS 1.3.
-
-SMP server:
-
-- Perform TLS handshake in a separate thread per-connection.
-
-SMP agent:
-
-- Cease attempts to send HELLO after one week timeout.
-- Coalesce requests to connect to SMP servers, to have 1 connection per server.
-
-# 1.0.1
-
-SMP server:
-
-- Explicitly set line buffering in stdout/stderr to log each line when output is redirected to files.
-
-# 1.0.0
-
-Security and privacy improvements:
-
-- Faster and more secure 2-layer E2E encryption with additional encryption layer between servers and recipients:
-  - application messages in each duplex connection (managed by SMP agents - see [overview](https://github.com/simplex-chat/simplexmq/blob/master/protocol/overview-tjr.md)) are encrypted using [double-ratchet algorithm](https://www.signal.org/docs/specifications/doubleratchet/), providing forward secrecy and break-in recovery. This layer uses two Curve448 keys per client for [X3DH key agreement](https://www.signal.org/docs/specifications/x3dh/), SHA512 based HKDFs and AES-GCM AEAD encryption.
-  - SMP client messages are additionally E2E encrypted in each SMP queue to avoid cipher-text correlation of messages sent via multiple redundant queues (that will be supported soon). This and the next layer use [NaCl crypto_box algorithm](https://nacl.cr.yp.to/index.html) with XSalsa20Poly1305 cipher and Curve25519 keys for DH key agreement.
-  - Messages delivered from the servers to the recipients are additionally encrypted to avoid cipher-text correlation between sent and received messages.
-- To prevent any traffic correlation by content size, SimpleX uses fixed transport block size of 16kb (16384 bytes) with padding on all encryption layers:
-  - application messages are padded to 15788 bytes before E2E double-ratchet encryption.
-  - messages between SMP clients are padded to 16032 bytes before E2E encryption in each SMP queue.
-  - messages from the server to the recipient are padded to padded to 16088 bytes before the additional encryption layer (see above).
-- TLS 1.2+ with tls-unique channel binding in each command to prevent replay attacks.
-- Server identity verification via server offline certificate fingerprints included in SMP server addresses.
-
-New functionality:
-
-- Support for notification servers with new SMP commands: `NKEY`/`NID`, `NSUB`/`NMSG`.
-
-Efficiency improvements:
-
-- Binary protocol encodings to reduce overhead from circa 15% to approximately 3.7% of transmitted application message size, with only 2.2% overhead for SMP protocol messages.
-- More performant cryptographic algorithms.
-
-For more information about SimpleX:
-
-- [SimpleX overview](https://github.com/simplex-chat/simplexmq/blob/master/protocol/overview-tjr.md).
-- [SimpleX chat v1 announcement](https://github.com/simplex-chat/simplex-chat/blob/master/blog/20220112-simplex-chat-v1-released.md).
-
 # 0.5.2
 
 - Fix message delivery logic that blocked delivery of all server messages when server per-queue quota exceeded, making it concurrent per SMP queue, not per server.

Dockerfile

@@ -1,85 +0,0 @@
-# syntax=docker/dockerfile:1.7.0-labs
-ARG TAG=24.04
-
-FROM ubuntu:${TAG} AS build
-
-### Build stage
-
-# Install curl and git and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-18 llvm-18-dev libnuma-dev libssl-dev
-
-# Specify bootstrap Haskell versions
-ENV BOOTSTRAP_HASKELL_GHC_VERSION=9.6.3
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.12.1.0
-
-# Do not install Stack
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK=true
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=true
-
-# Install ghcup
-RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
-
-# Adjust PATH
-ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"
-
-# Set both as default
-RUN ghcup set ghc "${BOOTSTRAP_HASKELL_GHC_VERSION}" && \
-    ghcup set cabal "${BOOTSTRAP_HASKELL_CABAL_VERSION}"
-
-# Copy only the source code
-COPY apps /project/apps/
-COPY cbits /project/cbits/
-COPY src /project/src/
-
-COPY cabal.project Setup.hs simplexmq.cabal LICENSE /project
-
-WORKDIR /project
-
-# Debug
-#ARG CACHEBUST=1
-
-#ADD --chmod=755 https://github.com/MShekow/directory-checksum/releases/download/v1.4.6/directory-checksum_1.4.6_linux_amd64 /usr/local/bin/directory-checksum
-#RUN directory-checksum --max-depth 2 .
-
-# Set build arguments and check if they exist
-ARG APP
-RUN if [ -z "$APP" ]; then printf "Please spcify \$APP build-arg.\n"; exit 1; fi
-
-# Compile app
-RUN cabal update
-RUN cabal build exe:$APP
-
-# Copy scripts
-COPY scripts /project/scripts/
-
-# Create new path containing all files needed
-RUN mkdir /final
-WORKDIR /final
-
-# Strip the binary from debug symbols to reduce size
-RUN bin="$(find /project/dist-newstyle -name "$APP" -type f -executable)" && \
-    mv "$bin" ./ && \
-    strip ./"$APP" &&\
-    mv /project/scripts/docker/entrypoint-"$APP" ./entrypoint &&\
-    mv /project/scripts/main/simplex-servers-stopscript ./simplex-servers-stopscript
-
-### Final stage
-FROM ubuntu:${TAG}
-
-# Install OpenSSL dependency
-RUN apt-get update && apt-get install -y openssl libnuma-dev
-
-# Copy compiled app from build stage
-COPY --from=build /final /usr/local/bin/
-
-# Open app listening port
-ARG APP_PORT
-RUN if [ -z "$APP_PORT" ]; then printf "Please spcify \$APP_PORT build-arg.\n"; exit 1; fi
-
-EXPOSE $APP_PORT
-
-# simplexmq requires using SIGINT to correctly preserve undelivered messages and restore them on restart
-STOPSIGNAL SIGINT
-
-# Finally, execute helper script
-ENTRYPOINT [ "/usr/local/bin/entrypoint" ]

Dockerfile.build

@@ -1,31 +0,0 @@
-# syntax=docker/dockerfile:1.7.0-labs
-ARG TAG=24.04
-FROM ubuntu:${TAG} AS build
-
-### Build stage
-
-ARG GHC=9.6.3
-ARG CABAL=3.14.1.1
-
-# Install curl, git and and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl libpq-dev git sqlite3 libsqlite3-dev build-essential libgmp3-dev zlib1g-dev llvm llvm-dev libnuma-dev libssl-dev
-
-# Specify bootstrap Haskell versions
-ENV BOOTSTRAP_HASKELL_GHC_VERSION=${GHC}
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=${CABAL}
-
-# Do not install Stack
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK=true
-ENV BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=true
-
-# Install ghcup
-RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
-
-# Adjust PATH
-ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"
-
-# Set both as default
-RUN ghcup set ghc "${GHC}" && \
-    ghcup set cabal "${CABAL}"
-
-WORKDIR /project

README.md

@@ -1,321 +1,113 @@
 # SimpleXMQ
 
-[![GitHub build](https://github.com/simplex-chat/simplexmq/actions/workflows/build.yml/badge.svg)](https://github.com/simplex-chat/simplexmq/actions/workflows/build.yml)
+[![GitHub build](https://github.com/simplex-chat/simplexmq/workflows/build/badge.svg)](https://github.com/simplex-chat/simplexmq/actions?query=workflow%3Abuild)
 [![GitHub release](https://img.shields.io/github/v/release/simplex-chat/simplexmq)](https://github.com/simplex-chat/simplexmq/releases)
 
-📢 SimpleXMQ v1 is released - with many security, privacy and efficiency improvements, new functionality - see [release notes](https://github.com/simplex-chat/simplexmq/releases/tag/v1.0.0).
+📢 **v0.5.1 brings a hotfix to the server's subscription management logic, to apply it log in to your server via SSH and run the following command. If you have store log enabled for your server, information about already established queues will be preserved.** If you're doing a custom installation instead of Linode or DigitalOcean you may have to change the path for binary download.
 
-**Please note**: v1 is not backwards compatible, but it has the version negotiation built into all protocol layers for forwards compatibility of this version and backwards compatibility of the future versions, that will be backwards compatible for at least two versions back.
-
-If you have a server deployed please deploy a new server to a new host and retire the previous version once it is no longer used.
+```sh
+systemctl stop smp-server
+curl -L -o /opt/simplex/bin/smp-server https://github.com/simplex-chat/simplexmq/releases/download/v0.5.1/smp-server-ubuntu-20_04-x86-64
+systemctl start smp-server
+```
 
 ## Message broker for unidirectional (simplex) queues
 
-SimpleXMQ is a message broker for managing message queues and sending messages over public network. It consists of SMP server, SMP client library and SMP agent that implement [SMP protocol](./protocol/simplex-messaging.md) for client-server communication and [SMP agent protocol](./protocol/agent-protocol.md) to manage duplex connections via simplex queues on multiple SMP servers.
+SimpleXMQ is a message broker for managing message queues and sending messages over public network. It consists of SMP server, SMP client library and SMP agent that implement [SMP protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md) for client-server communication and [SMP agent protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/agent-protocol.md) to manage duplex connections via simplex queues on multiple SMP servers.
 
-SMP protocol is inspired by [Redis serialization protocol](https://redis.io/topics/protocol), but it is much simpler - it currently has only 10 client commands and 8 server responses.
+SMP protocol is inspired by [Redis serialization protocol](https://redis.io/topics/protocol), but it is much simpler - it currently has only 8 client commands and 6 server responses.
 
 SimpleXMQ is implemented in Haskell - it benefits from robust software transactional memory (STM) and concurrency primitives that Haskell provides.
 
 ## SimpleXMQ roadmap
 
-- SimpleX service protocol and application template - to enable users building services and chat bots that work over SimpleX protocol stack. The first such service will be a notification service for a mobile app.
-- SMP queue redundancy and rotation in SMP agent connections.
+- SMP queue redundancy and rotation in SMP agent duplex connections.
 - SMP agents synchronization to share connections and messages between multiple agents (it would allow using multiple devices for [simplex-chat](https://github.com/simplex-chat/simplex-chat)).
+- Streams - high performance message queues. See [Streams RFC](https://github.com/simplex-chat/simplexmq/blob/master/rfcs/2021-02-28-streams.md) for details.
 
 ## Components
 
 ### SMP server
 
-[SMP server](./apps/smp-server/Main.hs) can be run on any Linux distribution, including low power/low memory devices. OpenSSL library is required for initialization.
+[SMP server](https://github.com/simplex-chat/simplexmq/blob/master/apps/smp-server/Main.hs) can be run on any Linux distribution without any dependencies. It uses in-memory persistence with an optional append-only log of created queues that allows to re-start the server without losing the connections. This log is compacted on every server restart, permanently removing suspended and removed queues.
 
-To initialize the server use `smp-server init -n <fqdn>` (or `smp-server init --ip <ip>` for IP based address) command - it will generate keys and certificates for TLS transport. The fingerprint of offline certificate is used as part of the server address to protect client/server connection against man-in-the-middle attacks: `smp://<fingerprint>@<hostname>[:5223]`.
+To enable the queue logging, uncomment `enable: on` option in `smp-server.ini` configuration file that is created the first time the server is started.
 
-SMP server uses in-memory persistence with an optional append-only log of created queues that allows to re-start the server without losing the connections. This log is compacted on every server restart, permanently removing suspended and removed queues.
+On the first start the server generates an RSA key pair for encrypted transport handshake and outputs hash of the public key every time it runs - this hash should be used as part of the server address: `<hostname>:5223#<key hash>`.
 
-To enable store log, initialize server using `smp-server -l` command, or modify `smp-server.ini` created during initialization (uncomment `enable: on` option in the store log section). Use `smp-server --help` for other usage tips.
-
-Starting from version 2.3.0, when store log is enabled, the server would also enable saving undelivered messages on exit and restoring them on start. This can be disabled via a separate setting `restore_messages` in `smp-server.ini` file. Saving messages would only work if the server is stopped with SIGINT signal (keyboard interrupt), if it is stopped with SIGTERM signal the messages would not be saved.
-
-> **Please note:** On initialization SMP server creates a chain of two certificates: a self-signed CA certificate ("offline") and a server certificate used for TLS handshake ("online"). **You should store CA certificate private key securely and delete it from the server. If server TLS credential is compromised this key can be used to sign a new one, keeping the same server identity and established connections.** CA private key location by default is `/etc/opt/simplex/ca.key`.
-
-SMP server implements [SMP protocol](./protocol/simplex-messaging.md).
-
-#### Running SMP server on MacOS
-
-SMP server requires OpenSSL library for initialization. On MacOS OpenSSL library may be replaced with LibreSSL, which doesn't support required algorithms. Before initializing SMP server verify you have OpenSSL installed:
-
-```sh
-openssl version
-```
-
-If it says "LibreSSL", please install original OpenSSL:
-
-```sh
-brew update
-brew install openssl
-echo 'PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"' >> ~/.zprofile # or follow whatever instructions brew suggests
-. ~/.zprofile # or restart your terminal to start a new session
-```
-
-Now `openssl version` should be saying "OpenSSL". You can now run `smp-server init` to initialize your SMP server.
+SMP server implements [SMP protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md).
 
 ### SMP client library
 
-[SMP client](./src/Simplex/Messaging/Client.hs) is a Haskell library to connect to SMP servers that allows to:
-
+[SMP client](https://github.com/simplex-chat/simplexmq/blob/master/src/Simplex/Messaging/Client.hs) is a Haskell library to connect to SMP servers that allows to:
 - execute commands with a functional API.
 - receive messages and other notifications via STM queue.
 - automatically send keep-alive commands.
 
 ### SMP agent
 
-[SMP agent library](./src/Simplex/Messaging/Agent.hs) can be used to run SMP agent as part of another application and to communicate with the agent via STM queues, without serializing and parsing commands and responses.
+[SMP agent library](https://github.com/simplex-chat/simplexmq/blob/master/src/Simplex/Messaging/Agent.hs) can be used to run SMP agent as part of another application and to communicate with the agent via STM queues, without serializing and parsing commands and responses.
 
-Haskell type [ACommand](./src/Simplex/Messaging/Agent/Protocol.hs) represents SMP agent protocol to communicate via STM queues.
+Haskell type [ACommand](https://github.com/simplex-chat/simplexmq/blob/master/src/Simplex/Messaging/Agent/Protocol.hs) represents SMP agent protocol to communicate via STM queues.
 
 See [simplex-chat](https://github.com/simplex-chat/simplex-chat) terminal UI for the example of integrating SMP agent into another application.
 
-[SMP agent executable](./apps/smp-agent/Main.hs) can be used to run a standalone SMP agent process that implements plaintext [SMP agent protocol](./protocol/agent-protocol.md) via TCP port 5224, so it can be used via telnet. It can be deployed in private networks to share access to the connections between multiple applications and services.
+[SMP agent executable](https://github.com/simplex-chat/simplexmq/blob/master/apps/smp-agent/Main.hs) can be used to run a standalone SMP agent process that implements plaintext [SMP agent protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/agent-protocol.md) via TCP port 5224, so it can be used via telnet. It can be deployed in private networks to share access to the connections between multiple applications and services.
 
 ## Using SMP server and SMP agent
 
-You can either run your own SMP server locally or deploy using [Linode StackScript](https://cloud.linode.com/stackscripts/748014), or try local SMP agent with the deployed servers:
+You can either run your own SMP server locally or deploy using [Linode StackScript](#deploy-smp-server-on-linode), or try local SMP agent with the deployed servers:
 
-`smp://u2dS9sG8nMNURyZwqASV4yROM28Er0luVTx5X1CsMrU=@smp4.simplex.im`
-
-`smp://hpq7_4gGJiilmz5Rf-CswuU5kZGkm_zOIooSw6yALRg=@smp5.simplex.im`
-
-`smp://PQUV2eL0t7OStZOoAsPEV2QYWt4-xilbakvGUGOItUo=@smp6.simplex.im`
+`smp2.simplex.im#z5W2QLQ1Br3Yd6CoWg7bIq1bHdwK7Y8bEiEXBs/WfAg=` (London, UK)
+`smp3.simplex.im#nxc7HnrnM8dOKgkMp008ub/9o9LXJlxlMrMpR+mfMQw=` (Fremont, CA)
 
 It's the easiest to try SMP agent via a prototype [simplex-chat](https://github.com/simplex-chat/simplex-chat) terminal UI.
 
-## Deploy SMP/XFTP servers on Linux
-
-You can run your SMP/XFTP server as a Linux process, optionally using a service manager for booting and restarts.
-
-Notice that `smp-server` and `xftp-server` requires `openssl` as run-time dependency (it is used to generate server certificates during initialization). Install it with your packet manager:
-
-```sh
-# For Ubuntu
-apt update && apt install openssl
-```
-
-### Install binaries
-
-#### Using Docker
-
-On Linux, you can deploy smp and xftp server using Docker. This will download image from [Docker Hub](https://hub.docker.com/r/simplexchat).
-
-1. Create directories for persistent Docker configuration:
-
-   ```sh
-   mkdir -p $HOME/simplex/{xftp,smp}/{config,logs} && mkdir -p $HOME/simplex/xftp/files
-   ```
-
-2. Run your Docker container.
-
-   - `smp-server`
-
-     You must change **your_ip_or_domain**. `-e "pass=password"` is optional variable to password-protect your `smp` server:
-     ```sh
-     docker run -d \
-         -e "ADDR=your_ip_or_domain" \
-         -e "PASS=password" \
-         -p 5223:5223 \
-         -v $HOME/simplex/smp/config:/etc/opt/simplex:z \
-         -v $HOME/simplex/smp/logs:/var/opt/simplex:z \
-         simplexchat/smp-server:latest
-     ```
-
-   - `xftp-server`
-
-     You must change **your_ip_or_domain** and **maximum_storage**.
-     ```sh
-     docker run -d \
-         -e "ADDR=your_ip_or_domain" \
-         -e "QUOTA=maximum_storage" \
-         -p 443:443 \
-         -v $HOME/simplex/xftp/config:/etc/opt/simplex-xftp:z \
-         -v $HOME/simplex/xftp/logs:/var/opt/simplex-xftp:z \
-         -v $HOME/simplex/xftp/files:/srv/xftp:z \
-         simplexchat/xftp-server:latest
-     ```
-
-#### Using installation script
-
-**Please note** that currently, only Ubuntu distribution is supported.
-
-You can install and setup servers automatically using our script:
-
-```sh
-curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/simplex-chat/simplexmq/stable/install.sh -o simplex-server-install.sh &&\
-if echo '53fcdb4ceab324316e2c4cda7e84dbbb344f32550a65975a7895425e5a1be757 simplex-server-install.sh' | sha256sum -c; then
-  chmod +x ./simplex-server-install.sh
-  ./simplex-server-install.sh
-  rm ./simplex-server-install.sh
-else
-  echo "SHA-256 checksum is incorrect!"
-  rm ./simplex-server-install.sh
-fi
-```
-
-### Build from source
-
-#### Using Docker
-
-> **Please note:** to build the app use source code from [stable branch](https://github.com/simplex-chat/simplexmq/tree/stable).
-
-On Linux, you can build smp server using Docker.
-
-1. Build your images:
-
-   ```sh
-   git clone https://github.com/simplex-chat/simplexmq
-   cd simplexmq
-   git checkout stable
-   DOCKER_BUILDKIT=1 docker build -t local/smp-server --build-arg APP="smp-server" --build-arg APP_PORT="5223" . # For xmp-server
-   DOCKER_BUILDKIT=1 docker build -t local/xftp-server --build-arg APP="xftp-server" --build-arg APP_PORT="443" . # For xftp-server
-   ```
-
-2. Create directories for persistent Docker configuration:
-
-   ```sh
-   mkdir -p $HOME/simplex/{xftp,smp}/{config,logs} && mkdir -p $HOME/simplex/xftp/files
-   ```
-
-3. Run your Docker container.
-
-   - `smp-server`
-
-     You must change **your_ip_or_domain**. `-e "pass=password"` is optional variable to password-protect your `smp` server:
-     ```sh
-     docker run -d \
-         -e "ADDR=your_ip_or_domain" \
-         -e "PASS=password" \
-         -p 5223:5223 \
-         -v $HOME/simplex/smp/config:/etc/opt/simplex:z \
-         -v $HOME/simplex/smp/logs:/var/opt/simplex:z \
-         simplexchat/smp-server:latest
-     ```
-
-   - `xftp-server`
-
-     You must change **your_ip_or_domain** and **maximum_storage**.
-     ```sh
-     docker run -d \
-         -e "ADDR=your_ip_or_domain" \
-         -e "QUOTA=maximum_storage" \
-         -p 443:443 \
-         -v $HOME/simplex/xftp/config:/etc/opt/simplex-xftp:z \
-         -v $HOME/simplex/xftp/logs:/var/opt/simplex-xftp:z \
-         -v $HOME/simplex/xftp/files:/srv/xftp:z \
-         simplexchat/xftp-server:latest
-     ```
-
-#### Using your distribution
-
-1. Install dependencies and build tools (`GHC`, `cabal` and dev libs):
-
-   ```sh
-   # On Ubuntu. Depending on your distribution, use your package manager to determine package names.
-   sudo apt-get update && apt-get install -y build-essential curl libffi-dev libffi7 libgmp3-dev libgmp10 libncurses-dev libncurses5 libtinfo5 pkg-config zlib1g-dev libnuma-dev libssl-dev
-   export BOOTSTRAP_HASKELL_GHC_VERSION=9.6.3
-   export BOOTSTRAP_HASKELL_CABAL_VERSION=3.10.3.0
-   curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
-   ghcup set ghc "${BOOTSTRAP_HASKELL_GHC_VERSION}"
-   ghcup set cabal "${BOOTSTRAP_HASKELL_CABAL_VERSION}"
-   source ~/.ghcup/env
-   ```
-
-2. Build the project:
-
-   ```sh
-   git clone https://github.com/simplex-chat/simplexmq
-   cd simplexmq
-   git checkout stable
-   cabal update
-   cabal build exe:smp-server exe:xftp-server
-   ```
-
-3. List compiled binaries:
-
-   `smp-server`
-   ```sh
-   cabal list-bin exe:smp-server
-   ```
-
-   `xftp-server`
-   ```sh
-   cabal list-bin exe:xftp-server
-   ```
-
-- Initialize SMP server with `smp-server init [-l] -n <fqdn>` or `smp-server init [-l] --ip <ip>` - depending on how you initialize it, either FQDN or IP will be used for server's address.
-
-- Run `smp-server start` to start SMP server, or you can configure a service manager to run it as a service.
-
-- Optionally, `smp-server` can be setup for having an onion address in `tor` network. See: [`scripts/tor`](./scripts/tor/). In this case, the server address can have both public and onion hostname pointing to the same server, to allow two people connect when only one of them is using Tor. The server address would be: `smp://<fingerprint>@<public_hostname>,<onion_hostname>`
-
-See [this section](#smp-server) for more information. Run `smp-server -h` and `smp-server init -h` for explanation of commands and options.
-
-[<img alt="Linode" src="./img/linode.svg" align="right" width="200">](https://cloud.linode.com/stackscripts/748014)
+[<img alt="Linode" src="https://raw.githubusercontent.com/simplex-chat/simplexmq/master/img/linode.svg" align="right" width="200">](https://cloud.linode.com/stackscripts/748014)
 
 ## Deploy SMP server on Linode
 
-\* You can use free credit Linode offers when [creating a new account](https://www.linode.com/) to deploy an SMP server.
+You can get Linode [free credits](https://www.linode.com/lp/affiliate-referral/?irclickid=02-QkdTEpxyLW0W0EOSREQreUkB2DtzGE2lGTE0&irgwc=1&utm_source=impact) to deploy SMP server.
 
-Deployment on Linode is performed via StackScripts, which serve as recipes for Linode instances, also called Linodes. To deploy SMP server on Linode:
+Deployment on [Linode](https://www.linode.com/) is performed via StackScripts, which serve as recipes for Linode instances, also called Linodes. To deploy SMP server on Linode:
 
 - Create a Linode account or login with an already existing one.
 - Open [SMP server StackScript](https://cloud.linode.com/stackscripts/748014) and click "Deploy New Linode".
 - You can optionally configure the following parameters:
-  - SMP Server store log flag for queue persistence on server restart, recommended.
-  - [Linode API token](https://www.linode.com/docs/guides/getting-started-with-the-linode-api#get-an-access-token) to attach server address etc. as tags to Linode and to add A record to your 2nd level domain (e.g. `example.com` [domain should be created](https://cloud.linode.com/domains/create) in your account prior to deployment). The API token access scopes:
-    - read/write for "linodes"
-    - read/write for "domains"
-  - Domain name to use instead of Linode IP address, e.g. `smp1.example.com`.
-- Choose the region and plan, Shared CPU Nanode with 1Gb is sufficient.
-- Provide ssh key to be able to connect to your Linode via ssh. If you haven't provided a Linode API token this step is required to login to your Linode and get the server's fingerprint either from the welcome message or from the file `/etc/opt/simplex/fingerprint` after server starts. See [Linode's guide on ssh](https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/) .
+    - [SMP Server store log](#SMP-server) flag for queue persistence on server restart (recommended).
+    - [Linode API token](https://www.linode.com/docs/guides/getting-started-with-the-linode-api#get-an-access-token) for attaching server info as tags to Linode (server address, public key hash, version) and adding A record to your 2nd level domain (Note: 2nd level e.g. `example.com` domain should be [created](https://cloud.linode.com/domains/create) in your account prior to deployment). The API token access scope should be read/write access to "linodes" (to update linode tags - you need them), and "domains" (to add A record for the 3rd level domain, e.g. `smp`).
+    - Domain name to use instead of Linode ip address, e.g. `smp.example.com`.
+- Choose the region and plan according to your requirements (for regular use Shared CPU Nanode should be sufficient).
+- Provide ssh key to be able to connect to your Linode via ssh. This step is required if you haven't provided a Linode API token, because you will need to login to your Linode and get a public key hash either from the welcome message or from the file `/etc/opt/simplex/pub_key_hash` on your Linode after SMP server starts.
 - Deploy your Linode. After it starts wait for SMP server to start and for tags to appear (if a Linode API token was provided). It may take up to 5 minutes depending on the connection speed on the Linode. Connecting Linode IP address to provided domain name may take some additional time.
-- Get `address` and `fingerprint` either from Linode tags (click on a tag and copy it's value from the browser search panel) or via ssh.
-- Great, your own SMP server is ready! If you provided FQDN use `smp://<fingerprint>@<fqdn>` as SMP server address in the client, otherwise use `smp://<fingerprint>@<ip_address>`.
+- Get `hostname` and `hash` either from Linode tags (click on a tag and copy it's value from the browser search panel) or via ssh. Linode has a good [guide](https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/) about ssh.
+- Great, your own SMP server is ready! Use `address#hash` as SMP server address in the client.
 
 Please submit an [issue](https://github.com/simplex-chat/simplexmq/issues) if any problems occur.
 
-[<img alt="DigitalOcean" src="/img/digitalocean.png" align="right" width="300">](https://marketplace.digitalocean.com/apps/simplex-server)
+[<img alt="DigitalOcean" src="https://raw.githubusercontent.com/simplex-chat/simplexmq/master/img/digitalocean.png" align="right" width="300">](https://marketplace.digitalocean.com/apps/simplex-server)
 
 ## Deploy SMP server on DigitalOcean
 
-> 🚧 DigitalOcean snapshot is currently not up to date, it will soon be updated 🏗️
-
-\* When creating a DigitalOcean account you can use [this link](https://try.digitalocean.com/freetrialoffer/) to get free credit. (You would still be required either to provide your credit card details or make a confirmation pre-payment with PayPal)
-
-To deploy SMP server use [SimpleX Server 1-click app](https://marketplace.digitalocean.com/apps/simplex-server) from DigitalOcean marketplace:
+You can deploy SMP server using [SimpleX Server 1-click app](https://marketplace.digitalocean.com/apps/simplex-server) from DigitalOcean marketplace:
 
 - Create a DigitalOcean account or login with an already existing one.
 - Click 'Create SimpleX server Droplet' button.
-- Choose the region and plan according to your requirements (Basic plan should be sufficient).
-- Finalize Droplet creation.
-- Open "Console" on your Droplet management page to get SMP server fingerprint - either from the welcome message or from `/etc/opt/simplex/fingerprint`. Alternatively you can manually SSH to created Droplet, see [DigitalOcean instruction](https://docs.digitalocean.com/products/droplets/how-to/connect-with-ssh/).
-- Great, your own SMP server is ready! Use `smp://<fingerprint>@<ip_address>` as SMP server address in the client.
+- Choose the region and plan according to your requirements (cheapest Regular plan should be sufficient).
+- Provide ssh key and confirm Droplet creation. 
+- SSH to created Droplet (`ssh root@<droplet_ip_address>`) to get SMP server public key hash - either from the welcome message or from `/etc/opt/simplex/pub_key_hash`. DigitalOcean has a good guide on [how to login to Droplet via ssh](https://docs.digitalocean.com/products/droplets/how-to/connect-with-ssh/).
+- Great, your own SMP server is ready! Use `ip_address#hash` as SMP server address in the client.
 
 Please submit an [issue](https://github.com/simplex-chat/simplexmq/issues) if any problems occur.
 
-> **Please note:** SMP server uses server address as a Common Name for server certificate generated during initialization. If you would like your server address to be FQDN instead of IP address, you can log in to your Droplet and run the commands below to re-initialize the server. Alternatively you can use [Linode StackScript](https://cloud.linode.com/stackscripts/748014) which allows this parameterization.
-
-```sh
-smp-server delete
-smp-server init [-l] -n <fqdn>
-```
-
 ## SMP server design
 
-![SMP server design](./design/server.svg)
+![SMP server design](https://raw.githubusercontent.com/simplex-chat/simplexmq/master/design/server.svg)
 
 ## SMP agent design
 
-![SMP agent design](./design/agent2.svg)
+![SMP agent design](https://raw.githubusercontent.com/simplex-chat/simplexmq/master/design/agent2.svg)
 
 ## License
 
-[AGPL v3](./LICENSE)
+[AGPL v3](https://github.com/simplex-chat/simplexmq/blob/master/LICENSE)

apps/ntf-server/Main.hs

@@ -1,20 +0,0 @@
-module Main where
-
-import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
-import Simplex.Messaging.Notifications.Server.Main
-
-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex-notifications"
-
-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex-notifications"
-
-logCfg :: LogConfig
-logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
-
-main :: IO ()
-main = do
-  cfgPath <- getEnvPath "NTF_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "NTF_SERVER_LOG_PATH" defaultLogPath
-  withGlobalLogging logCfg $ ntfServerCLI cfgPath logPath

apps/smp-agent/Main.hs

@@ -1,46 +1,23 @@
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE TypeApplications #-}
 
 module Main where
 
 import Control.Logger.Simple
-import Data.ByteArray (ScrubbedBytes)
 import qualified Data.List.NonEmpty as L
-import qualified Data.Map.Strict as M
+import Simplex.Messaging.Agent (runSMPAgent)
 import Simplex.Messaging.Agent.Env.SQLite
-import Simplex.Messaging.Agent.Server (runSMPAgent)
-import Simplex.Messaging.Agent.Store.SQLite (MigrationConfirmation (..))
-import Simplex.Messaging.Client (defaultNetworkConfig)
-import Simplex.Messaging.Transport (TLS, Transport (..))
+import Simplex.Messaging.Transport (TCP, Transport (..))
 
 cfg :: AgentConfig
-cfg = defaultAgentConfig
-
-agentDbFile :: String
-agentDbFile = "smp-agent.db"
-
-agentDbKey :: ScrubbedBytes
-agentDbKey = ""
-
-servers :: InitialAgentServers
-servers =
-  InitialAgentServers
-    { smp = M.fromList [(1, L.fromList ["smp://bU0K-bRg24xWW__lS0umO1Zdw_SXqpJNtm1_RrPLViE=@localhost:5223"])],
-      ntf = [],
-      xftp = M.empty,
-      netCfg = defaultNetworkConfig
-    }
+cfg = defaultAgentConfig {smpServers = L.fromList ["localhost:5223#bU0K+bRg24xWW//lS0umO1Zdw/SXqpJNtm1/RrPLViE="]}
 
 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
 
--- Warning: this SMP agent server is experimental - it does not work correctly with multiple connected TCP clients in some cases.
 main :: IO ()
 main = do
-  let AgentConfig {tcpPort} = cfg
-  putStrLn $ maybe (error "no agent port") (\port -> "SMP agent listening on port " ++ port) tcpPort
+  putStrLn $ "SMP agent listening on port " ++ tcpPort (cfg :: AgentConfig)
   setLogLevel LogInfo -- LogError
-  Right st <- createAgentStore agentDbFile agentDbKey False MCConsole
-  withGlobalLogging logCfg $ runSMPAgent (transport @TLS) cfg servers st
+  withGlobalLogging logCfg $ runSMPAgent (transport @TCP) cfg

apps/smp-server/Main.hs

@@ -1,21 +1,277 @@
+{-# LANGUAGE DataKinds #-}
+{-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TypeApplications #-}
+
 module Main where
 
-import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
-import Simplex.Messaging.Server.Main
-import qualified Static
+import Control.Monad.Except
+import Control.Monad.Trans.Except
+import qualified Crypto.Store.PKCS8 as S
+import Data.ByteString.Base64 (encode)
+import qualified Data.ByteString.Char8 as B
+import Data.Char (toLower)
+import Data.Ini (Ini, lookupValue, readIniFile)
+import Data.Text (Text)
+import qualified Data.Text as T
+import Data.X509 (PrivKey (PrivKeyRSA))
+import Network.Socket (ServiceName)
+import Options.Applicative
+import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Server (runSMPServer)
+import Simplex.Messaging.Server.Env.STM
+import Simplex.Messaging.Server.StoreLog (StoreLog, openReadStoreLog, storeLogFilePath)
+import Simplex.Messaging.Transport (ATransport (..), TCP, Transport (..))
+import Simplex.Messaging.Transport.WebSockets (WS)
+import System.Directory (createDirectoryIfMissing, doesFileExist, removeFile)
+import System.Exit (exitFailure)
+import System.FilePath (combine)
+import System.IO (IOMode (..), hFlush, stdout)
+import Text.Read (readEither)
 
-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex"
+defaultServerPort :: ServiceName
+defaultServerPort = "5223"
 
-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex"
+defaultBlockSize :: Int
+defaultBlockSize = 4096
 
-logCfg :: LogConfig
-logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
+serverConfig :: ServerConfig
+serverConfig =
+  ServerConfig
+    { tbqSize = 16,
+      serverTbqSize = 128,
+      msgQueueQuota = 256,
+      queueIdBytes = 12,
+      msgIdBytes = 6,
+      -- below parameters are set based on ini file /etc/opt/simplex/smp-server.ini
+      transports = undefined,
+      storeLog = undefined,
+      blockSize = undefined,
+      serverPrivateKey = undefined
+    }
+
+newKeySize :: Int
+newKeySize = 2048 `div` 8
+
+cfgDir :: FilePath
+cfgDir = "/etc/opt/simplex"
+
+logDir :: FilePath
+logDir = "/var/opt/simplex"
+
+defaultStoreLogFile :: FilePath
+defaultStoreLogFile = combine logDir "smp-server-store.log"
+
+iniFile :: FilePath
+iniFile = combine cfgDir "smp-server.ini"
+
+defaultKeyFile :: FilePath
+defaultKeyFile = combine cfgDir "server_key"
 
 main :: IO ()
 main = do
-  cfgPath <- getEnvPath "SMP_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "SMP_SERVER_LOG_PATH" defaultLogPath
-  withGlobalLogging logCfg $ smpServerCLI_ Static.generateSite Static.serveStaticFiles Static.attachStaticFiles cfgPath logPath
+  opts <- getServerOpts
+  case serverCommand opts of
+    ServerInit ->
+      runExceptT (getConfig opts) >>= \case
+        Right cfg -> do
+          putStrLn "Error: server is already initialized. Start it with `smp-server start` command"
+          printConfig cfg
+          exitFailure
+        Left _ -> do
+          cfg <- initializeServer opts
+          putStrLn "Server was initialized. Start it with `smp-server start` command"
+          printConfig cfg
+    ServerStart ->
+      runExceptT (getConfig opts) >>= \case
+        Right cfg -> runServer cfg
+        Left e -> do
+          putStrLn $ "Server is not initialized: " <> e
+          putStrLn "Initialize server with `smp-server init` command"
+          exitFailure
+    ServerDelete -> do
+      deleteServer
+      putStrLn "Server key, config file and store log deleted"
+
+getConfig :: ServerOpts -> ExceptT String IO ServerConfig
+getConfig opts = do
+  ini <- readIni
+  pk <- readKey ini
+  storeLog <- liftIO $ openStoreLog opts ini
+  pure $ makeConfig ini pk storeLog
+
+makeConfig :: IniOpts -> C.FullPrivateKey -> Maybe (StoreLog 'ReadMode) -> ServerConfig
+makeConfig IniOpts {serverPort, blockSize, enableWebsockets} pk storeLog =
+  let transports = (serverPort, transport @TCP) : [("80", transport @WS) | enableWebsockets]
+   in serverConfig {serverPrivateKey = pk, storeLog, blockSize, transports}
+
+printConfig :: ServerConfig -> IO ()
+printConfig ServerConfig {serverPrivateKey, storeLog} = do
+  B.putStrLn $ "transport key hash: " <> serverKeyHash serverPrivateKey
+  putStrLn $ case storeLog of
+    Just s -> "store log: " <> storeLogFilePath s
+    Nothing -> "store log disabled"
+
+initializeServer :: ServerOpts -> IO ServerConfig
+initializeServer opts = do
+  createDirectoryIfMissing False cfgDir
+  ini <- createIni opts
+  pk <- createKey ini
+  storeLog <- openStoreLog opts ini
+  pure $ makeConfig ini pk storeLog
+
+runServer :: ServerConfig -> IO ()
+runServer cfg = do
+  printConfig cfg
+  forM_ (transports cfg) $ \(port, ATransport t) ->
+    putStrLn $ "listening on port " <> port <> " (" <> transportName t <> ")"
+  runSMPServer cfg
+
+deleteServer :: IO ()
+deleteServer = do
+  ini <- runExceptT readIni
+  deleteIfExists iniFile
+  case ini of
+    Right IniOpts {storeLogFile, serverKeyFile} -> do
+      deleteIfExists storeLogFile
+      deleteIfExists serverKeyFile
+    Left _ -> do
+      deleteIfExists defaultKeyFile
+      deleteIfExists defaultStoreLogFile
+
+data IniOpts = IniOpts
+  { enableStoreLog :: Bool,
+    storeLogFile :: FilePath,
+    serverKeyFile :: FilePath,
+    serverPort :: ServiceName,
+    blockSize :: Int,
+    enableWebsockets :: Bool
+  }
+
+readIni :: ExceptT String IO IniOpts
+readIni = do
+  fileExists iniFile
+  ini <- ExceptT $ readIniFile iniFile
+  let enableStoreLog = (== Right "on") $ lookupValue "STORE_LOG" "enable" ini
+      storeLogFile = opt defaultStoreLogFile "STORE_LOG" "file" ini
+      serverKeyFile = opt defaultKeyFile "TRANSPORT" "key_file" ini
+      serverPort = opt defaultServerPort "TRANSPORT" "port" ini
+      enableWebsockets = (== Right "on") $ lookupValue "TRANSPORT" "websockets" ini
+  blockSize <- liftEither . readEither $ opt (show defaultBlockSize) "TRANSPORT" "block_size" ini
+  pure IniOpts {enableStoreLog, storeLogFile, serverKeyFile, serverPort, blockSize, enableWebsockets}
+  where
+    opt :: String -> Text -> Text -> Ini -> String
+    opt def section key ini = either (const def) T.unpack $ lookupValue section key ini
+
+createIni :: ServerOpts -> IO IniOpts
+createIni ServerOpts {enableStoreLog} = do
+  writeFile iniFile $
+    "[STORE_LOG]\n\
+    \# The server uses STM memory to store SMP queues and messages,\n\
+    \# that will be lost on restart (e.g., as with redis).\n\
+    \# This option enables saving SMP queues to append only log,\n\
+    \# and restoring them when the server is started.\n\
+    \# Log is compacted on start (deleted queues are removed).\n\
+    \# The messages in the queues are not logged.\n\n"
+      <> (if enableStoreLog then "" else "# ")
+      <> "enable: on\n\
+         \# file: "
+      <> defaultStoreLogFile
+      <> "\n\n\
+         \[TRANSPORT]\n\n\
+         \# key_file: "
+      <> defaultKeyFile
+      <> "\n\
+         \# port: "
+      <> defaultServerPort
+      <> "\n\
+         \# block_size: "
+      <> show defaultBlockSize
+      <> "\n\
+         \websockets: on\n"
+  pure
+    IniOpts
+      { enableStoreLog,
+        storeLogFile = defaultStoreLogFile,
+        serverKeyFile = defaultKeyFile,
+        serverPort = defaultServerPort,
+        blockSize = defaultBlockSize,
+        enableWebsockets = True
+      }
+
+readKey :: IniOpts -> ExceptT String IO C.FullPrivateKey
+readKey IniOpts {serverKeyFile} = do
+  fileExists serverKeyFile
+  liftIO (S.readKeyFile serverKeyFile) >>= \case
+    [S.Unprotected (PrivKeyRSA pk)] -> pure $ C.FullPrivateKey pk
+    [_] -> err "not RSA key"
+    [] -> err "invalid key file format"
+    _ -> err "more than one key"
+  where
+    err :: String -> ExceptT String IO b
+    err e = throwE $ e <> ": " <> serverKeyFile
+
+createKey :: IniOpts -> IO C.FullPrivateKey
+createKey IniOpts {serverKeyFile} = do
+  (_, pk) <- C.generateKeyPair newKeySize
+  S.writeKeyFile S.TraditionalFormat serverKeyFile [PrivKeyRSA $ C.rsaPrivateKey pk]
+  pure pk
+
+fileExists :: FilePath -> ExceptT String IO ()
+fileExists path = do
+  exists <- liftIO $ doesFileExist path
+  unless exists . throwE $ "file " <> path <> " not found"
+
+deleteIfExists :: FilePath -> IO ()
+deleteIfExists path = doesFileExist path >>= (`when` removeFile path)
+
+confirm :: String -> IO ()
+confirm msg = do
+  putStr $ msg <> " (y/N): "
+  hFlush stdout
+  ok <- getLine
+  when (map toLower ok /= "y") exitFailure
+
+serverKeyHash :: C.FullPrivateKey -> B.ByteString
+serverKeyHash = encode . C.unKeyHash . C.publicKeyHash . C.publicKey'
+
+openStoreLog :: ServerOpts -> IniOpts -> IO (Maybe (StoreLog 'ReadMode))
+openStoreLog ServerOpts {enableStoreLog = l} IniOpts {enableStoreLog = l', storeLogFile = f}
+  | l || l' = do
+    createDirectoryIfMissing True logDir
+    Just <$> openReadStoreLog f
+  | otherwise = pure Nothing
+
+data ServerOpts = ServerOpts
+  { serverCommand :: ServerCommand,
+    enableStoreLog :: Bool
+  }
+
+data ServerCommand = ServerInit | ServerStart | ServerDelete
+
+serverOpts :: Parser ServerOpts
+serverOpts =
+  ServerOpts
+    <$> subparser
+      ( command "init" (info (pure ServerInit) (progDesc "Initialize server: generate server key and ini file"))
+          <> command "start" (info (pure ServerStart) (progDesc "Start server (ini: /etc/opt/simplex/smp-server.ini)"))
+          <> command "delete" (info (pure ServerDelete) (progDesc "Delete server key, ini file and store log"))
+      )
+    <*> switch
+      ( long "store-log"
+          <> short 'l'
+          <> help "enable store log for SMP queues persistence"
+      )
+
+getServerOpts :: IO ServerOpts
+getServerOpts = customExecParser p opts
+  where
+    p = prefs showHelpOnEmpty
+    opts =
+      info
+        (serverOpts <**> helper)
+        ( fullDesc
+            <> header "Simplex Messaging Protocol (SMP) Server"
+        )

apps/smp-server/static/.well-known/apple-app-site-association

@@ -1,49 +0,0 @@
-{
-  "applinks": {
-    "details": [
-      {
-        "appIDs": [
-          "5NN7GUYB6T.chat.simplex.app"
-        ],
-        "components": [
-          {
-            "/": "/contact/*"
-          },
-          {
-            "/": "/contact"
-          },
-          {
-            "/": "/invitation/*"
-          },
-          {
-            "/": "/invitation"
-          },
-          {
-            "/": "/a/*"
-          },
-          {
-            "/": "/a"
-          },
-          {
-            "/": "/c/*"
-          },
-          {
-            "/": "/c"
-          },
-          {
-            "/": "/g/*"
-          },
-          {
-            "/": "/g"
-          },
-          {
-            "/": "/i/*"
-          },
-          {
-            "/": "/i"
-          }
-        ]
-      }
-    ]
-  }
-}

apps/smp-server/static/.well-known/assetlinks.json

@@ -1,16 +0,0 @@
-[
-    {
-        "relation": [
-            "delegate_permission/common.handle_all_urls"
-        ],
-        "target": {
-            "namespace": "android_app",
-            "package_name": "chat.simplex.app",
-            "sha256_cert_fingerprints": [
-                "5E:3E:DC:C2:00:FB:A8:D5:F4:88:F3:CA:4C:32:5B:05:78:C5:6A:9C:03:A1:CC:B5:92:9C:D7:5C:7E:57:E2:4D",
-                "3C:52:C4:FD:3C:AD:1C:07:C9:B0:0A:70:80:E3:58:FA:B9:FE:FC:B8:AF:5A:EC:14:77:65:F1:6D:0F:21:AD:85",
-                "AE:C1:95:DC:FD:46:14:BD:3A:91:EC:26:D1:D5:14:C8:75:71:C5:CC:8D:CF:48:08:3F:92:83:14:3C:A2:B9:A6"
-            ]
-        }
-    }
-]

apps/smp-server/static/a/index.html

@@ -1 +0,0 @@
-../link.html

apps/smp-server/static/c/index.html

@@ -1 +0,0 @@
-../link.html

apps/smp-server/static/contact/index.html

@@ -1 +0,0 @@
-../link.html

apps/smp-server/static/i/index.html

@@ -1 +0,0 @@
-../link.html

apps/smp-server/static/invitation/index.html

@@ -1 +0,0 @@
-../link.html

apps/smp-server/static/media/apple_store.svg

@@ -1,26 +0,0 @@
-<svg width="119" height="40" viewBox="0 0 119 40" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M8.44484 39.125C8.14016 39.125 7.84284 39.1211 7.54055 39.1143C6.91433 39.1061 6.28957 39.0516 5.67141 38.9512C5.095 38.8519 4.53661 38.6673 4.01467 38.4033C3.49751 38.1415 3.02582 37.7983 2.61767 37.3867C2.20361 36.98 1.85888 36.5082 1.59716 35.9902C1.33255 35.4688 1.14942 34.9099 1.05416 34.333C0.951281 33.7131 0.895621 33.0863 0.887656 32.458C0.881316 32.2471 0.873016 31.5449 0.873016 31.5449V8.44434C0.873016 8.44434 0.881856 7.75293 0.887706 7.5498C0.895332 6.92248 0.950669 6.29665 1.05324 5.67773C1.14868 5.09925 1.33194 4.53875 1.5967 4.01563C1.85746 3.49794 2.20027 3.02586 2.61184 2.61768C3.02294 2.20562 3.49614 1.8606 4.01418 1.59521C4.53492 1.33209 5.09225 1.14873 5.6675 1.05127C6.28769 0.949836 6.91462 0.894996 7.54301 0.88721L8.44533 0.875H111.214L112.127 0.8877C112.75 0.895099 113.371 0.94945 113.985 1.05029C114.566 1.14898 115.13 1.33362 115.656 1.59814C116.694 2.13299 117.539 2.97916 118.071 4.01807C118.332 4.53758 118.512 5.09351 118.606 5.66699C118.71 6.29099 118.768 6.92174 118.78 7.5542C118.783 7.8374 118.783 8.1416 118.783 8.44434C118.791 8.81934 118.791 9.17627 118.791 9.53613V30.4648C118.791 30.8281 118.791 31.1826 118.783 31.54C118.783 31.8652 118.783 32.1631 118.779 32.4697C118.768 33.0909 118.71 33.7104 118.608 34.3232C118.515 34.9043 118.333 35.4675 118.068 35.9932C117.805 36.5056 117.462 36.9733 117.053 37.3789C116.644 37.7927 116.172 38.1379 115.653 38.4014C115.128 38.6674 114.566 38.8527 113.985 38.9512C113.367 39.0522 112.742 39.1067 112.116 39.1143C111.823 39.1211 111.517 39.125 111.219 39.125L110.135 39.127L8.44484 39.125Z" fill="black"/>
-<path d="M24.7689 20.3007C24.7796 19.466 25.0013 18.6477 25.4134 17.9217C25.8254 17.1957 26.4144 16.5858 27.1254 16.1486C26.6737 15.5035 26.0778 14.9725 25.3849 14.598C24.6921 14.2234 23.9215 14.0156 23.1343 13.991C21.455 13.8147 19.8271 14.9958 18.9714 14.9958C18.0991 14.9958 16.7816 14.0085 15.3629 14.0376C14.4452 14.0673 13.5509 14.3341 12.767 14.8122C11.9831 15.2903 11.3364 15.9632 10.89 16.7655C8.95597 20.1139 10.3986 25.035 12.2512 27.7416C13.1781 29.0669 14.2613 30.5474 15.6788 30.4949C17.0659 30.4374 17.5839 29.6104 19.2582 29.6104C20.917 29.6104 21.403 30.4949 22.8492 30.4615C24.3376 30.4374 25.2753 29.1303 26.1697 27.7924C26.8357 26.848 27.3481 25.8043 27.6881 24.6999C26.8234 24.3341 26.0855 23.722 25.5664 22.9397C25.0473 22.1574 24.7699 21.2396 24.7689 20.3007V20.3007Z" fill="white"/>
-<path d="M22.0373 12.2109C22.8488 11.2367 23.2486 9.98451 23.1518 8.72028C21.9119 8.8505 20.7667 9.44306 19.9442 10.3799C19.5421 10.8376 19.2341 11.37 19.0378 11.9468C18.8416 12.5235 18.7609 13.1333 18.8005 13.7413C19.4206 13.7477 20.0341 13.6132 20.5948 13.3482C21.1555 13.0831 21.6487 12.6942 22.0373 12.2109Z" fill="white"/>
-<path d="M42.3023 27.1396H37.5689L36.4322 30.4961H34.4273L38.9107 18.0781H40.9937L45.4771 30.4961H43.438L42.3023 27.1396ZM38.0591 25.5908H41.8111L39.9615 20.1435H39.9097L38.0591 25.5908Z" fill="white"/>
-<path d="M55.1597 25.9697C55.1597 28.7832 53.6538 30.5908 51.3814 30.5908C50.8057 30.6209 50.2332 30.4883 49.7294 30.2082C49.2256 29.928 48.8109 29.5117 48.5327 29.0068H48.4897V33.4912H46.6313V21.4424H48.4302V22.9482H48.4644C48.7553 22.4458 49.1771 22.0316 49.6847 21.7497C50.1923 21.4679 50.7669 21.3289 51.3472 21.3476C53.645 21.3477 55.1597 23.1641 55.1597 25.9697ZM53.2495 25.9697C53.2495 24.1367 52.3023 22.9316 50.857 22.9316C49.437 22.9316 48.482 24.1621 48.482 25.9697C48.482 27.7939 49.437 29.0156 50.857 29.0156C52.3023 29.0156 53.2495 27.8193 53.2495 25.9697Z" fill="white"/>
-<path d="M65.1245 25.9697C65.1245 28.7832 63.6187 30.5908 61.3462 30.5908C60.7706 30.6209 60.1981 30.4883 59.6943 30.2082C59.1905 29.928 58.7758 29.5117 58.4976 29.0068H58.4546V33.4912H56.5962V21.4424H58.395V22.9482H58.4292C58.7201 22.4458 59.1419 22.0316 59.6495 21.7497C60.1571 21.4679 60.7317 21.3289 61.312 21.3476C63.6099 21.3476 65.1245 23.164 65.1245 25.9697ZM63.2144 25.9697C63.2144 24.1367 62.2671 22.9316 60.8218 22.9316C59.4019 22.9316 58.4468 24.1621 58.4468 25.9697C58.4468 27.7939 59.4019 29.0156 60.8218 29.0156C62.2671 29.0156 63.2144 27.8193 63.2144 25.9697H63.2144Z" fill="white"/>
-<path d="M71.7105 27.0361C71.8482 28.2676 73.0445 29.0761 74.6792 29.0761C76.2456 29.0761 77.3726 28.2675 77.3726 27.1572C77.3726 26.1933 76.6929 25.6162 75.0835 25.2207L73.4742 24.833C71.1939 24.2822 70.1353 23.2158 70.1353 21.4853C70.1353 19.3427 72.0025 17.871 74.6538 17.871C77.2778 17.871 79.0767 19.3427 79.1372 21.4853H77.2612C77.1489 20.246 76.1245 19.498 74.6274 19.498C73.1304 19.498 72.106 20.2548 72.106 21.3564C72.106 22.2343 72.7603 22.7509 74.3608 23.1464L75.729 23.4823C78.2769 24.0849 79.3355 25.1083 79.3355 26.9247C79.3355 29.248 77.4849 30.703 74.5415 30.703C71.7876 30.703 69.9282 29.2821 69.8081 27.036L71.7105 27.0361Z" fill="white"/>
-<path d="M83.3462 19.2998V21.4424H85.0679V22.9141H83.3462V27.9053C83.3462 28.6807 83.6909 29.042 84.4478 29.042C84.6522 29.0384 84.8562 29.0241 85.0591 28.999V30.4619C84.7188 30.5255 84.373 30.5543 84.0269 30.5478C82.1939 30.5478 81.479 29.8593 81.479 28.1035V22.9141H80.1626V21.4424H81.479V19.2998H83.3462Z" fill="white"/>
-<path d="M86.065 25.9697C86.065 23.1211 87.7427 21.3311 90.3589 21.3311C92.9839 21.3311 94.6539 23.1211 94.6539 25.9697C94.6539 28.8262 92.9927 30.6084 90.3589 30.6084C87.7261 30.6084 86.065 28.8262 86.065 25.9697ZM92.7603 25.9697C92.7603 24.0156 91.8648 22.8623 90.3589 22.8623C88.8531 22.8623 87.9585 24.0244 87.9585 25.9697C87.9585 27.9316 88.8531 29.0762 90.3589 29.0762C91.8648 29.0762 92.7603 27.9316 92.7603 25.9697H92.7603Z" fill="white"/>
-<path d="M96.1861 21.4424H97.9585V22.9834H98.0015C98.1215 22.5021 98.4034 22.0768 98.8 21.7789C99.1966 21.481 99.6836 21.3287 100.179 21.3476C100.393 21.3469 100.607 21.3702 100.816 21.417V23.1553C100.546 23.0726 100.264 23.0347 99.981 23.043C99.711 23.032 99.4419 23.0796 99.192 23.1825C98.9422 23.2854 98.7176 23.4411 98.5336 23.639C98.3496 23.8369 98.2106 24.0723 98.1262 24.3289C98.0418 24.5856 98.0139 24.8575 98.0445 25.126V30.4961H96.1861L96.1861 21.4424Z" fill="white"/>
-<path d="M109.384 27.8369C109.134 29.4805 107.534 30.6084 105.486 30.6084C102.852 30.6084 101.217 28.8437 101.217 26.0127C101.217 23.1729 102.861 21.3311 105.408 21.3311C107.913 21.3311 109.488 23.0518 109.488 25.7969V26.4336H103.093V26.5459C103.064 26.8791 103.105 27.2148 103.216 27.5306C103.326 27.8464 103.502 28.1352 103.732 28.3778C103.963 28.6203 104.242 28.8111 104.552 28.9374C104.861 29.0637 105.195 29.1226 105.529 29.1103C105.968 29.1515 106.409 29.0498 106.785 28.8203C107.162 28.5909 107.455 28.246 107.62 27.8369L109.384 27.8369ZM103.102 25.1348H107.628C107.645 24.8352 107.6 24.5354 107.495 24.2541C107.39 23.9729 107.229 23.7164 107.02 23.5006C106.812 23.2849 106.561 23.1145 106.283 23.0003C106.006 22.8861 105.708 22.8305 105.408 22.8369C105.105 22.8351 104.805 22.8933 104.525 23.008C104.245 23.1227 103.99 23.2918 103.776 23.5054C103.562 23.7191 103.392 23.973 103.276 24.2527C103.16 24.5323 103.101 24.8321 103.102 25.1348V25.1348Z" fill="white"/>
-<path d="M37.8262 8.73101C38.2158 8.70305 38.6068 8.76191 38.9709 8.90335C39.335 9.04478 39.6632 9.26526 39.9318 9.54889C40.2004 9.83251 40.4026 10.1722 40.524 10.5435C40.6455 10.9148 40.6829 11.3083 40.6338 11.6959C40.6338 13.6021 39.6035 14.6979 37.8262 14.6979H35.6709V8.73101H37.8262ZM36.5977 13.854H37.7227C38.0011 13.8707 38.2797 13.825 38.5382 13.7204C38.7968 13.6158 39.0287 13.4548 39.2172 13.2493C39.4057 13.0437 39.546 12.7987 39.6279 12.5321C39.7097 12.2655 39.7311 11.9839 39.6904 11.708C39.7282 11.4332 39.7046 11.1534 39.6215 10.8887C39.5384 10.6241 39.3977 10.3811 39.2097 10.1771C39.0216 9.97322 38.7908 9.81341 38.5337 9.70917C38.2766 9.60494 37.9997 9.55885 37.7227 9.57422H36.5977V13.854Z" fill="white"/>
-<path d="M41.6807 12.4443C41.6524 12.1484 41.6862 11.8499 41.7801 11.5678C41.8739 11.2857 42.0257 11.0264 42.2256 10.8064C42.4255 10.5864 42.6693 10.4107 42.9411 10.2904C43.213 10.1701 43.507 10.108 43.8042 10.108C44.1015 10.108 44.3955 10.1701 44.6673 10.2904C44.9392 10.4107 45.1829 10.5864 45.3828 10.8064C45.5828 11.0264 45.7345 11.2857 45.8284 11.5678C45.9222 11.8499 45.9561 12.1484 45.9278 12.4443C45.9566 12.7406 45.9232 13.0396 45.8296 13.3221C45.736 13.6046 45.5843 13.8644 45.3843 14.0848C45.1843 14.3052 44.9404 14.4814 44.6683 14.6019C44.3962 14.7225 44.1018 14.7847 43.8042 14.7847C43.5066 14.7847 43.2123 14.7225 42.9401 14.6019C42.668 14.4814 42.4241 14.3052 42.2241 14.0848C42.0241 13.8644 41.8725 13.6046 41.7789 13.3221C41.6853 13.0396 41.6518 12.7406 41.6807 12.4443V12.4443ZM45.0137 12.4443C45.0137 11.4683 44.5752 10.8975 43.8057 10.8975C43.0332 10.8975 42.5987 11.4683 42.5987 12.4444C42.5987 13.4282 43.0333 13.9946 43.8057 13.9946C44.5752 13.9946 45.0137 13.4243 45.0137 12.4443H45.0137Z" fill="white"/>
-<path d="M51.5733 14.6978H50.6514L49.7207 11.3813H49.6504L48.7237 14.6978H47.8106L46.5694 10.1948H47.4707L48.2774 13.6308H48.3438L49.2696 10.1948H50.1221L51.0479 13.6308H51.1182L51.9209 10.1948H52.8096L51.5733 14.6978Z" fill="white"/>
-<path d="M53.8536 10.1948H54.709V10.9102H54.7754C54.8881 10.6532 55.0781 10.4379 55.319 10.2941C55.5598 10.1503 55.8396 10.0852 56.1192 10.1079C56.3383 10.0914 56.5583 10.1245 56.7629 10.2046C56.9675 10.2847 57.1514 10.4098 57.3011 10.5706C57.4508 10.7315 57.5624 10.9239 57.6276 11.1337C57.6928 11.3436 57.7099 11.5654 57.6778 11.7827V14.6977H56.7891V12.0059C56.7891 11.2822 56.4746 10.9224 55.8174 10.9224C55.6687 10.9154 55.5202 10.9408 55.3821 10.9966C55.244 11.0524 55.1197 11.1375 55.0176 11.2458C54.9154 11.3542 54.838 11.4834 54.7904 11.6245C54.7429 11.7657 54.7265 11.9154 54.7422 12.0635V14.6978H53.8535L53.8536 10.1948Z" fill="white"/>
-<path d="M59.0938 8.43701H59.9825V14.6978H59.0938V8.43701Z" fill="white"/>
-<path d="M61.2178 12.4443C61.1895 12.1484 61.2234 11.8498 61.3172 11.5677C61.4111 11.2857 61.5629 11.0263 61.7629 10.8063C61.9628 10.5863 62.2065 10.4106 62.4784 10.2903C62.7503 10.17 63.0443 10.1079 63.3416 10.1079C63.6389 10.1079 63.9329 10.17 64.2047 10.2903C64.4766 10.4106 64.7203 10.5863 64.9203 10.8063C65.1203 11.0263 65.272 11.2857 65.3659 11.5677C65.4598 11.8498 65.4936 12.1484 65.4654 12.4443C65.4942 12.7406 65.4607 13.0396 65.3671 13.3221C65.2734 13.6046 65.1218 13.8644 64.9217 14.0848C64.7217 14.3052 64.4778 14.4814 64.2057 14.6019C63.9335 14.7224 63.6392 14.7847 63.3416 14.7847C63.044 14.7847 62.7496 14.7224 62.4775 14.6019C62.2053 14.4814 61.9614 14.3052 61.7614 14.0848C61.5614 13.8644 61.4097 13.6046 61.3161 13.3221C61.2225 13.0396 61.189 12.7406 61.2178 12.4443V12.4443ZM64.5508 12.4443C64.5508 11.4683 64.1123 10.8975 63.3428 10.8975C62.5703 10.8975 62.1358 11.4683 62.1358 12.4444C62.1358 13.4282 62.5704 13.9946 63.3428 13.9946C64.1123 13.9946 64.5508 13.4243 64.5508 12.4443H64.5508Z" fill="white"/>
-<path d="M66.4009 13.4243C66.4009 12.6138 67.0044 12.1465 68.0757 12.0801L69.2954 12.0098V11.6211C69.2954 11.1455 68.981 10.877 68.3736 10.877C67.8775 10.877 67.5337 11.0591 67.4351 11.3775H66.5747C66.6656 10.604 67.3931 10.1079 68.4146 10.1079C69.5435 10.1079 70.1802 10.6699 70.1802 11.6211V14.6978H69.3247V14.065H69.2544C69.1117 14.292 68.9113 14.477 68.6737 14.6012C68.4361 14.7254 68.1697 14.7844 67.9019 14.772C67.7129 14.7916 67.5218 14.7715 67.341 14.7128C67.1603 14.6541 66.9938 14.5581 66.8524 14.4312C66.711 14.3042 66.5977 14.149 66.52 13.9756C66.4422 13.8022 66.4017 13.6144 66.4009 13.4243V13.4243ZM69.2954 13.0396V12.6631L68.1958 12.7334C67.5757 12.7749 67.2945 12.9859 67.2945 13.3828C67.2945 13.7881 67.646 14.0239 68.1295 14.0239C68.2711 14.0383 68.4142 14.024 68.5502 13.9819C68.6862 13.9398 68.8123 13.8708 68.9211 13.7789C69.0299 13.6871 69.1191 13.5743 69.1834 13.4473C69.2477 13.3203 69.2858 13.1816 69.2954 13.0396V13.0396Z" fill="white"/>
-<path d="M71.3482 12.4444C71.3482 11.0215 72.0796 10.1201 73.2173 10.1201C73.4987 10.1072 73.778 10.1746 74.0226 10.3145C74.2671 10.4544 74.4667 10.661 74.5982 10.9101H74.6646V8.43701H75.5533V14.6978H74.7017V13.9863H74.6314C74.4898 14.2338 74.2832 14.4378 74.0339 14.5763C73.7847 14.7148 73.5023 14.7825 73.2173 14.772C72.0718 14.772 71.3482 13.8706 71.3482 12.4444ZM72.2662 12.4444C72.2662 13.3994 72.7164 13.9741 73.4693 13.9741C74.2183 13.9741 74.6812 13.3911 74.6812 12.4483C74.6812 11.5098 74.2134 10.9185 73.4693 10.9185C72.7212 10.9185 72.2661 11.4971 72.2661 12.4444H72.2662Z" fill="white"/>
-<path d="M79.23 12.4443C79.2017 12.1484 79.2356 11.8499 79.3294 11.5678C79.4232 11.2857 79.575 11.0264 79.7749 10.8064C79.9749 10.5864 80.2186 10.4107 80.4904 10.2904C80.7623 10.1701 81.0563 10.108 81.3536 10.108C81.6508 10.108 81.9448 10.1701 82.2167 10.2904C82.4885 10.4107 82.7322 10.5864 82.9322 10.8064C83.1321 11.0264 83.2839 11.2857 83.3777 11.5678C83.4715 11.8499 83.5054 12.1484 83.4771 12.4443C83.5059 12.7406 83.4725 13.0396 83.3789 13.3221C83.2853 13.6046 83.1336 13.8644 82.9336 14.0848C82.7336 14.3052 82.4897 14.4814 82.2176 14.6019C81.9455 14.7225 81.6512 14.7847 81.3536 14.7847C81.0559 14.7847 80.7616 14.7225 80.4895 14.6019C80.2173 14.4814 79.9735 14.3052 79.7735 14.0848C79.5735 13.8644 79.4218 13.6046 79.3282 13.3221C79.2346 13.0396 79.2012 12.7406 79.23 12.4443V12.4443ZM82.563 12.4443C82.563 11.4683 82.1245 10.8975 81.355 10.8975C80.5826 10.8975 80.148 11.4683 80.148 12.4444C80.148 13.4282 80.5826 13.9946 81.355 13.9946C82.1245 13.9946 82.563 13.4243 82.563 12.4443Z" fill="white"/>
-<path d="M84.6695 10.1948H85.5249V10.9102H85.5913C85.704 10.6532 85.894 10.4379 86.1349 10.2941C86.3757 10.1503 86.6555 10.0852 86.9351 10.1079C87.1542 10.0914 87.3742 10.1245 87.5788 10.2046C87.7834 10.2847 87.9673 10.4098 88.117 10.5706C88.2667 10.7315 88.3783 10.9239 88.4435 11.1337C88.5087 11.3436 88.5258 11.5654 88.4937 11.7827V14.6977H87.605V12.0059C87.605 11.2822 87.2906 10.9224 86.6333 10.9224C86.4846 10.9154 86.3361 10.9408 86.198 10.9966C86.06 11.0524 85.9356 11.1375 85.8335 11.2458C85.7314 11.3542 85.6539 11.4834 85.6064 11.6245C85.5588 11.7657 85.5424 11.9154 85.5581 12.0635V14.6978H84.6695V10.1948Z" fill="white"/>
-<path d="M93.5152 9.07373V10.2153H94.4908V10.9639H93.5152V13.2793C93.5152 13.751 93.7095 13.9575 94.1519 13.9575C94.2651 13.9572 94.3783 13.9503 94.4908 13.937V14.6772C94.3312 14.7058 94.1695 14.721 94.0074 14.7226C93.0191 14.7226 92.6255 14.375 92.6255 13.5068V10.9638H91.9107V10.2153H92.6255V9.07373H93.5152Z" fill="white"/>
-<path d="M95.7046 8.43701H96.5855V10.9185H96.6558C96.7739 10.6591 96.9691 10.4425 97.2148 10.2982C97.4605 10.1539 97.7448 10.0888 98.0288 10.1118C98.2467 10.1 98.4646 10.1364 98.6669 10.2184C98.8692 10.3004 99.0509 10.4261 99.199 10.5864C99.3471 10.7468 99.458 10.9378 99.5238 11.146C99.5896 11.3541 99.6086 11.5742 99.5796 11.7905V14.6978H98.69V12.0098C98.69 11.2905 98.355 10.9263 97.7271 10.9263C97.5744 10.9137 97.4207 10.9347 97.277 10.9878C97.1332 11.0408 97.0027 11.1247 96.8948 11.2334C96.7868 11.3421 96.7038 11.4732 96.6518 11.6173C96.5997 11.7614 96.5798 11.9152 96.5933 12.0679V14.6977H95.7047L95.7046 8.43701Z" fill="white"/>
-<path d="M104.761 13.4819C104.641 13.8935 104.379 14.2495 104.022 14.4876C103.666 14.7258 103.236 14.8309 102.81 14.7847C102.513 14.7925 102.219 14.7357 101.946 14.6182C101.674 14.5006 101.43 14.3252 101.232 14.1041C101.034 13.8829 100.887 13.6214 100.8 13.3376C100.713 13.0537 100.689 12.7544 100.73 12.4605C100.691 12.1656 100.715 11.8656 100.801 11.581C100.888 11.2963 101.034 11.0335 101.231 10.8105C101.428 10.5874 101.671 10.4092 101.942 10.288C102.214 10.1668 102.509 10.1054 102.806 10.1079C104.059 10.1079 104.815 10.9639 104.815 12.3779V12.688H101.635V12.7378C101.621 12.9031 101.642 13.0694 101.696 13.2261C101.75 13.3829 101.837 13.5266 101.95 13.6481C102.062 13.7695 102.2 13.866 102.352 13.9314C102.504 13.9968 102.669 14.0297 102.835 14.0278C103.047 14.0533 103.262 14.0151 103.453 13.9178C103.644 13.8206 103.802 13.6689 103.906 13.4819L104.761 13.4819ZM101.635 12.0308H103.91C103.921 11.8796 103.9 11.7278 103.849 11.5851C103.798 11.4424 103.718 11.3119 103.614 11.2021C103.509 11.0922 103.383 11.0054 103.243 10.9472C103.103 10.8891 102.953 10.8608 102.801 10.8643C102.648 10.8623 102.495 10.8912 102.353 10.9491C102.21 11.0071 102.081 11.0929 101.972 11.2017C101.864 11.3104 101.778 11.4397 101.72 11.5821C101.662 11.7245 101.633 11.8771 101.635 12.0308H101.635Z" fill="white"/>
-</svg>

apps/smp-server/static/media/contact.js

@@ -1,77 +0,0 @@
-(function () {
-
-  let complete = false
-  run()
-  window.onload = run
-
-  async function run() {
-    const connURIel = document.getElementById("conn_req_uri_text");
-    const mobileConnURIanchor = document.getElementById("mobile_conn_req_uri");
-    const connQRCodes = document.getElementsByClassName("conn_req_uri_qrcode");
-    console.log(connQRCodes);
-    if (complete || !connURIel || !mobileConnURIanchor || connQRCodes < 2) return
-    complete = true
-    let connURI = document.location.toString()
-    const parsedURI = new URL(connURI)
-    const path = parsedURI.pathname.split("/")
-    const len = path.length
-    const action = path[len - (path[len - 1] == "" ? 2 : 1)]
-    parsedURI.protocol = "https"
-    parsedURI.pathname = "/" + action
-    connURI = parsedURI.toString()
-    console.log("connection URI: ", connURI)
-    const hash = parsedURI.hash
-    const hostname = parsedURI.hostname
-    let appURI = "simplex:" + parsedURI.pathname
-    appURI += action.length > 1 // not short link
-              ? hash
-              : !hash.includes("?") // otherwise add server hostname
-              ? hash + "?h=" + hostname // no parameters
-              : !hash.includes("?h=") && !hash.includes("&h=")
-              ? hash + "&h=" + hostname // no "h" parameter
-              : hash.replace(/([?&])h=([^&]+)/, `$1h=${hostname},$2`) // add as the first hostname to "h" parameter
-    mobileConnURIanchor.href = appURI
-    console.log("app URI: ", appURI)
-    connURIel.innerText = "/c " + connURI
-    for (const connQRCode of connQRCodes) {
-      try {
-        await QRCode.toCanvas(connQRCode, connURI, {
-          errorCorrectionLevel: "M",
-          color: {dark: "#062D56"}
-        });
-        connQRCode.style.width = "320px";
-        connQRCode.style.height = "320px";
-      } catch (err) {
-        console.error(err);
-      }
-    }
-
-    function contentCopyWithTooltip(parent) {
-      const content = parent.querySelector(".content");
-      const tooltip = parent.querySelector(".tooltiptext");
-      console.log(parent.querySelector(".content_copy"), 111)
-      console.log(parent)
-      const copyButton = parent.querySelector(".content_copy");
-      copyButton.addEventListener("click", copyAddress)
-      copyButton.addEventListener("mouseout", resetTooltip)
-
-      function copyAddress() {
-        navigator.clipboard.writeText(content.innerText || content.value);
-        tooltip.innerHTML = "Copied!";
-      }
-
-      function resetTooltip() {
-        tooltip.innerHTML = "Copy to clipboard";
-      }
-    }
-
-    function copyAddress() {
-      navigator.clipboard.writeText(connURI);
-      tooltipEl.innerHTML = "Copied!";
-    }
-
-    function resetTooltip() {
-      tooltipEl.innerHTML = "Copy to clipboard";
-    }
-  }
-})();

apps/smp-server/static/media/f_droid.svg

@@ -1,372 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   width="560"
-   height="164"
-   version="1.1"
-   id="svg1048"
-   sodipodi:docname="f_droid.svg"
-   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04, custom)"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:xlink="http://www.w3.org/1999/xlink"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg">
-  <sodipodi:namedview
-     id="namedview1050"
-     pagecolor="#505050"
-     bordercolor="#ffffff"
-     borderopacity="1"
-     inkscape:pageshadow="0"
-     inkscape:pageopacity="0"
-     inkscape:pagecheckerboard="1"
-     showgrid="false"
-     inkscape:snap-bbox="true"
-     inkscape:bbox-paths="true"
-     inkscape:bbox-nodes="true"
-     inkscape:snap-bbox-edge-midpoints="true"
-     inkscape:snap-bbox-midpoints="true"
-     inkscape:snap-intersection-paths="true"
-     inkscape:object-paths="true"
-     inkscape:snap-smooth-nodes="true"
-     inkscape:snap-midpoints="true"
-     inkscape:snap-object-midpoints="true"
-     inkscape:snap-center="true"
-     inkscape:snap-text-baseline="true"
-     inkscape:snap-page="true"
-     fit-margin-top="0"
-     fit-margin-left="0"
-     fit-margin-right="0"
-     fit-margin-bottom="0"
-     inkscape:zoom="1.1996734"
-     inkscape:cx="186.71748"
-     inkscape:cy="100.02722"
-     inkscape:window-width="1920"
-     inkscape:window-height="1007"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="svg1048" />
-  <defs
-     id="defs974">
-    <linearGradient
-       id="a">
-      <stop
-         offset="0"
-         stop-color="#fff"
-         stop-opacity=".098"
-         id="stop968" />
-      <stop
-         offset="1"
-         stop-color="#fff"
-         stop-opacity="0"
-         id="stop970" />
-    </linearGradient>
-    <radialGradient
-       xlink:href="#a"
-       id="b"
-       cx="113"
-       cy="-12.89"
-       fx="113"
-       fy="-12.89"
-       r="59.661999"
-       gradientTransform="matrix(0,1.96105,-1.97781,0,254.507,78.763)"
-       gradientUnits="userSpaceOnUse" />
-  </defs>
-  <g
-     transform="translate(-332,-355.362)"
-     id="g1046">
-    <rect
-       style="stroke:none;marker:none"
-       width="560"
-       height="164"
-       x="332"
-       y="355.362"
-       rx="20"
-       ry="20"
-       color="#000000"
-       overflow="visible"
-       stroke="#a6a6a6"
-       stroke-width="4"
-       id="rect976" />
-    <text
-       y="402.367"
-       x="508.95099"
-       style="line-height:100%;-inkscape-font-specification:'DejaVu Sans';marker:none"
-       color="#000000"
-       font-weight="400"
-       font-size="12.395px"
-       font-family="'DejaVu Sans'"
-       letter-spacing="0"
-       word-spacing="0"
-       overflow="visible"
-       fill="#ffffff"
-       id="text980"><tspan
-         y="402.367"
-         x="508.95099"
-         style="-inkscape-font-specification:'DejaVu Sans'"
-         font-size="34.125px"
-         id="tspan978">GET IT ON</tspan></text>
-    <text
-       style="line-height:100%;-inkscape-font-specification:'Rokkitt Bold';text-align:start;marker:none"
-       x="508.21301"
-       y="489.36099"
-       color="#000000"
-       font-weight="700"
-       font-size="29.709px"
-       font-family="Rokkitt"
-       letter-spacing="0"
-       word-spacing="0"
-       overflow="visible"
-       fill="#ffffff"
-       id="text984"><tspan
-         x="508.21301"
-         y="489.36099"
-         style="line-height:100%;-inkscape-font-specification:'Roboto Slab Bold';text-align:start"
-         font-size="95px"
-         font-family="'Roboto Slab'"
-         id="tspan982">F-Droid</tspan></text>
-    <g
-       fill-rule="evenodd"
-       id="g994">
-      <path
-         d="m 2.589,1006.862 4.25,5.5"
-         fill="#8ab000"
-         stroke="#769616"
-         stroke-width="2.5"
-         stroke-linecap="round"
-         transform="matrix(-2.63159,0,0,2.63157,483.158,-2270.475)"
-         id="path986" />
-      <path
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         d="m 476.286,375.862 c 1.193,0.031 2.004,0.497 2.58,1.18 -5.333,6.34 -6.232,7.347 -13.514,16.372 -2.683,3.472 -5.478,1.678 -2.795,-1.793 l 11.185,-14.474 c 0.602,-0.804 1.54,-1.258 2.544,-1.285 z"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#ffffff"
-         fill-opacity="0.298"
-         id="path988" />
-      <path
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         d="m 478.89,377.075 c 0.325,0.39 1.476,2.118 0.058,4.096 l -11.184,14.473 c -2.683,3.471 -3.026,-1.611 -3.026,-1.611 0,0 9.828,-11.869 14.151,-16.958 z"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="path990" />
-      <path
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         d="m 477.006,376.48 c 1.153,0 2.525,0.373 2.169,2.102 -0.273,1.32 -12.266,15.985 -12.266,15.985 -2.683,3.47 -6.562,1.78 -3.879,-1.691 l 11.143,-14.402 c 0.685,-0.763 1.602,-1.957 2.833,-1.994 z"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#8ab000"
-         id="path992" />
-    </g>
-    <g
-       fill-rule="evenodd"
-       id="g1004">
-      <path
-         d="m 2.589,1006.862 4.25,5.5"
-         fill="#8ab000"
-         stroke="#769616"
-         stroke-width="2.5"
-         stroke-linecap="round"
-         transform="matrix(2.63159,0,0,2.63157,356.842,-2270.475)"
-         id="path996" />
-      <path
-         d="m 363.714,375.862 c -1.193,0.031 -2.004,0.497 -2.58,1.18 5.333,6.34 6.232,7.347 13.514,16.372 2.683,3.472 5.478,1.678 2.795,-1.793 l -11.185,-14.474 c -0.602,-0.804 -1.54,-1.258 -2.544,-1.285 z"
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#ffffff"
-         fill-opacity="0.298"
-         id="path998" />
-      <path
-         d="m 361.11,377.075 c -0.325,0.39 -1.476,2.118 -0.058,4.096 l 11.184,14.473 c 2.683,3.471 3.026,-1.611 3.026,-1.611 0,0 -9.828,-11.869 -14.151,-16.958 z"
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="path1000" />
-      <path
-         d="m 362.995,376.48 c -1.153,0 -2.526,0.373 -2.17,2.102 0.273,1.32 12.266,15.985 12.266,15.985 2.683,3.47 6.562,1.78 3.879,-1.691 l -11.143,-14.402 c -0.685,-0.763 -1.602,-1.957 -2.832,-1.994 z"
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#8ab000"
-         id="path1002" />
-    </g>
-    <g
-       transform="matrix(2.63159,0,0,2.63157,467.369,-2270.475)"
-       id="g1014">
-      <rect
-         ry="3"
-         rx="3"
-         y="1010.36"
-         x="-37"
-         height="12.92"
-         width="38"
-         fill="#aeea00"
-         id="rect1006" />
-      <rect
-         width="38"
-         height="10"
-         x="-37"
-         y="1013.279"
-         rx="3"
-         ry="3"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="rect1008" />
-      <rect
-         width="38"
-         height="10"
-         x="-37"
-         y="1010.362"
-         rx="3"
-         ry="3"
-         fill="#ffffff"
-         fill-opacity="0.298"
-         id="rect1010" />
-      <rect
-         width="38"
-         height="10.641"
-         x="-37"
-         y="1011.5"
-         rx="3"
-         ry="2.4560001"
-         fill="#aeea00"
-         id="rect1012" />
-    </g>
-    <g
-       transform="matrix(2.63159,0,0,2.63157,356.842,-2270.745)"
-       id="g1024">
-      <rect
-         ry="3"
-         rx="3"
-         y="1024.522"
-         x="5"
-         height="25.84"
-         width="38"
-         fill="#1976d2"
-         id="rect1016" />
-      <rect
-         width="38"
-         height="13"
-         x="5"
-         y="1037.3621"
-         rx="3"
-         ry="3"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="rect1018" />
-      <rect
-         width="38"
-         height="13"
-         x="5"
-         y="1024.442"
-         rx="3"
-         ry="3"
-         fill="#ffffff"
-         fill-opacity="0.2"
-         id="rect1020" />
-      <rect
-         width="38"
-         height="23.559999"
-         x="5"
-         y="1025.662"
-         rx="3"
-         ry="2.7179999"
-         fill="#1976d2"
-         id="rect1022" />
-    </g>
-    <g
-       transform="matrix(2.63159,0,0,2.63157,356.842,396.264)"
-       id="g1030">
-      <path
-         d="m 24,17.75 c -2.88,0 -5.32,1.985 -6.033,4.65 H 21.18 A 3.215,3.215 0 0 1 24,20.75 3.228,3.228 0 0 1 27.25,24 3.228,3.228 0 0 1 24,27.25 3.219,3.219 0 0 1 21.07,25.4 h -3.154 c 0.642,2.766 3.132,4.85 6.084,4.85 3.434,0 6.25,-2.816 6.25,-6.25 0,-3.434 -2.816,-6.25 -6.25,-6.25 z"
-         style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal"
-         color="#000000"
-         font-weight="400"
-         font-family="sans-serif"
-         white-space="normal"
-         overflow="visible"
-         fill="#0d47a1"
-         id="path1026" />
-      <circle
-         r="9.5500002"
-         cy="24"
-         cx="24"
-         fill="none"
-         stroke="#0d47a1"
-         stroke-width="1.9"
-         stroke-linecap="round"
-         id="circle1028" />
-    </g>
-    <g
-       transform="matrix(2.63159,0,0,2.63157,356.842,-2269.159)"
-       id="g1036">
-      <ellipse
-         ry="3.875"
-         rx="3.375"
-         cx="14.375"
-         cy="1016.487"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="ellipse1032" />
-      <circle
-         r="3.375"
-         cy="1016.987"
-         cx="14.375"
-         fill="#ffffff"
-         id="circle1034" />
-    </g>
-    <g
-       transform="matrix(2.63159,0,0,2.63157,408.158,-2269.159)"
-       id="g1042">
-      <ellipse
-         cy="1016.487"
-         cx="14.375"
-         rx="3.375"
-         ry="3.875"
-         fill="#263238"
-         fill-opacity="0.2"
-         id="ellipse1038" />
-      <circle
-         cx="14.375"
-         cy="1016.987"
-         r="3.375"
-         fill="#ffffff"
-         id="circle1040" />
-    </g>
-    <path
-       d="m 282.715,299.835 a 3.29,3.29 0 0 0 -2.662,5.336 l 9.474,12.261 A 7.894,7.894 0 0 0 289,320.257 v 18.21 a 7.877,7.877 0 0 0 7.895,7.895 h 84.21 A 7.877,7.877 0 0 0 389,338.468 v -18.211 c 0,-0.999 -0.19,-1.949 -0.525,-2.826 l 9.472,-12.26 a 3.29,3.29 0 0 0 -2.433,-5.334 3.29,3.29 0 0 0 -2.772,1.31 l -9.013,11.666 a 7.91,7.91 0 0 0 -2.624,-0.45 h -84.21 c -0.922,0 -1.8,0.163 -2.622,0.45 l -9.015,-11.666 a 3.29,3.29 0 0 0 -2.543,-1.312 z m 14.18,49.527 A 7.877,7.877 0 0 0 289,357.257 v 52.21 a 7.877,7.877 0 0 0 7.895,7.895 h 84.21 A 7.877,7.877 0 0 0 389,409.468 v -52.211 a 7.877,7.877 0 0 0 -7.895,-7.895 z"
-       style="line-height:normal;text-indent:0;text-align:start;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;text-transform:none;isolation:auto;mix-blend-mode:normal;fill:url(#b)"
-       color="#000000"
-       font-weight="400"
-       font-family="sans-serif"
-       white-space="normal"
-       overflow="visible"
-       fill="url(#b)"
-       fill-rule="evenodd"
-       transform="translate(81,76)"
-       id="path1044" />
-  </g>
-</svg>

apps/smp-server/static/media/google_play.svg

@@ -1,39 +0,0 @@
-<svg width="135" height="41" viewBox="0 0 135 41" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M130 40.5H5C2.2 40.5 0 38.3 0 35.5V5.5C0 2.7 2.2 0.5 5 0.5H130C132.8 0.5 135 2.7 135 5.5V35.5C135 38.3 132.8 40.5 130 40.5Z" fill="black"/>
-<path d="M47.4 10.7C47.4 11.5 47.2 12.2 46.7 12.7C46.1 13.3 45.4 13.6 44.5 13.6C43.6 13.6 42.9 13.3 42.3 12.7C41.7 12.1 41.4 11.4 41.4 10.5C41.4 9.60002 41.7 8.90002 42.3 8.30002C42.9 7.70002 43.6 7.40002 44.5 7.40002C44.9 7.40002 45.3 7.50002 45.7 7.70002C46.1 7.90002 46.4 8.10002 46.6 8.40002L46.1 8.90002C45.7 8.40002 45.2 8.20002 44.5 8.20002C43.9 8.20002 43.3 8.40002 42.9 8.90002C42.4 9.30002 42.2 9.90002 42.2 10.6C42.2 11.3 42.4 11.9 42.9 12.3C43.4 12.7 43.9 13 44.5 13C45.2 13 45.7 12.8 46.2 12.3C46.5 12 46.7 11.6 46.7 11.1H44.5V10.3H47.4V10.7V10.7ZM52 8.20002H49.3V10.1H51.8V10.8H49.3V12.7H52V13.5H48.5V7.50002H52V8.20002ZM55.3 13.5H54.5V8.20002H52.8V7.50002H57V8.20002H55.3V13.5ZM59.9 13.5V7.50002H60.7V13.5H59.9ZM64.1 13.5H63.3V8.20002H61.6V7.50002H65.7V8.20002H64V13.5H64.1ZM73.6 12.7C73 13.3 72.3 13.6 71.4 13.6C70.5 13.6 69.8 13.3 69.2 12.7C68.6 12.1 68.3 11.4 68.3 10.5C68.3 9.60002 68.6 8.90002 69.2 8.30002C69.8 7.70002 70.5 7.40002 71.4 7.40002C72.3 7.40002 73 7.70002 73.6 8.30002C74.2 8.90002 74.5 9.60002 74.5 10.5C74.5 11.4 74.2 12.1 73.6 12.7ZM69.8 12.2C70.2 12.6 70.8 12.9 71.4 12.9C72 12.9 72.6 12.7 73 12.2C73.4 11.8 73.7 11.2 73.7 10.5C73.7 9.80002 73.5 9.20002 73 8.80002C72.6 8.40002 72 8.10002 71.4 8.10002C70.8 8.10002 70.2 8.30002 69.8 8.80002C69.4 9.20002 69.1 9.80002 69.1 10.5C69.1 11.2 69.3 11.8 69.8 12.2ZM75.6 13.5V7.50002H76.5L79.4 12.2V7.50002H80.2V13.5H79.4L76.3 8.60002V13.5H75.6V13.5Z" fill="white" stroke="white" stroke-width="0.2" stroke-miterlimit="10"/>
-<path d="M68.1 22.3C65.7 22.3 63.8 24.1 63.8 26.6C63.8 29 65.7 30.9 68.1 30.9C70.5 30.9 72.4 29.1 72.4 26.6C72.4 24 70.5 22.3 68.1 22.3ZM68.1 29.1C66.8 29.1 65.7 28 65.7 26.5C65.7 25 66.8 23.9 68.1 23.9C69.4 23.9 70.5 24.9 70.5 26.5C70.5 28 69.4 29.1 68.1 29.1ZM58.8 22.3C56.4 22.3 54.5 24.1 54.5 26.6C54.5 29 56.4 30.9 58.8 30.9C61.2 30.9 63.1 29.1 63.1 26.6C63.1 24 61.2 22.3 58.8 22.3ZM58.8 29.1C57.5 29.1 56.4 28 56.4 26.5C56.4 25 57.5 23.9 58.8 23.9C60.1 23.9 61.2 24.9 61.2 26.5C61.2 28 60.1 29.1 58.8 29.1ZM47.7 23.6V25.4H52C51.9 26.4 51.5 27.2 51 27.7C50.4 28.3 49.4 29 47.7 29C45 29 43 26.9 43 24.2C43 21.5 45.1 19.4 47.7 19.4C49.1 19.4 50.2 20 51 20.7L52.3 19.4C51.2 18.4 49.8 17.6 47.8 17.6C44.2 17.6 41.1 20.6 41.1 24.2C41.1 27.8 44.2 30.8 47.8 30.8C49.8 30.8 51.2 30.2 52.4 28.9C53.6 27.7 54 26 54 24.7C54 24.3 54 23.9 53.9 23.6H47.7V23.6ZM93.1 25C92.7 24 91.7 22.3 89.5 22.3C87.3 22.3 85.5 24 85.5 26.6C85.5 29 87.3 30.9 89.7 30.9C91.6 30.9 92.8 29.7 93.2 29L91.8 28C91.3 28.7 90.7 29.2 89.7 29.2C88.7 29.2 88.1 28.8 87.6 27.9L93.3 25.5L93.1 25V25ZM87.3 26.4C87.3 24.8 88.6 23.9 89.5 23.9C90.2 23.9 90.9 24.3 91.1 24.8L87.3 26.4ZM82.6 30.5H84.5V18H82.6V30.5ZM79.6 23.2C79.1 22.7 78.3 22.2 77.3 22.2C75.2 22.2 73.2 24.1 73.2 26.5C73.2 28.9 75.1 30.7 77.3 30.7C78.3 30.7 79.1 30.2 79.5 29.7H79.6V30.3C79.6 31.9 78.7 32.8 77.3 32.8C76.2 32.8 75.4 32 75.2 31.3L73.6 32C74.1 33.1 75.3 34.5 77.4 34.5C79.6 34.5 81.4 33.2 81.4 30.1V22.5H79.6V23.2V23.2ZM77.4 29.1C76.1 29.1 75 28 75 26.5C75 25 76.1 23.9 77.4 23.9C78.7 23.9 79.7 25 79.7 26.5C79.7 28 78.7 29.1 77.4 29.1ZM101.8 18H97.3V30.5H99.2V25.8H101.8C103.9 25.8 105.9 24.3 105.9 21.9C105.9 19.5 103.9 18 101.8 18V18ZM101.9 24H99.2V19.7H101.9C103.3 19.7 104.1 20.9 104.1 21.8C104 22.9 103.2 24 101.9 24ZM113.4 22.2C112 22.2 110.6 22.8 110.1 24.1L111.8 24.8C112.2 24.1 112.8 23.9 113.5 23.9C114.5 23.9 115.4 24.5 115.5 25.5V25.6C115.2 25.4 114.4 25.1 113.6 25.1C111.8 25.1 110 26.1 110 27.9C110 29.6 111.5 30.7 113.1 30.7C114.4 30.7 115 30.1 115.5 29.5H115.6V30.5H117.4V25.7C117.2 23.5 115.5 22.2 113.4 22.2V22.2ZM113.2 29.1C112.6 29.1 111.7 28.8 111.7 28C111.7 27 112.8 26.7 113.7 26.7C114.5 26.7 114.9 26.9 115.4 27.1C115.2 28.3 114.2 29.1 113.2 29.1V29.1ZM123.7 22.5L121.6 27.9H121.5L119.3 22.5H117.3L120.6 30.1L118.7 34.3H120.6L125.7 22.5H123.7V22.5ZM106.9 30.5H108.8V18H106.9V30.5Z" fill="white"/>
-<path d="M10.4 8C10.1 8.3 10 8.8 10 9.4V31.5C10 32.1 10.2 32.6 10.5 32.9L10.6 33L23 20.6V20.4L10.4 8Z" fill="url(#paint0_linear_7_408)"/>
-<path d="M27 24.8L22.9 20.7V20.4L27 16.3L27.1 16.4L32 19.2C33.4 20 33.4 21.3 32 22.1L27 24.8V24.8Z" fill="url(#paint1_linear_7_408)"/>
-<path d="M27.1 24.7L22.9 20.5L10.4 33C10.9 33.5 11.6 33.5 12.5 33.1L27.1 24.7" fill="url(#paint2_linear_7_408)"/>
-<path d="M27.1 16.3001L12.5 8.00005C11.6 7.50005 10.9 7.60005 10.4 8.10005L22.9 20.5001L27.1 16.3001V16.3001Z" fill="url(#paint3_linear_7_408)"/>
-<path opacity="0.2" d="M27 24.6L12.5 32.8C11.7 33.3 11 33.2 10.5 32.8L10.4 32.9L10.5 33C11 33.4 11.7 33.5 12.5 33L27 24.6Z" fill="black"/>
-<path opacity="0.12" d="M10.4 32.8C10.1 32.5 10 32 10 31.4V31.5C10 32.1 10.2 32.6 10.5 32.9V32.8H10.4ZM32 21.8L27 24.6L27.1 24.7L32 21.9C32.7 21.5 33 21 33 20.5C33 21 32.6 21.4 32 21.8V21.8Z" fill="black"/>
-<path opacity="0.25" d="M12.5 8.10003L32 19.2C32.6 19.6 33 20 33 20.5C33 20 32.7 19.5 32 19.1L12.5 8.00003C11.1 7.20003 10 7.80003 10 9.40003V9.50003C10 8.00003 11.1 7.30003 12.5 8.10003Z" fill="white"/>
-<defs>
-<linearGradient id="paint0_linear_7_408" x1="21.8" y1="9.21" x2="5.017" y2="25.992" gradientUnits="userSpaceOnUse">
-<stop stop-color="#00A0FF"/>
-<stop offset="0.007" stop-color="#00A1FF"/>
-<stop offset="0.26" stop-color="#00BEFF"/>
-<stop offset="0.512" stop-color="#00D2FF"/>
-<stop offset="0.76" stop-color="#00DFFF"/>
-<stop offset="1" stop-color="#00E3FF"/>
-</linearGradient>
-<linearGradient id="paint1_linear_7_408" x1="33.834" y1="20.501" x2="9.63699" y2="20.501" gradientUnits="userSpaceOnUse">
-<stop stop-color="#FFE000"/>
-<stop offset="0.409" stop-color="#FFBD00"/>
-<stop offset="0.775" stop-color="#FFA500"/>
-<stop offset="1" stop-color="#FF9C00"/>
-</linearGradient>
-<linearGradient id="paint2_linear_7_408" x1="24.827" y1="22.796" x2="2.069" y2="45.554" gradientUnits="userSpaceOnUse">
-<stop stop-color="#FF3A44"/>
-<stop offset="1" stop-color="#C31162"/>
-</linearGradient>
-<linearGradient id="paint3_linear_7_408" x1="7.29699" y1="0.676051" x2="17.46" y2="10.8391" gradientUnits="userSpaceOnUse">
-<stop stop-color="#32A071"/>
-<stop offset="0.069" stop-color="#2DA771"/>
-<stop offset="0.476" stop-color="#15CF74"/>
-<stop offset="0.801" stop-color="#06E775"/>
-<stop offset="1" stop-color="#00F076"/>
-</linearGradient>
-</defs>
-</svg>

apps/smp-server/static/media/logo-symbol-dark.svg

@@ -1,10 +0,0 @@
-<svg width="34" height="35" viewBox="0 0 34 35" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M3.02958 8.60922L8.622 14.2013L14.3705 8.45375L17.1669 11.2498L11.4183 16.9972L17.0114 22.5895L14.1373 25.4633L8.54422 19.871L2.79636 25.6187L0 22.8227L5.74794 17.075L0.155484 11.483L3.02958 8.60922Z" fill="white"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M14.0923 25.5156L16.944 22.6642L16.9429 22.6634L22.6467 16.9612L17.0513 11.3675L17.0523 11.367L14.2548 8.56979L8.65972 2.97535L11.5114 0.123963L17.1061 5.71849L22.8099 0.015625L25.6074 2.81285L19.9035 8.51562L25.4984 14.1099L31.2025 8.40729L34 11.2045L28.2958 16.907L33.8917 22.5017L31.0399 25.3531L25.4442 19.7584L19.7409 25.4611L25.3365 31.0559L22.4848 33.9073L16.8892 28.3124L11.1864 34.0156L8.38885 31.2184L14.0923 25.5156Z" fill="url(#paint0_linear_656_10815)"/>
-<defs>
-<linearGradient id="paint0_linear_656_10815" x1="12.8381" y1="-0.678252" x2="9.54355" y2="31.4493" gradientUnits="userSpaceOnUse">
-<stop stop-color="#01F1FF"/>
-<stop offset="1" stop-color="#0197FF"/>
-</linearGradient>
-</defs>
-</svg>

apps/smp-server/static/media/logo-symbol-light.svg

@@ -1,15 +0,0 @@
-<svg width="34" height="34" viewBox="0 0 34 34" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_14_10)">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M3.02972 8.59396L8.62219 14.186L14.3703 8.43848L17.1668 11.2346L11.4182 16.982L17.0112 22.5742L14.1371 25.448L8.5441 19.8557L2.79651 25.6035L0 22.8074L5.74813 17.0597L0.155656 11.4678L3.02972 8.59396Z" fill="#023789"/>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M14.0922 25.5L16.9434 22.6486L16.9423 22.6478L22.6464 16.9456L17.0512 11.3519L17.0518 11.3514L14.2542 8.55418L8.65961 2.95973L11.5114 0.108337L17.106 5.70288L22.8095 0L25.607 2.79722L19.903 8.5L25.4981 14.0943L31.2022 8.39169L33.9997 11.1889L28.2957 16.8914L33.8914 22.4861L31.0396 25.3375L25.4439 19.7428L19.7404 25.4454L25.3361 31.0403L22.4843 33.8917L16.8887 28.2968L11.1862 34L8.38867 31.2028L14.0922 25.5Z" fill="url(#paint0_linear_14_10)"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_14_10" x1="12.8379" y1="-0.693875" x2="9.54344" y2="31.4337" gradientUnits="userSpaceOnUse">
-<stop stop-color="#01F1FF"/>
-<stop offset="1" stop-color="#0197FF"/>
-</linearGradient>
-<clipPath id="clip0_14_10">
-<rect width="34" height="34" fill="white"/>
-</clipPath>
-</defs>
-</svg>

apps/smp-server/static/media/moon.svg

@@ -1,3 +0,0 @@
-<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M2.92814 12.6789C6.17655 15.9347 11.7044 15.6463 14.5425 12.0117C14.6636 11.8566 14.6825 11.6448 14.5907 11.4708C14.4989 11.2967 14.3136 11.1926 14.1172 11.2049C11.5269 11.3673 8.97627 10.4315 7.0743 8.52765C5.17264 6.62414 4.23958 4.06868 4.40169 1.47281C4.41397 1.2762 4.30965 1.09069 4.13526 0.999048C3.96088 0.907402 3.74893 0.926696 3.59396 1.04833C3.36099 1.23117 3.13828 1.42685 2.92823 1.63726C-0.111372 4.68223 -0.111585 9.63533 2.92814 12.6789Z" stroke="black" stroke-miterlimit="10" stroke-linejoin="round"/>
-</svg>

apps/smp-server/static/media/script.js

@@ -1,39 +0,0 @@
-const isMobile = {
-    Android: () => navigator.userAgent.match(/Android/i),
-    iOS: () => navigator.userAgent.match(/iPhone|iPad|iPod/i)
-};
-
-window.addEventListener('click', clickHandler)
-
-if (isMobile.iOS) {
-    for (const btn of document.getElementsByClassName("close-overlay-btn")) {
-        btn.addEventListener("touchend", (e) => setTimeout(() => closeOverlay(e), 100))
-    }
-}
-
-function clickHandler(e) {
-    if (e.target.closest('.contact-tab-btn')) {
-        e.target.closest('.contact-tab').classList.toggle('active')
-    }
-}
-
-window.addEventListener('load', () => {
-    const googlePlayBtn = document.querySelector('.google-play-btn');
-    const appleStoreBtn = document.querySelector('.apple-store-btn');
-    const fDroidBtn = document.querySelector('.f-droid-btn');
-    if (!googlePlayBtn || !appleStoreBtn || !fDroidBtn) return;
-
-
-    if (isMobile.Android()) {
-        googlePlayBtn.classList.remove('hidden');
-        fDroidBtn.classList.remove('hidden');
-    }
-    else if (isMobile.iOS()) {
-        appleStoreBtn.classList.remove('hidden');
-    }
-    else {
-        appleStoreBtn.classList.remove('hidden');
-        googlePlayBtn.classList.remove('hidden');
-        fDroidBtn.classList.remove('hidden');
-    }
-})

apps/smp-server/static/media/style.css

@@ -1,414 +0,0 @@
-@font-face {
-  font-family: Gilroy;
-  src: url("GilroyRegular.woff2") format("woff2");
-  font-weight: 400;
-  font-style: normal;
-}
-
-@font-face {
-  font-family: Gilroy;
-  src: url("GilroyLight.woff2") format("woff2");
-  font-weight: 300;
-  font-style: normal;
-}
-
-@font-face {
-  font-family: Gilroy;
-  src: url("GilroyMedium.woff2") format("woff2");
-  font-weight: 500;
-  font-style: normal;
-}
-
-@font-face {
-  font-family: Gilroy;
-  src: url("GilroyBold.woff2") format("woff2");
-  font-weight: 700;
-  font-style: normal;
-}
-
-@font-face {
-  font-family: Gilroy;
-  src: url("GilroyRegularItalic.woff2") format("woff2");
-  font-weight: 400;
-  font-style: italic;
-}
-
-html {
-  scroll-behavior: smooth;
-  font-family: Gilroy, Helvetica, sans-serif;
-  ;
-  letter-spacing: 0.003em;
-}
-
-img {
-  user-select: none;
-  -webkit-user-select: none;
-  /* For Safari and older Chrome versions */
-  -moz-user-select: none;
-  /* For Firefox */
-  -ms-user-select: none;
-  /* For Internet Explorer and Edge */
-}
-
-a{
-  word-wrap: break-word;
-}
-
-/* NEW SITE */
-.container,
-.container-fluid,
-.container-xxl,
-.container-xl,
-.container-lg,
-.container-md,
-.container-sm {
-  width: 100%;
-  /* padding: 0 20px; */
-  margin-right: auto;
-  margin-left: auto;
-}
-
-@media (min-width: 576px) {
-
-  .container-sm,
-  .container {
-    max-width: 540px;
-  }
-}
-
-@media (min-width: 768px) {
-
-  .container-md,
-  .container-sm,
-  .container {
-    max-width: 720px;
-  }
-}
-
-@media (min-width: 992px) {
-
-  .container-lg,
-  .container-md,
-  .container-sm,
-  .container {
-    max-width: 960px;
-  }
-}
-
-@media (min-width: 1200px) {
-
-  .container-xl,
-  .container-lg,
-  .container-md,
-  .container-sm,
-  .container {
-    max-width: 1140px;
-  }
-}
-
-@media (min-width: 1400px) {
-
-  .container-xxl,
-  .container-xl,
-  .container-lg,
-  .container-md,
-  .container-sm,
-  .container {
-    max-width: 1320px;
-  }
-}
-
-.gradient-text {
-  background: -webkit-linear-gradient(to bottom, #53C1FF -50%, #0053D0 160%);
-  background: linear-gradient(to bottom, #53C1FF -50%, #0053D0 160%);
-  -webkit-background-clip: text;
-  -webkit-text-fill-color: transparent;
-  background-clip: text;
-  text-fill-color: transparent;
-}
-
-.dark .border-gradient {
-  background:
-    linear-gradient(#11182F, #11182F) padding-box,
-    linear-gradient(to bottom, transparent, #01F1FF 58%) border-box;
-  border: 1px solid transparent;
-}
-
-.dark .only-light {
-  display: none;
-}
-
-.only-dark {
-  display: none;
-}
-
-.dark .only-dark {
-  display: inherit;
-}
-
-.menu-link {
-  font-size: 16px;
-  line-height: 33.42px;
-  color: #0D0E12;
-}
-
-.dark .menu-link {
-  color: #fff;
-}
-
-.nav-link ul li a.active {
-  color: #0053D0;
-
-}
-
-.dark .nav-link ul li a.active {
-  color: #66D9E2;
-}
-
-@media (min-width:1024px) {
-
-  .nav-link-text,
-  .menu-link {
-    display: inline-block;
-    position: relative;
-    color: #0D0E12;
-  }
-
-  .nav-link-text::before,
-  .active .nav-link-text::before,
-  .menu-link::before {
-    content: "";
-    position: absolute;
-    width: 0;
-    height: 1px;
-    bottom: 0;
-    right: 0;
-    /* background-color: initial; */
-    transition: width 0.25s ease-out;
-  }
-
-  .menu-link::before {
-    background-color: #0D0E12;
-  }
-
-  .dark .menu-link::before {
-    background-color: #fff;
-  }
-
-  .active .nav-link-text::before {
-    width: 100%;
-  }
-
-  .nav-link:hover .nav-link-text::before,
-  .menu-link:hover::before {
-    width: 100%;
-    left: 0;
-    right: auto;
-  }
-}
-
-
-.sub-menu {
-  visibility: hidden;
-  opacity: 0;
-  color: #505158;
-}
-
-.sub-menu .no-hover {
-  color: #505158 !important;
-}
-
-.dark .sub-menu,
-.dark .sub-menu .no-hover {
-  color: #fff !important;
-}
-
-.dark .sub-menu li:hover {
-  color: #66D9E2;
-}
-
-.sub-menu li:hover {
-  color: #0053D0;
-}
-
-.sub-menu {
-  transition: all .3s ease !important;
-}
-
-.nav-link span svg,
-header nav {
-  transition: all 0.5s ease;
-}
-
-.nav-link:hover span svg {
-  transform: rotate(180deg);
-}
-
-@media (min-width:1024px) {
-
-  .nav-link:hover .sub-menu,
-  .nav-link:focus-within .sub-menu {
-    visibility: visible;
-    opacity: 1;
-    margin-top: 0;
-  }
-}
-
-@media (max-width: 1024px) {
-  .sub-menu {
-    max-height: 0;
-    transform: translateY(-10px);
-    transition: all .7s ease !important;
-  }
-
-  .active .sub-menu {
-    max-height: 600px;
-    transform: translateY(0px);
-    opacity: 1;
-    visibility: visible;
-    margin-top: 0;
-  }
-
-  header nav {
-    visibility: hidden;
-    opacity: 0;
-    transform: translateX(100%);
-  }
-
-  header nav.open {
-    visibility: visible;
-    opacity: 1;
-    transform: translateX(0);
-  }
-}
-
-.lock-scroll {
-  overflow: hidden;
-}
-
-/* hero */
-header {
-  transition: all .7s ease;
-}
-
-.primary-header {
-  background: linear-gradient(270deg, #0053D0 35.85%, #0197FF 94.78%);
-  -webkit-background-clip: text;
-  -webkit-text-fill-color: transparent;
-  background-clip: text;
-  text-shadow: 0px 4px 74px #e9e7e2;
-}
-
-.dark .primary-header {
-  background: linear-gradient(270deg, #70F0F9 100%, #70F0F9 100%);
-  -webkit-background-clip: text;
-  -webkit-text-fill-color: transparent;
-  background-clip: text;
-  text-shadow: none;
-}
-
-.secondary-header {
-  color: #606c71;
-  text-shadow: 0px 4px 74px #e9e7e2;
-}
-
-.dark .secondary-header {
-  color: #fff;
-  text-shadow: none;
-}
-
-.description {
-  width: 31rem;
-}
-
-p a {
-  color: #0053D0;
-  text-decoration: underline;
-  text-underline-offset: 2px;
-}
-
-.dark p a {
-  color: #70F0F9;
-}
-
-/* For Contact & Invitation Page */
-.primary-header-contact {
-  background: linear-gradient(251.16deg, #53c1ff 1.1%, #0053d0 100.82%);
-  -webkit-background-clip: text;
-  -webkit-text-fill-color: transparent;
-  background-clip: text;
-  text-shadow: 0px 4px 74px #e9e7e2;
-}
-
-.dark .primary-header-contact {
-  background: linear-gradient(270deg, #70F0F9 100%, #70F0F9 100%);
-  -webkit-background-clip: text;
-  -webkit-text-fill-color: transparent;
-  background-clip: text;
-  text-shadow: none;
-}
-
-.secondary-header-contact {
-  text-shadow: 0px 4px 74px #e9e7e2;
-}
-
-.dark .secondary-header-contact {
-  text-shadow: none;
-}
-
-.content_copy_with_tooltip {
-  background-color: #f8f8f6;
-  border-radius: 50px;
-  padding-bottom: 4px;
-  padding-top: 8px;
-  margin-top: 16px;
-  margin-bottom: 16px;
-}
-
-.content_copy_with_tooltip .tooltip {
-  vertical-align: -6px;
-}
-
-.content_copy_with_tooltip .content {
-  font-size: 15px;
-}
-
-.contact-tab>.contact-tab-content,
-.job-tab>.job-tab-content {
-  opacity: 0;
-  max-height: 0;
-  transition: all 0.5s ease;
-  visibility: hidden;
-  transform: translateY(10px);
-  overflow: hidden;
-}
-
-.contact-tab svg,
-.job-tab svg {
-  transform: rotate(-180deg);
-  transition: all .5s ease;
-}
-
-.contact-tab.active>.contact-tab-content,
-.job-tab.active>.job-tab-content {
-  opacity: 1;
-  max-height: 300px;
-  visibility: visible;
-  transform: translateY(0px);
-}
-
-.for-tablet .contact-tab.active>.contact-tab-content,
-.for-tablet .job-tab.active>.job-tab-content {
-  min-height: 450px;
-}
-
-.contact-tab.active svg,
-.contact-tab:hover svg,
-.job-tab.active svg,
-.job-tab:hover svg {
-  transform: rotate(0deg);
-}
-
-.d-none-if-js-disabled {
-  display: none !important;
-}

apps/smp-server/static/media/sun.svg

@@ -1,11 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M23.9958 12.2815C23.9363 12.3954 23.8849 12.5146 23.8158 12.6224C23.5945 12.9674 23.2766 13.1624 22.8654 13.1685C22.2182 13.1782 21.5707 13.1764 20.9234 13.17C20.2781 13.1636 19.7772 12.6464 19.7773 11.9999C19.7774 11.3535 20.2754 10.8389 20.9237 10.8303C21.532 10.8221 22.1405 10.8258 22.7488 10.8278C23.3522 10.8298 23.7281 11.0908 23.9462 11.6508C23.956 11.6761 23.9789 11.6964 23.9958 11.719C23.9958 11.9064 23.9958 12.094 23.9958 12.2815Z" fill="white"/>
-<path d="M11.7154 24.0003C11.6217 23.9526 11.5256 23.9088 11.4345 23.8564C11.0545 23.6377 10.836 23.3104 10.8286 22.87C10.8175 22.2149 10.8179 21.5593 10.828 20.9042C10.8378 20.2738 11.3597 19.7812 11.9967 19.7812C12.6336 19.7812 13.155 20.2739 13.1654 20.9042C13.1757 21.5359 13.1717 22.168 13.1682 22.7998C13.1652 23.3392 12.8885 23.7369 12.3906 23.937C12.3509 23.9529 12.3153 23.979 12.2779 24.0003C12.0904 24.0003 11.9029 24.0003 11.7154 24.0003Z" fill="white"/>
-<path d="M17.2592 11.9958C17.2733 14.8825 14.9232 17.2468 12.0032 17.2612C9.11732 17.2754 6.75397 14.9264 6.73836 12.0041C6.72295 9.12027 9.07502 6.75326 11.9946 6.73835C14.8788 6.72363 17.2449 9.07587 17.2592 11.9958Z" stroke="white" stroke-width="1.5"/>
-<path d="M13.1693 2.11324C13.1692 2.43329 13.1744 2.75345 13.1682 3.07341C13.1555 3.7216 12.6425 4.21934 11.995 4.21864C11.3493 4.21789 10.8358 3.71808 10.828 3.06768C10.8204 2.42766 10.8201 1.78736 10.8283 1.14738C10.8365 0.500704 11.3562 -0.000843934 12.0007 1.06615e-06C12.6437 0.000846066 13.1564 0.504314 13.1684 1.15307C13.1743 1.47303 13.1694 1.79318 13.1693 2.11324Z" fill="white"/>
-<path d="M2.10878 13.1714C1.78877 13.1714 1.46872 13.1754 1.14885 13.1705C0.504832 13.1605 -0.000422735 12.6426 2.65407e-07 11.9987C0.000423265 11.3553 0.503376 10.838 1.15138 10.8301C1.79126 10.8223 2.43138 10.8222 3.07126 10.8303C3.72034 10.8385 4.21822 11.3541 4.21794 12.0012C4.21766 12.6477 3.71555 13.1609 3.06872 13.1706C2.7488 13.1753 2.42875 13.1714 2.10878 13.1714Z" fill="white"/>
-<path d="M6.85268 5.524C6.82732 6.152 6.60944 6.52005 6.16969 6.72981C5.73844 6.93552 5.29738 6.90378 4.94534 6.58208C4.41604 6.09838 3.90431 5.59148 3.42451 5.05894C3.02923 4.62023 3.09727 3.9209 3.51626 3.50792C3.9361 3.09409 4.63284 3.03567 5.06893 3.43194C5.59381 3.90888 6.09569 4.41446 6.57188 4.93996C6.73726 5.12252 6.79642 5.4014 6.85268 5.524Z" fill="white"/>
-<path d="M17.1426 18.4446C17.1749 17.8424 17.389 17.4819 17.8198 17.2738C18.2418 17.07 18.6812 17.0888 19.0265 17.3998C19.5706 17.8899 20.0919 18.4099 20.5814 18.9544C20.9675 19.384 20.895 20.0764 20.485 20.4873C20.0824 20.8907 19.3961 20.9756 18.9718 20.5988C18.4129 20.1026 17.89 19.5625 17.3864 19.0096C17.2323 18.8405 17.1926 18.5671 17.1426 18.4446Z" fill="white"/>
-<path d="M18.2026 6.84235C17.8449 6.82333 17.4821 6.61377 17.2723 6.18256C17.0626 5.7515 17.0878 5.30837 17.4061 4.95629C17.8919 4.41887 18.4055 3.90234 18.945 3.41897C19.3826 3.02693 20.0905 3.1037 20.4947 3.52429C20.9057 3.95198 20.9561 4.64003 20.5568 5.07805C20.0843 5.59645 19.576 6.08306 19.071 6.5708C18.8688 6.76619 18.6057 6.84832 18.2026 6.84235Z" fill="white"/>
-<path d="M5.54205 17.1445C6.14812 17.1747 6.51058 17.385 6.72137 17.8153C6.9323 18.2459 6.90765 18.6892 6.58942 19.0415C6.1037 19.5791 5.58933 20.0948 5.05088 20.5795C4.62165 20.9659 3.93035 20.8989 3.51681 20.4933C3.09875 20.0833 3.02864 19.3789 3.4227 18.942C3.908 18.404 4.42706 17.8934 4.96382 17.4066C5.13982 17.247 5.41663 17.1985 5.54205 17.1445Z" fill="white"/>
-</svg>

apps/smp-server/web/Static.hs

@@ -1,253 +0,0 @@
-{-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
-
-module Static where
-
-import Control.Logger.Simple
-import Control.Monad
-import Data.ByteString (ByteString)
-import qualified Data.ByteString.Char8 as B
-import Data.Char (toUpper)
-import Data.IORef (readIORef)
-import Data.Maybe (fromMaybe)
-import Data.String (fromString)
-import qualified Data.Text as T
-import Data.Text.Encoding (encodeUtf8)
-import Network.Socket (getPeerName)
-import Network.Wai (Application, Request (..))
-import Network.Wai.Application.Static (StaticSettings (..))
-import qualified Network.Wai.Application.Static as S
-import qualified Network.Wai.Handler.Warp as W
-import qualified Network.Wai.Handler.Warp.Internal as WI
-import qualified Network.Wai.Handler.WarpTLS as WT
-import Simplex.Messaging.Encoding.String (strEncode)
-import Simplex.Messaging.Server (AttachHTTP)
-import Simplex.Messaging.Server.CLI (simplexmqCommit)
-import Simplex.Messaging.Server.Information
-import Simplex.Messaging.Server.Main (EmbeddedWebParams (..), WebHttpsParams (..), simplexmqSource)
-import Simplex.Messaging.Transport (simplexMQVersion)
-import Simplex.Messaging.Transport.Client (TransportHost (..))
-import Simplex.Messaging.Util (tshow)
-import Static.Embedded as E
-import System.Directory (createDirectoryIfMissing)
-import System.FilePath
-import UnliftIO.Concurrent (forkFinally)
-import UnliftIO.Exception (bracket, finally)
-import qualified WaiAppStatic.Types as WAT
-
-serveStaticFiles :: EmbeddedWebParams -> IO ()
-serveStaticFiles EmbeddedWebParams {webStaticPath, webHttpPort, webHttpsParams} = do
-  forM_ webHttpPort $ \port -> flip forkFinally (\e -> logError $ "HTTP server crashed: " <> tshow e) $ do
-    logInfo $ "Serving static site on port " <> tshow port
-    W.runSettings (mkSettings port) app
-  forM_ webHttpsParams $ \WebHttpsParams {port, cert, key} -> flip forkFinally (\e -> logError $ "HTTPS server crashed: " <> tshow e) $ do
-    logInfo $ "Serving static site on port " <> tshow port <> " (TLS)"
-    WT.runTLS (WT.tlsSettings cert key) (mkSettings port) app
-  where
-    app = staticFiles webStaticPath
-    mkSettings port = W.setPort port warpSettings
-
--- | Prepare context and prepare HTTP handler for TLS connections that already passed TLS.handshake and ALPN check.
-attachStaticFiles :: FilePath -> (AttachHTTP -> IO ()) -> IO ()
-attachStaticFiles path action =
-  -- Initialize global internal state for http server.
-  WI.withII warpSettings $ \ii -> do
-    action $ \socket cxt -> do
-      -- Initialize internal per-connection resources.
-      addr <- getPeerName socket
-      withConnection addr cxt $ \(conn, transport) ->
-        withTimeout ii conn $ \th ->
-          -- Run Warp connection handler to process HTTP requests for static files.
-          WI.serveConnection conn ii th addr transport warpSettings app
-  where
-    app = staticFiles path
-    -- from warp-tls
-    withConnection socket cxt = bracket (WT.attachConn socket cxt) (terminate . fst)
-    -- from warp
-    withTimeout ii conn =
-      bracket
-        (WI.registerKillThread (WI.timeoutManager ii) (WI.connClose conn))
-        WI.cancel
-    -- shared clean up
-    terminate conn = WI.connClose conn `finally` (readIORef (WI.connWriteBuffer conn) >>= WI.bufFree)
-
-warpSettings :: W.Settings
-warpSettings = W.setGracefulShutdownTimeout (Just 1) W.defaultSettings
-
-staticFiles :: FilePath -> Application
-staticFiles root = S.staticApp settings . changeWellKnownPath
-  where
-    settings = defSettings {ssListing = Nothing, ssGetMimeType = getMimeType}
-    defSettings = S.defaultFileServerSettings root
-    getMimeType f
-      | WAT.fromPiece (WAT.fileName f) == "apple-app-site-association" = pure "application/json"
-      | otherwise = (ssGetMimeType defSettings) f
-    changeWellKnownPath req = case pathInfo req of
-      ".well-known" : rest ->
-        req
-          { pathInfo = "well-known" : rest,
-            rawPathInfo = "/well-known/" <> B.drop pfxLen (rawPathInfo req)
-          }
-      _ -> req
-    pfxLen = B.length "/.well-known/"
-
-generateSite :: ServerInformation -> Maybe TransportHost -> FilePath -> IO ()
-generateSite si onionHost sitePath = do
-  createDirectoryIfMissing True sitePath
-  B.writeFile (sitePath </> "index.html") $ serverInformation si onionHost
-  copyDir "media" E.mediaContent
-  -- `.well-known` path is re-written in changeWellKnownPath,
-  -- staticApp does not allow hidden folders.
-  copyDir "well-known" E.wellKnown
-  createLinkPage "contact"
-  createLinkPage "invitation"
-  createLinkPage "a"
-  createLinkPage "c"
-  createLinkPage "g"
-  createLinkPage "r"
-  createLinkPage "i"
-  logInfo $ "Generated static site contents at " <> tshow sitePath
-  where
-    copyDir dir content = do
-      createDirectoryIfMissing True $ sitePath </> dir
-      forM_ content $ \(path, s) -> B.writeFile (sitePath </> dir </> path) s
-    createLinkPage path = do
-      createDirectoryIfMissing True $ sitePath </> path
-      B.writeFile (sitePath </> path </> "index.html") E.linkHtml
-
-serverInformation :: ServerInformation -> Maybe TransportHost -> ByteString
-serverInformation ServerInformation {config, information} onionHost = render E.indexHtml substs
-  where
-    substs = substConfig <> substInfo <> [("onionHost", strEncode <$> onionHost)]
-    substConfig =
-      [ ( "persistence",
-          Just $ case persistence config of
-            SPMMemoryOnly -> "In-memory only"
-            SPMQueues -> "Queues"
-            SPMMessages -> "Queues and messages"
-        ),
-        ("messageExpiration", Just $ maybe "Never" (fromString . timedTTLText) $ messageExpiration config),
-        ("statsEnabled", Just . yesNo $ statsEnabled config),
-        ("newQueuesAllowed", Just . yesNo $ newQueuesAllowed config),
-        ("basicAuthEnabled", Just . yesNo $ basicAuthEnabled config)
-      ]
-    yesNo True = "Yes"
-    yesNo False = "No"
-    substInfo =
-      concat
-        [ basic,
-          maybe [("usageConditions", Nothing), ("usageAmendments", Nothing)] conds (usageConditions spi),
-          maybe [("operator", Nothing)] operatorE (operator spi),
-          maybe [("admin", Nothing)] admin (adminContacts spi),
-          maybe [("complaints", Nothing)] complaints (complaintsContacts spi),
-          maybe [("hosting", Nothing)] hostingE (hosting spi),
-          server
-        ]
-      where
-        basic =
-          [ ("sourceCode", if T.null sc then Nothing else Just (encodeUtf8 sc)),
-            ("noSourceCode", if T.null sc then Just "none" else Nothing),
-            ("version", Just $ B.pack simplexMQVersion),
-            ("commitSourceCode", Just $ encodeUtf8 $ maybe (T.pack simplexmqSource) sourceCode information),
-            ("shortCommit", Just $ B.pack $ take 7 simplexmqCommit),
-            ("commit", Just $ B.pack simplexmqCommit),
-            ("website", encodeUtf8 <$> website spi)
-          ]
-        spi = fromMaybe (emptyServerInfo "") information
-        sc = sourceCode spi
-        conds ServerConditions {conditions, amendments} =
-          [ ("usageConditions", Just $ encodeUtf8 conditions),
-            ("usageAmendments", encodeUtf8 <$> amendments)
-          ]
-        operatorE Entity {name, country} =
-          [ ("operator", Just ""),
-            ("operatorEntity", Just $ encodeUtf8 name),
-            ("operatorCountry", encodeUtf8 <$> country)
-          ]
-        admin ServerContactAddress {simplex, email, pgp} =
-          [ ("admin", Just ""),
-            ("adminSimplex", strEncode <$> simplex),
-            ("adminEmail", encodeUtf8 <$> email),
-            ("adminPGP", encodeUtf8 . pkURI <$> pgp),
-            ("adminPGPFingerprint", encodeUtf8 . pkFingerprint <$> pgp)
-          ]
-        complaints ServerContactAddress {simplex, email, pgp} =
-          [ ("complaints", Just ""),
-            ("complaintsSimplex", strEncode <$> simplex),
-            ("complaintsEmail", encodeUtf8 <$> email),
-            ("complaintsPGP", encodeUtf8 . pkURI <$> pgp),
-            ("complaintsPGPFingerprint", encodeUtf8 . pkFingerprint <$> pgp)
-          ]
-        hostingE Entity {name, country} =
-          [ ("hosting", Just ""),
-            ("hostingEntity", Just $ encodeUtf8 name),
-            ("hostingCountry", encodeUtf8 <$> country)
-          ]
-        server =
-          [ ("serverCountry", encodeUtf8 <$> serverCountry spi),
-            ("hostingType",  (\s -> maybe s (\(c, rest) -> toUpper c `B.cons` rest) $ B.uncons s) . strEncode <$> hostingType spi)
-          ]
-
--- Copy-pasted from simplex-chat Simplex.Chat.Types.Preferences
-{-# INLINE timedTTLText #-}
-timedTTLText :: (Integral i, Show i) => i -> String
-timedTTLText 0 = "0 sec"
-timedTTLText ttl = do
-  let (m', s) = ttl `quotRem` 60
-      (h', m) = m' `quotRem` 60
-      (d', h) = h' `quotRem` 24
-      (mm, d) = d' `quotRem` 30
-  unwords $
-    [mms mm | mm /= 0]
-      <> [ds d | d /= 0]
-      <> [hs h | h /= 0]
-      <> [ms m | m /= 0]
-      <> [ss s | s /= 0]
-  where
-    ss s = show s <> " sec"
-    ms m = show m <> " min"
-    hs 1 = "1 hour"
-    hs h = show h <> " hours"
-    ds 1 = "1 day"
-    ds 7 = "1 week"
-    ds 14 = "2 weeks"
-    ds d = show d <> " days"
-    mms 1 = "1 month"
-    mms mm = show mm <> " months"
-
--- | Rewrite source with provided substitutions
-render :: ByteString -> [(ByteString, Maybe ByteString)] -> ByteString
-render src = \case
-  [] -> src
-  (label, content') : rest -> render (section_ label content' src) rest
-
--- | Rewrite section content inside @<x-label>...</x-label>@ markers.
--- Markers are always removed when found. Closing marker is mandatory.
--- If content is absent, whole section is removed.
--- Section content is delegated to `item_`. If no sections found, the whole source is delegated.
-section_ :: ByteString -> Maybe ByteString -> ByteString -> ByteString
-section_ label content' src =
-  case B.breakSubstring startMarker src of
-    (_, "") -> item_ label (fromMaybe "" content') src -- no section, just replace items
-    (before, afterStart') ->
-      -- found section start, search for end too
-      case B.breakSubstring endMarker $ B.drop (B.length startMarker) afterStart' of
-        (_, "") -> error $ "missing section end: " <> show endMarker
-        (inside, next') ->
-          let next = B.drop (B.length endMarker) next'
-           in case content' of
-                Just content | not (B.null content) -> before <> item_ label content inside <> section_ label content' next
-                _ -> before <> next -- collapse section
-  where
-    startMarker = "<x-" <> label <> ">"
-    endMarker = "</x-" <> label <> ">"
-
--- | Replace all occurences of @${label}@ with provided content.
-item_ :: ByteString -> ByteString -> ByteString -> ByteString
-item_ label content' src =
-  case B.breakSubstring marker src of
-    (done, "") -> done
-    (before, after') -> before <> content' <> item_ label content' (B.drop (B.length marker) after')
-  where
-    marker = "${" <> label <> "}"

apps/smp-server/web/Static/Embedded.hs

@@ -1,18 +0,0 @@
-{-# LANGUAGE TemplateHaskell #-}
-
-module Static.Embedded where
-
-import Data.FileEmbed (embedDir, embedFile)
-import Data.ByteString (ByteString)
-
-indexHtml :: ByteString
-indexHtml = $(embedFile "apps/smp-server/static/index.html")
-
-linkHtml :: ByteString
-linkHtml = $(embedFile "apps/smp-server/static/link.html")
-
-mediaContent :: [(FilePath, ByteString)]
-mediaContent = $(embedDir "apps/smp-server/static/media/")
-
-wellKnown :: [(FilePath, ByteString)]
-wellKnown = $(embedDir "apps/smp-server/static/.well-known/")

apps/xftp-server/Main.hs

@@ -1,21 +0,0 @@
-module Main where
-
-import Control.Logger.Simple
-import Simplex.Messaging.Server.CLI (getEnvPath)
-import Simplex.FileTransfer.Server.Main
-
-defaultCfgPath :: FilePath
-defaultCfgPath = "/etc/opt/simplex-xftp"
-
-defaultLogPath :: FilePath
-defaultLogPath = "/var/opt/simplex-xftp"
-
-logCfg :: LogConfig
-logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
-
-main :: IO ()
-main = do
-  setLogLevel LogDebug -- change to LogError in production
-  cfgPath <- getEnvPath "XFTP_SERVER_CFG_PATH" defaultCfgPath
-  logPath <- getEnvPath "XFTP_SERVER_LOG_PATH" defaultLogPath
-  withGlobalLogging logCfg $ xftpServerCLI cfgPath logPath

apps/xftp/Main.hs

@@ -1,6 +0,0 @@
-module Main where
-
-import Simplex.FileTransfer.Client.Main
-
-main :: IO ()
-main = xftpClientCLI

cabal.project

@@ -1,53 +0,0 @@
-packages: .
--- packages: . ../direct-sqlcipher ../sqlcipher-simple
--- packages: . ../hs-socks
--- packages: . ../http2
--- packages: . ../network-transport
-
--- uncomment two sections below to run tests with coverage
--- package *
-   -- coverage: True
-   -- library-coverage: True
-
--- package attoparsec
-   -- coverage: False
-   -- library-coverage: False
-
-index-state: 2023-12-12T00:00:00Z
-
-package cryptostore
-    flags: +use_crypton
-
-source-repository-package
-    type: git
-    location: https://github.com/simplex-chat/aeson.git
-    tag: aab7b5a14d6c5ea64c64dcaee418de1bb00dcc2b
-
-source-repository-package
-    type: git
-    location: https://github.com/simplex-chat/hs-socks.git
-    tag: a30cc7a79a08d8108316094f8f2f82a0c5e1ac51
-
-source-repository-package
-    type: git
-    location: https://github.com/simplex-chat/direct-sqlcipher.git
-    tag: f814ee68b16a9447fbb467ccc8f29bdd3546bfd9
-
-source-repository-package
-    type: git
-    location: https://github.com/simplex-chat/sqlcipher-simple.git
-    tag: a46bd361a19376c5211f1058908fc0ae6bf42446
-
--- waiting for published warp-tls-3.4.7
-source-repository-package
-    type: git
-    location: https://github.com/yesodweb/wai.git
-    tag: ec5e017d896a78e787a5acea62b37a4e677dec2e
-    subdir: warp-tls
-
--- backported fork due http-5.0
-source-repository-package
-    type: git
-    location: https://github.com/simplex-chat/wai.git
-    tag: 2f6e5aa5f05ba9140ac99e195ee647b4f7d926b0
-    subdir: warp

cbits/README.md

@@ -1,3 +0,0 @@
-# Streamlined NTRU Prime: sntrup761
-
-The implementation of sntrup761 is the _exact_ copy from this [Internet draft](https://www.ietf.org/archive/id/draft-josefsson-ntruprime-streamlined-00.html).

cbits/sha512.c

@@ -1,9 +0,0 @@
-#include <openssl/sha.h>
-#include "sha512.h"
-
-void crypto_hash_sha512 (unsigned char *out,
-                         const unsigned char *in,
-                         unsigned long long inlen)
-{
-  SHA512(in, inlen, out);
-}

cbits/sha512.h

@@ -1,3 +0,0 @@
-void crypto_hash_sha512 (unsigned char *out,
-                         const unsigned char *in,
-                         unsigned long long inlen);

cbits/sntrup761.h

@@ -1,33 +0,0 @@
-/*
- * Derived from public domain source, written by (in alphabetical order):
- * - Daniel J. Bernstein
- * - Chitchanok Chuengsatiansup
- * - Tanja Lange
- * - Christine van Vredendaal
- */
-
-#ifndef SNTRUP761_H
-#define SNTRUP761_H
-
-#include <string.h>
-#include <stdint.h>
-
-#define SNTRUP761_SECRETKEY_SIZE 1763
-#define SNTRUP761_PUBLICKEY_SIZE 1158
-#define SNTRUP761_CIPHERTEXT_SIZE 1039
-#define SNTRUP761_SIZE 32
-
-typedef void sntrup761_random_func (void *ctx, size_t length, uint8_t *dst);
-
-void
-sntrup761_keypair (uint8_t *pk, uint8_t *sk,
-                   void *random_ctx, sntrup761_random_func *random);
-
-void
-sntrup761_enc (uint8_t *c, uint8_t *k, const uint8_t *pk,
-               void *random_ctx, sntrup761_random_func *random);
-
-void
-sntrup761_dec (uint8_t *k, const uint8_t *c, const uint8_t *sk);
-
-#endif /* SNTRUP761_H */

fourmolu.yaml

@@ -1,30 +0,0 @@
-indentation: 2
-column-limit: none
-function-arrows: trailing
-comma-style: trailing
-import-export-style: trailing
-indent-wheres: true
-record-brace-space: true
-newlines-between-decls: 1
-haddock-style: single-line
-haddock-style-module: null
-let-style: inline
-in-style: right-align
-single-constraint-parens: never
-unicode: never
-respectful: true
-fixities:
-  - infixr 9 .
-  - infixr 8 .:, .:., .=
-  - infixr 6 <>
-  - infixr 5 ++
-  - infixl 4 <$>, <$, $>,  <$$>, <$?>
-  - infixl 4 <*>, <*, *>, <**>
-  - infix 4 ==, /=
-  - infixr 3 &&
-  - infixl 3 <|>
-  - infixr 2 ||
-  - infixl 1 >>, >>=
-  - infixr 1 =<<, >=>, <=<
-  - infixr 0 $, $!
-reexports: []

img/linode.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 506.94 131.5"><path d="m109.65 58.21-18.21-10.07-15.37 9.38-.19 9.59-7.47-4.92-10.16 6.19-.44-10.48-10.48-7 10-5.17c-.08 0 0 1-1.48-34.34l-23.65-11.39-32.2 10 7.19 34.63 10.81 8.37-8.22 3.9 5.37 26.1 7.55 7.09-5.4 3.29 4.19 20.18 16.94 17.94c.08-.1 1.78-1.41 21.79-17.32l-.58-13.71 8.58 7.28c.12-.12 1.84-1.39 17.56-13.89l.61-10.14 6.48 4.5c.13-.12 1.58-1.22 14.26-11.33z" fill="#231f20"/><path d="m94.54 69 15.11-10.79-18.21-10.07-15.37 9.38z"/><path d="m92.87 88.2 1.67-19.2-18.47-11.48-.38 18.75z" fill="#004b16"/><path d="m68.22 107.73v-19.89l-18.66-14.15 1.47 19.54z" fill="#004b16"/><path d="m68.22 87.84 18.74-13.43-18.55-12.22-18.85 11.5z"/><path d="m38.43 131.48-2.98-20.32-18.15-17.8 4.19 20.18z" fill="#004b16"/><path d="m35.45 111.16 23.91-17.06-18.53-15.09-23.53 14.35z"/><path d="m33.9 100.6-3.94-26.88-20.22-16.81 5.41 26.07z" fill="#004b16"/><path d="m29.96 73.72 27.85-15.82-20.8-13.94-27.27 12.95z"/><path d="m28.07 60.88-5.4-36.81-22.67-14.06 7.19 34.62z" fill="#004b16"/><path d="m22.67 24.07 33.14-12.7-23.61-11.37-32.2 10.01z"/><g fill="#1cb35c"><path d="m107.13 76.87c-14.02 11.13-14.33 11.33-14.26 11.33 1.74-20.1 1.59-19.2 1.67-19.2 16-11.45 15-10.79 15.11-10.79z"/><path d="m85.78 93.84c-17.35 13.8-17.63 13.89-17.56 13.89-.17-20.82-.07-19.89 0-19.89 20-14.3 18.67-13.43 18.74-13.43z"/><path d="m60.22 114.16c-21.66 17.22-21.86 17.32-21.79 17.32-3.07-20.94-3-20.32-3-20.32 25.47-18.16 23.86-17.06 23.93-17.06z"/><path d="m55.81 11.37c1.52 35.37 1.4 34.34 1.48 34.34-28.66 14.89-29.29 15.17-29.22 15.17-5.52-37.63-5.47-36.81-5.4-36.81z"/><path d="m57.81 57.9c1.15 26.81 1 25.88 1.11 25.88-24.81 16.67-25.09 16.82-25 16.82-4-27.58-4-26.88-3.94-26.88z"/></g><path xmlns="http://www.w3.org/2000/svg" d="m151.61 14.24 16.58-4v79.88q0 13.13 7.83 15.65-3.84 7.31-13.13 7.3-11.28 0-11.28-15.66z"/><path d="m186.66 111.72v-57.42h-9.08v-13.6h25.86v71zm8.56-98.54a9.62 9.62 0 1 1 -9.62 9.62 9.63 9.63 0 0 1 9.62-9.62z"/><path d="m262.94 111.74v-41.06c0-6.05-1.16-10.48-3.48-13.26s-6.11-4.18-11.37-4.18a17.74 17.74 0 0 0 -7.8 2.06 18 18 0 0 0 -6.46 5.1v51.34h-16.59v-71h11.94l3 6.64q6.76-8 20-8 12.66 0 20 7.59t7.33 21.19v43.58z"/><path d="m288.42 76.06q0-16.26 9.38-26.47t24.77-10.21q16.19 0 25.14 9.82t9 26.86q0 17-9.12 27t-25 10q-16.18 0-25.17-10.12t-9-26.88zm17.24 0q0 23.47 16.91 23.48a14.54 14.54 0 0 0 12.31-6.11q4.55-6.09 4.54-17.37 0-23.14-16.85-23.15a14.61 14.61 0 0 0 -12.33 6.09q-4.58 6.11-4.58 17.06z"/><path d="m412.37 111.74v-4.31c-1.37 1.5-3.71 2.82-7 3.95a31.33 31.33 0 0 1 -10.15 1.69q-14.87 0-23.38-9.42t-8.52-26.27q0-16.84 9.78-27.42a32 32 0 0 1 24.51-10.58 32.37 32.37 0 0 1 14.72 3.32v-28.46l16.58-4v101.5zm0-54.06a17.6 17.6 0 0 0 -11.07-4.24q-10 0-15.33 6.07t-5.37 17.41q0 22.15 21.36 22.15a16.11 16.11 0 0 0 5.87-1.42c2.32-1 3.83-1.92 4.54-2.89z"/><path d="m505.55 81.3h-50.74q.46 8.49 5.83 13.2t14.46 4.7q11.34 0 17.25-5.9l6.43 12.7q-8.75 7.09-26.13 7.1-16.25 0-25.7-9.52t-9.45-26.58q0-16.78 10.38-27.2a33.91 33.91 0 0 1 24.9-10.41q15.45 0 24.81 9.22t9.35 23.48a46.28 46.28 0 0 1 -1.39 9.21zm-50.15-12.47h34.89q-1.73-15.58-17.24-15.59-14.2 0-17.65 15.59z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 506.94 131.5"><path d="m109.65 58.21-18.21-10.07-15.37 9.38-.19 9.59-7.47-4.92-10.16 6.19-.44-10.48-10.48-7 10-5.17c-.08 0 0 1-1.48-34.34l-23.65-11.39-32.2 10 7.19 34.63 10.81 8.37-8.22 3.9 5.37 26.1 7.55 7.09-5.4 3.29 4.19 20.18 16.94 17.94c.08-.1 1.78-1.41 21.79-17.32l-.58-13.71 8.58 7.28c.12-.12 1.84-1.39 17.56-13.89l.61-10.14 6.48 4.5c.13-.12 1.58-1.22 14.26-11.33z" fill="#231f20"/><path d="m94.54 69 15.11-10.79-18.21-10.07-15.37 9.38z"/><path d="m92.87 88.2 1.67-19.2-18.47-11.48-.38 18.75z" fill="#004b16"/><path d="m68.22 107.73v-19.89l-18.66-14.15 1.47 19.54z" fill="#004b16"/><path d="m68.22 87.84 18.74-13.43-18.55-12.22-18.85 11.5z"/><path d="m38.43 131.48-2.98-20.32-18.15-17.8 4.19 20.18z" fill="#004b16"/><path d="m35.45 111.16 23.91-17.06-18.53-15.09-23.53 14.35z"/><path d="m33.9 100.6-3.94-26.88-20.22-16.81 5.41 26.07z" fill="#004b16"/><path d="m29.96 73.72 27.85-15.82-20.8-13.94-27.27 12.95z"/><path d="m28.07 60.88-5.4-36.81-22.67-14.06 7.19 34.62z" fill="#004b16"/><path d="m22.67 24.07 33.14-12.7-23.61-11.37-32.2 10.01z"/><g fill="#1cb35c"><path d="m107.13 76.87c-14.02 11.13-14.33 11.33-14.26 11.33 1.74-20.1 1.59-19.2 1.67-19.2 16-11.45 15-10.79 15.11-10.79z"/><path d="m85.78 93.84c-17.35 13.8-17.63 13.89-17.56 13.89-.17-20.82-.07-19.89 0-19.89 20-14.3 18.67-13.43 18.74-13.43z"/><path d="m60.22 114.16c-21.66 17.22-21.86 17.32-21.79 17.32-3.07-20.94-3-20.32-3-20.32 25.47-18.16 23.86-17.06 23.93-17.06z"/><path d="m55.81 11.37c1.52 35.37 1.4 34.34 1.48 34.34-28.66 14.89-29.29 15.17-29.22 15.17-5.52-37.63-5.47-36.81-5.4-36.81z"/><path d="m57.81 57.9c1.15 26.81 1 25.88 1.11 25.88-24.81 16.67-25.09 16.82-25 16.82-4-27.58-4-26.88-3.94-26.88z"/></g><path xmlns="http://www.w3.org/2000/svg" d="m151.61 14.24 16.58-4v79.88q0 13.13 7.83 15.65-3.84 7.31-13.13 7.3-11.28 0-11.28-15.66z"/><path d="m186.66 111.72v-57.42h-9.08v-13.6h25.86v71zm8.56-98.54a9.62 9.62 0 1 1 -9.62 9.62 9.63 9.63 0 0 1 9.62-9.62z"/><path d="m262.94 111.74v-41.06c0-6.05-1.16-10.48-3.48-13.26s-6.11-4.18-11.37-4.18a17.74 17.74 0 0 0 -7.8 2.06 18 18 0 0 0 -6.46 5.1v51.34h-16.59v-71h11.94l3 6.64q6.76-8 20-8 12.66 0 20 7.59t7.33 21.19v43.58z"/><path d="m288.42 76.06q0-16.26 9.38-26.47t24.77-10.21q16.19 0 25.14 9.82t9 26.86q0 17-9.12 27t-25 10q-16.18 0-25.17-10.12t-9-26.88zm17.24 0q0 23.47 16.91 23.48a14.54 14.54 0 0 0 12.31-6.11q4.55-6.09 4.54-17.37 0-23.14-16.85-23.15a14.61 14.61 0 0 0 -12.33 6.09q-4.58 6.11-4.58 17.06z"/><path d="m412.37 111.74v-4.31c-1.37 1.5-3.71 2.82-7 3.95a31.33 31.33 0 0 1 -10.15 1.69q-14.87 0-23.38-9.42t-8.52-26.27q0-16.84 9.78-27.42a32 32 0 0 1 24.51-10.58 32.37 32.37 0 0 1 14.72 3.32v-28.46l16.58-4v101.5zm0-54.06a17.6 17.6 0 0 0 -11.07-4.24q-10 0-15.33 6.07t-5.37 17.41q0 22.15 21.36 22.15a16.11 16.11 0 0 0 5.87-1.42c2.32-1 3.83-1.92 4.54-2.89z"/><path d="m505.55 81.3h-50.74q.46 8.49 5.83 13.2t14.46 4.7q11.34 0 17.25-5.9l6.43 12.7q-8.75 7.09-26.13 7.1-16.25 0-25.7-9.52t-9.45-26.58q0-16.78 10.38-27.2a33.91 33.91 0 0 1 24.9-10.41q15.45 0 24.81 9.22t9.35 23.48a46.28 46.28 0 0 1 -1.39 9.21zm-50.15-12.47h34.89q-1.73-15.58-17.24-15.59-14.2 0-17.65 15.59z"/></svg>

install.sh

@@ -1,228 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-# Links to scripts/configs
-scripts="https://raw.githubusercontent.com/simplex-chat/simplexmq/stable/scripts/main"
-scripts_systemd_smp="$scripts/smp-server.service"
-scripts_systemd_xftp="$scripts/xftp-server.service"
-scripts_update="$scripts/simplex-servers-update"
-scripts_uninstall="$scripts/simplex-servers-uninstall"
-scripts_stopscript="$scripts/simplex-servers-stopscript"
-
-# Default installation paths
-path_bin="/usr/local/bin"
-path_bin_smp="$path_bin/smp-server"
-path_bin_xftp="$path_bin/xftp-server"
-path_bin_update="$path_bin/simplex-servers-update"
-path_bin_uninstall="$path_bin/simplex-servers-uninstall"
-path_bin_stopscript="$path_bin/simplex-servers-stopscript"
-
-path_conf_etc="/etc/opt"
-path_conf_var="/var/opt"
-path_conf_smp="$path_conf_etc/simplex $path_conf_var/simplex"
-path_conf_xftp="$path_conf_etc/simplex-xftp $path_conf_var/simplex-xftp /srv/xftp"
-
-path_conf_info="$path_conf_etc/simplex-info"
-
-path_systemd="/etc/systemd/system"
-path_systemd_smp="$path_systemd/smp-server.service"
-path_systemd_xftp="$path_systemd/xftp-server.service"
-
-# Defaut users
-user_smp="smp"
-user_xftp="xftp"
-
-GRN='\033[0;32m'
-BLU='\033[1;34m'
-YLW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-logo='
- ____  _                 _     __  __
-/ ___|(_)_ __ ___  _ __ | | ___\ \/ /
-\___ \| | '"'"'_ ` _ \| '"'"'_ \| |/ _ \\  / 
- ___) | | | | | | | |_) | |  __//  \ 
-|____/|_|_| |_| |_| .__/|_|\___/_/\_\
-                  |_|                            
-'
-
-welcome="Welcome to SMP/XFTP installation script! Here's what we're going to do:
-${GRN}1.${NC} Install latest binaries from GitHub releases:
-    - smp: ${YLW}${path_bin_smp}${NC}
-    - xftp: ${YLW}${path_bin_xftp}${NC}
-${GRN}2.${NC} Create server directories:
-    - smp: ${YLW}${path_conf_smp}${NC}
-    - xftp: ${YLW}${path_conf_xftp}${NC}
-${GRN}3.${NC} Setup user for server:
-    - xmp: ${YLW}${user_smp}${NC}
-    - xftp: ${YLW}${user_xftp}${NC}
-${GRN}4.${NC} Create systemd services:
-    - smp: ${YLW}${path_systemd_smp}${NC}
-    - xftp: ${YLW}${path_systemd_xftp}${NC}
-${GRN}5.${NC} Install stopscript (systemd), update and uninstallation script:
-    - all: ${YLW}${path_bin_update}${NC}, ${YLW}${path_bin_uninstall}${NC}, ${YLW}${path_bin_stopscript}${NC}
-
-Press:
-  - ${GRN}1${NC} to install smp server
-  - ${GRN}2${NC} to install xftp server
-  - ${RED}Ctrl+C${NC} to cancel installation
-  
-Selection: "
-
-end="Installtion is complete!
-
-Please checkout our server guides:
-- smp: ${GRN}https://simplex.chat/docs/server.html${NC}
-- xftp: ${GRN}https://simplex.chat/docs/xftp-server.html${NC}
-
-To uninstall with full clean-up, simply run: ${YLW}sudo /usr/local/bin/simplex-servers-uninstall${NC}
-"
-
-set_version() {
-  ver="${VER:-latest}"
-
-  case "$ver" in 
-    latest)
-      bin="https://github.com/simplex-chat/simplexmq/releases/latest/download"
-      remote_version="$(curl --proto '=https' --tlsv1.2 -sSf -L https://api.github.com/repos/simplex-chat/simplexmq/releases/latest | grep -i "tag_name" | awk -F \" '{print $4}')"
-      ;;
-    *)
-      bin="https://github.com/simplex-chat/simplexmq/releases/download/${ver}"
-      remote_version="${ver}"
-      ;;
-  esac
-}
-
-os_test() {
- . /etc/os-release
-
- case "$VERSION_ID" in
-  20.04|22.04) : ;;
-  24.04) VERSION_ID='22.04' ;;
-  *) printf "${RED}Unsupported Ubuntu version!${NC}\nPlease file Github issue with request to support Ubuntu %s: https://github.com/simplex-chat/simplexmq/issues/new\n" "$VERSION_ID" && exit 1 ;;
- esac
-
- version="$(printf '%s' "$VERSION_ID" | tr '.' '_')"
- arch="$(uname -p)"
-
- case "$arch" in
-  x86_64) arch="$(printf '%s' "$arch" | tr '_' '-')" ;;
-  *)  printf "${RED}Unsupported architecture!${NC}\nPlease file Github issue with request to support %s architecture: https://github.com/simplex-chat/simplexmq/issues/new" "$arch" && exit 1 ;;
- esac
-
- bin_smp="$bin/smp-server-ubuntu-${version}-${arch}"
- bin_xftp="$bin/xftp-server-ubuntu-${version}-${arch}"
-}
-
-setup_bins() {
- eval "bin=\$bin_${1}"
- eval "path=\$path_bin_${1}"
-
- curl --proto '=https' --tlsv1.2 -sSf -L "$bin" -o "$path" && chmod +x "$path"
-
- unset bin path
-}
-
-setup_users() {
- eval "user=\$user_${1}"
-
- useradd -M "$user" 2> /dev/null || true
-
- unset user
-}
-
-setup_dirs() {
- # Unquoted varibles, so field splitting can occur
- eval "path_conf=\$path_conf_${1}"
- eval "user=\$user_${1}"
-
- mkdir -p $path_conf
- mkdir -p $path_conf_info
- printf "local_version_%s='%s'\n" "$1" "$remote_version" >> "$path_conf_info/release"
- chown -R "$user":"$user" $path_conf
-
- unset path_conf user
-}
-
-setup_systemd() {
- eval "scripts_systemd=\$scripts_systemd_${1}"
- eval "path_systemd=\$path_systemd_${1}"
-
- curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_systemd" -o "$path_systemd"
-
- unset scripts_systemd path_systemd
-}
-
-setup_scripts() {
- curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_update" -o "$path_bin_update" && chmod +x "$path_bin_update"
- curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_uninstall" -o "$path_bin_uninstall" && chmod +x "$path_bin_uninstall"
- curl --proto '=https' --tlsv1.2 -sSf -L "$scripts_stopscript" -o "$path_bin_stopscript" && chmod +x "$path_bin_stopscript"
- }
-
-checks() {
- if [ "$(id -u)" -ne 0 ]; then
-  printf "This script is intended to be run with root privileges. Please re-run script using sudo."
-  exit 1
- fi
- 
- set_version
- os_test
-
- mkdir -p $path_conf_info  
-}
-
-main() {
- checks
- 
- printf "%b\n%b" "${BLU}$logo${NC}" "$welcome"
- read ans
-
- case "$ans" in
-  1) setup='smp' ;;
-  2) setup='xftp' ;;
-  *) printf 'Installation aborted.\n' && exit 0 ;;
- esac
-
- printf "Installing binaries..."
- 
- for i in $setup; do
-  setup_bins "$i"
- done
- 
- printf "${GRN} Done!${NC}\n"
-
- printf "Creating users..."
-
- for i in $setup; do
-  setup_users "$i"
- done
-
- printf "${GRN} Done!${NC}\n"
- 
- printf "Creating directories..."
-
- for i in $setup; do
-  setup_dirs "$i"
- done
-
- printf "${GRN} Done!${NC}\n"
-
- printf "Creating systemd services..."
-
- for i in $setup; do
-  setup_systemd "$i"
- done
-
- printf "${GRN} Done!${NC}\n"
-
- printf "Installing stopscript, update and uninstallation script..."
-
- setup_scripts
-
- printf "${GRN} Done!${NC}\n"
-
- printf "%b" "$end"
-}
-
-main

migrations/20210101_initial.sql

@@ -0,0 +1,117 @@
+CREATE TABLE IF NOT EXISTS servers(
+  host TEXT NOT NULL,
+  port TEXT NOT NULL,
+  key_hash BLOB,
+  PRIMARY KEY (host, port)
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS rcv_queues(
+  host TEXT NOT NULL,
+  port TEXT NOT NULL,
+  rcv_id BLOB NOT NULL,
+  conn_alias BLOB NOT NULL,
+  rcv_private_key BLOB NOT NULL,
+  snd_id BLOB,
+  snd_key BLOB,
+  decrypt_key BLOB NOT NULL,
+  verify_key BLOB,
+  status TEXT NOT NULL,
+  PRIMARY KEY (host, port, rcv_id),
+  FOREIGN KEY (host, port) REFERENCES servers (host, port),
+  FOREIGN KEY (conn_alias)
+    REFERENCES connections (conn_alias)
+    ON DELETE CASCADE
+    DEFERRABLE INITIALLY DEFERRED,
+  UNIQUE (host, port, snd_id)
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS snd_queues(
+  host TEXT NOT NULL,
+  port TEXT NOT NULL,
+  snd_id BLOB NOT NULL,
+  conn_alias BLOB NOT NULL,
+  snd_private_key BLOB NOT NULL,
+  encrypt_key BLOB NOT NULL,
+  sign_key BLOB NOT NULL,
+  status TEXT NOT NULL,
+  PRIMARY KEY (host, port, snd_id),
+  FOREIGN KEY (host, port) REFERENCES servers (host, port),
+  FOREIGN KEY (conn_alias)
+    REFERENCES connections (conn_alias)
+    ON DELETE CASCADE
+    DEFERRABLE INITIALLY DEFERRED
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS connections(
+  conn_alias BLOB NOT NULL,
+  rcv_host TEXT,
+  rcv_port TEXT,
+  rcv_id BLOB,
+  snd_host TEXT,
+  snd_port TEXT,
+  snd_id BLOB,
+  last_internal_msg_id INTEGER NOT NULL, -- TODO add defauls here and below in the new schema
+  last_internal_rcv_msg_id INTEGER NOT NULL,
+  last_internal_snd_msg_id INTEGER NOT NULL,
+  last_external_snd_msg_id INTEGER NOT NULL,
+  last_rcv_msg_hash BLOB NOT NULL,
+  last_snd_msg_hash BLOB NOT NULL,
+  PRIMARY KEY (conn_alias),
+  FOREIGN KEY (rcv_host, rcv_port, rcv_id) REFERENCES rcv_queues (host, port, rcv_id),
+  FOREIGN KEY (snd_host, snd_port, snd_id) REFERENCES snd_queues (host, port, snd_id)
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS messages(
+  conn_alias BLOB NOT NULL,
+  internal_id INTEGER NOT NULL,
+  internal_ts TEXT NOT NULL,
+  internal_rcv_id INTEGER,
+  internal_snd_id INTEGER,
+  body TEXT NOT NULL,  -- deprecated
+  PRIMARY KEY (conn_alias, internal_id),
+  FOREIGN KEY (conn_alias)
+    REFERENCES connections (conn_alias)
+    ON DELETE CASCADE,
+  FOREIGN KEY (conn_alias, internal_rcv_id)
+    REFERENCES rcv_messages (conn_alias, internal_rcv_id)
+    ON DELETE CASCADE
+    DEFERRABLE INITIALLY DEFERRED,
+  FOREIGN KEY (conn_alias, internal_snd_id)
+    REFERENCES snd_messages (conn_alias, internal_snd_id)
+    ON DELETE CASCADE
+    DEFERRABLE INITIALLY DEFERRED
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS rcv_messages(
+  conn_alias BLOB NOT NULL,
+  internal_rcv_id INTEGER NOT NULL,
+  internal_id INTEGER NOT NULL,
+  external_snd_id INTEGER NOT NULL,
+  external_snd_ts TEXT NOT NULL,
+  broker_id BLOB NOT NULL,
+  broker_ts TEXT NOT NULL,
+  rcv_status TEXT NOT NULL,
+  ack_brocker_ts TEXT,
+  ack_sender_ts TEXT,
+  internal_hash BLOB NOT NULL,
+  external_prev_snd_hash BLOB NOT NULL,
+  integrity BLOB NOT NULL,
+  PRIMARY KEY (conn_alias, internal_rcv_id),
+  FOREIGN KEY (conn_alias, internal_id)
+    REFERENCES messages (conn_alias, internal_id)
+    ON DELETE CASCADE
+) WITHOUT ROWID;
+
+CREATE TABLE IF NOT EXISTS snd_messages(
+  conn_alias BLOB NOT NULL,
+  internal_snd_id INTEGER NOT NULL,
+  internal_id INTEGER NOT NULL,
+  snd_status TEXT NOT NULL,
+  sent_ts TEXT,
+  delivered_ts TEXT,
+  internal_hash BLOB NOT NULL,
+  PRIMARY KEY (conn_alias, internal_snd_id),
+  FOREIGN KEY (conn_alias, internal_id)
+    REFERENCES messages (conn_alias, internal_id)
+    ON DELETE CASCADE
+) WITHOUT ROWID;

migrations/20210624_confirmations.sql

@@ -0,0 +1,9 @@
+CREATE TABLE conn_confirmations (
+  confirmation_id BLOB NOT NULL PRIMARY KEY,
+  conn_alias BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
+  sender_key BLOB NOT NULL,
+  sender_conn_info BLOB NOT NULL,
+  accepted INTEGER NOT NULL,
+  own_conn_info BLOB,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+) WITHOUT ROWID;

migrations/20210809_snd_messages.sql

@@ -0,0 +1,3 @@
+ALTER TABLE messages ADD msg_body BLOB NOT NULL DEFAULT x'';  -- this field replaces body TEXT
+-- TODO possibly migrate the data from body if it is possible in migration
+ALTER TABLE snd_messages ADD previous_msg_hash BLOB NOT NULL DEFAULT x'';

migrations/20211202_connection_mode.sql

@@ -0,0 +1,11 @@
+ALTER TABLE connections ADD conn_mode TEXT NOT NULL DEFAULT 'INV';
+
+CREATE TABLE conn_invitations (
+  invitation_id BLOB NOT NULL PRIMARY KEY,
+  contact_conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
+  cr_invitation BLOB NOT NULL,
+  recipient_conn_info BLOB NOT NULL,
+  accepted INTEGER NOT NULL DEFAULT 0,
+  own_conn_info BLOB,
+  created_at TEXT NOT NULL DEFAULT (datetime('now'))
+) WITHOUT ROWID;

migrations/README.md

@@ -0,0 +1,9 @@
+# SQLite database migrations
+
+These migrations are [embedded](../src/Simplex/Messaging/Agent/Store/SQLite/Migrations.hs) into the executable and run when SMP agent starts (as a separate executable or as a part of [simplex-chat](https://github.com/simplex-chat/simplex-chat) app).
+
+Migration file names must have a format `YYYYMMDD-name.sql` - they will be executed in the order or lexicographic sorting of the names, the files with any other extension than `.sql` are ignored.
+
+The proposed approach is to minimize the number of migrations and merge them together when possible, to align with the agent releases.
+
+**Please note**: Adding or editing migrations will NOT update the migrations embedded into the executable, unless the [Migrations](../src/Simplex/Messaging/Agent/Store/SQLite/Migrations.hs) module is rebuilt - use `stack build --force-dirty` (in addition to edited files it seems to rebuild the files with TH splices and their dependencies, not all files as with `stack clean`).

notes-flow.txt

@@ -1,23 +0,0 @@
-common:
-  corrId - random BS, used as CbNonce
-  entityId - p2r tlsUniq
-
-# setup
-s->p: "proxy", uri, auth?
-  # unless connected
-  p->r: "p_handshake"
-  p<-r: "r_key", tls-signed dh pub
-s<-r: "r_key", tls-signed dh pub # reply entityId contains tlsUniq
-
-# working
-s ; generate random dh priv, make shared secret
-s->p: s2r("forward", random dh pub, SEND command blob)
-  p->r: p2r("forward", random dh pub, s2r("forward", ...)))
-    r->c@ "msg", ...
-  p<-r: p2r("r_res", s2r("ok" / "error", error))
-s<-p@ s2r("ok" / "error", error)
-
-# expired
-  p<-r@ p2r("error", "key expired")
-s<-p@ "error", "key expired"
-s ; reconnect

package.yaml

@@ -0,0 +1,106 @@
+name: simplexmq-v0
+version: 0.5.3
+synopsis: SimpleXMQ message broker
+description:  |
+  This package includes <./docs/Simplex-Messaging-Server.html server>,
+  <./docs/Simplex-Messaging-Client.html client> and
+  <./docs/Simplex-Messaging-Agent.html agent> for SMP protocols:
+  .
+  * <https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md SMP protocol>
+  * <https://github.com/simplex-chat/simplexmq/blob/master/protocol/agent-protocol.md SMP agent protocol>
+  .
+  See <https://github.com/simplex-chat/simplex-chat terminal chat prototype> built with SimpleXMQ broker.
+
+homepage: https://github.com/simplex-chat/simplexmq#readme
+license: AGPL-3
+author: simplex.chat
+maintainer: chat@simplex.chat
+copyright: 2020 simplex.chat
+category: Chat, Network, Web, System, Cryptography
+extra-source-files:
+  - README.md
+  - CHANGELOG.md
+  - migrations/*.*
+
+dependencies:
+  - ansi-terminal >= 0.10 && < 0.12
+  - asn1-encoding == 0.9.*
+  - asn1-types == 0.3.*
+  - async == 2.2.*
+  - attoparsec == 0.13.*
+  - base >= 4.7 && < 5
+  - base64-bytestring >= 1.0 && < 1.3
+  - bytestring == 0.10.*
+  - composition == 1.0.*
+  - constraints >= 0.12 && < 0.14
+  - containers == 0.6.*
+  - cryptonite >= 0.27 && < 0.30
+  - direct-sqlite == 2.3.*
+  - directory == 1.3.*
+  - file-embed >= 0.0.14.0 && <= 0.0.15.0
+  - filepath == 1.4.*
+  - http-types == 0.12.*
+  - generic-random >= 1.3 && < 1.5
+  - iso8601-time == 0.1.*
+  - memory == 0.15.*
+  - mtl == 2.2.*
+  - network == 3.1.*
+  - network-transport == 0.5.*
+  - QuickCheck == 2.14.*
+  - random >= 1.1 && < 1.3
+  - simple-logger == 0.1.*
+  - sqlite-simple == 0.4.*
+  - stm == 2.5.*
+  - template-haskell == 2.16.*
+  - text == 1.2.*
+  - time == 1.9.*
+  - transformers == 0.5.*
+  - unliftio == 0.2.*
+  - unliftio-core == 0.2.*
+  - websockets == 0.12.*
+  - x509 == 1.7.*
+
+library:
+  source-dirs: src
+
+executables:
+  smp-server:
+    source-dirs: apps/smp-server
+    main: Main.hs
+    dependencies:
+      - cryptostore == 0.2.*
+      - ini == 0.4.*
+      - optparse-applicative >= 0.15 && < 0.17
+      - simplexmq-v0
+    ghc-options:
+      - -threaded
+
+  smp-agent:
+    source-dirs: apps/smp-agent
+    main: Main.hs
+    dependencies:
+      - simplexmq-v0
+    ghc-options:
+      - -threaded
+
+tests:
+  smp-server-test:
+    source-dirs: tests
+    main: Test.hs
+    dependencies:
+      - simplexmq-v0
+      - hspec == 2.7.*
+      - hspec-core == 2.7.*
+      - HUnit == 1.6.*
+      - QuickCheck == 2.14.*
+      - timeit == 2.0.*
+
+ghc-options:
+  # - -haddock
+  - -Wall
+  - -Wcompat
+  - -Werror=incomplete-patterns
+  - -Wredundant-constraints
+  - -Wincomplete-record-updates
+  - -Wincomplete-uni-patterns
+  - -Wunused-type-patterns

protocol/agent-protocol.md

@@ -1,5 +1,3 @@
-Version 5, 2024-06-22
-
 # SMP agent protocol - duplex communication over SMP protocol
 
 ## Table of contents
@@ -7,61 +5,69 @@ Version 5, 2024-06-22
 - [Abstract](#abstract)
 - [SMP agent](#smp-agent)
 - [SMP servers management](#smp-servers-management)
-- [SMP agent protocol scope](#smp-agent-protocol-scope)
+- [SMP agent protocol components](#smp-agent-protocol-components)
 - [Duplex connection procedure](#duplex-connection-procedure)
-- [Contact addresses](#contact-addresses)
 - [Communication between SMP agents](#communication-between-smp-agents)
   - [Message syntax](#messages-between-smp-agents)
     - [HELLO message](#hello-message)
-    - [A_MSG message](#a_msg-message)
-    - [A_RCVD message](#a_rcvd-message)
-    - [EREADY message](#eready-message)
-    - [A_QCONT message](#a_qcont-message)
-    - [Rotating messaging queue](#rotating-messaging-queue)
-- [End-to-end encryption](#end-to-end-encryption)
-- [Connection link: 1-time invitation and contact address](#connection-link-1-time-invitation-and-contact-address)
-- [Appendix A: SMP agent API](#smp-agent-api)
-  - [API functions](#api-functions)
-  - [API events](#api-events)
+    - [REPLY message](#reply-message)
+    - [MSG message](#msg-message)
+    - [INV message](#inv-message)
+    - [ACK message](#ack-message)
+    - [NEW message](#new-message)
+    - [DEL message](#del-message)
+- [SMP agent commands](#smp-agent-commands)
+  - [Client commands and server responses](#client-commands-and-server-responses)
+    - [NEW command and INV response](#new-command-and-inv-response)
+    - [JOIN command](#join-command)
+    - [CONF notification and LET command](#conf-notification-and-let-command)
+    - [REQ notification and ACPT command](#req-notification-and-acpt-command)
+    - [INFO and CON notifications](#info-and-con-notifications)
+    - [SUB command](#sub-command)
+    - [SEND command and MID, SENT and MERR responses](#send-command-and-mid-sent-and-merr-responses)
+    - [MSG notification](#msg-notification)
+    - [END notification](#end-notification)
+    - [OFF command](#off-command)
+    - [DEL command](#del-command)
+- [Connection request](#connection-request)
 
 ## Abstract
 
 The purpose of SMP agent protocol is to define the syntax and the semantics of communications between the client and the agent that connects to [SMP](./simplex-messaging.md) servers.
 
 It provides:
-- API to create and manage bi-directional (duplex) connections between the users of SMP agents consisting of two (or more) separate unidirectional (simplex) SMP queues, abstracting away multiple steps required to establish bi-directional connections and any information about the servers location from the users of the agent protocol.
+- protocol to create and manage bi-directional (duplex) connections between the users of SMP agents consisting of two (or more) separate unidirectional (simplex) SMP queues, abstracting away multiple steps required to establish bi-directional connections and any information about the servers location from the users of the agent protocol.
 - management of E2E encryption between SMP agents, generating ephemeral asymmetric keys for each connection.
 - SMP command authentication on SMP servers, generating ephemeral keys for each SMP queue.
 - TCP/TLS transport handshake with SMP servers.
 - validation of message integrity.
 
-SMP agent API provides no security between the agent and the client - it is assumed that the agent is executed in the trusted and secure environment, via the agent library, when the agent logic is included directly into the client application - [SimpleX Chat for terminal](https://github.com/simplex-chat/simplex-chat) uses this approach.
+SMP agent protocol provides no encryption or security on the client side - it is assumed that the agent is executed in the trusted and secure environment, in one of three ways:
+- via TCP network using secure connection.
+- via local port (when the agent runs on the same device as a separate process).
+- via agent library, when the agent logic is included directly into the client application - [SimpleX Chat for terminal](https://github.com/simplex-chat/simplex-chat) uses this approach.
 
 ## SMP agent
 
-SMP agents communicate with each other via SMP servers using [simplex messaging protocol (SMP)](./simplex-messaging.md) according to the API calls used by the client applications. This protocol is a middle layer in SimpleX protocols (above SMP protocol but below any application level protocol) - it is intended to be used by client-side applications that need secure asynchronous bi-directional communication channels ("connections").
+SMP agents communicate with each other via SMP servers using [simplex messaging protocol (SMP)](./simplex-messaging.md) according to the commands received from its users. This protocol is a middle layer in SimpleX protocols (above SMP protocol but below any application level protocol) - it is intended to be used by client-side applications that need secure asynchronous bi-directional communication channels ("connections").
 
 The agent must have a persistent storage to manage the states of known connections and of the client-side information of SMP queues that each connection consists of, and also the buffer of the most recent sent and received messages. The number of the messages that should be stored is implementation specific, depending on the error management approach that the agent implements; at the very least the agent must store the hashes and IDs of the last received and sent messages.
 
 ## SMP servers management
 
-SMP agent API does not use the addresses of the SMP servers that the agent will use to create and use the connections (excluding the server address in queue URIs used in JOIN command). The list of the servers is a part of the agent configuration and can be dynamically changed by the agent implementation:
+SMP agent protocol commands do not contain the addresses of the SMP servers that the agent will use to create and use the connections (excluding the server address in queue URIs used in JOIN command). The list of the servers is a part of the agent configuration and can be dynamically changed by the agent implementation:
 - by the client applications via any API that is outside of scope of this protocol.
 - by the agents themselves based on availability and latency of the configured servers.
 
-## SMP agent protocol scope
+## SMP agent protocol components
 
-SMP agent protocol has 2 main parts:
+SMP agent protocol has 3 main parts:
 
-- the messages that SMP agents exchange with each other in order to:
+- the syntax and semantics of the messages that SMP agents exchange with each other in order to:
   - negotiate establishing unidirectional (simplex) encrypted queues on SMP servers.
   - exchange client messages and delivery notifications, providing sequential message IDs and message integrity (by including the hash of the previous message).
-  - re-negotiate messaging queues to use and connection e2e encryption.
-- the messages that the clients of SMP agents should send out-of-band (as pre-shared "invitation" including queue URIs) to protect [E2E encryption][1] from active attacks ([MITM attacks][2]).
-
-[Appendix A](#appendix-a-smp-agent-api) of this document describes:
-- the functional API used by the client application with the agent. This API allows to create and manage multiple connections, each consisting of two or more SMP queues.
-- events that the agent passes to the clients.
+- the syntax and semantics of the commands that are sent by the agent clients to the agents. This protocol allows to create and manage multiple connections, each consisting of two or more SMP queues.
+- the syntax and semantics of the message that the clients of SMP agents should send out-of-band (as pre-shared "invitation" including queue URIs) to protect [E2E encryption][1] from active attacks ([MITM attacks][2]).
 
 ## Duplex connection procedure
 
@@ -69,287 +75,348 @@ SMP agent protocol has 2 main parts:
 
 The procedure of establishing a duplex connection is explained on the example of Alice and Bob creating a bi-directional connection consisting of two unidirectional (simplex) queues, using SMP agents (A and B) to facilitate it, and two different SMP servers (which could be the same server). It is shown on the diagram above and has these steps:
 
-1. Alice requests the new connection from the SMP agent A using agent `createConnection` api function.
-2. Agent A creates an SMP queue on the server (using [SMP protocol](./simplex-messaging.md) `NEW` command) and responds to Alice with the invitation that contains queue information and the encryption keys Bob's agent B should use. The invitation format is described in [Connection link](connection-link-1-time-invitation-and-contact-address).
-3. Alice sends the [connection link](#connection-link-1-time-invitation-and-contact-address) to Bob via any secure channel (out-of-band message) - as a link or as a QR code.
-4. Bob uses agent `joinConnection` api function with the connection link as a parameter to agent B to accept the connection.
-5. Agent B creates Bob's SMP reply queue with SMP server `NEW` command.
-6. Agent B confirms the connection: sends an "SMP confirmation" with SMP server `SEND` command to the SMP queue specified in the connection link - SMP confirmation is an unauthenticated message with an ephemeral key that will be used to authenticate Bob's commands to the queue, as described in SMP protocol, and Bob's info (profile, public key for E2E encryption, and the connection link to this 2nd queue to Agent A - this connection link SHOULD use "simplex" URI scheme). This message is encrypted using key passed in the connection link (or with the derived shared secret, in which case public key for key derivation should be sent in clear text).
-6. Alice confirms and continues the connection:
-  - Agent A receives the SMP confirmation containing Bob's key, reply queue and info as SMP server `MSG`.
-  - Agent A notifies Alice sending `CONF` notification with Bob's info.
-  - Alice allows connection to continue with agent `allowConnection` api function.
-  - Agent A secures the queue with SMP server `KEY` command.
-  - Agent A sends SMP confirmation with ephemeral sender key, ephemeral public encryption key and profile (but without reply queue).
-7. Agent B confirms the connection:
-  - receives the confirmation.
-  - sends the notification `INFO` with Alice's information to Bob.
-  - secures SMP queue that it sent to Alice in the first confirmation with SMP `KEY` command .
-  - sends `HELLO` message via SMP `SEND` command. This confirms that the reply queue is secured and also validates that Agent A secured the first SMP queue
-8. Agent A notifies Alice.
-  - receives `HELLO` message from Agent B.
-  - sends `HELLO` message to Agent B via SMP `SEND` command.
-  - sends `CON` notification to Alice, confirming that the connection is established.
-9. Agent B notifies Bob.
-  - Once Agent B receives `HELLO` from Agent A, it sends to Bob `CON` notification as well.
+1. Alice requests the new connection from the SMP agent A using SMP NEW command.
+2. Agent A creates an SMP connection on the server (using [SMP protocol](./simplex-messaging.md)) and responds to Alice with the invitation that contains queue information and the encryption key Bob's agent B should use. The invitation format is described in [Connection request](#connection-request).
+3. Alice sends the [connection request](#connection-request) to Bob via any secure channel (out-of-band message).
+4. Bob sends `JOIN` command with the connection request as a parameter to agent B to accept the connection.
+5. Establishing Alice's SMP queue (with SMP protocol commands):
+  - Agent B sends an "SMP confirmation" with SMP SEND command to the SMP queue specified in the connection request - SMP confirmation is an unauthenticated message with an ephemeral key that will be used to authenticate Bob's commands to the queue, as described in SMP protocol, and Bob's info (profile, public key for E2E encryption, etc.). This message is encrypted using key passed in the connection request (or with the derived key, in which case public key for key derivation should be sent in clear text).
+  - Agent A receives the SMP confirmation containing Bob's key and info as SMP MSG.
+  - Agent A notifies Alice sending REQ notification with Bob's info.
+  - Alice accepts connection request with ACPT command.
+  - Agent A secures the queue with SMP KEY command.
+  - Agent B tries sending authenticated SMP SEND command with agent `HELLO` message until it succeeds. Once it succeeds, Bob's agent "knows" the queue is secured.
+6. Agent B creates a new SMP queue on the server.
+7. Establish Bob's SMP queue:
+  - Agent B sends `REPLY` message (SMP SEND command) with the connection request to this 2nd queue to Alice's agent (via the 1st queue) - this connection request SHOULD use "simplex" URI scheme.
+  - Agent A, having received `REPLY` message, sends unauthenticated message (SMP SEND) to SMP queue with Alice agent's ephemeral key that will be used to authenticate Alice's commands to the queue, as described in SMP protocol, and Alice's info.
+  - Bob's agent receives the key and Alice's information and secures the queue (SMP KEY).
+  - Bob's agent sends the notification `INFO` with Alice's information to Bob.
+  - Alice's agent keeps sending `HELLO` message until it succeeds.
+8. Agents A and B notify Alice and Bob that connection is established.
+  - Once sending `HELLO` succeeds, Alice's agent sends to Alice `CON` notification that confirms that now both parties can communicate.
+  - Once Bob's agent receives `HELLO` from Alice's agent, it sends to Bob `CON` notification as well.
 
 At this point the duplex connection between Alice and Bob is established, they can use `SEND` command to send messages. The diagram also shows how the connection status changes for both parties, where the first part is the status of the SMP queue to receive messages, and the second part - the status of the queue to send messages.
 
 The most communication happens between the agents and servers, from the point of view of Alice and Bob there are 4 steps (not including notifications):
 
-1. Alice requests a new connection with `createConnection` agent API function and receives the connection link.
-2. Alice passes connection link out-of-band to Bob.
-3. Bob accepts the connection with `joinConnection` agent API function with the connection link to his agent.
-4. Alice accepts the connection with `ACPT` agent API function.
+1. Alice requests a new connection with `NEW` command and receives the invitation.
+2. Alice passes connection request out-of-band to Bob.
+3. Bob accepts the connection with `JOIN` command with the connection request to his agent.
+4. Alice accepts the connection with `ACPT` command.
 5. Both parties receive `CON` notification once duplex connection is established.
 
 Clients SHOULD support establishing duplex connection asynchronously (when parties are intermittently offline) by persisting intermediate states and resuming SMP queue subscriptions.
 
-## Fast duplex connection procedure
-
-Previously described duplex connection procedure requires sending 4 messages creating a bad UX for the users - it requires waiting until each party in online before the messages can be sent.
-
-It allows users validating connecting party profile before proceeding with the connection, but it turned out to be unnecessary UX step and is not used in the client applications.
-
-It also protects against an attacker who compromised TLS and uses the sender queue ID sent to the recipient to secure the queue before the sender can. This attack is very hard, and this accepting its risk is better than worse UX. Future protocol versions could mitigate this attack by encrypting entity IDs.
-
-Faster duplex connection process is possible with the `SKEY` command added in v9 of SMP protocol.
-
-![Fast duplex connection procedure](./diagrams/duplex-messaging/duplex-creating-fast.svg)
-
-1. Alice requests the new connection from the SMP agent A using agent `createConnection` api function
-2. Agent A creates an SMP queue on the server (using [SMP protocol](./simplex-messaging.md) `NEW` command with the flag allowing the sender to secure the queue) and responds to Alice with the invitation that contains queue information and the encryption keys Bob's agent B should use. The invitation format is described in [Connection link](connection-link-1-time-invitation-and-contact-address).
-3. Alice sends the [connection link](connection-link-1-time-invitation-and-contact-address) to Bob via any secure channel (out-of-band message) - as a link or as a QR code. This link contains the flag that the queue can be secured by the sender.
-4. Bob uses agent `joinConnection` api function with the connection link as a parameter to agent B to accept the connection.
-5. Agent B secures Alice's queue with SMP command `SKEY` - this command can be proxied.
-6. Agent B creates Bob's SMP reply queue with SMP server `NEW` command (with the flag allowing the sender to secure the queue).
-7. Agent B confirms the connection: sends an "SMP confirmation" with SMP server `SEND` command to the SMP queue specified in the connection link - SMP confirmation is an unauthenticated message with an ephemeral key that will be used to authenticate Bob's commands to the queue, as described in SMP protocol, and Bob's info (profile, public key for E2E encryption, and the connection link to this 2nd queue to Agent A - this connection link SHOULD use "simplex" URI scheme). This message is encrypted using key passed in the connection link (or with the derived shared secret, in which case public key for key derivation should be sent in clear text).
-8. Alice confirms the connection:
-  - Agent A receives the SMP confirmation containing Bob's key, reply queue and info as SMP server `MSG`.
-  - Agent A notifies Alice sending `CONF` notification with Bob's info (that indicates that Agent B already secured the queue).
-  - Alice allows connection to continue with agent `allowConnection` api function.
-  - Agent A secures Bob's queue with SMP command `SKEY`.
-  - Agent A sends SMP confirmation with ephemeral public encryption key and profile (but without reply queue, and without sender key).
-9. Agent A notifies Alice with `CON` notification.
-10. Agent B notifies Bob about connection success:
-  - receives confirmation message from Alice.
-  - sends the notification `INFO` with Alice's information to Bob.
-  - sends `CON` notification to Bob.
-
-## Contact addresses
-
-SMP agents support creating a special type of connection - a contact address - that allows to connect to multiple network users who can send connection requests by sending 1-time connection links to the message queue. 
-
-This connection address uses a messaging queue on SMP server to receive invitations to connect - see `agentInvitation` message below. Once connection request is accepted, a new connection is created and the address itself is no longer used to send the messages - deleting this address does not disrupt the connections that were created via it.
-
 ## Communication between SMP agents
 
 To establish duplex connections and to send messages on behalf of their clients, SMP agents communicate via SMP servers.
 
 Agents use SMP message client body (the part of the SMP message after header - see [SMP protocol](./simplex-messaging.md)) to transmit agent client messages and exchange messages between each other.
 
-These messages are encrypted with per-queue shared secret using NaCL crypto_box and can be of 4 types, as defined by `decryptedSMPClientMessage`:
-- `agentConfirmation` - used when confirming SMP queues, contains connection information encrypted with double ratchet. This envelope can only contain `agentConnInfo` or `agentConnInfoReply` encrypted with double ratchet.
-- `agentMsgEnvelope` - contains different agent messages encrypted with double ratchet, as defined in `agentMessage`.
-- `agentInvitation` - sent to SMP queue that is used as contact address, does not use double ratchet.
-- `agentRatchetKey` - used to re-negotiate double ratchet encryption - can contain additional information in `agentRatchetKey`.
+Each SMP message client body, once decrypted, contains 3 parts (one of them may include binary message body), as defined by `decryptedSmpMessageBody` syntax:
 
-```abnf
-decryptedSMPClientMessage = agentConfirmation / agentMsgEnvelope / agentInvitation / agentRatchetKey
-agentConfirmation = agentVersion %s"C" ("0" / "1" sndE2EEncryptionParams) encConnInfo
-agentVersion = 2*2 OCTET
-sndE2EEncryptionParams = TODO
-encConnInfo = doubleRatchetEncryptedMessage
-
-agentMsgEnvelope = agentVersion %s"M" encAgentMessage
-encAgentMessage = doubleRatchetEncryptedMessage
-
-agentInvitation = agentVersion %s"I" connReqLength connReq connInfo
-connReqLength = 2*2 OCTET ; Word16
-
-agentRatchetKey = agentVersion %s"R" rcvE2EEncryptionParams agentRatchetInfo
-rcvE2EEncryptionParams = TODO
-
-doubleRatchetEncryptedMessage = TODO
-```
-
-This syntax of decrypted SMP client message body is defined by `decryptedAgentMessage` below.
-
-Decrypted SMP message client body can be one of 4 types:
-- `agentConnInfo` - used by the initiating party when confirming reply queue - sent in `agentConfirmation` envelope.
-- `agentConnInfoReply` - used by accepting party, includes reply queue(s) in the initial confirmation - sent in `agentConfirmation` envelope.
-- `agentRatchetInfo` - used to pass additional information when renegotiating double ratchet encryption - sent in `agentRatchetKey` envelope.
-- `agentMessage` - all other agent messages.
-
-`agentMessage` contains these parts:
 - `agentMsgHeader` - agent message header that contains sequential agent message ID for a particular SMP queue, agent timestamp (ISO8601) and the hash of the previous message.
-- `aMessage` - a command/message to the other SMP agent:
-  - to confirm the connection (`HELLO`).
-  - to send and to confirm reception of user messages (`A_MSG`, `A_RCVD`).
-  - to confirm that the new double ratchet encryption is agreed (`EREADY`).
-  - to notify another party that it can continue sending messages after queue capacity was exceeded (`A_QCONT`).
-  - to manage SMP queue rotation (`QADD`, `QKEY`, `QUSE`, `QTEST`).
-- `msgPadding` - an optional message padding to make all SMP messages have constant size, to prevent servers from observing the actual message size. The only case the message padding can be absent is when the message has exactly the maximum size, in all other cases the message MUST be padded to a fixed size.
+- `agentMessage` - a command/message to the other SMP agent:
+  - to establish the connection with two SMP queues (`helloMsg`, `replyQueueMsg`)
+  - to send and to acknowledge user messages (`clientMsg`, `acknowledgeMsg`)
+  - to manage SMP queue rotation (`newQueueMessage`, `deleteQueueMsg`)
+  - to manage encryption key rotation (TODO)
+- `msgPadding` - an optional message padding to make all SMP messages have constant size, to prevent servers from observing the actual message size.
 
 ### Messages between SMP agents
 
 Message syntax below uses [ABNF][3] with [case-sensitive strings extension][4].
 
 ```abnf
-decryptedAgentMessage = agentConnInfo / agentConnInfoReply / agentRatchetInfo / agentMessage
-agentConnInfo = %s"I" connInfo
-connInfo = *OCTET
-agentConnInfoReply = %s"D" smpQueues connInfo
-agentRatchetInfo = %s"R" ratchetInfo
+decryptedSmpMessageBody = agentMsgHeader CRLF agentMessage CRLF msgPadding
+agentMsgHeader = agentMsgId SP agentTimestamp SP previousMsgHash ; here `agentMsgId` is sequential ID set by the sending agent
+agentMsgId = 1*DIGIT
+agentTimestamp = <date-time> ; RFC3339
+previousMsgHash = encoded
+encoded = <base64 encoded>
 
-agentMessage = %s"M" agentMsgHeader aMessage msgPadding
-agentMsgHeader = agentMsgId prevMsgHash
-agentMsgId = 8*8 OCTET ; Int64
-prevMsgHash = shortString
+agentMessage = helloMsg / replyQueueMsg /
+               clientMsg / invitationMsg/ acknowledgeMsg /
+               newQueueMessage / deleteQueueMsg 
 
-aMessage = HELLO / A_MSG / A_RCVD / EREADY / A_QCONT /
-           QADD / QKEY / QUSE / QTEST
+msgPadding = *OCTET ; optional random bytes to get messages to the same size (as defined in SMP message size)
 
-HELLO = %s"H"
+helloMsg = %s"HELLO" SP signatureVerificationKey [SP %s"NO_ACK"]
+; NO_ACK means that acknowledgements to client messages will NOT be sent in this connection by the agent that sent `HELLO` message.
+signatureVerificationKey = encoded
 
-A_MSG = %s"M" userMsgBody
-userMsgBody = *OCTET
+replyQueueMsg = %s"REPLY" SP connectionRequest ; `connectionRequest` is defined below
+; this message can only be sent by the second connection party
 
-A_RCVD = %s"V" msgReceipt
-msgReceipt = agentMsgId msgHash rcptLength rcptInfo
+clientMsg = %s"MSG" SP size CRLF clientMsgBody CRLF ; CRLF is in addition to CRLF in decryptedSmpMessageBody
+size = 1*DIGIT
+clientMsgBody = *OCTET
 
-EREADY = %s"E" agentMsgId
+invitationMsg = %s"INV" SP connReqInvitation SP connInfo
+; `connReqInvitation` and `connInfo` are defined below
 
-A_QCONT = %s"QC" sndQueueAddr
+acknowledgeMsg = %s"ACK" SP agentMsgId SP msgHash SP ackStatus
+; NOT SUPPORTED in the current implementation
 
-QADD = %s"QA" sndQueues
-sndQueues = length 1*(newQueueUri replacedSndQueue)
-newQueueUri = clientVRange smpServer senderId dhPublicKey [sndSecure]
-dhPublicKey = length x509encoded
-sndSecure = "T"
-replacedSndQueue = "0" / "1" sndQueueAddr
+msgHash = encoded
+; base64 encoded hash of the received message
 
-QKEY = %s"QK" sndQueueKeys
-sndQueueKeys = length 1*(newQueueInfo senderKey)
-newQueueInfo = version smpServer senderId dhPublicKey [sndSecure]
-senderKey = length x509encoded
+ackStatus = %s"OK" / ackError
 
-QUSE = %s"QU" sndQueuesReady
-sndQueuesReady = length 1*(sndQueueAddr primary)
-primary = %s"T" / %s"F"
+ackError = %s"ERR" SP ackErrorType
 
-QTEST = %s"QT" sndQueueAddrs
-sndQueueAddrs = length 1*sndQueueAddr
+ackErrorType = ackUnknownMsg / ackProhibitedMsg / ackSyntaxErr
 
-sndQueueAddr = smpServer senderId
-smpServer = hosts port keyHash
-hosts = length 1*host
-host = shortString
-port = shortString
-keyHash = shortString
-senderId = shortString
+ackUnknownMsg = %s"UNKNOWN"
 
-clientVRange = version version
-version = 2*2 OCTET
+ackProhibitedMsg = %s"PROHIBITED" ; unexpected message e.g. "HELLO" or "REPLY"
 
-msgPadding = *OCTET
-rcptLength = 2*2 OCTET
-shortString = length *OCTET
-length = 1*1 OCTET
+ackSyntaxErr = %s"SYNTAX" SP syntaxErrCode
+syntaxErrCode = 1*DIGIT ; TODO
+
+newQueueMsg = %s"NEW" SP queueURI
+; this message can be sent by any party to add SMP queue to the connection.
+; NOT SUPPORTED in the current implementation
+
+deleteQueueMsg = %s"DEL" SP queueURI
+; notification that the queue with passed URI will be deleted
+; no need to notify the other party about suspending queue separately, as suspended and deleted queues are indistinguishable to the sender
+; NOT SUPPORTED in the current implementation
 ```
 
 #### HELLO message
 
-This is the first message that both agents send after the respective SMP queue is secured by the receiving agent (see diagram).
+This is the first message that both agents send after the respective SMP queue is secured by the receiving agent (see diagram). It MAY contain the public key that the recipient would use to verify messages signed by the sender.
 
-This message is not used with [fast duplex connection](#fast-duplex-connection-procedure).
+Sending agent might need to retry sending HELLO message, as it would not have any other confirmation that the queue is secured other than the success of sending this message with the signed SMP SEND command.
 
-#### A_MSG message
+#### REPLY message
 
-This is the agent envelope used to send client messages once the connection is established. This is different from the MSG sent by SMP server to the agent and MSG event from SMP agent to the client that are sent in different contexts.
+This is the message that is sent by the agent that received an out-of-band connection request to pass the connection request for the reply SMP queues to the agent that originated the connection (see diagram).
 
-#### A_RCVD message
+#### MSG message
 
-This message is sent to confirm the client message reception. It includes received message number and message hash.
+This is the agent envelope used to send client messages once the connection is established. Do not confuse it with the MSG response from SMP server to the agent and MSG response from SMP agent to the client that are sent in different contexts.
 
-#### EREADY message
+#### INV message
 
-This message is sent after re-negotiating a new double ratchet encryption with `agentRatchetKey`.
+This message is sent to the SMP queue(s) in `connReqContact`, to establish a new connection via existing unsecured queue, that acts as a permanent connection link of a user.
 
-#### A_QCONT message
+#### ACK message
 
-This message is sent to notify the sender client that it can continue sending the messages after queue capacity was exhausted.
+This message is sent to confirm the client message reception. It includes received message number, message hash and the reception status.
 
-### Rotating messaging queue
+#### NEW message
 
-SMP agents SHOULD support 4 messages to rotate message reception to another messaging server:
-`QADD`: add the new queue address(es) to the connection - sent by the client that initiates rotation.
-`QKEY`: pass sender's key via existing connection (SMP confirmation message will not be used, to avoid the same "race" of the initial key exchange that would create the risk of intercepting the queue for the attacker) - sent by the client accepting the rotation
-`QUSE`: instruct the sender to use the new queue with sender's queue ID as parameter. From this point some messages can be sent to both the new queue and the old queue.
-`QTEST`: send test message to the new connection. Any other message can be sent if available to continue rotation, the absence of this message is not an error. Once this message is successfully sent the sender will stop using the old queue. Once this message (or any other message in the new queue) is received, the recipient will stop using the old queue and delete it.
+This message is sent to add an additional SMP queue to the connection. Unlike REPLY message it can be sent at any time.
 
-**Queue rotation procedure**
+#### DEL message 
 
-![Queue rotation procedure](./diagrams/duplex-messaging/queue-rotation.svg)
+This message is sent to notify that the queue with passed URI will be deleted - having received this message, the receiving agent should no longer send messages to this queue. In case it was the only queue in the connection to which the agent could send the messages, it MAY also delete the reply queue(s) in the connection.
 
-`SKEY` command added in v9 of SMP protocol allows for faster queue rotation procedure.
+## SMP agent commands
 
-**Fast queue rotation procedure**
+This part describes the transmissions between users and client-side SMP agents: commands that the users send to create and operate duplex connections and SMP agent responses and messages they deliver.
 
-![Fast queue rotation procedure](./diagrams/duplex-messaging/queue-rotation-fast.svg)
+Commands syntax below is provided using [ABNF][3] with [case-sensitive strings extension][4].
 
-## End-to-end encryption
+Each transmission between the user and SMP agent must have this format/syntax:
 
-Messages between SMP agents have two layers of e2e encryption:
-- simple encryption agreed in SMP protocol with a fixed key agreed when the messaging queue is agreed by parties.
-- post-quantum resistant augmented double ratchet algorithm (PQDR) specified in [this document](./pqdr.md).
+```abnf
+agentTransmission = [corrId] CRLF [cAlias] CRLF agentCommand
 
-The protocol supports adding and removing post-quantum KEM primitive to the key agreement in double ratchet:
-- to support migration of pre-existing connections to PQDR.
-- to be able to disable PQ key agreement.
-- to be able to use invitation links and contact addresses without large PQ keys.
+corrId = 1*(%x21-7F) ; any characters other than control/whitespace
 
-Possible scenarios below show the possible states of PQ key agreement, assuming that both clients support it.
+cAlias = cId / cName
+cId = encoded
+cName = 1*(ALPHA / DIGIT / "_" / "-")
 
-Possible options for each stage are:
-- no KEM encapsulation key was sent (No PQ key),
-- only KEM encapsulation key was sent, but not ciphertext yet (PQ key sent),
-- both KEM encapsulation key from one KEM agreement and ciphertext from the previous agreement were sent (PQ key + PQ ct sent).
+agentCommand = (userCmd / agentMsg) CRLF
+userCmd = newCmd / joinCmd / letCmd / acceptCmd / subscribeCmd / sendCmd / acknowledgeCmd / suspendCmd / deleteCmd
+agentMsg = invitation / confMsg / connReqMsg / connInfo / connected / unsubscribed / connDown / connUp / messageId / sent / messageError / message / received / ok / error
 
-`+` in the table means that this scenario is possible, and `-` - that it is not possible.
+newCmd = %s"NEW" SP connectionMode [SP %s"NO_ACK"] ; response is `invitation` or `error`
+; NO_ACK parameter currently not supported
 
-| Connection stage                                       | No PQ key        | PQ key sent      | PQ key + PQ ct sent |
-|:------------------------------------------------------:|:----------------:|:----------------:|:-------------------:|
-| invitation                                             |         +        |         +        |          -          |
-| confirmation, in reply to: <br>no-pq inv <br>pq inv    | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+    |
-| 1st msg, in reply to: <br>no-pq conf <br>pq/pq+ct conf | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+    |
-| Nth msg, in reply to: <br>no-pq msg <br>pq/pq+ct msg   | &nbsp;<br>+<br>+ | &nbsp;<br>+<br>- | &nbsp;<br>-<br>+    |
+connectionMode = %s"INV" / %s"CON"
 
-These scenarios can be reduced to:
-1. initial invitation optionally has PQ key, but must not have ciphertext.
-2. all subsequent messages should be allowed without PQ key/ciphertext, but:
-  - if the previous message had PQ key or PQ key with ciphertext, they must either have no PQ key, or have PQ key with ciphertext (PQ key without ciphertext is an error).
-  - if the previous message had no PQ key, they must either have no PQ key, or have PQ key without ciphertext (PQ key with ciphertext is an error).
+invitation = %s"INV" SP connectionRequest ; `connectionRequest` is defined below
 
-The rules for calculating the shared secret for received/sent messages are (assuming received message is valid according to the above rules):
+confMsg = %s"CONF" SP confirmationId SP msgBody
+; msgBody here is any binary information identifying connection request
 
-|  sent msg > <br>V received msg | no-pq       | pq      | pq+ct           |
-|:------------------------------:|:-----------:|:-------:|:---------------:|
-| no-pq                          | DH / DH     | DH / DH | err             |
-| pq (sent msg was NOT pq)       | DH / DH     | err     | DH / DH+KEM     |
-| pq+ct (sent msg was NOT no-pq) | DH+KEM / DH | err     | DH+KEM / DH+KEM |
+letCmd = %s"LET" SP confirmationId SP msgBody
+; msgBody here is any binary information identifying connecting party
 
-To summarize, the upgrade to DH+KEM secret happens in a sent message that has PQ key with ciphertext sent in reply to message with PQ key only (without ciphertext), and the downgrade to DH secret happens in the message that has no PQ key.
+confirmationId = 1*DIGIT
 
-## Connection link: 1-time invitation and contact address
+connReqMsg = %s"REQ" SP invitationId SP msgBody
+; msgBody here is any binary information identifying connection request
 
-Connection links are generated by SMP agent in response to `createConnection` api call, used by another party user with `joinConnection` api, and then another connection link is sent by the agent in `agentConnInfoReply` and used by the first party agent to connect to the reply queue (the second part of the process is invisible to the users).
+acceptCmd = %s"ACPT" SP invitationId SP msgBody
+; msgBody here is any binary information identifying connecting party
 
-Connection link syntax:
+invitationId = 1*DIGIT
+
+connInfo = %s"INFO" SP msgBody
+; msgBody here is any binary information identifying connecting party
+
+connected = %s"CON"
+
+subscribeCmd = %s"SUB" ; response is `ok` or `error`
+
+unsubscribed = %s"END"
+; when another agent (or another client of the same agent)
+; subscribes to the same SMP queue on the server
+
+connDown = %s"DOWN"
+; lost connection (e.g. because of Internet connectivity or server is down)
+
+connUp = %s"UP"
+; restored connection
+
+joinCmd = %s"JOIN" SP connectionRequest SP connInfo [SP %s"NO_REPLY"] [SP %s"NO_ACK"]
+; `connectionRequest` and `connInfo` are defined below
+; response is `connected` or `error`
+; parameters NO_REPLY and NO_ACK are currently not supported
+
+suspendCmd = %s"OFF" ; can be sent by either party, response `ok` or `error`
+
+deleteCmd = %s"DEL" ; can be sent by either party, response `ok` or `error`
+
+sendCmd = %s"SEND" SP msgBody
+; send syntax is similar to that of SMP protocol, but it is wrapped in SMP message
+msgBody = stringMsg | binaryMsg
+stringMsg = ":" string ; until CRLF in the transmission
+string = *(%x01-09 / %x0B-0C / %x0E-FF %) ; any characters other than NUL, CR and LF
+binaryMsg = size CRLF msgBody CRLF ; the last CRLF is in addition to CRLF in the transmission
+size = 1*DIGIT ; size in bytes
+msgBody = *OCTET ; any content of specified size - safe for binary
+
+messageId = %s"MID" SP agentMsgId
+
+sent = %s"SENT" SP agentMsgId
+
+messageError = %s"MERR" SP agentMsgId SP <errorType>
+
+message = %s"MSG" SP msgIntegrity SP recipientMeta SP brokerMeta SP senderMeta SP binaryMsg
+recipientMeta = %s"R=" agentMsgId "," agentTimestamp ; receiving agent message metadata 
+brokerMeta = %s"B=" brokerMsgId "," brokerTimestamp ; broker (server) message metadata
+senderMeta = %s"S=" agentMsgId "," agentTimestamp ; sending agent message metadata 
+brokerMsgId = encoded
+brokerTimestamp = <date-time>
+msgIntegrity = ok / msgIntegrityError
+
+msgIntegrityError = %s"ERR" SP msgIntegrityErrorType
+msgIntegrityErrorType = skippedMsgErr / badMsgIdErr / badHashErr
+
+skippedMsgErr = %s"NO_ID" SP missingFromMsgId SP missingToMsgId
+badMsgIdErr = %s"ID" SP previousMsgId ; ID is lower than the previous
+badHashErr = %s"HASH"
+
+missingFromMsgId = agentMsgId
+missingToMsgId = agentMsgId
+previousMsgId = agentMsgId
+
+acknowledgeCmd = %s"ACK" SP agentMsgId ; ID assigned by receiving agent (in MSG "R")
+
+received = %s"RCVD" SP agentMsgId SP msgIntegrity
+; ID assigned by sending agent (in SENT response)
+; currently not implemented
+
+msgStatus = ok | error
+
+ok = %s"OK"
+
+error = %s"ERR" SP <errorType>
+```
+
+### Client commands and server responses
+
+#### NEW command and INV response
+
+`NEW` command is used to create a connection and a connection request to be sent out-of-band to another protocol user (the joining party). It should be used by the client of the agent that initiates creating a duplex connection (the initiating party).
+
+`INV` response is sent by the agent to the client of the initiating party.
+
+`NEW` command has `connectionMode` parameter to define the connection mode - to be used to communicate with a single contact (invitation mode, `connectionMode` is `INV`) or to accept connection requests from anybody (contact mode, `connectionMode` is `CON`). The type of connection request is determined by `connectionMode` parameter.
+
+#### JOIN command
+
+It is used to create a connection and accept the connection request received out-of-band. It should be used by the client of the agent that accepts the connection (the joining party).
+
+#### CONF notification and LET command
+
+When the joining party uses `JOIN` command to accept connection invitation created with `NEW INV` command, the initiating party will receive `CONF` notification with some numeric identifier and an additional binary information, that can be used to identify the joining party or for any other purpose.
+
+To continue with the connection the initiating party should use `LET` command.
+
+#### REQ notification and ACPT command
+
+When the joining party uses `JOIN` command to connect to the contact created with `NEW CON` command, the initiating party will receive `REQ` notification with some numeric identifier and an additional binary information, that can be used to identify the joining party or for any other purpose.
+
+To continue with the connection the party that created the contact should use `ACPT` command.
+
+#### INFO and CON notifications
+
+After the initiating party proceeds with the connection using `ACPT` command, the joining party will receive `INFO` notification that can be used to identify the initiating party or for any other purpose.
+
+Once the connection is established and ready to accept client messages, both agents will send `CON` notification to their clients.
+
+#### SUB command
+
+This command can be used by the client to resume receiving messages from the connection that was created in another TCP/client session. Agent response to this command can be `OK` or `ERR` in case connection does not exist (or can only be used to send connections - e.g. when the reply queue was not created).
+
+#### SEND command and MID, SENT, RCVD and MERR responses
+
+`SEND` command is used by the client to send messages.
+
+`MID` response with the message ID (the sequential message number that includes both sent and received messages in the connection) is sent to the client to confirm that the message is accepted by the agent, before it is sent to the SMP server.
+
+`SENT` notification is sent by the agent to confirm that the message was delivered to at least one of SMP servers. This notification contains the same message ID as `MID` notification. `SENT` notification, depending on network availability, can be sent at any time later, potentially in the next client session.
+
+`RCVD` notification is sent by the agent when it receives `ACK` message from the receiving agent. This notification contains reception status, only one successful notification will be sent, and multiple error notifications will be sent in case `ACK` had error status.
+
+In case of the failure to send the message for any other reason than network connection or message queue quota - e.g. authentication error (`ERR AUTH`) or syntax error (`ERR CMD error`), the agent will send to the client `MERR` notification with the message ID, and this message delivery will no longer be attempted to this SMP queue.
+
+#### MSG notification
+
+It is sent by the agent to the client when agent receives the message from the SMP server. It has message ID and timestamp from both the receiving and sending agents and from SMP server:
+- recipient agent ID is intended to be used to refer to the message in the future.
+- sender agent ID is intended to be used to identify any missed / skipped message(s)
+- broker ID should be used to detect duplicate deliveries (it would happen if TCP connection is lost before the message is acknowledged by the agent - see [SMP protocol](./simplex-messaging.md))
+
+#### END notification
+
+It is sent by the agent to the client when agent receives SMP protocol `END` notification from SMP server. It indicates that another agent has subscribed to the same SMP queue on the server and the server terminated the subscription of the current agent.
+
+#### DOWN and UP notifications
+
+These notifications are sent when server or network connection is, respectively, `DOWN` or back `UP`.
+
+All the subscriptions made in the current client session will be automatically resumed when `UP` notification is received.
+
+#### OFF command
+
+It is used to suspend the receiving SMP queue - sender will no longer be able to send the messages to the connection, but the recipient can retrieve the remaining messages. Agent response to this command can be `OK` or `ERR`. This command is irreversible.
+
+#### DEL command
+
+It is used to delete the connection and all messages in it, as well as the receiving SMP queue and all messages in it that were remaining on the server. Agent response to this command can be `OK` or `ERR`. This command is irreversible.
+
+## Connection request
+
+Connection request `connectionRequest` is generated by SMP agent in response to `newCmd` command (`"NEW"`), used by another party user with `joinCmd` command (`"JOIN"`), and then another connection request is sent by the agent in `replyQueueMsg` and used by the first party agent to connect to the reply queue (the second part of the process is invisible to the users).
+
+Connection request syntax:
 
 ```
-connectionLink = connectionScheme "/" connLinkType "#/?smp=" smpQueues "&e2e=" e2eEncryption
-connLinkType = %s"invitation" / %s"contact"
+connectionRequest = connectionScheme "/" connReqType "#/?smp=" smpQueues "&e2e=" e2eEncryption
+connReqType = %s"invitation" / %s"contact"
+; this parameter has the same meaning as connectionMode in agent commands
+; `NEW INV` creates `invitation` connection request, `NEW CON` - `contact`
 connectionScheme = (%s"https://" clientAppServer) | %s"simplex:"
 clientAppServer = hostname [ ":" port ]
 ; client app server, e.g. simplex.chat
@@ -364,112 +431,12 @@ smpQueue = <URL-encoded queueURI defined in SMP protocol>
 
 All parameters are passed via URI hash to avoid sending them to the server (in case "https" scheme is used) - they can be used by the client-side code and processed by the client application. Parameters `smp` and `e2e` can be present in any order, any unknown additional parameters SHOULD be ignored.
 
-`clientAppServer` is not an SMP server - it is a server that shows the instruction on how to download the client app that will connect using this connection link. This server can also host a mobile or desktop app manifest so that this link is opened directly in the app if it is installed on the device.
+`clientAppServer` is not an SMP server - it is a server that shows the instruction on how to download the client app that will connect using this connection request. This server can also host a mobile or desktop app manifest so that this link is opened directly in the app if it is installed on the device.
 
 "simplex" URI scheme in `connectionProtocol` can be used instead of client app server, to connect without creating any web traffic. Client apps MUST support this URI scheme.
 
 See SMP protocol [out-of-band messages](./simplex-messaging.md#out-of-band-messages) for syntax of `queueURI`.
 
-## Appendix A: SMP agent API
-
-The exact specification of agent library API and of the events that the agent sends to the client application is out of scope of the protocol specification.
-
-The list of some of the API functions and events below is supported by the reference implementation, and they are likely to be required by the client applications.
-
-### API functions
-
-The list of APIs below is not exhaustive and provided for information only. Please consult the source code for more information.
-
-#### Create conection
-
-`createConnection` api is used to create a connection - it returns the connection link that should be sent out-of-band to another protocol user (the joining party). It should be used by the client of the agent that initiates creating a duplex connection (the initiating party).
-
-This api is also used to create a contact address - a special connection that can be used by multiple people to connect to the user.
-
-Some communication scenarios may require fault-tolerant mechanism of creating connections that retries on network failures and continue retrying after the client is restarted. Such asynchronous API would return its result via `INV` event once it succeeds.
-
-#### Join connection
-
-`joinConnection` is used to create a connection record and accept the connection invitation received out-of-band. It should be used by the client of the agent that accepts the connection (the joining party).
-
-This api can also be required as asynchronous, in which case `OK` event will be dispatched to the client to indicate the success or `ERR` in case it permanently failed (e.g., in case connection was deleted by another party).
-
-#### Allow connection
-
-Once the client receives `CONF` event, it should use synchronous `allowConnection` api to proceed with the connection (both for the [standard](#duplex-connection-procedure) and for the [fast duplex procedure](#fast-duplex-connection-procedure)).
-
-In case this API is used as asynchronous it will return its result via `OK` or `ERR` event.
-
-#### Accept and reject connection requests
-
-Connection requests are delivered to the client application via `REQ` event.
-
-Client can `acceptContact` and `rejectContact`, with `OK` and `ERR` events in case of asynchronous calls.
-
-#### Send message
-
-`sendMessage` api is always asynchronous. The api call returns message ID, `SENT` event once the message is sent to the server, `MWARN` event in case of temporary delivery failure that can be resolved by the user (e.g., by connecting via Tor or by upgrading the client) and `MERR` in case of permanent delivery failure.
-
-#### Acknowledge received message
-
-Messages are delivered to the client application via `MSG` event.
-
-Client application must always `ackMessage` to receive the next one - failure to call it in reference implementation will prevent the delivery of subsequent messages until the client reconnects to the server.
-
-This api is also used to acknowledge message delivery to the sending party - that party client application will receive `RCVD` event.
-
-#### Subscribe connection
-
-`subscribeConnection` api is used by the client to resume receiving messages from the connection that was created in another TCP/client session.
-
-#### Get notification message
-
-`getNotificationMessage` is used by push notification subsystem of the client application to receive the message from a specific messaging queue mentioned in the notification. The client application would receive `MSG` and any other events from the agent, and then `MSGNTF` event once the message related to this notification is received.
-
-#### Rotate message queue to another server
-
-`switchConnection` api is used to rotate connection queues to another messaging server.
-
-#### Renegotiate e2e encryption
-
-`synchronizeRatchet` api is used to re-negotiate double ratchet encryption for the connection.
-
-#### Delete connection
-
-`deleteConnection` api is used to delete connection. In case of asynchronous call, the connection deletion will be confirmed with `DEL_RCVQ` and `DEL_CONN` events.
-
-#### Suspend connection
-
-`suspendConnection` api is used to prevent any further messages delivered to the connection without deleting it.
-
-### API events
-
-Agent API uses these events dispatch to notify client application about events related to the connections:
-- `INV` - connection invitation or connection address URI after connection is created.
-- `CONF` - confirmation that connection is accepted by another party. When the accepting party uses `joinConnection` api to accept connection invitation, the initiating party will receive `CONF` notification with some identifier and additional information from the accepting party (e.g., profile). To continue the connection the initiating party client should use `allowConnection` api.
-- `REQ` - connection request is sent when another party uses `joinConnection` api with contact address. The client application can use `acceptContact` or `rejectContact` api.
-- `INFO` - information from the party that initiated the connection with `createConnection` sent to the party accepting the connection with `joinConnection`.
-- `CON` - notification that connection is established sent to both parties of the connection.
-- `END` - notification that connection subscription is terminated when another client subscribed to the same messaging queue.  
-- `DOWN` - notification that connection server is temporarily unavailable.
-- `UP` - notification that the subscriptions made in the current client session are resumed after the server became available.
-- `SWITCH` - notification about queue rotation process.
-- `RSYNC` - notification about e2e encryption re-negotiation process.
-- `SENT` - notification to confirm that the message was delivered to at least one of SMP servers. This notification contains the same message ID as returned to `sendMessage` api. `SENT` notification, depending on network availability, can be sent at any time later, potentially in the next client session.
-- `MWARN` - temporary delivery failure that can be resolved by the user (e.g., by connecting via Tor or by upgrading the client).
-- `MERR` - notification about permanent message delivery failure.
-- `MERRS` - notification about permanent message delivery failure for multiple messages (e.g., when multiple messages expire).
-- `MSG` - sent when agent receives the message from the SMP server.
-- `MSGNTF` - sent after agent received and processed the message referenced in the push notification.
-- `RCVD` - notification confirming message receipt by another party.
-- `QCONT` - notification that the agent continued sending messages after queue capacity was exceeded and recipient received all messages.
-- `DEL_RCVQ` - confirmation that message queue was deleted.
-- `DEL_CONN` - confirmation that connection was deleted.
-- `OK` - confirmation that asynchronous api call was successful.
-- `ERR` - error of asynchronous api call or some other error event.
-
-This list of events is not exhaustive and provided for information only. Please consult the source code for more information.
-
 [1]: https://en.wikipedia.org/wiki/End-to-end_encryption
 [2]: https://en.wikipedia.org/wiki/Man-in-the-middle_attack
 [3]: https://tools.ietf.org/html/rfc5234

protocol/diagrams/duplex-messaging/duplex-creating-fast.mmd

@@ -1,65 +0,0 @@
-sequenceDiagram
-  participant A as Alice
-  participant AA as Alice's<br>agent
-  participant AS as Alice's<br>server
-  participant BS as Bob's<br>server
-  participant BA as Bob's<br>agent
-  participant B as Bob
-
-  note over AA, BA: status (receive/send): NONE/NONE
-
-  note over A, AA: 1. request connection<br>from agent
-  A ->> AA: createConnection
- 
-  note over AA, AS: 2. create Alice's SMP queue
-  AA ->> AS: NEW: create SMP queue<br>allow sender to secure
-  AS ->> AA: IDS: SMP queue IDs
-  note over AA: status: NEW/NONE
-
-  AA ->> A: INV: invitation<br>to connect
-
-  note over A, B: 3. out-of-band invitation
-  A ->> B: OOB: invitation to connect
-
-  note over BA, B: 4. accept connection
-  B ->> BA: joinConnection:<br>via invitation info
-  note over BA: status: NONE/NEW
-
-  note over BA, AS: 5. secure Alice's SMP queue
-  BA ->> AS: SKEY: secure queue (this command needs to be proxied)
-  note over BA: status: NONE/SECURED
-
-  note over BA, BS: 6. create Bob's SMP queue
-  BA ->> BS: NEW: create SMP queue<br>allow sender to secure
-  BS ->> BA: IDS: SMP queue IDs
-  note over BA: status: NEW/SECURED
-
-  note over BA, AA: 7. confirm Alice's SMP queue
-  BA ->> AS: SEND: Bob's info without sender's key (SMP confirmation with reply queues)
-  note over BA: status: NEW/CONFIRMED
-
-  AS ->> AA: MSG: Bob's info without<br>sender server key
-  note over AA: status: CONFIRMED/NEW
-  AA ->> AS: ACK: confirm message
-  AA ->> A: CONF: connection request ID<br>and Bob's info
-  A -> AA: allowConnection: accept connection request,<br>send Alice's info
-  
-  note over AA, BS: 8. secure Bob's SMP queue
-  AA ->> BS: SKEY: secure queue (this command needs to be proxied)
-  note over BA: status: CONFIRMED/SECURED
-
-  AA ->> BS: SEND: Alice's info without sender's server key (SMP confirmation without reply queues)
-  note over AA: status: CONFIRMED/CONFIRMED
-
-  note over AA, A: 9. notify Alice<br>about connection success<br>(no HELLO needed in v6)
-  AA ->> A: CON: connected
-  note over AA: status: ACTIVE/ACTIVE
-
-  note over BA, B: 10. notify Bob<br>about connection success
-  BS ->> BA: MSG: Alice's info without<br>sender's server key
-  note over BA: status: CONFIRMED/CONFIRMED
-  BA ->> B: INFO: Alice's info
-  BA ->> BS: ACK: confirm message
-
-  BA ->> B: CON: connected
-  note over BA: status: ACTIVE/ACTIVE

protocol/diagrams/duplex-messaging/duplex-creating.mmd

@@ -8,8 +8,8 @@ sequenceDiagram
 
   note over AA, BA: status (receive/send): NONE/NONE
 
-  note over A, AA: 1. request connection<br>from agent
-  A ->> AA: createConnection
+  note over A, AA: 1. request connection from agent
+  A ->> AA: NEW: create<br>duplex connection
  
   note over AA, AS: 2. create Alice's SMP queue
   AA ->> AS: NEW: create SMP queue
@@ -17,58 +17,63 @@ sequenceDiagram
   note over AA: status: NEW/NONE
 
   AA ->> A: INV: invitation<br>to connect
+  note over AA: status: PENDING/NONE
 
   note over A, B: 3. out-of-band invitation
   A ->> B: OOB: invitation to connect
 
   note over BA, B: 4. accept connection
-  B ->> BA: joinConnection:<br>via invitation info
+  B ->> BA: JOIN:<br>via invitation info
   note over BA: status: NONE/NEW
 
-  note over BA, BS: 5. create Bob's SMP queue
-  BA ->> BS: NEW: create SMP queue
-  BS ->> BA: IDS: SMP queue IDs
-  note over BA: status: NEW/NEW
-
-  note over BA, AA: 6. confirm Alice's SMP queue
-  BA ->> AS: SEND: Bob's info and sender server key (SMP confirmation with reply queues)
-  note over BA: status: NEW/CONFIRMED
-
+  note over BA, AA: 5. establish Alice's SMP queue
+  BA ->> AS: SEND: Bob's info and sender server key (SMP confirmation)
+  note over BA: status: NONE/CONFIRMED
+  activate BA
   AS ->> AA: MSG: Bob's info and<br>sender server key
   note over AA: status: CONFIRMED/NONE
   AA ->> AS: ACK: confirm message
-  AA ->> A: CONF: connection request ID<br>and Bob's info
-  A ->> AA: allowConnection: accept connection request,<br>send Alice's info
+  AA ->> A: REQ: connection request ID<br>and Bob's info
+  A ->> AA: ACPT: accept connection request,<br>send Alice's info
   AA ->> AS: KEY: secure queue
   note over AA: status: SECURED/NONE
 
-  AA ->> BS: SEND: Alice's info and sender's server key (SMP confirmation without reply queues)
-  note over AA: status: SECURED/CONFIRMED
+  BA ->> AS: SEND: HELLO: try sending until successful
+  deactivate BA
+  note over BA: status: NONE/ACTIVE
+  AS ->> AA: MSG: HELLO: Alice's agent<br>knows Bob can send
+  note over AA: status: ACTIVE/NONE
+  AA ->> AS: ACK: confirm message
 
-  note over BA, AA: 7. confirm Bob's SMP queue
+  note over BA, BS: 6. create Bob's SMP queue
+  BA ->> BS: NEW: create SMP queue
+  BS ->> BA: IDS: SMP queue IDs
+  note over BA: status: NEW/ACTIVE
+
+  note over AA, BA: 7. establish Bob's SMP queue
+  BA ->> AS: SEND: REPLY: invitation to the connect
+  note over BA: status: PENDING/ACTIVE
+  AS ->> AA: MSG: REPLY: invitation<br>to connect
+  note over AA: status: ACTIVE/NEW
+  AA ->> AS: ACK: confirm message
+
+  AA ->> BS: SEND: Alice's info and sender's server key
+  note over AA: status: ACTIVE/CONFIRMED
+  activate AA
   BS ->> BA: MSG: Alice's info and<br>sender's server key
-  note over BA: status: CONFIRMED/CONFIRMED
+  note over BA: status: CONFIRMED/ACTIVE
   BA ->> B: INFO: Alice's info
   BA ->> BS: ACK: confirm message
   BA ->> BS: KEY: secure queue
-  note over BA: status: SECURED/CONFIRMED
-
-  BA ->> AS: SEND: HELLO message
-
   note over BA: status: SECURED/ACTIVE
 
-  AS ->> AA: MSG: HELLO: Alice's agent<br>knows Bob can send
-  note over AA: status: SECURED/ACTIVE
-  AA ->> AS: ACK: confirm message
-  AA ->> BS: SEND: HELLO
-
-  note over A, AA: 8. notify Alice<br>about connection success
-  AA ->> A: CON: connected
+  AA ->> BS: SEND: HELLO: try sending until successful
+  deactivate AA
   note over AA: status: ACTIVE/ACTIVE
-
   BS ->> BA: MSG: HELLO: Bob's agent<br>knows Alice can send
   note over BA: status: ACTIVE/ACTIVE
   BA ->> BS: ACK: confirm message
 
-  note over BA, B: 9. notify Bob<br>about connection success
+  note over A, B: 8. notify users about connection success
+  AA ->> A: CON: connected
   BA ->> B: CON: connected

protocol/diagrams/duplex-messaging/queue-rotation-fast.mmd

@@ -1,17 +0,0 @@
-sequenceDiagram
-  participant A as Alice
-  participant R as Current server<br>that has A's<br>receive queue
-  participant R' as New server<br>that has the new A's<br>receive queue
-  participant S as Server<br>that has A's send queue<br>(B's receive queue)
-  participant B as Bob
-
-  A ->> R': NEW: create new queue<br>(allow SKEY)
-  A ->> S: SEND: QADD (R'): send address<br>of the new queue(s)
-  S ->> B: MSG: QADD (R')
-  B ->> R': SKEY: secure new queue
-  B ->> R': SEND: QTEST
-  R' ->> A: MSG: QTEST
-  A ->> R: DEL: delete the old queue
-  B ->> R': SEND: send messages to the new queue
-  R' ->> A: MSG: receive messages from the new queue
-  

protocol/diagrams/duplex-messaging/queue-rotation.mmd

@@ -1,21 +0,0 @@
-sequenceDiagram
-  participant A as Alice
-  participant R as Current server<br>that has A's<br>receive queue
-  participant R' as New server<br>that has the new A's<br>receive queue
-  participant S as Server<br>that has A's send queue<br>(B's receive queue)
-  participant B as Bob
-
-  A ->> R': NEW: create new queue
-  A ->> S: SEND: QADD (R'): send address<br>of the new queue(s)
-  S ->> B: MSG: QADD (R')
-  B ->> R: SEND: QKEY (R'): sender's key<br>for the new queue(s)
-  R ->> A: MSG: QKEY(R')
-  A ->> R': KEY: secure new queue
-  A ->> S: SEND: QUSE (R'): instruction to use new queue(s)
-  S ->> B: MSG: QUSE (R')
-  B ->> R': SEND: QTEST
-  R' ->> A: MSG: QTEST
-  A ->> R: DEL: delete the old queue
-  B ->> R': SEND: send messages to the new queue
-  R' ->> A: MSG: receive messages from the new queue
-  

protocol/diagrams/notifications/register-token-detailed.mmd

@@ -1,30 +0,0 @@
-sequenceDiagram
-  participant M as mobile app
-  participant C as chat core
-  participant A as agent
-  participant P as push server
-  participant APN as APN
-
-  note over M, APN: get device token
-  M ->> APN: registerForRemoteNotifications()
-  APN ->> M: device token
-
-  note over M, P: register device token with push server
-  M ->> C: /_ntf register <token>
-  C ->> A: registerNtfToken(<token>)
-  A ->> P: TNEW
-  P ->> A: ID (tokenId)
-  A ->> C: registered
-  C ->> M: registered
-
-  note over M, APN: verify device token
-  P ->> APN: E2E encrypted code<br>in background<br>notification
-  APN ->> M: deliver background notification with e2ee verification token
-  M ->> C: /_ntf verify <e2ee code>
-  C ->> A: verifyNtfToken(<e2ee code>)
-  A ->> P: TVFY code
-  P ->> A: OK / ERR
-  A ->> C: verified
-  C ->> M: verified
-
-  note over M, APN: now token ID can be used

protocol/diagrams/notifications/register-token.mmd

@@ -1,26 +0,0 @@
-sequenceDiagram
-  participant C as client app
-  participant A as agent
-  participant P as SimpleX<br>Notification<br>Server
-  participant APN as Apple<br>Push Notifications<br>Server
-
-  note over C, APN: get device token
-  C ->> APN: registerForRemoteNotifications()
-  APN ->> C: device token
-
-  note over C, P: register device token with push server
-  C ->> A: registerToken
-  A ->> P: TNEW
-  P ->> A: ID (tokenId)
-  A ->> C: registered
-
-  note over C, APN: verify device token
-  P ->> APN: E2E encrypted code<br>in background<br>notification
-  APN ->> C: deliver background notification with e2ee verification token
-  C ->> A: verifyToken<br>(<e2ee code>)
-  A ->> P: TVFY code
-  P ->> A: OK / ERR
-  A ->> C: verified
-
-  note over C, APN: now token ID can be used
-  

protocol/diagrams/notifications/subscription-detailed.mmd

@@ -1,40 +0,0 @@
-sequenceDiagram
-  participant M as mobile app
-  participant C as chat core
-  participant A as agent
-  participant S as SMP server
-  participant N as NTF server
-  participant APN as APN
-
-  note over M, APN: register subscription
-
-  alt register existing
-    M -->> A: on /_ntf register, for subscribed queues
-  else create new connection
-    A -->> S: NEW / JOIN
-    note over A, S: ...<br>Connection handshake<br>...
-    S -->> A: CON
-  end
-  A ->> S: NKEY nKey
-  S ->> A: NID nId
-  A ->> N: SNEW tknId dhKey (smpServer, nId, nKey)
-  N ->> A: ID subId dhKey
-  N ->> S: NSUB nId
-  S ->> N: OK [/ NMSG]
-
-  note over M, APN: notify about message
-
-  S ->> N: NMSG
-  N ->> APN: APNSMutableContent<br>ntfQueue, nonce
-  APN ->> M: UNMutableNotificationContent
-  note over M, S: ...<br>Client awaken, message is received<br>...
-  S ->> M: message
-  note over M: mutate notification
-
-  note over M, APN: change APN token
-
-  APN ->> M: new device token
-  M -->> C: /_ntf_sub update tkn
-  C -->> A: updateNtfToken()
-  A -->> N: TUPD tknId newDeviceToken
-  note over M, N: ...<br>Verify token<br>...

protocol/diagrams/notifications/subscription.mmd

@@ -1,38 +0,0 @@
-sequenceDiagram
-  participant C as client app
-  participant A as agent
-  participant S as SMP server
-  participant N as NTF server
-  participant APN as APN
-
-  note over C, APN: register subscription
-
-  alt register existing
-    C -->> A: registerToken
-  else create new connection
-    A -->> S: create/joinConnection
-    note over A, S: ...<br>Connection handshake<br>...
-    S -->> A: CON
-  end
-  A ->> S: NKEY nKey
-  S ->> A: NID nId
-  A ->> N: SNEW tknId dhKey (smpServer, nId, nKey)
-  N ->> A: ID subId dhKey
-  N ->> S: NSUB nId
-  S ->> N: OK / NMSG:<br>confirm subscription
-
-  note over C, APN: notify about message
-
-  S ->> N: NMSG
-  N ->> APN: APNSMutableContent<br>ntfQueue, nonce
-  APN ->> C: UNMutableNotificationContent
-  note over C, S: ...<br>Client awaken, message is received<br>...
-  S ->> C: message
-  note over C: show notification
-
-  note over C, APN: change APN token
-
-  APN ->> C: new device token
-  C -->> A: updateToken()
-  A -->> N: TUPD tknId newDeviceToken
-  note over C, N: ...<br>Verify token<br>...

protocol/diagrams/simplex-messaging/simplex-creating-fast.mmd

@@ -1,23 +0,0 @@
-sequenceDiagram
-  participant B as Bob (sender)
-  participant S as server (queue RID)
-  participant A as Alice (recipient)
-
-  note over A: creating queue<br>("public" key RK<br>for msg retrieval)
-  A ->> S: 1. create queue ("NEW")
-  S ->> A: respond with queue RID and SID ("IDS")
-
-  note over A: out-of-band msg<br>(sender's queue SID<br>and "public" key EK<br>to encrypt msgs)
-  A -->> B: 2. send out-of-band message
-
-  note over B: secure queue<br>(with "public" key SK for<br>sending messages)
-  B ->> S: 3. confirm queue ("SKEY" command authorized with SK)
-
-  note over B: confirm queue<br>(public key<br>for e2e encryption<br>and any optional<br>encrypted info.)
-  B ->> S: 4. confirm queue ("SEND" command authorized with SK)
-
-  S ->> A: 5. deliver Bob's message (MSG)
-  note over A: decrypt message<br>("private" key EK)
-  A ->> S: acknowledge message (ACK)
-
-  note over S: 6. simplex<br>queue RID<br>is ready to use!

protocol/diagrams/simplex-messaging/simplex-creating.mmd

@@ -10,13 +10,11 @@ sequenceDiagram
   note over A: out-of-band msg<br>(sender's queue SID<br>and "public" key EK<br>to encrypt msgs)
   A -->> B: 2. send out-of-band message
 
-  note over B: confirm queue<br>("public" key SK for<br>sending messages,<br>public key for<br>e2e encryption<br>and any optional<br>encrypted info)
+  note over B: confirm queue<br>("public" key SK for<br>sending messages<br>and any optional<br>info encrypted with<br>"public" key EK)
   B ->> S: 3. confirm queue ("SEND" command not signed)
 
-  S ->> A: 4. deliver Bob's message (MSG)
+  S ->> A: 4. deliver Bob's message
   note over A: decrypt message<br>("private" key EK)
-  A ->> S: acknowledge message (ACK)
-
   A ->> S: 5. secure queue ("KEY", RK-signed)
 
   note over S: 6. simplex<br>queue RID<br>is ready to use!

protocol/diagrams/xftp/xftp-receiving-file.mmd

@@ -1,18 +0,0 @@
-sequenceDiagram
-  participant B as Bob (recipient)
-  participant S as XFTP server(s)
-
-  note over B: having received file description<br>from sender
-
-  loop for each chunk
-    B ->> S: 1a. download chunk ("FGET")
-    S ->> B: send chunk body ("FILE")
-
-    opt
-      B ->> S: 1b. acknowledge chunk reception ("FACK")
-      note over S: delete recipient ID
-      S ->> B: respond with ok ("OK")
-    end
-  end
-
-  note over B: 2. combine chunks into a file<br>3. decrypt file using key from file description<br>4. extract file name and unpad the file<br>5. validate file digest with the file description

protocol/diagrams/xftp/xftp-sending-file.mmd

@@ -1,23 +0,0 @@
-sequenceDiagram
-  participant A as Alice (sender)
-  participant S as XFTP server(s)
-  participant B as recipient(s)
-
-  note over A: 1. prepare file:<br>encrypt,<br>split into chunks,<br>generate recipient<br>keys, etc.
-
-  loop for each chunk
-    A ->> S: 2a. register chunk ("FNEW")
-    S ->> A: respond with sender's and recipients' chunk IDs ("SIDS")
-
-    opt
-      A ->> S: 2b. request additional recipient IDs ("FADD")
-      S ->> A: respond with added recipients' chunk IDs ("RIDS")
-    end
-
-    A ->> S: 2c. upload chunk to chosen server ("FPUT")
-    S ->> A: respond with ok ("OK")
-  end
-
-  note over A: 3. prepare file description(s)
-
-  A -->> B: 4. send file description(s) out-of-band

protocol/diagrams/xrcp/session.mmd

@@ -1,44 +0,0 @@
-sequenceDiagram
-  participant CI as Controller UI
-  participant CC as Controller Core
-  participant HC as Host Core
-  participant HI as Host UI
-
-note over CI, HI: 1. Session invitation
-CI->>CC: "Link a mobile"
-CC-->>CI: Session invitation URI
-note over CC: Listen for TCP connection
-activate CC
-HI->>HC: Session invitation URI
-
-note over CI, HI: 2. Establishing TLS connection
-HC-->>CC: TCP connect
-note over CC, HC: TLS handshake
-par
-    note over CC: validate client X509 credentials
-    CC->>CI: session code from tlsUnique
-    CI-->>CC: user confirmation
-and
-    note over HC: validate server X509 credentials
-    HC->>HI: session code from tlsUnique
-    HI-->>HC: user confirmation
-end
-
-note over CI, HI: 3. Session verification and protocol negotiation
-HC->>CC: host HELLO
-note over CC: validate version, CA fingerprint
-alt
-    CC-->>HC: controller ERROR
-else
-    CC-->>HC: controller HELLO
-    note over CC, HC: update stored keys
-end
-deactivate CC
-
-note over CI, HI: 4. Session operation
-loop
-    CI->>CC: command
-    CC->>HC: XRCP command
-    HC-->>CC: XRCP response
-    CC-->>CI: response
-end

protocol/overview-tjr.md

@@ -1,384 +0,0 @@
-Revision 2, 2024-06-22
-
-Evgeny Poberezkin
-
-# SimpleX: messaging and application platform
-
-## Table of contents
-
-- [Introduction](#introduction)
-  - [What is SimpleX](#what-is-simplex)
-  - [SimpleX objectives](#simplex-objectives)
-  - [In Comparison](#in-comparison)
-- [Technical Details](#technical-details)
-  - [Trust in Servers](#trust-in-servers)
-  - [Client -> Server Communication](#client---server-communication)
-  - [2-hop Onion Message Routing](#2-hop-onion-message-routing)
-  - [SimpleX Messaging Protocol](#simplex-messaging-protocol)
-  - [SimpleX Agents](#simplex-agents)
-  - [Encryption Primitives Used](#encryption-primitives-used)
-- [Threat model](#threat-model)
-- [Acknowledgements](#acknowledgements)
-
-
-## Introduction
-
-#### What is SimpleX
-
-SimpleX as a whole is a platform upon which applications can be built. [SimpleX Chat](https://github.com/simplex-chat/simplex-chat) is one such application that also serves as an example and reference application.
-
- - [SimpleX Messaging Protocol](./simplex-messaging.md) (SMP) is a protocol to send messages in one direction to a recipient, relying on a server in-between. The messages are delivered via uni-directional queues created by recipients.
- 
- - SMP protocol allows to send message via a SMP server playing proxy role using 2-hop onion routing (referred to as "private routing" in messaging clients) to protect transport information of the sender (IP address and session) from the server chosen (and possibly controlled) by the recipient.
-
- - SMP runs over a transport protocol (shown below as TLS) that provides integrity, server authentication, confidentiality, and transport channel binding.
-
- - A SimpleX Server is one of those servers.
-
- - The SimpleX Network is the term used for the collective of SimpleX Servers that facilitate SMP.
-
- - SimpleX Client libraries speak SMP to SimpleX Servers and provide a low-level API not generally intended to be used by applications.
-
- - SimpleX Agents interface with SimpleX Clients to provide a more high-level API intended to be used by applications. Typically they are embedded as libraries, but can also be abstracted into local services.
-
- - SimpleX Agents communicate with other agents inside e2e encrypted envelopes provided by SMP protocol - the syntax and semantics of the messages exchanged by the agent are defined by [SMP agent protocol](./agent-protocol.md)
-
-
-*Diagram showing the SimpleX Chat app, with logical layers of the chat application interfacing with a SimpleX Agent library, which in turn interfaces with a SimpleX Client library. The Client library in turn speaks the Messaging Protocol to a SimpleX Server.*
-
-```
-  User's Computer                 Internet                    Third-Party Server
-------------------     |   ----------------------     |   -------------------------
-                       |                              |
-   SimpleX Chat        |                              |
-                       |                              |
-+----------------+     |                              |
-|    Chat App    |     |                              |
-+----------------+     |                              |
-|  SimpleX Agent |     |                              |
-+----------------+    -------------- TLS ----------------    +----------------+
-| SimpleX Client | ------ SimpleX Messaging Protocol ------> | SimpleX Server |
-+----------------+    -----------------------------------    +----------------+
-                       |                              |
-```
-
-#### SimpleX objectives
-
-1. Provide messaging infrastructure for distributed applications. This infrastructure needs to have the following qualities:
-
-   - Security against passive and active (man-in-the-middle) attacks: the parties should have reliable end-to-end encryption and be able to detect the presence of an active attacker who modified, deleted or added messages.
-
-   - Privacy: protect against traffic correlation attacks to determine the contacts that the users communicate with.
-
-   - Reliability: the messages should be delivered even if some participating network servers or receiving clients fail, with “at least once” delivery guarantee.
-
-   - Integrity: the messages sent in one direction are ordered in a way that sender and recipient agree on; the recipient can detect when a message was removed or changed.
-
-   - Asynchronous delivery: it should not be required that both communicating parties (client devices, services or applications) are online for reliable message delivery.
-
-   - Low latency: the delay introduced by the network should not be higher than 100ms-1s in addition to the underlying TCP network latency.
-
-2. Provide better communication security and privacy than the alternative instant messaging solutions. In particular SimpleX provides better privacy of metadata (who talks to whom and when) and better security against active network attackers and malicious servers.
-
-3. Balance user experience with privacy requirements, prioritizing experience of mobile device users.
-
-
-#### In Comparison
-
-SimpleX network has a design similar to P2P networks, but unlike most P2P networks it consists of clients and servers without depending on any centralized component.
-In comparison to more traditional messaging applications (e.g. WhatsApp, Signal, Telegram) the key differences of SimpleX network are:
-
-- participants do not need to have globally unique addresses to communicate, instead they use redundant unidirectional (simplex) messaging queues, with a separate set of queues for each contact.
-
-- connection requests are passed out-of-band, non-optionally protecting key exchange against man-in-the-middle attack.
-
-- simple message queues provided by network servers are used by the clients to create more complex communication scenarios, such as duplex one-to-one communication, transmitting files, group communication without central servers, and content/communication channels.
-
-- servers do not store any user information (no user profiles or contacts, or messages once they are delivered), and primarily use in-memory persistence.
-
-- users can change servers with minimal disruption - even after an in-use server disappears, simply by changing the configuration on which servers the new queues are created.
-
-
-## Technical Details
-
-#### Trust in Servers
-
-Clients communicate directly with servers (but not with other clients) using SimpleX Messaging Protocol (SMP) running over some transport protocol that provides integrity, server authentication, confidentiality, and transport channel binding. By default, we assume this transport protocol is TLS.
-
-Users use multiple servers, and choose where to receive their messages. Accordingly, they send messages to their communication partners' chosen servers either directly, if this is a known/trusted server, or via another SMP server providing proxy functionality to protect IP address and session of the sender.
-
-Although end-to-end encryption is always present, users place a degree of trust in servers they connect to. This trust decision is very similar to a user's choice of email provider; however the trust placed in a SimpleX server is significantly less. Notably, there is no re-used identifier or credential between queues on the same (or different) servers. While a user *may* re-use a transport connection to fetch messages from multiple queues, or connect to a server from the same IP address, both are choices a user may opt into to break the promise of un-correlatable queues.
-
-Users may trust a server because:
-
-- They deploy and control the servers themselves from the available open-source code. This has the trade-offs of strong trust in the server but limited metadata obfuscation to a passive network observer. Techniques such as noise traffic, traffic mixing (incurring latency), and using an onion routing transport protocol can mitigate that.
-
-- They use servers from a trusted commercial provider. The more clients the provider has, the less metadata about the communication times is leaked to the network observers.
-
-By default, servers do not retain access logs, and permanently delete messages and queues when requested. Messages persist only in memory until they cross a threshold of time, typically on the order of days.[0] There is still a risk that a server maliciously records all queues and messages (even though encrypted) sent via the same transport connection to gain a partial knowledge of the user’s communications graph and other meta-data.
-
-SimpleX supports measures (managed transparently to the user at the agent level) to mitigate the trust placed in servers.  These include rotating the queues in use between users, noise traffic, supporting overlay networks such as Tor, and isolating traffic to different queues to different transport connections (and Tor circuits, if Tor is used).
-
-[0] While configurable by servers, a minimum value is enforced by the default software. SimpleX Agents can provide redundant routing over queues to mitigate against message loss.
-
-
-#### Client -> Server Communication
-
-Utilizing TLS grants the SimpleX Messaging Protocol (SMP) server authentication and metadata protection to a passive network observer. But SMP does not rely on the transport protocol for message confidentiality or client authentication. The SMP protocol itself provides end-to-end confidentiality, authentication, and integrity of messages between communicating parties.
-
-Servers have long-lived, self-signed, offline certificates whose hash is pre-shared with clients over secure channels - either provided with the client library or provided in the secure introduction between clients, as part of the server address.  The offline certificate signs an online certificate used in the transport protocol handshake. [0]
-
-If the transport protocol's confidentiality is broken, incoming and outgoing messages to the server cannot be correlated by message contents. Additionally, because of encryption at the SMP layer, impersonating the server is not sufficient to pass (and therefore correlate) a message from a sender to recipient - the only attack possible is to drop the messages. Only by additionally *compromising* the server can one pass and correlate messages.
-
-It's important to note that the SMP protocol does not do server authentication. Instead we rely upon the fact that an attacker who tricks the transport protocol into authenticating the server incorrectly cannot do anything with the SMP messages except drop them.
-
-After the connection is established, the client sends blocks of a fixed size 16KB, and the server replies with the blocks of the same size to reduce metadata observable to a network adversary. The protocol has been designed to make traffic correlation attacks difficult, adapting ideas from Tor, remailers, and more general onion and mix networks. It does not try to replace Tor though - SimpleX servers can be deployed as onion services and SimpleX clients can communicate with servers over Tor to further improve participants privacy.
-
-By using fixed-size blocks, oversized for the expected content, the vast majority of traffic is uniform in nature. When enough traffic is transiting a server simultaneously, the server acts as a low-latency mix node. We can't rely on this behavior to make a security claim, but we have engineered to take advantage of it when we can. As mentioned, this holds true even if the transport connection is compromised.
-
-The protocol does not protect against attacks targeted at particular users with known identities - e.g., if the attacker wants to prove that two known users are communicating, they can achieve it by observing their local traffic. At the same time, it substantially complicates large-scale traffic correlation, making determining the real user identities much less effective.
-
-[0] Future versions of SMP may add support for revocation lists of certificates, presently this risk is mitigated by the SMP protocol itself.
-
-
-#### 2-hop Onion Message Routing
-
-As SimpleX Messaging Protocol servers providing messaging queues are chosen by the recipients, in case senders connect to these servers directly the server owners (who potentially can be the recipients themselves) can learn senders' IP addresses (if Tor is not used) and which other queues on the same server are accessed by the user in the same transport connection (even if Tor is used).
-
-While the clients support isolating the messages sent to different queues into different transport connections (and Tor circuits), this is not practical, as it consumes additional traffic and system resources.
-
-To mitigate this problem SimpleX Messaging Protocol servers support 2-hop onion message routing when the SMP server chosen by the sender forwards the messages to the servers chosen by the recipients, thus protecting both the senders IP addresses and sessions, even if connection isolation and Tor are not used.
-
-The design of 2-hop onion message routing prevents these potential attacks:
-
-- MITM by proxy (SMP server that forwards the messages).
-
-- Identification by the proxy which and how many queues the sender sends messages to (as messages are additionally e2e encrypted between the sender and the destination SMP server).
-
-- Correlation of messages sent to different queues via the same user session (as random correlation IDs and keys are used for each message).
-
-See more details about 2-hop onion message routing design in [SimpleX Messaging Protocol](./simplex-messaging.md#proxying-sender-commands)
-
-Also see [Threat model](#threat-model)
-
-
-#### SimpleX Messaging Protocol
-
-SMP is initialized with an in-person or out-of-band introduction message, where Alice provides Bob with details of a server (including IP address or host name, port, and hash of the long-lived offline certificate), a queue ID, and Alice's public keys to agree e2e encryption. These introductions are similar to the PANDA key-exchange, in that if observed, the adversary can race to establish the communication channel instead of the intended participant. [0]
-
-Because queues are uni-directional, Bob provides an identically-formatted introduction message to Alice over Alice's now-established receiving queue.
-
-When setting up a queue, the server will create separate sender and recipient queue IDs (provided to Alice during set-up and Bob during initial connection). Additionally, during set-up Alice will perform a DH exchange with the server to agree upon a shared secret. This secret will be used to re-encrypt Bob's incoming message before Alice receives it, creating the anti-correlation property earlier-described should the transport encryption be compromised.
-
-[0] Users can additionally create public 'contact queues' that are only used to receive connection requests.  
-
-
-#### SimpleX Agents
-
-SimpleX agents provide higher-level operations compared to SimpleX Clients, who are primarily concerned with creating queues and communicating with servers using SMP.  Agent operations include:
-
-- Managing sets of bi-directional, redundant queues for communication partners
-
-- Providing end-to-end encryption of messages
-
-- Rotating queues periodically with communication partners
-
-- Noise traffic
-
-
-#### Encryption Primitives Used
-
-- Ed25519 or Curve25519 to authorize/verify commands to SMP servers (authorization algorithm is set via client/server configuration).
-- Curve25519 for DH exchange to agree:
-  - the shared secret between server and recipient (to encrypt message bodies - it avoids shared cipher-text in sender and recipient traffic)
-  - the shared secret between sender and recipient (to encrypt messages end-to-end in each queue - it avoids shared cipher-text in redundant queues).
-- [NaCl crypto_box](https://nacl.cr.yp.to/box.html) encryption scheme (curve25519xsalsa20poly1305) for message body encryption between server and recipient and for E2E per-queue encryption.
-- SHA256 to validate server offline certificates.
-- [double ratchet](https://signal.org/docs/specifications/doubleratchet/) protocol for end-to-end message encryption between the agents:
-  - Curve448 keys to agree shared secrets required for double ratchet initialization (using [X3DH](https://signal.org/docs/specifications/x3dh/) key agreement with 2 ephemeral keys for each side),
-  - AES-GCM AEAD cipher,
-  - SHA512-based HKDF for key derivation.
-
-
-## Threat Model
-
-#### Global Assumptions
-
- - A user protects their local database and key material.
- - The user's application is authentic, and no local malware is running.
- - The cryptographic primitives in use are not broken.
- - A user's choice of servers is not directly tied to their identity or otherwise represents distinguishing information about the user.
- - The user's client uses 2-hop onion message routing.
-
-#### A passive adversary able to monitor the traffic of one user
-
-*can:*
-
- - identify that and when a user is using SimpleX.
-
- - determine which servers the user receives the messages from.
-
- - observe how much traffic is being sent, and make guesses as to its purpose.
-
-*cannot:*
-
- - see who sends messages to the user and who the user sends the messages to.
-
- - determine the servers used by users' contacts.
-
-#### A passive adversary able to monitor a set of senders and recipients
-
- *can:*
-
- - identify who and when is using SimpleX.
-
- - learn which SimpleX Messaging Protocol servers are used as receive queues for which users.
-
- - learn when messages are sent and received.
-
- - perform traffic correlation attacks against senders and recipients and correlate senders and recipients within the monitored set, frustrated by the number of users on the servers.
-
- - observe how much traffic is being sent, and make guesses as to its purpose
-
-*cannot, even in case of a compromised transport protocol:*
-
- - perform traffic correlation attacks with any increase in efficiency over a non-compromised transport protocol
-
-#### SimpleX Messaging Protocol server
-
-*can:*
-
-- learn when a queue recipient is online
-
-- know how many messages are sent via the queue (although some may be noise or not content messages).
-
-- learn which messages would trigger notifications even if a user does not use [push notifications](./push-notifications.md).
-
-- perform the correlation of the queue used to receive messages (matching multiple queues to a single user) via either a re-used transport connection, user's IP Address, or connection timing regularities.
-
-- learn a recipient's IP address, track them through other IP addresses they use to access the same queue, and infer information (e.g. employer) based on the IP addresses, as long as Tor is not used.
-
-- drop all future messages inserted into a queue, detectable only over other, redundant queues.
-
-- lie about the state of a queue to the recipient and/or to the sender  (e.g. suspended or deleted when it is not).
-
-- spam a user with invalid messages.
-
-*cannot:*
-
-- undetectably add, duplicate, or corrupt individual messages.
-
-- undetectably drop individual messages, so long as a subsequent message is delivered.
-
-- learn the contents or type of messages.
-
-- distinguish noise messages from regular messages except via timing regularities.
-
-- compromise the users' end-to-end encryption with an active attack.
-
-- learn a sender's IP address, track them through other IP addresses they use to access the same queue, and infer information (e.g. employer) based on the IP addresses, even if Tor is not used (provided messages are sent via proxy SMP server).
-
-- perform senders' queue correlation (matching multiple queues to a single sender) via either a re-used transport connection, user's IP Address, or connection timing regularities, unless it has additional information from the proxy SMP server (provided messages are sent via proxy SMP server).
-
-#### SimpleX Messaging Protocol server that proxies the messages to another SMP server
-
-*can:*
-
-- learn a sender's IP address, as long as Tor is not used.
-
-- learn when a sender with a given IP address is online.
-
-- know how many messages are sent from a given IP address and to a given destination SMP server.
-
-- drop all messages from a given IP address or to a given destination server.
-
-- unless destination SMP server detects repeated public DH keys of senders, replay messages to a destination server within a single session, causing either duplicate message delivery (which will be detected and ignored by the receiving clients), or, when receiving client is not connected to SMP server, exhausting capacity of destination queues used within the session.
-
-*cannot:*
-
-- perform queue correlation (matching multiple queues to a single user), unless it has additional information from the destination SMP server.
-
-- undetectably add, duplicate, or corrupt individual messages.
-
-- undetectably drop individual messages, so long as a subsequent message is delivered.
-
-- learn the contents or type of messages.
-
-- learn which messages would trigger notifications.
-
-- learn the destination queues of messages.
-
-- distinguish noise messages from regular messages except via timing regularities.
-
-- compromise the user's end-to-end encryption with another user via an active attack.
-
-- compromise the user's end-to-end encryption with the destination SMP servers via an active attack.
-
-#### An attacker who obtained Alice's (decrypted) chat database
-
-*can:*
-
-- see the history of all messages exchanged by Alice with her communication partners.
-
-- see shared profiles of contacts and groups.
-
-- surreptitiously receive new messages sent to Alice via existing queues; until communication queues are rotated or the Double-Ratchet advances forward.
-
-- prevent Alice from receiving all new messages sent to her - either surreptitiously by emptying the queues regularly or overtly by deleting them.
-
-- send messages from the user to their contacts; recipients will detect it as soon as the user sends the next message, because the previous message hash won’t match (and potentially won’t be able to decrypt them in case they don’t keep the previous ratchet keys).
-
-*cannot:*
-
-- impersonate a sender and send messages to the user whose database was stolen. Doing so requires also compromising the server (to place the message in the queue, that is possible until the Double-Ratchet advances forward) or the user's device at a subsequent time (to place the message in the database).
-
-- undetectably communicate at the same time as Alice with her contacts. Doing so would result in the contact getting different messages with repeated IDs.
-
-- undetectably monitor message queues in realtime without alerting the user they are doing so, as a second subscription request unsubscribes the first and notifies the second.
-
-#### A user’s contact
-
-*can:*
-
-- spam the user with messages.
-
-- forever retain messages from the user.
-
-*cannot:*
-
-- cryptographically prove to a third-party that a message came from a user (assuming the user’s device is not seized).
-
-- prove that two contacts they have is the same user.
-
-- cannot collaborate with another of the user's contacts to confirm they are communicating with the same user.
-
-#### An attacker who observes Alice showing an introduction message to Bob
-
-*can:*
-
- - Impersonate Bob to Alice.
-
-*cannot:*
-
- - Impersonate Alice to Bob.
-
-#### An attacker with Internet access
-
-*can:*
-
-- Denial of Service SimpleX messaging servers.
-
-- spam a user's public “contact queue” with connection requests.
-
-*cannot:*
-
-- send messages to a user who they are not connected with.
-
-- enumerate queues on a SimpleX server.
-
-
-## Acknowledgements
-
-Efim Poberezkin contributed to the design and implementation of [SimpleX Messaging Protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/simplex-messaging.md) and [SimpleX Agent Protocol](https://github.com/simplex-chat/simplexmq/blob/master/protocol/agent-protocol.md) since 2019.
-
-Adam Langley's [Pond](https://github.com/agl/pond) inspired some of the recent improvements and the structure of this document.

protocol/overview.md

@@ -0,0 +1,259 @@
+# SimpleX: messaging and application network
+
+## Table of contents
+
+- [SimpleX objectives](#simplex-objectives)
+- [SimpleX network](#simplex-network)
+- [Threat model](#threat-model)
+
+## SimpleX objectives
+
+1. Provide messaging infrastructure for distributed applications. This infrastructure needs to have the following qualities:
+
+   - Security against passive and active (man-in-the-middle) attacks: the parties should have reliable end-to-end encryption and be able to identify and to some extent compensate for the presence of the active attacker who may modify, delete or add messages.
+  
+   - Privacy: network server operators should have no ability to read or modify messages without detection, and it should be impossible or hard to infer the contacts the users communicate with. Non-malicious network operators should retain no record of participants communications.
+  
+   - Reliability: the messages should be delivered even if some participating network servers or receiving clients fail, with “at least once” delivery guarantee.
+  
+   - Integrity: the messages should be delivered without alteration, in the same order, and any unauthorized message change should be detected by the recipient.
+  
+   - Asynchronous delivery: it should not be required that both communicating parties (client devices, services or applications) are online for reliable message delivery.
+  
+   - Low latency: the delay introduced by the network should not be higher than 100ms-1s in addition to the underlying TCP network latency.
+  
+2. Provide better communication privacy, in particular meta-data privacy (who talks to whom and when), and security, in particular security against active attacks, than the alternative instant messaging solutions.
+
+3. Balance user experience with privacy requirements, prioritizing experience of mobile device users.
+
+## SimpleX network
+
+### Overview
+
+SimpleX network provides asynchronous messaging infrastructure that aims to deliver on the above objectives and to avoid the disadvantages of the alternative solutions.
+
+The key differences of SimpleX network are:
+
+- participants do not need to have globally unique addresses to communicate, instead they use redundant unidirectional (simplex) messaging queues, with a separate set of queues for each contact.
+
+- connection requests are passed out-of-band, non-optionally protecting key exchange against man-in-the-middle attack.
+
+- message queues provided by network servers are used by the clients to create more complex communication scenarios, such as duplex one-to-one communication, transmitting files, group communication without central servers and content/communication channels (requiring a separate type of server to host them, which is out of scope of this document).
+
+- servers do not store any user information (no user profiles, contacts or messages, once they are delivered), and can use in-memory persistence only.
+
+- users can change server provider(s) without losing their communication contacts, simply by changing the configuration on which servers the new queues are created.
+
+SimpleX network has design similar to P2P networks, but unlike most P2P networks it consists of clients and servers, without dependency on any centralized component. Servers provide anonymous unidirectional message queues in order to:
+
+- continuously accept messages for the recipients, even when they are offline.
+
+- provide recipient anonymity, as the messaging queues do not identify the users, and different addresses of the same queue are used for senders and recipients to provide additional protection against server traffic correlation, in case transport connections are compromised.
+
+Coincidentally, SimpleX network reminds [Pond messenger](https://github.com/agl/pond) design, the main differences are:
+
+- Clients can receive messages via multiple servers (in Pond users use one home server and it serves as a user permanent address),
+
+- Clients do not need to poll servers to receive messages, the messages from subscribed queues are delivered via an open transport connection as they are received by the servers, resulting in low latency of message delivery.
+
+### SimpleX servers
+
+Clients communicate with servers (but not with other clients) using SimpleX Messaging Protocol (SMP) running over some transport protocol that provides server authentication, confidentiality with forward secrecy, integrity and transport channel binding (to prevent SMP commands replay).
+
+Users can use multiple servers. They choose the servers they use to receive the messages through, and they communicate with the servers chosen by the recipients to send messages.
+
+It is assumed that users have some degree of trust to the servers, for one of the following reasons:
+
+- They deploy and control the servers themselves from the available open-source code. The advantage of self-deployed servers is that users have full control of server information and activity, but the downside is that it is easier to correlate incoming and outgoing messages by observing server traffic, assuming small number of messages sent via user-hosted servers and irregular communication time. It can be mitigated by:
+
+  - sending noise traffic.
+
+  - future protocol versions can add configurable per queue message delivery delays (compromising on one of the design objectives of low latency).
+
+  - using SMP servers via an onion routing or mix network.
+
+- They use servers from the trusted commercial providers. The more clients the provider has, the less meta-data about the communication times is leaked to the network observers, and even if transport confidentiality is compromised it is not possible to correlate sent and received traffic without compromising the server, because the clients use different queue IDs to send and receive messages, and the message delivered to the recipient is additionally encrypted by the server.
+
+- To some extent, users trust their contacts and the servers they chose that the users send messages to. The client applications could further improve user trust to the servers chosen by their contacts by supporting either the list of servers that are “allowed to send to” or “prohibited to send to” (e.g., known trusted or compromised servers, certain IP ranges, server geographical locations etc.).
+
+If users use the free servers deployed by the volunteers, there is a risk that the server code can maliciously record all queues and messages (even though encrypted) sent via the same transport connection and to gain a partial knowledge of the user’s communications graph and other meta-data. User clients can mitigate it by using some overlay network that protects the privacy of TCP connections, e.g., Tor, and by sending noise traffic between the end users.
+
+The servers authorize users to access (send/receive/etc.) their message queues via a digital signature of transmissions using a unique key pair different for each queue sender and recipient, so no information that is required for the server to authorize users allows to aggregate user communications across multiple queues.
+
+### Transport
+
+SimpleX network does not rely on transport or overlay network for server or client authentication. SMP protocol itself must provide integrity, forward secure confidentiality of communicating parties and mutual authentication even if transport protocol (but not the server) is compromised by the active attacker.
+
+To protect against MITM attack on the transport, the clients should verify server self-signed certificate during TLS handshake by validating its pre-shared hash of the certificate in the server address (either as part of client configuration or passed in SMP connection request).
+
+Clients use TLS1.3 protocol to connect to the server, restricting supported cryptographic protocols as defined in SimpleX Messaging Protocol.
+
+After TCP transport connection is established, and the server is authenticated, the client sends blocks of a fixed size 16Kb, and the server replies with the blocks of the same size. When the actual message is smaller, it should be padded before encryption, and if it is larger, it can be split to chunks by the client application. The first blocks from the client and the server should include protocol version so that the party with the higher version can confirm compatibility and the transport channel identifier as described in SMP protocol.
+
+Client can terminate the server transport connection without losing any messages – removal of the message from the server and the delivery of the next message happens when the client acknowledges the message reception (normally, after it is persisted in the client’s database).
+
+Depending on the privacy requirements of the clients, the client can use a separate transport connection per queue, or receive messages from multiple queues via a single transport connection, for efficiency. In our implementations this configuration will be available to the end users.
+
+### Server implementation
+
+- does not store user access logs.
+
+- does not store messages after the client has received them.
+
+- permanently removes queues after they are deleted by the users
+
+- only stores messages in transit in server operating memory; as clients are expected to use multiple servers to deliver each message, the message loss in one of the servers is acceptable.
+
+### SimpleX clients and agents
+
+Clients are assumed to be running on the trusted devices and can use the locally encrypted storage for messages, contacts, groups and other resources.
+
+SimpleX clients implementing application-level protocols communicate with SimpleX servers via agents. SimpleX agents can be accessed in one of the following ways:
+
+- via TCP network using trusted network connection or an overlay transport network.
+
+- via local port (when the agent runs on the same device as a separate process).
+
+- via agent library, when the agent logic is included directly into the client application.
+
+The last option is the most secure, as it reduces the number of attack vectors in comparison with other options. The current implementation of SimpleX Chat uses this approach.
+
+SimpleX agents provide the following operations:
+
+- Creating and managing bi-directional (duplex) client connections and delivering messages via redundant groups of SimpleX queues.
+
+- Exchanging keys and providing end-to-end encryption. The current prototype uses RSA cryptography with ad-hoc hybrid encryption scheme, we are currently switching it to X3DH for key exchange and double ratchet protocol for E2E encryption.
+
+Communication between the client and the agent and the communication between the agents (via end-to-end encrypted messages delivered via SMP protocol) is described by SimpleX Agent Protocol.
+
+Bi-directional client connections consist of multiple “send” and multiple “receive” queues (for redundancy) that agents use to send and receive messages; each queue should be used for limited amount of time, the rotation of queues is negotiated using SimpleX Agent Protocol.
+
+There are two ways that SimpleX network users can establish the connection:
+
+- Users communicate the initial connection invitation out-of-band, via link or via QR code. This out-of-band communication is assumed secure against active attacks and insecure against passive attacks. Once the connection is established that users are assumed to have confirmed out-of-band, the connection can no longer be compromised even if out-of-band invitation was obtained by the attacker. This out-of-band invitation does not contain any personal information, only the address of the queue and public key for the key exchange for end-to-end encryption.
+
+- Users can create a “contact queue(s)” on SMP servers that would be used to receive connection requests. The important distinction with commonly used addressing systems is that this queue is only used to pass the connection request and not for subsequent messages. So, while it is possible to spam users who created such contact queues with connection requests, they can be removed without disrupting the communication with the existing contacts.
+
+The reply queue addresses and the key exchange for the reply queues is negotiated via the direct queue.
+
+### Message encryption
+
+Messages are encrypted end-to-end using double ratchet protocol. Once the sending client deletes messages it won’t be able to decrypt them again. While messages are numbered within the queue, this only reveals to the servers how messages have been exchanged in a given queue that has a limited lifetime, so the total number of messages exchanged between contacts is not revealed.
+
+The next queue to use is negotiated between agents in encrypted messages, and in most cases, it will be on another server (unless the client is configured to use one server, which is not recommended).
+
+### Client storage
+
+It is assumed that the client device and the storage is trusted, but clients can implement storage encryption using a user-provided passphrase.
+
+## Threat model
+
+### Assumptions
+
+User protects their information and keys.
+
+SimpleX Chat software is authentic.
+
+User device is not compromised, excluding the scenarios below where it is explicitly stated it is compromised.
+
+Used cryptographic primitives are not compromised.
+
+### SimpleX Messaging Protocol server
+
+**can:**
+
+- learn when a queue recipient or sender is online via transmission times.
+
+- correlate multiple queues to a single user in case they are accessed via the same transport connection or from the same IP address.
+
+- correlate multiple queues to a single user based on the time they are accessed. Clients that use message notification servers can mitigate it by only subscribing to the queues after they receive the notifications and disconnecting after some time of inactivity.
+
+- know how many messages is sent via the queue, clients can mitigate it with noise traffic.
+
+- add, drop, duplicate or corrupt messages, but it will be detected by the client on SimpleX Agent Protocol level. Using multiple servers to deliver each message mitigates the loss of messages.
+
+**cannot:**
+
+- decrypt messages
+
+- compromise e2e encryption with MITM attack (as server is only used to pass one of two keys in DH exchange, the first key is passed out-of-band)
+
+### A global passive adversary monitoring all Internet traffic
+
+**can:**
+
+- learn who is using SimpleX Chat.
+
+- learn when messages are sent and received.
+
+- learn which SimpleX Messaging Protocol servers are used.
+
+- in case of low traffic on the servers, correlate senders and recipients by the time messages sent and received.
+
+- observe the approximate size of the files transmitted – to O(log log M) of file size precision.
+
+**cannot, even in case of compromised transport protocol:**
+
+- correlate senders and recipients by the content of messages (as different queue IDs are used for senders and recipients, with additional encryption layer in the delivered messages).
+
+### A local network attacker
+
+**can:**
+
+- observe when a user is using SimpleX Chat.
+
+- block SimpleX Chat traffic.
+
+- determine which servers the user communicates with.
+
+- observe the approximate size of files transmissions and receptions.
+
+**cannot:**
+
+- see who sends messages to the user and who the user sends the messages to
+
+### An attacker who obtained user’s decrypted chat database
+
+**can:**
+
+- see the history of all messages
+
+- see shared profiles of contacts and groups
+
+- receive new user messages, but the user will detect it as the number and the hash of the previous message won’t match. Also, they will be instantly alerted that an unknown device is connected to their message queues, as long as they are online at the same time, as message queues only allow one active subscription.
+
+- delete user’s message queues, so the contacts won’t be able to send messages.
+
+- send messages from the user to their contacts, but the recipients will detect it as soon as the user sends the next message, because the previous message hash won’t match (and potentially won’t be able to decrypt them in case they don’t keep the previous ratchet keys).
+
+**cannot:**
+
+- impersonate a sender and send messages to the user whose database was stolen without also compromising the server (to place the message in the queue) or the user's device at a subsequent time (to place the message in the database).
+
+### A user’s contact
+
+**can:**
+
+- spam the user with messages.
+
+- forever retain messages from the user.
+
+**cannot:**
+
+- prove to a third-party that a message came from a user (assuming a user’s device is not seized)
+
+- prove that two contacts they have is the same user.
+
+- two contacts cannot confirm if they are communicating with the same user.
+
+### An attacker with Internet access
+
+**can:**
+
+- DoS SimpleX messaging servers.
+
+- spam the user who created a “contact queue” (queue for accepting connection requests) by sending multiple connection requests.
+
+**cannot:**
+
+- send messages to the user who they are not connected with.

protocol/pqdr.md

@@ -1,222 +0,0 @@
-Version 1, 2024-06-22
-
-# Post-quantum resistant augmented double ratchet algorithm (PQDR)
-
-## Table of contents
-
-- [Overview](#overview)
-- [Comparison with the other approaches](#comparison-with-the-other-approaches)
-  - [PQXDH for post-quantum key agreement](#pqxdh-for-post-quantum-key-agreement) (Signal)
-  - [Hybrid Signal protocol for post-quantum encryption](#hybrid-signal-protocol-for-post-quantum-encryption) (Tutanota)
-- [Augmented double ratchet algorithm](#augmented-double-ratchet-algorithm)
-- [Double ratchet with encrypted headers augmented with double PQ KEM](#double-ratchet-with-encrypted-headers-augmented-with-double-pq-kem)
-  - [Initialization](#initialization)
-  - [Encrypting messages](#encrypting-messages)
-  - [Decrypting messages](#decrypting-messages)
-- [Implementation considerations](#implementation-considerations)
-- [Chosen KEM algorithm](#chosen-kem-algorithm)
-- [Summary](#summary)
-
-## Overview
-
-It is a reasonable assumption that "record-now-decrypt-later" attacks are ongoing, so the users want to use cryptographic schemes for end-to-end encryption that are augmented with some post-quantum algorithm that is believed to be resistant to quantum computers.
-
-SimpleX Chat uses [double-ratchet with header encryption](https://signal.org/docs/specifications/doubleratchet/#double-ratchet-with-header-encryption) to provide end-to-end encryption to messages and files. This document describes augmented algorithm with post-quantum key encapsulation mechanism (KEM) making it resistant to quantum computers.
-
-Double-ratchet algorithm is a state of the art solution for end to end encryption offering a set of qualities that is not present in any other algorithm:
-
-- perfect forward secrecy, i.e. compromise of session or long term keys does not lead to the ability to decrypt any of the past messages.
-- deniability (also known as repudiation), i.e. the fact that the recipient of the message while having the proof of message authenticity, cannot prove to a third party that the sender actually sent this message.
-- break-in recovery (also know as post-compromise security or future secrecy), i.e. the ability of the end-to-end encryption security to recover from the compromise of the long term keys. This is achieved by generating a new random key pair whenever a new DH key is received (DH ratchet step).
-
-It is desirable to preserve all these qualities when augmenting the algorithm with a post-quantum algorithm, and having these qualities resistant to both conventional and quantum computers.
-
-## Comparison with the other approaches
-
-### PQXDH for post-quantum key agreement
-
-[The solution](https://signal.org/docs/specifications/pqxdh/) recently [introduced by Signal](https://signal.org/blog/pqxdh/) augments the initial key agreement ([X3DH](https://signal.org/docs/specifications/x3dh/)) that is made prior to double ratchet algorithm. This is believed to provide protection from "record-now-decrypt-later" attack, but if the attacker at any point obtains long term keys from any of the devices, the break-in recovery will not be post-quantum resistant, and the attacker with quantum computer will be able to decrypt all the subsequent messages.
-
-### Hybrid Signal protocol for post-quantum encryption
-
-[The solution](https://eprint.iacr.org/2021/875.pdf) [proposed by Tutanota](https://tutanota.com/blog/posts/pqmail-update/) aims to preserve the break-in recovery property of double ratchet, but in doing so it:
-- replaces rather than augments DH key agreement with post-quantum KEM mechanism, making it potentially vulnerable to conventional computers.
-- adds signature to the DH ratchet step, to compensate for not keeping DH key agreement, but losing the deniability property for some of the messages.
-
-## Augmented double ratchet algorithm
-
-The double ratchet algorithm is augmented with post-quantum KEM mechanism, preserving all properties of the double ratchet algorithm.
-
-It is possible, because although double ratchet uses DH (which is a non-interactive key exchanges), it uses it "interactively", when the new DH keys are generated by both parties in turns. Parties of double-ratchet encrypted communication can run two post-quantum key encapsulation mechanisms in parallel with both DH and KEM key agreements in each DH ratchet step, making break-in recovery of double ratchet algorithm post-quantum resistant, without losing deniability or resistance to conventional computers.
-
-Specifically, [double ratchet with encrypted headers](https://signal.org/docs/specifications/doubleratchet/#double-ratchet-with-header-encryption) is augmented with some post-quantum key encapsulation mechanism (KEM) as described below. A possible algorithm for PQ KEM is [NTRU-prime](https://ntruprime.cr.yp.to), that is currently adopted in SSH and has available implementations. It is important though that the proposed scheme can be used with any PQ KEM algorithm.
-
-The downside of the scheme is its substantial size overhead, as the encapsulation key and encapsulated shared secret are added to the header of each message. For the algorithm described below NTRU-prime adds ~2-4kb to each message (depending on the key size and the chosen variant). See [this table](https://ntruprime.cr.yp.to/security.html) for key and ciphertext sizes and the assessment of the security level for various key sizes.
-
-It is possible to reduce size overhead by using only one KEM agreement and making only one of two ratchet steps providing post-quantum resistant break-in recovery.
-
-## Double ratchet with encrypted headers augmented with double PQ KEM
-
-Algorithm below assumes that in addition to shared secret from the initial key agreement, there will be an encapsulation key available from the party that published its keys (Bob).
-
-### Initialization
-
-The double ratchet initialization is defined in pseudo-code. This pseudo-code is identical to Signal algorithm specification except for that parts that add post-quantum key agreement.
-
-```
-// Alice obtained Bob's keys and initializes ratchet first
-def RatchetInitAlicePQ2HE(state, SK, bob_dh_public_key, shared_hka, shared_nhkb, bob_pq_kem_encapsulation_key):
-    state.DHRs = GENERATE_DH()
-    state.DHRr = bob_dh_public_key
-    // below added for post-quantum KEM
-    state.PQRs = GENERATE_PQKEM()
-    state.PQRr = bob_pq_kem_encapsulation_key
-    state.PQRss = random // shared secret for KEM
-    state.PQRct = PQKEM-ENC(state.PQRr, state.PQRss) // encapsulated additional shared secret
-    // above added for KEM
-    // the next line augments DH key agreement with PQ shared secret
-    state.RK, state.CKs, state.NHKs = KDF_RK_HE(SK, DH(state.DHRs, state.DHRr) || state.PQRss) 
-    state.CKr = None
-    state.Ns = 0
-    state.Nr = 0
-    state.PN = 0
-    state.MKSKIPPED = {}
-    state.HKs = shared_hka
-    state.HKr = None
-    state.NHKr = shared_nhkb
-
-// Bob initializes ratchet second, having received Alice's connection request
-def RatchetInitBobPQ2HE(state, SK, bob_dh_key_pair, shared_hka, shared_nhkb, bob_pq_kem_key_pair):
-    state.DHRs = bob_dh_key_pair
-    state.DHRr = None
-    // below added for KEM
-    state.PQRs = bob_pq_kem_key_pair
-    state.PQRr = None
-    state.PQRss = None
-    state.PQRct = None
-    // above added for KEM
-    state.RK = SK 
-    state.CKs = None
-    state.CKr = None
-    state.Ns = 0
-    state.Nr = 0
-    state.PN = 0
-    state.MKSKIPPED = {}
-    state.HKs = None
-    state.NHKs = shared_nhkb
-    state.HKr = None
-    state.NHKr = shared_hka
-```
-
-`GENERATE_PQKEM` generates decapsulation/encapsulation key pair.
-
-`PQKEM-ENC` is key encapsulation algorithm.
-
-Other than commented lines, the above adds parameters `bob_pq_kem_encapsulation_key` and `bob_pq_kem_key_pair` to the ratchet initialization. Otherwise it is identical to the original double ratchet initialization.
-
-### Encrypting messages
-
-```
-def RatchetEncryptPQ2HE(state, plaintext, AD):
-    state.CKs, mk = KDF_CK(state.CKs)
-    // encapsulation key from PQRs and encapsulated shared secret is added to header
-    header = HEADER_PQ2(
-      dh = state.DHRs.public,
-      kem = state.PQRs.public, // added for KEM #2
-      ct = state.PQRct // added for KEM #1
-      pn = state.PN,
-      n = state.Ns,
-    )
-    enc_header = HENCRYPT(state.HKs, header)
-    state.Ns += 1
-    return enc_header, ENCRYPT(mk, plaintext, CONCAT(AD, enc_header))
-```
-
-Other than adding encapsulation key and encapsulated shared secret into the header, the above is identical to the original double ratchet message encryption step.
-
-### Decrypting messages
-
-```
-def RatchetDecryptPQ2HE(state, enc_header, ciphertext, AD):
-    plaintext = TrySkippedMessageKeysHE(state, enc_header, ciphertext, AD)
-    if plaintext != None:
-        return plaintext
-    header, dh_ratchet = DecryptHeader(state, enc_header) // DecryptHeader is the same as in double ratchet specification
-    if dh_ratchet:
-        SkipMessageKeysHE(state, header.pn) // SkipMessageKeysHE is the same as in double ratchet specification
-        DHRatchetPQ2HE(state, header)
-    SkipMessageKeysHE(state, header.n)
-    state.CKr, mk = KDF_CK(state.CKr)
-    state.Nr += 1
-    return DECRYPT(mk, ciphertext, CONCAT(AD, enc_header))
-
-// DecryptHeader is the same as in double ratchet specification
-def DecryptHeader(state, enc_header):
-    header = HDECRYPT(state.HKr, enc_header)
-    if header != None:
-        return header, False
-    header = HDECRYPT(state.NHKr, enc_header)
-    if header != None:
-        return header, True
-    raise Error()
-
-def DHRatchetPQ2HE(state, header):
-    state.PN = state.Ns
-    state.Ns = 0
-    state.Nr = 0
-    state.HKs = state.NHKs
-    state.HKr = state.NHKr
-    state.DHRr = header.dh
-    // save new encapsulation key from header
-    state.PQRr = header.kem
-    // decapsulate shared secret from header - KEM #2
-    ss = PQKEM-DEC(state.PQRs.private, header.ct)
-    // use decapsulated shared secret with receiving ratchet
-    state.RK, state.CKr, state.NHKr = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr) || ss)
-    state.DHRs = GENERATE_DH()
-    // below is added for KEM
-    state.PQRs = GENERATE_PQKEM() // generate new PQ key pair
-    state.PQRss = random // shared secret for KEM
-    state.PQRct = PQKEM-ENC(state.PQRr, state.PQRss) // encapsulated additional shared secret KEM #1
-    // above is added for KEM
-    // use new shared secret with sending ratchet
-    state.RK, state.CKs, state.NHKs = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr) || state.PQRss)
-```
-
-`PQKEM-DEC` is key decapsulation algorithm.
-
-`DHRatchetPQ2HE` augments both DH agreements with decapsulated shared secret from the received header and with the new shared secret, respectively. The new shared secret together with the new encapsulation key are saved in the state and will be added to the header in the next sent message.
-
-Other than augmenting DH key agreements with the shared secrets from KEM, the above is identical to the original double ratchet DH ratchet step.
-
-It is worth noting that while DH agreements work as ping-pong, when the new received DH key is used for both DH agreements (and only the sent DH key is updated for the second DH key agreement), PQ KEM agreements in the proposed scheme work as a "parallel ping-pong", with two balls in play all the time (two KEM agreements run in parallel).
-
-## Implementation considerations for SimpleX Messaging Protocol
-
-As SimpleX Messaging Protocol pads messages to a fixed size, using 16kb transport blocks, the size increase introduced by this scheme can be compensated for by using ZSTD encryption of JSON bodies and image previews encoded as base64. While there may be some rare cases of random texts that would fail to compress, in all real scenarios it would not cause the message size reduction.
-
-Sharing the initial keys in case of SimpleX Chat it is equivalent to sharing the invitation link. As encapsulation key is large, it may be inconvenient to share it in the link in some contexts, e.g. when QR codes are used.
-
-It is possible to postpone sharing the encapsulation key until the first message from Alice (confirmation message in SMP protocol), the party sending connection request. The upside here is that the invitation link size would not increase. The downside is that the user profile shared in this confirmation will not be encrypted with PQ-resistant algorithm.
-
-Another consideration is pairwise ratchets in groups. Key generation in sntrup761 is quite slow - on slow devices it can be as slow as 10-20 keys per second, so using this primitive in groups larger than 10-20 members would result in slow performance.
-
-For backward compatibility the implementation must support adding PQ-resistant key agreement to the existing connections.
-
-It is also beneficial to support removing PQ-resistant key agreement from the connections that have them, e.g. as the group size grows.
-
-### Chosen KEM algorithm
-
-The implementation uses Streamlined NTRU-Prime 761 (sntrup761) that was also used for OpenSSH for a long time.
-
-It was chosen over ML-KEM (Kyber) standardized by NIST for several reasons:
-
-- sntrup761 was used in OpenSSH for a long period of time.
-- ML-KEM standardization process raised [concerns](https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/WFRDl8DqYQ4) [amongst](https://blog.cr.yp.to/20231003-countcorrectly.html) the experts.
-- ML-KEM (if modified) is likely to have conflicts with the existing patents, unlike sntrup761.
-
-It was chosen over non-interactive CTIDH due to its slower implementation, and lack of optimized code for aarch64 CPUs used in mobile devices.
-
-## Summary
-
-If chosen PQ KEM proves secure against quantum computer attacks, then the proposed augmented double ratchet will also be secure against quantum computer attack, including break-in recovery property, while keeping deniability and forward secrecy, because the [same proof](https://eprint.iacr.org/2016/1013.pdf) as for double ratchet algorithm would hold here, provided chosen KEM is secure.

protocol/push-notifications.md

@@ -1,398 +0,0 @@
-Version 2, 2024-06-22
-
-# Overview of push notifications for SimpleX Messaging Servers
-
-## Table of contents
-
-- [Introduction](#introduction)
-- [Participating servers](#participating-servers)
-- [Register device token to receive push notifications](#register-device-token-to-receive-push-notifications)
-- [Subscribe to connection notifications](#subscribe-to-connection-notifications)
-- [SimpleX Notification Server protocol](#simplex-notification-server-protocol)
-  - [Register new notification token](#register-new-notification-token)
-  - [Verify notification token](#verify-notification-token)
-  - [Check notification token status](#check-notification-token-status)
-  - [Replace notification token](#replace-notification-token)
-  - [Delete notification token](#delete-notification-token)
-  - [Subscribe to periodic notifications](#subscribe-to-periodic-notifications)
-  - [Create SMP message notification subscription](#create-smp-message-notification-subscription)
-  - [Check notification subscription status](#check-notification-subscription-status)
-  - [Delete notification subscription](#delete-notification-subscription)
-  - [Error responses](#error-responses)
-- [Threat model](#threat-model)
-
-## Introduction
-
-SimpleX Messaging servers already operate as push servers and deliver the messages to subscribed clients as soon as they are sent to the servers.
-
-The reason for push notifications is to support instant message notifications on iOS that does not allow background services.
-
-## Participating servers
-
-The diagram below shows which servers participate in message notification delivery.
-
-While push provider (e.g., APN) can learn how many notifications are delivered to the user, it cannot access message content, even encrypted, or any message metadata - the notifications are e2e encrypted between SimpleX Notification Server and the user's device.
-
-```
-  User's iOS device                Internet                           Servers
----------------------   .   ------------------------   .   -----------------------------
-                        .                              .
-                        .                              .       can be self-hosted now
-+--------------+        .                              .         +----------------+
-| SimpleX Chat |       -------------- TLS ---------------        | SimpleX        |
-|    client    |------> SimpleX Messaging Protocol (SMP) ------> | Messaging      |
-+--------------+       ----------------------------------        | Server         |
-     ^    |             .                              .         +----------------+
-     |    |             .                              .          . . .  |   . . .
-     |    |             .                              .               | V |
-     |    |             .                              .               |SMP| TLS
-     |    |             .                              .               | | |               SimpleX
-     |    |             .                              .          . . .  V   . . .      NTF Server
-     |    |             .                              .       +----------------------------------+
-     |    |             .                              .       | +---------------+                |
-     |    |            -------------- TLS ---------------      | | SimpleX       | can be         | 
-     |    |----------->   Notification Server Protocol  -----> | | Notifications | self-hosted    |
-     |                 ----------------------------------      | | Subscriber    | in the future  |
-     |                  .                              .       | +---------------+                |
-     |                  .                              .       |         |                        |
-     |                  .                              .       |         V                        |
-     |                  .                              .       | +---------------+                |
-     |                  .                              .       | | SimpleX       |                |
-     |                  .                              .       | | Push          |                |
-     |                  .                              .       | | Server        |                |
-     |                  .                              .       | +---------------+                |
-     |                  .                              .       +----------------------------------+
-     |                  .                              .          . . .  |   . . .
-     |                  .                              .               | V |
-     |                  .                              .               |SMP| TLS
-     |                  .                              .               | | |
-     |                  .                              .          . . .  V   . . .
-     |                 -------------- TLS ---------------       +-----------------+
-     |-----------------       Notification delivery     <-------| Apple PN server |
-                       ----------------------------------       +-----------------+
-                        .                              .
-```
-
-## Register device token to receive push notifications
-
-This diagram shows the process of registering a device to receive PUSH notifications via Apple Push Notification (APN) servers.
-
-![Register device notification token](./diagrams/notifications/register-token.svg)
-
-## Subscribe to connection notifications
-
-This diagram shows the process of subscription to notifications, notification delivery and device token update.
-
-![Subscribe to notifications](./diagrams/notifications/subscription.svg)
-
-## SimpleX Notification Server protocol
-
-To manage notification subscriptions to SMP servers, SimpleX Notification Server provides an RPC protocol with a similar design to SimpleX Messaging Protocol server.
-
-This protocol sends requests and responses in a fixed size blocks of 512 bytes over TLS, uses the same [syntax of protocol transmissions](./simplex-messaging.md#smp-transmission-and-transport-block-structure) as SMP protocol, and has the same transport [handshake syntax](./simplex-messaging.md#transport-handshake) (except the server certificate is not included in the handshake).
-
-Protocol commands have this syntax:
-
-```
-ntfServerTransmission = 
-ntfServerCmd = newTokenCmd / verifyTokenCmd / checkTokenCmd /
-               replaceTokenCmd / deleteTokenCmd / cronCmd /
-               newSubCmd / checkSubCmd / deleteSubCmd
-```
-### Register new notification token
-
-This command should be used after the client app obtains a token from push notifications provider to register the token with the server.
-
-Having received this command the server will deliver a test notification via the push provider to validate that the client has this token.
-
-The command syntax:
-
-```abnf
-newTokenCmd = %s"TNEW" SP newToken
-newToken = %s"T" deviceToken authPubKey clientDhPubKey
-deviceToken = pushProvider tokenString
-pushProvider = apnsDev / apnsProd / apnsNull
-apnsDev = "AD" ; APNS token for development environment
-apnsProd = "AP" ; APNS token for production environment
-apnsNull = "AN" ; token that does not trigger any notification delivery - used for server testing
-tokenString = shortString
-authPubKey = length x509encoded ; Ed25519 key used to verify clients commands
-clientDhPubKey = length x509encoded ; X25519 key to agree e2e encryption between the server and client
-shortString = length *OCTET
-length = 1*1 OCTET
-```
-
-The server response syntax:
-
-```abnf
-tokenIdResp = %s"IDTKN" SP entityId serverDhPubKey
-entityId = shortString
-serverDhPubKey = length x509encoded ; X25519 key to agree e2e encryption between the server and client
-```
-
-### Verify notification token
-
-This command is used to verify the token after the device receives the test notification from the push provider.
-
-The command syntax:
-
-```abnf
-verifyTokenCmd = %s"TVFY" SP regCode
-regCode = shortString
-```
-
-The response to this command is `okResp` or `errorResp`
-
-```abnf
-okResp = %s"OK"
-```
-
-### Check notification token status
-
-This command is used to check the token status:
-
-```abnf
-checkTokenCmd = %s"TCHK"
-```
-
-The response to this command:
-
-```abnf
-tokenStatusResp = %s"TKN" SP tokenStatus
-tokenStatus = %s"NEW" / %s"REGISTERED" / %s"INVALID" / %s"CONFIRMED" / %s"ACTIVE" / %s"EXPIRED"
-```
-
-### Replace notification token
-
-This command should be used when push provider issues a new notification token.
-
-It happens when:
-- the app data is migrated to another device.
-- the app is re-installed on the same device.
-- can happen periodically, at push provider discretion.
-
-This command allows to replace the token without re-registering and re-subscribing all notification subscriptions.
-
-Using this command triggers the same verification flow as registering a new token.
-
-The command syntax:
-
-```abnf
-replaceTokenCmd = %s"TRPL" SP deviceToken
-```
-
-The response to this command is `okResp` or `errorResp`.
-
-### Delete notification token
-
-The command syntax:
-
-```abnf
-deleteTokenCmd = %s"TDEL"
-```
-
-The response to this command is `okResp` or `errorResp`.
-
-After this command all message notification subscriptions will be removed and no more notifications will be sent.
-
-### Subscribe to periodic notifications
-
-This command enables or disables periodic notifications sent to the client device irrespective of message notifications.
-
-This is useful for two reasons:
-- it provides better privacy from notification server, as while the server learns the device token, it doesn't learn anything else about user communications.
-- it allows to receive messages when notifications were dropped by push provider, e.g. while the device was offline, or lost by notification server, e.g. while it was restarting.
-
-The command syntax:
-
-```abnf
-cronCmd = %s"TCRN" SP interval
-interval = 2*2 OCTET ; Word16, minutes
-```
-
-The interval for periodic notifications is set in minutes, with the minimum of 20 minutes. The client should pass `0` to disable periodic notifications.
-
-### Create SMP message notification subscription
-
-This command makes notification server subscribe to message notifications from SMP server and to deliver them to push provider:
-
-```abnf
-newSubCmd = %s"SNEW" newSub
-newSub = %s "S" tokenId smpServer notifierId notifierKey
-tokenId = shortString ; returned in response to `TNEW` command
-smpServer = smpServer = hosts port fingerprint
-hosts = length 1*host
-host = shortString
-port = shortString
-fingerprint = shortString
-notifierId = shortString ; returned by SMP server in response to `NKEY` SMP command
-notifierKey = length x509encoded ; private key used to authorize requests to subscribe to message notifications
-```
-
-The response syntax:
-
-```abnf
-subIdResp = %s"IDSUB" SP entityId
-```
-
-### Check notification subscription status
-
-This command syntax:
-
-```abnf
-checkSubCmd = %s"SCHK"
-```
-
-The response:
-
-```abnf
-subStatusResp = %s"SUB" SP subStatus
-subStatus = %s"NEW" / %s"PENDING" / ; e.g., after SMP server disconnect/timeout while ntf server is retrying to connect
-            %s"ACTIVE" / %s"INACTIVE" / %s"END" / ; if another server subscribed to notifications
-            %s"AUTH" / subErrStatus
-subErrStatus = %s"ERR" SP shortString
-```
-
-### Delete notification subscription
-
-The command syntax:
-
-```abnf
-deleteSubCmd = %s"SDEL"
-```
-
-The response to this command is `okResp` or `errorResp`.
-
-After this command no more message notifications will be sent from this queue.
-
-### Error responses
-
-All commands can return error response:
-
-```abnf
-errorResp = %s"ERR" SP errorType
-```
-
-Where `errorType` has the same syntax as in [SimpleX Messaging Protocol](./simplex-messaging.md#error-responses)
-
-## Threat Model
-
-This threat model compliments SimpleX Messaging Protocol [threat model](./overview-tjr.md#threat-model)
-
-#### A passive adversary able to monitor the traffic of one user
-
-*can:*
-
- - identify that and a user is using SimpleX push notifications.
-
-*cannot:*
-
- - determine which servers a user subscribed to the notifications from.
-
-#### A passive adversary able to monitor a set of senders and recipients
-
- *can:*
-
- - perform more efficient traffic correlation attacks against senders and recipients and correlate senders and recipients within the monitored set, frustrated by the number of users on the servers.
-
-#### SimpleX Messaging Protocol server
-
-*can:*
-
-- learn which messages trigger push notifications.
-
-- learn IP address of SimpleX notification servers used by the user.
-
-- drop message notifications.
-
-- spam a user with invalid notifications.
-
-*cannot:*
-
-- learn user device token for push notifications.
-
-- learn which queues belong to the same users with any additional efficiency compared with not using push notifications.
-
-#### SimpleX Notification Server subscribed to message notifications
-
-*can:*
-
-- learn a user device token.
-
-- learn how many messaging queues and servers a user receives messages from.
-
-- learn how many message notifications are delivered to the user from each queue.
-
-- undetectably drop notifications.
-
-- spam a user with background notifications.
-
-*cannot:*
-
-- learn queue addresses for receiving or sending messages.
-
-- learn the contents or type of messages (not even encrypted).
-
-- learn anything about messages sent without notification flag.
-
-- spam a user with visible notifications (provided the client app can filter push notifications).
-
-- add, duplicate, or corrupt individual messages that will be shown to the user.
-
-#### SimpleX Notification Server subscribed ONLY to periodic notifications
-
-*can:*
-
-- learn a user device token.
-
-- drop periodic notifications.
-
-- spam a user with background notifications.
-
-*cannot:*
-
-- learn how many messaging queues and servers a user receives messages from.
-
-- learn how many message notifications are delivered to the user from each queue.
-
-- learn queue addresses for receiving or sending messages.
-
-- learn the contents or type of messages (not even encrypted).
-
-- learn anything about messages sent without notification flag.
-
-- spam a user with visible notifications (provided the client app can filter push notifications).
-
-- add, duplicate, or corrupt individual messages that will be shown to the user.
-
-#### A user’s contact
-
-*cannot:*
-
-- determine if a user uses push notifications or not.
-
-#### Push notification provider (e.g., APN)
-
-*can:*
-
-- learn that a user uses SimpleX app.
-
-- learn how many notifications are delivered to user's device.
-
-- drop notifications (in fact, APN coalesces notifications delivered while user's device is offline, delivering only the last one).
-
-*cannot:*
-
-- learn which SimpleX Messaging Protocol servers are used by a user (notifications are e2e encrypted).
-
-- learn which or how many messaging queues a user receives notifications from.
-
-- learn the contents or type of messages (not even encrypted, notifications only contain encrypted metadata).
-
-#### An attacker with Internet access
-
-*cannot:*
-
-- register notification token not present on attacker's device.
-
-- enumerate tokens or subscriptions on a SimpleX Notification Server.