fix

agent: test NTF server (#1000 )
5.5.2.1
2026-08-30 18:28:23 +00:00 · 2024-02-22 17:18:58 +00:00 · 2024-02-22 17:13:55 +00:00 · 2024-02-21 14:13:07 +00:00 · 2024-02-21 11:52:24 +00:00 · 2024-02-21 11:45:34 +00:00
142 changed files with 11683 additions and 4107 deletions
@@ -11,7 +11,7 @@ on:

 jobs:
  build:
-    name: build-${{ matrix.os }}
+    name: build-${{ matrix.os }}-${{ matrix.ghc }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
@@ -19,17 +19,22 @@ jobs:
        include:
          - os: ubuntu-20.04
            platform_name: 20_04-x86-64
+            ghc: "8.10.7"
+          - os: ubuntu-20.04
+            platform_name: 20_04-x86-64
+            ghc: "9.6.3"
          - os: ubuntu-22.04
            platform_name: 22_04-x86-64
+            ghc: "9.6.3"
    steps:
      - name: Clone project
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3

      - name: Setup Haskell
-        uses: haskell/actions/setup@v1
+        uses: haskell-actions/setup@v2
        with:
-          ghc-version: "8.10.7"
-          cabal-version: "latest"
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: "3.10.1.0"

      - name: Cache dependencies
        uses: actions/cache@v2
@@ -70,7 +75,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
-        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'ubuntu-20.04'
+        if: startsWith(github.ref, 'refs/tags/v') && matrix.os == 'ubuntu-20.04' && matrix.ghc == '9.6.3'
        uses: softprops/action-gh-release@v1
        with:
          body: |
@@ -0,0 +1 @@
+- ignore: {name: "Use underscore"}
@@ -1,3 +1,88 @@
+# 5.5.2
+
+Extensible handshake for clients and SMP/NTF servers (ignore extra data).
+
+# 5.5.1
+
+SMP servers:
+- do not keep stats file open
+- additional stats about currently stored messages
+
+Agent:
+- support multiple notification servers (only one can be used at a time).
+- expire messages after "quota exceeded" error after 7 days (instead of 21 days previously).
+- stabilize message delivery, remove unnecessary subscription retries and traffic.
+- improve database performance for message delivery.
+- fix sockets/memory leak - a very old bug "activated" by improvements in v5.5.0.
+
+# 5.5.0
+
+Code:
+- compatible with GHC 8.10.7 to support compilation for armv7a.
+- migrate to `crypton` from deprecated `cryptonite` (the seed for DRG is now sha512-hashed).
+- use ChaChaDRG for all random IDs, keys and nonces, only using hashed entropy as seed.
+- more efficient transaction batching in SMP protocol client and server.
+
+Agent:
+- stabilize message reception and delivery, migrate message delivery to database queue.
+- additional event MSGNTF confirming that message received via notification is processed.
+- efficient processing of messages sent to multiple recipients with batched database transactions.
+- new worker abstraction for all queued tasks resilient to race conditions and some database errors.
+- many fixed race conditions.
+- background mode for iOS NSE.
+- additional error reporting to client on critical errors (to be show as alert in the clients).
+- functional api to get worker statistics.
+
+SMP/XFTP servers:
+- fix socket and memory leak on servers with high load (inactive clients without subscriptions are disconnected after set time of inactivity).
+- control port improvements.
+- fix statistics for stored queues, messages and files.
+- make writing to store log atomic (fixes a rare bug in XFTP server).
+
+# 5.4.0
+
+Migrate to GHC 9.6.3
+
+Agent:
+- database improvements:
+  - track slow queries.
+  - better performance.
+  - "busy" error handling.
+  - create parent folder when needed.
+  - support closing and re-opening database.
+- SMP agent improvements
+  - streaming for batched SMP commands.
+  - fix asynchronous JOINing connection.
+  - handle repeating JOINs without failure.
+  - api to get subscribed connections.
+  - return simplex:/ links as invitations.
+  - fix memory leak.
+- XFTP improvements:
+  - suspend when agent is suspended.
+  - support locally encrypted files.
+  - fixes - create empty file, prevent permanent error treated as temporary.
+  - upgrade HTTP2 library (fixes error handling and flow control).
+- Remote control protocol (XRCP)
+
+SMP server:
+- control port commands for GHC threads introspection.
+- allow creating new queues without subscriptions (required for iOS).
+
+XFTP server:
+- allow 64kb file chunks.
+
+NTF server:
+- faster startup.
+
+# 5.3.0
+
+Agent:
+- improve performance, track slow database queries.
+- support delivery receipts.
+
+SMP server:
+- control port
+
 # 5.2.0 (NTF server 1.5.0)

 Agent:
@@ -72,7 +157,7 @@ SMP agent:
 - batch connection deletion
 - improve asynchronous connection deletion – it may now be completed after the client is restarted as well.
 - improve subscription logic to retry if initial attempt fails.
- end SMP client connection after a number of failed PINGs (defalt is 3).
+- end SMP client connection after a number of failed PINGs (default is 3).

 # 4.3.0

@@ -105,7 +190,7 @@ SMP agent:

 Notification server (v1.3.0):

- check token status when sending verification notificaiton.
+- check token status when sending verification notification.

 # 4.1.0

@@ -124,15 +209,15 @@ SMP agent:
 SMP server:

 - Basic authentication. The server address can now include an optional password that is required to create messaging queues, so the contacts who message you will not be able to receive messages via your server, unless you share with them the address with the password. It is recommended to enable basic authentication on all private servers by adding `create_password` parameter into AUTH section of server INI file (the previously deployed servers do not have this section, you need to add it).
- Disable creating new queues completely with `new_queues: off` parameter in AUTH section of INI file - it can be used to simplify migrating the exising connections to another server.
+- Disable creating new queues completely with `new_queues: off` parameter in AUTH section of INI file - it can be used to simplify migrating the existing connections to another server.
 - Updated server CLI with changed defaults:
-  - interactive server initialization, use -y flag to initalize the server non-interactively.
+  - interactive server initialization, use -y flag to initialize the server non-interactively.
  - store log is now enabled by default, so messaging queues and messages are restored when the server is restarted (to restore undelivered messages the server needs to be stopped with SIGINT signal).
  - a random password is now generated by default during the server initialization.

 SMP agent:

- API to test SMP servers. It connects to the server, creates and deletes a messaging queue. The new SimpleX Chat client uses this API to allow you to test that you have the correct server address, with the valid certificate fingerprint and pasword, before enabling the new server.
+- API to test SMP servers. It connects to the server, creates and deletes a messaging queue. The new SimpleX Chat client uses this API to allow you to test that you have the correct server address, with the valid certificate fingerprint and password, before enabling the new server.

 # 3.4.0

@@ -178,9 +263,9 @@ SMP server and agent:

 SMP server:

- restore undeliverd messages when the server is restarted.
+- restore undelivered messages when the server is restarted.
 - SMP protocol v3 to support push notification:
-  - updated SEND and MSG to add message flags (for notification flag that contros whether the notification is sent and for any future extensions) and to move message meta-data sent to the recipient into the encrypted envelope.
+  - updated SEND and MSG to add message flags (for notification flag that confirm whether the notification is sent and for any future extensions) and to move message meta-data sent to the recipient into the encrypted envelope.
  - update NKEY and NID to add e2e encryption keys (for the notification meta-data encryption between SMP server and the client), and update NMSG to include this meta-data.
  - update ACK command to include message ID (to avoid acknowledging unprocessed message).
  - add NDEL commands to remove notification subscription credentials from SMP queue.
@@ -191,7 +276,7 @@ SMP agent:
 - new protocol for duplex connection handshake reducing traffic and connection time.
 - support for SMP notifications server and managing device token.
 - remove redundant FQDN validation from TLS handshake to prepare for access via Tor.
- support for fully stopping agent and for termporary suspending agent operations.
+- support for fully stopping agent and for temporary suspending agent operations.
 - improve management of duplicate message delivery.

 SMP notifications server v1.0:
@@ -5,11 +5,11 @@ FROM ubuntu:${TAG} AS build
 ### Build stage

 # Install curl and git and simplexmq dependencies
-RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev
+RUN apt-get update && apt-get install -y curl git build-essential libgmp3-dev zlib1g-dev llvm-12 llvm-12-dev libnuma-dev libssl-dev

 # Specify bootstrap Haskell versions
-ENV BOOTSTRAP_HASKELL_GHC_VERSION=8.10.7
-ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.6.2.0
+ENV BOOTSTRAP_HASKELL_GHC_VERSION=9.6.3
+ENV BOOTSTRAP_HASKELL_CABAL_VERSION=3.10.1.0

 # Install ghcup
 RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 sh
@@ -19,7 +19,7 @@ ENV PATH="/root/.cabal/bin:/root/.ghcup/bin:$PATH"

 # Set both as default
 RUN ghcup set ghc "${BOOTSTRAP_HASKELL_GHC_VERSION}" && \
-    ghcup set cabal
+    ghcup set cabal "${BOOTSTRAP_HASKELL_CABAL_VERSION}"

 COPY . /project
 WORKDIR /project
@@ -5,6 +5,7 @@
 module Main where

 import Control.Logger.Simple
+import Data.ByteArray (ScrubbedBytes)
 import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
 import Simplex.Messaging.Agent.Env.SQLite
@@ -19,7 +20,7 @@ cfg = defaultAgentConfig
 agentDbFile :: String
 agentDbFile = "smp-agent.db"

-agentDbKey :: String
+agentDbKey :: ScrubbedBytes
 agentDbKey = ""

 servers :: InitialAgentServers
@@ -34,9 +35,10 @@ servers =
 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}

+-- Warning: this SMP agent server is experimental - it does not work correctly with multiple connected TCP clients in some cases.
 main :: IO ()
 main = do
  putStrLn $ "SMP agent listening on port " ++ tcpPort (cfg :: AgentConfig)
  setLogLevel LogInfo -- LogError
-  Right st <- createAgentStore agentDbFile agentDbKey MCConsole
+  Right st <- createAgentStore agentDbFile agentDbKey False MCConsole
  withGlobalLogging logCfg $ runSMPAgent (transport @TLS) cfg servers st
@@ -1,13 +1,16 @@
+{-# LANGUAGE LambdaCase #-}
+
 module Main where

 import Control.Logger.Simple
 import Simplex.Messaging.Server.Main
+import System.Environment

-cfgPath :: FilePath
-cfgPath = "/etc/opt/simplex"
+defaultCfgPath :: FilePath
+defaultCfgPath = "/etc/opt/simplex"

-logPath :: FilePath
-logPath = "/var/opt/simplex"
+defaultLogPath :: FilePath
+defaultLogPath = "/var/opt/simplex"

 logCfg :: LogConfig
 logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
@@ -15,4 +18,9 @@ logCfg = LogConfig {lc_file = Nothing, lc_stderr = True}
 main :: IO ()
 main = do
  setLogLevel LogDebug
+  cfgPath <- getEnvPath "SMP_SERVER_CFG_PATH" defaultCfgPath
+  logPath <- getEnvPath "SMP_SERVER_LOG_PATH" defaultLogPath
  withGlobalLogging logCfg $ smpServerCLI cfgPath logPath
+    
+getEnvPath :: String -> FilePath -> IO FilePath
+getEnvPath name def = maybe def (\case "" -> def; f -> f) <$> lookupEnv name
@@ -2,28 +2,29 @@ packages: .
 -- packages: . ../direct-sqlcipher ../sqlcipher-simple
 -- packages: . ../hs-socks
 -- packages: . ../http2
+-- packages: . ../network-transport
+
+index-state: 2023-12-12T00:00:00Z
+
+package cryptostore
+    flags: +use_crypton

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/aeson.git
-    tag: 3eb66f9a68f103b5f1489382aad89f5712a64db7
+    tag: aab7b5a14d6c5ea64c64dcaee418de1bb00dcc2b

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/hs-socks.git
    tag: a30cc7a79a08d8108316094f8f2f82a0c5e1ac51

-source-repository-package
-    type: git
-    location: https://github.com/kazu-yamamoto/http2.git
-    tag: b5a1b7200cf5bc7044af34ba325284271f6dff25
-
 source-repository-package
    type: git
    location: https://github.com/simplex-chat/direct-sqlcipher.git
-    tag: 34309410eb2069b029b8fc1872deb1e0db123294
+    tag: f814ee68b16a9447fbb467ccc8f29bdd3546bfd9

 source-repository-package
    type: git
    location: https://github.com/simplex-chat/sqlcipher-simple.git
-    tag: 5e154a2aeccc33ead6c243ec07195ab673137221
+    tag: a46bd361a19376c5211f1058908fc0ae6bf42446
@@ -0,0 +1,3 @@
+# Streamlined NTRU Prime: sntrup761
+
+The implementation of sntrup761 is the _exact_ copy from this [Internet draft](https://www.ietf.org/archive/id/draft-josefsson-ntruprime-streamlined-00.html).
@@ -0,0 +1,9 @@
+#include <openssl/sha.h>
+#include "sha512.h"
+
+void crypto_hash_sha512 (unsigned char *out,
+                         const unsigned char *in,
+                         unsigned long long inlen)
+{
+  SHA512(in, inlen, out);
+}
@@ -0,0 +1,3 @@
+void crypto_hash_sha512 (unsigned char *out,
+                         const unsigned char *in,
+                         unsigned long long inlen);
@@ -0,0 +1,33 @@
+/*
+ * Derived from public domain source, written by (in alphabetical order):
+ * - Daniel J. Bernstein
+ * - Chitchanok Chuengsatiansup
+ * - Tanja Lange
+ * - Christine van Vredendaal
+ */
+
+#ifndef SNTRUP761_H
+#define SNTRUP761_H
+
+#include <string.h>
+#include <stdint.h>
+
+#define SNTRUP761_SECRETKEY_SIZE 1763
+#define SNTRUP761_PUBLICKEY_SIZE 1158
+#define SNTRUP761_CIPHERTEXT_SIZE 1039
+#define SNTRUP761_SIZE 32
+
+typedef void sntrup761_random_func (void *ctx, size_t length, uint8_t *dst);
+
+void
+sntrup761_keypair (uint8_t *pk, uint8_t *sk,
+                   void *random_ctx, sntrup761_random_func *random);
+
+void
+sntrup761_enc (uint8_t *c, uint8_t *k, const uint8_t *pk,
+               void *random_ctx, sntrup761_random_func *random);
+
+void
+sntrup761_dec (uint8_t *k, const uint8_t *c, const uint8_t *sk);
+
+#endif /* SNTRUP761_H */
@@ -0,0 +1,30 @@
+indentation: 2
+column-limit: none
+function-arrows: trailing
+comma-style: trailing
+import-export-style: trailing
+indent-wheres: true
+record-brace-space: true
+newlines-between-decls: 1
+haddock-style: single-line
+haddock-style-module: null
+let-style: inline
+in-style: right-align
+single-constraint-parens: never
+unicode: never
+respectful: true
+fixities:
+  - infixr 9 .
+  - infixr 8 .:, .:., .=
+  - infixr 6 <>
+  - infixr 5 ++
+  - infixl 4 <$>, <$, $>,  <$$>, <$?>
+  - infixl 4 <*>, <*, *>, <**>
+  - infix 4 ==, /=
+  - infixr 3 &&
+  - infixl 3 <|>
+  - infixr 2 ||
+  - infixl 1 >>, >>=
+  - infixr 1 =<<, >=>, <=<
+  - infixr 0 $, $!
+reexports: []
@@ -1,5 +1,5 @@
 name: simplexmq
-version: 5.2.0
+version: 5.5.2.1
 synopsis: SimpleXMQ message broker
 description: |
  This package includes <./docs/Simplex-Messaging-Server.html server>,
@@ -20,9 +20,11 @@ category: Chat, Network, Web, System, Cryptography
 extra-source-files:
  - README.md
  - CHANGELOG.md
+  - cbits/sha512.h
+  - cbits/sntrup761.h

 dependencies:
-  - aeson == 2.0.*
+  - aeson == 2.2.*
  - ansi-terminal >= 0.10 && < 0.12
  - asn1-encoding == 0.9.*
  - asn1-types == 0.3.*
@@ -30,49 +32,46 @@ dependencies:
  - attoparsec == 0.14.*
  - base >= 4.14 && < 5
  - base64-bytestring >= 1.0 && < 1.3
-  - bytestring == 0.10.*
  - case-insensitive == 1.2.*
  - composition == 1.0.*
  - constraints >= 0.12 && < 0.14
  - containers == 0.6.*
-  - cryptonite >= 0.27 && < 0.30
-  - cryptostore == 0.2.*
+  - crypton == 0.34.*
+  - crypton-x509 == 1.7.*
+  - crypton-x509-store == 1.6.*
+  - crypton-x509-validation == 1.6.*
+  - cryptostore == 0.3.*
  - data-default == 0.7.*
  - direct-sqlcipher == 2.3.*
  - directory == 1.3.*
  - filepath == 1.4.*
+  - hourglass == 0.2.*
  - http-types == 0.12.*
-  - http2 == 4.1.*
-  - generic-random >= 1.3 && < 1.5
+  - http2 >= 4.2.2 && < 4.3
  - ini == 0.4.1
  - iproute == 1.7.*
  - iso8601-time == 0.1.*
-  - memory == 0.15.*
-  - mtl == 2.2.*
+  - memory == 0.18.*
+  - mtl >= 2.3.1 && < 3.0
  - network >= 3.1.2.7 && < 3.2
-  - network-transport == 0.5.4
+  - network-info >= 0.2 && < 0.3
+  - network-transport == 0.5.6
+  - network-udp >= 0.0 && < 0.1
  - optparse-applicative >= 0.15 && < 0.17
-  - QuickCheck == 2.14.*
  - process == 1.6.*
  - random >= 1.1 && < 1.3
  - simple-logger == 0.1.*
  - socks == 0.6.*
  - sqlcipher-simple == 0.4.*
  - stm == 2.5.*
-  - template-haskell == 2.16.*
  - temporary == 1.3.*
-  - text == 1.2.*
-  - time == 1.9.*
-  - time-compat == 1.9.*
+  - time == 1.12.*
  - time-manager == 0.0.*
-  - tls >= 1.6.0 && < 1.7
-  - transformers == 0.5.*
+  - tls >= 1.7.0 && < 1.8
+  - transformers == 0.6.*
  - unliftio == 0.2.*
  - unliftio-core == 0.2.*
  - websockets == 0.12.*
-  - x509 == 1.7.*
-  - x509-store == 1.6.*
-  - x509-validation == 1.6.*
  - yaml == 0.11.*

 flags:
@@ -80,14 +79,33 @@ flags:
    description: Enable swift JSON format
    manual: True
    default: False
+  use_crypton:
+    description: Use crypton etc. in cryptostore
+    manual: True
+    default: True

 when:
  - condition: flag(swift)
    cpp-options:
      - -DswiftJSON
+  - condition: impl(ghc >= 9.6.2)
+    dependencies:
+      - bytestring == 0.11.*
+      - template-haskell == 2.20.*
+      - text >= 2.0.1 && < 2.2
+  - condition: impl(ghc < 9.6.2)
+    dependencies:
+      - bytestring == 0.10.*
+      - template-haskell == 2.16.*
+      - text >= 1.2.3.0 && < 1.3

 library:
  source-dirs: src
+  c-sources:
+    - cbits/sha512.c
+    - cbits/sntrup761.c
+  include-dirs: cbits
+  extra-libraries: crypto

 executables:
  smp-server:
@@ -97,6 +115,7 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
+      - -rtsopts

  ntf-server:
    source-dirs: apps/ntf-server
@@ -105,6 +124,7 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
+      - -rtsopts

  xftp-server:
    source-dirs: apps/xftp-server
@@ -113,6 +133,7 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
+      - -rtsopts

  smp-agent:
    source-dirs: apps/smp-agent
@@ -121,6 +142,7 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
+      - -rtsopts

  xftp:
    source-dirs: apps/xftp
@@ -129,6 +151,7 @@ executables:
      - simplexmq
    ghc-options:
      - -threaded
+      - -rtsopts

 tests:
  simplexmq-test:
@@ -137,8 +160,9 @@ tests:
    dependencies:
      - simplexmq
      - deepseq == 1.4.*
-      - hspec == 2.7.*
-      - hspec-core == 2.7.*
+      - generic-random == 1.5.*
+      - hspec == 2.11.*
+      - hspec-core == 2.11.*
      - HUnit == 1.6.*
      - QuickCheck == 2.14.*
      - silently == 1.2.*
@@ -347,7 +347,7 @@ Simplex messaging server implementations MUST NOT create, store or send to any o

 - Snapshots of the database they use to store queues and messages (instead simplex messaging clients must manage redundancy by using more than one simplex messaging server). In-memory persistence is recommended.

- Any other information that may compromise privacy or [forward secrecy][4] of communication between clients using simplex messaging servers.
+- Any other information that may compromise privacy or [forward secrecy][4] of communication between clients using simplex messaging servers (the servers cannot compromise forward secrecy of any application layer protocol, such as double ratchet).

 ## Message delivery notifications

@@ -364,9 +364,9 @@ The clients can optionally instruct a dedicated push notification server to subs

 [`SEND` command](#send-message) includes the notification flag to instruct SMP server whether to send the notification - this flag is forwarded to the recepient inside encrypted envelope, together with the timestamp and the message body, so even if TLS is compromised this flag cannot be used for traffic correlation.

-## SMP Transmission andtransport block structure
+## SMP Transmission and transport block structure

-Each transport block (SMP transmission) has a fixed size of 16384 bytes for traffic uniformity.
+Each transport block has a fixed size of 16384 bytes for traffic uniformity.

 From SMP version 4 each block can contain multiple transmissions, version 3 blocks have 1 transmission.
 Some parts of SMP transmission are padded to a fixed size; this padding is uniformly added as a word16 encoded in network byte order - see `paddedString` syntax.
@@ -387,17 +387,17 @@ Each transmission/block for SMP v3 between the client and the server must have t

 ```abnf
 paddedTransmission = <padded(transmission), 16384>
-transmission = [signature] SP signed
-signed = sessionIdentifier SP [corrId] SP [queueId] SP smpCommand
+transmission = signature signed
+signed = sessionIdentifier corrId queueId smpCommand
 ; corrId is required in client commands and server responses,
 ; it is empty in server notifications.
-corrId = 1*32(%x21-7F) ; any characters other than control/whitespace
-queueId = encoded ; max 32 bytes when decoded (24 bytes is used),
+corrId = length *OCTET
+queueId = length *OCTET
 ; empty queue ID is used with "create" command and in some server responses
-signature = encoded
+signature = length *OCTET
 ; empty signature can be used with "send" before the queue is secured with secure command
 ; signature is always empty with "ping" and "serverMsg"
-encoded = <base64 encoded binary>
+length = 1*1 OCTET
 ```

 `base64` encoding should be used with padding, as defined in section 4 of [RFC 4648][9]
@@ -0,0 +1,16 @@
+Scheme name: xftp
+
+Status: Provisional
+
+Applications/protocols that use this scheme name:
+This scheme is used for URIs of XFTP (SimpleX File Transfer Protocol) servers,
+a client-server protocol for asynchronous file transfer via relays,
+preserving file meta-data (including size and name) and content privacy.
+
+Contact: Evgeny Poberezkin <ep@simplex.chat>
+
+Change controller: Evgeny Poberezkin <ep@simplex.chat>
+
+References:
+The syntax for server URIs in the provisional specification for SimpleX File Transfer Protocol:
+https://github.com/simplex-chat/simplexmq/blob/master/rfcs/2022-12-26-simplex-file-transfer.md#server-address-syntax
@@ -0,0 +1,15 @@
+Scheme name: xrcp
+
+Status: Provisional
+
+Applications/protocols that use this scheme name:
+This scheme is used for URIs of controller sessions via SimpleX Remote Control protocol (XRCP),
+a protocol for remote access and management of hosts via insecure network.
+
+Contact: Evgeny Poberezkin <ep@simplex.chat>
+
+Change controller: Evgeny Poberezkin <ep@simplex.chat>
+
+References:
+The syntax for server URIs in the provisional specification for SimpleX File Transfer Protocol:
+https://github.com/simplex-chat/simplexmq/blob/master/rfcs/2023-10-25-remote-control.md#session-invitation
@@ -149,6 +149,19 @@ parts:

 This file description is sent to all recipients via normal messages, split to 15780 byte chunks if needed.

+### Server address syntax
+
+The server address is a URI with the following format:
+
+```abnf
+xftpServerURI = %s"xftp://" xftpServer
+xftpServer = serverIdentity "@" srvHost [":" port]
+srvHost = <hostname> ; RFC1123, RFC5891
+port = 1*DIGIT
+serverIdentity = base64url
+base64url = <base64url encoded binary> ; RFC4648, section 5
+```
+
 ### Receiving file

 Having received the description, the recipient will:
@@ -0,0 +1,58 @@
+# Re-sync encryption ratchets, queue rotation, message delivery receipts
+
+This is very unfocussed doc outlining several problems that seem somewhat related, and some possible solution approaches.
+
+## Problems
+
+When old database backup is used, the sending client encrypts the messages in a way that the receiving client cannot decrypt them, because it does not store the old keys, and does not try to decrypt ratchet headers using the old keys. When receiving the messages, the client that uses the old database is unable to decrypt them, either the header or the message itself (if more than 500 messages are skipped, or if root ratchet step happened).
+
+The same symptoms happen during the queue rotation, unfortunately, as we do not keep the history of received messages once they are acknowledged, so the client reports these error to the users.
+
+While these are two different problems, to the users they manifest in the same way, so it is difficult to differentiate.
+
+Another ratchet problem that should be solved as well is not deleting unused skipped keys after some time or some number of events, possibly it should be considered at the same time.
+
+While it is tempting to consider delivery receipts as an isolated problem, it is somewhat coupled, as the requests to re-sync ratchets and to re-deliver skipped messages are effectively delivery receipts.
+
+A naive solution to delivery receipts when each message is responded to with a confirmation has two downsides:
+
+- it doubles the traffic.
+- in the absense of delays, it also leaks some information about the network latency, that can be used to track user's location.
+
+Both problems can be mitigated by sending delivery receipts with a random delay, to confirm all messages sent, not each one. But this would only reduce the traffic when the sender sends many messages. Alternatively, we could think how to reduce the block size for SMP commands. The challenge is profile pictures and image previews, so to reduce traffic we need to start sending them as XFTP files, potentially with a smaller 64kb chunks (that would also increase preview quality).
+
+## Solution for queue rotation
+
+We need to:
+- store and show the rotation status in the UI to prevent attempts to rotate the queue multiple times.
+- process multiple message delivery events while there is a redundancy, to avoid errors in terminal.
+- differentiate between decryption errors during queue rotation - that would require keeping the messages for some time, at least keeping their IDs and hashes together with some additional status. In this case when duplicate or old message arrives, we can check whether this message was already processed, and do not show error if it was.
+
+## Solution to re-sync ratchets
+
+When we establish that the receiving client is indeed unable to decrypt messages, we should:
+- notify the user - it is already happening, but it happens in case of rotation as well.
+- optionally, notify another client that message was not decrypted - this effectively becomes a delivery receipt. That could be a separate command triggered by the user in the UI.
+- clients can get into this state at the same time, how do we handle concurrent requests? Possibly, we could design these messages so this is irrelevant whether the message is sent in response or not, and calculate the new ratchet keys once the clients have both the sent and received messages. After that both clients can send "ratchet reset" message:
+  - EKEY - message containing a new set of keys to initialize the ratchets
+  - EREADY - message confirming that the ratchet is ready, already e2e encrypted
+
+The downside of this approach, is that unlike the initial handshake, where the second ratchet key is sent in e2e encrypted response, this message will be sent only encrypted with queue key. We could change this protocol by adding EREPLY message, and the clients would know to ingnore EKEY with bigger hash of the keys, so that the client who sent keys with smaller hash would be processing response from another client (that is if EKEY is received after EKEY is sent).
+
+```
+A                B
+
+EKEY 1 ->        <- EKEY 2 (e2e encrypted with per-queue key only)
+EKEY 2 <-        -> EKEY 1
+1 < 2, wait      2 > 1, reply EREPLY 3 (e2e encrypted with ratchets)
+ratchet: 1, 3   ratchet: 3, 1
+```
+
+Once ratchets are re-synched the clients could additionally request delivery of skipped messages. As ratchets being out of sync is not the only problem when messages can be lost, it may be managed independently from the ratchet re-sync. This problem seems tied with delivery receipts too, as requesting to re-deliver some messages automatically confirms that some other messages were delivered.
+
+Alternatively, the request for ratchet sync can already contain the ID of the first failed message - that would allow the agent:
+- stop sending messages until ratchets are in sync.
+- re-deliver failed messages first.
+- only then deliver any pending messages.
+
+This approach would probably result in a better UX (no out of order delivery), but requires tracking pending messages that are not attempted to deliver and to also insert old messages in the delivery queue with the old IDs.
@@ -0,0 +1,170 @@
+# Delivery receipts
+
+## Problems
+
+User experience - users need to know that the messages are delivered to the recipient, as this confirms that the system is functioning.
+
+The downside of communicating message delivery as it confirms that the recipient was online, and, unless there is a delay in confirming, can be used to track the location via the variation in network latency. So delivery receipts should be delayed with a randomized interval and should be opt in or opt out.
+
+Another problem of message receipts is that they increase network traffic and server load. This could be avoided if delivery receipts are communicated as part of normal message delivery flow.
+
+Some other existing and planned features implicitely confirm message delivery and, possibly, should depend on message delivery being enabled:
+- agent message to resume delivery when quota was exceeded (implemented, [rfc](./2022-12-27-queue-quota.md))
+- agent message to re-deliver skipped messages or to re-negotiate double ratchet.
+
+## Solution
+
+There are three layers where delivery receipts can be implemented:
+- chat protocol. Pro: logic of when to deliver it is decoupled from the message flow, Con: extra traffic, can only work in duplex connections.
+- agent client protocol. Pro: can be automated and combined with the protocol to re-deliver skipped messages. Con: extra traffic.
+- SMP protocol. Pro: minimal extra traffic, Con: complicates server design as it would require pushing receipts when there is no next message.
+
+The last approach seems the most promising for avoiding additional traffic:
+- modify client ACK command to include whether delivery receipt should be provided to sender, and, possibly, any e2e encrypted data that should be included in the receipt (e.g., that the receiving client already saw this message in case we use "feedback" variant of roumor-mongering protocol for groups).
+- server would manage delaying of the receipts, by randomizing the time after which the receipt will be available to the sender, and by combining the receipts when possible.
+- modify response to SEND command to include any available delivery receipts.
+- add a separate delivery receipt that will be pushed to the sender in the connection where the message was received by the server.
+
+## SMP protocol changes
+
+```haskell
+data Command (p :: Party) where
+  -- ...
+  ACK :: MsgId -> Maybe ByteString -> Command Recipient
+  -- the presense of ByteString in ACK indicates that the delivery needs to be confirmed.
+  -- the protocol does not define the format of this confirmation, it is application specific, and can be -- an empty string.
+  -- And open question is how to e2e encrypt information in this string - this probably can be handled on Agent client protocol level, and could be the same ratchet key that was used to encrypt and decrypt the message. The downside of this approach is that this key currently is not stored, and storing it requires additional logic to clear these keys if unused after some time.
+  -- TODO consider what could be a better approach.
+  SENT :: MsgId -> [(MsgId, UTCTime, ByteString)] -> Command Sender
+  -- or
+  -- SENT :: MsgId -> Command Sender
+  -- in case we just batch
+  -- this response will be sent to SEND command and will include a sender's message ID generated by the server (currently it does not exist), and posibly an empty list of delivery receipts with the same message IDs as in responses to SEND, timestamps when these receipts became available, and e2e encrypted ByteString passed in ACK command.
+  -- The ID in this response should be different from the ID used in MSG, to keep the promise of not having shared identifiers in sent/received traffic even inside TLS tunnel.
+  -- Keeping the quality of shared ciphertext also requires adding additional encryption layer between the server and the sender, this can be achieved in one of two ways:
+  -- 1) passing a separate DH key in each SEND command, and server including additional DH key in each SENT response, with computed DH secret per message later used to encrypt and decrypt the delivery receipt payloads. This is probably a bad idea as it would increase a cryptographic load on both the server and the client.
+  -- 2) agree a key per queue, in the same way it is done for the recipient. Possibly, it requires additional DH key in confirmation message that the recipient then uses to secure the queue, and passing this key in KEY (secure queue) command. The response to this secure command would the include server's DH key returned to the recipient that would be passed to the sender in HELLO message. Even though recipient could observe both public DH keys, they won't know the computed shared secret. Recipient that controls the server could perform MITM attack on this key exchange, but it doesn't give any benefit over what recipient can do when they have access to the server - the threat model remains the same. The downside of this approach is that it also requires additional changes in client protocol level (confirmation message format and HELLO message).
+  -- 3) also agree on a key per queue, but via separate commands between the sender and the server, once the sender was notified that the queue is secured. This approach is probably better, and the server would simply delay the delivery of delivery receipts until the shared secret is agreed.
+  SKEY :: C.PublicKeyX25519 -> Command Sender
+  SBKEY :: C.PublicKeyX25519 -> BrokerMsg
+  -- these are the command and response to agree secret to encrypt delivery receipt payloads for option 3
+  SSUB :: Command Sender
+  -- subscribe to receive delivery receipts for a given queue - will be sent when the conversation is opened (unless there is an active subscription already), not all queues at once, and won't be re-subscribed on losing the server connection (TBC).
+  RCVD :: MsgId -> UTCTime -> ByteString -> Command Recipient
+  -- delivery receipt. UTCTime is the time when it became available, not the time when ACK was sent by the recipient, to avoid leaking location via network latency.
+```
+
+Possibly, there is no need to include delivery receipts into SENT response and instead just use batching of responses that is already supported. As server responses are not signed, there is no per-response overhead that is substantial, and a lot of receipts that are available can be packed into one block (depending on the size of payload that has to be fixed not to leak metadata).
+
+This all seems rather complicated for SMP protocol, and the approach of doing it on a higher level seems more attractive than initially. Possibly we should reconsider, and reduce traffic by reducing block sizes... Reducing block sizes unfortunately requires supporting variable block sizes, and would leak some metadata during the transition period.
+
+## Another approach
+
+Above represents substantial complexity, and at least doubles server code complexity for the feature that is definitely not doubling the value of server software. Moving to variable block size is simpler, but also has a lot of complexity, reduces metadata privacy (at least for the duration of migration period), reduces image preview quality, and requires postponing this feature for multiple releases, until all clients migrate.
+
+Given that the main traffic is generated by the groups, and direct messages do not create a lot of traffic, a much simpler and better solution is to simply send delivery receipts as the message, in direct conversations only, either as chat protocol message or as agent client protocol message (either on the message or on the envelope layer).
+
+### Comparison of these two approaches:
+
+**Chat protocol message**
+
+Pros:
+- simpler, more contained change - SMP layer is not aware of this feature
+- easier to extend protocol with additional application specific payload, e.g. references to group DAG
+Cons:
+- ?
+
+```json
+  // ...
+  "x.msg.delivered": {
+    "properties": {
+      "msgId": {"ref": "base64url"},
+      "params": {
+        "properties": {
+          "msgId": {"ref": "base64url"},
+        },
+        "optionalProperties": {
+          "data": {} // possibly the initial protocol does not need it, with JSON can be added later
+        }
+      }
+    }
+  },
+  // ...
+```
+
+**Agent client protocol envelope**
+
+Pros:
+- possibility of using it in a wider range of the applications
+- possibility to include received message hash to increase communication integrity - the sending client would be then notified, and it can be exposed in the UI, that the received message is not the same as sent.
+
+Cons:
+- additional implementation complexity - requires additional events to communicate between chat and agent.
+
+```haskell
+data AMessage =
+  -- ...
+  | A_RCVD AgentMsgId MsgHash ByteString -- references to the received message
+  -- ...
+```
+
+The weirdness of the above design is that it refers to the data present in the header of another message, the alternative would be to have a separate envelope for delivery receipt:
+
+```haskell
+data AgentMessage =
+  -- ...
+  AgentMessageRcvd APrivHeader AgentMsgId MsgHash ByteString -- references to the received message
+  -- ...
+```
+
+But probably the first one is a bit better, TBC.
+
+In any case there should be an additional event to notify chat client:
+
+```haskell
+data ACommand (p :: AParty) (e :: AEntity) where
+  -- ...
+  RCVD AgentMsgId MsgMeta ByteString -> ACommand Agent AEConn
+  -- ...
+```
+
+On the balance of things, implementing on the level of Agent Client protocol seems better, as the additional complexity is marginal, but it allows for wider range of applications, and also allows for additional delivery integrity validation. The format for payload still requires chat protocol message encoding once we want to add it, but initially it could be just an empty string.
+
+## Implementation plan
+
+Currently, we delete sent messages once delivered to the server. It would be helpful if we could keep the records in snd_messages table, and then use them to process delivery receipts, although it may be insufficient (we could add fields). Probably it is not possible to keep them as there is a foreign key constraint with `on delete cascade`.
+
+The new table will be used to track sent message hashes to correlate their IDs with delivery receipts (that will also be stored in messages/rcv_messages). Receipts need to be processed in chat in the same way as normal messages, so they would be sent to chat with MsgMeta, and the chat will need to ack them once processed.
+
+Agent ackMessage function will be also used to automatically schedule sending delivery receipts if they are enabled for connection, only for normal messages - no sending receipts to receipts.
+
+There can be receipt re-delivery to the chat in the same cases as when normal message can be re-delivered (in case of AGENT A_DUPLICATE when it was not ack'd by the user).
+
+## Other considerations
+
+### How clients decide whether to send delivery receipts
+
+Two options are possible - local settings per conversation or chat preferences framework, that allows to have mutual on/off. The latter seems preferable as without knowing whether the other party is sending receipts, it is not possible to uderstand what the absense of the receipt means - network malfunction or receipts disabled.
+
+Groups are a special case, as while some groups may enable sending the delivery receipts, the group members should be able to disable it locally. This should probably be done via a separate conversation setting in the same way as enabling notifications or favourites. In this case the receipt would only be sent to the group if it is enabled in the group and not disabled by the member. The toggle may be located in the same page as chat preferences, but it should be a separate setting. We might want though to communicate somehow whether a given member sends delivery receipts so that other members know whether to expect them or not.
+
+### How this functionality is released
+
+5.2:
+- support for sending and receiving delivery receipts preference, both in direct messages and in groups (for forward compatibility).
+- support for sending and receiving delivery receipts in direct chats only, but disable sending them
+
+5.3:
+- show receipt preferences in the UI
+- enable sending receipts in direct chats where they are enabled
+
+A separate question is how to enable this functionality for the existing contacts. Possible options are:
+
+1. Enable (as per default) for all contacts, show notification to the user when they open the app for update that delivery notifications are now sent by default to all contacts. Pro: no extra logic to implement. Con: may be perceived as a privacy violation, as to some contacts the delivery receipts will be sent before the user had chance to disable them.
+2. Ask the user when the new version first runs whether they want to use delivery receipts and offer these options:
+  1) keep enabled for all profiles (and for all contacts)
+  2) enable for all profiles in ~12 or in ~24 hours giving users the chance to review all contacts / profiles and disable some of them. The problem here is also in possibility of the correlation in case they all start sending receipts at the same time. Possibly the option could be to set a random time in 12-15 or 24-30 hours range to avoid the possibility of such correlation.
+  3) disable for all profiles – it will require sending profile updates to all contacts, so the delivery receipts should be kept disabled and profile updates should be sent after random intervals, one by one (not scheduled all at once, as the time may pass while the app is off).
+3. Offer an option to enable globally later - we could keep it as a one-off option, available only to existing users, and visible on the top level of the Settings - once enabled, the option will disappear and it won't be possible to disable again. The downside here is that the new contacts would be receiving the profile with enabled notifications but they still won't be delivered...
+4. Another option is to have all new contacts decided based on a global user default (that can be set in the settings and in the dialog on first start), but for the existing contacts keep in unset state that is not interpreted as either on or off, but interpreted as unknown until the user makes a choice... That might be an optimal solution for the users but it would probably require changing the preferences framework or some ad-hoc hacks. That still keeps the question open how to avoid correlation between profiles.
+5. That might be the case for version agreement too - the availability of the option per contact will depend on the version. It doesn't answer the question what to do with global defaults though...
@@ -0,0 +1,34 @@
+# SMP and XFTP delivery relays
+
+## Problem
+
+SimpleX network relies on SMP relays to hold sent messages while the recipient is offline. This design provides many advantages over pure p2p designs [1]. The threat model for relays is covered in [2].
+
+The problem with this design is that the relays are chosen by the recipients, and they as a result can be used to record transport addresses of the senders.
+
+Similar problem, but reversed, exists with XFTP design - XFTP relays are chosen by the senders and also can be modified to record transport addresses of the recipients.
+
+The current solution to this problem is to use onion routing to access relays, and many users do it already. The downside is that it requires additional configuration and can be complex to some users.
+
+## Solution approach
+
+Add a second type of relays to the network design.
+
+For SMP protocol, these relays would accept messages from the senders and deliver them to the recipients. If the recipient were to modify the relay used to receive the messages to also records senders' IP addresses, then they would only succeed in recording the IP address of the relay, not the sender.
+
+Similar relay can be introduced for XFTP protocol.
+
+The additional advantage of using the relays is the reduced number of network connections that need to be used, and reduced traffic.
+
+Compared with Tor this approach has:
+- lower latency
+- no centralized components or the registry of the servers
+- still no visibility of the whole network to the relays, as sending relays do not need to randomly choose the next relay, but would forward the messages directly to the destination relay.
+
+The downside of this approach is that relays will have more visibility of the network than in the current design.
+
+## Implementation considerations
+
+1. Should this new relays be included in the existing SMP and XFTP protocols and servers, or should they be designed as separate protocols and servers?
+
+2. Should the client aim to choose the same host for delivery relay as the destination server (to reduce the traffic), if possible, or should it aim to choose a different host (to reduce metadata available to single host)? The answer to this would affect the answer to the first question.
@@ -0,0 +1,240 @@
+# Protecting IP addresses of the users from their contacts
+
+## Problem
+
+SMP protocol relays are chosen and can be controlled by the message recipients. It means that the recipients can find out IP addresses of message senders by modifying SMP relay code (or by using proxies and timing correlation), unless the senders use VPN or some overlay network. Tor is an audequate solution in most cases to mitigate it, but it requires additional technical knowledge to install and configure (even installing Orbot on Android is seen as "complex" by many users), and reduces usability because of higher latency.
+
+The lack of in-built IP address protection is the main concern of many users, particularly given that most people do not realise that it is lacking by default - without transport protection SimpleX is not perceived as a "whole product".
+
+Similarly, XFTP protocol relays are chosen by senders, and they can be used to detect file recipients' IP addresses.
+
+## Possible solutions
+
+1. Embed Tor in the client.
+
+Pros:
+- no changes in the protocols/servers
+- acceptable threat model for most users
+- removes complexity of installing and configuring Tor
+- probably, the most attractive option for Tor users
+
+Cons:
+- higher latency and error rate
+- higher resource usage
+- requires us updating Tor client regularly
+- restriction on Tor usage in some networks, so it would require supporting bridges in the app UI
+- legislative restrictions on Tor usage, so it may require supporting multiple app versions, and won't solve the problem where Tor is not embedded
+
+2. Thin clients with hosted accounts.
+
+Host some part of the current client on the server and have another part running on the devices.
+
+Pros:
+- substantially reduces the traffic for mobile clients
+- probably the most attractive option for mass market users who expect to have an account on the server and be able to access it from multiple devices and via web.
+
+Cons:
+- a lot of design and development
+- makes accounts visible to the server
+- the new protocol design to protect connections graph and message content from the hosting server.
+- quite different threat model
+
+Overall, this is not a viable or even appropriate option for the current stage.
+
+3. SMP / XFTP proxy.
+
+Introduce SMP and XFTP protocol extenstions to allow message senders and file recipients to delegate the tasks of sending messages and receiving files to the proxies, so that peer-chosen relays can only observe IP addresses of the proxies and not of the users.
+
+Pros:
+- no dependency on and lower latency than via Tor
+- reduces client traffic, both due to retries handled by these proxies and due to the smaller number of connections to the peer-chosen relays. The flip side is that additional commands (and traffic) are needed to create the sessions with relays.
+- higher transport privacy: protects IP addresses from peers and makes transport correlation harder.
+- additional function: retrying pending messages, while the queue is not secured yet, without extra traffic for the clients.
+- improves current threat model by preventing session-based correlation of the traffic by the destination relay (assuming no information sharing with the proxies), as there will be one session between proxy and destination relay, mixing traffic from multiple users.
+
+Cons:
+- design and development cost
+- can undermine delivery stability
+
+This seems an attractive option, both from technical (reasonable complexity) and positioning (moving SimpleX closer to mix networks, while still avoiding server list visibility) points of view, and it is in the middle between embedding Tor, which would make the product more niche and has downsides and development costs too, and thin clients, which is 10x+ more work, and also creates a different threat model, that is not very attractive for the current stage and users.
+
+Below considers this design.
+
+## SMP/XFTP proxy design
+
+### Design requirements
+
+1. To avoid increasing the complexity of self-hosting, we should not create additional server types, and existing SMP and XFTP servers should be extended to provide proxy functions.
+
+2. SMP proxy should not be able to observe queue addresses and their count on the destination relays. This requirement is not needed for XFTP proxies, as each file chunk is downloaded only once, so there is no need to hide its address.
+
+3. There must be no identifiers and cyphertext in common in outgoing and incoming traffic inside TLS (the current designs have this quality).
+
+4. Traffic between the client and destination relays must be e2e encrypted, with MITM-by-proxy mitigated, relying on the relay identity (certificate fingerprint), ideally without any additional fingerprint in relay address.
+
+5. SMP proxy should implement retry logic and hold messages while they are delivered. They also should return relay replies to the client. To avoid any additional traffic the client should just add "sent to proxy" status and only show "sent" once proxy returns the response from the destination relay - there should be no additional response from the proxy confirming acceptance to delivery.
+
+This would also reduce the difference in how the traffic looks to the observer - sending via proxy may look similar to sending to the usual server (which can be further supported by friendly destination relays that could add latency for direct requests and reply quickly when response came via proxy and be undermined by hostile relays that would introduce some latency pattern to help traffic correlation. The latter problem can be mitigated by having a fixed response latency from proxy that may be "come back later for destination response").
+
+6. Sending messages to groups have to be batched in the client to avoid multiple requests for destination relay sessions - such requests can be batched to proxy, even though it leaks _some_ metadata - which destination relays are used by a given sender's IP address, it also reduces the overhead from proxies – it could be an option based on the privacy slider.
+
+6. SMP proxy may also increase utility and privacy of the platform:
+
+- holding messages and retrying them for the new connections while the receiving queue is not secured yet.
+- add delays in message delivery to make traffic correlation harder (same can be done in SMP relays).
+
+### Implementation considerations
+
+1. Block size. Possibly, there is not enough spare capacity in the current 16kb block to fit additional headers, any necessary metadata and encryption authentication tags, in which case we cannot send SMP and SMP-proxy traffic in the same transport connection (in case the same server plays both roles). In which case we will need to negotiate role during connection handshake and define a different (sub-)protocol for SMP-proxy.
+
+2. To be decided if we see it as extension of SMP protocol or as another protocol, irrespective of whether it's provided by the same or another server. Given different roles and block size it may be simpler to see it as a separate protocol, and which protocol is provided in the connection is determined during handshake.
+
+3. We probably should aim to avoid changing agent/client logic and see it instead as transport concern that can be dynamically decided at a point of sending a message, based on the current configuration.
+
+4. Configuration should probably allow to choose between not using proxies (particularly, during testing, when it would be the default), using proxies only for unknown relays, and using proxies for all relays (extra traffic, but more complex transport correlation - although randomizing this choice can be more beneficial to the transport privacy). The clients can aim to use proxy from another provider, to reduce the risks of sharing the information.
+
+### SMP-proxy protocol
+
+The flow of the messages will be:
+
+1. Client requests proxy to create session with the relay by sending `server` command with the SMP relay address and optional proxy basic AUTH (below). It should be possible to batch multiple session requests into one block, to reduce traffic.
+
+2. Proxy connects to SMP relay, negotiating a shared secret in the handshake that will be used to encrypt all sender blocks inside TLS (proxy-relay encryption). SMP relay also returns in handshake its temporary DH key to agree e2e encryption with the client (sender-relay encryption, to hide metadata sent to the destination relay from proxy).
+
+3. Proxy replies with `server_id` command including relay session ID to identify it in further requests, relay DH key for e2e encryption with the client - this key is signed with the TLS online private key associated with the certificate (its fingerprint is included in the relay address), and the TLS session ID between proxy and relay (this session ID must be used in transmissions, to mitigate replay attacks as before).
+
+A possible attack here is that proxy can use this TLS session to replay commands received from the client. Possibly, it could be mitigated with a bloom filter per proxy/SMP relay connection that would reject the repeated DH keys (that need to be used for replay), and also with DH key expiration (this mitigation should allow some acceptable rate of false positives from the bloom filter).
+
+With 32 bits per key there will be ~1/1,000,000 false positives (see https://en.wikipedia.org/wiki/Bloom_filter), and the filter would use ~32mb per each proxy connection if we reset relay key every 1000000 messages or more frequently. Given that the only commands accepted via relay would be SEND, replaying it would be interpreted by the receiving client as duplicate message delivery, so a small number of replayed messages won't cause any problems. But without mitigation it could be used to flood the receiving SMP relay queues with repeated messages, effectively causing DoS on these queues, even in case when SMP relays require basic auth to create queues.
+
+Given that the client chooses proxy it has some trust to, maybe this replay attack risk can be accepted.
+
+It is important that the same public key from destination relay is returned to all clients, so proxy does not need to repeat this request to know relays while the key did not expire, as using different keys for different clients would allow destination relays to correlate requests to the clients. A proxy that colludes with the destination relay can pass different public keys to the same client, but it is not changing threat model as colluding proxy can share information as well. It is also important that the client uses a new random key for each command, as using the same key would allow the destination relay to identify these commands as comming from the same user, and using a different key for each queue while would protect privacy of the user from the destination relay, would make it visible to the proxy how many different queues the client has on destination relay.
+
+*Unrelated cosideration for SMP protocol privacy improvement*: instead of signing commands to the destination relay, the sender could have a ratchet per queue agreed with the destination relay that would simply use authenticated encryption with per-message symmetric key to encrypt the message on the way to relay, and this encryption would be used as a proof of sender.
+
+4. Now the client sends `forward` to proxy, which it then forwards to SMP relay, applying additional encryption layer.
+
+5. SMP relay sends `response` to proxy applying additional encryption layer, which it then forwards to the client removing the additional encryption layer.
+
+Effectively it works as a simplified two-hop onion routing with the first relay (proxy) chosen by the sending client and the second relay chosen by the recipient, not only protecting senders' IP addresses from the recipients' relays, but also preventing recipients relays from correlating senders' traffic to different queues, as TLS session is owned by the proxy now and it mixes the traffic from multiple senders. To correlate traffic to users, proxy and relay would have to combine their information. SMP relays are still able to correlate traffic to receiving users via transport session.
+
+Sequence diagram for sending the message via SMP proxy:
+
+```
+-------------               -------------                     -------------              -------------
+|  sending  |               |    SMP    |                     |    SMP    |              | receiving |
+|  client   |               |   proxy   |                     |   relay   |              |  client   |
+-------------               -------------                     -------------              -------------
+     |       `server`             |                                 |                          |
+     | -------------------------> |   create TLS session, get keys  |                          |
+     |                            | ------------------------------> |                          |
+     |        `server_id`         |       (if doesn't exist)        |                          |
+     | <------------------------- |                                 |                          |
+     |                            |                                 |                          |
+     | TLS(F:s2r(SEND(e2e(msg)))) |                                 |                          |
+     | -------------------------> | TLS(F:p2r(s2r(SEND(e2e(msg))))) |                          |
+     |                            | ------------------------------> |                          |
+     |                            |                                 |                          |
+     |                            |     TLS(R:p2r(s2r(OK/ERR)))     |                          |
+     |     TLS(R:s2r(OK/ERR))     | <------------------------------ |                          |
+     | <------------------------- |                                 | TLS(MSG(r2c(e2e(msg))))  |
+     |                            |                                 | -----------------------> |
+     |                            |                                 |                          |
+     |                            |                                 |        TLS(ACK)          |
+     |                            |                                 | <----------------------- |
+     |                            |                                 |                          |
+     |                            |                                 |                          |
+
+```
+
+Below diagram shows the encrypttion layers for `forward` and `response` commands:
+
+- s2r (added) - encryption between client and SMP relay, with relay key returned in server_id command, with MITM by proxy mitigated by verifying the certificate fingerprint included in the relay address.
+- e2e (exists now) - end-to-end encryption per SMP queue, with double ratchet e2e encryption inside it.
+- p2r (added) - additional encryption between proxy and SMP relay with key agreed in the handshake, to mitigate traffic correlation inside TLS. This key could also be signed by the same certificate, if we don't want to rely on TLS security.
+- r2c (exists now) additional encryption between SMP relay and client to prevent traffic correlation inside TLS.
+
+```
+-----------------             -----------------  -- TLS --  -----------------             -----------------
+|               |  -- TLS --  |               |  -- p2r --  |               |  -- TLS --  |               |
+|               |  -- s2r --  |               |  -- s2r --  |               |  -- r2c --  |               |
+|    sending    |  -- e2e --  |               |  -- e2e --  |               |  -- e2e --  |   receiving   |
+|    client     |     MSG     |   SMP proxy   |     MSG     |   SMP relay   |     MSG     |    client     |
+|               |  -- e2e --  |               |  -- e2e --  |               |  -- e2e --  |               |
+|               |  -- s2r --  |               |  -- s2r --  |               |  -- r2c --  |               |
+|               |  -- TLS --  |               |  -- p2r --  |               |  -- TLS --  |               |
+-----------------             -----------------  -- TLS --  -----------------             -----------------
+```
+
+When proxy connects to SMP relay it would indicate in the handshake that it will use proxy protocol and the SMP relay would expect the same `forward` commands and reply with `response`s.
+
+Below syntax aims to fit in 16kb block using spare capacity in SMP protocol.
+
+```abnf
+proxy_block = padded(proxy_transmission, 16384)
+proxy_transmission = corr_id relay_session_id proxy_command
+corr_id = length *8 OCTET
+proxy_command = server / server_id / forward / response / error
+server = "S" address [relay_basic_auth] ; creates transport session between proxy and relay
+server_id = "I" relay_session_id tls_session_id signed_relay_key ;
+    ; session_id is the TLS session ID between proxy and relay, it has to be included inside encrypted block to prevent replay attacks
+forward = %s"F" random_dh_pub_key encrypted_block ; it's important that a new key is used for each command, to prevent any correlation by proxy or by destination relay
+response = %s"R" encrypted_block; response received from the destination SMP relay
+relay_session_id = length *8 OCTET
+error = %s"E" error
+```
+
+The overhead is: 1+8 (corrId) + 1+8 (relay_session_id) + 1 (command) + 1+32 (random_dh_pub_key) + 2 (original length) + 16 (auth tag for e2e encryption) + 16 (auth tag for proxy to relay encryption) = 86 bytes. The reserve for sent messages in SMP is ~84 bytes, so it should about fit with some reduced bytes somewhere.
+
+Another possible design is to allow mixing sent messages and normal SMP commands in the same transport connection, but it can make fitting in the block a bit harder, additional overhead would be: 1 (transmission count) + 2 (transmission size) + 1 (empty signature) = 4 bytes.
+
+The above assumes that the client can only send one message to an SMP relay and then has to wait for response before sending the next message. Missing the response would cause re-delivery (further improvement is possible when proxy detects these redelieveries and not send them to relays but simply reply with the same response).
+
+### Threat model for SMP proxy and changes to threat model for SMP
+
+#### SMP proxy
+
+*can:*
+
+- learn a user's IP address, as long as Tor is not used.
+
+- learn when a user with a given IP address is online.
+
+- know how many messages are sent from a given IP address and to a given destination SMP relay.
+
+- drop all messages from a given IP address or to a given destination relay.
+
+- unless SMP relay detects repeated public DH keys of senders, replay messages to a destination relay within a single session, causing either duplicate message delivery (which will be detected and ignored by the receiving clients), or, when receiving client is not connected to SMP relay, exhausting capacity of destination queues used within the session.
+
+*cannot:*
+
+- perform queue correlation (matching multiple queues to a single user), unless it has additional information from SMP relay.
+
+- undetectably add, duplicate, or corrupt individual messages.
+
+- undetectably drop individual messages, so long as a subsequent message is delivered.
+
+- learn the contents of messages.
+
+- learn the destination queues of messages.
+
+- distinguish noise messages from regular messages except via timing regularities.
+
+- compromise the user's end-to-end encryption with another user via an active attack.
+
+- compromise the user's end-to-end encryption with destination relay via an active attack.
+
+#### SMP relay accessed via SMP proxy
+
+*still can:*
+
+- perform recipients' queue correlation (matching multiple queues to a single recipient) via either a re-used transport connection, user's IP Address, or connection timing regularities
+
+*no longer can:*
+
+- perform senders' queue correlation (matching multiple queues to a single sender) via either a re-used transport connection, user's IP Address, or connection timing regularities, unless it has additional information from SMP proxy.
+
+- learn a sender's IP address, track them through other IP addresses they use to access the same queue, and infer information (e.g. employer) based on the IP addresses, even if Tor is not used.
+
+The rest of the threat model for SMP relays remains the same as in [overview](../protocol/overview-tjr.md#simplex-messaging-protocol-server).
@@ -0,0 +1,361 @@
+# SimpleX Remote Control protocol
+
+Using profiles in SimpleX Chat mobile app from desktop app with minimal risk to the security/threat model of SimpleX protocols.
+
+## Problem
+
+Synchronizing profiles that use double ratchet for e2e encryption is effectively impossible in a way that tolerates partitioning between devices without reducing security of double ratchet.
+
+We are not considering replacing (or weakening) double ratchet to allow profile synchronization, as some other messengers did (e.g., Session). We are also not considering Signal model, when profile is known to the server and adding devices results in changing security code and no visibility of conversation history, as it would be substantially different from the current model, and also effectively weakens the security, as in practives most users don't revalidate security codes when they change.
+
+## Solution
+
+The proposed solution is a new remote access/control protocol, when the application on host device (usually mobile) acts as a server, and application on another device (usually desktop) acts as a controller usually running in the same local network.
+
+Existing service discovery and remote control protocols known to us are vulnerable to spoofing, spamming and MITM attacks. This design aims to solve these problems.
+
+## Requirements
+
+- Strong, cryptographically verified identity of the controller device, with the initial connection requiring out-of-band communication of public keys (QR code or link).
+- Identity verification of the host device during session handshake.
+- Protection against malicious "controllers" trying to make host connect to them instead of valid controller on the same network.
+- Protection against replay attacks, both during discovery and during control session.
+- Additional encryption layer inside TLS, with post-quantum algorithm in key agreement.
+- Protect host device from unauthorized access in case of controller compromise.
+- Post-compromised security - that is, even if long term secrets were copied from the controller, and host device was made to connect to malicious controller device, prevent malicious controller from accessing the host device data.
+- Allow general high-level interactions common for many applications:
+  - RPC pattern for commands executed by the host application.
+  - Events sent by host to update controller UI.
+  - Uploading and downloading files between host and controller, either to be processed by the host or to be presented in the controller UI.
+
+This design will allow application-level protocol that is quite close to how SimpleX Chat UI interacts with SimpleX Chat core - there is a similar RPC + events protocol and support for files. The application-level protocol is out of scope of this specification.
+
+## Protocol phases
+
+Protocol consists of four phases:
+- controller session invitation
+- establishing session TLS connection
+- session verification and protocol negotiation
+- session operation
+
+### Session invitation
+
+The invitation to the first session between host and controller pair MUST be shared out-of-band, to establish a long term identity keys/certificates of the controller to host device.
+
+The subsequent sessions can be announced via an application-defined site-local multicast group, e.g. `224.0.0.251` (also used in mDNS/bonjour) and an application-defined port (SimpleX Chat uses 5227).
+
+The session invitation contains this data:
+- supported version range for remote control protocol
+- application-specific information, e.g. device name, application name and supported version range, settings, etc.
+- session start time in seconds since epoch
+- if multicast is used, counter of announce packets sent by controller
+- network address (ipv4 address and port) of the controller
+- CA TLS certificate fingerprint of the controller - this is part of long term identity of the controller established during the first session, and repeated in the subsequent session announcements.
+- Session Ed25519 public key used to verify the announcement and commands - this mitigates the compromise of the long term signature key, as the controller will have to sign each command with this key first.
+- Long-term Ed25519 public key used to verify the announcement and commands - this is part of the long term controller identity.
+- Session X25519 DH key and sntrup761 KEM encapsulation key to agree session encryption (both for multicast announcement and for commands and responses in TLS), as described in https://datatracker.ietf.org/doc/draft-josefsson-ntruprime-hybrid/. The new keys are used for each session, and if client key is already available (from the previous session), the computed shared secret will be used to encrypt the announcement multicast packet. The out-of-band invitation is unencrypted. These DH public key and KEM encapsulation key are always sent unencrypted. NaCL Cryptobox is used for encryption.
+
+Host device decrypts (except the first session) and validates the invitation:
+- Session signature is valid.
+- Timestamp is within some window from the current time.
+- Long-term key signature is valid.
+- Long-term CA and signature key are the same as in the first session.
+- Some version in the offered range is supported.
+
+OOB session invitation is a URI with this syntax:
+
+```abnf
+sessionAddressUri = "xrcp://" encodedCAFingerprint "@" host ":" port "#/?" qsParams
+encodedCAFingerprint = base64url
+qsParams = param *("&" param)
+param = versionRangeParam / appInfoParam / sessionTsParam /
+        sessPubKeyParam / idPubKeyParam / kemEncKeyParam / dhPubKeyParam /
+        sessSignatureParam / idSignatureParam
+versionRangeParam = "v=" (versionParam / (versionParam "-" versionParam))
+versionParam = 1*DIGIT
+appInfoParam = "app=" escapedJSON ; optional
+sessionTsParam = "ts=" 1*DIGIT
+sessPubKeyParam = "skey=" base64url ; required
+idPubKeyParam = "idkey=" base64url ; required
+dhPubKeyParam = "dh=" base64url ; required
+sessSignatureParam = "ssig=" base64url ; required, signs the URI with this and idSignatureParam param removed
+idSignatureParam = "idsig=" base64url ; required, signs the URI with this param removed
+base64url = <base64url encoded binary> ; RFC4648, section 5
+```
+
+Multicast session announcement is a binary encoded packet with this syntax:
+
+```abnf
+sessionAddressPacket = dhPubKey nonce encrypted(unpaddedSize sessionAddress packetPad)
+dhPubKey = length x509encoded ; same as announced
+nonce = length *OCTET
+sessionAddress = largeLength sessionAddressUri ; as above
+length = 1*1 OCTET ; for binary data up to 255 bytes
+largeLength = 2*2 OCTET ; for binary data up to 65535 bytes
+packetPad = <pad packet size to 1450 bytes> ; possibly, we may need to move KEM agreement one step later,
+; with encapsulation key in HELLO block and KEM ciphertext in reply to HELLO.
+```
+
+### Establishing session TLS connection
+
+Host connects to controller via TCP session and validates CA credentials during TLS handshake. Controller acts as a TCP server in this connection, to avoid host device listening on a port, which might create an attack vector. During TLS handshake the controller's TCP server MUST present a self-signed two-certificate chain where the fingerprint of the first certificate MUST be the same as in the announcement.
+
+Host device presents its own client certificate chain with CA representing a long-term identity of the host device.
+
+### Session verification and protocol negotiation
+
+Once TLS session is established, both the host and controller device present a "session security code" to the user who must match them (e.g., visually or via QR code scan) and confirm on the host device. The session security code must be a digest of tlsunique channel binding. As it is computed as a digest of the TLS handshake for both the controller and the host, it will validate that the same TLS certificates are used on both sides, and that the same TLS session is established, mitigating the possibility of MITM attack in the connection.
+
+Once the session is confirmed by the user, the host device sends "hello" block to the controller. ALPN TLS extension is not used to obtain tlsunique prior to sending any packets.
+
+Block size should be 16384 bytes.
+
+Host HELLO must contain:
+- new session DH key - used to compute new shared secret with the controller keys from the announcement.
+- encrypted part of hello block (JSON object), containing:
+  - chosen protocol version.
+  - host CA TLS certificate fingerprint - part of host long term identity - must match the one presented in TLS handshake and the previous sessions, otherwise the connection is terminated.
+  - KEM encapsulation key - used to compute new shared secret for the session.
+  - additional application specific parameters, e.g host device name, application version, host settings or JSON encoding format.
+
+Hello block syntax:
+
+```abnf
+hostHello = unpaddedSize %s"HELLO " dhPubKey nonce encrypted(unpaddedSize hostHelloJSON helloPad) pad
+unpaddedSize = largeLength
+dhPubKey = length x509encoded
+pad = <pad block size to 16384 bytes>
+helloPad = <pad hello size to 12888 bytes>
+largeLength = 2*2 OCTET
+```
+
+Controller decrypts (including the first session) and validates the received hello block:
+- Chosen versions are supported (must be within offered ranges).
+- CA fingerprint matches the one presented in TLS handshake and the previous sessions - in subsequent sessions TLS connection should be rejected if the fingerprint is different.
+
+JTD schema for the encrypted part of host HELLO block `hostHelloJSON`: 
+
+```json
+{
+  "definitions": {
+    "version": {
+      "type": "string",
+      "metadata": {
+        "format": "[0-9]+"
+      }
+    },
+    "base64url": {
+      "type": "string",
+      "metadata": {
+        "format": "base64url"
+      }
+    }
+  },
+  "properties": {
+    "v": {"ref": "version"},
+    "ca": {"ref": "base64url"},
+    "kem": {"ref": "base64url"}
+  },
+  "optionalProperties": {
+    "app": {"properties": {}, "additionalProperties": true}
+  },
+  "additionalProperties": true
+}
+```
+
+Controller should reply with with `hello` or `error` response:
+
+```abnf
+ctrlHello = unpaddedSize %s"HELLO " kemCyphertext nonce encrypted(unpaddedSize ctrlHelloJSON helloPad) pad
+; ctrlHelloJSON is encrypted with the hybrid secret,
+; including both previously agreed DH secret and KEM secret from kemCyphertext
+unpaddedSize = largeLength
+kemCyphertext = largeLength *OCTET
+pad = <pad block size to 16384 bytes>
+helloPad = <pad hello size to 12888 bytes>
+largeLength = 2*2 OCTET
+
+ctrlError = unpaddedSize %s"ERROR " nonce encrypted(unpaddedSize ctrlErrorJSON helloPad) pad
+; ctrlErrorJSON is encrypted using previously agreed DH secret.
+```
+
+JTD schema for the encrypted part of controller HELLO block `ctrlHelloJSON`:
+
+```json
+{
+  "properties": {},
+  "additionalProperties": true
+}
+```
+
+JTD schema for the encrypted part of controller ERROR block `ctrlErrorJSON`:
+
+```json
+{
+  "properties": {
+    "message": {"type": "string"}
+  },
+  "additionalProperties": true
+}
+```
+
+Once controller replies HELLO to the valid host HELLO block, it should stop accepting new TCP connections.
+
+
+### Сontroller/host session operation
+
+The protocol for communication during the session is out of scope of this protocol.
+
+SimpleX Chat will use HTTP2 encoding, where host device acts as a server and controller acts as a client (these roles are reversed compared with TLS connection).
+
+Payloads in the protocol must be encrypted using NaCL cryptobox using the hybrid shared secret agreed during session establishment.
+
+Commands of the controller must be signed after the encryption using the controller's session and long term Ed25519 keys.
+
+tlsunique channel binding from TLS session MUST be included in commands (included in the signed body).
+
+The syntax for encrypted command and response body encoding:
+
+```
+commandBody = encBody sessSignature idSignature (attachment / noAttachment)
+responseBody = encBody attachment; should match counter in the command
+encBody = nonce encLength32 encrypted(tlsunique counter body)
+attachment = %x01 nonce encLength32 encrypted(attachment)
+noAttachment = %x00
+tlsunique = length 1*OCTET
+counter = 8*8 OCTET ; int64
+encLength32 = 4*4 OCTET ; uint32, includes authTag
+```
+
+If the command or response includes attachment, it's hash must be included in command/response and validated.
+
+## Key agreement for announcement packet and for session
+
+Initial announcement is shared out-of-band (URI with xrcp scheme), and it is not encrypted.
+
+This announcement contains only DH keys, as KEM key is too large to include in QR code, which are used to agree encryption key for host HELLO block. The host HELLO block will containt DH key in plaintext part and KEM encapsulation (public) key in encrypted part, that will be used to determine the shared secret (using SHA256 over concatenated DH shared secret and KEM encapsulated secret) both for controller HELLO response (that contains KEM cyphertext in plaintext part) and subsequent session commands and responses.
+
+During the next session the announcement is sent via encrypted multicast block. The shared key for this announcement and for host HELLO block is determined using the KEM shared secred from the previous session and DH shared secret computed using the host DH key from the previous session and the new controller DH key from the announcement.
+
+For the session, the shared secred is computed again using the KEM shared secret encapsulated by the controller using the new KEM key from the HOST hello block and DH shared secret computed using the host DH key from HELLO block and the new controller DH key from the announcement.
+
+To describe it in pseudocode:
+
+```
+// session 1
+hostHelloSecret(1) = dhSecret(1)
+sessionSecret(1) = sha256(dhSecret(1) || kemSecret(1)) // to encrypt session 1 data, incl. controller hello
+dhSecret(1) = dh(hostHelloDhKey(1), controllerInvitationDhKey(1))
+kemCiphertext(1) = enc(kemSecret(1), kemEncKey(1))
+// kemEncKey is included in host HELLO, kemCiphertext - in controller HELLO
+kemSecret(1) = dec(kemCiphertext(1), kemDecKey(1))
+
+// multicast announcement for session n
+announcementSecret(n) = sha256(dhSecret(n'))
+dhSecret(n') = dh(hostHelloDhKey(n - 1), controllerDhKey(n))
+
+// session n
+hostHelloSecret(n) = dhSecret(n)
+sessionSecret(n) = sha256(dhSecret(n) || kemSecret(n)) // to encrypt session n data, incl. controller hello
+dhSecret(n) = dh(hostHelloDhKey(n), controllerDhKey(n))
+// controllerDhKey(n) is either from invitation or from multicast announcement
+kemCiphertext(n) = enc(kemSecret(n), kemEncKey(n))
+kemSecret(n) = dec(kemCiphertext(n), kemDecKey(n))
+```
+
+If controller fails to store the new host DH key after receiving HELLO block, the encryption will become out of sync and the host won't be able to decrypt the next announcement. To mitigate it, the host should keep the last session DH key and also previous session DH key to try to decrypt the next announcement computing shared secret using both keys (first the new one, and in case it fails - the previous).
+
+To decrypt multicast announcement, the host should try to decrypt it using the keys of all known (paired) remote controllers.
+
+## Other options
+
+The proposed design has these pros/cons:
+
+Pros:
+- mobile host that has sensitive data doesn't act as TLS server.
+- multicast is optional - all sessions can happen via QR code only.
+
+Cons:
+- reversing of client/server roles between TLS and HTTP2.
+- in the first session mobile host TLS client credentials are verified after TLS connection is accepted.
+- cannot be used with host that runs in VM.
+
+The alternative design will use mobile host device as TLS server. The session negotiation process:
+
+- desktop shares its initial credentials via QR code, only for the first session
+- mobile sends encrypted multicast with session address, TLS CA fingerprint, DH key in clear text
+- desktop connects to mobile
+- session tlsunique presented to users on both devices - either user would have to confirm session on both devices or the mobile would have to send an additional "ready" block.
+
+Pros:
+- no reversing server role between TLS and HTTP2
+- TLS credentials are exchanged before TLS, so invalid credentials can be rejected during the handshake of the first session.
+- if some other way to pass data from host to controller is added, then it can be used with host running in VM.
+
+Cons:
+- multicast is mandatory, as there is no efficient way to communicate from mobile to desktop.
+- still needs hello or confirmation on both devices
+- mobile is now acting as TLS server creating additional attack vector
+
+In both proposed and alternative design mobile host has chat data, acts as HTTP2 server, commands are signed with desktop key presented out-of–band, and both commands and responses are encrypted inside TLS session.
+
+Other considered options:
+- SSH - more work integrating it.
+- use SMP connection to negotiate TLS session - it seems wrong to require Internet connection to negotiate a local network connection between desktop and mobile.
+- other multicast service discovery protocols - quite insecure.
+
+## Threat model
+
+#### A passive network adversary able to monitor the site-local traffic:
+
+*can:*
+- observe session times, duration and volume of the transmitted data between host and controller.
+
+*cannot:*
+- observe the content of the transmitted data.
+- substitute the transmitted commands or responses.
+- replay transmitted commands or events from the hosts.
+
+#### An active network adversary able to intercept and substitute the site-local traffic:
+
+*can:*
+- prevent host and controller devices from establishing the session
+
+*cannot:*
+- same as passive adversary, provided that user visually verified session code out-of-band.
+
+#### An active adversary with the access to the network:
+
+*can:*
+- spam controller device.
+
+*cannot:*
+- compromise host or controller devices.
+
+#### An active adversary with the access to the network who also observed OOB announcement:
+
+*can:*
+- connect to controller instead of the host.
+- present incorrect data to the controller.
+
+*cannot:*
+- connect to the host or make host connect to itself.
+
+#### Compromised controller device:
+
+*can:*
+- observe the content of the transmitted data.
+- access any data of the controlled host application, within the capabilities of the provided API.
+
+*cannot:*
+- access other data on the host device.
+- compromise host device.
+
+#### Compromised host device:
+
+*can:*
+- present incorrect data to the controller.
+- incorrectly interpret controller commands.
+
+*cannot:*
+- access controller data, even related to this host device.
@@ -19,7 +19,9 @@ if [ ! -f "${confd}/file-server.ini" ]; then
  # Set quota
  case "${QUOTA}" in
    '') printf 'Please specify $QUOTA environment variable.\n'; exit 1 ;;
-    *) set -- "$@" --quota "${QUOTA}" ;;
+    *GB) QUOTA="$(printf ${QUOTA} | tr '[:upper:]' '[:lower:]')"; set -- "$@" --quota "${QUOTA}" ;;
+    *gb) set -- "$@" --quota "${QUOTA}" ;;
+    *) printf 'Wrong format. Format should be: 1gb, 10gb, 100gb.\n'; exit 1 ;;
  esac

  # Init the certificates and configs
@@ -1,11 +1,11 @@
 cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.1.
+-- This file has been generated from package.yaml by hpack version 0.35.0.
 --
 -- see: https://github.com/sol/hpack

 name:           simplexmq
-version:        5.2.0
+version:        5.5.2.1
 synopsis:       SimpleXMQ message broker
 description:    This package includes <./docs/Simplex-Messaging-Server.html server>,
                <./docs/Simplex-Messaging-Client.html client> and
@@ -26,16 +26,23 @@ build-type:     Simple
 extra-source-files:
    README.md
    CHANGELOG.md
+    cbits/sha512.h
+    cbits/sntrup761.h

 flag swift
  description: Enable swift JSON format
  manual: True
  default: False

+flag use_crypton
+  description: Use crypton etc. in cryptostore
+  manual: True
+  default: True
+
 library
  exposed-modules:
-      Simplex.FileTransfer
      Simplex.FileTransfer.Agent
+      Simplex.FileTransfer.Chunks
      Simplex.FileTransfer.Client
      Simplex.FileTransfer.Client.Agent
      Simplex.FileTransfer.Client.Main
@@ -44,6 +51,7 @@ library
      Simplex.FileTransfer.Description
      Simplex.FileTransfer.Protocol
      Simplex.FileTransfer.Server
+      Simplex.FileTransfer.Server.Control
      Simplex.FileTransfer.Server.Env
      Simplex.FileTransfer.Server.Main
      Simplex.FileTransfer.Server.Stats
@@ -63,6 +71,8 @@ library
      Simplex.Messaging.Agent.Server
      Simplex.Messaging.Agent.Store
      Simplex.Messaging.Agent.Store.SQLite
+      Simplex.Messaging.Agent.Store.SQLite.Common
+      Simplex.Messaging.Agent.Store.SQLite.DB
      Simplex.Messaging.Agent.Store.SQLite.Migrations
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
@@ -84,13 +94,26 @@ library
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
-      Simplex.Messaging.Agent.TAsyncs
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
+      Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
      Simplex.Messaging.Agent.TRcvQueues
      Simplex.Messaging.Client
      Simplex.Messaging.Client.Agent
      Simplex.Messaging.Crypto
+      Simplex.Messaging.Crypto.File
      Simplex.Messaging.Crypto.Lazy
      Simplex.Messaging.Crypto.Ratchet
+      Simplex.Messaging.Crypto.SNTRUP761
+      Simplex.Messaging.Crypto.SNTRUP761.Bindings
+      Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines
+      Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
+      Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG
      Simplex.Messaging.Encoding
      Simplex.Messaging.Encoding.String
      Simplex.Messaging.Notifications.Client
@@ -99,6 +122,7 @@ library
      Simplex.Messaging.Notifications.Server.Env
      Simplex.Messaging.Notifications.Server.Main
      Simplex.Messaging.Notifications.Server.Push.APNS
+      Simplex.Messaging.Notifications.Server.Push.APNS.Internal
      Simplex.Messaging.Notifications.Server.Stats
      Simplex.Messaging.Notifications.Server.Store
      Simplex.Messaging.Notifications.Server.StoreLog
@@ -108,6 +132,7 @@ library
      Simplex.Messaging.Protocol
      Simplex.Messaging.Server
      Simplex.Messaging.Server.CLI
+      Simplex.Messaging.Server.Control
      Simplex.Messaging.Server.Env.STM
      Simplex.Messaging.Server.Expiration
      Simplex.Messaging.Server.Main
@@ -121,22 +146,35 @@ library
      Simplex.Messaging.Transport
      Simplex.Messaging.Transport.Buffer
      Simplex.Messaging.Transport.Client
+      Simplex.Messaging.Transport.Credentials
      Simplex.Messaging.Transport.HTTP2
      Simplex.Messaging.Transport.HTTP2.Client
+      Simplex.Messaging.Transport.HTTP2.File
      Simplex.Messaging.Transport.HTTP2.Server
      Simplex.Messaging.Transport.KeepAlive
      Simplex.Messaging.Transport.Server
      Simplex.Messaging.Transport.WebSockets
      Simplex.Messaging.Util
      Simplex.Messaging.Version
+      Simplex.RemoteControl.Client
+      Simplex.RemoteControl.Discovery
+      Simplex.RemoteControl.Discovery.Multicast
+      Simplex.RemoteControl.Invitation
+      Simplex.RemoteControl.Types
  other-modules:
      Paths_simplexmq
  hs-source-dirs:
      src
  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns
+  include-dirs:
+      cbits
+  c-sources:
+      cbits/sha512.c
+      cbits/sntrup761.c
+  extra-libraries:
+      crypto
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -144,27 +182,31 @@ library
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -172,24 +214,28 @@ library
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 executable ntf-server
  main-is: Main.hs
@@ -197,10 +243,9 @@ executable ntf-server
      Paths_simplexmq
  hs-source-dirs:
      apps/ntf-server
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded -rtsopts
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -208,27 +253,31 @@ executable ntf-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -237,24 +286,28 @@ executable ntf-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 executable smp-agent
  main-is: Main.hs
@@ -262,10 +315,9 @@ executable smp-agent
      Paths_simplexmq
  hs-source-dirs:
      apps/smp-agent
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded -rtsopts
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -273,27 +325,31 @@ executable smp-agent
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -302,24 +358,28 @@ executable smp-agent
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 executable smp-server
  main-is: Main.hs
@@ -327,10 +387,9 @@ executable smp-server
      Paths_simplexmq
  hs-source-dirs:
      apps/smp-server
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded -rtsopts
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -338,27 +397,31 @@ executable smp-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -367,24 +430,28 @@ executable smp-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 executable xftp
  main-is: Main.hs
@@ -392,10 +459,9 @@ executable xftp
      Paths_simplexmq
  hs-source-dirs:
      apps/xftp
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded -rtsopts
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -403,27 +469,31 @@ executable xftp
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -432,24 +502,28 @@ executable xftp
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 executable xftp-server
  main-is: Main.hs
@@ -457,10 +531,9 @@ executable xftp-server
      Paths_simplexmq
  hs-source-dirs:
      apps/xftp-server
-  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded
+  ghc-options: -Wall -Wcompat -Werror=incomplete-patterns -Wredundant-constraints -Wincomplete-record-updates -Wincomplete-uni-patterns -Wunused-type-patterns -threaded -rtsopts
  build-depends:
-      QuickCheck ==2.14.*
-    , aeson ==2.0.*
+      aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -468,27 +541,31 @@ executable xftp-server
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
+    , hourglass ==0.2.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -497,24 +574,28 @@ executable xftp-server
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3

 test-suite simplexmq-test
  type: exitcode-stdio-1.0
@@ -529,14 +610,18 @@ test-suite simplexmq-test
      AgentTests.SchemaDump
      AgentTests.SQLiteTests
      CLITests
+      CoreTests.BatchingTests
+      CoreTests.CryptoFileTests
      CoreTests.CryptoTests
      CoreTests.EncodingTests
      CoreTests.ProtocolErrorTests
      CoreTests.RetryIntervalTests
+      CoreTests.UtilTests
      CoreTests.VersionRangeTests
      FileDescriptionTests
      NtfClient
      NtfServerTests
+      RemoteControl
      ServerTests
      SMPAgentClient
      SMPClient
@@ -551,7 +636,7 @@ test-suite simplexmq-test
  build-depends:
      HUnit ==1.6.*
    , QuickCheck ==2.14.*
-    , aeson ==2.0.*
+    , aeson ==2.2.*
    , ansi-terminal >=0.10 && <0.12
    , asn1-encoding ==0.9.*
    , asn1-types ==0.3.*
@@ -559,31 +644,36 @@ test-suite simplexmq-test
    , attoparsec ==0.14.*
    , base >=4.14 && <5
    , base64-bytestring >=1.0 && <1.3
-    , bytestring ==0.10.*
    , case-insensitive ==1.2.*
    , composition ==1.0.*
    , constraints >=0.12 && <0.14
    , containers ==0.6.*
-    , cryptonite >=0.27 && <0.30
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
    , data-default ==0.7.*
    , deepseq ==1.4.*
    , direct-sqlcipher ==2.3.*
    , directory ==1.3.*
    , filepath ==1.4.*
-    , generic-random >=1.3 && <1.5
-    , hspec ==2.7.*
-    , hspec-core ==2.7.*
+    , generic-random ==1.5.*
+    , hourglass ==0.2.*
+    , hspec ==2.11.*
+    , hspec-core ==2.11.*
    , http-types ==0.12.*
-    , http2 ==4.1.*
+    , http2 >=4.2.2 && <4.3
    , ini ==0.4.1
    , iproute ==1.7.*
    , iso8601-time ==0.1.*
    , main-tester ==0.2.*
-    , memory ==0.15.*
-    , mtl ==2.2.*
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
    , network >=3.1.2.7 && <3.2
-    , network-transport ==0.5.4
+    , network-info ==0.2.*
+    , network-transport ==0.5.6
+    , network-udp ==0.0.*
    , optparse-applicative >=0.15 && <0.17
    , process ==1.6.*
    , random >=1.1 && <1.3
@@ -593,22 +683,26 @@ test-suite simplexmq-test
    , socks ==0.6.*
    , sqlcipher-simple ==0.4.*
    , stm ==2.5.*
-    , template-haskell ==2.16.*
    , temporary ==1.3.*
-    , text ==1.2.*
-    , time ==1.9.*
-    , time-compat ==1.9.*
+    , time ==1.12.*
    , time-manager ==0.0.*
    , timeit ==2.0.*
-    , tls >=1.6.0 && <1.7
-    , transformers ==0.5.*
+    , tls >=1.7.0 && <1.8
+    , transformers ==0.6.*
    , unliftio ==0.2.*
    , unliftio-core ==0.2.*
    , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
    , yaml ==0.11.*
  default-language: Haskell2010
  if flag(swift)
    cpp-options: -DswiftJSON
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , template-haskell ==2.20.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , template-haskell ==2.16.*
+      , text >=1.2.3.0 && <1.3
@@ -1,14 +0,0 @@
-module Simplex.FileTransfer where
-
-- TODO
-- Protocol
-- Store (in memory storage)
-- StoreLog (append only log)
-- FileDescription
-- Server
-- Client
-- Server/Main (server CLI)
-- Client/Main (client CLI)
--
-- Transport for HTTP2 ?
-- streaming Crypto
@@ -7,39 +7,32 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
+{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Agent
-  ( startWorkers,
+  ( startXFTPWorkers,
    closeXFTPAgent,
    toFSFilePath,
    -- Receiving files
-    receiveFile,
-    deleteRcvFile,
+    xftpReceiveFile',
+    xftpDeleteRcvFile',
    -- Sending files
-    sendFileExperimental,
-    sendFile,
+    xftpSendFile',
    deleteSndFileInternal,
    deleteSndFileRemote,
  )
 where

-import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple (logError)
 import Control.Monad
 import Control.Monad.Except
 import Control.Monad.Reader
-import Crypto.Random (ChaChaDRG, randomBytesGenerate)
-import Data.Bifunctor (first)
-import Data.ByteString (ByteString)
-import qualified Data.ByteString.Base64.URL as U
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Composition ((.:))
 import Data.Int (Int64)
-import Data.List (foldl', isSuffixOf, partition, sortOn)
-import Data.List.NonEmpty (nonEmpty)
+import Data.List (foldl', sortOn)
 import qualified Data.List.NonEmpty as L
 import Data.Map (Map)
 import qualified Data.Map.Strict as M
@@ -50,7 +43,7 @@ import Simplex.FileTransfer.Client (XFTPChunkSpec (..))
 import Simplex.FileTransfer.Client.Main
 import Simplex.FileTransfer.Crypto
 import Simplex.FileTransfer.Description
-import Simplex.FileTransfer.Protocol (FileParty (..), FilePartyI, SFileParty (..))
+import Simplex.FileTransfer.Protocol (FileParty (..), SFileParty (..))
 import Simplex.FileTransfer.Transport (XFTPRcvChunkSpec (..))
 import Simplex.FileTransfer.Types
 import Simplex.FileTransfer.Util (removePath, uniqueCombine)
@@ -60,58 +53,52 @@ import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Agent.Store.SQLite
 import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.File (CryptoFile (..), CryptoFileArgs)
+import qualified Simplex.Messaging.Crypto.File as CF
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
-import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (EntityId, XFTPServer, XFTPServerWithAuth)
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (liftError, liftIOEither, tshow, unlessM, whenM)
+import Simplex.Messaging.Protocol (EntityId, XFTPServer)
+import Simplex.Messaging.Util (liftError, tshow, unlessM, whenM)
 import System.FilePath (takeFileName, (</>))
 import UnliftIO
-import UnliftIO.Concurrent
 import UnliftIO.Directory
-import qualified UnliftIO.Exception as E

-startWorkers :: AgentMonad m => AgentClient -> Maybe FilePath -> m ()
-startWorkers c workDir = do
+startXFTPWorkers :: AgentMonad m => AgentClient -> Maybe FilePath -> m ()
+startXFTPWorkers c workDir = do
  wd <- asks $ xftpWorkDir . xftpAgent
  atomically $ writeTVar wd workDir
-  startRcvFiles
-  startSndFiles
-  startDelFiles
+  cfg <- asks config
+  startRcvFiles cfg
+  startSndFiles cfg
+  startDelFiles cfg
  where
-    startRcvFiles = do
-      rcvFilesTTL <- asks $ rcvFilesTTL . config
+    startRcvFiles AgentConfig {rcvFilesTTL} = do
      pendingRcvServers <- withStore' c (`getPendingRcvFilesServers` rcvFilesTTL)
-      forM_ pendingRcvServers $ \s -> addXFTPRcvWorker c (Just s)
+      forM_ pendingRcvServers $ \s -> resumeXFTPRcvWork c (Just s)
      -- start local worker for files pending decryption,
      -- no need to make an extra query for the check
      -- as the worker will check the store anyway
-      addXFTPRcvWorker c Nothing
-    startSndFiles = do
-      sndFilesTTL <- asks $ sndFilesTTL . config
+      resumeXFTPRcvWork c Nothing
+    startSndFiles AgentConfig {sndFilesTTL} = do
      -- start worker for files pending encryption/creation
-      addXFTPSndWorker c Nothing
+      resumeXFTPSndWork c Nothing
      pendingSndServers <- withStore' c (`getPendingSndFilesServers` sndFilesTTL)
-      forM_ pendingSndServers $ \s -> addXFTPSndWorker c (Just s)
-    startDelFiles = do
-      rcvFilesTTL <- asks $ rcvFilesTTL . config
+      forM_ pendingSndServers $ \s -> resumeXFTPSndWork c (Just s)
+    startDelFiles AgentConfig {rcvFilesTTL} = do
      pendingDelServers <- withStore' c (`getPendingDelFilesServers` rcvFilesTTL)
-      forM_ pendingDelServers $ addXFTPDelWorker c
+      forM_ pendingDelServers $ resumeXFTPDelWork c

 closeXFTPAgent :: MonadUnliftIO m => XFTPAgent -> m ()
-closeXFTPAgent XFTPAgent {xftpRcvWorkers, xftpSndWorkers} = do
-  stopWorkers xftpRcvWorkers
-  stopWorkers xftpSndWorkers
+closeXFTPAgent a = do
+  stopWorkers $ xftpRcvWorkers a
+  stopWorkers $ xftpSndWorkers a
+  stopWorkers $ xftpDelWorkers a
  where
-    stopWorkers wsSel = do
-      ws <- atomically $ stateTVar wsSel (,M.empty)
-      mapM_ (uninterruptibleCancel . snd) ws
+    stopWorkers workers = atomically (swapTVar workers M.empty) >>= mapM_ (liftIO . cancelWorker)

-receiveFile :: AgentMonad m => AgentClient -> UserId -> ValidFileDescription 'FRecipient -> m RcvFileId
-receiveFile c userId (ValidFileDescription fd@FileDescription {chunks}) = do
-  g <- asks idsDrg
+xftpReceiveFile' :: AgentMonad m => AgentClient -> UserId -> ValidFileDescription 'FRecipient -> Maybe CryptoFileArgs -> m RcvFileId
+xftpReceiveFile' c userId (ValidFileDescription fd@FileDescription {chunks}) cfArgs = do
+  g <- asks random
  prefixPath <- getPrefixPath "rcv.xftp"
  createDirectory prefixPath
  let relPrefixPath = takeFileName prefixPath
@@ -119,13 +106,14 @@ receiveFile c userId (ValidFileDescription fd@FileDescription {chunks}) = do
      relSavePath = relPrefixPath </> "xftp.decrypted"
  createDirectory =<< toFSFilePath relTmpPath
  createEmptyFile =<< toFSFilePath relSavePath
-  fId <- withStore c $ \db -> createRcvFile db g userId fd relPrefixPath relTmpPath relSavePath
+  let saveFile = CryptoFile relSavePath cfArgs
+  fId <- withStore c $ \db -> createRcvFile db g userId fd relPrefixPath relTmpPath saveFile
  forM_ chunks downloadChunk
  pure fId
  where
    downloadChunk :: AgentMonad m => FileChunk -> m ()
    downloadChunk FileChunk {replicas = (FileChunkReplica {server} : _)} = do
-      addXFTPRcvWorker c (Just server)
+      void $ getXFTPRcvWorker True c (Just server)
    downloadChunk _ = throwError $ INTERNAL "no replicas"

 getPrefixPath :: AgentMonad m => String -> m FilePath
@@ -139,59 +127,37 @@ toFSFilePath :: AgentMonad m => FilePath -> m FilePath
 toFSFilePath f = (</> f) <$> getXFTPWorkPath

 createEmptyFile :: AgentMonad m => FilePath -> m ()
-createEmptyFile fPath = do
-  h <- openFile fPath AppendMode
-  liftIO $ B.hPut h "" >> hFlush h
+createEmptyFile fPath = liftIO $ B.writeFile fPath ""

-addXFTPRcvWorker :: AgentMonad m => AgentClient -> Maybe XFTPServer -> m ()
-addXFTPRcvWorker c = addWorker c xftpRcvWorkers runXFTPRcvWorker runXFTPRcvLocalWorker
+resumeXFTPRcvWork :: AgentMonad' m => AgentClient -> Maybe XFTPServer -> m ()
+resumeXFTPRcvWork = void .: getXFTPRcvWorker False

-addWorker ::
-  AgentMonad m =>
-  AgentClient ->
-  (XFTPAgent -> TMap (Maybe XFTPServer) (TMVar (), Async ())) ->
-  (AgentClient -> XFTPServer -> TMVar () -> m ()) ->
-  (AgentClient -> TMVar () -> m ()) ->
-  Maybe XFTPServer ->
-  m ()
-addWorker c wsSel runWorker runWorkerNoSrv srv_ = do
-  ws <- asks $ wsSel . xftpAgent
-  atomically (TM.lookup srv_ ws) >>= \case
-    Nothing -> do
-      doWork <- newTMVarIO ()
-      let runWorker' = case srv_ of
-            Just srv -> runWorker c srv doWork
-            Nothing -> runWorkerNoSrv c doWork
-      worker <- async $ runWorker' `E.finally` atomically (TM.delete srv_ ws)
-      atomically $ TM.insert srv_ (doWork, worker) ws
-    Just (doWork, _) ->
-      void . atomically $ tryPutTMVar doWork ()
+getXFTPRcvWorker :: AgentMonad' m => Bool -> AgentClient -> Maybe XFTPServer -> m Worker
+getXFTPRcvWorker hasWork c server = do
+  ws <- asks $ xftpRcvWorkers . xftpAgent
+  getAgentWorker "xftp_rcv" hasWork c server ws $
+    maybe (runXFTPRcvLocalWorker c) (runXFTPRcvWorker c) server

-runXFTPRcvWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
-runXFTPRcvWorker c srv doWork = do
+runXFTPRcvWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> Worker -> m ()
+runXFTPRcvWorker c srv Worker {doWork} = do
+  cfg <- asks config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation
+    runXFTPOperation cfg
  where
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    runXFTPOperation :: m ()
-    runXFTPOperation = do
-      rcvFilesTTL <- asks (rcvFilesTTL . config)
-      nextChunk <- withStore' c $ \db -> getNextRcvChunkToDownload db srv rcvFilesTTL
-      case nextChunk of
-        Nothing -> noWorkToDo
-        Just RcvFileChunk {rcvFileId, rcvFileEntityId, fileTmpPath, replicas = []} -> rcvWorkerInternalError c rcvFileId rcvFileEntityId (Just fileTmpPath) "chunk has no replicas"
-        Just fc@RcvFileChunk {userId, rcvFileId, rcvFileEntityId, digest, fileTmpPath, replicas = replica@RcvFileChunkReplica {rcvChunkReplicaId, server, delay} : _} -> do
-          ri <- asks $ reconnectInterval . config
+    runXFTPOperation :: AgentConfig -> m ()
+    runXFTPOperation AgentConfig {rcvFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} =
+      withWork c doWork (\db -> getNextRcvChunkToDownload db srv rcvFilesTTL) $ \case
+        RcvFileChunk {rcvFileId, rcvFileEntityId, fileTmpPath, replicas = []} -> rcvWorkerInternalError c rcvFileId rcvFileEntityId (Just fileTmpPath) "chunk has no replicas"
+        fc@RcvFileChunk {userId, rcvFileId, rcvFileEntityId, digest, fileTmpPath, replicas = replica@RcvFileChunkReplica {rcvChunkReplicaId, server, delay} : _} -> do
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryInterval ri' $ \delay' loop ->
+          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop ->
            downloadFileChunk fc replica
-              `catchError` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
+              `catchAgentError` \e -> retryOnError "XFTP rcv worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchError (\_ -> pure ()) $ do
-                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
+              flip catchAgentError (\_ -> pure ()) $ do
                when notifyOnRetry $ notify c rcvFileEntityId $ RFERR e
                closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateRcvChunkReplicaDelay db rcvChunkReplicaId replicaDelay
@@ -205,6 +171,7 @@ runXFTPRcvWorker c srv doWork = do
      let chunkSpec = XFTPRcvChunkSpec chunkPath (unFileSize chunkSize) (unFileDigest digest)
          relChunkPath = fileTmpPath </> takeFileName chunkPath
      agentXFTPDownloadChunk c userId digest replica chunkSpec
+      atomically $ waitUntilForeground c
      (complete, progress) <- withStore c $ \db -> runExceptT $ do
        liftIO $ updateRcvFileChunkReceived db (rcvChunkReplicaId replica) rcvChunkId relChunkPath
        RcvFile {size = FileSize total, chunks} <- ExceptT $ getRcvFile db rcvFileId
@@ -213,7 +180,8 @@ runXFTPRcvWorker c srv doWork = do
        liftIO . when complete $ updateRcvFileStatus db rcvFileId RFSReceived
        pure (complete, RFPROG rcvd total)
      notify c rcvFileEntityId progress
-      when complete $ addXFTPRcvWorker c Nothing
+      when complete . void $
+        getXFTPRcvWorker True c Nothing
      where
        receivedSize :: [RcvFileChunk] -> Int64
        receivedSize = foldl' (\sz ch -> sz + receivedChunkSize ch) 0
@@ -222,6 +190,12 @@ runXFTPRcvWorker c srv doWork = do
          | otherwise = 0
        chunkReceived RcvFileChunk {replicas} = any received replicas

+-- The first call of action has n == 0, maxN is max number of retries
+withRetryIntervalLimit :: forall m. MonadIO m => Int -> RetryInterval -> (Int64 -> m () -> m ()) -> m ()
+withRetryIntervalLimit maxN ri action =
+  withRetryIntervalCount ri $ \n delay loop ->
+    when (n < maxN) $ action delay loop
+
 retryOnError :: AgentMonad m => Text -> m a -> m a -> AgentErrorType -> m a
 retryOnError name loop done e = do
  logError $ name <> " error: " <> tshow e
@@ -235,33 +209,33 @@ rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath internalErrStr = do
  withStore' c $ \db -> updateRcvFileError db rcvFileId internalErrStr
  notify c rcvFileEntityId $ RFERR $ INTERNAL internalErrStr

-runXFTPRcvLocalWorker :: forall m. AgentMonad m => AgentClient -> TMVar () -> m ()
-runXFTPRcvLocalWorker c doWork = do
+runXFTPRcvLocalWorker :: forall m. AgentMonad m => AgentClient -> Worker -> m ()
+runXFTPRcvLocalWorker c Worker {doWork} = do
+  cfg <- asks config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation
+    runXFTPOperation cfg
  where
-    runXFTPOperation :: m ()
-    runXFTPOperation = do
-      rcvFilesTTL <- asks (rcvFilesTTL . config)
-      nextFile <- withStore' c (`getNextRcvFileToDecrypt` rcvFilesTTL)
-      case nextFile of
-        Nothing -> noWorkToDo
-        Just f@RcvFile {rcvFileId, rcvFileEntityId, tmpPath} ->
-          decryptFile f `catchError` (rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath . show)
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
+    runXFTPOperation :: AgentConfig -> m ()
+    runXFTPOperation AgentConfig {rcvFilesTTL} =
+      withWork c doWork (`getNextRcvFileToDecrypt` rcvFilesTTL) $
+        \f@RcvFile {rcvFileId, rcvFileEntityId, tmpPath} ->
+          decryptFile f `catchAgentError` (rcvWorkerInternalError c rcvFileId rcvFileEntityId tmpPath . show)
    decryptFile :: RcvFile -> m ()
-    decryptFile RcvFile {rcvFileId, rcvFileEntityId, key, nonce, tmpPath, savePath, status, chunks} = do
+    decryptFile RcvFile {rcvFileId, rcvFileEntityId, key, nonce, tmpPath, saveFile, status, chunks} = do
+      let CryptoFile savePath cfArgs = saveFile
      fsSavePath <- toFSFilePath savePath
      when (status == RFSDecrypting) $
        whenM (doesFileExist fsSavePath) (removeFile fsSavePath >> createEmptyFile fsSavePath)
      withStore' c $ \db -> updateRcvFileStatus db rcvFileId RFSDecrypting
      chunkPaths <- getChunkPaths chunks
      encSize <- liftIO $ foldM (\s path -> (s +) . fromIntegral <$> getFileSize path) 0 chunkPaths
-      void $ liftError (INTERNAL . show) $ decryptChunks encSize chunkPaths key nonce $ \_ -> pure fsSavePath
+      let destFile = CryptoFile fsSavePath cfArgs
+      void $ liftError (INTERNAL . show) $ decryptChunks encSize chunkPaths key nonce $ \_ -> pure destFile
      notify c rcvFileEntityId $ RFDONE fsSavePath
      forM_ tmpPath (removePath <=< toFSFilePath)
+      atomically $ waitUntilForeground c
      withStore' c (`updateRcvFileComplete` rcvFileId)
      where
        getChunkPaths :: [RcvFileChunk] -> m [FilePath]
@@ -273,8 +247,8 @@ runXFTPRcvLocalWorker c doWork = do
        getChunkPaths (RcvFileChunk {chunkTmpPath = Nothing} : _cs) =
          throwError $ INTERNAL "no chunk path"

-deleteRcvFile :: AgentMonad m => AgentClient -> RcvFileId -> m ()
-deleteRcvFile c rcvFileEntityId = do
+xftpDeleteRcvFile' :: AgentMonad m => AgentClient -> RcvFileId -> m ()
+xftpDeleteRcvFile' c rcvFileEntityId = do
  RcvFile {rcvFileId, prefixPath, status} <- withStore c $ \db -> getRcvFileByEntityId db rcvFileEntityId
  if status == RFSComplete || status == RFSError
    then do
@@ -282,129 +256,79 @@ deleteRcvFile c rcvFileEntityId = do
      withStore' c (`deleteRcvFile'` rcvFileId)
    else withStore' c (`updateRcvFileDeleted` rcvFileId)

-sendFileExperimental :: forall m. AgentMonad m => AgentClient -> UserId -> FilePath -> Int -> m SndFileId
-sendFileExperimental c@AgentClient {xftpServers} userId filePath numRecipients = do
-  g <- asks idsDrg
-  sndFileId <- liftIO $ randomId g 12
-  xftpSrvs <- atomically $ TM.lookup userId xftpServers
-  void $ forkIO $ sendCLI sndFileId $ maybe [] L.toList xftpSrvs
-  pure sndFileId
-  where
-    randomId :: TVar ChaChaDRG -> Int -> IO ByteString
-    randomId gVar n = U.encode <$> (atomically . stateTVar gVar $ randomBytesGenerate n)
-    sendCLI :: SndFileId -> [XFTPServerWithAuth] -> m ()
-    sendCLI sndFileId xftpSrvs = do
-      let fileName = takeFileName filePath
-      workPath <- getXFTPWorkPath
-      outputDir <- uniqueCombine workPath $ fileName <> ".descr"
-      createDirectory outputDir
-      let tempPath = workPath </> "snd"
-      createDirectoryIfMissing False tempPath
-      runSend fileName outputDir tempPath `catchError` \e -> do
-        cleanup outputDir tempPath
-        notify c sndFileId $ SFERR e
-      where
-        runSend :: String -> FilePath -> FilePath -> m ()
-        runSend fileName outputDir tempPath = do
-          let sendOptions =
-                SendOptions
-                  { filePath,
-                    outputDir = Just outputDir,
-                    numRecipients,
-                    xftpServers = xftpSrvs,
-                    retryCount = 3,
-                    tempPath = Just tempPath,
-                    verbose = False
-                  }
-          liftCLI $ cliSendFileOpts sendOptions False $ notify c sndFileId .: SFPROG
-          (sndDescr, rcvDescrs) <- readDescrs outputDir fileName
-          cleanup outputDir tempPath
-          notify c sndFileId $ SFDONE sndDescr rcvDescrs
-        cleanup :: FilePath -> FilePath -> m ()
-        cleanup outputDir tempPath = do
-          removePath tempPath
-          removePath outputDir
-    liftCLI :: ExceptT CLIError IO () -> m ()
-    liftCLI = either (throwError . INTERNAL . show) pure <=< liftIO . runExceptT
-    readDescrs :: FilePath -> FilePath -> m (ValidFileDescription 'FSender, [ValidFileDescription 'FRecipient])
-    readDescrs outDir fileName = do
-      let descrDir = outDir </> (fileName <> ".xftp")
-      files <- listDirectory descrDir
-      let (sdFiles, rdFiles) = partition ("snd.xftp.private" `isSuffixOf`) files
-          sdFile = maybe "" (\l -> descrDir </> L.head l) (nonEmpty sdFiles)
-          rdFiles' = map (descrDir </>) rdFiles
-      (,) <$> readDescr sdFile <*> mapM readDescr rdFiles'
-    readDescr :: FilePartyI p => FilePath -> m (ValidFileDescription p)
-    readDescr f = liftIOEither $ first INTERNAL . strDecode <$> B.readFile f
-
 notify :: forall m e. (MonadUnliftIO m, AEntityI e) => AgentClient -> EntityId -> ACommand 'Agent e -> m ()
 notify c entId cmd = atomically $ writeTBQueue (subQ c) ("", entId, APC (sAEntity @e) cmd)

-sendFile :: AgentMonad m => AgentClient -> UserId -> FilePath -> Int -> m SndFileId
-sendFile c userId filePath numRecipients = do
-  g <- asks idsDrg
+xftpSendFile' :: AgentMonad m => AgentClient -> UserId -> CryptoFile -> Int -> m SndFileId
+xftpSendFile' c userId file numRecipients = do
+  g <- asks random
  prefixPath <- getPrefixPath "snd.xftp"
  createDirectory prefixPath
  let relPrefixPath = takeFileName prefixPath
-  key <- liftIO C.randomSbKey
-  nonce <- liftIO C.randomCbNonce
+  key <- atomically $ C.randomSbKey g
+  nonce <- atomically $ C.randomCbNonce g
  -- saving absolute filePath will not allow to restore file encryption after app update, but it's a short window
-  fId <- withStore c $ \db -> createSndFile db g userId numRecipients filePath relPrefixPath key nonce
-  addXFTPSndWorker c Nothing
+  fId <- withStore c $ \db -> createSndFile db g userId file numRecipients relPrefixPath key nonce
+  void $ getXFTPSndWorker True c Nothing
  pure fId

-addXFTPSndWorker :: AgentMonad m => AgentClient -> Maybe XFTPServer -> m ()
-addXFTPSndWorker c = addWorker c xftpSndWorkers runXFTPSndWorker runXFTPSndPrepareWorker
+resumeXFTPSndWork :: AgentMonad' m => AgentClient -> Maybe XFTPServer -> m ()
+resumeXFTPSndWork = void .: getXFTPSndWorker False

-runXFTPSndPrepareWorker :: forall m. AgentMonad m => AgentClient -> TMVar () -> m ()
-runXFTPSndPrepareWorker c doWork = do
+getXFTPSndWorker :: AgentMonad' m => Bool -> AgentClient -> Maybe XFTPServer -> m Worker
+getXFTPSndWorker hasWork c server = do
+  ws <- asks $ xftpSndWorkers . xftpAgent
+  getAgentWorker "xftp_snd" hasWork c server ws $
+    maybe (runXFTPSndPrepareWorker c) (runXFTPSndWorker c) server
+
+runXFTPSndPrepareWorker :: forall m. AgentMonad m => AgentClient -> Worker -> m ()
+runXFTPSndPrepareWorker c Worker {doWork} = do
+  cfg <- asks config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation
+    runXFTPOperation cfg
  where
-    runXFTPOperation :: m ()
-    runXFTPOperation = do
-      sndFilesTTL <- asks (sndFilesTTL . config)
-      nextFile <- withStore' c (`getNextSndFileToPrepare` sndFilesTTL)
-      case nextFile of
-        Nothing -> noWorkToDo
-        Just f@SndFile {sndFileId, sndFileEntityId, prefixPath} ->
-          prepareFile f `catchError` (sndWorkerInternalError c sndFileId sndFileEntityId prefixPath . show)
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    prepareFile :: SndFile -> m ()
-    prepareFile SndFile {prefixPath = Nothing} =
+    runXFTPOperation :: AgentConfig -> m ()
+    runXFTPOperation cfg@AgentConfig {sndFilesTTL} =
+      withWork c doWork (`getNextSndFileToPrepare` sndFilesTTL) $
+        \f@SndFile {sndFileId, sndFileEntityId, prefixPath} ->
+          prepareFile cfg f `catchAgentError` (sndWorkerInternalError c sndFileId sndFileEntityId prefixPath . show)
+    prepareFile :: AgentConfig -> SndFile -> m ()
+    prepareFile _ SndFile {prefixPath = Nothing} =
      throwError $ INTERNAL "no prefix path"
-    prepareFile sndFile@SndFile {sndFileId, userId, prefixPath = Just ppath, status} = do
+    prepareFile cfg sndFile@SndFile {sndFileId, userId, prefixPath = Just ppath, status} = do
      SndFile {numRecipients, chunks} <-
        if status /= SFSEncrypted -- status is SFSNew or SFSEncrypting
          then do
            fsEncPath <- toFSFilePath $ sndFileEncPath ppath
-            when (status == SFSEncrypting) $
-              whenM (doesFileExist fsEncPath) $ removeFile fsEncPath
+            when (status == SFSEncrypting) . whenM (doesFileExist fsEncPath) $
+              removeFile fsEncPath
            withStore' c $ \db -> updateSndFileStatus db sndFileId SFSEncrypting
            (digest, chunkSpecsDigests) <- encryptFileForUpload sndFile fsEncPath
            withStore c $ \db -> do
              updateSndFileEncrypted db sndFileId digest chunkSpecsDigests
              getSndFile db sndFileId
          else pure sndFile
-      maxRecipients <- asks (xftpMaxRecipientsPerRequest . config)
      let numRecipients' = min numRecipients maxRecipients
      -- concurrently?
+      -- separate worker to create chunks? record retries and delay on snd_file_chunks?
      forM_ (filter (not . chunkCreated) chunks) $ createChunk numRecipients'
      withStore' c $ \db -> updateSndFileStatus db sndFileId SFSUploading
      where
+        AgentConfig {xftpMaxRecipientsPerRequest = maxRecipients, messageRetryInterval = ri} = cfg
        encryptFileForUpload :: SndFile -> FilePath -> m (FileDigest, [(XFTPChunkSpec, FileDigest)])
-        encryptFileForUpload SndFile {key, nonce, filePath} fsEncPath = do
-          let fileName = takeFileName filePath
-          fileSize <- fromInteger <$> getFileSize filePath
+        encryptFileForUpload SndFile {key, nonce, srcFile} fsEncPath = do
+          let CryptoFile {filePath} = srcFile
+              fileName = takeFileName filePath
+          fileSize <- liftIO $ fromInteger <$> CF.getFileContentsSize srcFile
          when (fileSize > maxFileSize) $ throwError $ INTERNAL "max file size exceeded"
          let fileHdr = smpEncode FileHeader {fileName, fileExtra = Nothing}
              fileSize' = fromIntegral (B.length fileHdr) + fileSize
              chunkSizes = prepareChunkSizes $ fileSize' + fileSizeLen + authTagSize
              chunkSizes' = map fromIntegral chunkSizes
              encSize = sum chunkSizes'
-          void $ liftError (INTERNAL . show) $ encryptFile filePath fileHdr key nonce fileSize' encSize fsEncPath
+          void $ liftError (INTERNAL . show) $ encryptFile srcFile fileHdr key nonce fileSize' encSize fsEncPath
          digest <- liftIO $ LC.sha512Hash <$> LB.readFile fsEncPath
          let chunkSpecs = prepareChunkSpecs fsEncPath chunkSizes
          chunkDigests <- map FileDigest <$> mapM (liftIO . getChunkDigest) chunkSpecs
@@ -417,14 +341,13 @@ runXFTPSndPrepareWorker c doWork = do
          atomically $ assertAgentForeground c
          (replica, ProtoServerWithAuth srv _) <- tryCreate
          withStore' c $ \db -> createSndFileReplica db ch replica
-          addXFTPSndWorker c $ Just srv
+          void $ getXFTPSndWorker True c (Just srv)
          where
            tryCreate = do
-              ri <- asks $ messageRetryInterval . config
              usedSrvs <- newTVarIO ([] :: [XFTPServer])
              withRetryInterval (riFast ri) $ \_ loop ->
                createWithNextSrv usedSrvs
-                  `catchError` \e -> retryOnError "XFTP prepare worker" (retryLoop loop) (throwError e) e
+                  `catchAgentError` \e -> retryOnError "XFTP prepare worker" (retryLoop loop) (throwError e) e
              where
                retryLoop loop = atomically (assertAgentForeground c) >> loop
            createWithNextSrv usedSrvs = do
@@ -440,45 +363,41 @@ sndWorkerInternalError c sndFileId sndFileEntityId prefixPath internalErrStr = d
  withStore' c $ \db -> updateSndFileError db sndFileId internalErrStr
  notify c sndFileEntityId $ SFERR $ INTERNAL internalErrStr

-runXFTPSndWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
-runXFTPSndWorker c srv doWork = do
+runXFTPSndWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> Worker -> m ()
+runXFTPSndWorker c srv Worker {doWork} = do
+  cfg <- asks config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation
+    runXFTPOperation cfg
  where
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    runXFTPOperation :: m ()
-    runXFTPOperation = do
-      sndFilesTTL <- asks (sndFilesTTL . config)
-      nextChunk <- withStore' c $ \db -> getNextSndChunkToUpload db srv sndFilesTTL
-      case nextChunk of
-        Nothing -> noWorkToDo
-        Just SndFileChunk {sndFileId, sndFileEntityId, filePrefixPath, replicas = []} -> sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) "chunk has no replicas"
-        Just fc@SndFileChunk {userId, sndFileId, sndFileEntityId, filePrefixPath, digest, replicas = replica@SndFileChunkReplica {sndChunkReplicaId, server, delay} : _} -> do
-          ri <- asks $ reconnectInterval . config
+    runXFTPOperation :: AgentConfig -> m ()
+    runXFTPOperation cfg@AgentConfig {sndFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} = do
+      withWork c doWork (\db -> getNextSndChunkToUpload db srv sndFilesTTL) $ \case
+        SndFileChunk {sndFileId, sndFileEntityId, filePrefixPath, replicas = []} -> sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) "chunk has no replicas"
+        fc@SndFileChunk {userId, sndFileId, sndFileEntityId, filePrefixPath, digest, replicas = replica@SndFileChunkReplica {sndChunkReplicaId, server, delay} : _} -> do
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryInterval ri' $ \delay' loop ->
-            uploadFileChunk fc replica
-              `catchError` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
+          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop ->
+            uploadFileChunk cfg fc replica
+              `catchAgentError` \e -> retryOnError "XFTP snd worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchError (\_ -> pure ()) $ do
-                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
+              flip catchAgentError (\_ -> pure ()) $ do
                when notifyOnRetry $ notify c sndFileEntityId $ SFERR e
                closeXFTPServerClient c userId server digest
                withStore' c $ \db -> updateSndChunkReplicaDelay db sndChunkReplicaId replicaDelay
              atomically $ assertAgentForeground c
              loop
            retryDone e = sndWorkerInternalError c sndFileId sndFileEntityId (Just filePrefixPath) (show e)
-    uploadFileChunk :: SndFileChunk -> SndFileChunkReplica -> m ()
-    uploadFileChunk sndFileChunk@SndFileChunk {sndFileId, userId, chunkSpec = chunkSpec@XFTPChunkSpec {filePath}, digest = chunkDigest} replica = do
+    uploadFileChunk :: AgentConfig -> SndFileChunk -> SndFileChunkReplica -> m ()
+    uploadFileChunk AgentConfig {xftpMaxRecipientsPerRequest = maxRecipients} sndFileChunk@SndFileChunk {sndFileId, userId, chunkSpec = chunkSpec@XFTPChunkSpec {filePath}, digest = chunkDigest} replica = do
      replica'@SndFileChunkReplica {sndChunkReplicaId} <- addRecipients sndFileChunk replica
      fsFilePath <- toFSFilePath filePath
      unlessM (doesFileExist fsFilePath) $ throwError $ INTERNAL "encrypted file doesn't exist on upload"
      let chunkSpec' = chunkSpec {filePath = fsFilePath} :: XFTPChunkSpec
      atomically $ assertAgentForeground c
      agentXFTPUploadChunk c userId chunkDigest replica' chunkSpec'
+      atomically $ waitUntilForeground c
      sf@SndFile {sndFileEntityId, prefixPath, chunks} <- withStore c $ \db -> do
        updateSndChunkReplicaStatus db sndChunkReplicaId SFRSUploaded
        getSndFile db sndFileId
@@ -497,11 +416,10 @@ runXFTPSndWorker c srv doWork = do
          | length rcvIdsKeys > numRecipients = throwError $ INTERNAL "too many recipients"
          | length rcvIdsKeys == numRecipients = pure cr
          | otherwise = do
-            maxRecipients <- asks $ xftpMaxRecipientsPerRequest . config
-            let numRecipients' = min (numRecipients - length rcvIdsKeys) maxRecipients
-            rcvIdsKeys' <- agentXFTPAddRecipients c userId chunkDigest cr numRecipients'
-            cr' <- withStore' c $ \db -> addSndChunkReplicaRecipients db cr $ L.toList rcvIdsKeys'
-            addRecipients ch cr'
+              let numRecipients' = min (numRecipients - length rcvIdsKeys) maxRecipients
+              rcvIdsKeys' <- agentXFTPAddRecipients c userId chunkDigest cr numRecipients'
+              cr' <- withStore' c $ \db -> addSndChunkReplicaRecipients db cr $ L.toList rcvIdsKeys'
+              addRecipients ch cr'
        sndFileToDescrs :: SndFile -> m (ValidFileDescription 'FSender, [ValidFileDescription 'FRecipient])
        sndFileToDescrs SndFile {digest = Nothing} = throwError $ INTERNAL "snd file has no digest"
        sndFileToDescrs SndFile {chunks = []} = throwError $ INTERNAL "snd file has no chunks"
@@ -542,7 +460,7 @@ runXFTPSndWorker c srv doWork = do
            rcvChunks :: [[FileChunk]]
            rcvChunks = map (sortChunks . M.elems) $ M.elems $ foldl' addRcvChunk M.empty rcvReplicas
            sortChunks :: [FileChunk] -> [FileChunk]
-            sortChunks = map reverseReplicas . sortOn (chunkNo :: FileChunk -> Int)
+            sortChunks = map reverseReplicas . sortOn (\FileChunk {chunkNo} -> chunkNo)
            reverseReplicas ch@FileChunk {replicas} = (ch :: FileChunk) {replicas = reverse replicas}
            addRcvChunk :: Map Int (Map Int FileChunk) -> SentRecipientReplica -> Map Int (Map Int FileChunk)
            addRcvChunk m SentRecipientReplica {chunkNo, server, rcvNo, replicaId, replicaKey, digest, chunkSize} =
@@ -579,61 +497,53 @@ deleteSndFileInternal c sndFileEntityId = do

 deleteSndFileRemote :: forall m. AgentMonad m => AgentClient -> UserId -> SndFileId -> ValidFileDescription 'FSender -> m ()
 deleteSndFileRemote c userId sndFileEntityId (ValidFileDescription FileDescription {chunks}) = do
-  deleteSndFileInternal c sndFileEntityId `catchError` (notify c sndFileEntityId . SFERR)
-  forM_ chunks $ \ch -> deleteFileChunk ch `catchError` (notify c sndFileEntityId . SFERR)
+  deleteSndFileInternal c sndFileEntityId `catchAgentError` (notify c sndFileEntityId . SFERR)
+  forM_ chunks $ \ch -> deleteFileChunk ch `catchAgentError` (notify c sndFileEntityId . SFERR)
  where
    deleteFileChunk :: FileChunk -> m ()
    deleteFileChunk FileChunk {digest, replicas = replica@FileChunkReplica {server} : _} = do
      withStore' c $ \db -> createDeletedSndChunkReplica db userId replica digest
-      addXFTPDelWorker c server
+      void $ getXFTPDelWorker True c server
    deleteFileChunk _ = pure ()

-addXFTPDelWorker :: AgentMonad m => AgentClient -> XFTPServer -> m ()
-addXFTPDelWorker c srv = do
-  ws <- asks $ xftpDelWorkers . xftpAgent
-  atomically (TM.lookup srv ws) >>= \case
-    Nothing -> do
-      doWork <- newTMVarIO ()
-      worker <- async $ runXFTPDelWorker c srv doWork `E.finally` atomically (TM.delete srv ws)
-      atomically $ TM.insert srv (doWork, worker) ws
-    Just (doWork, _) ->
-      void . atomically $ tryPutTMVar doWork ()
+resumeXFTPDelWork :: AgentMonad' m => AgentClient -> XFTPServer -> m ()
+resumeXFTPDelWork = void .: getXFTPDelWorker False

-runXFTPDelWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> TMVar () -> m ()
-runXFTPDelWorker c srv doWork = do
+getXFTPDelWorker :: AgentMonad' m => Bool -> AgentClient -> XFTPServer -> m Worker
+getXFTPDelWorker hasWork c server = do
+  ws <- asks $ xftpDelWorkers . xftpAgent
+  getAgentWorker "xftp_del" hasWork c server ws $ runXFTPDelWorker c server
+
+runXFTPDelWorker :: forall m. AgentMonad m => AgentClient -> XFTPServer -> Worker -> m ()
+runXFTPDelWorker c srv Worker {doWork} = do
+  cfg <- asks config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    atomically $ assertAgentForeground c
-    runXFTPOperation
+    runXFTPOperation cfg
  where
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    runXFTPOperation :: m ()
-    runXFTPOperation = do
+    runXFTPOperation :: AgentConfig -> m ()
+    runXFTPOperation AgentConfig {rcvFilesTTL, reconnectInterval = ri, xftpNotifyErrsOnRetry = notifyOnRetry, xftpConsecutiveRetries} = do
      -- no point in deleting files older than rcv ttl, as they will be expired on server
-      rcvFilesTTL <- asks (rcvFilesTTL . config)
-      nextReplica <- withStore' c $ \db -> getNextDeletedSndChunkReplica db srv rcvFilesTTL
-      case nextReplica of
-        Nothing -> noWorkToDo
-        Just replica@DeletedSndChunkReplica {deletedSndChunkReplicaId, userId, server, chunkDigest, delay} -> do
-          ri <- asks $ reconnectInterval . config
+      withWork c doWork (\db -> getNextDeletedSndChunkReplica db srv rcvFilesTTL) processDeletedReplica
+      where
+        processDeletedReplica replica@DeletedSndChunkReplica {deletedSndChunkReplicaId, userId, server, chunkDigest, delay} = do
          let ri' = maybe ri (\d -> ri {initialInterval = d, increaseAfter = 0}) delay
-          withRetryInterval ri' $ \delay' loop ->
-            deleteChunkReplica replica
-              `catchError` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
+          withRetryIntervalLimit xftpConsecutiveRetries ri' $ \delay' loop ->
+            deleteChunkReplica
+              `catchAgentError` \e -> retryOnError "XFTP del worker" (retryLoop loop e delay') (retryDone e) e
          where
            retryLoop loop e replicaDelay = do
-              flip catchError (\_ -> pure ()) $ do
-                notifyOnRetry <- asks (xftpNotifyErrsOnRetry . config)
+              flip catchAgentError (\_ -> pure ()) $ do
                when notifyOnRetry $ notify c "" $ SFERR e
                closeXFTPServerClient c userId server chunkDigest
                withStore' c $ \db -> updateDeletedSndChunkReplicaDelay db deletedSndChunkReplicaId replicaDelay
              atomically $ assertAgentForeground c
              loop
-            retryDone e = delWorkerInternalError c deletedSndChunkReplicaId e
-    deleteChunkReplica :: DeletedSndChunkReplica -> m ()
-    deleteChunkReplica replica@DeletedSndChunkReplica {userId, deletedSndChunkReplicaId} = do
-      agentXFTPDeleteChunk c userId replica
-      withStore' c $ \db -> deleteDeletedSndChunkReplica db deletedSndChunkReplicaId
+            retryDone = delWorkerInternalError c deletedSndChunkReplicaId
+            deleteChunkReplica = do
+              agentXFTPDeleteChunk c userId replica
+              withStore' c $ \db -> deleteDeletedSndChunkReplica db deletedSndChunkReplicaId

 delWorkerInternalError :: AgentMonad m => AgentClient -> Int64 -> AgentErrorType -> m ()
 delWorkerInternalError c deletedSndChunkReplicaId e = do
@@ -0,0 +1,35 @@
+module Simplex.FileTransfer.Chunks where
+
+import Data.Word (Word32)
+
+serverChunkSizes :: [Word32]
+serverChunkSizes = [chunkSize0, chunkSize1, chunkSize2, chunkSize3]
+{-# INLINE serverChunkSizes #-}
+
+chunkSize0 :: Word32
+chunkSize0 = kb 64
+{-# INLINE chunkSize0 #-}
+
+chunkSize1 :: Word32
+chunkSize1 = kb 256
+{-# INLINE chunkSize1 #-}
+
+chunkSize2 :: Word32
+chunkSize2 = mb 1
+{-# INLINE chunkSize2 #-}
+
+chunkSize3 :: Word32
+chunkSize3 = mb 4
+{-# INLINE chunkSize3 #-}
+
+kb :: Integral a => a -> a
+kb n = 1024 * n
+{-# INLINE kb #-}
+
+mb :: Integral a => a -> a
+mb n = 1024 * kb n
+{-# INLINE mb #-}
+
+gb :: Integral a => a -> a
+gb n = 1024 * mb n
+{-# INLINE gb #-}
@@ -9,7 +9,9 @@

 module Simplex.FileTransfer.Client where

+import Control.Monad
 import Control.Monad.Except
+import Crypto.Random (ChaChaDRG)
 import Data.Bifunctor (first)
 import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
@@ -47,6 +49,7 @@ import Simplex.Messaging.Transport (supportedParameters)
 import Simplex.Messaging.Transport.Client (TransportClientConfig, TransportHost)
 import Simplex.Messaging.Transport.HTTP2
 import Simplex.Messaging.Transport.HTTP2.Client
+import Simplex.Messaging.Transport.HTTP2.File
 import Simplex.Messaging.Util (bshow, liftEitherError, whenM)
 import UnliftIO
 import UnliftIO.Directory
@@ -108,7 +111,7 @@ xftpClientServer = B.unpack . strEncode . snd3 . transportSession
    snd3 (_, s, _) = s

 xftpTransportHost :: XFTPClient -> TransportHost
-xftpTransportHost = (host :: HClient -> TransportHost) . client_ . http2Client
+xftpTransportHost XFTPClient {http2Client = HTTP2Client {client_ = HClient {host}}} = host

 xftpSessionTs :: XFTPClient -> UTCTime
 xftpSessionTs = sessionTs . http2Client
@@ -129,11 +132,15 @@ xftpClientError = \case
  HCIOError e -> PCEIOError e

 sendXFTPCommand :: forall p. FilePartyI p => XFTPClient -> C.APrivateSignKey -> XFTPFileId -> FileCommand p -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
-sendXFTPCommand XFTPClient {config, http2Client = http2@HTTP2Client {sessionId}} pKey fId cmd chunkSpec_ = do
+sendXFTPCommand c@XFTPClient {http2Client = HTTP2Client {sessionId}} pKey fId cmd chunkSpec_ = do
  t <-
    liftEither . first PCETransportError $
      xftpEncodeTransmission sessionId (Just pKey) ("", fId, FileCmd (sFileParty @p) cmd)
-  let req = H.requestStreaming N.methodPost "/" [] $ streamBody t
+  sendXFTPTransmission c t chunkSpec_
+
+sendXFTPTransmission :: XFTPClient -> ByteString -> Maybe XFTPChunkSpec -> ExceptT XFTPClientError IO (FileResponse, HTTP2Body)
+sendXFTPTransmission XFTPClient {config, http2Client = http2@HTTP2Client {sessionId}} t chunkSpec_ = do
+  let req = H.requestStreaming N.methodPost "/" [] streamBody
      reqTimeout = (\XFTPChunkSpec {chunkSize} -> chunkTimeout config chunkSize) <$> chunkSpec_
  HTTP2Response {respBody = body@HTTP2Body {bodyHead}} <- liftEitherError xftpClientError $ sendRequest http2 req reqTimeout
  when (B.length bodyHead /= xftpBlockSize) $ throwError $ PCEResponseError BLOCK
@@ -145,13 +152,13 @@ sendXFTPCommand XFTPClient {config, http2Client = http2@HTTP2Client {sessionId}}
      _ -> pure (r, body)
    Left e -> throwError $ PCEResponseError e
  where
-    streamBody :: ByteString -> (Builder -> IO ()) -> IO () -> IO ()
-    streamBody t send done = do
+    streamBody :: (Builder -> IO ()) -> IO () -> IO ()
+    streamBody send done = do
      send $ byteString t
      forM_ chunkSpec_ $ \XFTPChunkSpec {filePath, chunkOffset, chunkSize} ->
        withFile filePath ReadMode $ \h -> do
          hSeek h AbsoluteSeek $ fromIntegral chunkOffset
-          sendFile h send $ fromIntegral chunkSize
+          hSendFile h send $ fromIntegral chunkSize
      done

 createXFTPChunk ::
@@ -176,9 +183,9 @@ uploadXFTPChunk :: XFTPClient -> C.APrivateSignKey -> XFTPFileId -> XFTPChunkSpe
 uploadXFTPChunk c spKey fId chunkSpec =
  sendXFTPCommand c spKey fId FPUT (Just chunkSpec) >>= okResponse

-downloadXFTPChunk :: XFTPClient -> C.APrivateSignKey -> XFTPFileId -> XFTPRcvChunkSpec -> ExceptT XFTPClientError IO ()
-downloadXFTPChunk c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {filePath, chunkSize} = do
-  (rDhKey, rpDhKey) <- liftIO C.generateKeyPair'
+downloadXFTPChunk :: TVar ChaChaDRG -> XFTPClient -> C.APrivateSignKey -> XFTPFileId -> XFTPRcvChunkSpec -> ExceptT XFTPClientError IO ()
+downloadXFTPChunk g c@XFTPClient {config} rpKey fId chunkSpec@XFTPRcvChunkSpec {filePath, chunkSize} = do
+  (rDhKey, rpDhKey) <- atomically $ C.generateKeyPair g
  sendXFTPCommand c rpKey fId (FGET rDhKey) Nothing >>= \case
    (FRFile sDhKey cbNonce, HTTP2Body {bodyHead = _bg, bodySize = _bs, bodyPart}) -> case bodyPart of
      -- TODO atm bodySize is set to 0, so chunkSize will be incorrect - validate once set
@@ -204,6 +211,16 @@ deleteXFTPChunk c spKey sId = sendXFTPCommand c spKey sId FDEL Nothing >>= okRes
 ackXFTPChunk :: XFTPClient -> C.APrivateSignKey -> RecipientId -> ExceptT XFTPClientError IO ()
 ackXFTPChunk c rpKey rId = sendXFTPCommand c rpKey rId FACK Nothing >>= okResponse

+pingXFTP :: XFTPClient -> ExceptT XFTPClientError IO ()
+pingXFTP c@XFTPClient {http2Client = HTTP2Client {sessionId}} = do
+  t <-
+    liftEither . first PCETransportError $
+      xftpEncodeTransmission sessionId Nothing ("", "", FileCmd SFRecipient PING)
+  (r, _) <- sendXFTPTransmission c t Nothing
+  case r of
+    FRPong -> pure ()
+    _ -> throwError $ PCEUnexpectedResponse $ bshow r
+
 okResponse :: (FileResponse, HTTP2Body) -> ExceptT XFTPClientError IO ()
 okResponse = \case
  (FROk, body) -> noFile body ()
@@ -8,6 +8,7 @@
 module Simplex.FileTransfer.Client.Agent where

 import Control.Logger.Simple (logInfo)
+import Control.Monad
 import Control.Monad.Except
 import Data.Bifunctor (first)
 import qualified Data.ByteString.Char8 as B
@@ -21,7 +22,7 @@ import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtocolServer (..), XFTPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
-import Simplex.Messaging.Util (catchAll_, tryError)
+import Simplex.Messaging.Util (catchAll_)
 import UnliftIO

 type XFTPClientVar = TMVar (Either XFTPClientAgentError XFTPClient)
@@ -8,18 +8,15 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TypeApplications #-}
+{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Client.Main
  ( SendOptions (..),
    CLIError (..),
    xftpClientCLI,
    cliSendFile,
-    cliSendFileOpts,
    prepareChunkSizes,
    prepareChunkSpecs,
-    chunkSize1,
-    chunkSize2,
-    chunkSize3,
    maxFileSize,
    fileSizeLen,
    getChunkDigest,
@@ -27,11 +24,10 @@ module Simplex.FileTransfer.Client.Main
  )
 where

-import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple
 import Control.Monad
 import Control.Monad.Except
-import Crypto.Random (getRandomBytes)
+import Crypto.Random (ChaChaDRG)
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.ByteString.Char8 (ByteString)
@@ -49,6 +45,7 @@ import qualified Data.Text as T
 import Data.Word (Word32)
 import GHC.Records (HasField (getField))
 import Options.Applicative
+import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Client
 import Simplex.FileTransfer.Client.Agent
 import Simplex.FileTransfer.Client.Presets
@@ -59,6 +56,8 @@ import Simplex.FileTransfer.Transport (XFTPRcvChunkSpec (..))
 import Simplex.FileTransfer.Types
 import Simplex.FileTransfer.Util (uniqueCombine)
 import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.File (CryptoFile (..), FTCryptoError (..))
+import qualified Simplex.Messaging.Crypto.File as CF
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String (StrEncoding (..))
@@ -74,16 +73,7 @@ import UnliftIO
 import UnliftIO.Directory

 xftpClientVersion :: String
-xftpClientVersion = "0.1.0"
-
-chunkSize1 :: Word32
-chunkSize1 = kb 256
-
-chunkSize2 :: Word32
-chunkSize2 = mb 1
-
-chunkSize3 :: Word32
-chunkSize3 = mb 4
+xftpClientVersion = "1.0.1"

 maxFileSize :: Int64
 maxFileSize = gb 1
@@ -102,6 +92,7 @@ cliCryptoError = \case
  FTCECryptoError e -> CLIError $ "Error decrypting file: " <> show e
  FTCEInvalidHeader e -> CLIError $ "Invalid file header: " <> e
  FTCEInvalidAuthTag -> CLIError "Error decrypting file: incorrect auth tag"
+  FTCEInvalidFileSize -> CLIError "Error decrypting file: incorrect file size"
  FTCEFileIOError e -> CLIError $ "File IO error: " <> show e

 data CliCommand
@@ -272,10 +263,11 @@ cliSendFileOpts :: SendOptions -> Bool -> (Int64 -> Int64 -> IO ()) -> ExceptT C
 cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, retryCount, tempPath, verbose} printInfo notifyProgress = do
  let (_, fileName) = splitFileName filePath
  liftIO $ when printInfo $ printNoNewLine "Encrypting file..."
-  (encPath, fdRcv, fdSnd, chunkSpecs, encSize) <- encryptFileForUpload fileName
+  g <- liftIO C.newRandom
+  (encPath, fdRcv, fdSnd, chunkSpecs, encSize) <- encryptFileForUpload g fileName
  liftIO $ when printInfo $ printNoNewLine "Uploading file..."
  uploadedChunks <- newTVarIO []
-  sentChunks <- uploadFile chunkSpecs uploadedChunks encSize
+  sentChunks <- uploadFile g chunkSpecs uploadedChunks encSize
  whenM (doesFileExist encPath) $ removeFile encPath
  -- TODO if only small chunks, use different default size
  liftIO $ do
@@ -288,28 +280,29 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
      putStrLn "Pass file descriptions to the recipient(s):"
    forM_ fdRcvPaths putStrLn
  where
-    encryptFileForUpload :: String -> ExceptT CLIError IO (FilePath, FileDescription 'FRecipient, FileDescription 'FSender, [XFTPChunkSpec], Int64)
-    encryptFileForUpload fileName = do
+    encryptFileForUpload :: TVar ChaChaDRG -> String -> ExceptT CLIError IO (FilePath, FileDescription 'FRecipient, FileDescription 'FSender, [XFTPChunkSpec], Int64)
+    encryptFileForUpload g fileName = do
      fileSize <- fromInteger <$> getFileSize filePath
      when (fileSize > maxFileSize) $ throwError $ CLIError $ "Files bigger than " <> maxFileSizeStr <> " are not supported"
      encPath <- getEncPath tempPath "xftp"
-      key <- liftIO C.randomSbKey
-      nonce <- liftIO C.randomCbNonce
+      key <- atomically $ C.randomSbKey g
+      nonce <- atomically $ C.randomCbNonce g
      let fileHdr = smpEncode FileHeader {fileName, fileExtra = Nothing}
          fileSize' = fromIntegral (B.length fileHdr) + fileSize
          chunkSizes = prepareChunkSizes $ fileSize' + fileSizeLen + authTagSize
          defChunkSize = head chunkSizes
          chunkSizes' = map fromIntegral chunkSizes
          encSize = sum chunkSizes'
-      withExceptT (CLIError . show) $ encryptFile filePath fileHdr key nonce fileSize' encSize encPath
+          srcFile = CF.plain filePath
+      withExceptT (CLIError . show) $ encryptFile srcFile fileHdr key nonce fileSize' encSize encPath
      digest <- liftIO $ LC.sha512Hash <$> LB.readFile encPath
      let chunkSpecs = prepareChunkSpecs encPath chunkSizes
          fdRcv = FileDescription {party = SFRecipient, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = []}
          fdSnd = FileDescription {party = SFSender, size = FileSize encSize, digest = FileDigest digest, key, nonce, chunkSize = FileSize defChunkSize, chunks = []}
      logInfo $ "encrypted file to " <> tshow encPath
      pure (encPath, fdRcv, fdSnd, chunkSpecs, encSize)
-    uploadFile :: [XFTPChunkSpec] -> TVar [Int64] -> Int64 -> ExceptT CLIError IO [SentFileChunk]
-    uploadFile chunks uploadedChunks encSize = do
+    uploadFile :: TVar ChaChaDRG -> [XFTPChunkSpec] -> TVar [Int64] -> Int64 -> ExceptT CLIError IO [SentFileChunk]
+    uploadFile g chunks uploadedChunks encSize = do
      a <- atomically $ newXFTPAgent defaultXFTPClientAgentConfig
      gen <- newTVarIO =<< liftIO newStdGen
      let xftpSrvs = fromMaybe defaultXFTPServers (nonEmpty xftpServers)
@@ -325,8 +318,8 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
        uploadFileChunk :: XFTPClientAgent -> (Int, XFTPChunkSpec, XFTPServerWithAuth) -> ExceptT CLIError IO (Int, SentFileChunk)
        uploadFileChunk a (chunkNo, chunkSpec@XFTPChunkSpec {chunkSize}, ProtoServerWithAuth xftpServer auth) = do
          logInfo $ "uploading chunk " <> tshow chunkNo <> " to " <> showServer xftpServer <> "..."
-          (sndKey, spKey) <- liftIO $ C.generateSignatureKeyPair C.SEd25519
-          rKeys <- liftIO $ L.fromList <$> replicateM numRecipients (C.generateSignatureKeyPair C.SEd25519)
+          (sndKey, spKey) <- atomically $ C.generateSignatureKeyPair C.SEd25519 g
+          rKeys <- atomically $ L.fromList <$> replicateM numRecipients (C.generateSignatureKeyPair C.SEd25519 g)
          digest <- liftIO $ getChunkDigest chunkSpec
          let ch = FileInfo {sndKey, size = fromIntegral chunkSize, digest}
          c <- withRetry retryCount $ getXFTPServerClient a xftpServer
@@ -367,7 +360,7 @@ cliSendFileOpts SendOptions {filePath, outputDir, numRecipients, xftpServers, re
        rcvChunks :: [[FileChunk]]
        rcvChunks = map (sortChunks . M.elems) $ M.elems $ foldl' addRcvChunk M.empty rcvReplicas
        sortChunks :: [FileChunk] -> [FileChunk]
-        sortChunks = map reverseReplicas . sortOn (chunkNo :: FileChunk -> Int)
+        sortChunks = map reverseReplicas . sortOn (\FileChunk {chunkNo} -> chunkNo)
        reverseReplicas ch@FileChunk {replicas} = (ch :: FileChunk) {replicas = reverse replicas}
        addRcvChunk :: Map Int (Map Int FileChunk) -> SentRecipientReplica -> Map Int (Map Int FileChunk)
        addRcvChunk m SentRecipientReplica {chunkNo, server, rcvNo, replicaId, replicaKey, digest, chunkSize} =
@@ -417,36 +410,39 @@ getChunkDigest XFTPChunkSpec {filePath = chunkPath, chunkOffset, chunkSize} =

 cliReceiveFile :: ReceiveOptions -> ExceptT CLIError IO ()
 cliReceiveFile ReceiveOptions {fileDescription, filePath, retryCount, tempPath, verbose, yes} =
-  getFileDescription' fileDescription >>= receiveFile
+  getFileDescription' fileDescription >>= receive
  where
-    receiveFile :: ValidFileDescription 'FRecipient -> ExceptT CLIError IO ()
-    receiveFile (ValidFileDescription FileDescription {size, digest, key, nonce, chunks}) = do
+    receive :: ValidFileDescription 'FRecipient -> ExceptT CLIError IO ()
+    receive (ValidFileDescription FileDescription {size, digest, key, nonce, chunks}) = do
      encPath <- getEncPath tempPath "xftp"
      createDirectory encPath
      a <- atomically $ newXFTPAgent defaultXFTPClientAgentConfig
      liftIO $ printNoNewLine "Downloading file..."
      downloadedChunks <- newTVarIO []
-      let srv FileChunk {replicas} = server (head replicas :: FileChunkReplica)
+      let srv FileChunk {replicas} = case replicas of
+            [] -> error "empty FileChunk.replicas"
+            FileChunkReplica {server} : _ -> server
          srvChunks = groupAllOn srv chunks
-      chunkPaths <- map snd . sortOn fst . concat <$> pooledForConcurrentlyN 16 srvChunks (mapM $ downloadFileChunk a encPath size downloadedChunks)
+      g <- liftIO C.newRandom
+      chunkPaths <- map snd . sortOn fst . concat <$> pooledForConcurrentlyN 16 srvChunks (mapM $ downloadFileChunk g a encPath size downloadedChunks)
      encDigest <- liftIO $ LC.sha512Hash <$> readChunks chunkPaths
      when (encDigest /= unFileDigest digest) $ throwError $ CLIError "File digest mismatch"
      encSize <- liftIO $ foldM (\s path -> (s +) . fromIntegral <$> getFileSize path) 0 chunkPaths
      when (FileSize encSize /= size) $ throwError $ CLIError "File size mismatch"
      liftIO $ printNoNewLine "Decrypting file..."
-      path <- withExceptT cliCryptoError $ decryptChunks encSize chunkPaths key nonce getFilePath
+      CryptoFile path _ <- withExceptT cliCryptoError $ decryptChunks encSize chunkPaths key nonce $ fmap CF.plain . getFilePath
      forM_ chunks $ acknowledgeFileChunk a
      whenM (doesPathExist encPath) $ removeDirectoryRecursive encPath
      liftIO $ do
        printNoNewLine $ "File downloaded: " <> path
        removeFD yes fileDescription
-    downloadFileChunk :: XFTPClientAgent -> FilePath -> FileSize Int64 -> TVar [Int64] -> FileChunk -> ExceptT CLIError IO (Int, FilePath)
-    downloadFileChunk a encPath (FileSize encSize) downloadedChunks FileChunk {chunkNo, chunkSize, digest, replicas = replica : _} = do
+    downloadFileChunk :: TVar ChaChaDRG -> XFTPClientAgent -> FilePath -> FileSize Int64 -> TVar [Int64] -> FileChunk -> ExceptT CLIError IO (Int, FilePath)
+    downloadFileChunk g a encPath (FileSize encSize) downloadedChunks FileChunk {chunkNo, chunkSize, digest, replicas = replica : _} = do
      let FileChunkReplica {server, replicaId, replicaKey} = replica
      logInfo $ "downloading chunk " <> tshow chunkNo <> " from " <> showServer server <> "..."
      chunkPath <- uniqueCombine encPath $ show chunkNo
      let chunkSpec = XFTPRcvChunkSpec chunkPath (unFileSize chunkSize) (unFileDigest digest)
-      withReconnect a server retryCount $ \c -> downloadXFTPChunk c replicaKey (unChunkReplicaId replicaId) chunkSpec
+      withReconnect a server retryCount $ \c -> downloadXFTPChunk g c replicaKey (unChunkReplicaId replicaId) chunkSpec
      logInfo $ "downloaded chunk " <> tshow chunkNo <> " to " <> T.pack chunkPath
      downloaded <- atomically . stateTVar downloadedChunks $ \cs ->
        let cs' = fromIntegral (unFileSize chunkSize) : cs in (sum cs', cs')
@@ -454,7 +450,7 @@ cliReceiveFile ReceiveOptions {fileDescription, filePath, retryCount, tempPath,
        printProgress "Downloaded" downloaded encSize
        when verbose $ putStrLn ""
      pure (chunkNo, chunkPath)
-    downloadFileChunk _ _ _ _ _ = throwError $ CLIError "chunk has no replicas"
+    downloadFileChunk _ _ _ _ _ _ = throwError $ CLIError "chunk has no replicas"
    getFilePath :: String -> ExceptT String IO FilePath
    getFilePath name =
      case filePath of
@@ -504,10 +500,9 @@ cliFileDescrInfo InfoOptions {fileDescription} = do
        printParty
        putStrLn $ "File download size: " <> strEnc size
        putStrLn "File server(s):"
-        forM_ replicas $ \srvReplicas -> do
-          let srv = replicaServer $ head srvReplicas
-              chSizes = map (\FileServerReplica {chunkSize = chSize_} -> unFileSize $ fromMaybe chunkSize chSize_) srvReplicas
-          putStrLn $ strEnc srv <> ": " <> strEnc (FileSize $ sum chSizes)
+        forM_ replicas $ \srvReplicas@(FileServerReplica {server} :| _) -> do
+          let chSizes = fmap (\FileServerReplica {chunkSize = chSize_} -> unFileSize $ fromMaybe chunkSize chSize_) srvReplicas
+          putStrLn $ strEnc server <> ": " <> strEnc (FileSize $ sum chSizes)
      where
        printParty :: IO ()
        printParty = case party of
@@ -529,7 +524,11 @@ getFileDescription' path =
 prepareChunkSizes :: Int64 -> [Word32]
 prepareChunkSizes size' = prepareSizes size'
  where
-    (smallSize, bigSize) = if size' > size34 chunkSize3 then (chunkSize2, chunkSize3) else (chunkSize1, chunkSize2)
+    (smallSize, bigSize)
+      | size' > size34 chunkSize3 = (chunkSize2, chunkSize3)
+      | otherwise = (chunkSize1, chunkSize2)
+    --  | size' > size34 chunkSize2 = (chunkSize1, chunkSize2)
+    --  | otherwise = (chunkSize0, chunkSize1)
    size34 sz = (fromIntegral sz * 3) `div` 4
    prepareSizes 0 = []
    prepareSizes size
@@ -572,11 +571,11 @@ withRetry retryCount = withRetry' retryCount . withExceptT (CLIError . show)
 removeFD :: Bool -> FilePath -> IO ()
 removeFD yes fd
  | yes = do
-    removeFile fd
-    putStrLn $ "\nFile description " <> fd <> " is deleted."
+      removeFile fd
+      putStrLn $ "\nFile description " <> fd <> " is deleted."
  | otherwise = do
-    y <- liftIO . getConfirmation $ "\nFile description " <> fd <> " can't be used again. Delete it"
-    when y $ removeFile fd
+      y <- liftIO . getConfirmation $ "\nFile description " <> fd <> " can't be used again. Delete it"
+      when y $ removeFile fd

 getConfirmation :: String -> IO Bool
 getConfirmation prompt = do
@@ -595,7 +594,8 @@ cliRandomFile RandomFileOptions {filePath, fileSize = FileSize size} = do
  putStrLn $ "File created: " <> filePath
  where
    saveRandomFile h sz = do
-      bytes <- getRandomBytes $ fromIntegral $ min mb' sz
+      g <- C.newRandom
+      bytes <- atomically $ C.randomBytes (fromIntegral $ min mb' sz) g
      B.hPut h bytes
      when (sz > mb') $ saveRandomFile h (sz - mb')
    mb' = mb 1
@@ -6,6 +6,7 @@

 module Simplex.FileTransfer.Crypto where

+import Control.Monad
 import Control.Monad.Except
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
@@ -16,6 +17,8 @@ import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Int (Int64)
 import Simplex.FileTransfer.Types (FileHeader (..), authTagSize)
 import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.File (CryptoFile (..), FTCryptoError (..))
+import qualified Simplex.Messaging.Crypto.File as CF
 import Simplex.Messaging.Crypto.Lazy (LazyByteString)
 import qualified Simplex.Messaging.Crypto.Lazy as LC
 import Simplex.Messaging.Encoding
@@ -23,54 +26,55 @@ import Simplex.Messaging.Util (liftEitherWith)
 import UnliftIO
 import UnliftIO.Directory (removeFile)

-encryptFile :: FilePath -> ByteString -> C.SbKey -> C.CbNonce -> Int64 -> Int64 -> FilePath -> ExceptT FTCryptoError IO ()
-encryptFile filePath fileHdr key nonce fileSize' encSize encFile = do
+encryptFile :: CryptoFile -> ByteString -> C.SbKey -> C.CbNonce -> Int64 -> Int64 -> FilePath -> ExceptT FTCryptoError IO ()
+encryptFile srcFile fileHdr key nonce fileSize' encSize encFile = do
  sb <- liftEitherWith FTCECryptoError $ LC.sbInit key nonce
-  withFile filePath ReadMode $ \r -> withFile encFile WriteMode $ \w -> do
+  CF.withFile srcFile ReadMode $ \r -> withFile encFile WriteMode $ \w -> do
    let lenStr = smpEncode fileSize'
        (hdr, !sb') = LC.sbEncryptChunk sb $ lenStr <> fileHdr
        padLen = encSize - authTagSize - fileSize' - 8
    liftIO $ B.hPut w hdr
    sb2 <- encryptChunks r w (sb', fileSize' - fromIntegral (B.length fileHdr))
+    CF.hGetTag r
    sb3 <- encryptPad w (sb2, padLen)
    let tag = BA.convert $ LC.sbAuth sb3
    liftIO $ B.hPut w tag
  where
-    encryptChunks r = encryptChunks_ $ liftIO . B.hGet r . fromIntegral
+    encryptChunks r = encryptChunks_ $ liftIO . CF.hGet r . fromIntegral
    encryptPad = encryptChunks_ $ \sz -> pure $ B.replicate (fromIntegral sz) '#'
    encryptChunks_ :: (Int64 -> IO ByteString) -> Handle -> (LC.SbState, Int64) -> ExceptT FTCryptoError IO LC.SbState
    encryptChunks_ get w (!sb, !len)
      | len == 0 = pure sb
      | otherwise = do
-        let chSize = min len 65536
-        ch <- liftIO $ get chSize
-        when (B.length ch /= fromIntegral chSize) $ throwError $ FTCEFileIOError "encrypting file: unexpected EOF"
-        let (ch', sb') = LC.sbEncryptChunk sb ch
-        liftIO $ B.hPut w ch'
-        encryptChunks_ get w (sb', len - chSize)
+          let chSize = min len 65536
+          ch <- liftIO $ get chSize
+          when (B.length ch /= fromIntegral chSize) $ throwError $ FTCEFileIOError "encrypting file: unexpected EOF"
+          let (ch', sb') = LC.sbEncryptChunk sb ch
+          liftIO $ B.hPut w ch'
+          encryptChunks_ get w (sb', len - chSize)

-decryptChunks :: Int64 -> [FilePath] -> C.SbKey -> C.CbNonce -> (String -> ExceptT String IO String) -> ExceptT FTCryptoError IO FilePath
+decryptChunks :: Int64 -> [FilePath] -> C.SbKey -> C.CbNonce -> (String -> ExceptT String IO CryptoFile) -> ExceptT FTCryptoError IO CryptoFile
 decryptChunks _ [] _ _ _ = throwError $ FTCEInvalidHeader "empty"
-decryptChunks encSize (chPath : chPaths) key nonce getFilePath = case reverse chPaths of
+decryptChunks encSize (chPath : chPaths) key nonce getDestFile = case reverse chPaths of
  [] -> do
    (!authOk, !f) <- liftEither . first FTCECryptoError . LC.sbDecryptTailTag key nonce (encSize - authTagSize) =<< liftIO (LB.readFile chPath)
    unless authOk $ throwError FTCEInvalidAuthTag
    (FileHeader {fileName}, !f') <- parseFileHeader f
-    path <- withExceptT FTCEFileIOError $ getFilePath fileName
-    liftIO $ LB.writeFile path f'
-    pure path
+    destFile <- withExceptT FTCEFileIOError $ getDestFile fileName
+    CF.writeFile destFile f'
+    pure destFile
  lastPath : chPaths' -> do
    (state, expectedLen, ch) <- decryptFirstChunk
    (FileHeader {fileName}, ch') <- parseFileHeader ch
-    path <- withExceptT FTCEFileIOError $ getFilePath fileName
-    authOk <- liftIO . withFile path WriteMode $ \h -> do
-      liftIO $ LB.hPut h ch'
+    destFile@(CryptoFile path _) <- withExceptT FTCEFileIOError $ getDestFile fileName
+    authOk <- CF.withFile destFile WriteMode $ \h -> liftIO $ do
+      CF.hPut h ch'
      state' <- foldM (decryptChunk h) state $ reverse chPaths'
      decryptLastChunk h state' expectedLen
    unless authOk $ do
      removeFile path
      throwError FTCEInvalidAuthTag
-    pure path
+    pure destFile
    where
      decryptFirstChunk = do
        sb <- liftEitherWith FTCECryptoError $ LC.sbInit key nonce
@@ -83,7 +87,7 @@ decryptChunks encSize (chPath : chPaths) key nonce getFilePath = case reverse ch
        ch <- LB.readFile chPth
        let len' = len + LB.length ch
            (ch', sb') = LC.sbDecryptChunkLazy sb ch
-        LB.hPut h ch'
+        CF.hPut h ch'
        pure (sb', len')
      decryptLastChunk h (!sb, !len) expectedLen = do
        ch <- LB.readFile lastPath
@@ -93,7 +97,8 @@ decryptChunks encSize (chPath : chPaths) key nonce getFilePath = case reverse ch
            len' = len + LB.length ch2
            ch3 = LB.take (LB.length ch2 - len' + expectedLen) ch2
            tag :: ByteString = BA.convert (LC.sbAuth sb')
-        LB.hPut h ch3
+        CF.hPut h ch3
+        CF.hPutTag h
        pure $ B.length tag'' == 16 && BA.constEq tag'' tag
  where
    parseFileHeader :: LazyByteString -> ExceptT FTCryptoError IO (FileHeader, LazyByteString)
@@ -106,10 +111,3 @@ decryptChunks encSize (chPath : chPaths) key nonce getFilePath = case reverse ch

 readChunks :: [FilePath] -> IO LB.ByteString
 readChunks = foldM (\s path -> (s <>) <$> LB.readFile path) ""
-
-data FTCryptoError
-  = FTCECryptoError C.CryptoError
-  | FTCEInvalidHeader String
-  | FTCEInvalidAuthTag
-  | FTCEFileIOError String
-  deriving (Show, Eq, Exception)
@@ -1,6 +1,5 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
@@ -8,6 +7,8 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TemplateHaskell #-}
+{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.FileTransfer.Description
  ( FileDescription (..),
@@ -25,7 +26,6 @@ module Simplex.FileTransfer.Description
    YAMLServerReplicas (..), -- for tests
    validateFileDescription,
    groupReplicasByServer,
-    replicaServer,
    fdSeparator,
    kb,
    mb,
@@ -36,7 +36,7 @@ where
 import Control.Applicative (optional)
 import Control.Monad ((<=<))
 import Data.Aeson (FromJSON, ToJSON)
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import Data.Attoparsec.ByteString.Char8 (Parser)
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
@@ -44,6 +44,8 @@ import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Int (Int64)
 import Data.List (foldl', sortOn)
+import Data.List.NonEmpty (NonEmpty (..))
+import qualified Data.List.NonEmpty as L
 import Data.Map (Map)
 import qualified Data.Map as M
 import Data.Maybe (fromMaybe)
@@ -52,13 +54,13 @@ import Data.Word (Word32)
 import qualified Data.Yaml as Y
 import Database.SQLite.Simple.FromField (FromField (..))
 import Database.SQLite.Simple.ToField (ToField (..))
-import GHC.Generics (Generic)
+import Simplex.FileTransfer.Chunks
 import Simplex.FileTransfer.Protocol
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (parseAll)
+import Simplex.Messaging.Parsers (defaultJSON, parseAll)
 import Simplex.Messaging.Protocol (XFTPServer)
-import Simplex.Messaging.Util (bshow, groupAllOn, (<$?>))
+import Simplex.Messaging.Util (bshow, (<$?>))

 data FileDescription (p :: FileParty) = FileDescription
  { party :: SFileParty p,
@@ -147,21 +149,13 @@ data YAMLFileDescription = YAMLFileDescription
    chunkSize :: String,
    replicas :: [YAMLServerReplicas]
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance ToJSON YAMLFileDescription where
-  toJSON = J.genericToJSON J.defaultOptions
-  toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 data YAMLServerReplicas = YAMLServerReplicas
  { server :: XFTPServer,
    chunks :: [String]
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance ToJSON YAMLServerReplicas where
-  toJSON = J.genericToJSON J.defaultOptions
-  toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 data FileServerReplica = FileServerReplica
  { chunkNo :: Int,
@@ -173,6 +167,13 @@ data FileServerReplica = FileServerReplica
  }
  deriving (Show)

+newtype FileSize a = FileSize {unFileSize :: a}
+  deriving (Eq, Show)
+
+$(J.deriveJSON defaultJSON ''YAMLServerReplicas)
+
+$(J.deriveJSON defaultJSON ''YAMLFileDescription)
+
 instance FilePartyI p => StrEncoding (ValidFileDescription p) where
  strEncode (ValidFD fd) = strEncode fd
  strDecode s = strDecode s >>= (\(AVFD fd) -> checkParty fd)
@@ -199,7 +200,7 @@ validateFileDescription fd@FileDescription {size, chunks}
  | chunksSize chunks /= unFileSize size = Left "chunks total size is different than file size"
  | otherwise = Right $ ValidFD fd
  where
-    chunkNos = map (chunkNo :: FileChunk -> Int) chunks
+    chunkNos = map (\FileChunk {chunkNo} -> chunkNo) chunks
    chunksSize = fromIntegral . foldl' (\s FileChunk {chunkSize} -> s + unFileSize chunkSize) 0

 encodeFileDescription :: FileDescription p -> YAMLFileDescription
@@ -214,9 +215,6 @@ encodeFileDescription FileDescription {party, size, digest, key, nonce, chunkSiz
      replicas = encodeFileReplicas chunkSize chunks
    }

-newtype FileSize a = FileSize {unFileSize :: a}
-  deriving (Eq, Show)
-
 instance (Integral a, Show a) => StrEncoding (FileSize a) where
  strEncode (FileSize b)
    | b' /= 0 = bshow b
@@ -236,42 +234,27 @@ instance (Integral a, Show a) => StrEncoding (FileSize a) where
          A.decimal
        ]

-kb :: Integral a => a -> a
-kb n = 1024 * n
-{-# INLINE kb #-}
-
-mb :: Integral a => a -> a
-mb n = 1024 * kb n
-{-# INLINE mb #-}
-
-gb :: Integral a => a -> a
-gb n = 1024 * mb n
-{-# INLINE gb #-}
-
 instance (Integral a, Show a) => IsString (FileSize a) where
  fromString = either error id . strDecode . B.pack

-instance (FromField a) => FromField (FileSize a) where fromField f = FileSize <$> fromField f
+instance FromField a => FromField (FileSize a) where fromField f = FileSize <$> fromField f

-instance (ToField a) => ToField (FileSize a) where toField (FileSize s) = toField s
+instance ToField a => ToField (FileSize a) where toField (FileSize s) = toField s

-groupReplicasByServer :: FileSize Word32 -> [FileChunk] -> [[FileServerReplica]]
+groupReplicasByServer :: FileSize Word32 -> [FileChunk] -> [NonEmpty FileServerReplica]
 groupReplicasByServer defChunkSize =
-  groupAllOn replicaServer . unfoldChunksToReplicas defChunkSize
+  L.groupAllWith (\FileServerReplica {server} -> server) . unfoldChunksToReplicas defChunkSize

 encodeFileReplicas :: FileSize Word32 -> [FileChunk] -> [YAMLServerReplicas]
 encodeFileReplicas defChunkSize =
  map encodeServerReplicas . groupReplicasByServer defChunkSize
  where
-    encodeServerReplicas fs =
+    encodeServerReplicas fs@(FileServerReplica {server} :| _) =
      YAMLServerReplicas
-        { server = replicaServer $ head fs, -- groupAllOn guarantees that fs is not empty
-          chunks = map (B.unpack . encodeServerReplica) fs
+        { server,
+          chunks = map (B.unpack . encodeServerReplica) $ L.toList fs
        }

-replicaServer :: FileServerReplica -> XFTPServer
-replicaServer = server
-
 encodeServerReplica :: FileServerReplica -> ByteString
 encodeServerReplica FileServerReplica {chunkNo, replicaId, replicaKey, digest, chunkSize} =
  bshow chunkNo
@@ -323,7 +306,7 @@ foldReplicasToChunks :: FileSize Word32 -> [FileServerReplica] -> Either String
 foldReplicasToChunks defChunkSize fs = do
  sd <- foldSizesDigests fs
  -- TODO validate (check that chunks match) or in separate function
-  sortOn (chunkNo :: FileChunk -> Int) . map reverseReplicas . M.elems <$> foldChunks sd fs
+  sortOn (\FileChunk {chunkNo} -> chunkNo) . map reverseReplicas . M.elems <$> foldChunks sd fs
  where
    foldSizesDigests :: [FileServerReplica] -> Either String (Map Int (FileSize Word32), Map Int FileDigest)
    foldSizesDigests = foldl' addSizeDigest $ Right (M.empty, M.empty)
@@ -1,5 +1,4 @@
 {-# LANGUAGE DataKinds #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiParamTypeClasses #-}
@@ -7,6 +6,7 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE StandaloneDeriving #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TypeApplications #-}
 {-# LANGUAGE TypeFamilies #-}
 {-# OPTIONS_GHC -fno-warn-unticked-promoted-constructors #-}
@@ -14,8 +14,7 @@
 module Simplex.FileTransfer.Protocol where

 import Control.Applicative ((<|>))
-import Data.Aeson (FromJSON, ToJSON)
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.ByteString.Char8 (ByteString)
@@ -25,8 +24,6 @@ import Data.List.NonEmpty (NonEmpty (..))
 import Data.Maybe (isNothing)
 import Data.Type.Equality
 import Data.Word (Word32)
-import GHC.Generics (Generic)
-import Generic.Random (genericArbitraryU)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
@@ -51,15 +48,12 @@ import Simplex.Messaging.Protocol
    encodeTransmission,
    messageTagP,
    tDecodeParseValidate,
-    tEncode,
-    tEncodeBatch,
+    tEncodeBatch1,
    tParse,
-    _smpP,
  )
 import Simplex.Messaging.Transport (SessionId, TransportError (..))
 import Simplex.Messaging.Util (bshow, (<$?>))
 import Simplex.Messaging.Version
-import Test.QuickCheck (Arbitrary (..))

 currentXFTPVersion :: Version
 currentXFTPVersion = 1
@@ -69,14 +63,7 @@ xftpBlockSize = 16384

 -- | File protocol clients
 data FileParty = FRecipient | FSender
-  deriving (Eq, Show, Generic)
-
-instance FromJSON FileParty where
-  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "F"
-
-instance ToJSON FileParty where
-  toJSON = J.genericToJSON . enumJSON $ dropPrefix "F"
-  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "F"
+  deriving (Eq, Show)

 data SFileParty :: FileParty -> Type where
  SFRecipient :: SFileParty FRecipient
@@ -355,11 +342,7 @@ data XFTPErrorType
    INTERNAL
  | -- | used internally, never returned by the server (to be removed)
    DUPLICATE_ -- not part of SMP protocol, used internally
-  deriving (Eq, Generic, Read, Show)
-
-instance ToJSON XFTPErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Read, Show)

 instance StrEncoding XFTPErrorType where
  strEncode = \case
@@ -367,8 +350,6 @@ instance StrEncoding XFTPErrorType where
    e -> bshow e
  strP = "CMD " *> (CMD <$> parseRead1) <|> parseRead1

-instance Arbitrary XFTPErrorType where arbitrary = genericArbitraryU
-
 instance Encoding XFTPErrorType where
  smpEncode = \case
    BLOCK -> "BLOCK"
@@ -421,10 +402,8 @@ xftpEncodeTransmission sessionId pKey (corrId, fId, msg) = do
    signTransmission t = ((`C.sign` t) <$> pKey, t)

 -- this function uses batch syntax but puts only one transmission in the batch
-xftpEncodeBatch1 :: (Maybe C.ASignature, ByteString) -> Either TransportError ByteString
-xftpEncodeBatch1 (sig, t) =
-  let t' = tEncodeBatch 1 . smpEncode . Large $ tEncode (sig, t)
-   in first (const TELargeMsg) $ C.pad t' xftpBlockSize
+xftpEncodeBatch1 :: SentRawTransmission -> Either TransportError ByteString
+xftpEncodeBatch1 t = first (const TELargeMsg) $ C.pad (tEncodeBatch1 t) xftpBlockSize

 xftpDecodeTransmission :: ProtocolEncoding e c => SessionId -> ByteString -> Either XFTPErrorType (SignedTransmission e c)
 xftpDecodeTransmission sessionId t = do
@@ -432,3 +411,7 @@ xftpDecodeTransmission sessionId t = do
  case tParse True t' of
    t'' :| [] -> Right $ tDecodeParseValidate sessionId currentXFTPVersion t''
    _ -> Left BLOCK
+
+$(J.deriveJSON (enumJSON $ dropPrefix "F") ''FileParty)
+
+$(J.deriveJSON (sumTypeJSON id) ''XFTPErrorType)
@@ -1,3 +1,4 @@
+{-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
@@ -12,10 +13,9 @@
 module Simplex.FileTransfer.Server where

 import Control.Logger.Simple
+import Control.Monad
 import Control.Monad.Except
-import Control.Monad.IO.Unlift (MonadUnliftIO)
 import Control.Monad.Reader
-import Crypto.Random (getRandomBytes)
 import Data.Bifunctor (first)
 import qualified Data.ByteString.Base64.URL as B64
 import Data.ByteString.Builder (byteString)
@@ -32,9 +32,13 @@ import Data.Time.Clock (UTCTime (..), diffTimeToPicoseconds, getCurrentTime)
 import Data.Time.Clock.System (SystemTime (..), getSystemTime)
 import Data.Time.Format.ISO8601 (iso8601Show)
 import Data.Word (Word32)
+import GHC.IO.Handle (hSetNewlineMode)
+import GHC.Stats (getRTSStats)
 import qualified Network.HTTP.Types as N
 import qualified Network.HTTP2.Server as H
+import Network.Socket
 import Simplex.FileTransfer.Protocol
+import Simplex.FileTransfer.Server.Control
 import Simplex.FileTransfer.Server.Env
 import Simplex.FileTransfer.Server.Stats
 import Simplex.FileTransfer.Server.Store
@@ -47,17 +51,18 @@ import Simplex.Messaging.Protocol (CorrId, RcvPublicDhKey, RcvPublicVerifyKey, R
 import Simplex.Messaging.Server (dummyVerifyCmd, verifyCmdSignature)
 import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Server.Stats
+import Simplex.Messaging.Transport.Buffer (trimCR)
 import Simplex.Messaging.Transport.HTTP2
 import Simplex.Messaging.Transport.HTTP2.Server
+import Simplex.Messaging.Transport.Server (runTCPServer)
 import Simplex.Messaging.Util
 import System.Exit (exitFailure)
 import System.FilePath ((</>))
-import System.IO (BufferMode (..), hPutStrLn, hSetBuffering)
-import UnliftIO (IOMode (..), withFile)
+import System.IO (hPrint, hPutStrLn, universalNewlineMode)
+import UnliftIO
 import UnliftIO.Concurrent (threadDelay)
 import UnliftIO.Directory (doesFileExist, removeFile, renameFile)
-import UnliftIO.Exception
-import UnliftIO.STM
+import qualified UnliftIO.Exception as E

 type M a = ReaderT XFTPEnv IO a

@@ -70,16 +75,16 @@ runXFTPServerBlocking :: TMVar Bool -> XFTPServerConfig -> IO ()
 runXFTPServerBlocking started cfg = newXFTPServerEnv cfg >>= runReaderT (xftpServer cfg started)

 xftpServer :: XFTPServerConfig -> TMVar Bool -> M ()
-xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig} started = do
+xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpiration} started = do
  restoreServerStats
-  raceAny_ (runServer : expireFilesThread_ cfg <> serverStatsThread_ cfg) `finally` stopServer
+  raceAny_ (runServer : expireFilesThread_ cfg <> serverStatsThread_ cfg <> controlPortThread_ cfg) `finally` stopServer
  where
    runServer :: M ()
    runServer = do
      serverParams <- asks tlsServerParams
      env <- ask
      liftIO $
-        runHTTP2Server started xftpPort defaultHTTP2BufferSize serverParams transportConfig $ \sessionId r sendResponse -> do
+        runHTTP2Server started xftpPort defaultHTTP2BufferSize serverParams transportConfig inactiveClientExpiration $ \sessionId r sendResponse -> do
          reqBody <- getHTTP2Body r xftpBlockSize
          processRequest HTTP2Request {sessionId, request = r, reqBody, sendResponse} `runReaderT` env

@@ -103,16 +108,19 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig} started = do
        forM_ sIds $ \sId -> do
          threadDelay 100000
          atomically (expiredFilePath st sId old)
-            >>= mapM_ (remove $ delete st sId)
+            >>= mapM_ (maybeRemove $ delete st sId)
      where
+        maybeRemove del = maybe del (remove del)
        remove del filePath =
          ifM
            (doesFileExist filePath)
-            (removeFile filePath >> del `catch` \(e :: SomeException) -> logError $ "failed to remove expired file " <> tshow filePath <> ": " <> tshow e)
+            ((removeFile filePath >> del) `catch` \(e :: SomeException) -> logError $ "failed to remove expired file " <> tshow filePath <> ": " <> tshow e)
            del
        delete st sId = do
          withFileLog (`logDeleteFile` sId)
          void $ atomically $ deleteFile st sId
+          FileServerStats {filesExpired} <- asks serverStats
+          atomically $ modifyTVar' filesExpired (+ 1)

    serverStatsThread_ :: XFTPServerConfig -> [M ()]
    serverStatsThread_ XFTPServerConfig {logStatsInterval = Just interval, logStatsStartTime, serverStatsLogFile} =
@@ -124,7 +132,7 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig} started = do
      initialDelay <- (startAt -) . fromIntegral . (`div` 1000000_000000) . diffTimeToPicoseconds . utctDayTime <$> liftIO getCurrentTime
      liftIO $ putStrLn $ "server stats log enabled: " <> statsFilePath
      liftIO $ threadDelay' $ 1_000_000 * (initialDelay + if initialDelay < 0 then 86_400 else 0)
-      FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize} <- asks serverStats
+      FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize} <- asks serverStats
      let interval = 1_000_000 * logInterval
      forever $ do
        withFile statsFilePath AppendMode $ \h -> liftIO $ do
@@ -134,12 +142,13 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig} started = do
          filesCreated' <- atomically $ swapTVar filesCreated 0
          fileRecipients' <- atomically $ swapTVar fileRecipients 0
          filesUploaded' <- atomically $ swapTVar filesUploaded 0
+          filesExpired' <- atomically $ swapTVar filesExpired 0
          filesDeleted' <- atomically $ swapTVar filesDeleted 0
          files <- atomically $ periodStatCounts filesDownloaded ts
          fileDownloads' <- atomically $ swapTVar fileDownloads 0
          fileDownloadAcks' <- atomically $ swapTVar fileDownloadAcks 0
-          filesCount' <- atomically $ swapTVar filesCount 0
-          filesSize' <- atomically $ swapTVar filesSize 0
+          filesCount' <- readTVarIO filesCount
+          filesSize' <- readTVarIO filesSize
          hPutStrLn h $
            intercalate
              ","
@@ -154,10 +163,52 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig} started = do
                show fileDownloads',
                show fileDownloadAcks',
                show filesCount',
-                show filesSize'
+                show filesSize',
+                show filesExpired'
              ]
        liftIO $ threadDelay' interval

+    controlPortThread_ :: XFTPServerConfig -> [M ()]
+    controlPortThread_ XFTPServerConfig {controlPort = Just port} = [runCPServer port]
+    controlPortThread_ _ = []
+
+    runCPServer :: ServiceName -> M ()
+    runCPServer port = do
+      cpStarted <- newEmptyTMVarIO
+      u <- askUnliftIO
+      liftIO $ do
+        labelMyThread "control port server"
+        runTCPServer cpStarted port $ runCPClient u
+      where
+        runCPClient :: UnliftIO (ReaderT XFTPEnv IO) -> Socket -> IO ()
+        runCPClient u sock = do
+          labelMyThread "control port client"
+          h <- socketToHandle sock ReadWriteMode
+          hSetBuffering h LineBuffering
+          hSetNewlineMode h universalNewlineMode
+          hPutStrLn h "XFTP server control port\n'help' for supported commands"
+          cpLoop h
+          where
+            cpLoop h = do
+              s <- B.hGetLine h
+              case strDecode $ trimCR s of
+                Right CPQuit -> hClose h
+                Right cmd -> processCP h cmd >> cpLoop h
+                Left err -> hPutStrLn h ("error: " <> err) >> cpLoop h
+            processCP h = \case
+              CPStatsRTS -> E.tryAny getRTSStats >>= either (hPrint h) (hPrint h)
+              CPDelete fileId -> unliftIO u $ do
+                fs <- asks store
+                r <- runExceptT $ do
+                  let asSender = ExceptT . atomically $ getFile fs SFSender fileId
+                  let asRecipient = ExceptT . atomically $ getFile fs SFRecipient fileId
+                  (fr, _) <- asSender `catchError` const asRecipient
+                  ExceptT $ deleteServerFile_ fr
+                liftIO . hPutStrLn h $ either (\e -> "error: " <> show e) (\() -> "ok") r
+              CPHelp -> hPutStrLn h "commands: stats-rts, delete, help, quit"
+              CPQuit -> pure ()
+              CPSkip -> pure ()
+
 data ServerFile = ServerFile
  { filePath :: FilePath,
    fileSize :: Word32,
@@ -168,17 +219,17 @@ processRequest :: HTTP2Request -> M ()
 processRequest HTTP2Request {sessionId, reqBody = body@HTTP2Body {bodyHead}, sendResponse}
  | B.length bodyHead /= xftpBlockSize = sendXFTPResponse ("", "", FRErr BLOCK) Nothing
  | otherwise = do
-    case xftpDecodeTransmission sessionId bodyHead of
-      Right (sig_, signed, (corrId, fId, cmdOrErr)) -> do
-        case cmdOrErr of
-          Right cmd -> do
-            verifyXFTPTransmission sig_ signed fId cmd >>= \case
-              VRVerified req -> uncurry send =<< processXFTPRequest body req
-              VRFailed -> send (FRErr AUTH) Nothing
-          Left e -> send (FRErr e) Nothing
-        where
-          send resp = sendXFTPResponse (corrId, fId, resp)
-      Left e -> sendXFTPResponse ("", "", FRErr e) Nothing
+      case xftpDecodeTransmission sessionId bodyHead of
+        Right (sig_, signed, (corrId, fId, cmdOrErr)) -> do
+          case cmdOrErr of
+            Right cmd -> do
+              verifyXFTPTransmission sig_ signed fId cmd >>= \case
+                VRVerified req -> uncurry send =<< processXFTPRequest body req
+                VRFailed -> send (FRErr AUTH) Nothing
+            Left e -> send (FRErr e) Nothing
+          where
+            send resp = sendXFTPResponse (corrId, fId, resp)
+        Left e -> sendXFTPResponse ("", "", FRErr e) Nothing
  where
    sendXFTPResponse :: (CorrId, XFTPFileId, FileResponse) -> Maybe ServerFile -> M ()
    sendXFTPResponse (corrId, fId, resp) serverFile_ = do
@@ -317,9 +368,10 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
    sendServerFile FileRec {senderId, filePath, fileInfo = FileInfo {size}} rDhKey = do
      readTVarIO filePath >>= \case
        Just path -> do
-          (sDhKey, spDhKey) <- liftIO C.generateKeyPair'
+          g <- asks random
+          (sDhKey, spDhKey) <- atomically $ C.generateKeyPair g
          let dhSecret = C.dh' rDhKey spDhKey
-          cbNonce <- liftIO C.randomCbNonce
+          cbNonce <- atomically $ C.randomCbNonce g
          case LC.cbInit dhSecret cbNonce of
            Right sbState -> do
              stats <- asks serverStats
@@ -330,21 +382,7 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
        _ -> pure (FRErr NO_FILE, Nothing)

    deleteServerFile :: FileRec -> M FileResponse
-    deleteServerFile FileRec {senderId, fileInfo, filePath} = do
-      withFileLog (`logDeleteFile` senderId)
-      r <- runExceptT $ do
-        path <- readTVarIO filePath
-        stats <- asks serverStats
-        ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
-        st <- asks store
-        void $ atomically $ deleteFile st senderId
-        atomically $ modifyTVar' (filesDeleted stats) (+ 1)
-        pure FROk
-      either (pure . FRErr) pure r
-      where
-        deletedStats stats = do
-          atomically $ modifyTVar' (filesCount stats) (subtract 1)
-          atomically $ modifyTVar' (filesSize stats) (subtract $ fromIntegral $ size fileInfo)
+    deleteServerFile fr = either FRErr (\() -> FROk) <$> deleteServerFile_ fr

    logFileError :: SomeException -> IO ()
    logFileError e = logError $ "Error deleting file: " <> tshow e
@@ -358,13 +396,28 @@ processXFTPRequest HTTP2Body {bodyPart} = \case
      atomically $ modifyTVar' (fileDownloadAcks stats) (+ 1)
      pure FROk

+deleteServerFile_ :: FileRec -> M (Either XFTPErrorType ())
+deleteServerFile_ FileRec {senderId, fileInfo, filePath} = do
+  withFileLog (`logDeleteFile` senderId)
+  runExceptT $ do
+    path <- readTVarIO filePath
+    stats <- asks serverStats
+    ExceptT $ first (\(_ :: SomeException) -> FILE_IO) <$> try (forM_ path $ \p -> whenM (doesFileExist p) (removeFile p >> deletedStats stats))
+    st <- asks store
+    void $ atomically $ deleteFile st senderId
+    atomically $ modifyTVar' (filesDeleted stats) (+ 1)
+  where
+    deletedStats stats = do
+      atomically $ modifyTVar' (filesCount stats) (subtract 1)
+      atomically $ modifyTVar' (filesSize stats) (subtract $ fromIntegral $ size fileInfo)
+
 randomId :: (MonadUnliftIO m, MonadReader XFTPEnv m) => Int -> m ByteString
-randomId n = do
-  gVar <- asks idsDrg
-  atomically (C.pseudoRandomBytes n gVar)
+randomId n = atomically . C.randomBytes n =<< asks random

 getFileId :: M XFTPFileId
-getFileId = liftIO . getRandomBytes =<< asks (fileIdSize . config)
+getFileId = do
+  size <- asks (fileIdSize . config)
+  atomically . C.randomBytes size =<< asks random

 withFileLog :: (MonadIO m, MonadReader XFTPEnv m) => (StoreLog 'WriteMode -> IO a) -> m ()
 withFileLog action = liftIO . mapM_ action =<< asks storeLog
@@ -390,14 +443,17 @@ restoreServerStats = asks (serverStatsBackupFile . config) >>= mapM_ restoreStat
    restoreStats f = whenM (doesFileExist f) $ do
      logInfo $ "restoring server stats from file " <> T.pack f
      liftIO (strDecode <$> B.readFile f) >>= \case
-        Right d -> do
+        Right d@FileServerStatsData {_filesCount = statsFilesCount, _filesSize = statsFilesSize} -> do
          s <- asks serverStats
-          fs <- readTVarIO . files =<< asks store
-          let _filesCount = length $ M.keys fs
-              _filesSize = M.foldl' (\n -> (n +) . fromIntegral . size . fileInfo) 0 fs
+          FileStore {files, usedStorage} <- asks store
+          _filesCount <- M.size <$> readTVarIO files
+          _filesSize <- readTVarIO usedStorage
          atomically $ setFileServerStats s d {_filesCount, _filesSize}
          renameFile f $ f <> ".bak"
          logInfo "server stats restored"
+          when (statsFilesCount /= _filesCount) $ logWarn $ "Files count differs: stats: " <> tshow statsFilesCount <> ", store: " <> tshow _filesCount
+          when (statsFilesSize /= _filesSize) $ logWarn $ "Files size differs: stats: " <> tshow statsFilesSize <> ", store: " <> tshow _filesSize
+          logInfo $ "Restored " <> tshow (_filesSize `div` 1048576) <> " MBs in " <> tshow _filesCount <> " files"
        Left e -> do
          logInfo $ "error restoring server stats: " <> T.pack e
          liftIO exitFailure
@@ -0,0 +1,31 @@
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module Simplex.FileTransfer.Server.Control where
+
+import qualified Data.Attoparsec.ByteString.Char8 as A
+import Data.ByteString (ByteString)
+import Simplex.Messaging.Encoding.String
+
+data ControlProtocol
+  = CPStatsRTS
+  | CPDelete ByteString
+  | CPHelp
+  | CPQuit
+  | CPSkip
+
+instance StrEncoding ControlProtocol where
+  strEncode = \case
+    CPStatsRTS -> "stats-rts"
+    CPDelete bs -> "delete " <> strEncode bs
+    CPHelp -> "help"
+    CPQuit -> "quit"
+    CPSkip -> ""
+  strP =
+    A.takeTill (== ' ') >>= \case
+      "stats-rts" -> pure CPStatsRTS
+      "delete" -> CPDelete <$> (A.space *> strP)
+      "help" -> pure CPHelp
+      "quit" -> pure CPQuit
+      "" -> pure CPSkip
+      _ -> fail "bad ControlProtocol command"
@@ -26,13 +26,14 @@ import Simplex.FileTransfer.Server.StoreLog
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Protocol (BasicAuth, RcvPublicVerifyKey)
 import Simplex.Messaging.Server.Expiration
-import Simplex.Messaging.Transport.Server (loadFingerprint, loadTLSServerParams, TransportServerConfig)
+import Simplex.Messaging.Transport.Server (TransportServerConfig, loadFingerprint, loadTLSServerParams)
 import Simplex.Messaging.Util (tshow)
 import System.IO (IOMode (..))
 import UnliftIO.STM

 data XFTPServerConfig = XFTPServerConfig
  { xftpPort :: ServiceName,
+    controlPort :: Maybe ServiceName,
    fileIdSize :: Int,
    storeLogFile :: Maybe FilePath,
    filesPath :: FilePath,
@@ -46,6 +47,8 @@ data XFTPServerConfig = XFTPServerConfig
    newFileBasicAuth :: Maybe BasicAuth,
    -- | time after which the files can be removed and check interval, seconds
    fileExpiration :: Maybe ExpirationConfig,
+    -- | time after which inactive clients can be disconnected and check interval, seconds
+    inactiveClientExpiration :: Maybe ExpirationConfig,
    -- CA certificate private key is not needed for initialization
    caCertificateFile :: FilePath,
    privateKeyFile :: FilePath,
@@ -58,11 +61,18 @@ data XFTPServerConfig = XFTPServerConfig
    transportConfig :: TransportServerConfig
  }

+defaultInactiveClientExpiration :: ExpirationConfig
+defaultInactiveClientExpiration =
+  ExpirationConfig
+    { ttl = 43200, -- seconds, 12 hours
+      checkInterval = 3600 -- seconds, 1 hours
+    }
+
 data XFTPEnv = XFTPEnv
  { config :: XFTPServerConfig,
    store :: FileStore,
    storeLog :: Maybe (StoreLog 'WriteMode),
-    idsDrg :: TVar ChaChaDRG,
+    random :: TVar ChaChaDRG,
    serverIdentity :: C.KeyHash,
    tlsServerParams :: T.ServerParams,
    serverStats :: FileServerStats
@@ -80,7 +90,7 @@ defaultFileExpiration =

 newXFTPServerEnv :: (MonadUnliftIO m, MonadRandom m) => XFTPServerConfig -> m XFTPEnv
 newXFTPServerEnv config@XFTPServerConfig {storeLogFile, fileSizeQuota, caCertificateFile, certificateFile, privateKeyFile} = do
-  idsDrg <- drgNew >>= newTVarIO
+  random <- liftIO C.newRandom
  store <- atomically newFileStore
  storeLog <- liftIO $ mapM (`readWriteFileStore` store) storeLogFile
  used <- readTVarIO (usedStorage store)
@@ -90,7 +100,7 @@ newXFTPServerEnv config@XFTPServerConfig {storeLogFile, fileSizeQuota, caCertifi
  tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
  Fingerprint fp <- liftIO $ loadFingerprint caCertificateFile
  serverStats <- atomically . newFileServerStats =<< liftIO getCurrentTime
-  pure XFTPEnv {config, store, storeLog, idsDrg, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}
+  pure XFTPEnv {config, store, storeLog, random, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}

 data XFTPRequest
  = XFTPReqNew FileInfo (NonEmpty RcvPublicVerifyKey) (Maybe BasicAuth)
@@ -16,9 +16,10 @@ import Data.Maybe (fromMaybe)
 import qualified Data.Text as T
 import Network.Socket (HostName)
 import Options.Applicative
-import Simplex.FileTransfer.Description (FileSize (..), kb, mb)
+import Simplex.FileTransfer.Chunks
+import Simplex.FileTransfer.Description (FileSize (..))
 import Simplex.FileTransfer.Server (runXFTPServer)
-import Simplex.FileTransfer.Server.Env (XFTPServerConfig (..), defaultFileExpiration, defFileExpirationHours)
+import Simplex.FileTransfer.Server.Env (XFTPServerConfig (..), defFileExpirationHours, defaultFileExpiration, defaultInactiveClientExpiration)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), pattern XFTPServer)
@@ -32,7 +33,7 @@ import System.IO (BufferMode (..), hSetBuffering, stderr, stdout)
 import Text.Read (readMaybe)

 xftpServerVersion :: String
-xftpServerVersion = "1.0.0"
+xftpServerVersion = "1.2.2.0"

 xftpServerCLI :: FilePath -> FilePath -> IO ()
 xftpServerCLI cfgPath logPath = do
@@ -99,10 +100,17 @@ xftpServerCLI cfgPath logPath = do
            <> ("host: " <> host <> "\n")
            <> ("port: " <> defaultServerPort <> "\n")
            <> "log_tls_errors: off\n\
+               \# control_port: 5226\n\
               \\n\
               \[FILES]\n"
            <> ("path: " <> filesPath <> "\n")
            <> ("storage_quota: " <> B.unpack (strEncode fileSizeQuota) <> "\n")
+            <> "\n\
+               \[INACTIVE_CLIENTS]\n\
+               \# TTL and interval to check inactive clients\n\
+               \disconnect: off\n"
+            <> ("# ttl: " <> show (ttl defaultInactiveClientExpiration) <> "\n")
+            <> ("# check_interval: " <> show (checkInterval defaultInactiveClientExpiration) <> "\n")
    runServer ini = do
      hSetBuffering stdout LineBuffering
      hSetBuffering stderr LineBuffering
@@ -117,13 +125,16 @@ xftpServerCLI cfgPath logPath = do
        enableStoreLog = settingIsOn "STORE_LOG" "enable" ini
        logStats = settingIsOn "STORE_LOG" "log_stats" ini
        c = combine cfgPath . ($ defaultX509Config)
-        printXFTPConfig XFTPServerConfig {allowNewFiles, newFileBasicAuth, xftpPort, storeLogFile, fileExpiration} = do
+        printXFTPConfig XFTPServerConfig {allowNewFiles, newFileBasicAuth, xftpPort, storeLogFile, fileExpiration, inactiveClientExpiration} = do
          putStrLn $ case storeLogFile of
            Just f -> "Store log: " <> f
            _ -> "Store log disabled."
          putStrLn $ case fileExpiration of
            Just ExpirationConfig {ttl} -> "expiring files after " <> showTTL ttl
            _ -> "not expiring files"
+          putStrLn $ case inactiveClientExpiration of
+            Just ExpirationConfig {ttl, checkInterval} -> "expiring clients inactive for " <> show ttl <> " seconds every " <> show checkInterval <> " seconds"
+            _ -> "not expiring inactive clients"
          putStrLn $
            "Uploading new files "
              <> if allowNewFiles
@@ -134,17 +145,25 @@ xftpServerCLI cfgPath logPath = do
        serverConfig =
          XFTPServerConfig
            { xftpPort = T.unpack $ strictIni "TRANSPORT" "port" ini,
+              controlPort = either (const Nothing) (Just . T.unpack) $ lookupValue "TRANSPORT" "control_port" ini,
              fileIdSize = 16,
              storeLogFile = enableStoreLog $> storeLogFilePath,
              filesPath = T.unpack $ strictIni "FILES" "path" ini,
              fileSizeQuota = either error unFileSize <$> strDecodeIni "FILES" "storage_quota" ini,
-              allowedChunkSizes = [kb 256, mb 1, mb 4],
+              allowedChunkSizes = serverChunkSizes,
              allowNewFiles = fromMaybe True $ iniOnOff "AUTH" "new_files" ini,
              newFileBasicAuth = either error id <$> strDecodeIni "AUTH" "create_password" ini,
              fileExpiration =
-                Just defaultFileExpiration
-                  { ttl = 3600 * readIniDefault defFileExpirationHours "STORE_LOG" "expire_files_hours" ini
-                  },
+                Just
+                  defaultFileExpiration
+                    { ttl = 3600 * readIniDefault defFileExpirationHours "STORE_LOG" "expire_files_hours" ini
+                    },
+              inactiveClientExpiration =
+                settingIsOn "INACTIVE_CLIENTS" "disconnect" ini
+                  $> ExpirationConfig
+                    { ttl = readStrictIni "INACTIVE_CLIENTS" "ttl" ini,
+                      checkInterval = readStrictIni "INACTIVE_CLIENTS" "check_interval" ini
+                    },
              caCertificateFile = c caCrtFile,
              privateKeyFile = c serverKeyFile,
              certificateFile = c serverCrtFile,
@@ -4,6 +4,7 @@

 module Simplex.FileTransfer.Server.Stats where

+import Control.Applicative ((<|>))
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
 import Data.Int (Int64)
@@ -18,6 +19,7 @@ data FileServerStats = FileServerStats
    filesCreated :: TVar Int,
    fileRecipients :: TVar Int,
    filesUploaded :: TVar Int,
+    filesExpired :: TVar Int,
    filesDeleted :: TVar Int,
    filesDownloaded :: PeriodStats SenderId,
    fileDownloads :: TVar Int,
@@ -31,6 +33,7 @@ data FileServerStatsData = FileServerStatsData
    _filesCreated :: Int,
    _fileRecipients :: Int,
    _filesUploaded :: Int,
+    _filesExpired :: Int,
    _filesDeleted :: Int,
    _filesDownloaded :: PeriodStatsData SenderId,
    _fileDownloads :: Int,
@@ -46,13 +49,14 @@ newFileServerStats ts = do
  filesCreated <- newTVar 0
  fileRecipients <- newTVar 0
  filesUploaded <- newTVar 0
+  filesExpired <- newTVar 0
  filesDeleted <- newTVar 0
  filesDownloaded <- newPeriodStats
  fileDownloads <- newTVar 0
  fileDownloadAcks <- newTVar 0
  filesCount <- newTVar 0
  filesSize <- newTVar 0
-  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}
+  pure FileServerStats {fromTime, filesCreated, fileRecipients, filesUploaded, filesExpired, filesDeleted, filesDownloaded, fileDownloads, fileDownloadAcks, filesCount, filesSize}

 getFileServerStatsData :: FileServerStats -> STM FileServerStatsData
 getFileServerStatsData s = do
@@ -60,13 +64,14 @@ getFileServerStatsData s = do
  _filesCreated <- readTVar $ filesCreated s
  _fileRecipients <- readTVar $ fileRecipients s
  _filesUploaded <- readTVar $ filesUploaded s
+  _filesExpired <- readTVar $ filesExpired s
  _filesDeleted <- readTVar $ filesDeleted s
  _filesDownloaded <- getPeriodStatsData $ filesDownloaded s
  _fileDownloads <- readTVar $ fileDownloads s
  _fileDownloadAcks <- readTVar $ fileDownloadAcks s
  _filesCount <- readTVar $ filesCount s
  _filesSize <- readTVar $ filesSize s
-  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
+  pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}

 setFileServerStats :: FileServerStats -> FileServerStatsData -> STM ()
 setFileServerStats s d = do
@@ -74,6 +79,7 @@ setFileServerStats s d = do
  writeTVar (filesCreated s) $! _filesCreated d
  writeTVar (fileRecipients s) $! _fileRecipients d
  writeTVar (filesUploaded s) $! _filesUploaded d
+  writeTVar (filesExpired s) $! _filesExpired d
  writeTVar (filesDeleted s) $! _filesDeleted d
  setPeriodStats (filesDownloaded s) $! _filesDownloaded d
  writeTVar (fileDownloads s) $! _fileDownloads d
@@ -82,13 +88,16 @@ setFileServerStats s d = do
  writeTVar (filesSize s) $! _filesSize d

 instance StrEncoding FileServerStatsData where
-  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks} =
+  strEncode FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize} =
    B.unlines
      [ "fromTime=" <> strEncode _fromTime,
        "filesCreated=" <> strEncode _filesCreated,
        "fileRecipients=" <> strEncode _fileRecipients,
        "filesUploaded=" <> strEncode _filesUploaded,
+        "filesExpired=" <> strEncode _filesExpired,
        "filesDeleted=" <> strEncode _filesDeleted,
+        "filesCount=" <> strEncode _filesCount,
+        "filesSize=" <> strEncode _filesSize,
        "filesDownloaded:",
        strEncode _filesDownloaded,
        "fileDownloads=" <> strEncode _fileDownloads,
@@ -99,8 +108,11 @@ instance StrEncoding FileServerStatsData where
    _filesCreated <- "filesCreated=" *> strP <* A.endOfLine
    _fileRecipients <- "fileRecipients=" *> strP <* A.endOfLine
    _filesUploaded <- "filesUploaded=" *> strP <* A.endOfLine
+    _filesExpired <- "filesExpired=" *> strP <* A.endOfLine <|> pure 0
    _filesDeleted <- "filesDeleted=" *> strP <* A.endOfLine
+    _filesCount <- "filesCount=" *> strP <* A.endOfLine <|> pure 0
+    _filesSize <- "filesSize=" *> strP <* A.endOfLine <|> pure 0
    _filesDownloaded <- "filesDownloaded:" *> A.endOfLine *> strP <* A.endOfLine
    _fileDownloads <- "fileDownloads=" *> strP <* A.endOfLine
    _fileDownloadAcks <- "fileDownloadAcks=" *> strP <* A.endOfLine
-    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount = 0, _filesSize = 0}
+    pure FileServerStatsData {_fromTime, _filesCreated, _fileRecipients, _filesUploaded, _filesExpired, _filesDeleted, _filesDownloaded, _fileDownloads, _fileDownloadAcks, _filesCount, _filesSize}
@@ -121,12 +121,12 @@ getFile st party fId = case party of
      Just (sId, rKey) -> withFile st sId $ pure . Right . (,rKey)
      _ -> pure $ Left AUTH

-expiredFilePath :: FileStore -> XFTPFileId -> Int64 -> STM (Maybe FilePath)
+expiredFilePath :: FileStore -> XFTPFileId -> Int64 -> STM (Maybe (Maybe FilePath))
 expiredFilePath FileStore {files} sId old =
  TM.lookup sId files
    $>>= \FileRec {filePath, createdAt} ->
      if systemSeconds createdAt < old
-        then readTVar filePath
+        then Just <$> readTVar filePath
        else pure Nothing

 ackFile :: FileStore -> RecipientId -> STM (Either XFTPErrorType ())
@@ -1,32 +1,34 @@
 {-# LANGUAGE DuplicateRecordFields #-}
-{-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiWayIf #-}
 {-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}

 module Simplex.FileTransfer.Transport
  ( supportedFileServerVRange,
    XFTPRcvChunkSpec (..),
-    sendFile,
+    ReceiveFileError (..),
    receiveFile,
    sendEncFile,
    receiveEncFile,
+    receiveSbFile,
  )
 where

 import qualified Control.Exception as E
+import Control.Monad
 import Control.Monad.Except
+import Control.Monad.IO.Class
+import Data.Bifunctor (first)
 import qualified Data.ByteArray as BA
 import Data.ByteString.Builder (Builder, byteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Word (Word32)
-import GHC.IO.Handle.Internals (ioe_EOF)
 import Simplex.FileTransfer.Protocol (XFTPErrorType (..))
 import qualified Simplex.Messaging.Crypto as C
 import qualified Simplex.Messaging.Crypto.Lazy as LC
+import Simplex.Messaging.Transport.HTTP2.File
 import Simplex.Messaging.Version
 import System.IO (Handle, IOMode (..), withFile)

@@ -40,18 +42,6 @@ data XFTPRcvChunkSpec = XFTPRcvChunkSpec
 supportedFileServerVRange :: VersionRange
 supportedFileServerVRange = mkVersionRange 1 1

-fileBlockSize :: Int
-fileBlockSize = 16 * 1024
-
-sendFile :: Handle -> (Builder -> IO ()) -> Word32 -> IO ()
-sendFile h send = go
-  where
-    go 0 = pure ()
-    go sz =
-      getFileChunk h sz >>= \ch -> do
-        send $ byteString ch
-        go $ sz - fromIntegral (B.length ch)
-
 sendEncFile :: Handle -> (Builder -> IO ()) -> LC.SbState -> Word32 -> IO ()
 sendEncFile h send = go
  where
@@ -64,46 +54,42 @@ sendEncFile h send = go
        send (byteString encCh) `E.catch` \(e :: E.SomeException) -> print e >> E.throwIO e
        go sbState' $ sz - fromIntegral (B.length ch)

-getFileChunk :: Handle -> Word32 -> IO ByteString
-getFileChunk h sz =
-  B.hGet h fileBlockSize >>= \case
-    "" -> ioe_EOF
-    ch -> pure $ B.take (fromIntegral sz) ch -- sz >= xftpBlockSize
-
 receiveFile :: (Int -> IO ByteString) -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
 receiveFile getBody = receiveFile_ receive
  where
-    receive h sz = do
-      ch <- getBody fileBlockSize
-      let chSize = fromIntegral $ B.length ch
-      if
-          | chSize > sz -> pure $ Left SIZE
-          | chSize > 0 -> B.hPut h ch >> receive h (sz - chSize)
-          | sz == 0 -> pure $ Right ()
-          | otherwise -> pure $ Left SIZE
+    receive h sz = hReceiveFile getBody h sz >>= \sz' -> pure $ if sz' == 0 then Right () else Left SIZE

 receiveEncFile :: (Int -> IO ByteString) -> LC.SbState -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
 receiveEncFile getBody = receiveFile_ . receive
  where
-    receive sbState h sz = do
+    receive sbState h sz = first err <$> receiveSbFile getBody h sbState sz
+    err RFESize = SIZE
+    err RFECrypto = CRYPTO
+
+data ReceiveFileError = RFESize | RFECrypto
+
+receiveSbFile :: (Int -> IO ByteString) -> Handle -> LC.SbState -> Word32 -> IO (Either ReceiveFileError ())
+receiveSbFile getBody h = receive
+  where
+    receive sbState sz = do
      ch <- getBody fileBlockSize
      let chSize = fromIntegral $ B.length ch
      if
-          | chSize > sz + authSz -> pure $ Left SIZE
-          | chSize > 0 -> do
+        | chSize > sz + authSz -> pure $ Left RFESize
+        | chSize > 0 -> do
            let (ch', rest) = B.splitAt (fromIntegral sz) ch
                (decCh, sbState') = LC.sbDecryptChunk sbState ch'
                sz' = sz - fromIntegral (B.length ch')
            B.hPut h decCh
            if sz' > 0
-              then receive sbState' h sz'
+              then receive sbState' sz'
              else do
                let tag' = B.take C.authTagSize rest
                    tagSz = B.length tag'
                    tag = LC.sbAuth sbState'
                tag'' <- if tagSz == C.authTagSize then pure tag' else (tag' <>) <$> getBody (C.authTagSize - tagSz)
-                pure $ if BA.constEq tag'' tag then Right () else Left CRYPTO
-          | otherwise -> pure $ Left SIZE
+                pure $ if BA.constEq tag'' tag then Right () else Left RFECrypto
+        | otherwise -> pure $ Left RFESize
    authSz = fromIntegral C.authTagSize

 receiveFile_ :: (Handle -> Word32 -> IO (Either XFTPErrorType ())) -> XFTPRcvChunkSpec -> ExceptT XFTPErrorType IO ()
@@ -13,6 +13,7 @@ import Simplex.FileTransfer.Client (XFTPChunkSpec (..))
 import Simplex.FileTransfer.Description
 import Simplex.Messaging.Agent.Protocol (RcvFileId, SndFileId)
 import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.File (CryptoFile (..))
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (fromTextField_)
@@ -49,7 +50,7 @@ data RcvFile = RcvFile
    chunks :: [RcvFileChunk],
    prefixPath :: FilePath,
    tmpPath :: Maybe FilePath,
-    savePath :: FilePath,
+    saveFile :: CryptoFile,
    status :: RcvFileStatus,
    deleted :: Bool
  }
@@ -120,7 +121,7 @@ data SndFile = SndFile
    key :: C.SbKey,
    nonce :: C.CbNonce,
    chunks :: [SndFileChunk],
-    filePath :: FilePath,
+    srcFile :: CryptoFile,
    prefixPath :: Maybe FilePath,
    status :: SndFileStatus,
    deleted :: Bool
@@ -6,6 +6,7 @@
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE NumericUnderscores #-}
 {-# LANGUAGE RankNTypes #-}
+{-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TypeApplications #-}
 {-# OPTIONS_GHC -fno-warn-unticked-promoted-constructors #-}

@@ -17,23 +18,33 @@ module Simplex.Messaging.Agent.Env.SQLite
    NetworkConfig (..),
    defaultAgentConfig,
    defaultReconnectInterval,
+    tryAgentError,
+    tryAgentError',
+    catchAgentError,
+    agentFinally,
    Env (..),
    newSMPAgentEnv,
    createAgentStore,
    NtfSupervisor (..),
    NtfSupervisorCommand (..),
    XFTPAgent (..),
+    Worker (..),
+    RestartCount (..),
+    updateRestartCount,
  )
 where

+import Control.Monad
 import Control.Monad.Except
 import Control.Monad.IO.Unlift
 import Control.Monad.Reader
 import Crypto.Random
+import Data.ByteArray (ScrubbedBytes)
 import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty)
 import Data.Map (Map)
 import Data.Time.Clock (NominalDiffTime, nominalDay)
+import Data.Time.Clock.System (SystemTime (..))
 import Data.Word (Word16)
 import Network.Socket
 import Numeric.Natural
@@ -52,9 +63,10 @@ import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport (TLS, Transport (..))
 import Simplex.Messaging.Transport.Client (defaultSMPPort)
+import Simplex.Messaging.Util (allFinally, catchAllErrors, tryAllErrors)
 import Simplex.Messaging.Version
 import System.Random (StdGen, newStdGen)
-import UnliftIO (Async)
+import UnliftIO (Async, SomeException)
 import UnliftIO.STM

 type AgentMonad' m = (MonadUnliftIO m, MonadReader Env m)
@@ -80,13 +92,17 @@ data AgentConfig = AgentConfig
    messageRetryInterval :: RetryInterval2,
    messageTimeout :: NominalDiffTime,
    helloTimeout :: NominalDiffTime,
+    quotaExceededTimeout :: NominalDiffTime,
    initialCleanupDelay :: Int64,
    cleanupInterval :: Int64,
-    rcvMsgHashesTTL :: NominalDiffTime,
-    processedRatchetKeyHashesTTL :: NominalDiffTime,
+    cleanupStepInterval :: Int,
+    maxWorkerRestartsPerMin :: Int,
+    maxSubscriptionTimeouts :: Int,
+    storedMsgDataTTL :: NominalDiffTime,
    rcvFilesTTL :: NominalDiffTime,
    sndFilesTTL :: NominalDiffTime,
    xftpNotifyErrsOnRetry :: Bool,
+    xftpConsecutiveRetries :: Int,
    xftpMaxRecipientsPerRequest :: Int,
    deleteErrorCount :: Int,
    ntfCron :: Word16,
@@ -99,8 +115,7 @@ data AgentConfig = AgentConfig
    certificateFile :: FilePath,
    e2eEncryptVRange :: VersionRange,
    smpAgentVRange :: VersionRange,
-    smpClientVRange :: VersionRange,
-    initialClientId :: Int
+    smpClientVRange :: VersionRange
  }

 defaultReconnectInterval :: RetryInterval
@@ -121,13 +136,10 @@ defaultMessageRetryInterval =
            maxInterval = 60_000000
          },
      riSlow =
-        -- TODO: these timeouts can be increased in v5.0 once most clients are updated
-        -- to resume sending on QCONT messages.
-        -- After that local message expiration period should be also increased.
        RetryInterval
-          { initialInterval = 60_000000,
+          { initialInterval = 180_000000, -- 3 minutes
            increaseAfter = 60_000000,
-            maxInterval = 3600_000000 -- 1 hour
+            maxInterval = 3 * 3600_000000 -- 3 hours
          }
    }

@@ -145,20 +157,26 @@ defaultAgentConfig =
      messageRetryInterval = defaultMessageRetryInterval,
      messageTimeout = 2 * nominalDay,
      helloTimeout = 2 * nominalDay,
+      quotaExceededTimeout = 7 * nominalDay,
      initialCleanupDelay = 30 * 1000000, -- 30 seconds
      cleanupInterval = 30 * 60 * 1000000, -- 30 minutes
-      rcvMsgHashesTTL = 30 * nominalDay,
-      processedRatchetKeyHashesTTL = 30 * nominalDay,
+      cleanupStepInterval = 200000, -- 200ms
+      maxWorkerRestartsPerMin = 5,
+      -- 3 consecutive subscription timeouts will result in alert to the user
+      -- this is a fallback, as the timeout set to 3x of expected timeout, to avoid potential locking.
+      maxSubscriptionTimeouts = 3,
+      storedMsgDataTTL = 21 * nominalDay,
      rcvFilesTTL = 2 * nominalDay,
      sndFilesTTL = nominalDay,
      xftpNotifyErrsOnRetry = True,
+      xftpConsecutiveRetries = 3,
      xftpMaxRecipientsPerRequest = 200,
      deleteErrorCount = 10,
      ntfCron = 20, -- minutes
      ntfWorkerDelay = 100000, -- microseconds
      ntfSMPWorkerDelay = 500000, -- microseconds
      ntfSubCheckInterval = nominalDay,
-      ntfMaxMessages = 4,
+      ntfMaxMessages = 3,
      -- CA certificate private key is not needed for initialization
      -- ! we do not generate these
      caCertificateFile = "/etc/opt/simplex-agent/ca.crt",
@@ -166,37 +184,36 @@ defaultAgentConfig =
      certificateFile = "/etc/opt/simplex-agent/agent.crt",
      e2eEncryptVRange = supportedE2EEncryptVRange,
      smpAgentVRange = supportedSMPAgentVRange,
-      smpClientVRange = supportedSMPClientVRange,
-      initialClientId = 0
+      smpClientVRange = supportedSMPClientVRange
    }

 data Env = Env
  { config :: AgentConfig,
    store :: SQLiteStore,
-    idsDrg :: TVar ChaChaDRG,
-    clientCounter :: TVar Int,
+    random :: TVar ChaChaDRG,
    randomServer :: TVar StdGen,
    ntfSupervisor :: NtfSupervisor,
-    xftpAgent :: XFTPAgent
+    xftpAgent :: XFTPAgent,
+    multicastSubscribers :: TMVar Int
  }

 newSMPAgentEnv :: AgentConfig -> SQLiteStore -> IO Env
-newSMPAgentEnv config@AgentConfig {initialClientId} store = do
-  idsDrg <- newTVarIO =<< liftIO drgNew
-  clientCounter <- newTVarIO initialClientId
+newSMPAgentEnv config store = do
+  random <- C.newRandom
  randomServer <- newTVarIO =<< liftIO newStdGen
  ntfSupervisor <- atomically . newNtfSubSupervisor $ tbqSize config
  xftpAgent <- atomically newXFTPAgent
-  pure Env {config, store, idsDrg, clientCounter, randomServer, ntfSupervisor, xftpAgent}
+  multicastSubscribers <- newTMVarIO 0
+  pure Env {config, store, random, randomServer, ntfSupervisor, xftpAgent, multicastSubscribers}

-createAgentStore :: FilePath -> String -> MigrationConfirmation -> IO (Either MigrationError SQLiteStore)
-createAgentStore dbFilePath dbKey = createSQLiteStore dbFilePath dbKey Migrations.app
+createAgentStore :: FilePath -> ScrubbedBytes -> Bool -> MigrationConfirmation -> IO (Either MigrationError SQLiteStore)
+createAgentStore dbFilePath dbKey keepKey = createSQLiteStore dbFilePath dbKey keepKey Migrations.app

 data NtfSupervisor = NtfSupervisor
  { ntfTkn :: TVar (Maybe NtfToken),
    ntfSubQ :: TBQueue (ConnId, NtfSupervisorCommand),
-    ntfWorkers :: TMap NtfServer (TMVar (), Async ()),
-    ntfSMPWorkers :: TMap SMPServer (TMVar (), Async ())
+    ntfWorkers :: TMap NtfServer Worker,
+    ntfSMPWorkers :: TMap SMPServer Worker
  }

 data NtfSupervisorCommand = NSCCreate | NSCDelete | NSCSmpDelete | NSCNtfWorker NtfServer | NSCNtfSMPWorker SMPServer
@@ -213,9 +230,9 @@ newNtfSubSupervisor qSize = do
 data XFTPAgent = XFTPAgent
  { -- if set, XFTP file paths will be considered as relative to this directory
    xftpWorkDir :: TVar (Maybe FilePath),
-    xftpRcvWorkers :: TMap (Maybe XFTPServer) (TMVar (), Async ()),
-    xftpSndWorkers :: TMap (Maybe XFTPServer) (TMVar (), Async ()),
-    xftpDelWorkers :: TMap XFTPServer (TMVar (), Async ())
+    xftpRcvWorkers :: TMap (Maybe XFTPServer) Worker,
+    xftpSndWorkers :: TMap (Maybe XFTPServer) Worker,
+    xftpDelWorkers :: TMap XFTPServer Worker
  }

 newXFTPAgent :: STM XFTPAgent
@@ -225,3 +242,41 @@ newXFTPAgent = do
  xftpSndWorkers <- TM.empty
  xftpDelWorkers <- TM.empty
  pure XFTPAgent {xftpWorkDir, xftpRcvWorkers, xftpSndWorkers, xftpDelWorkers}
+
+tryAgentError :: AgentMonad m => m a -> m (Either AgentErrorType a)
+tryAgentError = tryAllErrors mkInternal
+{-# INLINE tryAgentError #-}
+
+-- unlike runExceptT, this ensures we catch IO exceptions as well
+tryAgentError' :: AgentMonad' m => ExceptT AgentErrorType m a -> m (Either AgentErrorType a)
+tryAgentError' = fmap join . runExceptT . tryAgentError
+{-# INLINE tryAgentError' #-}
+
+catchAgentError :: AgentMonad m => m a -> (AgentErrorType -> m a) -> m a
+catchAgentError = catchAllErrors mkInternal
+{-# INLINE catchAgentError #-}
+
+agentFinally :: AgentMonad m => m a -> m b -> m a
+agentFinally = allFinally mkInternal
+{-# INLINE agentFinally #-}
+
+mkInternal :: SomeException -> AgentErrorType
+mkInternal = INTERNAL . show
+{-# INLINE mkInternal #-}
+
+data Worker = Worker
+  { workerId :: Int,
+    doWork :: TMVar (),
+    action :: TMVar (Maybe (Async ())),
+    restarts :: TVar RestartCount
+  }
+
+data RestartCount = RestartCount
+  { restartMinute :: Int64,
+    restartCount :: Int
+  }
+
+updateRestartCount :: SystemTime -> RestartCount -> RestartCount
+updateRestartCount t (RestartCount minute count) = do
+  let min' = systemSeconds t `div` 60
+   in RestartCount min' $ if minute == min' then count + 1 else 1
@@ -1,10 +1,18 @@
 {-# LANGUAGE NamedFieldPuns #-}

-module Simplex.Messaging.Agent.Lock where
+module Simplex.Messaging.Agent.Lock
+  ( Lock,
+    createLock,
+    withLock,
+    withGetLock,
+    withGetLocks,
+  )
+where

 import Control.Monad (void)
 import Control.Monad.IO.Unlift
 import Data.Functor (($>))
+import UnliftIO.Async (forConcurrently)
 import qualified UnliftIO.Exception as E
 import UnliftIO.STM

@@ -20,9 +28,22 @@ withLock lock name =
    (atomically $ putTMVar lock name)
    (void . atomically $ takeTMVar lock)

-withGetLock :: MonadUnliftIO m => STM Lock -> String -> m a -> m a
-withGetLock getLock name a =
+withGetLock :: MonadUnliftIO m => (k -> STM Lock) -> k -> String -> m a -> m a
+withGetLock getLock key name a =
  E.bracket
-    (atomically $ getLock >>= \l -> putTMVar l name $> l)
+    (atomically $ getPutLock getLock key name)
    (atomically . takeTMVar)
    (const a)
+
+withGetLocks :: MonadUnliftIO m => (k -> STM Lock) -> [k] -> String -> m a -> m a
+withGetLocks getLock keys name = E.bracket holdLocks releaseLocks . const
+  where
+    holdLocks = forConcurrently keys $ \key -> atomically $ getPutLock getLock key name
+    -- only this withGetLocks would be holding the locks,
+    -- so it's safe to combine all lock releases into one transaction
+    releaseLocks = atomically . mapM_ takeTMVar
+
+-- getLock and putTMVar can be in one transaction on the assumption that getLock doesn't write in case the lock already exists,
+-- and in case it is created and added to some shared resource (we use TMap) it also helps avoid contention for the newly created lock.
+getPutLock :: (k -> STM Lock) -> k -> String -> STM Lock
+getPutLock getLock key name = getLock key >>= \l -> putTMVar l name $> l
@@ -5,6 +5,7 @@
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TupleSections #-}
+{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.Messaging.Agent.NtfSubSupervisor
  ( runNtfSupervisor,
@@ -17,7 +18,6 @@ module Simplex.Messaging.Agent.NtfSubSupervisor
  )
 where

-import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple (logError, logInfo)
 import Control.Monad
 import Control.Monad.Except
@@ -37,9 +37,7 @@ import Simplex.Messaging.Client.Agent ()
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Notifications.Protocol (NtfSubStatus (..), NtfTknStatus (..), SMPQueueNtf (..))
 import Simplex.Messaging.Notifications.Types
-import Simplex.Messaging.Protocol (NtfServer, ProtocolServer, SMPServer, sameSrvAddr)
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
+import Simplex.Messaging.Protocol (NtfServer, SMPServer, sameSrvAddr)
 import Simplex.Messaging.Util (diffToMicroseconds, threadDelay', tshow, unlessM)
 import System.Random (randomR)
 import UnliftIO
@@ -51,13 +49,13 @@ runNtfSupervisor c = do
  ns <- asks ntfSupervisor
  forever $ do
    cmd@(connId, _) <- atomically . readTBQueue $ ntfSubQ ns
-    handleError connId . agentOperationBracket c AONtfNetwork waitUntilActive $
+    handleErr connId . agentOperationBracket c AONtfNetwork waitUntilActive $
      runExceptT (processNtfSub c cmd) >>= \case
        Left e -> notifyErr connId e
        Right _ -> return ()
  where
-    handleError :: ConnId -> m () -> m ()
-    handleError connId = E.handle $ \(e :: E.SomeException) -> do
+    handleErr :: ConnId -> m () -> m ()
+    handleErr connId = E.handle $ \(e :: E.SomeException) -> do
      logError $ "runNtfSupervisor error " <> tshow e
      notifyErr connId e
    notifyErr connId e = notifyInternalError c connId $ "runNtfSupervisor error " <> show e
@@ -74,16 +72,16 @@ processNtfSub c (connId, cmd) = do
      logInfo $ "processNtfSub, NSCCreate - a = " <> tshow a
      case a of
        Nothing -> do
-          withNtfServer c $ \ntfServer -> do
+          withTokenServer $ \ntfServer -> do
            case clientNtfCreds of
              Just ClientNtfCreds {notifierId} -> do
                let newSub = newNtfSubscription connId smpServer (Just notifierId) ntfServer NASKey
                withStore c $ \db -> createNtfSubscription db newSub $ NtfSubNTFAction NSACreate
-                addNtfNTFWorker ntfServer
+                void $ getNtfNTFWorker True c ntfServer
              Nothing -> do
                let newSub = newNtfSubscription connId smpServer Nothing ntfServer NASNew
                withStore c $ \db -> createNtfSubscription db newSub $ NtfSubSMPAction NSASmpKey
-                addNtfSMPWorker smpServer
+                void $ getNtfSMPWorker True c smpServer
        (Just (sub@NtfSubscription {ntfSubStatus, ntfServer = subNtfServer, smpServer = smpServer', ntfQueueId}, action_)) -> do
          case (clientNtfCreds, ntfQueueId) of
            (Just ClientNtfCreds {notifierId}, Just ntfQueueId')
@@ -99,84 +97,74 @@ processNtfSub c (connId, cmd) = do
              Just (action, _)
                -- subscription was marked for deletion / is being deleted
                | isDeleteNtfSubAction action -> do
-                  if ntfSubStatus == NASNew || ntfSubStatus == NASOff || ntfSubStatus == NASDeleted
-                    then resetSubscription
-                    else withNtfServer c $ \ntfServer -> do
-                      withStore' c $ \db -> supervisorUpdateNtfSub db sub {ntfServer} (NtfSubNTFAction NSACreate)
-                      addNtfNTFWorker ntfServer
+                    if ntfSubStatus == NASNew || ntfSubStatus == NASOff || ntfSubStatus == NASDeleted
+                      then resetSubscription
+                      else withTokenServer $ \ntfServer -> do
+                        withStore' c $ \db -> supervisorUpdateNtfSub db sub {ntfServer} (NtfSubNTFAction NSACreate)
+                        void $ getNtfNTFWorker True c ntfServer
                | otherwise -> case action of
-                  NtfSubNTFAction _ -> addNtfNTFWorker subNtfServer
-                  NtfSubSMPAction _ -> addNtfSMPWorker smpServer
+                    NtfSubNTFAction _ -> void $ getNtfNTFWorker True c subNtfServer
+                    NtfSubSMPAction _ -> void $ getNtfSMPWorker True c smpServer
            rotate :: m ()
            rotate = do
              withStore' c $ \db -> supervisorUpdateNtfSub db sub (NtfSubNTFAction NSARotate)
-              addNtfNTFWorker subNtfServer
+              void $ getNtfNTFWorker True c subNtfServer
            resetSubscription :: m ()
            resetSubscription =
-              withNtfServer c $ \ntfServer -> do
+              withTokenServer $ \ntfServer -> do
                let sub' = sub {ntfQueueId = Nothing, ntfServer, ntfSubId = Nothing, ntfSubStatus = NASNew}
                withStore' c $ \db -> supervisorUpdateNtfSub db sub' (NtfSubSMPAction NSASmpKey)
-                addNtfSMPWorker smpServer
+                void $ getNtfSMPWorker True c smpServer
    NSCDelete -> do
      sub_ <- withStore' c $ \db -> do
        supervisorUpdateNtfAction db connId (NtfSubNTFAction NSADelete)
        getNtfSubscription db connId
      logInfo $ "processNtfSub, NSCDelete - sub_ = " <> tshow sub_
      case sub_ of
-        (Just (NtfSubscription {ntfServer}, _)) -> addNtfNTFWorker ntfServer
+        (Just (NtfSubscription {ntfServer}, _)) -> void $ getNtfNTFWorker True c ntfServer
        _ -> pure () -- err "NSCDelete - no subscription"
    NSCSmpDelete -> do
      withStore' c (`getPrimaryRcvQueue` connId) >>= \case
        Right rq@RcvQueue {server = smpServer} -> do
          logInfo $ "processNtfSub, NSCSmpDelete - rq = " <> tshow rq
          withStore' c $ \db -> supervisorUpdateNtfAction db connId (NtfSubSMPAction NSASmpDelete)
-          addNtfSMPWorker smpServer
+          void $ getNtfSMPWorker True c smpServer
        _ -> notifyInternalError c connId "NSCSmpDelete - no rcv queue"
-    NSCNtfWorker ntfServer -> addNtfNTFWorker ntfServer
-    NSCNtfSMPWorker smpServer -> addNtfSMPWorker smpServer
-  where
-    addNtfNTFWorker = addWorker ntfWorkers runNtfWorker
-    addNtfSMPWorker = addWorker ntfSMPWorkers runNtfSMPWorker
-    addWorker ::
-      (NtfSupervisor -> TMap (ProtocolServer s) (TMVar (), Async ())) ->
-      (AgentClient -> ProtocolServer s -> TMVar () -> m ()) ->
-      ProtocolServer s ->
-      m ()
-    addWorker wsSel runWorker srv = do
-      ws <- asks $ wsSel . ntfSupervisor
-      atomically (TM.lookup srv ws) >>= \case
-        Nothing -> do
-          doWork <- newTMVarIO ()
-          worker <- async $ runWorker c srv doWork `E.finally` atomically (TM.delete srv ws)
-          atomically $ TM.insert srv (doWork, worker) ws
-        Just (doWork, _) ->
-          void . atomically $ tryPutTMVar doWork ()
+    NSCNtfWorker ntfServer -> void $ getNtfNTFWorker True c ntfServer
+    NSCNtfSMPWorker smpServer -> void $ getNtfSMPWorker True c smpServer

-withNtfServer :: AgentMonad' m => AgentClient -> (NtfServer -> m ()) -> m ()
-withNtfServer c action = getNtfServer c >>= mapM_ action
+getNtfNTFWorker :: AgentMonad' m => Bool -> AgentClient -> NtfServer -> m Worker
+getNtfNTFWorker hasWork c server = do
+  ws <- asks $ ntfWorkers . ntfSupervisor
+  getAgentWorker "ntf_ntf" hasWork c server ws $ runNtfWorker c server

-runNtfWorker :: forall m. AgentMonad m => AgentClient -> NtfServer -> TMVar () -> m ()
-runNtfWorker c srv doWork = do
+getNtfSMPWorker :: AgentMonad' m => Bool -> AgentClient -> SMPServer -> m Worker
+getNtfSMPWorker hasWork c server = do
+  ws <- asks $ ntfSMPWorkers . ntfSupervisor
+  getAgentWorker "ntf_smp" hasWork c server ws $ runNtfSMPWorker c server
+
+withTokenServer :: AgentMonad' m => (NtfServer -> m ()) -> m ()
+withTokenServer action = getNtfToken >>= mapM_ (\NtfToken {ntfServer} -> action ntfServer)
+
+runNtfWorker :: forall m. AgentMonad m => AgentClient -> NtfServer -> Worker -> m ()
+runNtfWorker c srv Worker {doWork} = do
  delay <- asks $ ntfWorkerDelay . config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    agentOperationBracket c AONtfNetwork throwWhenInactive runNtfOperation
    threadDelay delay
  where
    runNtfOperation :: m ()
-    runNtfOperation = do
-      nextSub_ <- withStore' c (`getNextNtfSubNTFAction` srv)
-      logInfo $ "runNtfWorker, nextSub_ " <> tshow nextSub_
-      case nextSub_ of
-        Nothing -> noWorkToDo
-        Just a@(NtfSubscription {connId}, _, _) -> do
+    runNtfOperation =
+      withWork c doWork (`getNextNtfSubNTFAction` srv) $
+        \nextSub@(NtfSubscription {connId}, _, _) -> do
+          logInfo $ "runNtfWorker, nextSub " <> tshow nextSub
          ri <- asks $ reconnectInterval . config
          withRetryInterval ri $ \_ loop ->
-            processAction a
-              `catchError` retryOnError c "NtfWorker" loop (workerInternalError c connId . show)
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    processAction :: (NtfSubscription, NtfSubNTFAction, NtfActionTs) -> m ()
-    processAction (sub@NtfSubscription {connId, smpServer, ntfSubId}, action, actionTs) = do
+            processSub nextSub
+              `catchAgentError` retryOnError c "NtfWorker" loop (workerInternalError c connId . show)
+    processSub :: (NtfSubscription, NtfSubNTFAction, NtfActionTs) -> m ()
+    processSub (sub@NtfSubscription {connId, smpServer, ntfSubId}, action, actionTs) = do
      ts <- liftIO getCurrentTime
      unlessM (rescheduleAction doWork ts actionTs) $
        case action of
@@ -213,7 +201,7 @@ runNtfWorker c srv doWork = do
          NSADelete -> case ntfSubId of
            Just nSubId ->
              (getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
-                `E.finally` continueDeletion
+                `agentFinally` continueDeletion
            _ -> continueDeletion
            where
              continueDeletion = do
@@ -224,7 +212,7 @@ runNtfWorker c srv doWork = do
          NSARotate -> case ntfSubId of
            Just nSubId ->
              (getNtfToken >>= mapM_ (agentNtfDeleteSubscription c nSubId))
-                `E.finally` deleteCreate
+                `agentFinally` deleteCreate
            _ -> deleteCreate
            where
              deleteCreate = do
@@ -240,27 +228,24 @@ runNtfWorker c srv doWork = do
          withStore' c $ \db ->
            updateNtfSubscription db sub {ntfSubStatus = toStatus} toAction actionTs'

-runNtfSMPWorker :: forall m. AgentMonad m => AgentClient -> SMPServer -> TMVar () -> m ()
-runNtfSMPWorker c srv doWork = do
+runNtfSMPWorker :: forall m. AgentMonad m => AgentClient -> SMPServer -> Worker -> m ()
+runNtfSMPWorker c srv Worker {doWork} = do
  delay <- asks $ ntfSMPWorkerDelay . config
  forever $ do
-    void . atomically $ readTMVar doWork
+    waitForWork doWork
    agentOperationBracket c AONtfNetwork throwWhenInactive runNtfSMPOperation
    threadDelay delay
  where
-    runNtfSMPOperation = do
-      nextSub_ <- withStore' c (`getNextNtfSubSMPAction` srv)
-      logInfo $ "runNtfSMPWorker, nextSub_ " <> tshow nextSub_
-      case nextSub_ of
-        Nothing -> noWorkToDo
-        Just a@(NtfSubscription {connId}, _, _) -> do
+    runNtfSMPOperation =
+      withWork c doWork (`getNextNtfSubSMPAction` srv) $
+        \nextSub@(NtfSubscription {connId}, _, _) -> do
+          logInfo $ "runNtfSMPWorker, nextSub " <> tshow nextSub
          ri <- asks $ reconnectInterval . config
          withRetryInterval ri $ \_ loop ->
-            processAction a
-              `catchError` retryOnError c "NtfSMPWorker" loop (workerInternalError c connId . show)
-    noWorkToDo = void . atomically $ tryTakeTMVar doWork
-    processAction :: (NtfSubscription, NtfSubSMPAction, NtfActionTs) -> m ()
-    processAction (sub@NtfSubscription {connId, ntfServer}, smpAction, actionTs) = do
+            processSub nextSub
+              `catchAgentError` retryOnError c "NtfSMPWorker" loop (workerInternalError c connId . show)
+    processSub :: (NtfSubscription, NtfSubSMPAction, NtfActionTs) -> m ()
+    processSub (sub@NtfSubscription {connId, ntfServer}, smpAction, actionTs) = do
      ts <- liftIO getCurrentTime
      unlessM (rescheduleAction doWork ts actionTs) $
        case smpAction of
@@ -269,8 +254,9 @@ runNtfSMPWorker c srv doWork = do
              Just NtfToken {ntfTknStatus = NTActive, ntfMode = NMInstant} -> do
                rq <- withStore c (`getPrimaryRcvQueue` connId)
                C.SignAlg a <- asks (cmdSignAlg . config)
-                (ntfPublicKey, ntfPrivateKey) <- liftIO $ C.generateSignatureKeyPair a
-                (rcvNtfPubDhKey, rcvNtfPrivDhKey) <- liftIO C.generateKeyPair'
+                g <- asks random
+                (ntfPublicKey, ntfPrivateKey) <- atomically $ C.generateSignatureKeyPair a g
+                (rcvNtfPubDhKey, rcvNtfPrivDhKey) <- atomically $ C.generateKeyPair g
                (notifierId, rcvNtfSrvPubDhKey) <- enableQueueNotifications c rq ntfPublicKey rcvNtfPubDhKey
                let rcvNtfDhSecret = C.dh' rcvNtfSrvPubDhKey rcvNtfPrivDhKey
                withStore' c $ \db -> do
@@ -290,11 +276,11 @@ rescheduleAction :: AgentMonad' m => TMVar () -> UTCTime -> UTCTime -> m Bool
 rescheduleAction doWork ts actionTs
  | actionTs <= ts = pure False
  | otherwise = do
-    void . atomically $ tryTakeTMVar doWork
-    void . forkIO $ do
-      liftIO $ threadDelay' $ diffToMicroseconds $ diffUTCTime actionTs ts
-      void . atomically $ tryPutTMVar doWork ()
-    pure True
+      void . atomically $ tryTakeTMVar doWork
+      void . forkIO $ do
+        liftIO $ threadDelay' $ diffToMicroseconds $ diffUTCTime actionTs ts
+        atomically $ hasWorkToDo' doWork
+      pure True

 retryOnError :: AgentMonad' m => AgentClient -> Text -> m () -> (AgentErrorType -> m ()) -> AgentErrorType -> m ()
 retryOnError c name loop done e = do
@@ -342,13 +328,10 @@ instantNotifications = \case

 closeNtfSupervisor :: MonadUnliftIO m => NtfSupervisor -> m ()
 closeNtfSupervisor ns = do
-  cancelNtfWorkers_ $ ntfWorkers ns
-  cancelNtfWorkers_ $ ntfSMPWorkers ns
-
-cancelNtfWorkers_ :: MonadUnliftIO m => TMap (ProtocolServer s) (TMVar (), Async ()) -> m ()
-cancelNtfWorkers_ wsVar = do
-  ws <- atomically $ stateTVar wsVar (,M.empty)
-  mapM_ (uninterruptibleCancel . snd) ws
+  stopWorkers $ ntfWorkers ns
+  stopWorkers $ ntfSMPWorkers ns
+  where
+    stopWorkers workers = atomically (swapTVar workers M.empty) >>= mapM_ (liftIO . cancelWorker)

 getNtfServer :: AgentMonad' m => AgentClient -> m (Maybe NtfServer)
 getNtfServer c = do
@@ -1,6 +1,5 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE GADTs #-}
@@ -13,6 +12,7 @@
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE StandaloneDeriving #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
 {-# LANGUAGE TypeFamilies #-}
@@ -69,6 +69,10 @@ module Simplex.Messaging.Agent.Protocol
    AgentMessageType (..),
    APrivHeader (..),
    AMessage (..),
+    AMessageReceipt (..),
+    MsgReceipt (..),
+    MsgReceiptInfo,
+    MsgReceiptStatus (..),
    SndQAddr,
    SMPServer,
    pattern SMPServer,
@@ -76,6 +80,8 @@ module Simplex.Messaging.Agent.Protocol
    SMPServerWithAuth,
    SrvLoc (..),
    SMPQueue (..),
+    qAddress,
+    sameQueue,
    sameQAddress,
    noAuthSrv,
    SMPQueueUri (..),
@@ -145,7 +151,7 @@ import Control.Monad (unless)
 import Control.Monad.Except (runExceptT, throwError)
 import Control.Monad.IO.Class
 import Data.Aeson (FromJSON (..), ToJSON (..))
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import Data.Attoparsec.ByteString.Char8 (Parser)
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.ByteString.Base64
@@ -170,8 +176,6 @@ import Data.Typeable ()
 import Data.Word (Word32)
 import Database.SQLite.Simple.FromField
 import Database.SQLite.Simple.ToField
-import GHC.Generics (Generic)
-import Generic.Random (genericArbitraryU)
 import Simplex.FileTransfer.Description
 import Simplex.FileTransfer.Protocol (FileParty (..), XFTPErrorType)
 import Simplex.Messaging.Agent.QueryString
@@ -189,10 +193,12 @@ import Simplex.Messaging.Protocol
    MsgId,
    NMsgMeta,
    ProtocolServer (..),
+    SMPMsgMeta,
    SMPServer,
    SMPServerWithAuth,
    SndPublicVerifyKey,
    SrvLoc (..),
+    SubscriptionMode,
    legacyEncodeServer,
    legacyServerP,
    legacyStrEncodeServer,
@@ -206,12 +212,12 @@ import Simplex.Messaging.Transport (Transport (..), TransportError, serializeTra
 import Simplex.Messaging.Transport.Client (TransportHost, TransportHosts_ (..))
 import Simplex.Messaging.Util
 import Simplex.Messaging.Version
-import Test.QuickCheck (Arbitrary (..))
+import Simplex.RemoteControl.Types
 import Text.Read
 import UnliftIO.Exception (Exception)

 currentSMPAgentVersion :: Version
-currentSMPAgentVersion = 3
+currentSMPAgentVersion = 4

 supportedSMPAgentVRange :: VersionRange
 supportedSMPAgentVRange = mkVersionRange 1 currentSMPAgentVersion
@@ -309,12 +315,12 @@ type ConnInfo = ByteString

 -- | Parameterized type for SMP agent protocol commands and responses from all participants.
 data ACommand (p :: AParty) (e :: AEntity) where
-  NEW :: Bool -> AConnectionMode -> ACommand Client AEConn -- response INV
+  NEW :: Bool -> AConnectionMode -> SubscriptionMode -> ACommand Client AEConn -- response INV
  INV :: AConnectionRequestUri -> ACommand Agent AEConn
-  JOIN :: Bool -> AConnectionRequestUri -> ConnInfo -> ACommand Client AEConn -- response OK
+  JOIN :: Bool -> AConnectionRequestUri -> SubscriptionMode -> ConnInfo -> ACommand Client AEConn -- response OK
  CONF :: ConfirmationId -> [SMPServer] -> ConnInfo -> ACommand Agent AEConn -- ConnInfo is from sender, [SMPServer] will be empty only in v1 handshake
  LET :: ConfirmationId -> ConnInfo -> ACommand Client AEConn -- ConnInfo is from client
-  REQ :: InvitationId -> L.NonEmpty SMPServer -> ConnInfo -> ACommand Agent AEConn -- ConnInfo is from sender
+  REQ :: InvitationId -> NonEmpty SMPServer -> ConnInfo -> ACommand Agent AEConn -- ConnInfo is from sender
  ACPT :: InvitationId -> ConnInfo -> ACommand Client AEConn -- ConnInfo is from client
  RJCT :: InvitationId -> ACommand Client AEConn
  INFO :: ConnInfo -> ACommand Agent AEConn
@@ -326,13 +332,16 @@ data ACommand (p :: AParty) (e :: AEntity) where
  DOWN :: SMPServer -> [ConnId] -> ACommand Agent AENone
  UP :: SMPServer -> [ConnId] -> ACommand Agent AENone
  SWITCH :: QueueDirection -> SwitchPhase -> ConnectionStats -> ACommand Agent AEConn
-  RSYNC :: RatchetSyncState -> ConnectionStats -> ACommand Agent AEConn
+  RSYNC :: RatchetSyncState -> Maybe AgentCryptoError -> ConnectionStats -> ACommand Agent AEConn
  SEND :: MsgFlags -> MsgBody -> ACommand Client AEConn
  MID :: AgentMsgId -> ACommand Agent AEConn
  SENT :: AgentMsgId -> ACommand Agent AEConn
  MERR :: AgentMsgId -> AgentErrorType -> ACommand Agent AEConn
+  MERRS :: NonEmpty AgentMsgId -> AgentErrorType -> ACommand Agent AEConn
  MSG :: MsgMeta -> MsgFlags -> MsgBody -> ACommand Agent AEConn
-  ACK :: AgentMsgId -> ACommand Client AEConn
+  MSGNTF :: SMPMsgMeta -> ACommand Agent AEConn
+  ACK :: AgentMsgId -> Maybe MsgReceiptInfo -> ACommand Client AEConn
+  RCVD :: MsgMeta -> NonEmpty MsgReceipt -> ACommand Agent AEConn
  SWCH :: ACommand Client AEConn
  OFF :: ACommand Client AEConn
  DEL :: ACommand Client AEConn
@@ -390,8 +399,11 @@ data ACommandTag (p :: AParty) (e :: AEntity) where
  MID_ :: ACommandTag Agent AEConn
  SENT_ :: ACommandTag Agent AEConn
  MERR_ :: ACommandTag Agent AEConn
+  MERRS_ :: ACommandTag Agent AEConn
  MSG_ :: ACommandTag Agent AEConn
+  MSGNTF_ :: ACommandTag Agent AEConn
  ACK_ :: ACommandTag Client AEConn
+  RCVD_ :: ACommandTag Agent AEConn
  SWCH_ :: ACommandTag Client AEConn
  OFF_ :: ACommandTag Client AEConn
  DEL_ :: ACommandTag Client AEConn
@@ -442,8 +454,11 @@ aCommandTag = \case
  MID _ -> MID_
  SENT _ -> SENT_
  MERR {} -> MERR_
+  MERRS {} -> MERRS_
  MSG {} -> MSG_
-  ACK _ -> ACK_
+  MSGNTF {} -> MSGNTF_
+  ACK {} -> ACK_
+  RCVD {} -> RCVD_
  SWCH -> SWCH_
  OFF -> OFF_
  DEL -> DEL_
@@ -604,13 +619,11 @@ data RcvQueueInfo = RcvQueueInfo
    rcvSwitchStatus :: Maybe RcvSwitchStatus,
    canAbortSwitch :: Bool
  }
-  deriving (Eq, Show, Generic)
-
-instance ToJSON RcvQueueInfo where toEncoding = J.genericToEncoding J.defaultOptions {J.omitNothingFields = True}
+  deriving (Eq, Show)

 instance StrEncoding RcvQueueInfo where
  strEncode RcvQueueInfo {rcvServer, rcvSwitchStatus, canAbortSwitch} =
-    "srv=" <> strEncode rcvServer
+    ("srv=" <> strEncode rcvServer)
      <> maybe "" (\switch -> ";switch=" <> strEncode switch) rcvSwitchStatus
      <> (";can_abort_switch=" <> strEncode canAbortSwitch)
  strP = do
@@ -623,9 +636,7 @@ data SndQueueInfo = SndQueueInfo
  { sndServer :: SMPServer,
    sndSwitchStatus :: Maybe SndSwitchStatus
  }
-  deriving (Eq, Show, Generic)
-
-instance ToJSON SndQueueInfo where toEncoding = J.genericToEncoding J.defaultOptions {J.omitNothingFields = True}
+  deriving (Eq, Show)

 instance StrEncoding SndQueueInfo where
  strEncode SndQueueInfo {sndServer, sndSwitchStatus} =
@@ -642,11 +653,11 @@ data ConnectionStats = ConnectionStats
    ratchetSyncState :: RatchetSyncState,
    ratchetSyncSupported :: Bool
  }
-  deriving (Eq, Show, Generic)
+  deriving (Eq, Show)

 instance StrEncoding ConnectionStats where
  strEncode ConnectionStats {connAgentVersion, rcvQueuesInfo, sndQueuesInfo, ratchetSyncState, ratchetSyncSupported} =
-    "agent_version=" <> strEncode connAgentVersion
+    ("agent_version=" <> strEncode connAgentVersion)
      <> (" rcv=" <> strEncodeList rcvQueuesInfo)
      <> (" snd=" <> strEncodeList sndQueuesInfo)
      <> (" sync=" <> strEncode ratchetSyncState)
@@ -659,8 +670,6 @@ instance StrEncoding ConnectionStats where
    ratchetSyncSupported <- " sync_supported=" *> strP
    pure ConnectionStats {connAgentVersion, rcvQueuesInfo, sndQueuesInfo, ratchetSyncState, ratchetSyncSupported}

-instance ToJSON ConnectionStats where toEncoding = J.genericToEncoding J.defaultOptions
-
 data NotificationsMode = NMPeriodic | NMInstant
  deriving (Eq, Show)

@@ -678,6 +687,9 @@ instance ToJSON NotificationsMode where
  toEncoding = strToJEncoding
  toJSON = strToJSON

+instance FromJSON NotificationsMode where
+  parseJSON = strParseJSON "NotificationsMode"
+
 instance ToField NotificationsMode where toField = toField . strEncode

 instance FromField NotificationsMode where fromField = blobFieldDecoder $ parseAll strP
@@ -743,6 +755,25 @@ data MsgMeta = MsgMeta
  }
  deriving (Eq, Show)

+instance StrEncoding MsgMeta where
+  strEncode MsgMeta {integrity, recipient = (rmId, rTs), broker = (bmId, bTs), sndMsgId} =
+    B.unwords
+      [ strEncode integrity,
+        "R=" <> bshow rmId <> "," <> showTs rTs,
+        "B=" <> encode bmId <> "," <> showTs bTs,
+        "S=" <> bshow sndMsgId
+      ]
+    where
+      showTs = B.pack . formatISO8601Millis
+  strP = do
+    integrity <- strP
+    recipient <- " R=" *> partyMeta A.decimal
+    broker <- " B=" *> partyMeta base64P
+    sndMsgId <- " S=" *> A.decimal
+    pure MsgMeta {integrity, recipient, broker, sndMsgId}
+    where
+      partyMeta idParser = (,) <$> idParser <* A.char ',' <*> tsISO8601P
+
 data SMPConfirmation = SMPConfirmation
  { -- | sender's public key to use for authentication of sender's commands at the recepient's server
    senderKey :: SndPublicVerifyKey,
@@ -815,7 +846,7 @@ data AgentMessage
  = AgentConnInfo ConnInfo
  | -- AgentConnInfoReply is only used in duplexHandshake mode (v2), allowing to include reply queue(s) in the initial confirmation.
    -- It makes REPLY message unnecessary.
-    AgentConnInfoReply (L.NonEmpty SMPQueueInfo) ConnInfo
+    AgentConnInfoReply (NonEmpty SMPQueueInfo) ConnInfo
  | AgentRatchetInfo ByteString
  | AgentMessage APrivHeader AMessage
  deriving (Show)
@@ -841,6 +872,7 @@ data AgentMessageType
  | AM_HELLO_
  | AM_REPLY_
  | AM_A_MSG_
+  | AM_A_RCVD_
  | AM_QCONT_
  | AM_QADD_
  | AM_QKEY_
@@ -857,6 +889,7 @@ instance Encoding AgentMessageType where
    AM_HELLO_ -> "H"
    AM_REPLY_ -> "R"
    AM_A_MSG_ -> "M"
+    AM_A_RCVD_ -> "V"
    AM_QCONT_ -> "QC"
    AM_QADD_ -> "QA"
    AM_QKEY_ -> "QK"
@@ -871,6 +904,7 @@ instance Encoding AgentMessageType where
      'H' -> pure AM_HELLO_
      'R' -> pure AM_REPLY_
      'M' -> pure AM_A_MSG_
+      'V' -> pure AM_A_RCVD_
      'Q' ->
        A.anyChar >>= \case
          'C' -> pure AM_QCONT_
@@ -896,6 +930,7 @@ agentMessageType = \case
    -- REPLY is only used in v1
    REPLY _ -> AM_REPLY_
    A_MSG _ -> AM_A_MSG_
+    A_RCVD {} -> AM_A_RCVD_
    QCONT _ -> AM_QCONT_
    QADD _ -> AM_QADD_
    QKEY _ -> AM_QKEY_
@@ -920,6 +955,7 @@ data AMsgType
  = HELLO_
  | REPLY_
  | A_MSG_
+  | A_RCVD_
  | QCONT_
  | QADD_
  | QKEY_
@@ -933,6 +969,7 @@ instance Encoding AMsgType where
    HELLO_ -> "H"
    REPLY_ -> "R"
    A_MSG_ -> "M"
+    A_RCVD_ -> "V"
    QCONT_ -> "QC"
    QADD_ -> "QA"
    QKEY_ -> "QK"
@@ -944,6 +981,7 @@ instance Encoding AMsgType where
      'H' -> pure HELLO_
      'R' -> pure REPLY_
      'M' -> pure A_MSG_
+      'V' -> pure A_RCVD_
      'Q' ->
        A.anyChar >>= \case
          'C' -> pure QCONT_
@@ -962,23 +1000,63 @@ data AMessage
  = -- | the first message in the queue to validate it is secured
    HELLO
  | -- | reply queues information
-    REPLY (L.NonEmpty SMPQueueInfo)
+    REPLY (NonEmpty SMPQueueInfo)
  | -- | agent envelope for the client message
    A_MSG MsgBody
+  | -- | agent envelope for delivery receipt
+    A_RCVD (NonEmpty AMessageReceipt)
  | -- | the message instructing the client to continue sending messages (after ERR QUOTA)
    QCONT SndQAddr
  | -- add queue to connection (sent by recipient), with optional address of the replaced queue
-    QADD (L.NonEmpty (SMPQueueUri, Maybe SndQAddr))
+    QADD (NonEmpty (SMPQueueUri, Maybe SndQAddr))
  | -- key to secure the added queues and agree e2e encryption key (sent by sender)
-    QKEY (L.NonEmpty (SMPQueueInfo, SndPublicVerifyKey))
+    QKEY (NonEmpty (SMPQueueInfo, SndPublicVerifyKey))
  | -- inform that the queues are ready to use (sent by recipient)
-    QUSE (L.NonEmpty (SndQAddr, Bool))
+    QUSE (NonEmpty (SndQAddr, Bool))
  | -- sent by the sender to test new queues and to complete switching
-    QTEST (L.NonEmpty SndQAddr)
+    QTEST (NonEmpty SndQAddr)
  | -- ratchet re-synchronization is complete, with last decrypted sender message id (recipient's `last_external_snd_msg_id`)
-    EREADY Int64
+    EREADY AgentMsgId
  deriving (Show)

+-- | this type is used to send as part of the protocol between different clients
+-- TODO possibly, rename fields and types referring to external and internal IDs to make them different
+data AMessageReceipt = AMessageReceipt
+  { agentMsgId :: AgentMsgId, -- this is an external snd message ID referenced by the message recipient
+    msgHash :: MsgHash,
+    rcptInfo :: MsgReceiptInfo
+  }
+  deriving (Show)
+
+-- | this type is used as part of agent protocol to communicate with the user application
+data MsgReceipt = MsgReceipt
+  { agentMsgId :: AgentMsgId, -- this is an internal agent message ID of received message
+    msgRcptStatus :: MsgReceiptStatus
+  }
+  deriving (Eq, Show)
+
+data MsgReceiptStatus = MROk | MRBadMsgHash
+  deriving (Eq, Show)
+
+instance StrEncoding MsgReceiptStatus where
+  strEncode = \case
+    MROk -> "ok"
+    MRBadMsgHash -> "badMsgHash"
+  strP =
+    A.takeWhile1 (/= ' ') >>= \case
+      "ok" -> pure MROk
+      "badMsgHash" -> pure MRBadMsgHash
+      _ -> fail "bad MsgReceiptStatus"
+
+instance ToJSON MsgReceiptStatus where
+  toJSON = strToJSON
+  toEncoding = strToJEncoding
+
+instance FromJSON MsgReceiptStatus where
+  parseJSON = strParseJSON "MsgReceiptStatus"
+
+type MsgReceiptInfo = ByteString
+
 type SndQAddr = (SMPServer, SMP.SenderId)

 instance Encoding AMessage where
@@ -986,6 +1064,7 @@ instance Encoding AMessage where
    HELLO -> smpEncode HELLO_
    REPLY smpQueues -> smpEncode (REPLY_, smpQueues)
    A_MSG body -> smpEncode (A_MSG_, Tail body)
+    A_RCVD mrs -> smpEncode (A_RCVD_, mrs)
    QCONT addr -> smpEncode (QCONT_, addr)
    QADD qs -> smpEncode (QADD_, qs)
    QKEY qs -> smpEncode (QKEY_, qs)
@@ -998,6 +1077,7 @@ instance Encoding AMessage where
        HELLO_ -> pure HELLO
        REPLY_ -> REPLY <$> smpP
        A_MSG_ -> A_MSG . unTail <$> smpP
+        A_RCVD_ -> A_RCVD <$> smpP
        QCONT_ -> QCONT <$> smpP
        QADD_ -> QADD <$> smpP
        QKEY_ -> QKEY <$> smpP
@@ -1005,6 +1085,21 @@ instance Encoding AMessage where
        QTEST_ -> QTEST <$> smpP
        EREADY_ -> EREADY <$> smpP

+instance Encoding AMessageReceipt where
+  smpEncode AMessageReceipt {agentMsgId, msgHash, rcptInfo} =
+    smpEncode (agentMsgId, msgHash, Large rcptInfo)
+  smpP = do
+    (agentMsgId, msgHash, Large rcptInfo) <- smpP
+    pure AMessageReceipt {agentMsgId, msgHash, rcptInfo}
+
+instance StrEncoding MsgReceipt where
+  strEncode MsgReceipt {agentMsgId, msgRcptStatus} =
+    strEncode agentMsgId <> ":" <> strEncode msgRcptStatus
+  strP = do
+    agentMsgId <- strP <* A.char ':'
+    msgRcptStatus <- strP
+    pure MsgReceipt {agentMsgId, msgRcptStatus}
+
 instance forall m. ConnectionModeI m => StrEncoding (ConnectionRequestUri m) where
  strEncode = \case
    CRInvitationUri crData e2eParams -> crEncode "invitation" crData (Just e2eParams)
@@ -1028,13 +1123,13 @@ instance forall m. ConnectionModeI m => StrEncoding (ConnectionRequestUri m) whe
 instance StrEncoding AConnectionRequestUri where
  strEncode (ACR _ cr) = strEncode cr
  strP = do
-    crScheme <- strP
+    _crScheme :: ConnReqScheme <- strP
    crMode <- A.char '/' *> crModeP <* optional (A.char '/') <* "#/?"
    query <- strP
    crAgentVRange <- queryParam "v" query
    crSmpQueues <- queryParam "smp" query
    let crClientData = safeDecodeUtf8 <$> queryParamStr "data" query
-    let crData = ConnReqUriData {crScheme, crAgentVRange, crSmpQueues, crClientData}
+    let crData = ConnReqUriData {crScheme = CRSSimplex, crAgentVRange, crSmpQueues, crClientData}
    case crMode of
      CMInvitation -> do
        crE2eParams <- queryParam "e2e" query
@@ -1108,8 +1203,15 @@ updateSMPServerHosts srv@ProtocolServer {host} = case host of

 class SMPQueue q where
  qServer :: q -> SMPServer
-  qAddress :: q -> (SMPServer, SMP.QueueId)
-  sameQueue :: (SMPServer, SMP.QueueId) -> q -> Bool
+  queueId :: q -> SMP.QueueId
+
+qAddress :: SMPQueue q => q -> (SMPServer, SMP.QueueId)
+qAddress q = (qServer q, queueId q)
+{-# INLINE qAddress #-}
+
+sameQueue :: SMPQueue q => (SMPServer, SMP.QueueId) -> q -> Bool
+sameQueue addr q = sameQAddress addr (qAddress q)
+{-# INLINE sameQueue #-}

 data SMPQueueInfo = SMPQueueInfo {clientVersion :: Version, queueAddress :: SMPQueueAddress}
  deriving (Eq, Show)
@@ -1154,26 +1256,20 @@ data SMPQueueAddress = SMPQueueAddress
 instance SMPQueue SMPQueueUri where
  qServer SMPQueueUri {queueAddress} = qServer queueAddress
  {-# INLINE qServer #-}
-  qAddress SMPQueueUri {queueAddress} = qAddress queueAddress
-  {-# INLINE qAddress #-}
-  sameQueue addr q = sameQAddress addr (qAddress q)
-  {-# INLINE sameQueue #-}
+  queueId SMPQueueUri {queueAddress} = queueId queueAddress
+  {-# INLINE queueId #-}

 instance SMPQueue SMPQueueInfo where
  qServer SMPQueueInfo {queueAddress} = qServer queueAddress
  {-# INLINE qServer #-}
-  qAddress SMPQueueInfo {queueAddress} = qAddress queueAddress
-  {-# INLINE qAddress #-}
-  sameQueue addr q = sameQAddress addr (qAddress q)
-  {-# INLINE sameQueue #-}
+  queueId SMPQueueInfo {queueAddress} = queueId queueAddress
+  {-# INLINE queueId #-}

 instance SMPQueue SMPQueueAddress where
  qServer SMPQueueAddress {smpServer} = smpServer
  {-# INLINE qServer #-}
-  qAddress SMPQueueAddress {smpServer, senderId} = (smpServer, senderId)
-  {-# INLINE qAddress #-}
-  sameQueue addr q = sameQAddress addr (qAddress q)
-  {-# INLINE sameQueue #-}
+  queueId SMPQueueAddress {senderId} = senderId
+  {-# INLINE queueId #-}

 sameQAddress :: (SMPServer, SMP.QueueId) -> (SMPServer, SMP.QueueId) -> Bool
 sameQAddress (srv, qId) (srv', qId') = sameSrvAddr srv srv' && qId == qId'
@@ -1234,7 +1330,7 @@ deriving instance Show AConnectionRequestUri
 data ConnReqUriData = ConnReqUriData
  { crScheme :: ConnReqScheme,
    crAgentVRange :: VersionRange,
-    crSmpQueues :: L.NonEmpty SMPQueueUri,
+    crSmpQueues :: NonEmpty SMPQueueUri,
    crClientData :: Maybe CRClientData
  }
  deriving (Eq, Show)
@@ -1290,20 +1386,13 @@ type AgentMsgId = Int64

 -- | Result of received message integrity validation.
 data MsgIntegrity = MsgOk | MsgError {errorInfo :: MsgErrorType}
-  deriving (Eq, Show, Generic)
+  deriving (Eq, Show)

 instance StrEncoding MsgIntegrity where
  strP = "OK" $> MsgOk <|> "ERR " *> (MsgError <$> strP)
  strEncode = \case
    MsgOk -> "OK"
-    MsgError e -> "ERR" <> strEncode e
-
-instance ToJSON MsgIntegrity where
-  toJSON = J.genericToJSON $ sumTypeJSON fstToLower
-  toEncoding = J.genericToEncoding $ sumTypeJSON fstToLower
-
-instance FromJSON MsgIntegrity where
-  parseJSON = J.genericParseJSON $ sumTypeJSON fstToLower
+    MsgError e -> "ERR " <> strEncode e

 -- | Error of message integrity validation.
 data MsgErrorType
@@ -1311,12 +1400,12 @@ data MsgErrorType
  | MsgBadId {msgId :: AgentMsgId}
  | MsgBadHash
  | MsgDuplicate
-  deriving (Eq, Show, Generic)
+  deriving (Eq, Show)

 instance StrEncoding MsgErrorType where
  strP =
    "ID " *> (MsgBadId <$> A.decimal)
-      <|> "IDS " *> (MsgSkipped <$> A.decimal <* A.space <*> A.decimal)
+      <|> "NO_ID " *> (MsgSkipped <$> A.decimal <* A.space <*> A.decimal)
      <|> "HASH" $> MsgBadHash
      <|> "DUPLICATE" $> MsgDuplicate
  strEncode = \case
@@ -1326,13 +1415,6 @@ instance StrEncoding MsgErrorType where
    MsgBadHash -> "HASH"
    MsgDuplicate -> "DUPLICATE"

-instance ToJSON MsgErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON fstToLower
-  toEncoding = J.genericToEncoding $ sumTypeJSON fstToLower
-
-instance FromJSON MsgErrorType where
-  parseJSON = J.genericParseJSON $ sumTypeJSON fstToLower
-
 -- | Error type used in errors sent to agent clients.
 data AgentErrorType
  = -- | command or response error
@@ -1345,19 +1427,19 @@ data AgentErrorType
    NTF {ntfErr :: ErrorType}
  | -- | XFTP protocol errors forwarded to agent clients
    XFTP {xftpErr :: XFTPErrorType}
+  | -- | XRCP protocol errors forwarded to agent clients
+    RCP {rcpErr :: RCErrorType}
  | -- | SMP server errors
    BROKER {brokerAddress :: String, brokerErr :: BrokerErrorType}
  | -- | errors of other agents
    AGENT {agentErr :: SMPAgentError}
  | -- | agent implementation or dependency errors
    INTERNAL {internalErr :: String}
+  | -- | critical agent errors that should be shown to the user, optionally with restart button
+    CRITICAL {offerRestart :: Bool, criticalErr :: String}
  | -- | agent inactive
    INACTIVE
-  deriving (Eq, Generic, Show, Exception)
-
-instance ToJSON AgentErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Show, Exception)

 -- | SMP agent protocol command or response error.
 data CommandErrorType
@@ -1371,11 +1453,7 @@ data CommandErrorType
    SIZE
  | -- | message does not fit in SMP block
    LARGE
-  deriving (Eq, Generic, Read, Show, Exception)
-
-instance ToJSON CommandErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Read, Show, Exception)

 -- | Connection error.
 data ConnectionErrorType
@@ -1389,11 +1467,7 @@ data ConnectionErrorType
    NOT_ACCEPTED
  | -- | connection not available on reply confirmation/HELLO after timeout
    NOT_AVAILABLE
-  deriving (Eq, Generic, Read, Show, Exception)
-
-instance ToJSON ConnectionErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Read, Show, Exception)

 -- | SMP server errors.
 data BrokerErrorType
@@ -1409,11 +1483,7 @@ data BrokerErrorType
    TRANSPORT {transportErr :: TransportError}
  | -- | command response timeout
    TIMEOUT
-  deriving (Eq, Generic, Read, Show, Exception)
-
-instance ToJSON BrokerErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Read, Show, Exception)

 -- | Errors of another SMP agent.
 data SMPAgentError
@@ -1430,7 +1500,7 @@ data SMPAgentError
    A_DUPLICATE
  | -- | error in the message to add/delete/etc queue in connection
    A_QUEUE {queueErr :: String}
-  deriving (Eq, Generic, Read, Show, Exception)
+  deriving (Eq, Read, Show, Exception)

 data AgentCryptoError
  = -- | AES decryption error
@@ -1443,15 +1513,25 @@ data AgentCryptoError
    RATCHET_EARLIER Word32
  | -- | too many skipped messages
    RATCHET_SKIPPED Word32
-  deriving (Eq, Generic, Read, Show, Exception)
+  | -- | ratchet synchronization error
+    RATCHET_SYNC
+  deriving (Eq, Read, Show, Exception)

-instance ToJSON AgentCryptoError where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
-
-instance ToJSON SMPAgentError where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+instance StrEncoding AgentCryptoError where
+  strP =
+    "DECRYPT_AES" $> DECRYPT_AES
+      <|> "DECRYPT_CB" $> DECRYPT_CB
+      <|> "RATCHET_HEADER" $> RATCHET_HEADER
+      <|> "RATCHET_EARLIER " *> (RATCHET_EARLIER <$> strP)
+      <|> "RATCHET_SKIPPED " *> (RATCHET_SKIPPED <$> strP)
+      <|> "RATCHET_SYNC" $> RATCHET_SYNC
+  strEncode = \case
+    DECRYPT_AES -> "DECRYPT_AES"
+    DECRYPT_CB -> "DECRYPT_CB"
+    RATCHET_HEADER -> "RATCHET_HEADER"
+    RATCHET_EARLIER n -> "RATCHET_EARLIER " <> strEncode n
+    RATCHET_SKIPPED n -> "RATCHET_SKIPPED " <> strEncode n
+    RATCHET_SYNC -> "RATCHET_SYNC"

 instance StrEncoding AgentErrorType where
  strP =
@@ -1460,6 +1540,7 @@ instance StrEncoding AgentErrorType where
      <|> "SMP " *> (SMP <$> strP)
      <|> "NTF " *> (NTF <$> strP)
      <|> "XFTP " *> (XFTP <$> strP)
+      <|> "RCP " *> (RCP <$> strP)
      <|> "BROKER " *> (BROKER <$> textP <* " RESPONSE " <*> (RESPONSE <$> textP))
      <|> "BROKER " *> (BROKER <$> textP <* " TRANSPORT " <*> (TRANSPORT <$> transportErrorP))
      <|> "BROKER " *> (BROKER <$> textP <* A.space <*> parseRead1)
@@ -1467,7 +1548,8 @@ instance StrEncoding AgentErrorType where
      <|> "AGENT QUEUE " *> (AGENT . A_QUEUE <$> parseRead A.takeByteString)
      <|> "AGENT " *> (AGENT <$> parseRead1)
      <|> "INTERNAL " *> (INTERNAL <$> parseRead A.takeByteString)
-      <|> "INACTIVE" *> pure INACTIVE
+      <|> "CRITICAL " *> (CRITICAL <$> parseRead1 <* A.space <*> parseRead A.takeByteString)
+      <|> "INACTIVE" $> INACTIVE
    where
      textP = T.unpack . safeDecodeUtf8 <$> A.takeTill (== ' ')
  strEncode = \case
@@ -1476,6 +1558,7 @@ instance StrEncoding AgentErrorType where
    SMP e -> "SMP " <> strEncode e
    NTF e -> "NTF " <> strEncode e
    XFTP e -> "XFTP " <> strEncode e
+    RCP e -> "RCP " <> strEncode e
    BROKER srv (RESPONSE e) -> "BROKER " <> text srv <> " RESPONSE " <> text e
    BROKER srv (TRANSPORT e) -> "BROKER " <> text srv <> " TRANSPORT " <> serializeTransportError e
    BROKER srv e -> "BROKER " <> text srv <> " " <> bshow e
@@ -1483,22 +1566,11 @@ instance StrEncoding AgentErrorType where
    AGENT (A_QUEUE e) -> "AGENT QUEUE " <> bshow e
    AGENT e -> "AGENT " <> bshow e
    INTERNAL e -> "INTERNAL " <> bshow e
+    CRITICAL restart e -> "CRITICAL " <> bshow restart <> " " <> bshow e
    INACTIVE -> "INACTIVE"
    where
      text = encodeUtf8 . T.pack

-instance Arbitrary AgentErrorType where arbitrary = genericArbitraryU
-
-instance Arbitrary CommandErrorType where arbitrary = genericArbitraryU
-
-instance Arbitrary ConnectionErrorType where arbitrary = genericArbitraryU
-
-instance Arbitrary BrokerErrorType where arbitrary = genericArbitraryU
-
-instance Arbitrary SMPAgentError where arbitrary = genericArbitraryU
-
-instance Arbitrary AgentCryptoError where arbitrary = genericArbitraryU
-
 cryptoErrToSyncState :: AgentCryptoError -> RatchetSyncState
 cryptoErrToSyncState = \case
  DECRYPT_AES -> RSAllowed
@@ -1506,6 +1578,7 @@ cryptoErrToSyncState = \case
  RATCHET_HEADER -> RSRequired
  RATCHET_EARLIER _ -> RSAllowed
  RATCHET_SKIPPED _ -> RSRequired
+  RATCHET_SYNC -> RSRequired

 -- | SMP agent command and response parser for commands passed via network (only parses binary length)
 networkCommandP :: Parser ACmd
@@ -1541,8 +1614,11 @@ instance StrEncoding ACmdTag where
      "MID" -> ct MID_
      "SENT" -> ct SENT_
      "MERR" -> ct MERR_
+      "MERRS" -> ct MERRS_
      "MSG" -> ct MSG_
+      "MSGNTF" -> ct MSGNTF_
      "ACK" -> t ACK_
+      "RCVD" -> ct RCVD_
      "SWCH" -> t SWCH_
      "OFF" -> t OFF_
      "DEL" -> t DEL_
@@ -1595,8 +1671,11 @@ instance (APartyI p, AEntityI e) => StrEncoding (ACommandTag p e) where
    MID_ -> "MID"
    SENT_ -> "SENT"
    MERR_ -> "MERR"
+    MERRS_ -> "MERRS"
    MSG_ -> "MSG"
+    MSGNTF_ -> "MSGNTF"
    ACK_ -> "ACK"
+    RCVD_ -> "RCVD"
    SWCH_ -> "SWCH"
    OFF_ -> "OFF"
    DEL_ -> "DEL"
@@ -1633,14 +1712,14 @@ commandP binaryP =
    >>= \case
      ACmdTag SClient e cmd ->
        ACmd SClient e <$> case cmd of
-          NEW_ -> s (NEW <$> strP_ <*> strP)
-          JOIN_ -> s (JOIN <$> strP_ <*> strP_ <*> binaryP)
+          NEW_ -> s (NEW <$> strP_ <*> strP_ <*> (strP <|> pure SMP.SMSubscribe))
+          JOIN_ -> s (JOIN <$> strP_ <*> strP_ <*> (strP_ <|> pure SMP.SMSubscribe) <*> binaryP)
          LET_ -> s (LET <$> A.takeTill (== ' ') <* A.space <*> binaryP)
          ACPT_ -> s (ACPT <$> A.takeTill (== ' ') <* A.space <*> binaryP)
          RJCT_ -> s (RJCT <$> A.takeByteString)
          SUB_ -> pure SUB
          SEND_ -> s (SEND <$> smpP <* A.space <*> binaryP)
-          ACK_ -> s (ACK <$> A.decimal)
+          ACK_ -> s (ACK <$> A.decimal <*> optional (A.space *> binaryP))
          SWCH_ -> pure SWCH
          OFF_ -> pure OFF
          DEL_ -> pure DEL
@@ -1658,11 +1737,14 @@ commandP binaryP =
          DOWN_ -> s (DOWN <$> strP_ <*> connections)
          UP_ -> s (UP <$> strP_ <*> connections)
          SWITCH_ -> s (SWITCH <$> strP_ <*> strP_ <*> strP)
-          RSYNC_ -> s (RSYNC <$> strP_ <*> strP)
+          RSYNC_ -> s (RSYNC <$> strP_ <*> strP <*> strP)
          MID_ -> s (MID <$> A.decimal)
          SENT_ -> s (SENT <$> A.decimal)
          MERR_ -> s (MERR <$> A.decimal <* A.space <*> strP)
-          MSG_ -> s (MSG <$> msgMetaP <* A.space <*> smpP <* A.space <*> binaryP)
+          MERRS_ -> s (MERRS <$> strP_ <*> strP)
+          MSG_ -> s (MSG <$> strP <* A.space <*> smpP <* A.space <*> binaryP)
+          MSGNTF_ -> s (MSGNTF <$> strP)
+          RCVD_ -> s (RCVD <$> strP <* A.space <*> strP)
          DEL_RCVQ_ -> s (DEL_RCVQ <$> strP_ <*> strP_ <*> strP)
          DEL_CONN_ -> pure DEL_CONN
          DEL_USER_ -> s (DEL_USER <$> strP)
@@ -1687,13 +1769,6 @@ commandP binaryP =
       in case ds of
            [] -> Left "no sender file description"
            sd : rds -> SFDONE <$> strDecode (encodeUtf8 sd) <*> mapM (strDecode . encodeUtf8) rds
-    msgMetaP = do
-      integrity <- strP
-      recipient <- " R=" *> partyMeta A.decimal
-      broker <- " B=" *> partyMeta base64P
-      sndMsgId <- " S=" *> A.decimal
-      pure MsgMeta {integrity, recipient, broker, sndMsgId}
-    partyMeta idParser = (,) <$> idParser <* A.char ',' <*> tsISO8601P

 parseCommand :: ByteString -> Either AgentErrorType ACmd
 parseCommand = parse (commandP A.takeByteString) $ CMD SYNTAX
@@ -1701,9 +1776,9 @@ parseCommand = parse (commandP A.takeByteString) $ CMD SYNTAX
 -- | Serialize SMP agent command.
 serializeCommand :: ACommand p e -> ByteString
 serializeCommand = \case
-  NEW ntfs cMode -> s (NEW_, ntfs, cMode)
+  NEW ntfs cMode subMode -> s (NEW_, ntfs, cMode, subMode)
  INV cReq -> s (INV_, cReq)
-  JOIN ntfs cReq cInfo -> s (JOIN_, ntfs, cReq, Str $ serializeBinary cInfo)
+  JOIN ntfs cReq subMode cInfo -> s (JOIN_, ntfs, cReq, subMode, Str $ serializeBinary cInfo)
  CONF confId srvs cInfo -> B.unwords [s CONF_, confId, strEncodeList srvs, serializeBinary cInfo]
  LET confId cInfo -> B.unwords [s LET_, confId, serializeBinary cInfo]
  REQ invId srvs cInfo -> B.unwords [s REQ_, invId, s srvs, serializeBinary cInfo]
@@ -1717,13 +1792,16 @@ serializeCommand = \case
  DOWN srv conns -> B.unwords [s DOWN_, s srv, connections conns]
  UP srv conns -> B.unwords [s UP_, s srv, connections conns]
  SWITCH dir phase srvs -> s (SWITCH_, dir, phase, srvs)
-  RSYNC rrState cstats -> s (RSYNC_, rrState, cstats)
+  RSYNC rrState cryptoErr cstats -> s (RSYNC_, rrState, cryptoErr, cstats)
  SEND msgFlags msgBody -> B.unwords [s SEND_, smpEncode msgFlags, serializeBinary msgBody]
-  MID mId -> s (MID_, Str $ bshow mId)
-  SENT mId -> s (SENT_, Str $ bshow mId)
-  MERR mId e -> s (MERR_, Str $ bshow mId, e)
-  MSG msgMeta msgFlags msgBody -> B.unwords [s MSG_, serializeMsgMeta msgMeta, smpEncode msgFlags, serializeBinary msgBody]
-  ACK mId -> s (ACK_, Str $ bshow mId)
+  MID mId -> s (MID_, mId)
+  SENT mId -> s (SENT_, mId)
+  MERR mId e -> s (MERR_, mId, e)
+  MERRS mIds e -> s (MERRS_, mIds, e)
+  MSG msgMeta msgFlags msgBody -> B.unwords [s MSG_, s msgMeta, smpEncode msgFlags, serializeBinary msgBody]
+  MSGNTF smpMsgMeta -> s (MSGNTF_, smpMsgMeta)
+  ACK mId rcptInfo_ -> s (ACK_, mId) <> maybe "" (B.cons ' ' . serializeBinary) rcptInfo_
+  RCVD msgMeta rcpts -> s (RCVD_, msgMeta, rcpts)
  SWCH -> s SWCH_
  OFF -> s OFF_
  DEL -> s DEL_
@@ -1745,19 +1823,9 @@ serializeCommand = \case
  where
    s :: StrEncoding a => a -> ByteString
    s = strEncode
-    showTs :: UTCTime -> ByteString
-    showTs = B.pack . formatISO8601Millis
    connections :: [ConnId] -> ByteString
    connections = B.intercalate "," . map strEncode
    sfDone sd rds = B.intercalate fdSeparator $ strEncode sd : map strEncode rds
-    serializeMsgMeta :: MsgMeta -> ByteString
-    serializeMsgMeta MsgMeta {integrity, recipient = (rmId, rTs), broker = (bmId, bTs), sndMsgId} =
-      B.unwords
-        [ strEncode integrity,
-          "R=" <> bshow rmId <> "," <> showTs rTs,
-          "B=" <> encode bmId <> "," <> showTs bTs,
-          "S=" <> bshow sndMsgId
-        ]

 serializeBinary :: ByteString -> ByteString
 serializeBinary body = bshow (B.length body) <> "\n" <> body
@@ -1817,7 +1885,7 @@ tGet party h = liftIO (tGetRaw h) >>= tParseLoadBody
      APC e <$$> case cmd of
        SEND msgFlags body -> SEND msgFlags <$$> getBody body
        MSG msgMeta msgFlags body -> MSG msgMeta msgFlags <$$> getBody body
-        JOIN ntfs qUri cInfo -> JOIN ntfs qUri <$$> getBody cInfo
+        JOIN ntfs qUri subMode cInfo -> JOIN ntfs qUri subMode <$$> getBody cInfo
        CONF confId srvs cInfo -> CONF confId srvs <$$> getBody cInfo
        LET confId cInfo -> LET confId <$$> getBody cInfo
        REQ invId srvs cInfo -> REQ invId srvs <$$> getBody cInfo
@@ -1837,3 +1905,25 @@ tGet party h = liftIO (tGetRaw h) >>= tParseLoadBody
            unless (B.null s) $ throwError $ CMD SIZE
            pure body
          Nothing -> return . Left $ CMD SYNTAX
+
+$(J.deriveJSON defaultJSON ''RcvQueueInfo)
+
+$(J.deriveJSON defaultJSON ''SndQueueInfo)
+
+$(J.deriveJSON defaultJSON ''ConnectionStats)
+
+$(J.deriveJSON (sumTypeJSON fstToLower) ''MsgErrorType)
+
+$(J.deriveJSON (sumTypeJSON fstToLower) ''MsgIntegrity)
+
+$(J.deriveJSON (sumTypeJSON id) ''CommandErrorType)
+
+$(J.deriveJSON (sumTypeJSON id) ''ConnectionErrorType)
+
+$(J.deriveJSON (sumTypeJSON id) ''BrokerErrorType)
+
+$(J.deriveJSON (sumTypeJSON id) ''AgentCryptoError)
+
+$(J.deriveJSON (sumTypeJSON id) ''SMPAgentError)
+
+$(J.deriveJSON (sumTypeJSON id) ''AgentErrorType)
@@ -1,6 +1,5 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}

 module Simplex.Messaging.Agent.RetryInterval
@@ -9,6 +8,7 @@ module Simplex.Messaging.Agent.RetryInterval
    RetryIntervalMode (..),
    RI2State (..),
    withRetryInterval,
+    withRetryIntervalCount,
    withRetryLock2,
    updateRetryInterval2,
  )
@@ -49,15 +49,18 @@ data RetryIntervalMode = RISlow | RIFast
  deriving (Eq, Show)

 withRetryInterval :: forall m a. MonadIO m => RetryInterval -> (Int64 -> m a -> m a) -> m a
-withRetryInterval ri action = callAction 0 $ initialInterval ri
+withRetryInterval ri = withRetryIntervalCount ri . const
+
+withRetryIntervalCount :: forall m a. MonadIO m => RetryInterval -> (Int -> Int64 -> m a -> m a) -> m a
+withRetryIntervalCount ri action = callAction 0 0 $ initialInterval ri
  where
-    callAction :: Int64 -> Int64 -> m a
-    callAction elapsed delay = action delay loop
+    callAction :: Int -> Int64 -> Int64 -> m a
+    callAction n elapsed delay = action n delay loop
      where
        loop = do
          liftIO $ threadDelay' delay
          let elapsed' = elapsed + delay
-          callAction elapsed' $ nextDelay elapsed' delay ri
+          callAction (n + 1) elapsed' $ nextDelay elapsed' delay ri

 -- This function allows action to toggle between slow and fast retry intervals.
 withRetryLock2 :: forall m. MonadIO m => RetryInterval2 -> TMVar () -> (RI2State -> (RetryIntervalMode -> m ()) -> m ()) -> m ()
@@ -11,7 +11,7 @@ module Simplex.Messaging.Agent.Server
 where

 import Control.Logger.Simple (logInfo)
-import Control.Monad.Except
+import Control.Monad
 import Control.Monad.IO.Unlift (MonadUnliftIO)
 import Control.Monad.Reader
 import Crypto.Random (MonadRandom)
@@ -23,7 +23,7 @@ import Simplex.Messaging.Agent.Env.SQLite
 import Simplex.Messaging.Agent.Protocol
 import Simplex.Messaging.Agent.Store.SQLite (SQLiteStore)
 import Simplex.Messaging.Transport (ATransport (..), TProxy, Transport (..), simplexMQVersion)
-import Simplex.Messaging.Transport.Server (loadTLSServerParams, runTransportServer, defaultTransportServerConfig)
+import Simplex.Messaging.Transport.Server (defaultTransportServerConfig, loadTLSServerParams, runTransportServer)
 import Simplex.Messaging.Util (bshow)
 import UnliftIO.Async (race_)
 import qualified UnliftIO.Exception as E
@@ -34,23 +34,25 @@ import UnliftIO.STM
 -- See a full agent executable here: https://github.com/simplex-chat/simplexmq/blob/master/apps/smp-agent/Main.hs
 runSMPAgent :: (MonadRandom m, MonadUnliftIO m) => ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> m ()
 runSMPAgent t cfg initServers store =
-  runSMPAgentBlocking t cfg initServers store =<< newEmptyTMVarIO
+  runSMPAgentBlocking t cfg initServers store 0 =<< newEmptyTMVarIO

 -- | Runs an SMP agent as a TCP service using passed configuration with signalling.
 --
 -- This function uses passed TMVar to signal when the server is ready to accept TCP requests (True)
 -- and when it is disconnected from the TCP socket once the server thread is killed (False).
-runSMPAgentBlocking :: (MonadRandom m, MonadUnliftIO m) => ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> TMVar Bool -> m ()
-runSMPAgentBlocking (ATransport t) cfg@AgentConfig {tcpPort, caCertificateFile, certificateFile, privateKeyFile} initServers store started = do
+runSMPAgentBlocking :: (MonadRandom m, MonadUnliftIO m) => ATransport -> AgentConfig -> InitialAgentServers -> SQLiteStore -> Int -> TMVar Bool -> m ()
+runSMPAgentBlocking (ATransport t) cfg@AgentConfig {tcpPort, caCertificateFile, certificateFile, privateKeyFile} initServers store initClientId started = do
  liftIO (newSMPAgentEnv cfg store) >>= runReaderT (smpAgent t)
  where
    smpAgent :: forall c m'. (Transport c, MonadUnliftIO m', MonadReader Env m') => TProxy c -> m' ()
    smpAgent _ = do
      -- tlsServerParams is not in Env to avoid breaking functional API w/t key and certificate generation
      tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
+      clientId <- newTVarIO initClientId
      runTransportServer started tcpPort tlsServerParams defaultTransportServerConfig $ \(h :: c) -> do
        liftIO . putLn h $ "Welcome to SMP agent v" <> B.pack simplexMQVersion
-        c <- getAgentClient initServers
+        cId <- atomically $ stateTVar clientId $ \i -> (i + 1, i + 1)
+        c <- getAgentClient cId initServers
        logConnection c True
        race_ (connectClient h c) (runAgentClient c)
          `E.finally` disconnectAgentClient c
@@ -1,6 +1,9 @@
+{-# LANGUAGE ConstraintKinds #-}
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE FlexibleContexts #-}
+{-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE LambdaCase #-}
@@ -36,7 +39,6 @@ import Simplex.Messaging.Protocol
    NotifierId,
    NtfPrivateSignKey,
    NtfPublicVerifyKey,
-    QueueId,
    RcvDhSecret,
    RcvNtfDhSecret,
    RcvPrivateSignKey,
@@ -48,8 +50,26 @@ import Simplex.Messaging.Version

 -- * Queue types

+data QueueStored = QSStored | QSNew
+
+data SQueueStored (q :: QueueStored) where
+  SQSStored :: SQueueStored 'QSStored
+  SQSNew :: SQueueStored 'QSNew
+
+data DBQueueId (q :: QueueStored) where
+  DBQueueId :: Int64 -> DBQueueId 'QSStored
+  DBNewQueue :: DBQueueId 'QSNew
+
+deriving instance Eq (DBQueueId q)
+
+deriving instance Show (DBQueueId q)
+
+type RcvQueue = StoredRcvQueue 'QSStored
+
+type NewRcvQueue = StoredRcvQueue 'QSNew
+
 -- | A receive queue. SMP queue through which the agent receives messages from a sender.
-data RcvQueue = RcvQueue
+data StoredRcvQueue (q :: QueueStored) = RcvQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
@@ -68,7 +88,7 @@ data RcvQueue = RcvQueue
    -- | queue status
    status :: QueueStatus,
    -- | database queue ID (within connection)
-    dbQueueId :: Int64,
+    dbQueueId :: DBQueueId q,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | database queue ID to replace, Nothing if this queue is not replacing another, `Just Nothing` is used for replacing old queues
@@ -109,8 +129,12 @@ data ClientNtfCreds = ClientNtfCreds
  }
  deriving (Eq, Show)

+type SndQueue = StoredSndQueue 'QSStored
+
+type NewSndQueue = StoredSndQueue 'QSNew
+
 -- | A send queue. SMP queue through which the agent sends messages to a recipient.
-data SndQueue = SndQueue
+data StoredSndQueue (q :: QueueStored) = SndQueue
  { userId :: UserId,
    connId :: ConnId,
    server :: SMPServer,
@@ -126,7 +150,7 @@ data SndQueue = SndQueue
    -- | queue status
    status :: QueueStatus,
    -- | database queue ID (within connection)
-    dbQueueId :: Int64,
+    dbQueueId :: DBQueueId q,
    -- | True for a primary or a next primary queue of the connection (next if dbReplaceQueueId is set)
    primary :: Bool,
    -- | ID of the queue this one is replacing
@@ -144,18 +168,14 @@ sndQueueInfo SndQueue {server, sndSwchStatus} =
 instance SMPQueue RcvQueue where
  qServer RcvQueue {server} = server
  {-# INLINE qServer #-}
-  qAddress RcvQueue {server, rcvId} = (server, rcvId)
-  {-# INLINE qAddress #-}
-  sameQueue addr q = sameQAddress addr (qAddress q)
-  {-# INLINE sameQueue #-}
+  queueId RcvQueue {rcvId} = rcvId
+  {-# INLINE queueId #-}

 instance SMPQueue SndQueue where
  qServer SndQueue {server} = server
  {-# INLINE qServer #-}
-  qAddress SndQueue {server, sndId} = (server, sndId)
-  {-# INLINE qAddress #-}
-  sameQueue addr q = sameQAddress addr (qAddress q)
-  {-# INLINE sameQueue #-}
+  queueId SndQueue {sndId} = sndId
+  {-# INLINE queueId #-}

 findQ :: SMPQueue q => (SMPServer, SMP.QueueId) -> NonEmpty q -> Maybe q
 findQ = find . sameQueue
@@ -189,32 +209,27 @@ updatedQs q = L.map $ \q' -> if dbQId q == dbQId q' then q else q'
 class SMPQueue q => SMPQueueRec q where
  qUserId :: q -> UserId
  qConnId :: q -> ConnId
-  queueId :: q -> QueueId
  dbQId :: q -> Int64
  dbReplaceQId :: q -> Maybe Int64

 instance SMPQueueRec RcvQueue where
-  qUserId = userId
+  qUserId RcvQueue {userId} = userId
  {-# INLINE qUserId #-}
-  qConnId = connId
+  qConnId RcvQueue {connId} = connId
  {-# INLINE qConnId #-}
-  queueId = rcvId
-  {-# INLINE queueId #-}
-  dbQId = dbQueueId
+  dbQId RcvQueue {dbQueueId = DBQueueId qId} = qId
  {-# INLINE dbQId #-}
-  dbReplaceQId = dbReplaceQueueId
+  dbReplaceQId RcvQueue {dbReplaceQueueId} = dbReplaceQueueId
  {-# INLINE dbReplaceQId #-}

 instance SMPQueueRec SndQueue where
-  qUserId = userId
+  qUserId SndQueue {userId} = userId
  {-# INLINE qUserId #-}
-  qConnId = connId
+  qConnId SndQueue {connId} = connId
  {-# INLINE qConnId #-}
-  queueId = sndId
-  {-# INLINE queueId #-}
-  dbQId = dbQueueId
+  dbQId SndQueue {dbQueueId = DBQueueId qId} = qId
  {-# INLINE dbQId #-}
-  dbReplaceQId = dbReplaceQueueId
+  dbReplaceQId SndQueue {dbReplaceQueueId} = dbReplaceQueueId
  {-# INLINE dbReplaceQId #-}

 -- * Connection types
@@ -315,13 +330,17 @@ ratchetSyncAllowed cData@ConnData {ratchetSyncState} =
 ratchetSyncSupported' :: ConnData -> Bool
 ratchetSyncSupported' ConnData {connAgentVersion} = connAgentVersion >= 3

+messageRcptsSupported :: ConnData -> Bool
+messageRcptsSupported ConnData {connAgentVersion} = connAgentVersion >= 4
+
 -- this function should be mirrored in the clients
 ratchetSyncSendProhibited :: ConnData -> Bool
 ratchetSyncSendProhibited ConnData {ratchetSyncState} =
  ratchetSyncState `elem` ([RSRequired, RSStarted, RSAgreed] :: [RatchetSyncState])

 data PendingCommand = PendingCommand
-  { corrId :: ACorrId,
+  { cmdId :: AsyncCmdId,
+    corrId :: ACorrId,
    userId :: UserId,
    connId :: ConnId,
    command :: AgentCommand
@@ -506,7 +525,10 @@ data RcvMsgData = RcvMsgData
 data RcvMsg = RcvMsg
  { internalId :: InternalId,
    msgMeta :: MsgMeta,
+    msgType :: AgentMessageType,
    msgBody :: MsgBody,
+    internalHash :: MsgHash,
+    msgReceipt :: Maybe MsgReceipt, -- if this message is a delivery receipt
    userAck :: Bool
  }

@@ -521,6 +543,14 @@ data SndMsgData = SndMsgData
    prevMsgHash :: MsgHash
  }

+data SndMsg = SndMsg
+  { internalId :: InternalId,
+    internalSndId :: InternalSndId,
+    msgType :: AgentMessageType,
+    internalHash :: MsgHash,
+    msgReceipt :: Maybe MsgReceipt
+  }
+
 data PendingMsgData = PendingMsgData
  { msgId :: InternalId,
    msgType :: AgentMessageType,
@@ -586,6 +616,8 @@ data StoreError
    SEServerNotFound
  | -- | Connection already used.
    SEConnDuplicate
+  | -- | Confirmed snd queue already exists.
+    SESndQueueExists
  | -- | Wrong connection type, e.g. "send" connection when "receive" or "duplex" is expected, or vice versa.
    -- 'upgradeRcvConnToDuplex' and 'upgradeSndConnToDuplex' do not allow duplex connections - they would also return this error.
    SEBadConnType ConnType
@@ -613,4 +645,6 @@ data StoreError
    SEFileNotFound
  | -- | XFTP Deleted snd chunk replica not found.
    SEDeletedSndChunkReplicaNotFound
+  | -- | Error when reading work item that suspends worker - do not use!
+    SEWorkItemError ByteString
  deriving (Eq, Show, Exception)
@@ -0,0 +1,78 @@
+{-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE ScopedTypeVariables #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Common
+  ( SQLiteStore (..),
+    withConnection,
+    withConnection',
+    withTransaction,
+    withTransaction',
+    withTransactionCtx,
+    dbBusyLoop,
+    storeKey,
+  )
+where
+
+import Control.Concurrent (threadDelay)
+import Data.ByteArray (ScrubbedBytes)
+import qualified Data.ByteArray as BA
+import Data.Time.Clock (diffUTCTime, getCurrentTime)
+import Database.SQLite.Simple (SQLError)
+import qualified Database.SQLite.Simple as SQL
+import qualified Simplex.Messaging.Agent.Store.SQLite.DB as DB
+import Simplex.Messaging.Util (diffToMilliseconds)
+import UnliftIO.Exception (bracket)
+import qualified UnliftIO.Exception as E
+import UnliftIO.STM
+
+storeKey :: ScrubbedBytes -> Bool -> Maybe ScrubbedBytes
+storeKey key keepKey = if keepKey || BA.null key then Just key else Nothing
+
+data SQLiteStore = SQLiteStore
+  { dbFilePath :: FilePath,
+    dbKey :: TVar (Maybe ScrubbedBytes),
+    dbConnection :: TMVar DB.Connection,
+    dbClosed :: TVar Bool,
+    dbNew :: Bool
+  }
+
+withConnection :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
+withConnection SQLiteStore {dbConnection} =
+  bracket
+    (atomically $ takeTMVar dbConnection)
+    (atomically . putTMVar dbConnection)
+
+withConnection' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
+withConnection' st action = withConnection st $ action . DB.conn
+
+withTransaction :: SQLiteStore -> (DB.Connection -> IO a) -> IO a
+withTransaction = withTransactionCtx Nothing
+
+withTransaction' :: SQLiteStore -> (SQL.Connection -> IO a) -> IO a
+withTransaction' st action = withTransaction st $ action . DB.conn
+
+withTransactionCtx :: Maybe String -> SQLiteStore -> (DB.Connection -> IO a) -> IO a
+withTransactionCtx ctx_ st action = withConnection st $ dbBusyLoop . transactionWithCtx
+  where
+    transactionWithCtx db@DB.Connection {conn} = case ctx_ of
+      Nothing -> SQL.withImmediateTransaction conn $ action db
+      Just ctx -> do
+        t1 <- getCurrentTime
+        r <- SQL.withImmediateTransaction conn $ action db
+        t2 <- getCurrentTime
+        putStrLn $ "withTransactionCtx start :: " <> show t1 <> " :: " <> ctx
+        putStrLn $ "withTransactionCtx end   :: " <> show t2 <> " :: " <> ctx <> " :: duration=" <> show (diffToMilliseconds $ diffUTCTime t2 t1)
+        pure r
+
+dbBusyLoop :: forall a. IO a -> IO a
+dbBusyLoop action = loop 500 3000000
+  where
+    loop :: Int -> Int -> IO a
+    loop t tLim =
+      action `E.catch` \(e :: SQLError) ->
+        if tLim > t && SQL.sqlError e == SQL.ErrorBusy
+          then do
+            threadDelay t
+            loop (t * 9 `div` 8) (tLim - t)
+          else E.throwIO e
@@ -0,0 +1,101 @@
+{-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE StrictData #-}
+{-# LANGUAGE TemplateHaskell #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.DB
+  ( Connection (..),
+    SlowQueryStats (..),
+    open,
+    close,
+    execute,
+    execute_,
+    executeNamed,
+    executeMany,
+    query,
+    query_,
+    queryNamed,
+  )
+where
+
+import Control.Concurrent.STM
+import Control.Monad (when)
+import qualified Data.Aeson.TH as J
+import Data.Int (Int64)
+import Data.Time (diffUTCTime, getCurrentTime)
+import Database.SQLite.Simple (FromRow, NamedParam, Query, ToRow)
+import qualified Database.SQLite.Simple as SQL
+import Simplex.Messaging.Parsers (defaultJSON)
+import Simplex.Messaging.TMap (TMap)
+import qualified Simplex.Messaging.TMap as TM
+import Simplex.Messaging.Util (diffToMilliseconds)
+
+data Connection = Connection
+  { conn :: SQL.Connection,
+    slow :: TMap Query SlowQueryStats
+  }
+
+data SlowQueryStats = SlowQueryStats
+  { count :: Int64,
+    timeMax :: Int64,
+    timeAvg :: Int64
+  }
+  deriving (Show)
+
+timeIt :: TMap Query SlowQueryStats -> Query -> IO a -> IO a
+timeIt slow sql a = do
+  t <- getCurrentTime
+  r <- a
+  t' <- getCurrentTime
+  let diff = diffToMilliseconds $ diffUTCTime t' t
+  atomically $ when (diff > 5) $ TM.alter (updateQueryStats diff) sql slow
+  pure r
+  where
+    updateQueryStats :: Int64 -> Maybe SlowQueryStats -> Maybe SlowQueryStats
+    updateQueryStats diff Nothing = Just $ SlowQueryStats 1 diff diff
+    updateQueryStats diff (Just SlowQueryStats {count, timeMax, timeAvg}) =
+      Just $
+        SlowQueryStats
+          { count = count + 1,
+            timeMax = max timeMax diff,
+            timeAvg = (timeAvg * count + diff) `div` (count + 1)
+          }
+
+open :: String -> IO Connection
+open f = do
+  conn <- SQL.open f
+  slow <- atomically $ TM.empty
+  pure Connection {conn, slow}
+
+close :: Connection -> IO ()
+close = SQL.close . conn
+
+execute :: ToRow q => Connection -> Query -> q -> IO ()
+execute Connection {conn, slow} sql = timeIt slow sql . SQL.execute conn sql
+{-# INLINE execute #-}
+
+execute_ :: Connection -> Query -> IO ()
+execute_ Connection {conn, slow} sql = timeIt slow sql $ SQL.execute_ conn sql
+{-# INLINE execute_ #-}
+
+executeNamed :: Connection -> Query -> [NamedParam] -> IO ()
+executeNamed Connection {conn, slow} sql = timeIt slow sql . SQL.executeNamed conn sql
+{-# INLINE executeNamed #-}
+
+executeMany :: ToRow q => Connection -> Query -> [q] -> IO ()
+executeMany Connection {conn, slow} sql = timeIt slow sql . SQL.executeMany conn sql
+{-# INLINE executeMany #-}
+
+query :: (ToRow q, FromRow r) => Connection -> Query -> q -> IO [r]
+query Connection {conn, slow} sql = timeIt slow sql . SQL.query conn sql
+{-# INLINE query #-}
+
+query_ :: FromRow r => Connection -> Query -> IO [r]
+query_ Connection {conn, slow} sql = timeIt slow sql $ SQL.query_ conn sql
+{-# INLINE query_ #-}
+
+queryNamed :: FromRow r => Connection -> Query -> [NamedParam] -> IO [r]
+queryNamed Connection {conn, slow} sql = timeIt slow sql . SQL.queryNamed conn sql
+{-# INLINE queryNamed #-}
+
+$(J.deriveJSON defaultJSON ''SlowQueryStats)
@@ -1,4 +1,3 @@
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedLists #-}
@@ -27,8 +26,7 @@ module Simplex.Messaging.Agent.Store.SQLite.Migrations
 where

 import Control.Monad (forM_, when)
-import Data.Aeson (ToJSON)
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import Data.List (intercalate, sortOn)
 import Data.List.NonEmpty (NonEmpty)
 import qualified Data.Map as M
@@ -40,8 +38,8 @@ import Database.SQLite.Simple (Connection, Only (..), Query (..))
 import qualified Database.SQLite.Simple as DB
 import Database.SQLite.Simple.QQ (sql)
 import qualified Database.SQLite3 as SQLite3
-import GHC.Generics (Generic)
 import Simplex.Messaging.Agent.Protocol (extraSMPServerHosts)
+import Simplex.Messaging.Agent.Store.SQLite.Common
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220101_initial
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220301_snd_queue_keys
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20220322_notifications
@@ -62,6 +60,14 @@ import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230510_files_pending_r
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230516_encrypted_rcv_message_hashes
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230531_switch_status
 import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230615_ratchet_sync
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items
+import Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Parsers (dropPrefix, sumTypeJSON)
 import Simplex.Messaging.Transport.Client (TransportHost)
@@ -90,7 +96,15 @@ schemaMigrations =
    ("m20230510_files_pending_replicas_indexes", m20230510_files_pending_replicas_indexes, Just down_m20230510_files_pending_replicas_indexes),
    ("m20230516_encrypted_rcv_message_hashes", m20230516_encrypted_rcv_message_hashes, Just down_m20230516_encrypted_rcv_message_hashes),
    ("m20230531_switch_status", m20230531_switch_status, Just down_m20230531_switch_status),
-    ("m20230615_ratchet_sync", m20230615_ratchet_sync, Just down_m20230615_ratchet_sync)
+    ("m20230615_ratchet_sync", m20230615_ratchet_sync, Just down_m20230615_ratchet_sync),
+    ("m20230701_delivery_receipts", m20230701_delivery_receipts, Just down_m20230701_delivery_receipts),
+    ("m20230720_delete_expired_messages", m20230720_delete_expired_messages, Just down_m20230720_delete_expired_messages),
+    ("m20230722_indexes", m20230722_indexes, Just down_m20230722_indexes),
+    ("m20230814_indexes", m20230814_indexes, Just down_m20230814_indexes),
+    ("m20230829_crypto_files", m20230829_crypto_files, Just down_m20230829_crypto_files),
+    ("m20231222_command_created_at", m20231222_command_created_at, Just down_m20231222_command_created_at),
+    ("m20231225_failed_work_items", m20231225_failed_work_items, Just down_m20231225_failed_work_items),
+    ("m20240121_message_delivery_indexes", m20240121_message_delivery_indexes, Just down_m20240121_message_delivery_indexes)
  ]

 -- | The list of migrations in ascending order by date
@@ -99,44 +113,45 @@ app = sortOn name $ map migration schemaMigrations
  where
    migration (name, up, down) = Migration {name, up = fromQuery up, down = fromQuery <$> down}

-get :: Connection -> [Migration] -> IO (Either MTRError MigrationsToRun)
-get db migrations = migrationsToRun migrations <$> getCurrent db
+get :: SQLiteStore -> [Migration] -> IO (Either MTRError MigrationsToRun)
+get st migrations = migrationsToRun migrations <$> withTransaction' st getCurrent

 getCurrent :: Connection -> IO [Migration]
 getCurrent db = map toMigration <$> DB.query_ db "SELECT name, down FROM migrations ORDER BY name ASC;"
  where
    toMigration (name, down) = Migration {name, up = "", down}

-run :: Connection -> MigrationsToRun -> IO ()
-run db = \case
+run :: SQLiteStore -> MigrationsToRun -> IO ()
+run st = \case
  MTRUp [] -> pure ()
-  MTRUp ms -> mapM_ runUp ms >> execSQL "VACUUM;"
+  MTRUp ms -> mapM_ runUp ms >> withConnection' st (`execSQL` "VACUUM;")
  MTRDown ms -> mapM_ runDown $ reverse ms
  MTRNone -> pure ()
  where
-    runUp Migration {name, up, down} = do
-      when (name == "m20220811_onion_hosts") updateServers
-      DB.withImmediateTransaction db $ insert >> execSQL up
+    runUp Migration {name, up, down} = withTransaction' st $ \db -> do
+      when (name == "m20220811_onion_hosts") $ updateServers db
+      insert db >> execSQL db up'
      where
-        insert = DB.execute db "INSERT INTO migrations (name, down, ts) VALUES (?,?,?)" . (name,down,) =<< getCurrentTime
-        updateServers = forM_ (M.assocs extraSMPServerHosts) $ \(h, h') ->
-          DB.withImmediateTransaction db $
-            let hs = decodeLatin1 . strEncode $ ([h, h'] :: NonEmpty TransportHost)
-             in DB.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
-    runDown DownMigration {downName, downQuery} = do
-      DB.withImmediateTransaction db $ do
-        execSQL downQuery
-        DB.execute db "DELETE FROM migrations WHERE name = ?" (Only downName)
-    execSQL = SQLite3.exec $ DB.connectionHandle db
+        insert db = DB.execute db "INSERT INTO migrations (name, down, ts) VALUES (?,?,?)" . (name,down,) =<< getCurrentTime
+        up'
+          | dbNew st && name == "m20230110_users" = fromQuery new_m20230110_users
+          | otherwise = up
+        updateServers db = forM_ (M.assocs extraSMPServerHosts) $ \(h, h') ->
+          let hs = decodeLatin1 . strEncode $ ([h, h'] :: NonEmpty TransportHost)
+           in DB.execute db "UPDATE servers SET host = ? WHERE host = ?" (hs, decodeLatin1 $ strEncode h)
+    runDown DownMigration {downName, downQuery} = withTransaction' st $ \db -> do
+      execSQL db downQuery
+      DB.execute db "DELETE FROM migrations WHERE name = ?" (Only downName)
+    execSQL db = SQLite3.exec $ DB.connectionHandle db

-initialize :: Connection -> IO ()
-initialize db = do
+initialize :: SQLiteStore -> IO ()
+initialize st = withTransaction' st $ \db -> do
  cs :: [Text] <- map fromOnly <$> DB.query_ db "SELECT name FROM pragma_table_info('migrations')"
  case cs of
-    [] -> createMigrations
+    [] -> createMigrations db
    _ -> when ("down" `notElem` cs) $ DB.execute_ db "ALTER TABLE migrations ADD COLUMN down TEXT"
  where
-    createMigrations =
+    createMigrations db =
      DB.execute_
        db
        [sql|
@@ -160,11 +175,7 @@ data MigrationsToRun = MTRUp [Migration] | MTRDown [DownMigration] | MTRNone
 data MTRError
  = MTRENoDown {dbMigrations :: [String]}
  | MTREDifferent {appMigration :: String, dbMigration :: String}
-  deriving (Eq, Show, Generic)
-
-instance ToJSON MTRError where
-  toJSON = J.genericToJSON . sumTypeJSON $ dropPrefix "MTRE"
-  toEncoding = J.genericToEncoding . sumTypeJSON $ dropPrefix "MTRE"
+  deriving (Eq, Show)

 mtrErrorDescription :: MTRError -> String
 mtrErrorDescription = \case
@@ -183,3 +194,5 @@ migrationsToRun [] dbMs
 migrationsToRun (a : as) (d : ds)
  | name a == name d = migrationsToRun as ds
  | otherwise = Left $ MTREDifferent (name a) (name d)
+
+$(J.deriveJSON (sumTypeJSON $ dropPrefix "MTRE") ''MTRError)
@@ -27,3 +27,24 @@ UPDATE connections SET user_id = 1;

 PRAGMA ignore_check_constraints=OFF;
 |]
+
+-- This is executed in the new database
+-- It does not create new user record
+new_m20230110_users :: Query
+new_m20230110_users =
+  [sql|
+PRAGMA ignore_check_constraints=ON;
+
+CREATE TABLE users (
+  user_id INTEGER PRIMARY KEY AUTOINCREMENT
+);
+
+ALTER TABLE connections ADD COLUMN user_id INTEGER CHECK (user_id NOT NULL)
+REFERENCES users ON DELETE CASCADE;
+
+CREATE INDEX idx_connections_user ON connections(user_id);
+
+CREATE INDEX idx_commands_conn_id ON commands(conn_id);
+
+PRAGMA ignore_check_constraints=OFF;
+|]
@@ -0,0 +1,24 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230701_delivery_receipts where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20230701_delivery_receipts :: Query
+m20230701_delivery_receipts =
+  [sql|
+ALTER TABLE snd_messages ADD COLUMN rcpt_internal_id INTEGER;
+ALTER TABLE snd_messages ADD COLUMN rcpt_status TEXT;
+
+CREATE INDEX idx_snd_messages_rcpt_internal_id ON snd_messages(conn_id, rcpt_internal_id);
+|]
+
+down_m20230701_delivery_receipts :: Query
+down_m20230701_delivery_receipts =
+  [sql|
+DROP INDEX idx_snd_messages_rcpt_internal_id;
+
+ALTER TABLE snd_messages DROP COLUMN rcpt_internal_id;
+ALTER TABLE snd_messages DROP COLUMN rcpt_status;
+|]
@@ -0,0 +1,20 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230720_delete_expired_messages where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20230720_delete_expired_messages :: Query
+m20230720_delete_expired_messages =
+  [sql|
+CREATE INDEX idx_messages_internal_snd_id_ts ON messages(internal_snd_id, internal_ts);
+
+DELETE FROM messages WHERE internal_snd_id IS NOT NULL AND internal_ts < datetime('now', '-3 days');
+|]
+
+down_m20230720_delete_expired_messages :: Query
+down_m20230720_delete_expired_messages =
+  [sql|
+DROP INDEX idx_messages_internal_snd_id_ts;
+|]
@@ -0,0 +1,20 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230722_indexes where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20230722_indexes :: Query
+m20230722_indexes =
+  [sql|
+CREATE INDEX idx_processed_ratchet_key_hashes_created_at ON processed_ratchet_key_hashes(created_at);
+CREATE INDEX idx_encrypted_rcv_message_hashes_created_at ON encrypted_rcv_message_hashes(created_at);
+|]
+
+down_m20230722_indexes :: Query
+down_m20230722_indexes =
+  [sql|
+DROP INDEX idx_encrypted_rcv_message_hashes_created_at;
+DROP INDEX idx_processed_ratchet_key_hashes_created_at;
+|]
@@ -0,0 +1,22 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230814_indexes where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20230814_indexes :: Query
+m20230814_indexes =
+  [sql|
+DROP INDEX idx_messages_internal_snd_id_ts;
+
+CREATE INDEX idx_messages_internal_ts ON messages(internal_ts);
+|]
+
+down_m20230814_indexes :: Query
+down_m20230814_indexes =
+  [sql|
+DROP INDEX idx_messages_internal_ts;
+
+CREATE INDEX idx_messages_internal_snd_id_ts ON messages(internal_snd_id, internal_ts);
+|]
@@ -0,0 +1,24 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20230829_crypto_files where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20230829_crypto_files :: Query
+m20230829_crypto_files =
+  [sql|
+ALTER TABLE rcv_files ADD COLUMN save_file_key BLOB;
+ALTER TABLE rcv_files ADD COLUMN save_file_nonce BLOB;
+ALTER TABLE snd_files ADD COLUMN src_file_key BLOB;
+ALTER TABLE snd_files ADD COLUMN src_file_nonce BLOB;
+|]
+
+down_m20230829_crypto_files :: Query
+down_m20230829_crypto_files =
+  [sql|
+ALTER TABLE rcv_files DROP COLUMN save_file_key;
+ALTER TABLE rcv_files DROP COLUMN save_file_nonce;
+ALTER TABLE snd_files DROP COLUMN src_file_key;
+ALTER TABLE snd_files DROP COLUMN src_file_nonce;
+|]
@@ -0,0 +1,20 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231222_command_created_at where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20231222_command_created_at :: Query
+m20231222_command_created_at =
+  [sql|
+ALTER TABLE commands ADD COLUMN created_at TEXT NOT NULL DEFAULT('1970-01-01 00:00:00');
+CREATE INDEX idx_commands_server_commands ON commands(host, port, created_at, command_id);
+|]
+
+down_m20231222_command_created_at :: Query
+down_m20231222_command_created_at =
+  [sql|
+DROP INDEX idx_commands_server_commands;
+ALTER TABLE commands DROP COLUMN created_at;
+|]
@@ -0,0 +1,38 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20231225_failed_work_items where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20231225_failed_work_items :: Query
+m20231225_failed_work_items =
+    [sql|
+ALTER TABLE snd_message_deliveries ADD COLUMN failed INTEGER DEFAULT 0;
+ALTER TABLE commands ADD COLUMN failed INTEGER DEFAULT 0;
+ALTER TABLE ntf_subscriptions ADD COLUMN ntf_failed INTEGER DEFAULT 0;
+ALTER TABLE ntf_subscriptions ADD COLUMN smp_failed INTEGER DEFAULT 0;
+ALTER TABLE rcv_files ADD COLUMN failed INTEGER DEFAULT 0;
+ALTER TABLE snd_files ADD COLUMN failed INTEGER DEFAULT 0;
+ALTER TABLE deleted_snd_chunk_replicas ADD COLUMN failed INTEGER DEFAULT 0;
+
+CREATE INDEX idx_rcv_files_status_created_at ON rcv_files(status, created_at);
+CREATE INDEX idx_snd_files_status_created_at ON snd_files(status, created_at);
+CREATE INDEX idx_snd_files_snd_file_entity_id ON snd_files(snd_file_entity_id);
+|]
+
+down_m20231225_failed_work_items :: Query
+down_m20231225_failed_work_items =
+    [sql|
+DROP INDEX idx_rcv_files_status_created_at;
+DROP INDEX idx_snd_files_status_created_at;
+DROP INDEX idx_snd_files_snd_file_entity_id;
+
+ALTER TABLE snd_message_deliveries DROP COLUMN failed;
+ALTER TABLE commands DROP COLUMN failed;
+ALTER TABLE ntf_subscriptions DROP COLUMN ntf_failed;
+ALTER TABLE ntf_subscriptions DROP COLUMN smp_failed;
+ALTER TABLE rcv_files DROP COLUMN failed;
+ALTER TABLE snd_files DROP COLUMN failed;
+ALTER TABLE deleted_snd_chunk_replicas DROP COLUMN failed;
+|]
@@ -0,0 +1,20 @@
+{-# LANGUAGE QuasiQuotes #-}
+
+module Simplex.Messaging.Agent.Store.SQLite.Migrations.M20240121_message_delivery_indexes where
+
+import Database.SQLite.Simple (Query)
+import Database.SQLite.Simple.QQ (sql)
+
+m20240121_message_delivery_indexes :: Query
+m20240121_message_delivery_indexes =
+    [sql|
+CREATE INDEX idx_messages_snd_expired ON messages(conn_id, internal_snd_id, internal_ts);
+CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(conn_id, snd_queue_id, failed, internal_id);
+|]
+
+down_m20240121_message_delivery_indexes :: Query
+down_m20240121_message_delivery_indexes =
+    [sql|
+DROP INDEX idx_messages_snd_expired;
+DROP INDEX idx_snd_message_deliveries_expired;
+|]
@@ -119,6 +119,8 @@ CREATE TABLE snd_messages(
  previous_msg_hash BLOB NOT NULL DEFAULT x'',
  retry_int_slow INTEGER,
  retry_int_fast INTEGER,
+  rcpt_internal_id INTEGER,
+  rcpt_status TEXT,
  PRIMARY KEY(conn_id, internal_snd_id),
  FOREIGN KEY(conn_id, internal_id) REFERENCES messages
  ON DELETE CASCADE
@@ -211,6 +213,8 @@ CREATE TABLE ntf_subscriptions(
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now')),
  smp_server_key_hash BLOB,
+  ntf_failed INTEGER DEFAULT 0,
+  smp_failed INTEGER DEFAULT 0,
  PRIMARY KEY(conn_id),
  FOREIGN KEY(smp_host, smp_port) REFERENCES servers(host, port)
  ON DELETE SET NULL ON UPDATE CASCADE,
@@ -227,6 +231,8 @@ CREATE TABLE commands(
  command BLOB NOT NULL,
  agent_version INTEGER NOT NULL DEFAULT 1,
  server_key_hash BLOB,
+  created_at TEXT NOT NULL DEFAULT('1970-01-01 00:00:00'),
+  failed INTEGER DEFAULT 0,
  FOREIGN KEY(host, port) REFERENCES servers
  ON DELETE RESTRICT ON UPDATE CASCADE
 );
@@ -235,6 +241,7 @@ CREATE TABLE snd_message_deliveries(
  conn_id BLOB NOT NULL REFERENCES connections ON DELETE CASCADE,
  snd_queue_id INTEGER NOT NULL,
  internal_id INTEGER NOT NULL,
+  failed INTEGER DEFAULT 0,
  FOREIGN KEY(conn_id, internal_id) REFERENCES messages ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED
 );
 CREATE TABLE sqlite_sequence(name,seq);
@@ -269,6 +276,9 @@ CREATE TABLE rcv_files(
  error TEXT,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now')),
+  save_file_key BLOB,
+  save_file_nonce BLOB,
+  failed INTEGER DEFAULT 0,
  UNIQUE(rcv_file_entity_id)
 );
 CREATE TABLE rcv_file_chunks(
@@ -309,6 +319,10 @@ CREATE TABLE snd_files(
  error TEXT,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
+  ,
+  src_file_key BLOB,
+  src_file_nonce BLOB,
+  failed INTEGER DEFAULT 0
 );
 CREATE TABLE snd_file_chunks(
  snd_file_chunk_id INTEGER PRIMARY KEY,
@@ -352,6 +366,8 @@ CREATE TABLE deleted_snd_chunk_replicas(
  retries INTEGER NOT NULL DEFAULT 0,
  created_at TEXT NOT NULL DEFAULT(datetime('now')),
  updated_at TEXT NOT NULL DEFAULT(datetime('now'))
+  ,
+  failed INTEGER DEFAULT 0
 );
 CREATE TABLE encrypted_rcv_message_hashes(
  encrypted_rcv_message_hash_id INTEGER PRIMARY KEY,
@@ -461,3 +477,34 @@ CREATE INDEX idx_processed_ratchet_key_hashes_hash ON processed_ratchet_key_hash
  conn_id,
  hash
 );
+CREATE INDEX idx_snd_messages_rcpt_internal_id ON snd_messages(
+  conn_id,
+  rcpt_internal_id
+);
+CREATE INDEX idx_processed_ratchet_key_hashes_created_at ON processed_ratchet_key_hashes(
+  created_at
+);
+CREATE INDEX idx_encrypted_rcv_message_hashes_created_at ON encrypted_rcv_message_hashes(
+  created_at
+);
+CREATE INDEX idx_messages_internal_ts ON messages(internal_ts);
+CREATE INDEX idx_commands_server_commands ON commands(
+  host,
+  port,
+  created_at,
+  command_id
+);
+CREATE INDEX idx_rcv_files_status_created_at ON rcv_files(status, created_at);
+CREATE INDEX idx_snd_files_status_created_at ON snd_files(status, created_at);
+CREATE INDEX idx_snd_files_snd_file_entity_id ON snd_files(snd_file_entity_id);
+CREATE INDEX idx_messages_snd_expired ON messages(
+  conn_id,
+  internal_snd_id,
+  internal_ts
+);
+CREATE INDEX idx_snd_message_deliveries_expired ON snd_message_deliveries(
+  conn_id,
+  snd_queue_id,
+  failed,
+  internal_id
+);
@@ -1,25 +0,0 @@
-module Simplex.Messaging.Agent.TAsyncs where
-
-import Control.Concurrent.STM (stateTVar)
-import Control.Monad.IO.Unlift (MonadUnliftIO)
-import Simplex.Messaging.TMap (TMap)
-import qualified Simplex.Messaging.TMap as TM
-import UnliftIO.Async (Async, async)
-import UnliftIO.STM
-
-data TAsyncs = TAsyncs
-  { actionId :: TVar Int,
-    actions :: TMap Int (Async ())
-  }
-
-newTAsyncs :: STM TAsyncs
-newTAsyncs = TAsyncs <$> newTVar 0 <*> TM.empty
-
-newAsyncAction :: MonadUnliftIO m => (Int -> m ()) -> TAsyncs -> m ()
-newAsyncAction action as = do
-  aId <- atomically $ stateTVar (actionId as) $ \i -> (i + 1, i + 1)
-  a <- async $ action aId
-  atomically $ TM.insert aId a $ actions as
-
-removeAsyncAction :: Int -> TAsyncs -> STM ()
-removeAsyncAction aId = TM.delete aId . actions
@@ -1,5 +1,5 @@
 module Simplex.Messaging.Agent.TRcvQueues
-  ( TRcvQueues,
+  ( TRcvQueues (getRcvQueues),
    empty,
    clear,
    deleteConn,
@@ -9,6 +9,7 @@ module Simplex.Messaging.Agent.TRcvQueues
    deleteQueue,
    getSessQueues,
    getDelSessQueues,
+    qKey,
  )
 where

@@ -17,12 +18,12 @@ import qualified Data.Map.Strict as M
 import Data.Set (Set)
 import qualified Data.Set as S
 import Simplex.Messaging.Agent.Protocol (ConnId, UserId)
-import Simplex.Messaging.Agent.Store (RcvQueue (..))
+import Simplex.Messaging.Agent.Store (RcvQueue, StoredRcvQueue (..))
 import Simplex.Messaging.Protocol (RecipientId, SMPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM

-newtype TRcvQueues = TRcvQueues (TMap (UserId, SMPServer, RecipientId) RcvQueue)
+newtype TRcvQueues = TRcvQueues {getRcvQueues :: TMap (UserId, SMPServer, RecipientId) RcvQueue}

 empty :: STM TRcvQueues
 empty = TRcvQueues <$> TM.empty
@@ -1,6 +1,5 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE GADTs #-}
@@ -10,8 +9,9 @@
 {-# LANGUAGE OverloadedLists #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
-{-# LANGUAGE TypeApplications #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TupleSections #-}
+{-# LANGUAGE TypeApplications #-}

 -- |
 -- Module      : Simplex.Messaging.Client
@@ -40,6 +40,7 @@ module Simplex.Messaging.Client
    createSMPQueue,
    subscribeSMPQueue,
    subscribeSMPQueues,
+    streamSubscribeSMPQueues,
    getSMPMessage,
    subscribeSMPQueueNotifications,
    subscribeSMPQueuesNtfs,
@@ -69,6 +70,11 @@ module Simplex.Messaging.Client
    temporaryClientError,
    ServerTransmission,
    ClientCommand,
+
+    -- * For testing
+    PCTransmission,
+    mkTransmission,
+    clientStub,
  )
 where

@@ -78,26 +84,22 @@ import Control.Exception
 import Control.Monad
 import Control.Monad.IO.Class (liftIO)
 import Control.Monad.Trans.Except
-import Data.Aeson (FromJSON (..), ToJSON (..))
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
-import Data.Either (rights)
-import Data.Foldable (foldl')
 import Data.Functor (($>))
 import Data.Int (Int64)
 import Data.List (find)
-import Data.List.NonEmpty (NonEmpty (..), (<|))
+import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as L
 import Data.Maybe (fromMaybe)
 import Data.Time.Clock (UTCTime, getCurrentTime)
-import GHC.Generics (Generic)
 import Network.Socket (ServiceName)
 import Numeric.Natural
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (dropPrefix, enumJSON)
-import Simplex.Messaging.Protocol as SMP
+import Simplex.Messaging.Parsers (defaultJSON, dropPrefix, enumJSON)
+import Simplex.Messaging.Protocol
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport
@@ -116,7 +118,6 @@ data ProtocolClient err msg = ProtocolClient
    sessionId :: SessionId,
    sessionTs :: UTCTime,
    thVersion :: Version,
-    timeoutPerBlock :: Int,
    blockSize :: Int,
    batch :: Bool,
    client_ :: PClient err msg
@@ -131,18 +132,49 @@ data PClient err msg = PClient
    pingErrorCount :: TVar Int,
    clientCorrId :: TVar Natural,
    sentCommands :: TMap CorrId (Request err msg),
-    sndQ :: TBQueue (NonEmpty SentRawTransmission),
+    sndQ :: TBQueue ByteString,
    rcvQ :: TBQueue (NonEmpty (SignedTransmission err msg)),
    msgQ :: Maybe (TBQueue (ServerTransmission msg))
  }

-type SMPClient = ProtocolClient ErrorType SMP.BrokerMsg
+clientStub :: ByteString -> STM (ProtocolClient err msg)
+clientStub sessionId = do
+  connected <- newTVar False
+  clientCorrId <- newTVar 0
+  sentCommands <- TM.empty
+  sndQ <- newTBQueue 100
+  rcvQ <- newTBQueue 100
+  return
+    ProtocolClient
+      { action = Nothing,
+        sessionId,
+        sessionTs = undefined,
+        thVersion = 5,
+        blockSize = smpBlockSize,
+        batch = undefined,
+        client_ =
+          PClient
+            { connected,
+              transportSession = undefined,
+              transportHost = undefined,
+              tcpTimeout = undefined,
+              batchDelay = Nothing,
+              pingErrorCount = undefined,
+              clientCorrId,
+              sentCommands,
+              sndQ,
+              rcvQ,
+              msgQ = Nothing
+            }
+      }
+
+type SMPClient = ProtocolClient ErrorType BrokerMsg

 -- | Type for client command data
-type ClientCommand msg = (Maybe C.APrivateSignKey, QueueId, ProtoCommand msg)
+type ClientCommand msg = (Maybe C.APrivateSignKey, EntityId, ProtoCommand msg)

 -- | Type synonym for transmission from some SPM server queue.
-type ServerTransmission msg = (TransportSession msg, Version, SessionId, QueueId, msg)
+type ServerTransmission msg = (TransportSession msg, Version, SessionId, EntityId, msg)

 data HostMode
  = -- | prefer (or require) onion hosts when connecting via SOCKS proxy
@@ -151,14 +183,7 @@ data HostMode
    HMOnion
  | -- | prefer (or require) public hosts
    HMPublic
-  deriving (Eq, Show, Generic)
-
-instance FromJSON HostMode where
-  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "HM"
-
-instance ToJSON HostMode where
-  toJSON = J.genericToJSON . enumJSON $ dropPrefix "HM"
-  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "HM"
+  deriving (Eq, Show)

 -- | network configuration for the client
 data NetworkConfig = NetworkConfig
@@ -184,21 +209,10 @@ data NetworkConfig = NetworkConfig
    smpPingCount :: Int,
    logTLSErrors :: Bool
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance ToJSON NetworkConfig where
-  toJSON = J.genericToJSON J.defaultOptions {J.omitNothingFields = True}
-  toEncoding = J.genericToEncoding J.defaultOptions {J.omitNothingFields = True}
+  deriving (Eq, Show)

 data TransportSessionMode = TSMUser | TSMEntity
-  deriving (Eq, Show, Generic)
-
-instance ToJSON TransportSessionMode where
-  toJSON = J.genericToJSON . enumJSON $ dropPrefix "TSM"
-  toEncoding = J.genericToEncoding . enumJSON $ dropPrefix "TSM"
-
-instance FromJSON TransportSessionMode where
-  parseJSON = J.genericParseJSON . enumJSON $ dropPrefix "TSM"
+  deriving (Eq, Show)

 defaultNetworkConfig :: NetworkConfig
 defaultNetworkConfig =
@@ -207,9 +221,9 @@ defaultNetworkConfig =
      hostMode = HMOnionViaSocks,
      requiredHostMode = False,
      sessionMode = TSMUser,
-      tcpConnectTimeout = 7_500_000,
-      tcpTimeout = 5_000_000,
-      tcpTimeoutPerKb = 10_000, -- 10ms, should be less than 130ms to avoid Int overflow on 32 bit systems
+      tcpConnectTimeout = 20_000_000,
+      tcpTimeout = 15_000_000,
+      tcpTimeoutPerKb = 45_000, -- 45ms, should be less than 130ms to avoid Int overflow on 32 bit systems
      tcpKeepAlive = Just defaultKeepAliveOpts,
      smpPingInterval = 600_000_000, -- 10min
      smpPingCount = 3,
@@ -218,7 +232,7 @@ defaultNetworkConfig =

 transportClientConfig :: NetworkConfig -> TransportClientConfig
 transportClientConfig NetworkConfig {socksProxy, tcpKeepAlive, logTLSErrors} =
-  TransportClientConfig {socksProxy, tcpKeepAlive, logTLSErrors}
+  TransportClientConfig {socksProxy, tcpKeepAlive, logTLSErrors, clientCredentials = Nothing}

 -- | protocol client configuration.
 data ProtocolClientConfig = ProtocolClientConfig
@@ -246,11 +260,14 @@ defaultClientConfig =
    }

 data Request err msg = Request
-  { queueId :: QueueId,
-    responseVar :: TMVar (Response err msg)
+  { entityId :: EntityId,
+    responseVar :: TMVar (Either (ProtocolClientError err) msg)
  }

-type Response err msg = Either (ProtocolClientError err) msg
+data Response err msg = Response
+  { entityId :: EntityId,
+    response :: Either (ProtocolClientError err) msg
+  }

 chooseTransportHost :: NetworkConfig -> NonEmpty TransportHost -> Either (ProtocolClientError err) TransportHost
 chooseTransportHost NetworkConfig {socksProxy, hostMode, requiredHostMode} hosts =
@@ -295,7 +312,7 @@ getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize,
        `catch` \(e :: IOException) -> pure . Left $ PCEIOError e
    Left e -> pure $ Left e
  where
-    NetworkConfig {tcpConnectTimeout, tcpTimeout, tcpTimeoutPerKb, smpPingInterval} = networkConfig
+    NetworkConfig {tcpConnectTimeout, tcpTimeout, smpPingInterval} = networkConfig
    mkProtocolClient :: TransportHost -> STM (PClient err msg)
    mkProtocolClient transportHost = do
      connected <- newTVar False
@@ -327,12 +344,12 @@ getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize,
      action <-
        async $
          runTransportClient tcConfig (Just username) useHost port' (Just $ keyHash srv) (client t c cVar)
-            `finally` atomically (putTMVar cVar $ Left PCENetworkError)
+            `finally` atomically (tryPutTMVar cVar $ Left PCENetworkError)
      c_ <- tcpConnectTimeout `timeout` atomically (takeTMVar cVar)
-      pure $ case c_ of
-        Just (Right c') -> Right c' {action = Just action}
-        Just (Left e) -> Left e
-        Nothing -> Left PCENetworkError
+      case c_ of
+        Just (Right c') -> pure $ Right c' {action = Just action}
+        Just (Left e) -> pure $ Left e
+        Nothing -> cancel action $> Left PCENetworkError

    useTransport :: (ServiceName, ATransport)
    useTransport = case port srv of
@@ -346,8 +363,7 @@ getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize,
        Left e -> atomically . putTMVar cVar . Left $ PCETransportError e
        Right th@THandle {sessionId, thVersion, blockSize, batch} -> do
          sessionTs <- getCurrentTime
-          let timeoutPerBlock = (blockSize * tcpTimeoutPerKb) `div` 1024
-              c' = ProtocolClient {action = Nothing, client_ = c, sessionId, thVersion, sessionTs, timeoutPerBlock, blockSize, batch}
+          let c' = ProtocolClient {action = Nothing, client_ = c, sessionId, thVersion, sessionTs, blockSize, batch}
          atomically $ do
            writeTVar (connected c) True
            putTMVar cVar $ Right c'
@@ -355,7 +371,7 @@ getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize,
            `finally` disconnected c'

    send :: Transport c => ProtocolClient err msg -> THandle c -> IO ()
-    send ProtocolClient {client_ = PClient {sndQ}} h = forever $ atomically (readTBQueue sndQ) >>= tPut h batchDelay
+    send ProtocolClient {client_ = PClient {sndQ}} h = forever $ atomically (readTBQueue sndQ) >>= tPutLog h

    receive :: Transport c => ProtocolClient err msg -> THandle c -> IO ()
    receive ProtocolClient {client_ = PClient {rcvQ}} h = forever $ tGet h >>= atomically . writeTBQueue rcvQ
@@ -375,26 +391,27 @@ getProtocolClient transportSession@(_, srv, _) cfg@ProtocolClientConfig {qSize,
    process c = forever $ atomically (readTBQueue $ rcvQ $ client_ c) >>= mapM_ (processMsg c)

    processMsg :: ProtocolClient err msg -> SignedTransmission err msg -> IO ()
-    processMsg c@ProtocolClient {client_ = PClient {sentCommands}} (_, _, (corrId, qId, respOrErr)) =
+    processMsg c@ProtocolClient {client_ = PClient {sentCommands}} (_, _, (corrId, entId, respOrErr)) =
      if B.null $ bs corrId
        then sendMsg respOrErr
        else do
          atomically (TM.lookup corrId sentCommands) >>= \case
            Nothing -> sendMsg respOrErr
-            Just Request {queueId, responseVar} -> atomically $ do
+            Just Request {entityId, responseVar} -> atomically $ do
              TM.delete corrId sentCommands
-              putTMVar responseVar $
-                if queueId == qId
-                  then case respOrErr of
-                    Left e -> Left $ PCEResponseError e
-                    Right r -> case protocolError r of
-                      Just e -> Left $ PCEProtocolError e
-                      _ -> Right r
-                  else Left . PCEUnexpectedResponse $ bshow respOrErr
+              putTMVar responseVar $ response entityId
      where
+        response entityId
+          | entityId == entId =
+              case respOrErr of
+                Left e -> Left $ PCEResponseError e
+                Right r -> case protocolError r of
+                  Just e -> Left $ PCEProtocolError e
+                  _ -> Right r
+          | otherwise = Left . PCEUnexpectedResponse $ bshow respOrErr
        sendMsg :: Either err msg -> IO ()
        sendMsg = \case
-          Right msg -> atomically $ mapM_ (`writeTBQueue` serverTransmission c qId msg) msgQ
+          Right msg -> atomically $ mapM_ (`writeTBQueue` serverTransmission c entId msg) msgQ
          Left e -> putStrLn $ "SMP client error: " <> show e

 proxyUsername :: TransportSession msg -> ByteString
@@ -452,9 +469,10 @@ createSMPQueue ::
  RcvPublicVerifyKey ->
  RcvPublicDhKey ->
  Maybe BasicAuth ->
+  SubscriptionMode ->
  ExceptT SMPClientError IO QueueIdsKeys
-createSMPQueue c rpKey rKey dhKey auth =
-  sendSMPCommand c (Just rpKey) "" (NEW rKey dhKey auth) >>= \case
+createSMPQueue c rpKey rKey dhKey auth subMode =
+  sendSMPCommand c (Just rpKey) "" (NEW rKey dhKey auth subMode) >>= \case
    IDS qik -> pure qik
    r -> throwE . PCEUnexpectedResponse $ bshow r

@@ -470,14 +488,22 @@ subscribeSMPQueue c rpKey rId =

 -- | Subscribe to multiple SMP queues batching commands if supported.
 subscribeSMPQueues :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId) -> IO (NonEmpty (Either SMPClientError ()))
-subscribeSMPQueues c qs = sendProtocolCommands c cs >>= mapM response . L.zip qs
+subscribeSMPQueues c qs = sendProtocolCommands c cs >>= mapM (processSUBResponse c)
  where
    cs = L.map (\(rpKey, rId) -> (Just rpKey, rId, Cmd SRecipient SUB)) qs
-    response ((_, rId), r) = case r of
-      Right OK -> pure $ Right ()
-      Right cmd@MSG {} -> writeSMPMessage c rId cmd $> Right ()
-      Right r' -> pure . Left . PCEUnexpectedResponse $ bshow r'
-      Left e -> pure $ Left e
+
+streamSubscribeSMPQueues :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId) -> ([(RecipientId, Either SMPClientError ())] -> IO ()) -> IO ()
+streamSubscribeSMPQueues c qs cb = streamProtocolCommands c cs $ mapM process >=> cb
+  where
+    cs = L.map (\(rpKey, rId) -> (Just rpKey, rId, Cmd SRecipient SUB)) qs
+    process r@(Response rId _) = (rId,) <$> processSUBResponse c r
+
+processSUBResponse :: SMPClient -> Response ErrorType BrokerMsg -> IO (Either SMPClientError ())
+processSUBResponse c (Response rId r) = case r of
+  Right OK -> pure $ Right ()
+  Right cmd@MSG {} -> writeSMPMessage c rId cmd $> Right ()
+  Right r' -> pure . Left . PCEUnexpectedResponse $ bshow r'
+  Left e -> pure $ Left e

 writeSMPMessage :: SMPClient -> RecipientId -> BrokerMsg -> IO ()
 writeSMPMessage c rId msg = atomically $ mapM_ (`writeTBQueue` serverTransmission c rId msg) (msgQ $ client_ c)
@@ -523,12 +549,12 @@ enableSMPQueueNotifications c rpKey rId notifierKey rcvNtfPublicDhKey =

 -- | Enable notifications for the multiple queues for push notifications server.
 enableSMPQueuesNtfs :: SMPClient -> NonEmpty (RcvPrivateSignKey, RecipientId, NtfPublicVerifyKey, RcvNtfPublicDhKey) -> IO (NonEmpty (Either SMPClientError (NotifierId, RcvNtfPublicDhKey)))
-enableSMPQueuesNtfs c qs = L.map response <$> sendProtocolCommands c cs
+enableSMPQueuesNtfs c qs = L.map process <$> sendProtocolCommands c cs
  where
    cs = L.map (\(rpKey, rId, notifierKey, rcvNtfPublicDhKey) -> (Just rpKey, rId, Cmd SRecipient $ NKEY notifierKey rcvNtfPublicDhKey)) qs
-    response = \case
+    process (Response _ r) = case r of
      Right (NID nId rcvNtfSrvPublicDhKey) -> Right (nId, rcvNtfSrvPublicDhKey)
-      Right r -> Left . PCEUnexpectedResponse $ bshow r
+      Right r' -> Left . PCEUnexpectedResponse $ bshow r'
      Left e -> Left e

 -- | Disable notifications for the queue for push notifications server.
@@ -584,78 +610,88 @@ okSMPCommand cmd c pKey qId =
    r -> throwE . PCEUnexpectedResponse $ bshow r

 okSMPCommands :: PartyI p => Command p -> SMPClient -> NonEmpty (C.APrivateSignKey, QueueId) -> IO (NonEmpty (Either SMPClientError ()))
-okSMPCommands cmd c qs = L.map response <$> sendProtocolCommands c cs
+okSMPCommands cmd c qs = L.map process <$> sendProtocolCommands c cs
  where
    aCmd = Cmd sParty cmd
    cs = L.map (\(pKey, qId) -> (Just pKey, qId, aCmd)) qs
-    response = \case
+    process (Response _ r) = case r of
      Right OK -> Right ()
-      Right r -> Left . PCEUnexpectedResponse $ bshow r
+      Right r' -> Left . PCEUnexpectedResponse $ bshow r'
      Left e -> Left e

 -- | Send SMP command
 sendSMPCommand :: PartyI p => SMPClient -> Maybe C.APrivateSignKey -> QueueId -> Command p -> ExceptT SMPClientError IO BrokerMsg
 sendSMPCommand c pKey qId cmd = sendProtocolCommand c pKey qId (Cmd sParty cmd)

-type PCTransmission err msg = (SentRawTransmission, TMVar (Response err msg))
+type PCTransmission err msg = (SentRawTransmission, Request err msg)

 -- | Send multiple commands with batching and collect responses
-- It will result in Int overflow on 32 bit platform for a large number of blocks (~13.4k blocks / ~1.2m subscriptions)
-- TODO switch to timeout or TimeManager that supports Int64
-sendProtocolCommands :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> NonEmpty (ClientCommand msg) -> IO (NonEmpty (Either (ProtocolClientError err) msg))
-sendProtocolCommands c@ProtocolClient {client_ = PClient {sndQ, tcpTimeout, batchDelay}, batch, blockSize, timeoutPerBlock} cs = do
-  (h :| ts) <- mapM (runExceptT . mkTransmission c) cs
-  let h' :: Either (ProtocolClientError err) (PCTransmission err msg, Int) = (,timeoutPerBlock) <$> h
-      batchSz = if batch then either (const 0) tSize h else 0
-      ts' :: NonEmpty (Either (ProtocolClientError err) (PCTransmission err msg, Int)) =
-        L.reverse . fst3 $ foldl' batchTimeouts ([h'], timeoutPerBlock, batchSz) ts
-      ts_ :: (Maybe (NonEmpty SentRawTransmission)) =
-        L.nonEmpty . map (fst . fst) . rights $ L.toList ts'
-  mapM_ (atomically . writeTBQueue sndQ) ts_
-  forConcurrently ts' $ \case
-    Right ((_t, r), bt) -> withTimeout c (tcpTimeout + bt) (atomically $ takeTMVar r)
-    Left e -> pure $ Left e
+sendProtocolCommands :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> NonEmpty (ClientCommand msg) -> IO (NonEmpty (Response err msg))
+sendProtocolCommands c@ProtocolClient {batch, blockSize} cs = do
+  bs <- batchTransmissions' batch blockSize <$> mapM (mkTransmission c) cs
+  validate . concat =<< mapM (sendBatch c) bs
  where
-    fst3 (x, _, _) = x
-    -- tSize calculation matches the batching logic in tPut that does actual breaking of transmissions into blocks
-    tSize :: PCTransmission err msg -> Int
-    tSize ((sig, t), _) = maybe 0 C.signatureSize sig + B.length t + 3 -- 1 byte for signature size + 2 bytes for transmission size
-    batchTimeouts :: (NonEmpty (Either (ProtocolClientError err) (PCTransmission err msg, Int)), Int, Int) -> Either (ProtocolClientError err) (PCTransmission err msg) -> (NonEmpty (Either (ProtocolClientError err) (PCTransmission err msg, Int)), Int, Int)
-    batchTimeouts (ts, bt, batchSz) = \case
-      Left e -> (Left e <| ts, bt, batchSz)
-      Right t
-        | not batch ->
-          (Right (t, bt') <| ts, bt', 0)
-        | batchSz' + 1 > blockSize ->
-          (Right (t, bt') <| ts, bt', tSz)
-        | otherwise -> -- same block in the batch
-          (Right (t, bt) <| ts, bt, batchSz') -- 1 byte for the number of transmissions in the batch
-        where
-          batchSz' = batchSz + tSz
-          bt' = bt + timeoutPerBlock + fromMaybe 0 batchDelay
-          tSz = tSize t
+    validate :: [Response err msg] -> IO (NonEmpty (Response err msg))
+    validate rs
+      | diff == 0 = pure $ L.fromList rs
+      | diff > 0 = do
+          putStrLn "send error: fewer responses than expected"
+          pure $ L.fromList $ rs <> replicate diff (Response "" $ Left $ PCETransportError TEBadBlock)
+      | otherwise = do
+          putStrLn "send error: more responses than expected"
+          pure $ L.fromList $ take (L.length cs) rs
+      where
+        diff = L.length cs - length rs
+
+streamProtocolCommands :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> NonEmpty (ClientCommand msg) -> ([Response err msg] -> IO ()) -> IO ()
+streamProtocolCommands c@ProtocolClient {batch, blockSize} cs cb = do
+  bs <- batchTransmissions' batch blockSize <$> mapM (mkTransmission c) cs
+  mapM_ (cb <=< sendBatch c) bs
+
+sendBatch :: ProtocolClient err msg -> TransportBatch (Request err msg) -> IO [Response err msg]
+sendBatch c@ProtocolClient {client_ = PClient {sndQ}} b = do
+  case b of
+    TBLargeTransmission Request {entityId} -> do
+      putStrLn "send error: large message"
+      pure [Response entityId $ Left $ PCETransportError TELargeMsg]
+    TBTransmissions s n rs
+      | n > 0 -> do
+          atomically $ writeTBQueue sndQ s
+          mapConcurrently (getResponse c) rs
+      | otherwise -> pure []
+    TBTransmission s r -> do
+      atomically $ writeTBQueue sndQ s
+      (: []) <$> getResponse c r

 -- | Send Protocol command
-sendProtocolCommand :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> Maybe C.APrivateSignKey -> QueueId -> ProtoCommand msg -> ExceptT (ProtocolClientError err) IO msg
-sendProtocolCommand c@ProtocolClient {client_ = PClient {sndQ, tcpTimeout}} pKey qId cmd = do
-  (t, r) <- mkTransmission c (pKey, qId, cmd)
-  ExceptT $ sendRecv t r
+sendProtocolCommand :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> Maybe C.APrivateSignKey -> EntityId -> ProtoCommand msg -> ExceptT (ProtocolClientError err) IO msg
+sendProtocolCommand c@ProtocolClient {client_ = PClient {sndQ}, batch, blockSize} pKey entId cmd =
+  ExceptT $ uncurry sendRecv =<< mkTransmission c (pKey, entId, cmd)
  where
    -- two separate "atomically" needed to avoid blocking
-    sendRecv :: SentRawTransmission -> TMVar (Response err msg) -> IO (Response err msg)
-    sendRecv t r = atomically (writeTBQueue sndQ [t]) >> withTimeout c tcpTimeout (atomically $ takeTMVar r)
+    sendRecv :: SentRawTransmission -> Request err msg -> IO (Either (ProtocolClientError err) msg)
+    sendRecv t r
+      | B.length s > blockSize - 2 = pure $ Left $ PCETransportError TELargeMsg
+      | otherwise = atomically (writeTBQueue sndQ s) >> response <$> getResponse c r
+      where
+        s
+          | batch = tEncodeBatch1 t
+          | otherwise = tEncode t

-withTimeout :: ProtocolClient err msg -> Int -> IO (Either (ProtocolClientError err) msg) -> IO (Either (ProtocolClientError err) msg)
-withTimeout ProtocolClient {client_ = PClient {pingErrorCount}} t a = do
-  timeout t a >>= \case
-    Just r -> atomically (writeTVar pingErrorCount 0) >> pure r
-    _ -> pure $ Left PCEResponseTimeout
+-- TODO switch to timeout or TimeManager that supports Int64
+getResponse :: ProtocolClient err msg -> Request err msg -> IO (Response err msg)
+getResponse ProtocolClient {client_ = PClient {tcpTimeout, pingErrorCount}} Request {entityId, responseVar} = do
+  response <-
+    timeout tcpTimeout (atomically (takeTMVar responseVar)) >>= \case
+      Just r -> atomically (writeTVar pingErrorCount 0) $> r
+      Nothing -> pure $ Left PCEResponseTimeout
+  pure Response {entityId, response}

-mkTransmission :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> ClientCommand msg -> ExceptT (ProtocolClientError err) IO (PCTransmission err msg)
-mkTransmission ProtocolClient {sessionId, thVersion, client_ = PClient {clientCorrId, sentCommands}} (pKey, qId, cmd) = do
-  corrId <- liftIO $ atomically getNextCorrId
-  let t = signTransmission $ encodeTransmission thVersion sessionId (corrId, qId, cmd)
-  r <- liftIO . atomically $ mkRequest corrId
+mkTransmission :: forall err msg. ProtocolEncoding err (ProtoCommand msg) => ProtocolClient err msg -> ClientCommand msg -> IO (PCTransmission err msg)
+mkTransmission ProtocolClient {sessionId, thVersion, client_ = PClient {clientCorrId, sentCommands}} (pKey, entId, cmd) = do
+  corrId <- atomically getNextCorrId
+  let t = signTransmission $ encodeTransmission thVersion sessionId (corrId, entId, cmd)
+  r <- atomically $ mkRequest corrId
  pure (t, r)
  where
    getNextCorrId :: STM CorrId
@@ -664,8 +700,14 @@ mkTransmission ProtocolClient {sessionId, thVersion, client_ = PClient {clientCo
      pure . CorrId $ bshow i
    signTransmission :: ByteString -> SentRawTransmission
    signTransmission t = ((`C.sign` t) <$> pKey, t)
-    mkRequest :: CorrId -> STM (TMVar (Response err msg))
+    mkRequest :: CorrId -> STM (Request err msg)
    mkRequest corrId = do
-      r <- newEmptyTMVar
-      TM.insert corrId (Request qId r) sentCommands
+      r <- Request entId <$> newEmptyTMVar
+      TM.insert corrId r sentCommands
      pure r
+
+$(J.deriveJSON (enumJSON $ dropPrefix "HM") ''HostMode)
+
+$(J.deriveJSON (enumJSON $ dropPrefix "TSM") ''TransportSessionMode)
+
+$(J.deriveJSON defaultJSON ''NetworkConfig)
@@ -14,10 +14,11 @@ module Simplex.Messaging.Client.Agent where
 import Control.Concurrent (forkIO)
 import Control.Concurrent.Async (Async, uninterruptibleCancel)
 import Control.Logger.Simple
+import Control.Monad
 import Control.Monad.Except
 import Control.Monad.IO.Unlift
 import Control.Monad.Trans.Except
-import Data.Bifunctor (first, bimap)
+import Data.Bifunctor (bimap, first)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Either (partitionEithers)
@@ -35,11 +36,11 @@ import Simplex.Messaging.Agent.RetryInterval
 import Simplex.Messaging.Client
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Protocol (BrokerMsg, ProtocolServer (..), QueueId, SMPServer, NtfPrivateSignKey, NotifierId, RcvPrivateSignKey, RecipientId)
+import Simplex.Messaging.Protocol (BrokerMsg, NotifierId, NtfPrivateSignKey, ProtocolServer (..), QueueId, RcvPrivateSignKey, RecipientId, SMPServer)
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport
-import Simplex.Messaging.Util (catchAll_, tryE, ($>>=))
+import Simplex.Messaging.Util (catchAll_, toChunks, ($>>=))
 import System.Timeout (timeout)
 import UnliftIO (async)
 import UnliftIO.Exception (Exception)
@@ -66,7 +67,8 @@ data SMPClientAgentConfig = SMPClientAgentConfig
  { smpCfg :: ProtocolClientConfig,
    reconnectInterval :: RetryInterval,
    msgQSize :: Natural,
-    agentQSize :: Natural
+    agentQSize :: Natural,
+    agentSubsBatchSize :: Int
  }

 defaultSMPClientAgentConfig :: SMPClientAgentConfig
@@ -79,8 +81,9 @@ defaultSMPClientAgentConfig =
            increaseAfter = 10 * second,
            maxInterval = 10 * second
          },
-      msgQSize = 64,
-      agentQSize = 64
+      msgQSize = 256,
+      agentQSize = 256,
+      agentSubsBatchSize = 900
    }
  where
    second = 1000000
@@ -222,9 +225,9 @@ getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ} srv =
          SPRecipient -> False

        subscribe_ :: SMPClient -> SMPSubParty -> [(SMPSub, C.APrivateSignKey)] -> ExceptT SMPClientError IO ()
-        subscribe_ smp party subs =
-          case L.nonEmpty subs of
-            Just subs' -> do
+        subscribe_ smp party = mapM_ subscribeBatch . toChunks (agentSubsBatchSize agentCfg)
+          where
+            subscribeBatch subs' = do
              let subs'' :: (NonEmpty (QueueId, C.APrivateSignKey)) = L.map (first snd) subs'
              rs <- liftIO $ smpSubscribeQueues party ca smp srv subs''
              let rs' :: (NonEmpty ((SMPSub, C.APrivateSignKey), Either SMPClientError ())) =
@@ -235,10 +238,9 @@ getSMPServerClient' ca@SMPClientAgent {agentCfg, smpClients, msgQ} srv =
                  (tempErrs, finalErrs) = partition (temporaryClientError . snd) errs
              mapM_ (atomically . addSubscription ca srv) oks
              mapM_ (liftIO . notify . CAResubscribed srv) $ L.nonEmpty $ map fst oks
-              mapM_ (atomically . removePendingSubscription ca srv . fst) finalErrs 
+              mapM_ (atomically . removePendingSubscription ca srv . fst) finalErrs
              mapM_ (liftIO . notify . CASubError srv) $ L.nonEmpty finalErrs
              mapM_ (throwE . snd) $ listToMaybe tempErrs
-            Nothing -> pure ()

    notify :: SMPClientAgentEvent -> IO ()
    notify evt = atomically $ writeTBQueue (agentQ ca) evt
@@ -271,15 +273,15 @@ withSMP ca srv action = (getSMPServerClient' ca srv >>= action) `catchE` logSMPE
 subscribeQueue :: SMPClientAgent -> SMPServer -> (SMPSub, C.APrivateSignKey) -> ExceptT SMPClientError IO ()
 subscribeQueue ca srv sub = do
  atomically $ addPendingSubscription ca srv sub
-  withSMP ca srv $ \smp -> subscribe_ smp `catchE` handleError
+  withSMP ca srv $ \smp -> subscribe_ smp `catchE` handleErr
  where
    subscribe_ smp = do
      smpSubscribe smp sub
      atomically $ addSubscription ca srv sub

-    handleError e = do
+    handleErr e = do
      atomically . when (e /= PCENetworkError && e /= PCEResponseTimeout) $
-        removePendingSubscription ca srv $ fst sub
+        removePendingSubscription ca srv (fst sub)
      throwE e

 subscribeQueuesSMP :: SMPClientAgent -> SMPServer -> NonEmpty (RecipientId, RcvPrivateSignKey) -> IO (NonEmpty (RecipientId, Either SMPClientError ()))
@@ -298,14 +300,15 @@ subscribeQueues_ party ca srv subs = do
 smpSubscribeQueues :: SMPSubParty -> SMPClientAgent -> SMPClient -> SMPServer -> NonEmpty (QueueId, C.APrivateSignKey) -> IO (NonEmpty (QueueId, Either SMPClientError ()))
 smpSubscribeQueues party ca smp srv subs = do
  rs <- L.zip subs <$> subscribe smp (L.map swap subs)
-  atomically $ forM rs $ \(sub, r) -> (fst sub,) <$> case r of
-    Right () -> do
-      addSubscription ca srv $ first (party,) sub
-      pure $ Right ()
-    Left e -> do
-      when (e /= PCENetworkError && e /= PCEResponseTimeout) $
-        removePendingSubscription ca srv $ (party,) $ fst sub
-      pure $ Left e
+  atomically $ forM rs $ \(sub, r) ->
+    (fst sub,) <$> case r of
+      Right () -> do
+        addSubscription ca srv $ first (party,) sub
+        pure $ Right ()
+      Left e -> do
+        when (e /= PCENetworkError && e /= PCEResponseTimeout) $
+          removePendingSubscription ca srv (party, fst sub)
+        pure $ Left e
  where
    subscribe = case party of
      SPRecipient -> subscribeSMPQueues
@@ -3,6 +3,7 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DuplicateRecordFields #-}
+{-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE FlexibleInstances #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
@@ -40,6 +41,8 @@ module Simplex.Messaging.Crypto
    DhAlgorithm,
    PrivateKey (..),
    PublicKey (..),
+    PrivateKeyEd25519,
+    PublicKeyEd25519,
    PrivateKeyX25519,
    PublicKeyX25519,
    PrivateKeyX448,
@@ -58,12 +61,15 @@ module Simplex.Messaging.Crypto
    DhSecretX25519,
    ADhSecret (..),
    KeyHash (..),
+    newRandom,
+    generateAKeyPair,
    generateKeyPair,
-    generateKeyPair',
    generateSignatureKeyPair,
    generateDhKeyPair,
    privateToX509,
    publicKey,
+    signatureKeyPair,
+    publicToX509,

    -- * key encoding/decoding
    encodePubKey,
@@ -80,6 +86,7 @@ module Simplex.Messaging.Crypto
    SignatureAlgorithm,
    AlgorithmI (..),
    sign,
+    sign',
    verify,
    verify',
    validSignatureSize,
@@ -99,7 +106,6 @@ module Simplex.Messaging.Crypto
    decryptAESNoPad,
    authTagSize,
    randomAesKey,
-    randomIV,
    randomGCMIV,
    ivSize,
    gcmIVSize,
@@ -111,9 +117,10 @@ module Simplex.Messaging.Crypto
    cbEncrypt,
    cbEncryptMaxLenBS,
    cbDecrypt,
+    sbDecrypt_,
+    sbEncrypt_,
    cbNonce,
    randomCbNonce,
-    pseudoRandomCbNonce,

    -- * NaCl crypto_secretbox
    SbKey (unSbKey),
@@ -125,7 +132,7 @@ module Simplex.Messaging.Crypto
    randomSbKey,

    -- * pseudo-random bytes
-    pseudoRandomBytes,
+    randomBytes,

    -- * digests
    sha256Hash,
@@ -135,6 +142,16 @@ module Simplex.Messaging.Crypto
    pad,
    unPad,

+    -- * X509 Certificates
+    SignedCertificate,
+    Certificate,
+    signCertificate,
+    signX509,
+    certificateFingerprint,
+    signedFingerprint,
+    SignatureAlgorithmX509 (..),
+    SignedObject (..),
+
    -- * Cryptography error type
    CryptoError (..),

@@ -149,19 +166,20 @@ where

 import Control.Concurrent.STM
 import Control.Exception (Exception)
+import Control.Monad
 import Control.Monad.Except
 import Control.Monad.Trans.Except
 import Crypto.Cipher.AES (AES256)
 import qualified Crypto.Cipher.Types as AES
 import qualified Crypto.Cipher.XSalsa as XSalsa
 import qualified Crypto.Error as CE
-import Crypto.Hash (Digest, SHA256, SHA512, hash)
+import Crypto.Hash (Digest, SHA256 (..), SHA512, hash)
 import qualified Crypto.MAC.Poly1305 as Poly1305
 import qualified Crypto.PubKey.Curve25519 as X25519
 import qualified Crypto.PubKey.Curve448 as X448
 import qualified Crypto.PubKey.Ed25519 as Ed25519
 import qualified Crypto.PubKey.Ed448 as Ed448
-import Crypto.Random (ChaChaDRG, getRandomBytes, randomBytesGenerate)
+import Crypto.Random (ChaChaDRG, MonadPseudoRandom, drgNew, randomBytesGenerate, withDRG)
 import Data.ASN1.BinaryEncoding
 import Data.ASN1.Encoding
 import Data.ASN1.Types
@@ -182,6 +200,7 @@ import Data.Type.Equality
 import Data.Typeable (Proxy (Proxy), Typeable)
 import Data.Word (Word32)
 import Data.X509
+import Data.X509.Validation (Fingerprint (..), getFingerprint)
 import Database.SQLite.Simple.FromField (FromField (..))
 import Database.SQLite.Simple.ToField (ToField (..))
 import GHC.TypeLits (ErrorMessage (..), KnownNat, Nat, TypeError, natVal, type (+))
@@ -262,6 +281,8 @@ instance Eq APublicKey where

 deriving instance Show APublicKey

+type PublicKeyEd25519 = PublicKey Ed25519
+
 type PublicKeyX25519 = PublicKey X25519

 type PublicKeyX448 = PublicKey X448
@@ -277,6 +298,10 @@ deriving instance Eq (PrivateKey a)

 deriving instance Show (PrivateKey a)

+-- Do not enable, to avoid leaking key data
+-- instance StrEncoding (PrivateKey Ed25519) where
+
+-- Used in notification store log
 instance StrEncoding (PrivateKey X25519) where
  strEncode = strEncode . encodePrivKey
  {-# INLINE strEncode #-}
@@ -295,6 +320,8 @@ instance Eq APrivateKey where

 deriving instance Show APrivateKey

+type PrivateKeyEd25519 = PrivateKey Ed25519
+
 type PrivateKeyX25519 = PrivateKey X25519

 type PrivateKeyX448 = PrivateKey X448
@@ -537,6 +564,10 @@ publicKey = \case
  PrivateKeyX25519 _ k -> PublicKeyX25519 k
  PrivateKeyX448 _ k -> PublicKeyX448 k

+-- | Expand signature private key to a key pair.
+signatureKeyPair :: APrivateSignKey -> ASignatureKeyPair
+signatureKeyPair ak@(APrivateSignKey a k) = (APublicVerifyKey a (publicKey k), ak)
+
 encodePrivKey :: CryptoPrivateKey pk => pk -> ByteString
 encodePrivKey = toPrivKey $ encodeASNObj . privateToX509

@@ -563,17 +594,23 @@ type ASignatureKeyPair = KeyPairType APrivateSignKey

 type ADhKeyPair = KeyPairType APrivateDhKey

-generateKeyPair :: AlgorithmI a => SAlgorithm a -> IO AKeyPair
-generateKeyPair a = bimap (APublicKey a) (APrivateKey a) <$> generateKeyPair'
+newRandom :: IO (TVar ChaChaDRG)
+newRandom = newTVarIO =<< drgNew

-generateSignatureKeyPair :: (AlgorithmI a, SignatureAlgorithm a) => SAlgorithm a -> IO ASignatureKeyPair
-generateSignatureKeyPair a = bimap (APublicVerifyKey a) (APrivateSignKey a) <$> generateKeyPair'
+generateAKeyPair :: AlgorithmI a => SAlgorithm a -> TVar ChaChaDRG -> STM AKeyPair
+generateAKeyPair a g = bimap (APublicKey a) (APrivateKey a) <$> generateKeyPair g

-generateDhKeyPair :: (AlgorithmI a, DhAlgorithm a) => SAlgorithm a -> IO ADhKeyPair
-generateDhKeyPair a = bimap (APublicDhKey a) (APrivateDhKey a) <$> generateKeyPair'
+generateSignatureKeyPair :: (AlgorithmI a, SignatureAlgorithm a) => SAlgorithm a -> TVar ChaChaDRG -> STM ASignatureKeyPair
+generateSignatureKeyPair a g = bimap (APublicVerifyKey a) (APrivateSignKey a) <$> generateKeyPair g

-generateKeyPair' :: forall a. AlgorithmI a => IO (KeyPair a)
-generateKeyPair' = case sAlgorithm @a of
+generateDhKeyPair :: (AlgorithmI a, DhAlgorithm a) => SAlgorithm a -> TVar ChaChaDRG -> STM ADhKeyPair
+generateDhKeyPair a g = bimap (APublicDhKey a) (APrivateDhKey a) <$> generateKeyPair g
+
+generateKeyPair :: forall a. AlgorithmI a => TVar ChaChaDRG -> STM (KeyPair a)
+generateKeyPair g = stateTVar g (`withDRG` generateKeyPair_)
+
+generateKeyPair_ :: forall a. AlgorithmI a => MonadPseudoRandom ChaChaDRG (KeyPair a)
+generateKeyPair_ = case sAlgorithm @a of
  SEd25519 ->
    Ed25519.generateSecretKey >>= \pk ->
      let k = Ed25519.toPublic pk
@@ -648,13 +685,17 @@ class CryptoSignature s where
  signatureBytes :: s -> ByteString
  decodeSignature :: ByteString -> Either String s

+instance CryptoSignature (Signature s) => StrEncoding (Signature s) where
+  strEncode = serializeSignature
+  strDecode = decodeSignature
+
 instance CryptoSignature ASignature where
  signatureBytes (ASignature _ sig) = signatureBytes sig
  decodeSignature s
    | B.length s == Ed25519.signatureSize =
-      ASignature SEd25519 . SignatureEd25519 <$> ed Ed25519.signature s
+        ASignature SEd25519 . SignatureEd25519 <$> ed Ed25519.signature s
    | B.length s == Ed448.signatureSize =
-      ASignature SEd448 . SignatureEd448 <$> ed Ed448.signature s
+        ASignature SEd448 . SignatureEd448 <$> ed Ed448.signature s
    | otherwise = Left "bad signature size"
    where
      ed alg = first show . CE.eitherCryptoError . alg
@@ -803,6 +844,13 @@ instance StrEncoding KeyHash where
  strEncode = strEncode . unKeyHash
  strP = KeyHash <$> strP

+instance ToJSON KeyHash where
+  toEncoding = strToJEncoding
+  toJSON = strToJSON
+
+instance FromJSON KeyHash where
+  parseJSON = strParseJSON "KeyHash"
+
 instance IsString KeyHash where
  fromString = parseString $ parseAll strP

@@ -931,15 +979,11 @@ initAEADGCM (Key aesKey) (GCMIV ivBytes) = cryptoFailable $ do
  AES.aeadInit AES.AEAD_GCM cipher ivBytes

 -- | Random AES256 key.
-randomAesKey :: IO Key
-randomAesKey = Key <$> getRandomBytes aesKeySize
+randomAesKey :: TVar ChaChaDRG -> STM Key
+randomAesKey = fmap Key . randomBytes aesKeySize

-- | Random IV bytes for AES256 encryption.
-randomIV :: IO IV
-randomIV = IV <$> getRandomBytes (ivSize @AES256)
-
-randomGCMIV :: IO GCMIV
-randomGCMIV = GCMIV <$> getRandomBytes gcmIVSize
+randomGCMIV :: TVar ChaChaDRG -> STM GCMIV
+randomGCMIV = fmap GCMIV . randomBytes gcmIVSize

 ivSize :: forall c. AES.BlockCipher c => Int
 ivSize = AES.blockSize (undefined :: c)
@@ -966,6 +1010,53 @@ sign' (PrivateKeyEd448 pk k) msg = SignatureEd448 $ Ed448.sign pk k msg
 sign :: APrivateSignKey -> ByteString -> ASignature
 sign (APrivateSignKey a k) = ASignature a . sign' k

+signCertificate :: APrivateSignKey -> Certificate -> SignedCertificate
+signCertificate = signX509
+
+signX509 :: (ASN1Object o, Eq o, Show o) => APrivateSignKey -> o -> SignedExact o
+signX509 key = fst . objectToSignedExact f
+  where
+    f bytes =
+      ( signatureBytes $ sign key bytes,
+        signatureAlgorithmX509 key,
+        ()
+      )
+
+certificateFingerprint :: SignedCertificate -> KeyHash
+certificateFingerprint = signedFingerprint
+
+signedFingerprint :: (ASN1Object o, Eq o, Show o) => SignedExact o -> KeyHash
+signedFingerprint o = KeyHash fp
+  where
+    Fingerprint fp = getFingerprint o HashSHA256
+
+class SignatureAlgorithmX509 a where
+  signatureAlgorithmX509 :: a -> SignatureALG
+
+instance SignatureAlgorithm a => SignatureAlgorithmX509 (SAlgorithm a) where
+  signatureAlgorithmX509 = \case
+    SEd25519 -> SignatureALG_IntrinsicHash PubKeyALG_Ed25519
+    SEd448 -> SignatureALG_IntrinsicHash PubKeyALG_Ed448
+
+instance SignatureAlgorithmX509 APrivateSignKey where
+  signatureAlgorithmX509 (APrivateSignKey a _) = signatureAlgorithmX509 a
+
+instance SignatureAlgorithmX509 APublicVerifyKey where
+  signatureAlgorithmX509 (APublicVerifyKey a _) = signatureAlgorithmX509 a
+
+-- | An instance for 'ASignatureKeyPair' / ('PublicKeyType' pk, pk), without touching its type family.
+instance SignatureAlgorithmX509 pk => SignatureAlgorithmX509 (a, pk) where
+  signatureAlgorithmX509 = signatureAlgorithmX509 . snd
+
+-- | A wrapper to marshall signed ASN1 objects, like certificates.
+newtype SignedObject a = SignedObject (SignedExact a)
+
+instance (Typeable a, Eq a, Show a, ASN1Object a) => FromField (SignedObject a) where
+  fromField = fmap SignedObject . blobFieldDecoder decodeSignedObject
+
+instance (Eq a, Show a, ASN1Object a) => ToField (SignedObject a) where
+  toField (SignedObject s) = toField $ encodeSignedObject s
+
 -- | Signature verification.
 --
 -- Used by SMP servers to authorize SMP commands and by SMP agents to verify messages.
@@ -1053,14 +1144,11 @@ cbNonce s
  where
    len = B.length s

-randomCbNonce :: IO CbNonce
-randomCbNonce = CryptoBoxNonce <$> getRandomBytes 24
+randomCbNonce :: TVar ChaChaDRG -> STM CbNonce
+randomCbNonce = fmap CryptoBoxNonce . randomBytes 24

-pseudoRandomCbNonce :: TVar ChaChaDRG -> STM CbNonce
-pseudoRandomCbNonce gVar = CryptoBoxNonce <$> pseudoRandomBytes 24 gVar
-
-pseudoRandomBytes :: Int -> TVar ChaChaDRG -> STM ByteString
-pseudoRandomBytes n gVar = stateTVar gVar $ randomBytesGenerate n
+randomBytes :: Int -> TVar ChaChaDRG -> STM ByteString
+randomBytes n gVar = stateTVar gVar $ randomBytesGenerate n

 instance Encoding CbNonce where
  smpEncode = unCbNonce
@@ -1097,8 +1185,8 @@ sbKey s
 unsafeSbKey :: ByteString -> SbKey
 unsafeSbKey s = either error id $ sbKey s

-randomSbKey :: IO SbKey
-randomSbKey = SecretBoxKey <$> getRandomBytes 32
+randomSbKey :: TVar ChaChaDRG -> STM SbKey
+randomSbKey gVar = SecretBoxKey <$> randomBytes 32 gVar

 xSalsa20 :: ByteArrayAccess key => key -> ByteString -> ByteString -> (ByteString, ByteString)
 xSalsa20 secret nonce msg = (rs, msg')
@@ -0,0 +1,123 @@
+{-# LANGUAGE DeriveAnyClass #-}
+{-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TemplateHaskell #-}
+
+module Simplex.Messaging.Crypto.File
+  ( CryptoFile (..),
+    CryptoFileArgs (..),
+    CryptoFileHandle (..),
+    FTCryptoError (..),
+    Simplex.Messaging.Crypto.File.readFile,
+    Simplex.Messaging.Crypto.File.writeFile,
+    withFile,
+    hPut,
+    hPutTag,
+    hGet,
+    hGetTag,
+    plain,
+    randomArgs,
+    getFileContentsSize,
+  )
+where
+
+import Control.Exception
+import Control.Monad
+import Control.Monad.Except
+import Crypto.Random (ChaChaDRG)
+import qualified Data.Aeson.TH as J
+import qualified Data.ByteArray as BA
+import Data.ByteString.Char8 (ByteString)
+import qualified Data.ByteString.Char8 as B
+import qualified Data.ByteString.Lazy as LB
+import Data.List.NonEmpty (NonEmpty (..))
+import Data.Maybe (isJust)
+import Simplex.Messaging.Client.Agent ()
+import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.Lazy (LazyByteString)
+import qualified Simplex.Messaging.Crypto.Lazy as LC
+import Simplex.Messaging.Parsers (defaultJSON)
+import Simplex.Messaging.Util (liftEitherWith)
+import System.Directory (getFileSize)
+import UnliftIO (Handle, IOMode (..), liftIO)
+import qualified UnliftIO as IO
+import UnliftIO.STM
+
+-- Possibly encrypted local file
+data CryptoFile = CryptoFile {filePath :: FilePath, cryptoArgs :: Maybe CryptoFileArgs}
+  deriving (Eq, Show)
+
+data CryptoFileArgs = CFArgs {fileKey :: C.SbKey, fileNonce :: C.CbNonce}
+  deriving (Eq, Show)
+
+data CryptoFileHandle = CFHandle Handle (Maybe (TVar LC.SbState))
+
+readFile :: CryptoFile -> ExceptT FTCryptoError IO LazyByteString
+readFile (CryptoFile path cfArgs) = do
+  s <- liftIO $ LB.readFile path
+  case cfArgs of
+    Just (CFArgs (C.SbKey key) (C.CbNonce nonce)) -> do
+      let len = LB.length s - fromIntegral C.authTagSize
+      when (len < 0) $ throwError FTCEInvalidFileSize
+      let (s', tag') = LB.splitAt len s
+      (tag :| cs) <- liftEitherWith FTCECryptoError $ LC.secretBox LC.sbDecryptChunk key nonce s'
+      unless (BA.constEq (LB.toStrict tag') tag) $ throwError FTCEInvalidAuthTag
+      pure $ LB.fromChunks cs
+    Nothing -> pure s
+
+writeFile :: CryptoFile -> LazyByteString -> ExceptT FTCryptoError IO ()
+writeFile (CryptoFile path cfArgs) s = do
+  s' <- case cfArgs of
+    Just (CFArgs (C.SbKey key) (C.CbNonce nonce)) ->
+      liftEitherWith FTCECryptoError $ LB.fromChunks <$> LC.secretBoxTailTag LC.sbEncryptChunk key nonce s
+    Nothing -> pure s
+  liftIO $ LB.writeFile path s'
+
+withFile :: CryptoFile -> IOMode -> (CryptoFileHandle -> ExceptT FTCryptoError IO a) -> ExceptT FTCryptoError IO a
+withFile (CryptoFile path cfArgs) mode action = do
+  sb <- forM cfArgs $ \(CFArgs key nonce) ->
+    liftEitherWith FTCECryptoError (LC.sbInit key nonce) >>= newTVarIO
+  IO.withFile path mode $ \h -> action $ CFHandle h sb
+
+hPut :: CryptoFileHandle -> LazyByteString -> IO ()
+hPut (CFHandle h sb_) s = LB.hPut h =<< maybe (pure s) encrypt sb_
+  where
+    encrypt sb = atomically $ stateTVar sb (`LC.sbEncryptChunkLazy` s)
+
+hPutTag :: CryptoFileHandle -> IO ()
+hPutTag (CFHandle h sb_) = forM_ sb_ $ B.hPut h . BA.convert . LC.sbAuth <=< readTVarIO
+
+hGet :: CryptoFileHandle -> Int -> IO ByteString
+hGet (CFHandle h sb_) n = B.hGet h n >>= maybe pure decrypt sb_
+  where
+    decrypt sb s = atomically $ stateTVar sb (`LC.sbDecryptChunk` s)
+
+-- | Read and validate the auth tag.
+-- This function should be called after reading the whole file, it assumes you know the file size and read only the needed bytes.
+hGetTag :: CryptoFileHandle -> ExceptT FTCryptoError IO ()
+hGetTag (CFHandle h sb_) = forM_ sb_ $ \sb -> do
+  tag <- liftIO $ B.hGet h C.authTagSize
+  tag' <- LC.sbAuth <$> readTVarIO sb
+  unless (BA.constEq tag tag') $ throwError FTCEInvalidAuthTag
+
+data FTCryptoError
+  = FTCECryptoError C.CryptoError
+  | FTCEInvalidHeader String
+  | FTCEInvalidFileSize
+  | FTCEInvalidAuthTag
+  | FTCEFileIOError String
+  deriving (Show, Eq, Exception)
+
+plain :: FilePath -> CryptoFile
+plain = (`CryptoFile` Nothing)
+
+randomArgs :: TVar ChaChaDRG -> STM CryptoFileArgs
+randomArgs g = CFArgs <$> C.randomSbKey g <*> C.randomCbNonce g
+
+getFileContentsSize :: CryptoFile -> IO Integer
+getFileContentsSize (CryptoFile path cfArgs) = do
+  size <- getFileSize path
+  pure $ if isJust cfArgs then size - fromIntegral C.authTagSize else size
+
+$(J.deriveJSON defaultJSON ''CryptoFileArgs)
+
+$(J.deriveJSON defaultJSON ''CryptoFile)
@@ -1,7 +1,6 @@
 {-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE PatternSynonyms #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE TupleSections #-}
@@ -15,11 +14,16 @@ module Simplex.Messaging.Crypto.Lazy
    sbEncrypt,
    sbDecrypt,
    sbEncryptTailTag,
+    kcbEncryptTailTag,
    sbDecryptTailTag,
+    kcbDecryptTailTag,
    fastReplicate,
+    secretBox,
+    secretBoxTailTag,
    SbState,
    cbInit,
    sbInit,
+    kcbInit,
    sbEncryptChunk,
    sbDecryptChunk,
    sbEncryptChunkLazy,
@@ -37,7 +41,6 @@ import qualified Crypto.MAC.Poly1305 as Poly1305
 import Data.Bifunctor (first)
 import Data.ByteArray (ByteArrayAccess)
 import qualified Data.ByteArray as BA
-import qualified Data.ByteString as S
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy.Char8 as LB
@@ -47,6 +50,7 @@ import Data.Int (Int64)
 import Data.List.NonEmpty (NonEmpty (..))
 import Foreign (sizeOf)
 import Simplex.Messaging.Crypto (CbNonce, CryptoError (..), DhSecret (..), DhSecretX25519, SbKey, pattern CbNonce, pattern SbKey)
+import Simplex.Messaging.Crypto.SNTRUP761 (KEMHybridSecret (..))
 import Simplex.Messaging.Encoding

 type LazyByteString = LB.ByteString
@@ -88,10 +92,10 @@ unPad = fmap snd . splitLen
 splitLen :: LazyByteString -> Either CryptoError (Int64, LazyByteString)
 splitLen padded
  | LB.length lenStr == 8 = case smpDecode $ LB.toStrict lenStr of
-    Right len
-      | len < 0 -> Left CryptoInvalidMsgError
-      | otherwise -> Right (len, LB.take len rest)
-    Left _ -> Left CryptoInvalidMsgError
+      Right len
+        | len < 0 -> Left CryptoInvalidMsgError
+        | otherwise -> Right (len, LB.take len rest)
+      Left _ -> Left CryptoInvalidMsgError
  | otherwise = Left CryptoInvalidMsgError
  where
    (lenStr, rest) = LB.splitAt 8 padded
@@ -110,10 +114,10 @@ sbDecrypt :: SbKey -> CbNonce -> LazyByteString -> Either CryptoError LazyByteSt
 sbDecrypt (SbKey key) (CbNonce nonce) packet
  | LB.length tag' < 16 = Left CBDecryptError
  | otherwise = case secretBox sbDecryptChunk key nonce c of
-    Right (tag :| cs)
-      | BA.constEq (LB.toStrict tag') tag -> unPad $ LB.fromChunks cs
-      | otherwise -> Left CBDecryptError
-    Left e -> Left e
+      Right (tag :| cs)
+        | BA.constEq (LB.toStrict tag') tag -> unPad $ LB.fromChunks cs
+        | otherwise -> Left CBDecryptError
+      Left e -> Left e
  where
    (tag', c) = LB.splitAt 16 packet

@@ -126,13 +130,33 @@ secretBox sbProcess secret nonce msg = run <$> sbInit_ secret nonce

 -- | NaCl @secret_box@ lazy encrypt with a symmetric 256-bit key and 192-bit nonce with appended auth tag (more efficient with large files).
 sbEncryptTailTag :: SbKey -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
-sbEncryptTailTag (SbKey key) (CbNonce nonce) msg len paddedLen =
+sbEncryptTailTag (SbKey key) = sbEncryptTailTag_ key
+{-# INLINE sbEncryptTailTag #-}
+
+-- | NaCl @crypto_box@ lazy encrypt with with a shared hybrid KEM+DH 256-bit secret and 192-bit nonce with appended auth tag (more efficient with large strings/files).
+kcbEncryptTailTag :: KEMHybridSecret -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
+kcbEncryptTailTag (KEMHybridSecret key) = sbEncryptTailTag_ key
+{-# INLINE kcbEncryptTailTag #-}
+
+sbEncryptTailTag_ :: ByteArrayAccess key => key -> CbNonce -> LazyByteString -> Int64 -> Int64 -> Either CryptoError LazyByteString
+sbEncryptTailTag_ key (CbNonce nonce) msg len paddedLen =
  LB.fromChunks <$> (secretBoxTailTag sbEncryptChunk key nonce =<< pad msg len paddedLen)

 -- | NaCl @secret_box@ decrypt with a symmetric 256-bit key and 192-bit nonce with appended auth tag (more efficient with large files).
 -- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
 sbDecryptTailTag :: SbKey -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
-sbDecryptTailTag (SbKey key) (CbNonce nonce) paddedLen packet =
+sbDecryptTailTag (SbKey key) = sbDecryptTailTag_ key
+{-# INLINE sbDecryptTailTag #-}
+
+-- | NaCl @crypto_box@ lazy decrypt with a shared hybrid KEM+DH 256-bit secret and 192-bit nonce with appended auth tag (more efficient with large strings/files).
+-- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
+kcbDecryptTailTag :: KEMHybridSecret -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
+kcbDecryptTailTag (KEMHybridSecret key) = sbDecryptTailTag_ key
+{-# INLINE kcbDecryptTailTag #-}
+
+-- paddedLen should NOT include the tag length, it should be the same number that is passed to sbEncrypt / sbEncryptTailTag.
+sbDecryptTailTag_ :: ByteArrayAccess key => key -> CbNonce -> Int64 -> LazyByteString -> Either CryptoError (Bool, LazyByteString)
+sbDecryptTailTag_ key (CbNonce nonce) paddedLen packet =
  case secretBox sbDecryptChunk key nonce c of
    Right (tag :| cs) ->
      let valid = LB.length tag' == 16 && BA.constEq (LB.toStrict tag') tag
@@ -150,7 +174,7 @@ secretBoxTailTag sbProcess secret nonce msg = run <$> sbInit_ secret nonce

 -- passes lazy bytestring via initialized secret box returning the reversed list of chunks
 secretBoxLazy_ :: (SbState -> ByteString -> (ByteString, SbState)) -> SbState -> LazyByteString -> ([ByteString], SbState)
-secretBoxLazy_ sbProcess state = foldlChunks update ([], state)
+secretBoxLazy_ sbProcess state = LB.foldlChunks update ([], state)
  where
    update (cs, st) chunk = let (!c, !st') = sbProcess st chunk in (c : cs, st')

@@ -164,6 +188,10 @@ sbInit :: SbKey -> CbNonce -> Either CryptoError SbState
 sbInit (SbKey secret) (CbNonce nonce) = sbInit_ secret nonce
 {-# INLINE sbInit #-}

+kcbInit :: KEMHybridSecret -> CbNonce -> Either CryptoError SbState
+kcbInit (KEMHybridSecret k) (CbNonce nonce) = sbInit_ k nonce
+{-# INLINE kcbInit #-}
+
 sbInit_ :: ByteArrayAccess key => key -> ByteString -> Either CryptoError SbState
 sbInit_ secret nonce = (state2,) <$> cryptoPassed (Poly1305.initialize rs)
  where
@@ -202,10 +230,3 @@ cryptoPassed :: CE.CryptoFailable b -> Either CryptoError b
 cryptoPassed = \case
  CE.CryptoPassed a -> Right a
  CE.CryptoFailed e -> Left $ CryptoPoly1305Error e
-
-foldlChunks :: (a -> S.ByteString -> a) -> a -> LazyByteString -> a
-foldlChunks f = go
-  where
-    go !a LB.Empty = a
-    go !a (LB.Chunk c cs) = go (f a c) cs
-{-# INLINE foldlChunks #-}
@@ -1,12 +1,12 @@
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
 {-# LANGUAGE TypeFamilies #-}
@@ -19,8 +19,10 @@ import Control.Monad.Trans.Except
 import Crypto.Cipher.AES (AES256)
 import Crypto.Hash (SHA512)
 import qualified Crypto.KDF.HKDF as H
-import Data.Aeson (FromJSON, ToJSON)
+import Crypto.Random (ChaChaDRG)
+import Data.Aeson (FromJSON (..), ToJSON (..))
 import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as JQ
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import qualified Data.ByteString.Lazy as LB
@@ -32,14 +34,13 @@ import Data.Typeable (Typeable)
 import Data.Word (Word32)
 import Database.SQLite.Simple.FromField (FromField (..))
 import Database.SQLite.Simple.ToField (ToField (..))
-import GHC.Generics
 import Simplex.Messaging.Agent.QueryString
 import Simplex.Messaging.Crypto
 import Simplex.Messaging.Encoding
 import Simplex.Messaging.Encoding.String
-import Simplex.Messaging.Parsers (blobFieldDecoder, parseE, parseE')
-import Simplex.Messaging.Util (tryE)
+import Simplex.Messaging.Parsers (blobFieldDecoder, defaultJSON, parseE, parseE')
 import Simplex.Messaging.Version
+import UnliftIO.STM

 currentE2EEncryptVersion :: Version
 currentE2EEncryptVersion = 2
@@ -81,10 +82,10 @@ instance AlgorithmI a => StrEncoding (E2ERatchetParamsUri a) where
      [key1, key2] -> pure $ E2ERatchetParamsUri vs key1 key2
      _ -> fail "bad e2e params"

-generateE2EParams :: (AlgorithmI a, DhAlgorithm a) => Version -> IO (PrivateKey a, PrivateKey a, E2ERatchetParams a)
-generateE2EParams v = do
-  (k1, pk1) <- generateKeyPair'
-  (k2, pk2) <- generateKeyPair'
+generateE2EParams :: (AlgorithmI a, DhAlgorithm a) => TVar ChaChaDRG -> Version -> STM (PrivateKey a, PrivateKey a, E2ERatchetParams a)
+generateE2EParams g v = do
+  (k1, pk1) <- generateKeyPair g
+  (k2, pk2) <- generateKeyPair g
  pure (pk1, pk2, E2ERatchetParams v k1 k2)

 data RatchetInitParams = RatchetInitParams
@@ -112,11 +113,11 @@ x3dh v (sk1, rk1) dh1 dh2 dh3 =
    (hk, nhk, sk)
      -- for backwards compatibility with clients using agent version before 3.4.0
      | v == 1 =
-        let (hk', rest) = B.splitAt 32 dhs
-         in uncurry (hk',,) $ B.splitAt 32 rest
+          let (hk', rest) = B.splitAt 32 dhs
+           in uncurry (hk',,) $ B.splitAt 32 rest
      | otherwise =
-        let salt = B.replicate 64 '\0'
-         in hkdf3 salt dhs "SimpleXX3DH"
+          let salt = B.replicate 64 '\0'
+           in hkdf3 salt dhs "SimpleXX3DH"

 type RatchetX448 = Ratchet 'X448

@@ -135,29 +136,20 @@ data Ratchet a = Ratchet
    rcNHKs :: HeaderKey,
    rcNHKr :: HeaderKey
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance AlgorithmI a => ToJSON (Ratchet a) where
-  toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 data SndRatchet a = SndRatchet
  { rcDHRr :: PublicKey a,
    rcCKs :: RatchetKey,
    rcHKs :: HeaderKey
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance AlgorithmI a => ToJSON (SndRatchet a) where
-  toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 data RcvRatchet = RcvRatchet
  { rcCKr :: RatchetKey,
    rcHKr :: HeaderKey
  }
-  deriving (Eq, Show, Generic, FromJSON)
-
-instance ToJSON RcvRatchet where
-  toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 type SkippedMsgKeys = Map HeaderKey SkippedHdrMsgKeys

@@ -204,10 +196,6 @@ instance ToJSON RatchetKey where
 instance FromJSON RatchetKey where
  parseJSON = fmap RatchetKey . strParseJSON "Key"

-instance AlgorithmI a => ToField (Ratchet a) where toField = toField . LB.toStrict . J.encode
-
-instance (AlgorithmI a, Typeable a) => FromField (Ratchet a) where fromField = blobFieldDecoder J.eitherDecodeStrict'
-
 instance ToField MessageKey where toField = toField . smpEncode

 instance FromField MessageKey where fromField = blobFieldDecoder smpDecode
@@ -358,11 +346,12 @@ maxSkip = 512
 rcDecrypt ::
  forall a.
  (AlgorithmI a, DhAlgorithm a) =>
+  TVar ChaChaDRG ->
  Ratchet a ->
  SkippedMsgKeys ->
  ByteString ->
  ExceptT CryptoError IO (DecryptResult a)
-rcDecrypt rc@Ratchet {rcRcv, rcAD = Str rcAD} rcMKSkipped msg' = do
+rcDecrypt g rc@Ratchet {rcRcv, rcAD = Str rcAD} rcMKSkipped msg' = do
  encMsg@EncRatchetMessage {emHeader} <- parseE CryptoHeaderError smpP msg'
  encHdr <- parseE CryptoHeaderError smpP emHeader
  -- plaintext = TrySkippedMessageKeysHE(state, enc_header, cipher-text, AD)
@@ -402,7 +391,7 @@ rcDecrypt rc@Ratchet {rcRcv, rcAD = Str rcAD} rcMKSkipped msg' = do
            Left e -> throwE e
            Right (rc'@Ratchet {rcDHRs, rcRK, rcNHKs, rcNHKr}, hmks) -> do
              -- DHRatchetHE(state, header)
-              (_, rcDHRs') <- liftIO $ generateKeyPair' @a
+              (_, rcDHRs') <- atomically $ generateKeyPair @a g
              -- state.RK, state.CKr, state.NHKr = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr))
              let (rcRK', rcCKr', rcNHKr') = rootKdf rcRK msgDHRs rcDHRs
                  -- state.RK, state.CKs, state.NHKs = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr))
@@ -428,9 +417,9 @@ rcDecrypt rc@Ratchet {rcRcv, rcAD = Str rcAD} rcMKSkipped msg' = do
      | rcNr + maxSkip < untilN = Left $ CERatchetTooManySkipped (untilN + 1 - rcNr)
      | rcNr == untilN = Right (r, M.empty)
      | otherwise =
-        let (rcCKr', rcNr', mks) = advanceRcvRatchet (untilN - rcNr) rcCKr rcNr M.empty
-            r' = r {rcRcv = Just rr {rcCKr = rcCKr'}, rcNr = rcNr'}
-         in Right (r', M.singleton rcHKr mks)
+          let (rcCKr', rcNr', mks) = advanceRcvRatchet (untilN - rcNr) rcCKr rcNr M.empty
+              r' = r {rcRcv = Just rr {rcCKr = rcCKr'}, rcNr = rcNr'}
+           in Right (r', M.singleton rcHKr mks)
    advanceRcvRatchet :: Word32 -> RatchetKey -> Word32 -> SkippedHdrMsgKeys -> (RatchetKey, Word32, SkippedHdrMsgKeys)
    advanceRcvRatchet 0 ck msgNs mks = (ck, msgNs, mks)
    advanceRcvRatchet n ck msgNs mks =
@@ -493,3 +482,23 @@ hkdf3 salt ikm info = (s1, s2, s3)
    out = H.expand prk info 96
    (s1, rest) = B.splitAt 32 out
    (s2, s3) = B.splitAt 32 rest
+
+$(JQ.deriveJSON defaultJSON ''RcvRatchet)
+
+instance AlgorithmI a => ToJSON (SndRatchet a) where
+  toEncoding = $(JQ.mkToEncoding defaultJSON ''SndRatchet)
+  toJSON = $(JQ.mkToJSON defaultJSON ''SndRatchet)
+
+instance AlgorithmI a => FromJSON (SndRatchet a) where
+  parseJSON = $(JQ.mkParseJSON defaultJSON ''SndRatchet)
+
+instance AlgorithmI a => ToJSON (Ratchet a) where
+  toEncoding = $(JQ.mkToEncoding defaultJSON ''Ratchet)
+  toJSON = $(JQ.mkToJSON defaultJSON ''Ratchet)
+
+instance AlgorithmI a => FromJSON (Ratchet a) where
+  parseJSON = $(JQ.mkParseJSON defaultJSON ''Ratchet)
+
+instance AlgorithmI a => ToField (Ratchet a) where toField = toField . LB.toStrict . J.encode
+
+instance (AlgorithmI a, Typeable a) => FromField (Ratchet a) where fromField = blobFieldDecoder J.eitherDecodeStrict'
@@ -0,0 +1,31 @@
+{-# LANGUAGE DataKinds #-}
+{-# LANGUAGE GADTs #-}
+{-# LANGUAGE LambdaCase #-}
+
+module Simplex.Messaging.Crypto.SNTRUP761 where
+
+import Crypto.Hash (Digest, SHA256, hash)
+import Data.ByteArray (ScrubbedBytes)
+import qualified Data.ByteArray as BA
+import Data.ByteString (ByteString)
+import Simplex.Messaging.Crypto
+import qualified Simplex.Messaging.Crypto as C
+import Simplex.Messaging.Crypto.SNTRUP761.Bindings
+
+-- Hybrid shared secret for crypto_box is defined as SHA256(DHSecret || KEMSharedKey),
+-- similar to https://datatracker.ietf.org/doc/draft-josefsson-ntruprime-hybrid/
+
+newtype KEMHybridSecret = KEMHybridSecret ScrubbedBytes
+
+-- | NaCl @crypto_box@ decrypt with a shared hybrid DH + KEM secret and 192-bit nonce.
+kcbDecrypt :: KEMHybridSecret -> CbNonce -> ByteString -> Either CryptoError ByteString
+kcbDecrypt (KEMHybridSecret k) = sbDecrypt_ k
+
+-- | NaCl @crypto_box@ encrypt with a shared hybrid DH + KEM secret and 192-bit nonce.
+kcbEncrypt :: KEMHybridSecret -> CbNonce -> ByteString -> Int -> Either CryptoError ByteString
+kcbEncrypt (KEMHybridSecret k) = sbEncrypt_ k
+
+kemHybridSecret :: PublicKeyX25519 -> PrivateKeyX25519 -> KEMSharedKey -> KEMHybridSecret
+kemHybridSecret k pk (KEMSharedKey kem) =
+  let DhSecretX25519 dh = C.dh' k pk
+   in KEMHybridSecret $ BA.convert (hash $ BA.convert dh <> kem :: Digest SHA256)
@@ -0,0 +1,82 @@
+{-# LANGUAGE TypeApplications #-}
+
+module Simplex.Messaging.Crypto.SNTRUP761.Bindings where
+
+import Control.Concurrent.STM
+import Crypto.Random (ChaChaDRG)
+import Data.Aeson (FromJSON (..), ToJSON (..))
+import Data.Bifunctor (bimap)
+import Data.ByteArray (ScrubbedBytes)
+import qualified Data.ByteArray as BA
+import Data.ByteString (ByteString)
+import Database.SQLite.Simple.FromField
+import Database.SQLite.Simple.ToField
+import Foreign (nullPtr)
+import Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines
+import Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
+import Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG (withDRG)
+import Simplex.Messaging.Encoding
+import Simplex.Messaging.Encoding.String
+
+newtype KEMPublicKey = KEMPublicKey ByteString
+  deriving (Show)
+
+newtype KEMSecretKey = KEMSecretKey ScrubbedBytes
+  deriving (Show)
+
+newtype KEMCiphertext = KEMCiphertext ByteString
+  deriving (Show)
+
+newtype KEMSharedKey = KEMSharedKey ScrubbedBytes
+  deriving (Show)
+
+type KEMKeyPair = (KEMPublicKey, KEMSecretKey)
+
+sntrup761Keypair :: TVar ChaChaDRG -> IO KEMKeyPair
+sntrup761Keypair drg =
+  bimap KEMPublicKey KEMSecretKey
+    <$> BA.allocRet
+      c_SNTRUP761_SECRETKEY_SIZE
+      ( \skPtr ->
+          BA.alloc c_SNTRUP761_PUBLICKEY_SIZE $ \pkPtr ->
+            withDRG drg $ c_sntrup761_keypair pkPtr skPtr nullPtr
+      )
+
+sntrup761Enc :: TVar ChaChaDRG -> KEMPublicKey -> IO (KEMCiphertext, KEMSharedKey)
+sntrup761Enc drg (KEMPublicKey pk) =
+  BA.withByteArray pk $ \pkPtr ->
+    bimap KEMCiphertext KEMSharedKey
+      <$> BA.allocRet
+        c_SNTRUP761_SIZE
+        ( \kPtr ->
+            BA.alloc c_SNTRUP761_CIPHERTEXT_SIZE $ \cPtr ->
+              withDRG drg $ c_sntrup761_enc cPtr kPtr pkPtr nullPtr
+        )
+
+sntrup761Dec :: KEMCiphertext -> KEMSecretKey -> IO KEMSharedKey
+sntrup761Dec (KEMCiphertext c) (KEMSecretKey sk) =
+  BA.withByteArray sk $ \skPtr ->
+    BA.withByteArray c $ \cPtr ->
+      KEMSharedKey
+        <$> BA.alloc c_SNTRUP761_SIZE (\kPtr -> c_sntrup761_dec kPtr cPtr skPtr)
+
+instance StrEncoding KEMPublicKey where
+  strEncode (KEMPublicKey pk) = strEncode (BA.convert pk :: ByteString)
+  strP = KEMPublicKey . BA.convert <$> strP @ByteString
+
+instance Encoding KEMCiphertext where
+  smpEncode (KEMCiphertext c) = smpEncode . Large $ BA.convert c
+  smpP = KEMCiphertext . BA.convert . unLarge <$> smpP
+
+instance ToJSON KEMPublicKey where
+  toJSON = strToJSON
+  toEncoding = strToJEncoding
+
+instance FromJSON KEMPublicKey where
+  parseJSON = strParseJSON "KEMPublicKey"
+
+instance ToField KEMSharedKey where
+  toField (KEMSharedKey k) = toField (BA.convert k :: ByteString)
+
+instance FromField KEMSharedKey where
+  fromField f = KEMSharedKey . BA.convert @ByteString <$> fromField f
@@ -0,0 +1,15 @@
+module Simplex.Messaging.Crypto.SNTRUP761.Bindings.Defines where
+
+#include "sntrup761.h"
+
+c_SNTRUP761_SECRETKEY_SIZE :: Int
+c_SNTRUP761_SECRETKEY_SIZE = #{const SNTRUP761_SECRETKEY_SIZE}
+
+c_SNTRUP761_PUBLICKEY_SIZE :: Int
+c_SNTRUP761_PUBLICKEY_SIZE = #{const SNTRUP761_PUBLICKEY_SIZE}
+
+c_SNTRUP761_CIPHERTEXT_SIZE :: Int
+c_SNTRUP761_CIPHERTEXT_SIZE = #{const SNTRUP761_CIPHERTEXT_SIZE}
+
+c_SNTRUP761_SIZE :: Int
+c_SNTRUP761_SIZE = #{const SNTRUP761_SIZE}
@@ -0,0 +1,23 @@
+{-# LANGUAGE ForeignFunctionInterface #-}
+
+module Simplex.Messaging.Crypto.SNTRUP761.Bindings.FFI
+  ( c_sntrup761_keypair,
+    c_sntrup761_enc,
+    c_sntrup761_dec,
+  ) where
+
+import Foreign
+import Foreign.C
+import Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG (RNGContext, RNGFunc)
+
+-- void sntrup761_keypair (uint8_t *pk, uint8_t *sk, void *random_ctx, sntrup761_random_func *random);
+foreign import ccall "sntrup761_keypair"
+  c_sntrup761_keypair :: Ptr Word8 -> Ptr Word8 -> Ptr RNGContext -> FunPtr RNGFunc -> IO ()
+
+-- void sntrup761_enc (uint8_t *c, uint8_t *k, const uint8_t *pk, void *random_ctx, sntrup761_random_func *random);
+foreign import ccall "sntrup761_enc"
+  c_sntrup761_enc :: Ptr Word8 -> Ptr Word8 -> Ptr Word8 -> Ptr RNGContext -> FunPtr RNGFunc -> IO ()
+
+-- void sntrup761_dec (uint8_t *k, const uint8_t *c, const uint8_t *sk);
+foreign import ccall "sntrup761_dec"
+  c_sntrup761_dec :: Ptr Word8 -> Ptr Word8 -> Ptr Word8 -> IO ()
@@ -0,0 +1,30 @@
+module Simplex.Messaging.Crypto.SNTRUP761.Bindings.RNG
+  ( withDRG,
+    RNGContext,
+    RNGFunc,
+  ) where
+
+import Control.Concurrent.STM
+import Control.Exception (bracket)
+import Crypto.Random (ChaChaDRG)
+import Data.ByteArray (ByteArrayAccess (copyByteArrayToPtr))
+import Foreign
+import Foreign.C
+import qualified Simplex.Messaging.Crypto as C
+
+withDRG :: TVar ChaChaDRG -> (FunPtr RNGFunc -> IO a) -> IO a
+withDRG drg = bracket (createRNGFunc drg) freeHaskellFunPtr
+
+createRNGFunc :: TVar ChaChaDRG -> IO (FunPtr RNGFunc)
+createRNGFunc drg =
+  mkRNGFunc $ \_ctx sz buf -> do
+    bs <- atomically $ C.randomBytes (fromIntegral sz) drg
+    copyByteArrayToPtr bs buf
+
+type RNGContext = ()
+
+-- typedef void random_func (void *ctx, size_t length, uint8_t *dst);
+type RNGFunc = Ptr RNGContext -> CSize -> Ptr Word8 -> IO ()
+
+foreign import ccall "wrapper"
+  mkRNGFunc :: RNGFunc -> IO (FunPtr RNGFunc)
@@ -11,6 +11,7 @@ module Simplex.Messaging.Encoding
  ( Encoding (..),
    Tail (..),
    Large (..),
+    _smpP,
    smpEncodeList,
    smpListP,
    lenEncode,
@@ -109,7 +110,7 @@ lenP = fromIntegral . c2w <$> A.anyChar
 {-# INLINE lenP #-}

 instance Encoding a => Encoding (Maybe a) where
-  smpEncode s = maybe "0" (("1" <>) . smpEncode) s
+  smpEncode = maybe "0" (("1" <>) . smpEncode)
  {-# INLINE smpEncode #-}
  smpP =
    smpP >>= \case
@@ -143,6 +144,9 @@ instance Encoding SystemTime where
  smpP = MkSystemTime <$> smpP <*> pure 0
  {-# INLINE smpP #-}

+_smpP :: Encoding a => Parser a
+_smpP = A.space *> smpP
+
 -- lists encode/parse as a sequence of items prefixed with list length (as 1 byte)
 smpEncodeList :: Encoding a => [a] -> ByteString
 smpEncodeList xs = B.cons (lenEncode $ length xs) . B.concat $ map smpEncode xs
@@ -170,37 +174,37 @@ instance (Encoding a, Encoding b) => Encoding (a, b) where
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c) => Encoding (a, b, c) where
-  smpEncode (a, b, c) = smpEncode a <> smpEncode b <> smpEncode c
+  smpEncode (a, b, c) = B.concat [smpEncode a, smpEncode b, smpEncode c]
  {-# INLINE smpEncode #-}
  smpP = (,,) <$> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c, Encoding d) => Encoding (a, b, c, d) where
-  smpEncode (a, b, c, d) = smpEncode a <> smpEncode b <> smpEncode c <> smpEncode d
+  smpEncode (a, b, c, d) = B.concat [smpEncode a, smpEncode b, smpEncode c, smpEncode d]
  {-# INLINE smpEncode #-}
  smpP = (,,,) <$> smpP <*> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c, Encoding d, Encoding e) => Encoding (a, b, c, d, e) where
-  smpEncode (a, b, c, d, e) = smpEncode a <> smpEncode b <> smpEncode c <> smpEncode d <> smpEncode e
+  smpEncode (a, b, c, d, e) = B.concat [smpEncode a, smpEncode b, smpEncode c, smpEncode d, smpEncode e]
  {-# INLINE smpEncode #-}
  smpP = (,,,,) <$> smpP <*> smpP <*> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c, Encoding d, Encoding e, Encoding f) => Encoding (a, b, c, d, e, f) where
-  smpEncode (a, b, c, d, e, f) = smpEncode a <> smpEncode b <> smpEncode c <> smpEncode d <> smpEncode e <> smpEncode f
+  smpEncode (a, b, c, d, e, f) = B.concat [smpEncode a, smpEncode b, smpEncode c, smpEncode d, smpEncode e, smpEncode f]
  {-# INLINE smpEncode #-}
  smpP = (,,,,,) <$> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c, Encoding d, Encoding e, Encoding f, Encoding g) => Encoding (a, b, c, d, e, f, g) where
-  smpEncode (a, b, c, d, e, f, g) = smpEncode a <> smpEncode b <> smpEncode c <> smpEncode d <> smpEncode e <> smpEncode f <> smpEncode g
+  smpEncode (a, b, c, d, e, f, g) = B.concat [smpEncode a, smpEncode b, smpEncode c, smpEncode d, smpEncode e, smpEncode f, smpEncode g]
  {-# INLINE smpEncode #-}
  smpP = (,,,,,,) <$> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}

 instance (Encoding a, Encoding b, Encoding c, Encoding d, Encoding e, Encoding f, Encoding g, Encoding h) => Encoding (a, b, c, d, e, f, g, h) where
-  smpEncode (a, b, c, d, e, f, g, h) = smpEncode a <> smpEncode b <> smpEncode c <> smpEncode d <> smpEncode e <> smpEncode f <> smpEncode g <> smpEncode h
+  smpEncode (a, b, c, d, e, f, g, h) = B.concat [smpEncode a, smpEncode b, smpEncode c, smpEncode d, smpEncode e, smpEncode f, smpEncode g, smpEncode h]
  {-# INLINE smpEncode #-}
  smpP = (,,,,,,,) <$> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP <*> smpP
  {-# INLINE smpP #-}
@@ -11,7 +11,7 @@

 module Simplex.Messaging.Notifications.Protocol where

-import Data.Aeson (FromJSON (..), ToJSON (..), (.=))
+import Data.Aeson (FromJSON (..), ToJSON (..), (.:), (.=))
 import qualified Data.Aeson as J
 import qualified Data.Aeson.Encoding as JE
 import qualified Data.Attoparsec.ByteString.Char8 as A
@@ -358,7 +358,11 @@ instance StrEncoding SMPQueueNtf where
    notifierId <- A.char '/' *> strP
    pure SMPQueueNtf {smpServer, notifierId}

-data PushProvider = PPApnsDev | PPApnsProd | PPApnsTest
+data PushProvider
+  = PPApnsDev -- provider for Apple development environment
+  | PPApnsProd -- production environment, including TestFlight
+  | PPApnsTest -- used for tests, to use APNS mock server
+  | PPApnsNull -- used to test servers from the client - does not communicate with APNS
  deriving (Eq, Ord, Show)

 instance Encoding PushProvider where
@@ -366,11 +370,13 @@ instance Encoding PushProvider where
    PPApnsDev -> "AD"
    PPApnsProd -> "AP"
    PPApnsTest -> "AT"
+    PPApnsNull -> "AN"
  smpP =
    A.take 2 >>= \case
      "AD" -> pure PPApnsDev
      "AP" -> pure PPApnsProd
      "AT" -> pure PPApnsTest
+      "AN" -> pure PPApnsNull
      _ -> fail "bad PushProvider"

 instance StrEncoding PushProvider where
@@ -378,11 +384,13 @@ instance StrEncoding PushProvider where
    PPApnsDev -> "apns_dev"
    PPApnsProd -> "apns_prod"
    PPApnsTest -> "apns_test"
+    PPApnsNull -> "apns_null"
  strP =
    A.takeTill (== ' ') >>= \case
      "apns_dev" -> pure PPApnsDev
      "apns_prod" -> pure PPApnsProd
      "apns_test" -> pure PPApnsTest
+      "apns_null" -> pure PPApnsNull
      _ -> fail "bad PushProvider"

 instance FromField PushProvider where fromField = fromTextField_ $ eitherToMaybe . strDecode . encodeUtf8
@@ -408,6 +416,12 @@ instance ToJSON DeviceToken where
  toEncoding (DeviceToken pp t) = J.pairs $ "pushProvider" .= decodeLatin1 (strEncode pp) <> "token" .= decodeLatin1 t
  toJSON (DeviceToken pp t) = J.object ["pushProvider" .= decodeLatin1 (strEncode pp), "token" .= decodeLatin1 t]

+instance FromJSON DeviceToken where
+  parseJSON = J.withObject "DeviceToken" $ \o -> do
+    pp <- strDecode . encodeUtf8 <$?> o .: "pushProvider"
+    t <- encodeUtf8 <$> o .: "token"
+    pure $ DeviceToken pp t
+
 type NtfEntityId = ByteString

 type NtfSubscriptionId = NtfEntityId
@@ -510,6 +524,9 @@ instance ToJSON NtfTknStatus where
  toEncoding = JE.text . decodeLatin1 . smpEncode
  toJSON = J.String . decodeLatin1 . smpEncode

+instance FromJSON NtfTknStatus where
+  parseJSON = J.withText "NtfTknStatus" $ either fail pure . smpDecode . encodeUtf8
+
 checkEntity :: forall t e e'. (NtfEntityI e, NtfEntityI e') => t e' -> Either String (t e)
 checkEntity c = case testEquality (sNtfEntity @e) (sNtfEntity @e') of
  Just Refl -> Right c
@@ -12,17 +12,16 @@

 module Simplex.Messaging.Notifications.Server where

-import Control.Concurrent.STM (stateTVar)
 import Control.Logger.Simple
+import Control.Monad
 import Control.Monad.Except
 import Control.Monad.Reader
-import Data.Bifunctor (second)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Functor (($>))
 import Data.Int (Int64)
 import Data.List (intercalate, sort)
-import Data.List.NonEmpty (NonEmpty(..))
+import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as L
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
@@ -110,9 +109,9 @@ ntfServer cfg@NtfServerConfig {transports, transportConfig = tCfg} started = do
      liftIO $ threadDelay' $ 1000000 * (initialDelay + if initialDelay < 0 then 86400 else 0)
      NtfServerStats {fromTime, tknCreated, tknVerified, tknDeleted, subCreated, subDeleted, ntfReceived, ntfDelivered, activeTokens, activeSubs} <- asks serverStats
      let interval = 1000000 * logInterval
-      withFile statsFilePath AppendMode $ \h -> liftIO $ do
-        hSetBuffering h LineBuffering
-        forever $ do
+      forever $ do
+        withFile statsFilePath AppendMode $ \h -> liftIO $ do
+          hSetBuffering h LineBuffering
          ts <- getCurrentTime
          fromTime' <- atomically $ swapTVar fromTime ts
          tknCreated' <- atomically $ swapTVar tknCreated 0
@@ -142,7 +141,7 @@ ntfServer cfg@NtfServerConfig {transports, transportConfig = tCfg} started = do
                weekCount sub,
                monthCount sub
              ]
-          threadDelay' interval
+        liftIO $ threadDelay' interval

 resubscribe :: NtfSubscriber -> Map NtfSubscriptionId NtfSubData -> M ()
 resubscribe NtfSubscriber {newSubQ} subs = do
@@ -158,18 +157,13 @@ ntfSubscriber NtfSubscriber {smpSubscribers, newSubQ, smpAgent = ca@SMPClientAge
    subscribe = forever $ do
      subs <- atomically (readTBQueue newSubQ)
      let ss = L.groupAllWith server subs
+      batchSize <- asks $ subsBatchSize . config
      forM_ ss $ \serverSubs -> do
        let srv = server $ L.head serverSubs
-            batches = toChunks 900 $ L.toList serverSubs
+            batches = toChunks batchSize $ L.toList serverSubs
        SMPSubscriber {newSubQ = subscriberSubQ} <- getSMPSubscriber srv
        mapM_ (atomically . writeTQueue subscriberSubQ) batches

-    toChunks :: Int -> [a] -> [NonEmpty a]
-    toChunks _ [] = []
-    toChunks n xs =
-      let (ys, xs') = splitAt n xs
-      in maybe id (:) (L.nonEmpty ys) (toChunks n xs')
-
    server :: NtfEntityRec 'Subscription -> SMPServer
    server (NtfSub sub) = ntfSubServer sub

@@ -210,10 +204,10 @@ ntfSubscriber NtfSubscriber {smpSubscribers, newSubQ, smpAgent = ca@SMPClientAge
              Just err -> (subs, oks, err : errs) -- permanent error, log and don't retry subscription
              Nothing -> (sub : subs, oks, errs) -- temporary error, retry subscription

-    -- | Subscribe to queues. The list of results can have a different order.
+    -- \| Subscribe to queues. The list of results can have a different order.
    subscribeQueues :: SMPServer -> NonEmpty NtfSubData -> IO (NonEmpty (NtfSubData, Either SMPClientError ()))
    subscribeQueues srv subs =
-      L.map (second snd) . L.zip subs <$> subscribeQueuesNtfs ca srv (L.map sub subs)
+      L.zipWith (\s r -> (s, snd r)) subs <$> subscribeQueuesNtfs ca srv (L.map sub subs)
      where
        sub NtfSubData {smpQueue = SMPQueueNtf {notifierId}, notifierKey} = (notifierId, notifierKey)

@@ -253,10 +247,11 @@ ntfSubscriber NtfSubscriber {smpSubscribers, newSubQ, smpAgent = ca@SMPClientAge
            forM errs (\((_, ntfId), err) -> handleSubError (SMPQueueNtf srv ntfId) err)
              >>= logSubErrors srv . catMaybes . L.toList

-    logSubStatus srv event n = when (n > 0) $
-      logInfo $ "SMP server " <> event <> " " <> showServer' srv <> " (" <> tshow n <> " subscriptions)"
+    logSubStatus srv event n =
+      when (n > 0) . logInfo $
+        "SMP server " <> event <> " " <> showServer' srv <> " (" <> tshow n <> " subscriptions)"

-    logSubErrors :: SMPServer -> [NtfSubStatus] -> M ()        
+    logSubErrors :: SMPServer -> [NtfSubStatus] -> M ()
    logSubErrors srv errs = forM_ (L.group $ sort errs) $ \errs' -> do
      logError $ "SMP subscription errors on server " <> showServer' srv <> ": " <> tshow (L.head errs') <> " (" <> tshow (length errs') <> " errors)"

@@ -280,12 +275,11 @@ ntfSubscriber NtfSubscriber {smpSubscribers, newSubQ, smpAgent = ca@SMPClientAge

    updateSubStatus smpQueue status = do
      st <- asks store
-      atomically (findNtfSubscription st smpQueue)
-        >>= mapM_
-          ( \NtfSubData {ntfSubId, subStatus} -> do
-              atomically $ writeTVar subStatus status
-              withNtfLog $ \sl -> logSubscriptionStatus sl ntfSubId status
-          )
+      atomically (findNtfSubscription st smpQueue) >>= mapM_ update
+      where
+        update NtfSubData {ntfSubId, subStatus} = do
+          old <- atomically $ stateTVar subStatus (,status)
+          when (old /= status) $ withNtfLog $ \sl -> logSubscriptionStatus sl ntfSubId status

 ntfPush :: NtfPushServer -> M ()
 ntfPush s@NtfPushServer {pushQ} = forever $ do
@@ -295,11 +289,14 @@ ntfPush s@NtfPushServer {pushQ} = forever $ do
  case ntf of
    PNVerification _
      | status /= NTInvalid && status /= NTExpired ->
-        deliverNotification pp tkn ntf >>= \case
-          Right _ -> do
-            status_ <- atomically $ stateTVar tknStatus $ \status' -> if status' == NTActive then (Nothing, NTActive) else (Just NTConfirmed, NTConfirmed)
-            forM_ status_ $ \status' -> withNtfLog $ \sl -> logTokenStatus sl ntfTknId status'
-          _ -> pure ()
+          deliverNotification pp tkn ntf >>= \case
+            Right _ -> do
+              status_ <- atomically $ stateTVar tknStatus $ \case
+                NTActive -> (Nothing, NTActive)
+                NTConfirmed -> (Nothing, NTConfirmed)
+                _ -> (Just NTConfirmed, NTConfirmed)
+              forM_ status_ $ \status' -> withNtfLog $ \sl -> logTokenStatus sl ntfTknId status'
+            _ -> pure ()
      | otherwise -> logError "bad notification token status"
    PNCheckMessages -> checkActiveTkn status $ do
      void $ deliverNotification pp tkn ntf
@@ -314,7 +311,7 @@ ntfPush s@NtfPushServer {pushQ} = forever $ do
      | status == NTActive = action
      | otherwise = liftIO $ logError "bad notification token status"
    deliverNotification :: PushProvider -> NtfTknData -> PushNotification -> M (Either PushProviderError ())
-    deliverNotification pp tkn@NtfTknData {ntfTknId, tknStatus} ntf = do
+    deliverNotification pp tkn ntf = do
      deliver <- liftIO $ getPushClient s pp
      liftIO (runExceptT $ deliver tkn ntf) >>= \case
        Right _ -> pure $ Right ()
@@ -323,19 +320,20 @@ ntfPush s@NtfPushServer {pushQ} = forever $ do
          PPRetryLater -> retryDeliver
          PPCryptoError _ -> err e
          PPResponseError _ _ -> err e
-          PPTokenInvalid -> updateTknStatus NTInvalid >> err e
+          PPTokenInvalid -> updateTknStatus tkn NTInvalid >> err e
          PPPermanentError -> err e
      where
        retryDeliver :: M (Either PushProviderError ())
        retryDeliver = do
          deliver <- liftIO $ newPushClient s pp
          liftIO (runExceptT $ deliver tkn ntf) >>= either err (pure . Right)
-        updateTknStatus :: NtfTknStatus -> M ()
-        updateTknStatus status = do
-          atomically $ writeTVar tknStatus status
-          withNtfLog $ \sl -> logTokenStatus sl ntfTknId status
        err e = logError (T.pack $ "Push provider error (" <> show pp <> "): " <> show e) $> Left e

+updateTknStatus :: NtfTknData -> NtfTknStatus -> M ()
+updateTknStatus NtfTknData {ntfTknId, tknStatus} status = do
+  old <- atomically $ stateTVar tknStatus (,status)
+  when (old /= status) $ withNtfLog $ \sl -> logTokenStatus sl ntfTknId status
+
 runNtfClientTransport :: Transport c => THandle c -> M ()
 runNtfClientTransport th@THandle {sessionId} = do
  qSize <- asks $ clientQSize . config
@@ -347,16 +345,17 @@ runNtfClientTransport th@THandle {sessionId} = do
  raceAny_ ([liftIO $ send th c, client c s ps, receive th c] <> disconnectThread_ c expCfg)
    `finally` liftIO (clientDisconnected c)
  where
-    disconnectThread_ c expCfg = maybe [] ((: []) . liftIO . disconnectTransport th c activeAt) expCfg
+    disconnectThread_ c (Just expCfg) = [liftIO $ disconnectTransport th (rcvActiveAt c) (sndActiveAt c) expCfg (pure True)]
+    disconnectThread_ _ _ = []

 clientDisconnected :: NtfServerClient -> IO ()
 clientDisconnected NtfServerClient {connected} = atomically $ writeTVar connected False

 receive :: Transport c => THandle c -> NtfServerClient -> M ()
-receive th NtfServerClient {rcvQ, sndQ, activeAt} = forever $ do
+receive th NtfServerClient {rcvQ, sndQ, rcvActiveAt} = forever $ do
  ts <- liftIO $ tGet th
  forM_ ts $ \t@(_, _, (corrId, entId, cmdOrError)) -> do
-    atomically . writeTVar activeAt =<< liftIO getSystemTime
+    atomically . writeTVar rcvActiveAt =<< liftIO getSystemTime
    logDebug "received transmission"
    case cmdOrError of
      Left e -> write sndQ (corrId, entId, NRErr e)
@@ -368,10 +367,10 @@ receive th NtfServerClient {rcvQ, sndQ, activeAt} = forever $ do
    write q t = atomically $ writeTBQueue q t

 send :: Transport c => THandle c -> NtfServerClient -> IO ()
-send h@THandle {thVersion = v} NtfServerClient {sndQ, sessionId, activeAt} = forever $ do
+send h@THandle {thVersion = v} NtfServerClient {sndQ, sessionId, sndActiveAt} = forever $ do
  t <- atomically $ readTBQueue sndQ
-  void . liftIO $ tPut h Nothing [(Nothing, encodeTransmission v sessionId t)]
-  atomically . writeTVar activeAt =<< liftIO getSystemTime
+  void . liftIO $ tPut h [(Nothing, encodeTransmission v sessionId t)]
+  atomically . writeTVar sndActiveAt =<< liftIO getSystemTime

 -- instance Show a => Show (TVar a) where
 --   show x = unsafePerformIO $ show <$> readTVarIO x
@@ -441,7 +440,7 @@ client NtfServerClient {rcvQ, sndQ} NtfSubscriber {newSubQ, smpAgent = ca} NtfPu
      NtfReqNew corrId (ANE SToken newTkn@(NewNtfTkn _ _ dhPubKey)) -> do
        logDebug "TNEW - new token"
        st <- asks store
-        ks@(srvDhPubKey, srvDhPrivKey) <- liftIO C.generateKeyPair'
+        ks@(srvDhPubKey, srvDhPrivKey) <- atomically . C.generateKeyPair =<< asks random
        let dhSecret = C.dh' dhPubKey srvDhPrivKey
        tknId <- getId
        regCode <- getRegCode
@@ -465,17 +464,16 @@ client NtfServerClient {rcvQ, sndQ} NtfSubscriber {newSubQ, smpAgent = ca} NtfPu
              else pure $ NRErr AUTH
          TVFY code -- this allows repeated verification for cases when client connection dropped before server response
            | (status == NTRegistered || status == NTConfirmed || status == NTActive) && tknRegCode == code -> do
-              logDebug "TVFY - token verified"
-              st <- asks store
-              atomically $ writeTVar tknStatus NTActive
-              tIds <- atomically $ removeInactiveTokenRegistrations st tkn
-              forM_ tIds cancelInvervalNotifications
-              withNtfLog $ \s -> logTokenStatus s tknId NTActive
-              incNtfStat tknVerified
-              pure NROk
+                logDebug "TVFY - token verified"
+                st <- asks store
+                updateTknStatus tkn NTActive
+                tIds <- atomically $ removeInactiveTokenRegistrations st tkn
+                forM_ tIds cancelInvervalNotifications
+                incNtfStat tknVerified
+                pure NROk
            | otherwise -> do
-              logDebug "TVFY - incorrect code or token status"
-              pure $ NRErr AUTH
+                logDebug "TVFY - incorrect code or token status"
+                pure $ NRErr AUTH
          TCHK -> do
            logDebug "TCHK"
            pure $ NRTkn status
@@ -512,16 +510,16 @@ client NtfServerClient {rcvQ, sndQ} NtfSubscriber {newSubQ, smpAgent = ca} NtfPu
          TCRN int
            | int < 20 -> pure $ NRErr QUOTA
            | otherwise -> do
-              logDebug "TCRN"
-              atomically $ writeTVar tknCronInterval int
-              atomically (TM.lookup tknId intervalNotifiers) >>= \case
-                Nothing -> runIntervalNotifier int
-                Just IntervalNotifier {interval, action} ->
-                  unless (interval == int) $ do
-                    uninterruptibleCancel action
-                    runIntervalNotifier int
-              withNtfLog $ \s -> logTokenCron s tknId int
-              pure NROk
+                logDebug "TCRN"
+                atomically $ writeTVar tknCronInterval int
+                atomically (TM.lookup tknId intervalNotifiers) >>= \case
+                  Nothing -> runIntervalNotifier int
+                  Just IntervalNotifier {interval, action} ->
+                    unless (interval == int) $ do
+                      uninterruptibleCancel action
+                      runIntervalNotifier int
+                withNtfLog $ \s -> logTokenCron s tknId int
+                pure NROk
            where
              runIntervalNotifier interval = do
                action <- async . intervalNotifier $ fromIntegral interval * 1000000 * 60
@@ -567,13 +565,11 @@ client NtfServerClient {rcvQ, sndQ} NtfSubscriber {newSubQ, smpAgent = ca} NtfPu
          PING -> pure NRPong
      NtfReqPing corrId entId -> pure (corrId, entId, NRPong)
    getId :: M NtfEntityId
-    getId = getRandomBytes =<< asks (subIdBytes . config)
+    getId = randomBytes =<< asks (subIdBytes . config)
    getRegCode :: M NtfRegCode
-    getRegCode = NtfRegCode <$> (getRandomBytes =<< asks (regCodeBytes . config))
-    getRandomBytes :: Int -> M ByteString
-    getRandomBytes n = do
-      gVar <- asks idsDrg
-      atomically (C.pseudoRandomBytes n gVar)
+    getRegCode = NtfRegCode <$> (randomBytes =<< asks (regCodeBytes . config))
+    randomBytes :: Int -> M ByteString
+    randomBytes n = atomically . C.randomBytes n =<< asks random
    cancelInvervalNotifications :: NtfTokenId -> M ()
    cancelInvervalNotifications tknId =
      atomically (TM.lookupDelete tknId intervalNotifiers)
@@ -3,11 +3,13 @@
 {-# LANGUAGE GADTs #-}
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE NamedFieldPuns #-}
+{-# LANGUAGE OverloadedStrings #-}

 module Simplex.Messaging.Notifications.Server.Env where

 import Control.Concurrent (ThreadId)
 import Control.Concurrent.Async (Async)
+import Control.Logger.Simple
 import Control.Monad.IO.Unlift
 import Crypto.Random
 import Data.ByteString.Char8 (ByteString)
@@ -32,7 +34,7 @@ import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport (ATransport)
-import Simplex.Messaging.Transport.Server (loadFingerprint, loadTLSServerParams, TransportServerConfig)
+import Simplex.Messaging.Transport.Server (TransportServerConfig, loadFingerprint, loadTLSServerParams)
 import System.IO (IOMode (..))
 import System.Mem.Weak (Weak)
 import UnliftIO.STM
@@ -46,6 +48,7 @@ data NtfServerConfig = NtfServerConfig
    pushQSize :: Natural,
    smpAgentCfg :: SMPClientAgentConfig,
    apnsConfig :: APNSPushClientConfig,
+    subsBatchSize :: Int,
    inactiveClientExpiration :: Maybe ExpirationConfig,
    storeLogFile :: Maybe FilePath,
    -- CA certificate private key is not needed for initialization
@@ -63,8 +66,8 @@ data NtfServerConfig = NtfServerConfig
 defaultInactiveClientExpiration :: ExpirationConfig
 defaultInactiveClientExpiration =
  ExpirationConfig
-    { ttl = 7200, -- 2 hours
-      checkInterval = 3600 -- seconds, 1 hour
+    { ttl = 43200, -- seconds, 12 hours
+      checkInterval = 3600 -- seconds, 1 hours
    }

 data NtfEnv = NtfEnv
@@ -73,7 +76,7 @@ data NtfEnv = NtfEnv
    pushServer :: NtfPushServer,
    store :: NtfStore,
    storeLog :: Maybe (StoreLog 'WriteMode),
-    idsDrg :: TVar ChaChaDRG,
+    random :: TVar ChaChaDRG,
    tlsServerParams :: T.ServerParams,
    serverIdentity :: C.KeyHash,
    serverStats :: NtfServerStats
@@ -81,15 +84,17 @@ data NtfEnv = NtfEnv

 newNtfServerEnv :: (MonadUnliftIO m, MonadRandom m) => NtfServerConfig -> m NtfEnv
 newNtfServerEnv config@NtfServerConfig {subQSize, pushQSize, smpAgentCfg, apnsConfig, storeLogFile, caCertificateFile, certificateFile, privateKeyFile} = do
-  idsDrg <- newTVarIO =<< drgNew
+  random <- liftIO C.newRandom
  store <- atomically newNtfStore
+  logInfo "restoring subscriptions..."
  storeLog <- liftIO $ mapM (`readWriteNtfStore` store) storeLogFile
+  logInfo "restored subscriptions"
  subscriber <- atomically $ newNtfSubscriber subQSize smpAgentCfg
  pushServer <- atomically $ newNtfPushServer pushQSize apnsConfig
  tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
  Fingerprint fp <- liftIO $ loadFingerprint caCertificateFile
  serverStats <- atomically . newNtfServerStats =<< liftIO getCurrentTime
-  pure NtfEnv {config, subscriber, pushServer, store, storeLog, idsDrg, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}
+  pure NtfEnv {config, subscriber, pushServer, store, storeLog, random, tlsServerParams, serverIdentity = C.KeyHash fp, serverStats}

 data NtfSubscriber = NtfSubscriber
  { smpSubscribers :: TMap SMPServer SMPSubscriber,
@@ -137,7 +142,9 @@ newNtfPushServer qSize apnsConfig = do

 newPushClient :: NtfPushServer -> PushProvider -> IO PushProviderClient
 newPushClient NtfPushServer {apnsConfig, pushClients} pp = do
-  c <- apnsPushProviderClient <$> createAPNSPushClient (apnsProviderHost pp) apnsConfig
+  c <- case apnsProviderHost pp of
+    Nothing -> pure $ \_ _ -> pure ()
+    Just host -> apnsPushProviderClient <$> createAPNSPushClient host apnsConfig
  atomically $ TM.insert pp c pushClients
  pure c

@@ -155,7 +162,8 @@ data NtfServerClient = NtfServerClient
    sndQ :: TBQueue (Transmission NtfResponse),
    sessionId :: ByteString,
    connected :: TVar Bool,
-    activeAt :: TVar SystemTime
+    rcvActiveAt :: TVar SystemTime,
+    sndActiveAt :: TVar SystemTime
  }

 newNtfServerClient :: Natural -> ByteString -> SystemTime -> STM NtfServerClient
@@ -163,5 +171,6 @@ newNtfServerClient qSize sessionId ts = do
  rcvQ <- newTBQueue qSize
  sndQ <- newTBQueue qSize
  connected <- newTVar True
-  activeAt <- newTVar ts
-  return NtfServerClient {rcvQ, sndQ, sessionId, connected, activeAt}
+  rcvActiveAt <- newTVar ts
+  sndActiveAt <- newTVar ts
+  return NtfServerClient {rcvQ, sndQ, sessionId, connected, rcvActiveAt, sndActiveAt}
@@ -7,7 +7,6 @@

 module Simplex.Messaging.Notifications.Server.Main where

-import Data.Either (fromRight)
 import Data.Functor (($>))
 import Data.Ini (lookupValue, readIniFile)
 import Data.Maybe (fromMaybe)
@@ -18,10 +17,11 @@ import Simplex.Messaging.Client (ProtocolClientConfig (..))
 import Simplex.Messaging.Client.Agent (SMPClientAgentConfig (..), defaultSMPClientAgentConfig)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Notifications.Server (runNtfServer)
-import Simplex.Messaging.Notifications.Server.Env (NtfServerConfig (..))
+import Simplex.Messaging.Notifications.Server.Env (NtfServerConfig (..), defaultInactiveClientExpiration)
 import Simplex.Messaging.Notifications.Server.Push.APNS (defaultAPNSPushClientConfig)
 import Simplex.Messaging.Protocol (ProtoServerWithAuth (..), pattern NtfServer)
 import Simplex.Messaging.Server.CLI
+import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Transport.Client (TransportHost (..))
 import Simplex.Messaging.Transport.Server (TransportServerConfig (..), defaultTransportServerConfig)
 import System.Directory (createDirectoryIfMissing, doesFileExist)
@@ -30,7 +30,7 @@ import System.IO (BufferMode (..), hSetBuffering, stderr, stdout)
 import Text.Read (readMaybe)

 ntfServerVersion :: String
-ntfServerVersion = "1.5.0"
+ntfServerVersion = "1.7.2.0"

 defaultSMPBatchDelay :: Int
 defaultSMPBatchDelay = 10000
@@ -87,12 +87,17 @@ ntfServerCLI cfgPath logPath =
            <> "log_tls_errors: off\n\
               \# delay between command batches sent to SMP relays (microseconds), 0 to disable\n"
            <> ("smp_batch_delay: " <> show defaultSMPBatchDelay <> "\n")
-            <> "websockets: off\n"
+            <> "websockets: off\n\n\
+               \[INACTIVE_CLIENTS]\n\
+               \# TTL and interval to check inactive clients\n\
+               \disconnect: off\n"
+            <> ("# ttl: " <> show (ttl defaultInactiveClientExpiration) <> "\n")
+            <> ("# check_interval: " <> show (checkInterval defaultInactiveClientExpiration) <> "\n")
    runServer ini = do
      hSetBuffering stdout LineBuffering
      hSetBuffering stderr LineBuffering
      fp <- checkSavedFingerprint cfgPath defaultX509Config
-      let host = fromRight "<hostnames>" $ T.unpack <$> lookupValue "TRANSPORT" "host" ini
+      let host = either (const "<hostnames>") T.unpack $ lookupValue "TRANSPORT" "host" ini
          port = T.unpack $ strictIni "TRANSPORT" "port" ini
          cfg@NtfServerConfig {transports, storeLogFile} = serverConfig
          srv = ProtoServerWithAuth (NtfServer [THDomainName host] (if port == "443" then "" else port) (C.KeyHash fp)) Nothing
@@ -115,7 +120,13 @@ ntfServerCLI cfgPath logPath =
              pushQSize = 1048,
              smpAgentCfg = defaultSMPClientAgentConfig {smpCfg = (smpCfg defaultSMPClientAgentConfig) {batchDelay}},
              apnsConfig = defaultAPNSPushClientConfig,
-              inactiveClientExpiration = Nothing,
+              subsBatchSize = 900,
+              inactiveClientExpiration =
+                settingIsOn "INACTIVE_CLIENTS" "disconnect" ini
+                  $> ExpirationConfig
+                    { ttl = readStrictIni "INACTIVE_CLIENTS" "ttl" ini,
+                      checkInterval = readStrictIni "INACTIVE_CLIENTS" "check_interval" ini
+                    },
              storeLogFile = enableStoreLog $> storeLogFilePath,
              caCertificateFile = c caCrtFile,
              privateKeyFile = c serverKeyFile,
@@ -1,9 +1,9 @@
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# OPTIONS_GHC -Wno-unrecognised-pragmas #-}

 {-# HLINT ignore "Use newtype instead of data" #-}
@@ -12,24 +12,26 @@ module Simplex.Messaging.Notifications.Server.Push.APNS where

 import Control.Exception (Exception)
 import Control.Logger.Simple
+import Control.Monad
 import Control.Monad.Except
+import Control.Monad.IO.Class
 import Crypto.Hash.Algorithms (SHA256 (..))
 import qualified Crypto.PubKey.ECC.ECDSA as EC
 import qualified Crypto.PubKey.ECC.Types as ECT
-import Crypto.Random (ChaChaDRG, drgNew)
+import Crypto.Random (ChaChaDRG)
 import qualified Crypto.Store.PKCS8 as PK
 import Data.ASN1.BinaryEncoding (DER (..))
 import Data.ASN1.Encoding
 import Data.ASN1.Types
-import Data.Aeson (FromJSON, ToJSON, (.=))
+import Data.Aeson (ToJSON, (.=))
 import qualified Data.Aeson as J
 import qualified Data.Aeson.Encoding as JE
+import qualified Data.Aeson.TH as JQ
 import Data.Bifunctor (first)
 import qualified Data.ByteString.Base64.URL as U
 import Data.ByteString.Builder (lazyByteString)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Lazy.Char8 as LB
-import qualified Data.CaseInsensitive as CI
 import Data.Int (Int64)
 import Data.Map.Strict (Map)
 import Data.Maybe (isNothing)
@@ -38,8 +40,7 @@ import qualified Data.Text as T
 import Data.Time.Clock.System
 import qualified Data.X509 as X
 import qualified Data.X509.CertificateStore as XS
-import GHC.Generics (Generic)
-import Network.HTTP.Types (HeaderName, Status)
+import Network.HTTP.Types (Status)
 import qualified Network.HTTP.Types as N
 import Network.HTTP2.Client (Request)
 import qualified Network.HTTP2.Client as H
@@ -47,7 +48,9 @@ import Network.Socket (HostName, ServiceName)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Notifications.Protocol
+import Simplex.Messaging.Notifications.Server.Push.APNS.Internal
 import Simplex.Messaging.Notifications.Server.Store (NtfTknData (..))
+import Simplex.Messaging.Parsers (defaultJSON)
 import Simplex.Messaging.Protocol (EncNMsgMeta)
 import Simplex.Messaging.Transport.HTTP2 (HTTP2Body (..))
 import Simplex.Messaging.Transport.HTTP2.Client
@@ -59,17 +62,13 @@ data JWTHeader = JWTHeader
  { alg :: Text, -- key algorithm, ES256 for APNS
    kid :: Text -- key ID
  }
-  deriving (Show, Generic)
-
-instance ToJSON JWTHeader where toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Show)

 data JWTClaims = JWTClaims
  { iss :: Text, -- issuer, team ID for APNS
    iat :: Int64 -- issue time, seconds from epoch
  }
-  deriving (Show, Generic)
-
-instance ToJSON JWTClaims where toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Show)

 data JWTToken = JWTToken JWTHeader JWTClaims
  deriving (Show)
@@ -81,6 +80,10 @@ mkJWTToken hdr iss = do

 type SignedJWTToken = ByteString

+$(JQ.deriveToJSON defaultJSON ''JWTHeader)
+
+$(JQ.deriveToJSON defaultJSON ''JWTClaims)
+
 signedJWTToken :: EC.PrivateKey -> JWTToken -> IO SignedJWTToken
 signedJWTToken pk (JWTToken hdr claims) = do
  let hc = jwtEncode hdr <> "." <> jwtEncode claims
@@ -120,24 +123,13 @@ instance StrEncoding PNMessageData where
    pure PNMessageData {smpQueue, ntfTs, nmsgNonce, encNMsgMeta}

 data APNSNotification = APNSNotification {aps :: APNSNotificationBody, notificationData :: Maybe J.Value}
-  deriving (Show, Generic)
-
-instance ToJSON APNSNotification where
-  toJSON = J.genericToJSON J.defaultOptions {J.omitNothingFields = True}
-  toEncoding = J.genericToEncoding J.defaultOptions {J.omitNothingFields = True}
+  deriving (Show)

 data APNSNotificationBody
  = APNSBackground {contentAvailable :: Int}
  | APNSMutableContent {mutableContent :: Int, alert :: APNSAlertBody, category :: Maybe Text}
  | APNSAlert {alert :: APNSAlertBody, badge :: Maybe Int, sound :: Maybe Text, category :: Maybe Text}
-  deriving (Show, Generic)
-
-apnsJSONOptions :: J.Options
-apnsJSONOptions = J.defaultOptions {J.omitNothingFields = True, J.sumEncoding = J.UntaggedValue, J.fieldLabelModifier = J.camelTo2 '-'}
-
-instance ToJSON APNSNotificationBody where
-  toJSON = J.genericToJSON apnsJSONOptions
-  toEncoding = J.genericToEncoding apnsJSONOptions
+  deriving (Show)

 type APNSNotificationData = Map Text Text

@@ -201,11 +193,12 @@ data APNSPushClientConfig = APNSPushClientConfig
    caStoreFile :: FilePath
  }

-apnsProviderHost :: PushProvider -> HostName
+apnsProviderHost :: PushProvider -> Maybe HostName
 apnsProviderHost = \case
-  PPApnsTest -> "localhost"
-  PPApnsDev -> "api.sandbox.push.apple.com"
-  PPApnsProd -> "api.push.apple.com"
+  PPApnsNull -> Nothing
+  PPApnsTest -> Just "localhost"
+  PPApnsDev -> Just "api.sandbox.push.apple.com"
+  PPApnsProd -> Just "api.push.apple.com"

 defaultAPNSPushClientConfig :: APNSPushClientConfig
 defaultAPNSPushClientConfig =
@@ -240,7 +233,7 @@ createAPNSPushClient apnsHost apnsCfg@APNSPushClientConfig {authKeyFileEnv, auth
  authKeyId <- T.pack <$> getEnv authKeyIdEnv
  let jwtHeader = JWTHeader {alg = authKeyAlg, kid = authKeyId}
  jwtToken <- newTVarIO =<< mkApnsJWTToken appTeamId jwtHeader privateKey
-  nonceDrg <- drgNew >>= newTVarIO
+  nonceDrg <- C.newRandom
  pure APNSPushClient {https2Client, privateKey, jwtHeader, jwtToken, nonceDrg, apnsHost, apnsCfg}

 getApnsJWTToken :: APNSPushClient -> IO SignedJWTToken
@@ -303,6 +296,10 @@ apnsNotification NtfTknData {tknDhSecret} nonce paddedLen = \case

 -- apnAlert alert = APNSAlert {alert, badge = Nothing, sound = Nothing, category = Nothing}

+$(JQ.deriveToJSON apnsJSONOptions ''APNSNotificationBody)
+
+$(JQ.deriveToJSON defaultJSON ''APNSNotification)
+
 apnsRequest :: APNSPushClient -> ByteString -> APNSNotification -> IO Request
 apnsRequest c tkn ntf@APNSNotification {aps} = do
  signedJWT <- getApnsJWTToken c
@@ -335,12 +332,13 @@ type PushProviderClient = NtfTknData -> PushNotification -> ExceptT PushProvider

 -- this is not a newtype on purpose to have a correct JSON encoding as a record
 data APNSErrorResponse = APNSErrorResponse {reason :: Text}
-  deriving (Generic, FromJSON)
+
+$(JQ.deriveFromJSON defaultJSON ''APNSErrorResponse)

 apnsPushProviderClient :: APNSPushClient -> PushProviderClient
 apnsPushProviderClient c@APNSPushClient {nonceDrg, apnsCfg} tkn@NtfTknData {token = DeviceToken _ tknStr} pn = do
  http2 <- liftHTTPS2 $ getApnsHTTP2Client c
-  nonce <- atomically $ C.pseudoRandomCbNonce nonceDrg
+  nonce <- atomically $ C.randomCbNonce nonceDrg
  apnsNtf <- liftEither $ first PPCryptoError $ apnsNotification tkn nonce (paddedNtfLength apnsCfg) pn
  req <- liftIO $ apnsRequest c tknStr apnsNtf
  -- TODO when HTTP2 client is thread-safe, we can use sendRequestDirect
@@ -354,15 +352,15 @@ apnsPushProviderClient c@APNSPushClient {nonceDrg, apnsCfg} tkn@NtfTknData {toke
    result status reason'
      | status == Just N.ok200 = pure ()
      | status == Just N.badRequest400 =
-        case reason' of
-          "BadDeviceToken" -> throwError PPTokenInvalid
-          "DeviceTokenNotForTopic" -> throwError PPTokenInvalid
-          "TopicDisallowed" -> throwError PPPermanentError
-          _ -> err status reason'
+          case reason' of
+            "BadDeviceToken" -> throwError PPTokenInvalid
+            "DeviceTokenNotForTopic" -> throwError PPTokenInvalid
+            "TopicDisallowed" -> throwError PPPermanentError
+            _ -> err status reason'
      | status == Just N.forbidden403 = case reason' of
-        "ExpiredProviderToken" -> throwError PPPermanentError -- there should be no point retrying it as the token was refreshed
-        "InvalidProviderToken" -> throwError PPPermanentError
-        _ -> err status reason'
+          "ExpiredProviderToken" -> throwError PPPermanentError -- there should be no point retrying it as the token was refreshed
+          "InvalidProviderToken" -> throwError PPPermanentError
+          _ -> err status reason'
      | status == Just N.gone410 = throwError PPTokenInvalid
      | status == Just N.serviceUnavailable503 = liftIO (disconnectApnsHTTP2Client c) >> throwError PPRetryLater
      -- Just tooManyRequests429 -> TooManyRequests - too many requests for the same token
@@ -370,12 +368,3 @@ apnsPushProviderClient c@APNSPushClient {nonceDrg, apnsCfg} tkn@NtfTknData {toke
    err :: Maybe Status -> Text -> ExceptT PushProviderError IO ()
    err s r = throwError $ PPResponseError s r
    liftHTTPS2 a = ExceptT $ first PPConnection <$> a
-
-hApnsTopic :: HeaderName
-hApnsTopic = CI.mk "apns-topic"
-
-hApnsPushType :: HeaderName
-hApnsPushType = CI.mk "apns-push-type"
-
-hApnsPriority :: HeaderName
-hApnsPriority = CI.mk "apns-priority"
@@ -0,0 +1,20 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+module Simplex.Messaging.Notifications.Server.Push.APNS.Internal where
+
+import qualified Data.Aeson as J
+import qualified Data.CaseInsensitive as CI
+import Network.HTTP.Types (HeaderName)
+import Simplex.Messaging.Parsers (defaultJSON)
+
+hApnsTopic :: HeaderName
+hApnsTopic = CI.mk "apns-topic"
+
+hApnsPushType :: HeaderName
+hApnsPushType = CI.mk "apns-push-type"
+
+hApnsPriority :: HeaderName
+hApnsPriority = CI.mk "apns-priority"
+
+apnsJSONOptions :: J.Options
+apnsJSONOptions = defaultJSON {J.sumEncoding = J.UntaggedValue, J.fieldLabelModifier = J.camelTo2 '-'}
@@ -55,8 +55,8 @@ newNtfServerStats ts = do
  pure NtfServerStats {fromTime, tknCreated, tknVerified, tknDeleted, subCreated, subDeleted, ntfReceived, ntfDelivered, activeTokens, activeSubs}

 getNtfServerStatsData :: NtfServerStats -> STM NtfServerStatsData
-getNtfServerStatsData s = do
-  _fromTime <- readTVar $ fromTime (s :: NtfServerStats)
+getNtfServerStatsData s@NtfServerStats {fromTime} = do
+  _fromTime <- readTVar fromTime
  _tknCreated <- readTVar $ tknCreated s
  _tknVerified <- readTVar $ tknVerified s
  _tknDeleted <- readTVar $ tknDeleted s
@@ -69,8 +69,8 @@ getNtfServerStatsData s = do
  pure NtfServerStatsData {_fromTime, _tknCreated, _tknVerified, _tknDeleted, _subCreated, _subDeleted, _ntfReceived, _ntfDelivered, _activeTokens, _activeSubs}

 setNtfServerStats :: NtfServerStats -> NtfServerStatsData -> STM ()
-setNtfServerStats s d = do
-  writeTVar (fromTime (s :: NtfServerStats)) $! _fromTime (d :: NtfServerStatsData)
+setNtfServerStats s@NtfServerStats {fromTime} d@NtfServerStatsData {_fromTime} = do
+  writeTVar fromTime $! _fromTime
  writeTVar (tknCreated s) $! _tknCreated d
  writeTVar (tknVerified s) $! _tknVerified d
  writeTVar (tknDeleted s) $! _tknDeleted d
@@ -4,7 +4,6 @@
 {-# LANGUAGE KindSignatures #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
-{-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}

 module Simplex.Messaging.Notifications.Server.Store where
@@ -4,6 +4,8 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE StrictData #-}
+{-# OPTIONS_GHC -fno-warn-ambiguous-fields #-}

 module Simplex.Messaging.Notifications.Server.StoreLog
  ( StoreLog,
@@ -22,7 +24,7 @@ module Simplex.Messaging.Notifications.Server.StoreLog
 where

 import Control.Concurrent.STM
-import Control.Monad (void)
+import Control.Monad
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
 import Data.Word (Word16)
@@ -151,6 +153,7 @@ instance StrEncoding NtfSubRec where

 logNtfStoreRecord :: StoreLog 'WriteMode -> NtfStoreLogRecord -> IO ()
 logNtfStoreRecord = writeStoreLogRecord
+{-# INLINE logNtfStoreRecord #-}

 logCreateToken :: StoreLog 'WriteMode -> NtfTknData -> IO ()
 logCreateToken s tkn = logNtfStoreRecord s . CreateToken =<< atomically (mkTknRec tkn)
@@ -194,9 +197,11 @@ readNtfStore f st = mapM_ addNtfLogRecord . B.lines =<< B.readFile f
        CreateToken r@NtfTknRec {ntfTknId} -> do
          tkn <- mkTknData r
          addNtfToken st ntfTknId tkn
-        TokenStatus tknId status ->
-          getNtfToken st tknId
-            >>= mapM_ (\NtfTknData {tknStatus} -> writeTVar tknStatus status)
+        TokenStatus tknId status -> do
+          tkn_ <- getNtfToken st tknId
+          forM_ tkn_ $ \tkn@NtfTknData {tknStatus} -> do
+            writeTVar tknStatus status
+            when (status == NTActive) $ void $ removeInactiveTokenRegistrations st tkn
        UpdateToken tknId token' tknRegCode ->
          getNtfToken st tknId
            >>= mapM_
@@ -221,7 +226,5 @@ readNtfStore f st = mapM_ addNtfLogRecord . B.lines =<< B.readFile f

 writeNtfStore :: StoreLog 'WriteMode -> NtfStore -> IO ()
 writeNtfStore s NtfStore {tokens, subscriptions} = do
-  atomically (readTVar tokens >>= mapM mkTknRec)
-    >>= mapM_ (writeStoreLogRecord s . CreateToken)
-  atomically (readTVar subscriptions >>= mapM mkSubRec)
-    >>= mapM_ (writeStoreLogRecord s . CreateSubscription)
+  mapM_ (logCreateToken s) =<< readTVarIO tokens
+  mapM_ (logCreateSubscription s) =<< readTVarIO subscriptions
@@ -50,9 +50,9 @@ ntfServerHandshake c kh ntfVRange = do
  getHandshake th >>= \case
    NtfClientHandshake {ntfVersion, keyHash}
      | keyHash /= kh ->
-        throwError $ TEHandshake IDENTITY
-      | ntfVersion `isCompatible` ntfVRange -> do
-        pure (th :: THandle c) {thVersion = ntfVersion}
+          throwError $ TEHandshake IDENTITY
+      | ntfVersion `isCompatible` ntfVRange ->
+          pure (th :: THandle c) {thVersion = ntfVersion}
      | otherwise -> throwError $ TEHandshake VERSION

 -- | Notifcations server client transport handshake.
@@ -1,6 +1,7 @@
 {-# LANGUAGE CPP #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE PatternSynonyms #-}

 module Simplex.Messaging.Parsers where

@@ -13,6 +14,7 @@ import Data.ByteString.Base64
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
 import Data.Char (isAlphaNum, toLower)
+import Data.String
 import Data.Text (Text)
 import qualified Data.Text as T
 import Data.Time.Clock (UTCTime)
@@ -83,7 +85,7 @@ blobFieldDecoder dec = \case
      Left e -> returnError ConversionFailed f ("couldn't parse field: " ++ e)
  f -> returnError ConversionFailed f "expecting SQLBlob column type"

-fromTextField_ :: (Typeable a) => (Text -> Maybe a) -> Field -> Ok a
+fromTextField_ :: Typeable a => (Text -> Maybe a) -> Field -> Ok a
 fromTextField_ fromText = \case
  f@(Field (SQLText t) _) ->
    case fromText t of
@@ -107,17 +109,21 @@ enumJSON tagModifier =
      J.allNullaryToStringTag = True
    }

+-- used in platform-specific encoding, includes tag for single-field encoding of sum types to allow conversion to tagged objects
 sumTypeJSON :: (String -> String) -> J.Options
 #if defined(darwin_HOST_OS) && defined(swiftJSON)
-sumTypeJSON = singleFieldJSON
+sumTypeJSON = singleFieldJSON_ $ Just SingleFieldJSONTag
 #else
 sumTypeJSON = taggedObjectJSON
 #endif

+pattern SingleFieldJSONTag :: (Eq a, IsString a) => a
+pattern SingleFieldJSONTag = "_owsf"
+
 taggedObjectJSON :: (String -> String) -> J.Options
 taggedObjectJSON tagModifier =
  J.defaultOptions
-    { J.sumEncoding = J.TaggedObject "type" "data",
+    { J.sumEncoding = J.TaggedObject TaggedObjectJSONTag TaggedObjectJSONData,
      J.tagSingleConstructors = True,
      J.constructorTagModifier = tagModifier,
      J.allNullaryToStringTag = False,
@@ -125,13 +131,26 @@ taggedObjectJSON tagModifier =
      J.omitNothingFields = True
    }

+pattern TaggedObjectJSONTag :: (Eq a, IsString a) => a
+pattern TaggedObjectJSONTag = "type"
+
+pattern TaggedObjectJSONData :: (Eq a, IsString a) => a
+pattern TaggedObjectJSONData = "data"
+
+-- used in platform independent encoding, doesn't include tag for single-field encoding of sum types
 singleFieldJSON :: (String -> String) -> J.Options
-singleFieldJSON tagModifier =
+singleFieldJSON = singleFieldJSON_ Nothing
+
+singleFieldJSON_ :: Maybe String -> (String -> String) -> J.Options
+singleFieldJSON_ objectTag tagModifier =
  J.defaultOptions
-    { J.sumEncoding = J.ObjectWithSingleField,
+    { J.sumEncoding = J.ObjectWithSingleField objectTag,
      J.tagSingleConstructors = True,
      J.constructorTagModifier = tagModifier,
      J.allNullaryToStringTag = False,
      J.nullaryToObject = True,
      J.omitNothingFields = True
    }
+
+defaultJSON :: J.Options
+defaultJSON = J.defaultOptions {J.omitNothingFields = True}
@@ -1,6 +1,6 @@
 {-# LANGUAGE AllowAmbiguousTypes #-}
 {-# LANGUAGE DataKinds #-}
-{-# LANGUAGE DeriveGeneric #-}
+{-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE FlexibleInstances #-}
@@ -15,6 +15,8 @@
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 {-# LANGUAGE StandaloneDeriving #-}
+{-# LANGUAGE StrictData #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TupleSections #-}
 {-# LANGUAGE TypeApplications #-}
 {-# LANGUAGE TypeFamilyDependencies #-}
@@ -46,6 +48,7 @@ module Simplex.Messaging.Protocol
    -- * SMP protocol types
    ProtocolEncoding (..),
    Command (..),
+    SubscriptionMode (..),
    Party (..),
    Cmd (..),
    BrokerMsg (..),
@@ -76,6 +79,7 @@ module Simplex.Messaging.Protocol
    SMPServerWithAuth,
    NtfServer,
    pattern NtfServer,
+    NtfServerWithAuth,
    XFTPServer,
    pattern XFTPServer,
    XFTPServerWithAuth,
@@ -115,6 +119,8 @@ module Simplex.Messaging.Protocol
    userProtocol,
    rcvMessageMeta,
    noMsgFlags,
+    messageId,
+    messageTs,

    -- * Parse and serialize
    ProtocolMsgTag (..),
@@ -132,12 +138,16 @@ module Simplex.Messaging.Protocol
    noAuthSrv,

    -- * TCP transport functions
+    TransportBatch (..),
    tPut,
+    tPutLog,
    tGet,
    tParse,
    tDecodeParseValidate,
    tEncode,
-    tEncodeBatch,
+    tEncodeBatch1,
+    batchTransmissions,
+    batchTransmissions',

    -- * exports for tests
    CommandTag (..),
@@ -146,11 +156,10 @@ module Simplex.Messaging.Protocol
 where

 import Control.Applicative (optional, (<|>))
-import Control.Concurrent (threadDelay)
 import Control.Monad.Except
 import Data.Aeson (FromJSON (..), ToJSON (..))
-import qualified Data.Aeson as J
-import Data.Attoparsec.ByteString.Char8 (Parser)
+import qualified Data.Aeson.TH as J
+import Data.Attoparsec.ByteString.Char8 (Parser, (<?>))
 import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
@@ -164,9 +173,7 @@ import Data.Maybe (isJust, isNothing)
 import Data.String
 import Data.Time.Clock.System (SystemTime (..))
 import Data.Type.Equality
-import GHC.Generics (Generic)
 import GHC.TypeLits (ErrorMessage (..), TypeError, type (+))
-import Generic.Random (genericArbitraryU)
 import Network.Socket (HostName, ServiceName)
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding
@@ -176,7 +183,6 @@ import Simplex.Messaging.Transport
 import Simplex.Messaging.Transport.Client (TransportHost, TransportHosts (..))
 import Simplex.Messaging.Util (bshow, eitherToMaybe, (<$?>))
 import Simplex.Messaging.Version
-import Test.QuickCheck (Arbitrary (..))

 currentSMPClientVersion :: Version
 currentSMPClientVersion = 2
@@ -272,7 +278,7 @@ type EntityId = ByteString
 -- | Parameterized type for SMP protocol commands from all clients.
 data Command (p :: Party) where
  -- SMP recipient commands
-  NEW :: RcvPublicVerifyKey -> RcvPublicDhKey -> Maybe BasicAuth -> Command Recipient
+  NEW :: RcvPublicVerifyKey -> RcvPublicDhKey -> Maybe BasicAuth -> SubscriptionMode -> Command Recipient
  SUB :: Command Recipient
  KEY :: SndPublicVerifyKey -> Command Recipient
  NKEY :: NtfPublicVerifyKey -> RcvNtfPublicDhKey -> Command Recipient
@@ -295,6 +301,28 @@ deriving instance Show (Command p)

 deriving instance Eq (Command p)

+data SubscriptionMode = SMSubscribe | SMOnlyCreate
+  deriving (Eq, Show)
+
+instance StrEncoding SubscriptionMode where
+  strEncode = \case
+    SMSubscribe -> "subscribe"
+    SMOnlyCreate -> "only-create"
+  strP =
+    (A.string "subscribe" $> SMSubscribe)
+      <|> (A.string "only-create" $> SMOnlyCreate)
+        <?> "SubscriptionMode"
+
+instance Encoding SubscriptionMode where
+  smpEncode = \case
+    SMSubscribe -> "S"
+    SMOnlyCreate -> "C"
+  smpP =
+    A.anyChar >>= \case
+      'S' -> pure SMSubscribe
+      'C' -> pure SMOnlyCreate
+      _ -> fail "bad SubscriptionMode"
+
 data BrokerMsg where
  -- SMP broker messages (responses, client messages, notifications)
  IDS :: QueueIdsKeys -> BrokerMsg
@@ -331,6 +359,16 @@ data Message
        msgTs :: SystemTime
      }

+messageId :: Message -> MsgId
+messageId = \case
+  Message {msgId} -> msgId
+  MessageQuota {msgId} -> msgId
+
+messageTs :: Message -> SystemTime
+messageTs = \case
+  Message {msgTs} -> msgTs
+  MessageQuota {msgTs} -> msgTs
+
 instance StrEncoding RcvMessage where
  strEncode RcvMessage {msgId, msgTs, msgFlags, msgBody = EncRcvMsgBody body} =
    B.unwords
@@ -423,7 +461,14 @@ data SMPMsgMeta = SMPMsgMeta
    msgTs :: SystemTime,
    msgFlags :: MsgFlags
  }
-  deriving (Show)
+  deriving (Eq, Show)
+
+instance StrEncoding SMPMsgMeta where
+  strEncode SMPMsgMeta {msgId, msgTs, msgFlags} =
+    strEncode (msgId, msgTs, msgFlags)
+  strP = do
+    (msgId, msgTs, msgFlags) <- strP
+    pure SMPMsgMeta {msgId, msgTs, msgFlags}

 rcvMessageMeta :: MsgId -> ClientRcvMsgBody -> SMPMsgMeta
 rcvMessageMeta msgId = \case
@@ -446,9 +491,7 @@ instance Encoding NMsgMeta where

 -- it must be data for correct JSON encoding
 data MsgFlags = MsgFlags {notification :: Bool}
-  deriving (Eq, Show, Generic)
-
-instance ToJSON MsgFlags where toEncoding = J.genericToEncoding J.defaultOptions
+  deriving (Eq, Show)

 -- this encoding should not become bigger than 7 bytes (currently it is 1 byte)
 instance Encoding MsgFlags where
@@ -632,6 +675,8 @@ pattern NtfServer host port keyHash = ProtocolServer SPNTF host port keyHash

 {-# COMPLETE NtfServer #-}

+type NtfServerWithAuth = ProtoServerWithAuth 'PNTF
+
 type XFTPServer = ProtocolServer 'PXFTP

 pattern XFTPServer :: NonEmpty TransportHost -> ServiceName -> C.KeyHash -> ProtocolServer 'PXFTP
@@ -712,10 +757,16 @@ instance ProtocolTypeI p => ToJSON (SProtocolType p) where
  toEncoding = strToJEncoding
  toJSON = strToJSON

+instance ProtocolTypeI p => FromJSON (SProtocolType p) where
+  parseJSON = strParseJSON "SProtocolType"
+
 instance ToJSON AProtocolType where
  toEncoding = strToJEncoding
  toJSON = strToJSON

+instance FromJSON AProtocolType where
+  parseJSON = strParseJSON "AProtocolType"
+
 checkProtocolType :: forall t p p'. (ProtocolTypeI p, ProtocolTypeI p') => t p' -> Either String (t p)
 checkProtocolType p = case testEquality (protocolTypeI @p) (protocolTypeI @p') of
  Just Refl -> Right p
@@ -892,6 +943,9 @@ instance ToJSON CorrId where
  toJSON = strToJSON
  toEncoding = strToJEncoding

+instance FromJSON CorrId where
+  parseJSON = strParseJSON "CorrId"
+
 -- | Queue IDs and keys
 data QueueIdsKeys = QIK
  { rcvId :: RecipientId,
@@ -962,11 +1016,7 @@ data ErrorType
    INTERNAL
  | -- | used internally, never returned by the server (to be removed)
    DUPLICATE_ -- not part of SMP protocol, used internally
-  deriving (Eq, Generic, Read, Show)
-
-instance ToJSON ErrorType where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
+  deriving (Eq, Read, Show)

 instance StrEncoding ErrorType where
  strEncode = \case
@@ -988,15 +1038,7 @@ data CommandError
    HAS_AUTH
  | -- | transmission has no required entity ID (e.g. SMP queue)
    NO_ENTITY
-  deriving (Eq, Generic, Read, Show)
-
-instance ToJSON CommandError where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
-
-instance Arbitrary ErrorType where arbitrary = genericArbitraryU
-
-instance Arbitrary CommandError where arbitrary = genericArbitraryU
+  deriving (Eq, Read, Show)

 -- | SMP transmission parser.
 transmissionP :: Parser RawTransmission
@@ -1040,13 +1082,13 @@ class ProtocolMsgTag (Tag msg) => ProtocolEncoding err msg | msg -> err where
 instance PartyI p => ProtocolEncoding ErrorType (Command p) where
  type Tag (Command p) = CommandTag p
  encodeProtocol v = \case
-    NEW rKey dhKey auth_ -> case auth_ of
-      Just auth
-        | v >= 5 -> new <> e ('A', auth)
-        | otherwise -> new
-      _ -> new
+    NEW rKey dhKey auth_ subMode
+      | v >= 6 -> new <> auth <> e subMode
+      | v == 5 -> new <> auth
+      | otherwise -> new
      where
        new = e (NEW_, ' ', rKey, dhKey)
+        auth = maybe "" (e . ('A',)) auth_
    SUB -> e SUB_
    KEY k -> e (KEY_, ' ', k)
    NKEY k dhKey -> e (NKEY_, ' ', k, dhKey)
@@ -1098,10 +1140,12 @@ instance ProtocolEncoding ErrorType Cmd where
    CT SRecipient tag ->
      Cmd SRecipient <$> case tag of
        NEW_
-          | v >= 5 -> new <*> optional (A.char 'A' *> smpP)
-          | otherwise -> new <*> pure Nothing
+          | v >= 6 -> new <*> auth <*> smpP
+          | v == 5 -> new <*> auth <*> pure SMSubscribe
+          | otherwise -> new <*> pure Nothing <*> pure SMSubscribe
          where
            new = NEW <$> _smpP <*> smpP
+            auth = optional (A.char 'A' *> smpP)
        SUB_ -> pure SUB
        KEY_ -> KEY <$> _smpP
        NKEY_ -> NKEY <$> _smpP <*> smpP
@@ -1181,9 +1225,6 @@ instance ProtocolEncoding ErrorType BrokerMsg where
      | B.null queueId -> Left $ CMD NO_ENTITY
      | otherwise -> Right cmd

-_smpP :: Encoding a => Parser a
-_smpP = A.space *> smpP
-
 -- | Parse SMP protocol commands and broker messages
 parseProtocol :: forall err msg. ProtocolEncoding err msg => Version -> ByteString -> Either err msg
 parseProtocol v s =
@@ -1245,51 +1286,79 @@ instance Encoding CommandError where
      _ -> fail "bad command error type"

 -- | Send signed SMP transmission to TCP transport.
-tPut :: Transport c => THandle c -> Maybe Int -> NonEmpty SentRawTransmission -> IO [Either TransportError ()]
-tPut th delay_ trs 
-  | batch th = tPutBatch [] $ L.map tEncode trs
-  | otherwise = forM (L.toList trs) $ tPutLog . tEncode
+tPut :: Transport c => THandle c -> NonEmpty SentRawTransmission -> IO [Either TransportError ()]
+tPut th = fmap concat . mapM tPutBatch . batchTransmissions (batch th) (blockSize th)
  where
-    tPutBatch :: [Either TransportError ()] -> NonEmpty ByteString -> IO [Either TransportError ()]
-    tPutBatch rs ts = do
-      let (n, s, ts_) = encodeBatch 0 "" ts
-      r <- if n == 0 then largeMsg else replicate n <$> tPutLog (tEncodeBatch n s)
-      let rs' = rs <> r
-      case ts_ of
-        Just ts' -> mapM_ threadDelay delay_ >> tPutBatch rs' ts'
-        _ -> pure rs'
-    largeMsg = putStrLn "tPut error: large message" >> pure [Left TELargeMsg]
-    tPutLog s = do
-      r <- tPutBlock th s
-      case r of
-        Left e -> putStrLn ("tPut error: " <> show e)
-        _ -> pure ()
-      pure r
-    encodeBatch :: Int -> ByteString -> NonEmpty ByteString -> (Int, ByteString, Maybe (NonEmpty ByteString))
-    encodeBatch n s ts@(t :| ts_)
-      | n == 255 = (n, s, Just ts)
-      | otherwise =
-        let s' = s <> smpEncode (Large t)
-            n' = n + 1
-         in if B.length s' > blockSize th - 1 -- one byte is reserved for the number of messages in the batch
-              then (n,s,) $ if n == 0 then L.nonEmpty ts_ else Just ts
-              else case L.nonEmpty ts_ of
-                Just ts' -> encodeBatch n' s' ts'
-                _ -> (n', s', Nothing)
+    tPutBatch :: TransportBatch () -> IO [Either TransportError ()]
+    tPutBatch = \case
+      TBLargeTransmission _ -> [Left TELargeMsg] <$ putStrLn "tPut error: large message"
+      TBTransmissions s n _ -> replicate n <$> (tPutLog th s)
+      TBTransmission s _ -> (: []) <$> tPutLog th s

-tEncode :: (Maybe C.ASignature, ByteString) -> ByteString
+tPutLog :: Transport c => THandle c -> ByteString -> IO (Either TransportError ())
+tPutLog th s = do
+  r <- tPutBlock th s
+  case r of
+    Left e -> putStrLn ("tPut error: " <> show e)
+    _ -> pure ()
+  pure r
+
+-- ByteString in TBTransmissions includes byte with transmissions count
+data TransportBatch r = TBTransmissions ByteString Int [r] | TBTransmission ByteString r | TBLargeTransmission r
+
+batchTransmissions :: Bool -> Int -> NonEmpty SentRawTransmission -> [TransportBatch ()]
+batchTransmissions batch bSize = batchTransmissions' batch bSize . L.map (,())
+
+-- | encodes and batches transmissions into blocks,
+batchTransmissions' :: forall r. Bool -> Int -> NonEmpty (SentRawTransmission, r) -> [TransportBatch r]
+batchTransmissions' batch bSize
+  | batch = addBatch . foldr addTransmission ([], 0, 0, [], [])
+  | otherwise = map mkBatch1 . L.toList
+  where
+    mkBatch1 :: (SentRawTransmission, r) -> TransportBatch r
+    mkBatch1 (t, r)
+      -- 2 bytes are reserved for pad size
+      | B.length s <= bSize - 2 = TBTransmission s r
+      | otherwise = TBLargeTransmission r
+      where
+        s = tEncode t
+    -- 3 = 2 bytes reserved for pad size + 1 for transmission count
+    bSize' = bSize - 3
+    addTransmission :: (SentRawTransmission, r) -> ([TransportBatch r], Int, Int, [ByteString], [r]) -> ([TransportBatch r], Int, Int, [ByteString], [r])
+    addTransmission (t, r) acc@(bs, len, n, ss, rs)
+      | len' <= bSize' && n < 255 = (bs, len', 1 + n, s : ss, r : rs)
+      | sLen <= bSize' = (addBatch acc, sLen, 1, [s], [r])
+      | otherwise = (TBLargeTransmission r : addBatch acc, 0, 0, [], [])
+      where
+        s = tEncodeForBatch t
+        sLen = B.length s
+        len' = len + sLen
+    addBatch :: ([TransportBatch r], Int, Int, [ByteString], [r]) -> [TransportBatch r]
+    addBatch (bs, _len, n, ss, rs) = if n == 0 then bs else TBTransmissions b n rs : bs
+      where
+        b = B.concat $ B.singleton (lenEncode n) : ss
+
+tEncode :: SentRawTransmission -> ByteString
 tEncode (sig, t) = smpEncode (C.signatureBytes sig) <> t
+{-# INLINE tEncode #-}

-tEncodeBatch :: Int -> ByteString -> ByteString
-tEncodeBatch n s = lenEncode n `B.cons` s
+tEncodeForBatch :: SentRawTransmission -> ByteString
+tEncodeForBatch = smpEncode . Large . tEncode
+{-# INLINE tEncodeForBatch #-}
+
+tEncodeBatch1 :: SentRawTransmission -> ByteString
+tEncodeBatch1 t = lenEncode 1 `B.cons` tEncodeForBatch t
+{-# INLINE tEncodeBatch1 #-}

 encodeTransmission :: ProtocolEncoding e c => Version -> ByteString -> Transmission c -> ByteString
 encodeTransmission v sessionId (CorrId corrId, queueId, command) =
  smpEncode (sessionId, corrId, queueId) <> encodeProtocol v command
+{-# INLINE encodeTransmission #-}

 -- | Receive and parse transmission from the TCP transport (ignoring any trailing padding).
 tGetParse :: Transport c => THandle c -> IO (NonEmpty (Either TransportError RawTransmission))
 tGetParse th = eitherList (tParse $ batch th) <$> tGetBlock th
+{-# INLINE tGetParse #-}

 tParse :: Bool -> ByteString -> NonEmpty (Either TransportError RawTransmission)
 tParse batch s
@@ -1310,8 +1379,8 @@ tDecodeParseValidate :: forall err cmd. ProtocolEncoding err cmd => SessionId ->
 tDecodeParseValidate sessionId v = \case
  Right RawTransmission {signature, signed, sessId, corrId, entityId, command}
    | sessId == sessionId ->
-      let decodedTransmission = (,corrId,entityId,command) <$> C.decodeSignature signature
-       in either (const $ tError corrId) (tParseValidate signed) decodedTransmission
+        let decodedTransmission = (,corrId,entityId,command) <$> C.decodeSignature signature
+         in either (const $ tError corrId) (tParseValidate signed) decodedTransmission
    | otherwise -> (Nothing, "", (CorrId corrId, "", Left $ fromProtocolError @err @cmd PESession))
  Left _ -> tError ""
  where
@@ -1322,3 +1391,9 @@ tDecodeParseValidate sessionId v = \case
    tParseValidate signed t@(sig, corrId, entityId, command) =
      let cmd = parseProtocol @err @cmd v command >>= checkCredentials t
       in (sig, signed, (CorrId corrId, entityId, cmd))
+
+$(J.deriveJSON defaultJSON ''MsgFlags)
+
+$(J.deriveJSON (sumTypeJSON id) ''CommandError)
+
+$(J.deriveJSON (sumTypeJSON id) ''ErrorType)
@@ -1,3 +1,5 @@
+{-# LANGUAGE BangPatterns #-}
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
@@ -31,6 +33,7 @@ module Simplex.Messaging.Server
    disconnectTransport,
    verifyCmdSignature,
    dummyVerifyCmd,
+    randomId,
  )
 where

@@ -47,6 +50,7 @@ import qualified Data.ByteString.Char8 as B
 import Data.Either (fromRight, partitionEithers)
 import Data.Functor (($>))
 import Data.Int (Int64)
+import qualified Data.IntMap.Strict as IM
 import Data.List (intercalate)
 import qualified Data.List.NonEmpty as L
 import qualified Data.Map.Strict as M
@@ -57,33 +61,44 @@ import Data.Time.Clock (UTCTime (..), diffTimeToPicoseconds, getCurrentTime)
 import Data.Time.Clock.System (SystemTime (..), getSystemTime)
 import Data.Time.Format.ISO8601 (iso8601Show)
 import Data.Type.Equality
+import GHC.Stats (getRTSStats)
 import GHC.TypeLits (KnownNat)
-import Network.Socket (ServiceName)
+import Network.Socket (ServiceName, Socket, socketToHandle)
+import Simplex.Messaging.Agent.Lock
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding (Encoding (smpEncode))
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol
-import Simplex.Messaging.Server.Env.STM
+import Simplex.Messaging.Server.Control
+import Simplex.Messaging.Server.Env.STM as Env
 import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Server.MsgStore
 import Simplex.Messaging.Server.MsgStore.STM
 import Simplex.Messaging.Server.QueueStore
-import Simplex.Messaging.Server.QueueStore.STM
+import Simplex.Messaging.Server.QueueStore.STM as QS
 import Simplex.Messaging.Server.Stats
 import Simplex.Messaging.Server.StoreLog
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport
+import Simplex.Messaging.Transport.Buffer (trimCR)
 import Simplex.Messaging.Transport.Server
 import Simplex.Messaging.Util
 import System.Exit (exitFailure)
-import System.IO (hPutStrLn)
+import System.IO (hPrint, hPutStrLn, hSetNewlineMode, universalNewlineMode)
 import System.Mem.Weak (deRefWeak)
+import UnliftIO (timeout)
 import UnliftIO.Concurrent
 import UnliftIO.Directory (doesFileExist, renameFile)
 import UnliftIO.Exception
 import UnliftIO.IO
 import UnliftIO.STM
+#if MIN_VERSION_base(4,18,0)
+import Data.List (sort)
+import Data.Maybe (fromMaybe)
+import GHC.Conc (listThreads, threadStatus)
+import GHC.Conc.Sync (threadLabel)
+#endif

 -- | Runs an SMP server using passed configuration.
 --
@@ -105,38 +120,45 @@ type M a = ReaderT Env IO a
 smpServer :: TMVar Bool -> ServerConfig -> M ()
 smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do
  s <- asks server
-  restoreServerMessages
-  restoreServerStats
+  expired <- restoreServerMessages
+  restoreServerStats expired
  raceAny_
-    ( serverThread s subscribedQ subscribers subscriptions cancelSub :
-      serverThread s ntfSubscribedQ notifiers ntfSubscriptions (\_ -> pure ()) :
-      map runServer transports <> expireMessagesThread_ cfg <> serverStatsThread_ cfg
+    ( serverThread s "server subscribedQ" subscribedQ subscribers subscriptions cancelSub
+        : serverThread s "server ntfSubscribedQ" ntfSubscribedQ Env.notifiers ntfSubscriptions (\_ -> pure ())
+        : map runServer transports <> expireMessagesThread_ cfg <> serverStatsThread_ cfg <> controlPortThread_ cfg
    )
-    `finally` (withLog closeStoreLog >> saveServerMessages >> saveServerStats)
+    `finally` withLock (savingLock s) "final" (saveServer False)
  where
    runServer :: (ServiceName, ATransport) -> M ()
    runServer (tcpPort, ATransport t) = do
      serverParams <- asks tlsServerParams
-      runTransportServer started tcpPort serverParams tCfg (runClient t)
+      ss <- asks sockets
+      runTransportServerState ss started tcpPort serverParams tCfg (runClient t)
+
+    saveServer :: Bool -> M ()
+    saveServer keepMsgs = withLog closeStoreLog >> saveServerMessages keepMsgs >> saveServerStats

    serverThread ::
      forall s.
      Server ->
-      (Server -> TBQueue (QueueId, Client)) ->
+      String ->
+      (Server -> TQueue (QueueId, Client)) ->
      (Server -> TMap QueueId Client) ->
      (Client -> TMap QueueId s) ->
      (s -> IO ()) ->
      M ()
-    serverThread s subQ subs clientSubs unsub = forever $ do
-      atomically updateSubscribers
-        $>>= endPreviousSubscriptions
-        >>= liftIO . mapM_ unsub
+    serverThread s label subQ subs clientSubs unsub = do
+      labelMyThread label
+      forever $
+        atomically updateSubscribers
+          $>>= endPreviousSubscriptions
+          >>= liftIO . mapM_ unsub
      where
        updateSubscribers :: STM (Maybe (QueueId, Client))
        updateSubscribers = do
-          (qId, clnt) <- readTBQueue $ subQ s
-          let clientToBeNotified = \c' ->
-                if sameClientSession clnt c'
+          (qId, clnt) <- readTQueue $ subQ s
+          let clientToBeNotified c' =
+                if sameClientId clnt c'
                  then pure Nothing
                  else do
                    yes <- readTVar $ connected c'
@@ -144,8 +166,12 @@ smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do
          TM.lookupInsert qId clnt (subs s) $>>= clientToBeNotified
        endPreviousSubscriptions :: (QueueId, Client) -> M (Maybe s)
        endPreviousSubscriptions (qId, c) = do
-          void . forkIO . atomically $
-            writeTBQueue (sndQ c) [(CorrId "", qId, END)]
+          tId <- atomically $ stateTVar (endThreadSeq c) $ \next -> (next, next + 1)
+          t <- forkIO $ do
+            labelMyThread $ label <> ".endPreviousSubscriptions"
+            atomically $ writeTBQueue (sndQ c) [(CorrId "", qId, END)]
+            atomically $ modifyTVar' (endThreads c) $ IM.delete tId
+          mkWeakThreadId t >>= atomically . modifyTVar' (endThreads c) . IM.insert tId
          atomically $ TM.lookupDelete qId (clientSubs c)

    expireMessagesThread_ :: ServerConfig -> [M ()]
@@ -157,13 +183,16 @@ smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do
      ms <- asks msgStore
      quota <- asks $ msgQueueQuota . config
      let interval = checkInterval expCfg * 1000000
+      stats <- asks serverStats
+      labelMyThread "expireMessages"
      forever $ do
        liftIO $ threadDelay' interval
        old <- liftIO $ expireBeforeEpoch expCfg
        rIds <- M.keysSet <$> readTVarIO ms
-        forM_ rIds $ \rId ->
-          atomically (getMsgQueue ms rId quota)
-            >>= atomically . (`deleteExpiredMsgs` old)
+        forM_ rIds $ \rId -> do
+          q <- atomically (getMsgQueue ms rId quota)
+          deleted <- atomically $ deleteExpiredMsgs q old
+          atomically $ modifyTVar' (msgExpired stats) (+ deleted)

    serverStatsThread_ :: ServerConfig -> [M ()]
    serverStatsThread_ ServerConfig {logStatsInterval = Just interval, logStatsStartTime, serverStatsLogFile} =
@@ -172,14 +201,15 @@ smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do

    logServerStats :: Int64 -> Int64 -> FilePath -> M ()
    logServerStats startAt logInterval statsFilePath = do
+      labelMyThread "logServerStats"
      initialDelay <- (startAt -) . fromIntegral . (`div` 1000000_000000) . diffTimeToPicoseconds . utctDayTime <$> liftIO getCurrentTime
      liftIO $ putStrLn $ "server stats log enabled: " <> statsFilePath
      liftIO $ threadDelay' $ 1000000 * (initialDelay + if initialDelay < 0 then 86400 else 0)
-      ServerStats {fromTime, qCreated, qSecured, qDeleted, msgSent, msgRecv, activeQueues, msgSentNtf, msgRecvNtf, activeQueuesNtf, qCount, msgCount} <- asks serverStats
+      ServerStats {fromTime, qCreated, qSecured, qDeleted, msgSent, msgRecv, msgExpired, activeQueues, msgSentNtf, msgRecvNtf, activeQueuesNtf, qCount, msgCount} <- asks serverStats
      let interval = 1000000 * logInterval
-      withFile statsFilePath AppendMode $ \h -> liftIO $ do
-        hSetBuffering h LineBuffering
-        forever $ do
+      forever $ do
+        withFile statsFilePath AppendMode $ \h -> liftIO $ do
+          hSetBuffering h LineBuffering
          ts <- getCurrentTime
          fromTime' <- atomically $ swapTVar fromTime ts
          qCreated' <- atomically $ swapTVar qCreated 0
@@ -187,6 +217,7 @@ smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do
          qDeleted' <- atomically $ swapTVar qDeleted 0
          msgSent' <- atomically $ swapTVar msgSent 0
          msgRecv' <- atomically $ swapTVar msgRecv 0
+          msgExpired' <- atomically $ swapTVar msgExpired 0
          ps <- atomically $ periodStatCounts activeQueues ts
          msgSentNtf' <- atomically $ swapTVar msgSentNtf 0
          msgRecvNtf' <- atomically $ swapTVar msgRecvNtf 0
@@ -211,47 +242,177 @@ smpServer started cfg@ServerConfig {transports, transportConfig = tCfg} = do
                weekCount psNtf,
                monthCount psNtf,
                show qCount',
-                show msgCount'
+                show msgCount',
+                show msgExpired'
              ]
-          threadDelay' interval
+        liftIO $ threadDelay' interval

    runClient :: Transport c => TProxy c -> c -> M ()
-    runClient _ h = do
+    runClient tp h = do
      kh <- asks serverIdentity
-      smpVRange <- asks $ smpServerVRange . config
-      liftIO (runExceptT $ smpServerHandshake h kh smpVRange) >>= \case
-        Right th -> runClientTransport th
-        Left _ -> pure ()
+      ServerConfig {smpServerVRange, smpHandshakeTimeout} <- asks config
+      labelMyThread $ "smp handshake for " <> transportName tp
+      liftIO (timeout smpHandshakeTimeout . runExceptT $ smpServerHandshake h kh smpServerVRange) >>= \case
+        Just (Right th) -> runClientTransport th
+        _ -> pure ()
+
+    controlPortThread_ :: ServerConfig -> [M ()]
+    controlPortThread_ ServerConfig {controlPort = Just port} = [runCPServer port]
+    controlPortThread_ _ = []
+
+    runCPServer :: ServiceName -> M ()
+    runCPServer port = do
+      srv <- asks server
+      cpStarted <- newEmptyTMVarIO
+      u <- askUnliftIO
+      liftIO $ do
+        labelMyThread "control port server"
+        runTCPServer cpStarted port $ runCPClient u srv
+      where
+        runCPClient :: UnliftIO (ReaderT Env IO) -> Server -> Socket -> IO ()
+        runCPClient u srv sock = do
+          labelMyThread "control port client"
+          h <- socketToHandle sock ReadWriteMode
+          hSetBuffering h LineBuffering
+          hSetNewlineMode h universalNewlineMode
+          hPutStrLn h "SMP server control port\n'help' for supported commands"
+          cpLoop h
+          where
+            cpLoop h = do
+              s <- B.hGetLine h
+              case strDecode $ trimCR s of
+                Right CPQuit -> hClose h
+                Right cmd -> processCP h cmd >> cpLoop h
+                Left err -> hPutStrLn h ("error: " <> err) >> cpLoop h
+            processCP h = \case
+              CPSuspend -> hPutStrLn h "suspend not implemented"
+              CPResume -> hPutStrLn h "resume not implemented"
+              CPClients -> do
+                active <- unliftIO u (asks clients) >>= readTVarIO
+                hPutStrLn h $ "clientId,sessionId,connected,createdAt,rcvActiveAt,sndActiveAt,age,subscriptions"
+                forM_ (IM.toList active) $ \(cid, Client {sessionId, connected, createdAt, rcvActiveAt, sndActiveAt, subscriptions}) -> do
+                  connected' <- bshow <$> readTVarIO connected
+                  rcvActiveAt' <- strEncode <$> readTVarIO rcvActiveAt
+                  sndActiveAt' <- strEncode <$> readTVarIO sndActiveAt
+                  now <- liftIO getSystemTime
+                  let age = systemSeconds now - systemSeconds createdAt
+                  subscriptions' <- bshow . M.size <$> readTVarIO subscriptions
+                  hPutStrLn h . B.unpack $ B.intercalate "," [bshow cid, encode sessionId, connected', strEncode createdAt, rcvActiveAt', sndActiveAt', bshow age, subscriptions']
+              CPStats -> do
+                ServerStats {fromTime, qCreated, qSecured, qDeleted, msgSent, msgRecv, msgSentNtf, msgRecvNtf, qCount, msgCount} <- unliftIO u $ asks serverStats
+                putStat "fromTime" fromTime
+                putStat "qCreated" qCreated
+                putStat "qSecured" qSecured
+                putStat "qDeleted" qDeleted
+                putStat "msgSent" msgSent
+                putStat "msgRecv" msgRecv
+                putStat "msgSentNtf" msgSentNtf
+                putStat "msgRecvNtf" msgRecvNtf
+                putStat "qCount" qCount
+                putStat "msgCount" msgCount
+                where
+                  putStat :: Show a => String -> TVar a -> IO ()
+                  putStat label var = readTVarIO var >>= \v -> hPutStrLn h $ label <> ": " <> show v
+              CPStatsRTS -> getRTSStats >>= hPrint h
+              CPThreads -> do
+#if MIN_VERSION_base(4,18,0)
+                threads <- liftIO listThreads
+                hPutStrLn h $ "Threads: " <> show (length threads)
+                forM_ (sort threads) $ \tid -> do
+                  label <- threadLabel tid
+                  status <- threadStatus tid
+                  hPutStrLn h $ show tid <> " (" <> show status <> ") " <> fromMaybe "" label
+#else
+                hPutStrLn h "Not available on GHC 8.10"
+#endif
+              CPSockets -> do
+                (accepted', closed', active') <- unliftIO u $ asks sockets
+                (accepted, closed, active) <- atomically $ (,,) <$> readTVar accepted' <*> readTVar closed' <*> readTVar active'
+                hPutStrLn h "Sockets: "
+                hPutStrLn h $ "accepted: " <> show accepted
+                hPutStrLn h $ "closed: " <> show closed
+                hPutStrLn h $ "active: " <> show (IM.size active)
+                hPutStrLn h $ "leaked: " <> show (accepted - closed - IM.size active)
+              CPSocketThreads -> do
+#if MIN_VERSION_base(4,18,0)
+                (_, _, active') <- unliftIO u $ asks sockets
+                active <- readTVarIO active'
+                forM_ (IM.toList active) $ \(sid, tid') ->
+                  deRefWeak tid' >>= \case
+                    Nothing -> hPutStrLn h $ intercalate "," [show sid, "", "gone", ""]
+                    Just tid -> do
+                      label <- threadLabel tid
+                      status <- threadStatus tid
+                      hPutStrLn h $ intercalate "," [show sid, show tid, show status, fromMaybe "" label]
+#else
+                hPutStrLn h "Not available on GHC 8.10"
+#endif
+              CPDelete queueId' -> unliftIO u $ do
+                st <- asks queueStore
+                ms <- asks msgStore
+                stats <- asks serverStats
+                queueId <- atomically (getQueue st SSender queueId') >>= \case
+                  Left _ -> pure queueId' -- fallback to using as recipientId directly
+                  Right QueueRec {recipientId} -> pure recipientId
+                r <- atomically $
+                  deleteQueue st queueId $>>= \() ->
+                    Right <$> delMsgQueueSize ms queueId
+                case r of
+                  Left e -> liftIO . hPutStrLn h $ "error: " <> show e
+                  Right numDeleted -> do
+                    withLog (`logDeleteQueue` queueId)
+                    atomically $ modifyTVar' (qDeleted stats) (+ 1)
+                    atomically $ modifyTVar' (qCount stats) (subtract 1)
+                    liftIO . hPutStrLn h $ "ok, " <> show numDeleted <> " messages deleted"
+              CPSave -> withLock (savingLock srv) "control" $ do
+                hPutStrLn h "saving server state..."
+                unliftIO u $ saveServer True
+                hPutStrLn h "server state saved!"
+              CPHelp -> hPutStrLn h "commands: stats, stats-rts, clients, sockets, socket-threads, threads, delete, save, help, quit"
+              CPQuit -> pure ()
+              CPSkip -> pure ()

 runClientTransport :: Transport c => THandle c -> M ()
 runClientTransport th@THandle {thVersion, sessionId} = do
  q <- asks $ tbqSize . config
  ts <- liftIO getSystemTime
-  c <- atomically $ newClient q thVersion sessionId ts
+  active <- asks clients
+  nextClientId <- asks clientSeq
+  c <- atomically $ do
+    new@Client {clientId} <- newClient nextClientId q thVersion sessionId ts
+    modifyTVar' active $ IM.insert clientId new
+    pure new
  s <- asks server
  expCfg <- asks $ inactiveClientExpiration . config
+  labelMyThread . B.unpack $ "client $" <> encode sessionId
  raceAny_ ([liftIO $ send th c, client c s, receive th c] <> disconnectThread_ c expCfg)
    `finally` clientDisconnected c
  where
-    disconnectThread_ c (Just expCfg) = [liftIO $ disconnectTransport th c activeAt expCfg]
+    disconnectThread_ c (Just expCfg) = [liftIO $ disconnectTransport th (rcvActiveAt c) (sndActiveAt c) expCfg (noSubscriptions c)]
    disconnectThread_ _ _ = []
+    noSubscriptions c = atomically $ (&&) <$> TM.null (subscriptions c) <*> TM.null (ntfSubscriptions c)

 clientDisconnected :: Client -> M ()
-clientDisconnected c@Client {subscriptions, connected} = do
-  atomically $ writeTVar connected False
-  subs <- readTVarIO subscriptions
+clientDisconnected c@Client {clientId, subscriptions, connected, sessionId, endThreads} = do
+  labelMyThread . B.unpack $ "client $" <> encode sessionId <> " disc"
+  subs <- atomically $ do
+    writeTVar connected False
+    swapTVar subscriptions M.empty
  liftIO $ mapM_ cancelSub subs
-  atomically $ writeTVar subscriptions M.empty
-  cs <- asks $ subscribers . server
-  atomically . mapM_ (\rId -> TM.update deleteCurrentClient rId cs) $ M.keys subs
+  srvSubs <- asks $ subscribers . server
+  atomically $ modifyTVar' srvSubs $ \cs ->
+    M.foldrWithKey (\sub _ -> M.update deleteCurrentClient sub) cs subs
+  asks clients >>= atomically . (`modifyTVar'` IM.delete clientId)
+  tIds <- atomically $ swapTVar endThreads IM.empty
+  liftIO $ mapM_ (mapM_ killThread <=< deRefWeak) tIds
  where
    deleteCurrentClient :: Client -> Maybe Client
    deleteCurrentClient c'
-      | sameClientSession c c' = Nothing
+      | sameClientId c c' = Nothing
      | otherwise = Just c'

-sameClientSession :: Client -> Client -> Bool
-sameClientSession Client {sessionId} Client {sessionId = s'} = sessionId == s'
+sameClientId :: Client -> Client -> Bool
+sameClientId Client {clientId} Client {clientId = cId'} = clientId == cId'

 cancelSub :: TVar Sub -> IO ()
 cancelSub sub =
@@ -260,12 +421,14 @@ cancelSub sub =
    _ -> return ()

 receive :: Transport c => THandle c -> Client -> M ()
-receive th Client {rcvQ, sndQ, activeAt} = forever $ do
-  ts <- L.toList <$> liftIO (tGet th)
-  atomically . writeTVar activeAt =<< liftIO getSystemTime
-  as <- partitionEithers <$> mapM cmdAction ts
-  write sndQ $ fst as
-  write rcvQ $ snd as
+receive th Client {rcvQ, sndQ, rcvActiveAt, sessionId} = do
+  labelMyThread . B.unpack $ "client $" <> encode sessionId <> " receive"
+  forever $ do
+    ts <- L.toList <$> liftIO (tGet th)
+    atomically . writeTVar rcvActiveAt =<< liftIO getSystemTime
+    as <- partitionEithers <$> mapM cmdAction ts
+    write sndQ $ fst as
+    write rcvQ $ snd as
  where
    cmdAction :: SignedTransmission ErrorType Cmd -> M (Either (Transmission BrokerMsg) (Maybe QueueRec, Transmission Cmd))
    cmdAction (sig, signed, (corrId, queueId, cmdOrError)) =
@@ -279,10 +442,12 @@ receive th Client {rcvQ, sndQ, activeAt} = forever $ do
    write q = mapM_ (atomically . writeTBQueue q) . L.nonEmpty

 send :: Transport c => THandle c -> Client -> IO ()
-send h@THandle {thVersion = v} Client {sndQ, sessionId, activeAt} = forever $ do
-  ts <- atomically $ L.sortWith tOrder <$> readTBQueue sndQ
-  void . liftIO . tPut h Nothing $ L.map ((Nothing,) . encodeTransmission v sessionId) ts
-  atomically . writeTVar activeAt =<< liftIO getSystemTime
+send h@THandle {thVersion = v} Client {sndQ, sessionId, sndActiveAt} = do
+  labelMyThread . B.unpack $ "client $" <> encode sessionId <> " send"
+  forever $ do
+    ts <- atomically $ L.sortWith tOrder <$> readTBQueue sndQ
+    void . liftIO . tPut h $ L.map ((Nothing,) . encodeTransmission v sessionId) ts
+    atomically . writeTVar sndActiveAt =<< liftIO getSystemTime
  where
    tOrder :: Transmission BrokerMsg -> Int
    tOrder (_, _, cmd) = case cmd of
@@ -290,21 +455,25 @@ send h@THandle {thVersion = v} Client {sndQ, sessionId, activeAt} = forever $ do
      NMSG {} -> 0
      _ -> 1

-disconnectTransport :: Transport c => THandle c -> client -> (client -> TVar SystemTime) -> ExpirationConfig -> IO ()
-disconnectTransport THandle {connection} c activeAt expCfg = do
-  let interval = checkInterval expCfg * 1000000
-  forever . liftIO $ do
-    threadDelay' interval
-    old <- expireBeforeEpoch expCfg
-    ts <- readTVarIO $ activeAt c
-    when (systemSeconds ts < old) $ closeConnection connection
+disconnectTransport :: Transport c => THandle c -> TVar SystemTime -> TVar SystemTime -> ExpirationConfig -> IO Bool -> IO ()
+disconnectTransport THandle {connection, sessionId} rcvActiveAt sndActiveAt expCfg noSubscriptions = do
+  labelMyThread . B.unpack $ "client $" <> encode sessionId <> " disconnectTransport"
+  loop
+  where
+    loop = do
+      threadDelay' $ checkInterval expCfg * 1000000
+      ifM noSubscriptions checkExpired loop
+    checkExpired = do
+      old <- expireBeforeEpoch expCfg
+      ts <- max <$> readTVarIO rcvActiveAt <*> readTVarIO sndActiveAt
+      if systemSeconds ts < old then closeConnection connection else loop

 data VerificationResult = VRVerified (Maybe QueueRec) | VRFailed

 verifyTransmission :: Maybe C.ASignature -> ByteString -> QueueId -> Cmd -> M VerificationResult
 verifyTransmission sig_ signed queueId cmd =
  case cmd of
-    Cmd SRecipient (NEW k _ _) -> pure $ Nothing `verified` verifyCmdSignature sig_ signed k
+    Cmd SRecipient (NEW k _ _ _) -> pure $ Nothing `verified` verifyCmdSignature sig_ signed k
    Cmd SRecipient _ -> verifyCmd SRecipient $ verifyCmdSignature sig_ signed . recipientKey
    Cmd SSender SEND {} -> verifyCmd SSender $ verifyMaybe . senderKey
    Cmd SSender PING -> pure $ VRVerified Nothing
@@ -347,7 +516,8 @@ dummyKeyEd448 :: C.PublicKey 'C.Ed448
 dummyKeyEd448 = "MEMwBQYDK2VxAzoA6ibQc9XpkSLtwrf7PLvp81qW/etiumckVFImCMRdftcG/XopbOSaq9qyLhrgJWKOLyNrQPNVvpMA"

 client :: forall m. (MonadUnliftIO m, MonadReader Env m) => Client -> Server -> m ()
-client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Server {subscribedQ, ntfSubscribedQ, notifiers} =
+client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ, sessionId} Server {subscribedQ, ntfSubscribedQ, notifiers} = do
+  labelMyThread . B.unpack $ "client $" <> encode sessionId <> " commands"
  forever $
    atomically (readTBQueue rcvQ)
      >>= mapM processCommand
@@ -364,10 +534,10 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
        Cmd SNotifier NSUB -> subscribeNotifications
        Cmd SRecipient command ->
          case command of
-            NEW rKey dhKey auth ->
+            NEW rKey dhKey auth subMode ->
              ifM
                allowNew
-                (createQueue st rKey dhKey)
+                (createQueue st rKey dhKey subMode)
                (pure (corrId, queueId, ERR AUTH))
              where
                allowNew = do
@@ -382,9 +552,9 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
            OFF -> suspendQueue_ st
            DEL -> delQueueAndMsgs st
      where
-        createQueue :: QueueStore -> RcvPublicVerifyKey -> RcvPublicDhKey -> m (Transmission BrokerMsg)
-        createQueue st recipientKey dhKey = time "NEW" $ do
-          (rcvPublicDhKey, privDhKey) <- liftIO C.generateKeyPair'
+        createQueue :: QueueStore -> RcvPublicVerifyKey -> RcvPublicDhKey -> SubscriptionMode -> m (Transmission BrokerMsg)
+        createQueue st recipientKey dhKey subMode = time "NEW" $ do
+          (rcvPublicDhKey, privDhKey) <- atomically . C.generateKeyPair =<< asks random
          let rcvDhSecret = C.dh' dhKey privDhKey
              qik (rcvId, sndId) = QIK {rcvId, sndId, rcvPublicDhKey}
              qRec (recipientId, senderId) =
@@ -414,7 +584,10 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
                  stats <- asks serverStats
                  atomically $ modifyTVar' (qCreated stats) (+ 1)
                  atomically $ modifyTVar' (qCount stats) (+ 1)
-                  subscribeQueue qr rId $> IDS (qik ids)
+                  case subMode of
+                    SMOnlyCreate -> pure ()
+                    SMSubscribe -> void $ subscribeQueue qr rId
+                  pure $ IDS (qik ids)

            logCreateById :: StoreLog 'WriteMode -> RecipientId -> IO ()
            logCreateById s rId =
@@ -436,7 +609,7 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv

        addQueueNotifier_ :: QueueStore -> NtfPublicVerifyKey -> RcvNtfPublicDhKey -> m (Transmission BrokerMsg)
        addQueueNotifier_ st notifierKey dhKey = time "NKEY" $ do
-          (rcvPublicDhKey, privDhKey) <- liftIO C.generateKeyPair'
+          (rcvPublicDhKey, privDhKey) <- atomically . C.generateKeyPair =<< asks random
          let rcvNtfDhSecret = C.dh' dhKey privDhKey
          (corrId,queueId,) <$> addNotifierRetry 3 rcvPublicDhKey rcvNtfDhSecret
          where
@@ -477,7 +650,7 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
          where
            newSub :: m (TVar Sub)
            newSub = time "SUB newSub" . atomically $ do
-              writeTBQueue subscribedQ (rId, clnt)
+              writeTQueue subscribedQ (rId, clnt)
              sub <- newTVar =<< newSubscription NoSub
              TM.insert rId sub subscriptions
              pure sub
@@ -522,7 +695,7 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
        subscribeNotifications :: m (Transmission BrokerMsg)
        subscribeNotifications = time "NSUB" . atomically $ do
          unlessM (TM.member queueId ntfSubscriptions) $ do
-            writeTBQueue ntfSubscribedQ (queueId, clnt)
+            writeTQueue ntfSubscribedQ (queueId, clnt)
            TM.insert queueId () ntfSubscriptions
          pure ok

@@ -568,27 +741,27 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
        sendMessage qr msgFlags msgBody
          | B.length msgBody > maxMessageLength = pure $ err LARGE_MSG
          | otherwise = case status qr of
-            QueueOff -> return $ err AUTH
-            QueueActive ->
-              case C.maxLenBS msgBody of
-                Left _ -> pure $ err LARGE_MSG
-                Right body -> do
-                  msg_ <- time "SEND" $ do
-                    q <- getStoreMsgQueue "SEND" $ recipientId qr
-                    expireMessages q
-                    atomically . writeMsg q =<< mkMessage body
-                  case msg_ of
-                    Nothing -> pure $ err QUOTA
-                    Just msg -> time "SEND ok" $ do
-                      stats <- asks serverStats
-                      when (notification msgFlags) $ do
-                        atomically . trySendNotification msg =<< asks idsDrg
-                        atomically $ modifyTVar' (msgSentNtf stats) (+ 1)
-                        atomically $ updatePeriodStats (activeQueuesNtf stats) (recipientId qr)
-                      atomically $ modifyTVar' (msgSent stats) (+ 1)
-                      atomically $ modifyTVar' (msgCount stats) (subtract 1)
-                      atomically $ updatePeriodStats (activeQueues stats) (recipientId qr)
-                      pure ok
+              QueueOff -> return $ err AUTH
+              QueueActive ->
+                case C.maxLenBS msgBody of
+                  Left _ -> pure $ err LARGE_MSG
+                  Right body -> do
+                    msg_ <- time "SEND" $ do
+                      q <- getStoreMsgQueue "SEND" $ recipientId qr
+                      expireMessages q
+                      atomically . writeMsg q =<< mkMessage body
+                    case msg_ of
+                      Nothing -> pure $ err QUOTA
+                      Just msg -> time "SEND ok" $ do
+                        stats <- asks serverStats
+                        when (notification msgFlags) $ do
+                          atomically . trySendNotification msg =<< asks random
+                          atomically $ modifyTVar' (msgSentNtf stats) (+ 1)
+                          atomically $ updatePeriodStats (activeQueuesNtf stats) (recipientId qr)
+                        atomically $ modifyTVar' (msgSent stats) (+ 1)
+                        atomically $ modifyTVar' (msgCount stats) (subtract 1)
+                        atomically $ updatePeriodStats (activeQueues stats) (recipientId qr)
+                        pure ok
          where
            mkMessage :: C.MaxLenBS MaxMessageLen -> m Message
            mkMessage body = do
@@ -600,7 +773,9 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
            expireMessages q = do
              msgExp <- asks $ messageExpiration . config
              old <- liftIO $ mapM expireBeforeEpoch msgExp
-              atomically $ mapM_ (deleteExpiredMsgs q) old
+              stats <- asks serverStats
+              deleted <- atomically $ sum <$> mapM (deleteExpiredMsgs q) old
+              atomically $ modifyTVar' (msgExpired stats) (+ deleted)

            trySendNotification :: Message -> TVar ChaChaDRG -> STM ()
            trySendNotification msg ntfNonceDrg =
@@ -617,7 +792,7 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv

            mkMessageNotification :: ByteString -> SystemTime -> RcvNtfDhSecret -> TVar ChaChaDRG -> STM (C.CbNonce, EncNMsgMeta)
            mkMessageNotification msgId msgTs rcvNtfDhSecret ntfNonceDrg = do
-              cbNonce <- C.pseudoRandomCbNonce ntfNonceDrg
+              cbNonce <- C.randomCbNonce ntfNonceDrg
              let msgMeta = NMsgMeta {msgId, msgTs}
                  encNMsgMeta = C.cbEncrypt rcvNtfDhSecret cbNonce (smpEncode msgMeta) 128
              pure . (cbNonce,) $ fromRight "" encNMsgMeta
@@ -642,6 +817,7 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
                s -> s
              where
                subscriber = do
+                  labelMyThread $ B.unpack ("client $" <> encode sessionId) <> " subscriber/" <> T.unpack name
                  msg <- atomically $ peekMsg q
                  time "subscriber" . atomically $ do
                    let encMsg = encryptMsg qr msg
@@ -665,11 +841,11 @@ client clnt@Client {thVersion, subscriptions, ntfSubscriptions, rcvQ, sndQ} Serv
            encrypt msgFlags body =
              let encBody = EncRcvMsgBody $ C.cbEncryptMaxLenBS (rcvDhSecret qr) (C.cbNonce msgId') body
               in RcvMessage msgId' msgTs' msgFlags encBody
-            msgId' = msgId (msg :: Message)
-            msgTs' = msgTs (msg :: Message)
+            msgId' = messageId msg
+            msgTs' = messageTs msg

        setDelivered :: Sub -> Message -> STM Bool
-        setDelivered s msg = tryPutTMVar (delivered s) $ msgId (msg :: Message)
+        setDelivered s msg = tryPutTMVar (delivered s) (messageId msg)

        getStoreMsgQueue :: T.Text -> RecipientId -> m MsgQueue
        getStoreMsgQueue name rId = time (name <> " getMsgQueue") $ do
@@ -716,12 +892,10 @@ timed name qId a = do
    sec = 1000_000000

 randomId :: (MonadUnliftIO m, MonadReader Env m) => Int -> m ByteString
-randomId n = do
-  gVar <- asks idsDrg
-  atomically (C.pseudoRandomBytes n gVar)
+randomId n = atomically . C.randomBytes n =<< asks random

-saveServerMessages :: (MonadUnliftIO m, MonadReader Env m) => m ()
-saveServerMessages = asks (storeMsgsFile . config) >>= mapM_ saveMessages
+saveServerMessages :: (MonadUnliftIO m, MonadReader Env m) => Bool -> m ()
+saveServerMessages keepMsgs = asks (storeMsgsFile . config) >>= mapM_ saveMessages
  where
    saveMessages f = do
      logInfo $ "saving messages to file " <> T.pack f
@@ -730,28 +904,32 @@ saveServerMessages = asks (storeMsgsFile . config) >>= mapM_ saveMessages
        readTVarIO ms >>= mapM_ (saveQueueMsgs ms h) . M.keys
      logInfo "messages saved"
      where
+        getMessages = if keepMsgs then snapshotMsgQueue else flushMsgQueue
        saveQueueMsgs ms h rId =
-          atomically (flushMsgQueue ms rId)
+          atomically (getMessages ms rId)
            >>= mapM_ (B.hPutStrLn h . strEncode . MLRv3 rId)

-restoreServerMessages :: forall m. (MonadUnliftIO m, MonadReader Env m) => m ()
-restoreServerMessages = asks (storeMsgsFile . config) >>= mapM_ restoreMessages
+restoreServerMessages :: forall m. (MonadUnliftIO m, MonadReader Env m) => m Int
+restoreServerMessages = asks (storeMsgsFile . config) >>= \case
+  Just f -> ifM (doesFileExist f) (restoreMessages f) (pure 0)
+  Nothing -> pure 0
  where
-    restoreMessages f = whenM (doesFileExist f) $ do
+    restoreMessages f = do
      logInfo $ "restoring messages from file " <> T.pack f
      st <- asks queueStore
      ms <- asks msgStore
      quota <- asks $ msgQueueQuota . config
      old_ <- asks (messageExpiration . config) $>>= (liftIO . fmap Just . expireBeforeEpoch)
-      runExceptT (liftIO (B.readFile f) >>= mapM_ (restoreMsg st ms quota old_) . B.lines) >>= \case
+      runExceptT (liftIO (B.readFile f) >>= foldM (\expired -> restoreMsg expired st ms quota old_) 0 . B.lines) >>= \case
        Left e -> do
          logError . T.pack $ "error restoring messages: " <> e
          liftIO exitFailure
-        _ -> do
+        Right expired -> do
          renameFile f $ f <> ".bak"
          logInfo "messages restored"
+          pure expired
      where
-        restoreMsg st ms quota old_ s = do
+        restoreMsg !expired st ms quota old_ s = do
          r <- liftEither . first (msgErr "parsing") $ strDecode s
          case r of
            MLRv3 rId msg -> addToMsgQueue rId msg
@@ -761,14 +939,15 @@ restoreServerMessages = asks (storeMsgsFile . config) >>= mapM_ restoreMessages
              addToMsgQueue rId msg'
          where
            addToMsgQueue rId msg = do
-              logFull <- atomically $ do
+              (isExpired, logFull) <- atomically $ do
                q <- getMsgQueue ms rId quota
                case msg of
                  Message {msgTs}
-                    | maybe True (systemSeconds msgTs >=) old_ -> isNothing <$> writeMsg q msg
-                    | otherwise -> pure False
-                  MessageQuota {} -> writeMsg q msg $> False
-              when logFull . logError . decodeLatin1 $ "message queue " <> strEncode rId <> " is full, message not restored: " <> strEncode (msgId (msg :: Message))
+                    | maybe True (systemSeconds msgTs >=) old_ -> (False,) . isNothing <$> writeMsg q msg
+                    | otherwise -> pure (True, False)
+                  MessageQuota {} -> writeMsg q msg $> (False, False)
+              when logFull . logError . decodeLatin1 $ "message queue " <> strEncode rId <> " is full, message not restored: " <> strEncode (messageId msg)
+              pure $ if isExpired then expired + 1 else expired
            updateMsgV1toV3 QueueRec {rcvDhSecret} RcvMessage {msgId, msgTs, msgFlags, msgBody = EncRcvMsgBody body} = do
              let nonce = C.cbNonce msgId
              msgBody <- liftEither . first (msgErr "v1 message decryption") $ C.maxLenBS =<< C.cbDecrypt rcvDhSecret nonce body
@@ -786,19 +965,21 @@ saveServerStats =
      B.writeFile f $ strEncode stats
      logInfo "server stats saved"

-restoreServerStats :: (MonadUnliftIO m, MonadReader Env m) => m ()
-restoreServerStats = asks (serverStatsBackupFile . config) >>= mapM_ restoreStats
+restoreServerStats :: (MonadUnliftIO m, MonadReader Env m) => Int -> m ()
+restoreServerStats expiredWhileRestoring = asks (serverStatsBackupFile . config) >>= mapM_ restoreStats
  where
    restoreStats f = whenM (doesFileExist f) $ do
      logInfo $ "restoring server stats from file " <> T.pack f
      liftIO (strDecode <$> B.readFile f) >>= \case
-        Right d -> do
+        Right d@ServerStatsData {_qCount = statsQCount} -> do
          s <- asks serverStats
-          _qCount <- fmap (length . M.keys) . readTVarIO . queues =<< asks queueStore
-          _msgCount <- foldM (\n q -> (n +) <$> readTVarIO (size q)) 0 =<< readTVarIO =<< asks msgStore
-          atomically $ setServerStats s d {_qCount, _msgCount}
+          _qCount <- fmap M.size . readTVarIO . queues =<< asks queueStore
+          _msgCount <- foldM (\(!n) q -> (n +) <$> readTVarIO (size q)) 0 =<< readTVarIO =<< asks msgStore
+          atomically $ setServerStats s d {_qCount, _msgCount, _msgExpired = _msgExpired d + expiredWhileRestoring}
          renameFile f $ f <> ".bak"
          logInfo "server stats restored"
+          when (_qCount /= statsQCount) $ logWarn $ "Queue count differs: stats: " <> tshow statsQCount <> ", store: " <> tshow _qCount
+          logInfo $ "Restored " <> tshow _msgCount <> " messages in " <> tshow _qCount <> " queues"
        Left e -> do
          logInfo $ "error restoring server stats: " <> T.pack e
          liftIO exitFailure
@@ -0,0 +1,55 @@
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE OverloadedStrings #-}
+
+module Simplex.Messaging.Server.Control where
+
+import qualified Data.Attoparsec.ByteString.Char8 as A
+import Data.ByteString (ByteString)
+import Simplex.Messaging.Encoding.String
+
+data ControlProtocol
+  = CPSuspend
+  | CPResume
+  | CPClients
+  | CPStats
+  | CPStatsRTS
+  | CPThreads
+  | CPSockets
+  | CPSocketThreads
+  | CPDelete ByteString
+  | CPSave
+  | CPHelp
+  | CPQuit
+  | CPSkip
+
+instance StrEncoding ControlProtocol where
+  strEncode = \case
+    CPSuspend -> "suspend"
+    CPResume -> "resume"
+    CPClients -> "clients"
+    CPStats -> "stats"
+    CPStatsRTS -> "stats-rts"
+    CPThreads -> "threads"
+    CPSockets -> "sockets"
+    CPSocketThreads -> "socket-threads"
+    CPDelete bs -> "delete " <> strEncode bs
+    CPSave -> "save"
+    CPHelp -> "help"
+    CPQuit -> "quit"
+    CPSkip -> ""
+  strP =
+    A.takeTill (== ' ') >>= \case
+      "suspend" -> pure CPSuspend
+      "resume" -> pure CPResume
+      "clients" -> pure CPClients
+      "stats" -> pure CPStats
+      "stats-rts" -> pure CPStatsRTS
+      "threads" -> pure CPThreads
+      "sockets" -> pure CPSockets
+      "socket-threads" -> pure CPSocketThreads
+      "delete" -> CPDelete <$> (A.space *> strP)
+      "save" -> pure CPSave
+      "help" -> pure CPHelp
+      "quit" -> pure CPQuit
+      "" -> pure CPSkip
+      _ -> fail "bad ControlProtocol command"
@@ -10,6 +10,8 @@ import Control.Monad.IO.Unlift
 import Crypto.Random
 import Data.ByteString.Char8 (ByteString)
 import Data.Int (Int64)
+import Data.IntMap.Strict (IntMap)
+import qualified Data.IntMap.Strict as IM
 import Data.List.NonEmpty (NonEmpty)
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
@@ -19,7 +21,9 @@ import Data.X509.Validation (Fingerprint (..))
 import Network.Socket (ServiceName)
 import qualified Network.TLS as T
 import Numeric.Natural
+import Simplex.Messaging.Agent.Lock
 import Simplex.Messaging.Crypto (KeyHash (..))
+import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Protocol
 import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Server.MsgStore.STM
@@ -30,7 +34,7 @@ import Simplex.Messaging.Server.StoreLog
 import Simplex.Messaging.TMap (TMap)
 import qualified Simplex.Messaging.TMap as TM
 import Simplex.Messaging.Transport (ATransport)
-import Simplex.Messaging.Transport.Server (loadFingerprint, loadTLSServerParams, TransportServerConfig)
+import Simplex.Messaging.Transport.Server (SocketState, TransportServerConfig, loadFingerprint, loadTLSServerParams, newSocketState)
 import Simplex.Messaging.Version
 import System.IO (IOMode (..))
 import System.Mem.Weak (Weak)
@@ -38,8 +42,9 @@ import UnliftIO.STM

 data ServerConfig = ServerConfig
  { transports :: [(ServiceName, ATransport)],
+    smpHandshakeTimeout :: Int,
    tbqSize :: Natural,
-    serverTbqSize :: Natural,
+    -- serverTbqSize :: Natural,
    msgQueueQuota :: Int,
    queueIdBytes :: Int,
    msgIdBytes :: Int,
@@ -70,7 +75,9 @@ data ServerConfig = ServerConfig
    -- | SMP client-server protocol version range
    smpServerVRange :: VersionRange,
    -- | TCP transport config
-    transportConfig :: TransportServerConfig
+    transportConfig :: TransportServerConfig,
+    -- | run listener on control port
+    controlPort :: Maybe ServiceName
  }

 defMsgExpirationDays :: Int64
@@ -86,8 +93,8 @@ defaultMessageExpiration =
 defaultInactiveClientExpiration :: ExpirationConfig
 defaultInactiveClientExpiration =
  ExpirationConfig
-    { ttl = 86400, -- seconds, 24 hours
-      checkInterval = 43200 -- seconds, 12 hours
+    { ttl = 43200, -- seconds, 12 hours
+      checkInterval = 3600 -- seconds, 1 hours
    }

 data Env = Env
@@ -96,28 +103,37 @@ data Env = Env
    serverIdentity :: KeyHash,
    queueStore :: QueueStore,
    msgStore :: STMMsgStore,
-    idsDrg :: TVar ChaChaDRG,
+    random :: TVar ChaChaDRG,
    storeLog :: Maybe (StoreLog 'WriteMode),
    tlsServerParams :: T.ServerParams,
-    serverStats :: ServerStats
+    serverStats :: ServerStats,
+    sockets :: SocketState,
+    clientSeq :: TVar Int,
+    clients :: TVar (IntMap Client)
  }

 data Server = Server
-  { subscribedQ :: TBQueue (RecipientId, Client),
+  { subscribedQ :: TQueue (RecipientId, Client),
    subscribers :: TMap RecipientId Client,
-    ntfSubscribedQ :: TBQueue (NotifierId, Client),
-    notifiers :: TMap NotifierId Client
+    ntfSubscribedQ :: TQueue (NotifierId, Client),
+    notifiers :: TMap NotifierId Client,
+    savingLock :: Lock
  }

 data Client = Client
-  { subscriptions :: TMap RecipientId (TVar Sub),
+  { clientId :: Int,
+    subscriptions :: TMap RecipientId (TVar Sub),
    ntfSubscriptions :: TMap NotifierId (),
    rcvQ :: TBQueue (NonEmpty (Maybe QueueRec, Transmission Cmd)),
    sndQ :: TBQueue (NonEmpty (Transmission BrokerMsg)),
+    endThreads :: TVar (IntMap (Weak ThreadId)),
+    endThreadSeq :: TVar Int,
    thVersion :: Version,
    sessionId :: ByteString,
    connected :: TVar Bool,
-    activeAt :: TVar SystemTime
+    createdAt :: SystemTime,
+    rcvActiveAt :: TVar SystemTime,
+    sndActiveAt :: TVar SystemTime
  }

 data SubscriptionThread = NoSub | SubPending | SubThread (Weak ThreadId) | ProhibitSub
@@ -127,23 +143,28 @@ data Sub = Sub
    delivered :: TMVar MsgId
  }

-newServer :: Natural -> STM Server
-newServer qSize = do
-  subscribedQ <- newTBQueue qSize
+newServer :: STM Server
+newServer = do
+  subscribedQ <- newTQueue
  subscribers <- TM.empty
-  ntfSubscribedQ <- newTBQueue qSize
+  ntfSubscribedQ <- newTQueue
  notifiers <- TM.empty
-  return Server {subscribedQ, subscribers, ntfSubscribedQ, notifiers}
+  savingLock <- createLock
+  return Server {subscribedQ, subscribers, ntfSubscribedQ, notifiers, savingLock}

-newClient :: Natural -> Version -> ByteString -> SystemTime -> STM Client
-newClient qSize thVersion sessionId ts = do
+newClient :: TVar Int -> Natural -> Version -> ByteString -> SystemTime -> STM Client
+newClient nextClientId qSize thVersion sessionId createdAt = do
+  clientId <- stateTVar nextClientId $ \next -> (next, next + 1)
  subscriptions <- TM.empty
  ntfSubscriptions <- TM.empty
  rcvQ <- newTBQueue qSize
  sndQ <- newTBQueue qSize
+  endThreads <- newTVar IM.empty
+  endThreadSeq <- newTVar 0
  connected <- newTVar True
-  activeAt <- newTVar ts
-  return Client {subscriptions, ntfSubscriptions, rcvQ, sndQ, thVersion, sessionId, connected, activeAt}
+  rcvActiveAt <- newTVar createdAt
+  sndActiveAt <- newTVar createdAt
+  return Client {clientId, subscriptions, ntfSubscriptions, rcvQ, sndQ, endThreads, endThreadSeq, thVersion, sessionId, connected, createdAt, rcvActiveAt, sndActiveAt}

 newSubscription :: SubscriptionThread -> STM Sub
 newSubscription subThread = do
@@ -152,26 +173,28 @@ newSubscription subThread = do

 newEnv :: forall m. (MonadUnliftIO m, MonadRandom m) => ServerConfig -> m Env
 newEnv config@ServerConfig {caCertificateFile, certificateFile, privateKeyFile, storeLogFile} = do
-  server <- atomically $ newServer (serverTbqSize config)
+  server <- atomically newServer
  queueStore <- atomically newQueueStore
  msgStore <- atomically newMsgStore
-  idsDrg <- drgNew >>= newTVarIO
-  storeLog <- liftIO $ openReadStoreLog `mapM` storeLogFile
-  s' <- restoreQueues queueStore `mapM` storeLog
+  random <- liftIO C.newRandom
+  storeLog <- restoreQueues queueStore `mapM` storeLogFile
  tlsServerParams <- liftIO $ loadTLSServerParams caCertificateFile certificateFile privateKeyFile
  Fingerprint fp <- liftIO $ loadFingerprint caCertificateFile
  let serverIdentity = KeyHash fp
  serverStats <- atomically . newServerStats =<< liftIO getCurrentTime
-  return Env {config, server, serverIdentity, queueStore, msgStore, idsDrg, storeLog = s', tlsServerParams, serverStats}
+  sockets <- atomically newSocketState
+  clientSeq <- newTVarIO 0
+  clients <- newTVarIO mempty
+  return Env {config, server, serverIdentity, queueStore, msgStore, random, storeLog, tlsServerParams, serverStats, sockets, clientSeq, clients}
  where
-    restoreQueues :: QueueStore -> StoreLog 'ReadMode -> m (StoreLog 'WriteMode)
-    restoreQueues QueueStore {queues, senders, notifiers} s = do
-      (qs, s') <- liftIO $ readWriteStoreLog s
+    restoreQueues :: QueueStore -> FilePath -> m (StoreLog 'WriteMode)
+    restoreQueues QueueStore {queues, senders, notifiers} f = do
+      (qs, s) <- liftIO $ readWriteStoreLog f
      atomically $ do
        writeTVar queues =<< mapM newTVar qs
        writeTVar senders $! M.foldr' addSender M.empty qs
        writeTVar notifiers $! M.foldr' addNotifier M.empty qs
-      pure s'
+      pure s
    addSender :: QueueRec -> Map SenderId RecipientId -> Map SenderId RecipientId
    addSender q = M.insert (senderId q) (recipientId q)
    addNotifier :: QueueRec -> Map NotifierId RecipientId -> Map NotifierId RecipientId
@@ -8,10 +8,9 @@

 module Simplex.Messaging.Server.Main where

+import Control.Concurrent.STM
 import Control.Monad (void)
-import Crypto.Random (getRandomBytes)
 import qualified Data.ByteString.Char8 as B
-import Data.Either (fromRight)
 import Data.Functor (($>))
 import Data.Ini (lookupValue, readIniFile)
 import Data.Maybe (fromMaybe)
@@ -24,7 +23,7 @@ import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol (BasicAuth (..), ProtoServerWithAuth (ProtoServerWithAuth), pattern SMPServer)
 import Simplex.Messaging.Server (runSMPServer)
 import Simplex.Messaging.Server.CLI
-import Simplex.Messaging.Server.Env.STM (ServerConfig (..), defaultInactiveClientExpiration, defaultMessageExpiration, defMsgExpirationDays)
+import Simplex.Messaging.Server.Env.STM (ServerConfig (..), defMsgExpirationDays, defaultInactiveClientExpiration, defaultMessageExpiration)
 import Simplex.Messaging.Server.Expiration
 import Simplex.Messaging.Transport (simplexMQVersion, supportedSMPServerVRange)
 import Simplex.Messaging.Transport.Client (TransportHost (..))
@@ -60,15 +59,15 @@ smpServerCLI cfgPath logPath =
    initializeServer opts
      | scripted opts = initialize opts
      | otherwise = do
-        putStrLn "Use `smp-server init -h` for available options."
-        void $ withPrompt "SMP server will be initialized (press Enter)" getLine
-        enableStoreLog <- onOffPrompt "Enable store log to restore queues and messages on server restart" True
-        logStats <- onOffPrompt "Enable logging daily statistics" False
-        putStrLn "Require a password to create new messaging queues?"
-        password <- withPrompt "'r' for random (default), 'n' - no password, or enter password: " serverPassword
-        let host = fromMaybe (ip opts) (fqdn opts)
-        host' <- withPrompt ("Enter server FQDN or IP address for certificate (" <> host <> "): ") getLine
-        initialize opts {enableStoreLog, logStats, fqdn = if null host' then fqdn opts else Just host', password}
+          putStrLn "Use `smp-server init -h` for available options."
+          void $ withPrompt "SMP server will be initialized (press Enter)" getLine
+          enableStoreLog <- onOffPrompt "Enable store log to restore queues and messages on server restart" True
+          logStats <- onOffPrompt "Enable logging daily statistics" False
+          putStrLn "Require a password to create new messaging queues?"
+          password <- withPrompt "'r' for random (default), 'n' - no password, or enter password: " serverPassword
+          let host = fromMaybe (ip opts) (fqdn opts)
+          host' <- withPrompt ("Enter server FQDN or IP address for certificate (" <> host <> "): ") getLine
+          initialize opts {enableStoreLog, logStats, fqdn = if null host' then fqdn opts else Just host', password}
      where
        serverPassword =
          getLine >>= \case
@@ -96,7 +95,7 @@ smpServerCLI cfgPath logPath =
          where
            createServerPassword = \case
              ServerPassword s -> pure s
-              SPRandom -> BasicAuth . strEncode <$> (getRandomBytes 32 :: IO B.ByteString)
+              SPRandom -> BasicAuth . strEncode <$> (atomically . C.randomBytes 32 =<< C.newRandom)
            iniFileContent host basicAuth =
              "[STORE_LOG]\n\
              \# The server uses STM memory for persistence,\n\
@@ -121,8 +120,8 @@ smpServerCLI cfgPath logPath =
                   \# The password will not be shared with the connecting contacts, you must share it only\n\
                   \# with the users who you want to allow creating messaging queues on your server.\n"
                <> ( case basicAuth of
-                       Just auth -> "create_password: " <> T.unpack (safeDecodeUtf8 $ strEncode auth)
-                       _ -> "# create_password: password to create new queues (any printable ASCII characters without whitespace, '@', ':' and '/')"
+                      Just auth -> "create_password: " <> T.unpack (safeDecodeUtf8 $ strEncode auth)
+                      _ -> "# create_password: password to create new queues (any printable ASCII characters without whitespace, '@', ':' and '/')"
                   )
                <> "\n\n\
                   \[TRANSPORT]\n\
@@ -130,7 +129,8 @@ smpServerCLI cfgPath logPath =
                <> ("host: " <> host <> "\n")
                <> ("port: " <> defaultServerPort <> "\n")
                <> "log_tls_errors: off\n\
-                   \websockets: off\n\n\
+                   \websockets: off\n\
+                   \# control_port: 5224\n\n\
                   \[INACTIVE_CLIENTS]\n\
                   \# TTL and interval to check inactive clients\n\
                   \disconnect: off\n"
@@ -140,7 +140,7 @@ smpServerCLI cfgPath logPath =
      hSetBuffering stdout LineBuffering
      hSetBuffering stderr LineBuffering
      fp <- checkSavedFingerprint cfgPath defaultX509Config
-      let host = fromRight "<hostnames>" $ T.unpack <$> lookupValue "TRANSPORT" "host" ini
+      let host = either (const "<hostnames>") T.unpack $ lookupValue "TRANSPORT" "host" ini
          port = T.unpack $ strictIni "TRANSPORT" "port" ini
          cfg@ServerConfig {transports, storeLogFile, newQueueBasicAuth, messageExpiration, inactiveClientExpiration} = serverConfig
          srv = ProtoServerWithAuth (SMPServer [THDomainName host] (if port == "5223" then "" else port) (C.KeyHash fp)) newQueueBasicAuth
@@ -165,8 +165,9 @@ smpServerCLI cfgPath logPath =
        serverConfig =
          ServerConfig
            { transports = iniTransports ini,
+              smpHandshakeTimeout = 120000000,
              tbqSize = 64,
-              serverTbqSize = 1024,
+              -- serverTbqSize = 1024,
              msgQueueQuota = 128,
              queueIdBytes = 24,
              msgIdBytes = 24, -- must be at least 24 bytes, it is used as 192-bit nonce for XSalsa20
@@ -185,9 +186,10 @@ smpServerCLI cfgPath logPath =
              allowNewQueues = fromMaybe True $ iniOnOff "AUTH" "new_queues" ini,
              newQueueBasicAuth = either error id <$> strDecodeIni "AUTH" "create_password" ini,
              messageExpiration =
-                Just defaultMessageExpiration
-                  { ttl = 86400 * readIniDefault defMsgExpirationDays "STORE_LOG" "expire_messages_days" ini
-                  },
+                Just
+                  defaultMessageExpiration
+                    { ttl = 86400 * readIniDefault defMsgExpirationDays "STORE_LOG" "expire_messages_days" ini
+                    },
              inactiveClientExpiration =
                settingIsOn "INACTIVE_CLIENTS" "disconnect" ini
                  $> ExpirationConfig
@@ -202,7 +204,8 @@ smpServerCLI cfgPath logPath =
              transportConfig =
                defaultTransportServerConfig
                  { logTLSErrors = fromMaybe False $ iniOnOff "TRANSPORT" "log_tls_errors" ini
-                  }
+                  },
+              controlPort = either (const Nothing) (Just . T.unpack) $ lookupValue "TRANSPORT" "control_port" ini
            }

 data CliCommand
@@ -12,7 +12,9 @@ module Simplex.Messaging.Server.MsgStore.STM
    newMsgStore,
    getMsgQueue,
    delMsgQueue,
+    delMsgQueueSize,
    flushMsgQueue,
+    snapshotMsgQueue,
    writeMsg,
    tryPeekMsg,
    peekMsg,
@@ -23,7 +25,6 @@ module Simplex.Messaging.Server.MsgStore.STM
 where

 import Control.Concurrent.STM.TQueue (flushTQueue)
-import Control.Monad (when)
 import qualified Data.ByteString.Char8 as B
 import Data.Functor (($>))
 import Data.Int (Int64)
@@ -59,9 +60,20 @@ getMsgQueue st rId quota = maybe newQ pure =<< TM.lookup rId st
 delMsgQueue :: STMMsgStore -> RecipientId -> STM ()
 delMsgQueue st rId = TM.delete rId st

+delMsgQueueSize :: STMMsgStore -> RecipientId -> STM Int
+delMsgQueueSize st rId = TM.lookupDelete rId st >>= maybe (pure 0) (\MsgQueue {size} -> readTVar size)
+
 flushMsgQueue :: STMMsgStore -> RecipientId -> STM [Message]
 flushMsgQueue st rId = TM.lookupDelete rId st >>= maybe (pure []) (flushTQueue . msgQueue)

+snapshotMsgQueue :: STMMsgStore -> RecipientId -> STM [Message]
+snapshotMsgQueue st rId = TM.lookup rId st >>= maybe (pure []) (snapshotTQueue . msgQueue)
+  where
+    snapshotTQueue q = do
+      msgs <- flushTQueue q
+      mapM_ (writeTQueue q) msgs
+      pure msgs
+
 writeMsg :: MsgQueue -> Message -> STM (Maybe Message)
 writeMsg MsgQueue {msgQueue = q, quota, canWrite, size} msg = do
  canWrt <- readTVar canWrite
@@ -103,15 +115,15 @@ tryDelPeekMsg mq msgId' =
      | otherwise -> pure (Nothing, msg_)
    _ -> pure (Nothing, Nothing)

-deleteExpiredMsgs :: MsgQueue -> Int64 -> STM ()
-deleteExpiredMsgs mq old = loop
+deleteExpiredMsgs :: MsgQueue -> Int64 -> STM Int
+deleteExpiredMsgs mq old = loop 0
  where
-    loop = tryPeekMsg mq >>= mapM_ delOldMsg
-    delOldMsg = \case
-      Message {msgTs} ->
-        when (systemSeconds msgTs < old) $
-          tryDeleteMsg mq >> loop
-      _ -> pure ()
+    loop dc =
+      tryPeekMsg mq >>= \case
+        Just Message {msgTs}
+          | systemSeconds msgTs < old ->
+              tryDeleteMsg mq >> loop (dc + 1)
+        _ -> pure dc

 tryDeleteMsg :: MsgQueue -> STM ()
 tryDeleteMsg MsgQueue {msgQueue = q, size} =
@@ -11,7 +11,7 @@ import qualified Data.Attoparsec.ByteString.Char8 as A
 import qualified Data.ByteString.Char8 as B
 import Data.Set (Set)
 import qualified Data.Set as S
-import Data.Time.Calendar.Month.Compat (pattern MonthDay)
+import Data.Time.Calendar.Month (pattern MonthDay)
 import Data.Time.Calendar.OrdinalDate (mondayStartWeek)
 import Data.Time.Clock (UTCTime (..))
 import Simplex.Messaging.Encoding.String
@@ -25,6 +25,7 @@ data ServerStats = ServerStats
    qDeleted :: TVar Int,
    msgSent :: TVar Int,
    msgRecv :: TVar Int,
+    msgExpired :: TVar Int,
    activeQueues :: PeriodStats RecipientId,
    msgSentNtf :: TVar Int,
    msgRecvNtf :: TVar Int,
@@ -40,6 +41,7 @@ data ServerStatsData = ServerStatsData
    _qDeleted :: Int,
    _msgSent :: Int,
    _msgRecv :: Int,
+    _msgExpired :: Int,
    _activeQueues :: PeriodStatsData RecipientId,
    _msgSentNtf :: Int,
    _msgRecvNtf :: Int,
@@ -57,13 +59,14 @@ newServerStats ts = do
  qDeleted <- newTVar 0
  msgSent <- newTVar 0
  msgRecv <- newTVar 0
+  msgExpired <- newTVar 0
  activeQueues <- newPeriodStats
  msgSentNtf <- newTVar 0
  msgRecvNtf <- newTVar 0
  activeQueuesNtf <- newPeriodStats
  qCount <- newTVar 0
  msgCount <- newTVar 0
-  pure ServerStats {fromTime, qCreated, qSecured, qDeleted, msgSent, msgRecv, activeQueues, msgSentNtf, msgRecvNtf, activeQueuesNtf, qCount, msgCount}
+  pure ServerStats {fromTime, qCreated, qSecured, qDeleted, msgSent, msgRecv, msgExpired, activeQueues, msgSentNtf, msgRecvNtf, activeQueuesNtf, qCount, msgCount}

 getServerStatsData :: ServerStats -> STM ServerStatsData
 getServerStatsData s = do
@@ -73,13 +76,14 @@ getServerStatsData s = do
  _qDeleted <- readTVar $ qDeleted s
  _msgSent <- readTVar $ msgSent s
  _msgRecv <- readTVar $ msgRecv s
+  _msgExpired <- readTVar $ msgExpired s
  _activeQueues <- getPeriodStatsData $ activeQueues s
  _msgSentNtf <- readTVar $ msgSentNtf s
  _msgRecvNtf <- readTVar $ msgRecvNtf s
  _activeQueuesNtf <- getPeriodStatsData $ activeQueuesNtf s
  _qCount <- readTVar $ qCount s
  _msgCount <- readTVar $ msgCount s
-  pure ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _activeQueues, _msgSentNtf, _msgRecvNtf, _activeQueuesNtf, _qCount, _msgCount}
+  pure ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _msgExpired, _activeQueues, _msgSentNtf, _msgRecvNtf, _activeQueuesNtf, _qCount, _msgCount}

 setServerStats :: ServerStats -> ServerStatsData -> STM ()
 setServerStats s d = do
@@ -89,22 +93,25 @@ setServerStats s d = do
  writeTVar (qDeleted s) $! _qDeleted d
  writeTVar (msgSent s) $! _msgSent d
  writeTVar (msgRecv s) $! _msgRecv d
+  writeTVar (msgExpired s) $! _msgExpired d
  setPeriodStats (activeQueues s) (_activeQueues d)
  writeTVar (msgSentNtf s) $! _msgSentNtf d
  writeTVar (msgRecvNtf s) $! _msgRecvNtf d
  setPeriodStats (activeQueuesNtf s) (_activeQueuesNtf d)
  writeTVar (qCount s) $! _qCount d
-  writeTVar (msgCount s) $! _qCount d
+  writeTVar (msgCount s) $! _msgCount d

 instance StrEncoding ServerStatsData where
-  strEncode ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _msgSentNtf, _msgRecvNtf, _activeQueues, _activeQueuesNtf} =
+  strEncode ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _msgExpired, _msgSentNtf, _msgRecvNtf, _activeQueues, _activeQueuesNtf, _qCount, _msgCount} =
    B.unlines
      [ "fromTime=" <> strEncode _fromTime,
        "qCreated=" <> strEncode _qCreated,
        "qSecured=" <> strEncode _qSecured,
        "qDeleted=" <> strEncode _qDeleted,
+        "qCount=" <> strEncode _qCount,
        "msgSent=" <> strEncode _msgSent,
        "msgRecv=" <> strEncode _msgRecv,
+        "msgExpired=" <> strEncode _msgExpired,
        "msgSentNtf=" <> strEncode _msgSentNtf,
        "msgRecvNtf=" <> strEncode _msgRecvNtf,
        "activeQueues:",
@@ -117,8 +124,10 @@ instance StrEncoding ServerStatsData where
    _qCreated <- "qCreated=" *> strP <* A.endOfLine
    _qSecured <- "qSecured=" *> strP <* A.endOfLine
    _qDeleted <- "qDeleted=" *> strP <* A.endOfLine
+    _qCount <- "qCount=" *> strP <* A.endOfLine <|> pure 0
    _msgSent <- "msgSent=" *> strP <* A.endOfLine
    _msgRecv <- "msgRecv=" *> strP <* A.endOfLine
+    _msgExpired <- "msgExpired=" *> strP <* A.endOfLine <|> pure 0
    _msgSentNtf <- "msgSentNtf=" *> strP <* A.endOfLine <|> pure 0
    _msgRecvNtf <- "msgRecvNtf=" *> strP <* A.endOfLine <|> pure 0
    _activeQueues <-
@@ -133,7 +142,7 @@ instance StrEncoding ServerStatsData where
      optional ("activeQueuesNtf:" <* A.endOfLine) >>= \case
        Just _ -> strP <* optional A.endOfLine
        _ -> pure newPeriodStatsData
-    pure ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _msgSentNtf, _msgRecvNtf, _activeQueues, _activeQueuesNtf, _qCount = 0, _msgCount = 0}
+    pure ServerStatsData {_fromTime, _qCreated, _qSecured, _qDeleted, _msgSent, _msgRecv, _msgExpired, _msgSentNtf, _msgRecvNtf, _activeQueues, _activeQueuesNtf, _qCount, _msgCount = 0}

 data PeriodStats a = PeriodStats
  { day :: TVar (Set a),
@@ -4,7 +4,6 @@
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE TupleSections #-}
 {-# OPTIONS_GHC -fno-warn-orphans #-}

 module Simplex.Messaging.Server.StoreLog
@@ -25,20 +24,17 @@ module Simplex.Messaging.Server.StoreLog
 where

 import Control.Applicative (optional, (<|>))
-import Control.Monad (unless)
-import Data.Bifunctor (first, second)
+import Control.Monad (foldM, unless, when)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
-import qualified Data.ByteString.Lazy.Char8 as LB
-import Data.Either (partitionEithers)
 import Data.Functor (($>))
-import Data.List (foldl')
 import Data.Map.Strict (Map)
 import qualified Data.Map.Strict as M
 import Simplex.Messaging.Encoding.String
 import Simplex.Messaging.Protocol
 import Simplex.Messaging.Server.QueueStore (NtfCreds (..), QueueRec (..), ServerQueueStatus (..))
 import Simplex.Messaging.Transport.Buffer (trimCR)
+import Simplex.Messaging.Util (ifM)
 import System.Directory (doesFileExist)
 import System.IO

@@ -118,7 +114,7 @@ closeStoreLog = \case

 writeStoreLogRecord :: StrEncoding r => StoreLog 'WriteMode -> r -> IO ()
 writeStoreLogRecord (WriteStoreLog _ h) r = do
-  B.hPutStrLn h $ strEncode r
+  B.hPut h $ strEncode r `B.snoc` '\n' -- hPutStrLn makes write non-atomic for length > 1024
  hFlush h

 logCreateQueue :: StoreLog 'WriteMode -> QueueRec -> IO ()
@@ -139,37 +135,33 @@ logDeleteQueue s = writeStoreLogRecord s . DeleteQueue
 logDeleteNotifier :: StoreLog 'WriteMode -> QueueId -> IO ()
 logDeleteNotifier s = writeStoreLogRecord s . DeleteNotifier

-readWriteStoreLog :: StoreLog 'ReadMode -> IO (Map RecipientId QueueRec, StoreLog 'WriteMode)
-readWriteStoreLog s@(ReadStoreLog f _) = do
-  qs <- readQueues s
-  closeStoreLog s
-  s' <- openWriteStoreLog f
-  writeQueues s' qs
-  pure (qs, s')
+readWriteStoreLog :: FilePath -> IO (Map RecipientId QueueRec, StoreLog 'WriteMode)
+readWriteStoreLog f = do
+  qs <- ifM (doesFileExist f) (readQueues f) (pure M.empty)
+  s <- openWriteStoreLog f
+  writeQueues s qs
+  pure (qs, s)

 writeQueues :: StoreLog 'WriteMode -> Map RecipientId QueueRec -> IO ()
-writeQueues s = mapM_ (writeStoreLogRecord s . CreateQueue) . M.filter active
+writeQueues s = mapM_ $ \q -> when (active q) $ logCreateQueue s q
  where
    active QueueRec {status} = status == QueueActive

-type LogParsingError = (String, ByteString)
-
-readQueues :: StoreLog 'ReadMode -> IO (Map RecipientId QueueRec)
-readQueues (ReadStoreLog _ h) = LB.hGetContents h >>= returnResult . procStoreLog
+readQueues :: FilePath -> IO (Map RecipientId QueueRec)
+readQueues f = foldM processLine M.empty . B.lines =<< B.readFile f
  where
-    procStoreLog :: LB.ByteString -> ([LogParsingError], Map RecipientId QueueRec)
-    procStoreLog = second (foldl' procLogRecord M.empty) . partitionEithers . map parseLogRecord . LB.lines
-    returnResult :: ([LogParsingError], Map RecipientId QueueRec) -> IO (Map RecipientId QueueRec)
-    returnResult (errs, res) = mapM_ printError errs $> res
-    parseLogRecord :: LB.ByteString -> Either LogParsingError StoreLogRecord
-    parseLogRecord = (\s -> first (,s) $ strDecode s) . trimCR . LB.toStrict
-    procLogRecord :: Map RecipientId QueueRec -> StoreLogRecord -> Map RecipientId QueueRec
-    procLogRecord m = \case
-      CreateQueue q -> M.insert (recipientId q) q m
-      SecureQueue qId sKey -> M.adjust (\q -> q {senderKey = Just sKey}) qId m
-      AddNotifier qId ntfCreds -> M.adjust (\q -> q {notifier = Just ntfCreds}) qId m
-      SuspendQueue qId -> M.adjust (\q -> q {status = QueueOff}) qId m
-      DeleteQueue qId -> M.delete qId m
-      DeleteNotifier qId -> M.adjust (\q -> q {notifier = Nothing}) qId m
-    printError :: LogParsingError -> IO ()
-    printError (e, s) = B.putStrLn $ "Error parsing log: " <> B.pack e <> " - " <> s
+    processLine :: Map RecipientId QueueRec -> ByteString -> IO (Map RecipientId QueueRec)
+    processLine m s = case strDecode $ trimCR s of
+      Right r -> pure $ procLogRecord r
+      Left e -> printError e $> m
+      where
+        procLogRecord :: StoreLogRecord -> Map RecipientId QueueRec
+        procLogRecord = \case
+          CreateQueue q -> M.insert (recipientId q) q m
+          SecureQueue qId sKey -> M.adjust (\q -> q {senderKey = Just sKey}) qId m
+          AddNotifier qId ntfCreds -> M.adjust (\q -> q {notifier = Just ntfCreds}) qId m
+          SuspendQueue qId -> M.adjust (\q -> q {status = QueueOff}) qId m
+          DeleteQueue qId -> M.delete qId m
+          DeleteNotifier qId -> M.adjust (\q -> q {notifier = Nothing}) qId m
+        printError :: String -> IO ()
+        printError e = B.putStrLn $ "Error parsing log: " <> B.pack e <> " - " <> s
@@ -1,7 +1,6 @@
 {-# LANGUAGE AllowAmbiguousTypes #-}
 {-# LANGUAGE DataKinds #-}
 {-# LANGUAGE DeriveAnyClass #-}
-{-# LANGUAGE DeriveGeneric #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE GADTs #-}
@@ -10,6 +9,7 @@
 {-# LANGUAGE NamedFieldPuns #-}
 {-# LANGUAGE OverloadedStrings #-}
 {-# LANGUAGE ScopedTypeVariables #-}
+{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE TypeApplications #-}

 -- |
@@ -63,31 +63,28 @@ where
 import Control.Applicative ((<|>))
 import Control.Monad.Except
 import Control.Monad.Trans.Except (throwE)
-import Data.Aeson (ToJSON)
-import qualified Data.Aeson as J
+import qualified Data.Aeson.TH as J
 import Data.Attoparsec.ByteString.Char8 (Parser)
+import qualified Data.Attoparsec.ByteString.Char8 as A
 import Data.Bifunctor (first)
 import Data.Bitraversable (bimapM)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
-import qualified Data.ByteString.Lazy as BL
+import qualified Data.ByteString.Lazy.Char8 as LB
 import Data.Default (def)
 import Data.Functor (($>))
 import Data.Version (showVersion)
-import GHC.Generics (Generic)
 import GHC.IO.Handle.Internals (ioe_EOF)
-import Generic.Random (genericArbitraryU)
 import Network.Socket
 import qualified Network.TLS as T
 import qualified Network.TLS.Extra as TE
 import qualified Paths_simplexmq as SMQ
 import qualified Simplex.Messaging.Crypto as C
 import Simplex.Messaging.Encoding
-import Simplex.Messaging.Parsers (dropPrefix, parse, parseRead1, sumTypeJSON)
+import Simplex.Messaging.Parsers (dropPrefix, parseRead1, sumTypeJSON)
 import Simplex.Messaging.Transport.Buffer
 import Simplex.Messaging.Util (bshow, catchAll, catchAll_)
 import Simplex.Messaging.Version
-import Test.QuickCheck (Arbitrary (..))
 import UnliftIO.Exception (Exception)
 import qualified UnliftIO.Exception as E
 import UnliftIO.STM
@@ -98,7 +95,7 @@ smpBlockSize :: Int
 smpBlockSize = 16384

 supportedSMPServerVRange :: VersionRange
-supportedSMPServerVRange = mkVersionRange 1 5
+supportedSMPServerVRange = mkVersionRange 1 6

 simplexMQVersion :: String
 simplexMQVersion = showVersion SMQ.version
@@ -219,10 +216,10 @@ instance Transport TLS where
  cGet :: TLS -> Int -> IO ByteString
  cGet TLS {tlsContext, tlsBuffer, tlsTransportConfig = TransportConfig {transportTimeout = t_}} n =
    getBuffered tlsBuffer n t_ (T.recvData tlsContext)
-      
+
  cPut :: TLS -> ByteString -> IO ()
-  cPut TLS {tlsContext, tlsTransportConfig = TransportConfig {transportTimeout = t_}} s =
-    withTimedErr t_ . T.sendData tlsContext $ BL.fromStrict s
+  cPut TLS {tlsContext, tlsTransportConfig = TransportConfig {transportTimeout = t_}} =
+    withTimedErr t_ . T.sendData tlsContext . LB.fromStrict

  getLn :: TLS -> IO ByteString
  getLn TLS {tlsContext, tlsBuffer} = do
@@ -284,11 +281,7 @@ data TransportError
    TEBadSession
  | -- | transport handshake error
    TEHandshake {handshakeErr :: HandshakeError}
-  deriving (Eq, Generic, Read, Show, Exception)
-
-instance ToJSON TransportError where
-  toJSON = J.genericToJSON . sumTypeJSON $ dropPrefix "TE"
-  toEncoding = J.genericToEncoding . sumTypeJSON $ dropPrefix "TE"
+  deriving (Eq, Read, Show, Exception)

 -- | Transport handshake error.
 data HandshakeError
@@ -298,15 +291,7 @@ data HandshakeError
    VERSION
  | -- | incorrect server identity
    IDENTITY
-  deriving (Eq, Generic, Read, Show, Exception)
-
-instance ToJSON HandshakeError where
-  toJSON = J.genericToJSON $ sumTypeJSON id
-  toEncoding = J.genericToEncoding $ sumTypeJSON id
-
-instance Arbitrary TransportError where arbitrary = genericArbitraryU
-
-instance Arbitrary HandshakeError where arbitrary = genericArbitraryU
+  deriving (Eq, Read, Show, Exception)

 -- | SMP encrypted transport error parser.
 transportErrorP :: Parser TransportError
@@ -348,9 +333,9 @@ smpServerHandshake c kh smpVRange = do
  getHandshake th >>= \case
    ClientHandshake {smpVersion, keyHash}
      | keyHash /= kh ->
-        throwE $ TEHandshake IDENTITY
+          throwE $ TEHandshake IDENTITY
      | smpVersion `isCompatible` smpVRange -> do
-        pure $ smpThHandle th smpVersion
+          pure $ smpThHandle th smpVersion
      | otherwise -> throwE $ TEHandshake VERSION

 -- | Client SMP transport handshake.
@@ -374,8 +359,13 @@ smpThHandle th v = (th :: THandle c) {thVersion = v, batch = v >= 4}
 sendHandshake :: (Transport c, Encoding smp) => THandle c -> smp -> ExceptT TransportError IO ()
 sendHandshake th = ExceptT . tPutBlock th . smpEncode

+-- ignores tail bytes to allow future extensions
 getHandshake :: (Transport c, Encoding smp) => THandle c -> ExceptT TransportError IO smp
-getHandshake th = ExceptT $ (parse smpP (TEHandshake PARSE) =<<) <$> tGetBlock th
+getHandshake th = ExceptT $ (first (\_ -> TEHandshake PARSE) . A.parseOnly smpP =<<) <$> tGetBlock th

 smpTHandle :: Transport c => c -> THandle c
 smpTHandle c = THandle {connection = c, sessionId = tlsUnique c, blockSize = smpBlockSize, thVersion = 0, batch = False}
+
+$(J.deriveJSON (sumTypeJSON id) ''HandshakeError)
+
+$(J.deriveJSON (sumTypeJSON $ dropPrefix "TE") ''TransportError)
@@ -6,10 +6,11 @@ module Simplex.Messaging.Transport.Buffer where

 import Control.Concurrent.STM
 import qualified Control.Exception as E
+import Control.Monad (forM_)
 import Data.ByteString.Char8 (ByteString)
 import qualified Data.ByteString.Char8 as B
+import GHC.IO.Exception (IOErrorType (..), IOException (..), ioException)
 import System.Timeout (timeout)
-import GHC.IO.Exception (ioException, IOException (..), IOErrorType (..))

 data TBuffer = TBuffer
  { buffer :: TVar ByteString,
@@ -28,6 +29,14 @@ withBufferLock TBuffer {getLock} =
    (atomically $ takeTMVar getLock)
    (atomically $ putTMVar getLock ())

+-- | Attempt to read some bytes, appending it to the existing buffer
+peekBuffered :: TBuffer -> Int -> IO ByteString -> IO (ByteString, Maybe ByteString)
+peekBuffered tb@TBuffer {buffer} t getChunk = withBufferLock tb $ do
+  old <- readTVarIO buffer
+  next_ <- timeout t getChunk
+  forM_ next_ $ \next -> atomically $ writeTVar buffer $! old <> next
+  pure (old, next_)
+
 getBuffered :: TBuffer -> Int -> Maybe Int -> IO ByteString -> IO ByteString
 getBuffered tb@TBuffer {buffer} n t_ getChunk = withBufferLock tb $ do
  b <- readChunks True =<< readTVarIO buffer
@@ -41,9 +50,9 @@ getBuffered tb@TBuffer {buffer} n t_ getChunk = withBufferLock tb $ do
    readChunks firstChunk b
      | B.length b >= n = pure b
      | otherwise =
-        get >>= \case
-          "" -> pure b
-          s -> readChunks False $ b <> s
+          get >>= \case
+            "" -> pure b
+            s -> readChunks False $ b <> s
      where
        get
          | firstChunk = getChunk
--- a/Show More
+++ b/Show More