Šepot — end-to-end encrypted messenger

Initial public release. Anonymous on-device identity (no phone number,
e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double
Ratchet, sealed sender) via libsignal, a metadata-minimizing relay,
group chats, disappearing messages, encrypted local storage, optional
Tor transport, and a UI localized into Czech, English, German, Russian,
and Italian.

Monorepo: Flutter client (app/), Rust relay + wire types (rust/),
protobuf definitions (proto/), self-host deploy (deploy/).

Licensed under AGPL-3.0 with an app-store distribution exception (§7).

rust/sepot-proto/src/lib.rs

@@ -0,0 +1,44 @@
+//! Wire typy Šepotu generované z `proto/sepot.proto` (jediný zdroj pravdy).
+
+pub mod v1 {
+    include!(concat!(env!("OUT_DIR"), "/sepot.v1.rs"));
+}
+
+pub use prost::Message;
+
+/// Tvrdý limit velikosti payload obálky (message_queue CHECK).
+pub const MAX_ENVELOPE_PAYLOAD: usize = 256 * 1024;
+
+/// Doménový separátor podpisu AUTH výzvy.
+pub const AUTH_CONTEXT: &[u8] = b"sepot-auth-v1";
+
+#[cfg(test)]
+mod tests {
+    use super::v1::*;
+    use prost::Message;
+
+    #[test]
+    fn envelope_roundtrip() {
+        let env = Envelope {
+            dst_address: vec![7u8; 32],
+            msg_uuid: vec![1u8; 16],
+            content_hint: ContentHint::Default as i32,
+            payload: vec![0xAB; 128],
+        };
+        let bytes = env.encode_to_vec();
+        let back = Envelope::decode(bytes.as_slice()).unwrap();
+        assert_eq!(env, back);
+    }
+
+    #[test]
+    fn client_frame_oneof() {
+        let frame = ClientFrame {
+            frame: Some(client_frame::Frame::Ack(Ack {
+                msg_uuid: vec![9u8; 16],
+            })),
+        };
+        let bytes = frame.encode_to_vec();
+        let back = ClientFrame::decode(bytes.as_slice()).unwrap();
+        assert_eq!(frame, back);
+    }
+}