wip

2025-03-12 11:44:39 +01:00 · 2025-03-12 11:44:39 +01:00 · 2025-03-12 11:44:39 +01:00 · 2025-03-11 16:47:30 +00:00 · 2025-03-11 16:02:00 +01:00 · 2025-03-11 11:18:18 +00:00
112 changed files with 3503 additions and 711 deletions
@@ -4,6 +4,28 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2025.4-dorina-patched] (2025-03-06)
+
+- use legacy crypto for constructing SURB headers ([#5579])
+- bugfix: make sure to correctly decode response content when putting it into error message ([#5571])
+- Tweak surb management to be more conservative ([#5570])
+- Deserialize v5 authenticator requests ([#5568])
+- chore: additional logs when attempting to load ecash keys ([#5567])
+- add full response body to error message upon decoding failure ([#5566])
+- hotfix: ensure we bail on merkle leaves insertion upon missing data ([#5565])
+- feature: v2 authentication request (#5537) ([#5563])
+- Create authenticator v5 request/response types ([#5561])
+
+[#5579]: https://github.com/nymtech/nym/pull/5579
+[#5571]: https://github.com/nymtech/nym/pull/5571
+[#5570]: https://github.com/nymtech/nym/pull/5570
+[#5568]: https://github.com/nymtech/nym/pull/5568
+[#5567]: https://github.com/nymtech/nym/pull/5567
+[#5566]: https://github.com/nymtech/nym/pull/5566
+[#5565]: https://github.com/nymtech/nym/pull/5565
+[#5563]: https://github.com/nymtech/nym/pull/5563
+[#5561]: https://github.com/nymtech/nym/pull/5561
+
 ## [2025.4-dorina] (2025-03-04)

 - fixed sphinx version metrics registration ([#5546])
@@ -902,9 +902,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61dac84819c6588b558454b194026eb1f09c293b9036ae9b159e74e73ab6cf9"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 dependencies = [
 "serde",
 ]
@@ -941,7 +941,7 @@ checksum = "eee4243f1f26fc7a42710e7439c149e2b10b05472f88090acce52632f231a73a"
 dependencies = [
 "camino",
 "cargo-platform",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde_json",
 "thiserror 1.0.69",
@@ -955,7 +955,7 @@ checksum = "2d886547e41f740c616ae73108f6eb70afe6d940c7bc697cb30f13daec073037"
 dependencies = [
 "camino",
 "cargo-platform",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde_json",
 "thiserror 1.0.69",
@@ -1587,7 +1587,7 @@ dependencies = [
 "bitflags 2.8.0",
 "crossterm_winapi",
 "parking_lot",
- "rustix",
+ "rustix 0.38.44",
 "winapi",
 ]

@@ -1799,7 +1799,7 @@ dependencies = [
 "cosmwasm-std",
 "cw2",
 "schemars",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "thiserror 1.0.69",
 ]
@@ -1814,7 +1814,7 @@ dependencies = [
 "cosmwasm-std",
 "cw-storage-plus",
 "schemars",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "thiserror 1.0.69",
 ]
@@ -2433,7 +2433,7 @@ dependencies = [

 [[package]]
 name = "explorer-api"
-version = "1.1.47"
+version = "1.1.48"
 dependencies = [
 "chrono",
 "clap",
@@ -2527,9 +2527,9 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

 [[package]]
 name = "ff"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
 "rand_core 0.6.4",
 "subtle 2.6.1",
@@ -4144,6 +4144,12 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"

+[[package]]
+name = "linux-raw-sys"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9c683daf087dc577b7506e9695b3d556a9f3849903fa28186283afd6809e9"
+
 [[package]]
 name = "lioness"
 version = "0.1.2"
@@ -4780,7 +4786,7 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"

 [[package]]
 name = "nym-api"
-version = "1.1.51"
+version = "1.1.53"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -4841,7 +4847,7 @@ dependencies = [
 "rand_chacha 0.3.1",
 "reqwest 0.12.4",
 "schemars",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde_json",
 "sha2 0.9.9",
@@ -5029,7 +5035,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.49"
+version = "1.1.50"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5112,7 +5118,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.49"
+version = "1.1.50"
 dependencies = [
 "bs58",
 "clap",
@@ -5874,8 +5880,11 @@ name = "nym-http-api-client"
 version = "0.1.0"
 dependencies = [
 "async-trait",
+ "bytes",
+ "encoding_rs",
 "hickory-resolver",
 "http 1.2.0",
+ "mime",
 "nym-bin-common",
 "once_cell",
 "reqwest 0.12.4",
@@ -5951,6 +5960,7 @@ dependencies = [
 "bytes",
 "nym-bin-common",
 "nym-crypto",
+ "nym-sdk",
 "nym-service-provider-requests-common",
 "nym-sphinx",
 "rand 0.8.5",
@@ -5959,6 +5969,7 @@ dependencies = [
 "time",
 "tokio",
 "tokio-util",
+ "tracing",
 ]

 [[package]]
@@ -6052,7 +6063,7 @@ dependencies = [
 "nym-contracts-common",
 "rand_chacha 0.3.1",
 "schemars",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde-json-wasm",
 "serde_repr",
@@ -6153,7 +6164,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.50"
+version = "1.1.51"
 dependencies = [
 "addr",
 "anyhow",
@@ -6204,7 +6215,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.6.0"
+version = "1.6.2"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6253,7 +6264,7 @@ dependencies = [
 "nym-wireguard",
 "nym-wireguard-types",
 "rand 0.8.5",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde_json",
 "si-scale",
@@ -6489,6 +6500,7 @@ name = "nym-pemstore"
 version = "0.3.0"
 dependencies = [
 "pem",
+ "tracing",
 ]

 [[package]]
@@ -6536,6 +6548,7 @@ dependencies = [
 "reqwest 0.12.4",
 "serde",
 "tap",
+ "tempfile",
 "thiserror 2.0.12",
 "tokio",
 "tokio-stream",
@@ -6587,7 +6600,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.49"
+version = "1.1.50"
 dependencies = [
 "bs58",
 "clap",
@@ -7192,7 +7205,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.14"
+version = "0.1.15"
 dependencies = [
 "anyhow",
 "bytes",
@@ -7222,7 +7235,7 @@ dependencies = [

 [[package]]
 name = "nyx-chain-watcher"
-version = "0.1.11"
+version = "0.1.13"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -7237,7 +7250,6 @@ dependencies = [
 "nym-validator-client",
 "nyxd-scraper",
 "reqwest 0.12.4",
- "rocket",
 "schemars",
 "serde",
 "serde_json",
@@ -8405,9 +8417,9 @@ dependencies = [

 [[package]]
 name = "ring"
-version = "0.17.9"
+version = "0.17.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e75ec5e92c4d8aede845126adc388046234541629e76029599ed35a003c7ed24"
+checksum = "70ac5d832aa16abd7d1def883a8545280c20a60f523a370aa3a9617c2b8550ee"
 dependencies = [
 "cc",
 "cfg-if",
@@ -8594,9 +8606,9 @@ dependencies = [

 [[package]]
 name = "rs_merkle"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b241d2e59b74ef9e98d94c78c47623d04c8392abaf82014dfd372a16041128f"
+checksum = "bb09b49230ba22e8c676e7b75dfe2887dea8121f18b530ae0ba519ce442d2b21"
 dependencies = [
 "sha2 0.10.8",
 ]
@@ -8698,7 +8710,7 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
 dependencies = [
- "semver 1.0.25",
+ "semver 1.0.26",
 ]

 [[package]]
@@ -8710,7 +8722,20 @@ dependencies = [
 "bitflags 2.8.0",
 "errno",
 "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dade4812df5c384711475be5fcd8c162555352945401aed22a35bffeab61f657"
+dependencies = [
+ "bitflags 2.8.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.2",
 "windows-sys 0.59.0",
 ]

@@ -8986,9 +9011,9 @@ dependencies = [

 [[package]]
 name = "semver"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 dependencies = [
 "serde",
 ]
@@ -9001,9 +9026,9 @@ checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"

 [[package]]
 name = "serde"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8dfc9d19bdbf6d17e22319da49161d5d0108e4188e8b680aef6299eed22df60"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
 "serde_derive",
 ]
@@ -9041,18 +9066,18 @@ dependencies = [

 [[package]]
 name = "serde_bytes"
-version = "0.11.16"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "364fec0df39c49a083c9a8a18a23a6bcfd9af130fe9fe321d18520a0d113e09e"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09503e191f4e797cb8aac08e9a4a4695c5edf6a2e70e376d961ddd5c969f82b"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -9155,9 +9180,9 @@ dependencies = [

 [[package]]
 name = "serde_repr"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c64451ba24fc7a6a2d60fc75dd9c83c90903b19028d4eff35e88fc1e86564e9"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -9428,9 +9453,9 @@ dependencies = [

 [[package]]
 name = "sphinx-packet"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535f2c430778bf59c22249fcc1ed6d384129eb2f0f694706015d636c688f9ac6"
+checksum = "c23047e0cf36ff6904603f499fd13153425cdf5ba47bfbaedbc999da0bd92f4e"
 dependencies = [
 "aes",
 "arrayref",
@@ -9949,15 +9974,15 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.17.1"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e5a0acb1f3f55f65cc4a866c361b2fb2a0ff6366785ae6fbb5f85df07ba230"
+checksum = "2c317e0a526ee6120d8dabad239c8dadca62b24b6f168914bbbc8e2fb1f0e567"
 dependencies = [
 "cfg-if",
 "fastrand 2.3.0",
 "getrandom 0.3.1",
 "once_cell",
- "rustix",
+ "rustix 1.0.1",
 "windows-sys 0.59.0",
 ]

@@ -10085,7 +10110,7 @@ dependencies = [
 "pin-project",
 "rand 0.8.5",
 "reqwest 0.11.27",
- "semver 1.0.25",
+ "semver 1.0.26",
 "serde",
 "serde_bytes",
 "serde_json",
@@ -10245,9 +10270,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.37"
+version = "0.3.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+checksum = "dad298b01a40a23aac4580b67e3dbedb7cc8402f3592d7f49469de2ea4aecdd8"
 dependencies = [
 "deranged",
 "itoa",
@@ -10263,15 +10288,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "765c97a5b985b7c11d7bc27fa927dc4fe6af3a6dfb021d28deb60d3bf51e76ef"

 [[package]]
 name = "time-macros"
-version = "0.2.19"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+checksum = "e8093bc3e81c3bc5f7879de09619d06c9a5a5e45ca44dfeeb7225bae38005c5c"
 dependencies = [
 "num-conv",
 "time-core",
@@ -10314,9 +10339,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.43.0"
+version = "1.44.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+checksum = "9975ea0f48b5aa3972bf2d888c238182458437cc2a19374b81b25cdf1023fb3a"
 dependencies = [
 "backtrace",
 "bytes",
@@ -12041,8 +12066,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e105d177a3871454f754b33bb0ee637ecaaac997446375fd3e5d43a2ed00c909"
 dependencies = [
 "libc",
- "linux-raw-sys",
- "rustix",
+ "linux-raw-sys 0.4.15",
+ "rustix 0.38.44",
 ]

 [[package]]
@@ -209,7 +209,7 @@ blake3 = "1.6.1"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.7.2"
+bytes = "1.10.1"
 cargo_metadata = "0.18.1"
 celes = "2.5.0"
 cfg-if = "1.0.0"
@@ -241,6 +241,7 @@ doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
+encoding_rs = "0.8.35"
 env_logger = "0.11.6"
 envy = "0.4"
 etherparse = "0.13.0"
@@ -307,12 +308,12 @@ reqwest = { version = "0.12.4", default-features = false }
 rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
-rs_merkle = "1.4.2"
+rs_merkle = "1.5.0"
 safer-ffi = "0.1.13"
 schemars = "0.8.22"
-semver = "1.0.25"
-serde = "1.0.217"
-serde_bytes = "0.11.16"
+semver = "1.0.26"
+serde = "1.0.219"
+serde_bytes = "0.11.17"
 serde_derive = "1.0"
 serde_json = "1.0.140"
 serde_json_path = "0.7.2"
@@ -321,7 +322,7 @@ serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
-sphinx-packet = "0.3.1"
+sphinx-packet = "=0.3.2"
 sqlx = "0.7.4"
 strum = "0.26"
 strum_macros = "0.26"
@@ -330,10 +331,10 @@ syn = "1"
 sysinfo = "0.33.0"
 tap = "1.0.1"
 tar = "0.4.44"
-tempfile = "3.15"
+tempfile = "3.18"
 thiserror = "2.0"
-time = "0.3.37"
-tokio = "1.43"
+time = "0.3.39"
+tokio = "1.44"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
@@ -371,7 +372,7 @@ prometheus = { version = "0.13.0" }
 # plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
-ff = { version = "0.13.0", default-features = false }
+ff = { version = "0.13.1", default-features = false }
 subtle = "2.5.0"

 # cosmwasm-related
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.49"
+version = "1.1.50"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -117,7 +117,7 @@ impl Drop for Handler {
 }

 impl Handler {
-    async fn get_lane_queue_length(&self, connection_id: ConnectionId) -> Option<ServerResponse> {
+    async fn get_lane_queue_length(&mut self, connection_id: ConnectionId) -> Option<ServerResponse> {
        let req_start = Instant::now();

        // get the base queue length
@@ -282,7 +282,7 @@ impl Handler {
        None
    }

-    async fn handle_get_lane_queue_length(&self, connection_id: u64) -> Option<ServerResponse> {
+    async fn handle_get_lane_queue_length(&mut self, connection_id: u64) -> Option<ServerResponse> {
        self.get_lane_queue_length(connection_id).await
    }

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.49"
+version = "1.1.50"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -6,14 +6,15 @@ pub mod v1;
 pub mod v2;
 pub mod v3;
 pub mod v4;
+pub mod v5;

 mod error;
 mod util;

 pub use error::Error;
-pub use v4 as latest;
+pub use v5 as latest;

-pub const CURRENT_VERSION: u8 = 4;
+pub const CURRENT_VERSION: u8 = 5;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -8,8 +8,8 @@ use nym_sphinx::addressing::clients::Recipient;
 use nym_wireguard_types::PeerPublicKey;

 use crate::{
-    v1, v2, v3,
-    v4::{self, registration::IpPair},
+    v1, v2, v3, v4,
+    v5::{self, registration::IpPair},
    Error,
 };

@@ -19,6 +19,7 @@ pub enum AuthenticatorVersion {
    V2,
    V3,
    V4,
+    V5,
    UNKNOWN,
 }

@@ -34,6 +35,8 @@ impl From<Protocol> for AuthenticatorVersion {
            AuthenticatorVersion::V3
        } else if value.version == v4::VERSION {
            AuthenticatorVersion::V4
+        } else if value.version == v5::VERSION {
+            AuthenticatorVersion::V5
        } else {
            AuthenticatorVersion::UNKNOWN
        }
@@ -68,6 +71,12 @@ impl InitMessage for v4::registration::InitMessage {
    }
 }

+impl InitMessage for v5::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
 pub trait FinalMessage {
    fn pub_key(&self) -> PeerPublicKey;
    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
@@ -138,6 +147,24 @@ impl FinalMessage for v4::registration::FinalMessage {
        self.gateway_client.verify(private_key, nonce)
    }

+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ips.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+impl FinalMessage for v5::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
    fn private_ips(&self) -> IpPair {
        self.gateway_client.private_ips
    }
@@ -182,29 +209,39 @@ impl TopUpMessage for v4::topup::TopUpMessage {
    }
 }

+impl TopUpMessage for v5::topup::TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn credential(&self) -> CredentialSpendingData {
+        self.credential.clone()
+    }
+}
+
 pub enum AuthenticatorRequest {
    Initial {
        msg: Box<dyn InitMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
        request_id: u64,
    },
    Final {
        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
        request_id: u64,
    },
    QueryBandwidth {
        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
        request_id: u64,
    },
    TopUpBandwidth {
        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
        request_id: u64,
    },
 }
@@ -218,7 +255,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                    version: value.version,
                    service_provider_type: ServiceProviderType::Authenticator,
                },
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
@@ -227,7 +264,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                    version: value.version,
                    service_provider_type: ServiceProviderType::Authenticator,
                },
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
@@ -237,7 +274,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                        version: value.version,
                        service_provider_type: ServiceProviderType::Authenticator,
                    },
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
                    request_id: value.request_id,
                }
            }
@@ -251,20 +288,20 @@ impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
                    request_id: value.request_id,
                }
            }
@@ -278,20 +315,20 @@ impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
                    request_id: value.request_id,
                }
            }
@@ -299,7 +336,7 @@ impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
                Self::TopUpBandwidth {
                    msg: top_up_message,
                    protocol: value.protocol,
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
                    request_id: value.request_id,
                }
            }
@@ -313,20 +350,20 @@ impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: value.reply_to,
+                reply_to: Some(value.reply_to),
                request_id: value.request_id,
            },
            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
                    request_id: value.request_id,
                }
            }
@@ -334,7 +371,42 @@ impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
                Self::TopUpBandwidth {
                    msg: top_up_message,
                    protocol: value.protocol,
-                    reply_to: value.reply_to,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v5::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v5::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: None,
+                request_id: value.request_id,
+            },
+            v5::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: None,
+                request_id: value.request_id,
+            },
+            v5::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: None,
+                    request_id: value.request_id,
+                }
+            }
+            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: None,
                    request_id: value.request_id,
                }
            }
@@ -0,0 +1,478 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v4, v5};
+
+impl From<v4::request::AuthenticatorRequest> for v5::request::AuthenticatorRequest {
+    fn from(authenticator_request: v4::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v4::request::AuthenticatorRequestData> for v5::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v4::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v4::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v5::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v4::request::AuthenticatorRequestData::Final(final_msg) => {
+                v5::request::AuthenticatorRequestData::Final(Box::new((*final_msg).into()))
+            }
+            v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into())
+            }
+        }
+    }
+}
+
+impl From<v4::registration::InitMessage> for v5::registration::InitMessage {
+    fn from(init_msg: v4::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<v4::registration::FinalMessage> for v5::registration::FinalMessage {
+    fn from(final_msg: v4::registration::FinalMessage) -> Self {
+        Self {
+            gateway_client: final_msg.gateway_client.into(),
+            credential: final_msg.credential,
+        }
+    }
+}
+
+impl From<v4::registration::GatewayClient> for v5::registration::GatewayClient {
+    fn from(gateway_client: v4::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gateway_client.pub_key,
+            private_ips: gateway_client.private_ips.into(),
+            mac: gateway_client.mac.into(),
+        }
+    }
+}
+
+impl From<v5::registration::GatewayClient> for v4::registration::GatewayClient {
+    fn from(gateway_client: v5::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gateway_client.pub_key,
+            private_ips: gateway_client.private_ips.into(),
+            mac: gateway_client.mac.into(),
+        }
+    }
+}
+
+impl From<v4::registration::ClientMac> for v5::registration::ClientMac {
+    fn from(client_mac: v4::registration::ClientMac) -> Self {
+        Self::new((*client_mac).clone())
+    }
+}
+
+impl From<v5::registration::ClientMac> for v4::registration::ClientMac {
+    fn from(client_mac: v5::registration::ClientMac) -> Self {
+        Self::new((*client_mac).clone())
+    }
+}
+
+impl From<Box<v4::topup::TopUpMessage>> for Box<v5::topup::TopUpMessage> {
+    fn from(top_up_message: Box<v4::topup::TopUpMessage>) -> Self {
+        Box::new(v5::topup::TopUpMessage {
+            pub_key: top_up_message.pub_key,
+            credential: top_up_message.credential,
+        })
+    }
+}
+
+impl From<v4::response::AuthenticatorResponse> for v5::response::AuthenticatorResponse {
+    fn from(value: v4::response::AuthenticatorResponse) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 5,
+                service_provider_type: value.protocol.service_provider_type,
+            },
+            data: value.data.into(),
+        }
+    }
+}
+
+impl From<v4::response::AuthenticatorResponseData> for v5::response::AuthenticatorResponseData {
+    fn from(authenticator_response_data: v4::response::AuthenticatorResponseData) -> Self {
+        match authenticator_response_data {
+            v4::response::AuthenticatorResponseData::PendingRegistration(pending_response) => {
+                v5::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_response.into(),
+                )
+            }
+            v4::response::AuthenticatorResponseData::Registered(registered_response) => {
+                v5::response::AuthenticatorResponseData::Registered(registered_response.into())
+            }
+            v4::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => v5::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            ),
+            v4::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response) => {
+                v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response.into())
+            }
+        }
+    }
+}
+
+impl From<v4::response::RegisteredResponse> for v5::response::RegisteredResponse {
+    fn from(value: v4::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::PendingRegistrationResponse> for v5::response::PendingRegistrationResponse {
+    fn from(value: v4::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::registration::RegistrationData> for v5::registration::RegistrationData {
+    fn from(value: v4::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v5::registration::RegistrationData> for v4::registration::RegistrationData {
+    fn from(value: v5::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::response::RemainingBandwidthResponse> for v5::response::RemainingBandwidthResponse {
+    fn from(value: v4::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v4::response::TopUpBandwidthResponse> for v5::response::TopUpBandwidthResponse {
+    fn from(value: v4::response::TopUpBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::registration::RegistredData> for v5::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ips: value.private_ips.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::registration::RemainingBandwidthData> for v5::registration::RemainingBandwidthData {
+    fn from(value: v4::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
+
+impl From<v4::registration::IpPair> for v5::registration::IpPair {
+    fn from(value: v4::registration::IpPair) -> Self {
+        Self {
+            ipv4: value.ipv4,
+            ipv6: value.ipv6,
+        }
+    }
+}
+
+impl From<v5::registration::IpPair> for v4::registration::IpPair {
+    fn from(value: v5::registration::IpPair) -> Self {
+        Self {
+            ipv4: value.ipv4,
+            ipv6: value.ipv6,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        net::{Ipv4Addr, Ipv6Addr},
+        str::FromStr,
+    };
+
+    use nym_credentials_interface::CredentialSpendingData;
+    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_sphinx::addressing::Recipient;
+    use nym_wireguard_types::PeerPublicKey;
+    use x25519_dalek::PublicKey;
+
+    use super::*;
+    use crate::{
+        util::tests::{CREDENTIAL_BYTES, RECIPIENT},
+        v4,
+    };
+
+    #[test]
+    fn upgrade_initial_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v4::request::AuthenticatorRequest::new_initial_request(
+            v4::registration::InitMessage::new(pub_key),
+            reply_to,
+        );
+        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v5::request::AuthenticatorRequestData::Initial(v5::registration::InitMessage {
+                pub_key
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_final_req() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
+        let ips = v4::registration::IpPair::new(ipv4, ipv6);
+        let nonce = 42;
+        let gateway_client = v4::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            ips,
+            nonce,
+        );
+        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
+        let final_message = v4::registration::FinalMessage {
+            gateway_client: gateway_client.clone(),
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v4::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
+        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v5::request::AuthenticatorRequestData::Final(Box::new(
+                v5::registration::FinalMessage {
+                    gateway_client: v5::registration::GatewayClient::new(
+                        &local_secret,
+                        (&remote_secret).into(),
+                        v5::registration::IpPair::new(ipv4, ipv6),
+                        nonce
+                    ),
+                    credential
+                }
+            ))
+        );
+    }
+
+    #[test]
+    fn upgrade_query_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v4::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
+        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+        );
+    }
+
+    #[test]
+    fn upgrade_pending_reg_resp() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
+        let ips = v4::registration::IpPair::new(ipv4, ipv6);
+        let nonce = 42;
+        let wg_port = 51822;
+        let gateway_data = v4::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            ips,
+            nonce,
+        );
+        let registration_data = v4::registration::RegistrationData {
+            nonce,
+            gateway_data,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_pending_registration_success(
+            registration_data,
+            request_id,
+            reply_to,
+        );
+        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+
+        assert_eq!(
+            upgraded_msg.data,
+            v5::response::AuthenticatorResponseData::PendingRegistration(
+                v5::response::PendingRegistrationResponse {
+                    request_id,
+                    reply: v5::registration::RegistrationData {
+                        nonce,
+                        gateway_data: v5::registration::GatewayClient::new(
+                            &local_secret,
+                            (&remote_secret).into(),
+                            v5::registration::IpPair::new(ipv4, ipv6),
+                            nonce
+                        ),
+                        wg_port
+                    }
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn upgrade_registered_resp() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let ipv4 = Ipv4Addr::from_str("10.1.10.10").unwrap();
+        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
+        let private_ips = v4::registration::IpPair::new(ipv4, ipv6);
+        let wg_port = 51822;
+        let registred_data = v4::registration::RegistredData {
+            pub_key,
+            private_ips,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_registered(
+            registred_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v5::response::AuthenticatorResponseData::Registered(v5::response::RegisteredResponse {
+                request_id,
+                reply: v5::registration::RegistredData {
+                    wg_port,
+                    pub_key,
+                    private_ips: v5::registration::IpPair::new(ipv4, ipv6)
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_remaining_bandwidth_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = Some(v4::registration::RemainingBandwidthData {
+            available_bandwidth,
+        });
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_remaining_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 5,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v5::response::AuthenticatorResponseData::RemainingBandwidth(
+                v5::response::RemainingBandwidthResponse {
+                    request_id,
+                    reply: Some(v5::registration::RemainingBandwidthData {
+                        available_bandwidth,
+                    })
+                }
+            )
+        );
+    }
+}
@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 5;
@@ -0,0 +1,287 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpPair, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 250 * 1024 * 1024 * 1024; // 250 GB
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct IpPair {
+    pub ipv4: Ipv4Addr,
+    pub ipv6: Ipv6Addr,
+}
+
+impl IpPair {
+    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
+    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl fmt::Display for IpPair {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "({}, {})", self.ipv4, self.ipv6)
+    }
+}
+
+impl From<IpAddr> for IpPair {
+    fn from(value: IpAddr) -> Self {
+        let (before_last_byte, last_byte) = match value {
+            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
+            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
+        };
+        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
+        let ipv4 = Ipv4Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
+            before_last_byte,
+            last_byte,
+        );
+        let ipv6 = Ipv6Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
+            last_bytes,
+        );
+        IpPair::new(ipv4, ipv6)
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ips: IpPair,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IPs (v4 and v6)
+    pub private_ips: IpPair,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ips: IpPair,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ips,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone, PartialEq)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    fn create_ip_pair() {
+        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
+        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
+
+        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
+    }
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -0,0 +1,132 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 5;
+        let data = AuthenticatorRequest {
+            protocol: Protocol {
+                version,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,132 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                request_id,
+            }),
+        }
+    }
+
+    pub fn new_registered(registred_data: RegistredData, request_id: u64) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                request_id,
+            }),
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                request_id,
+            }),
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                request_id,
+            }),
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply: RemainingBandwidthData,
+}
@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}
@@ -50,7 +50,7 @@ const DEFAULT_MINIMUM_REPLY_SURB_THRESHOLD_BUFFER: usize = 0;
 // define how much to request at once
 // clients/client-core/src/client/replies/reply_controller.rs
 const DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 10;
-const DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 100;
+const DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 50;

 const DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE: u32 = 500;

@@ -658,6 +658,9 @@ pub struct ReplySurbs {
    /// Specifies the number of mixnet hops the packet should go through. If not specified, then
    /// the default value is used.
    pub surb_mix_hops: Option<u8>,
+
+    /// Specifies if we should reset all the sender tags on startup
+    pub fresh_sender_tags: bool,
 }

 impl Default for ReplySurbs {
@@ -675,6 +678,7 @@ impl Default for ReplySurbs {
            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
            maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
            surb_mix_hops: None,
+            fresh_sender_tags: false,
        }
    }
 }
@@ -88,7 +88,7 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
    let db_path = db_path.as_ref();
    if db_path.exists() {
        info!("loading existing surb database");
-        match fs_backend::Backend::try_load(db_path).await {
+        match fs_backend::Backend::try_load(db_path, surb_config.fresh_sender_tags).await {
            Ok(backend) => Ok(backend),
            Err(err) => {
                error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
@@ -18,7 +18,7 @@ pub type ClientRequestSender = tokio::sync::mpsc::Sender<ClientRequest>;
 pub mod transceiver;

 // We remind ourselves that 32 x 32kb = 1024kb, a reasonable size for a network buffer.
-pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 32;
+pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 5;
 const MAX_FAILURE_COUNT: usize = 100;

 // that's also disgusting.
@@ -96,6 +96,7 @@ impl MixTrafficController {
        mut mix_packets: Vec<MixPacket>,
    ) -> Result<(), ErasedGatewayError> {
        debug_assert!(!mix_packets.is_empty());
+        info!("on_messages: received {} mix_packets", mix_packets.len());

        let result = if mix_packets.len() == 1 {
            let mix_packet = mix_packets.pop().unwrap();
@@ -69,7 +69,7 @@ where
        // offload reply handling to the dedicated task
        if let Err(err) = self
            .reply_controller_sender
-            .send_reply(recipient_tag, data, lane)
+            .send_reply(recipient_tag, data, lane).await
        {
            if !self.task_client.is_shutdown_poll() {
                error!("failed to send a reply - {err}");
@@ -111,12 +111,17 @@ where
    }

    async fn on_input_message(&mut self, msg: InputMessage) {
+        log::info!(
+            "input_message_listener: received a message: {:?}",
+            msg.lane()
+        );
        match msg {
            InputMessage::Regular {
                recipient,
                data,
                lane,
            } => {
+                log::info!("input_message_listener: regular");
                self.handle_plain_message(recipient, data, lane, PacketType::Mix)
                    .await
            }
@@ -126,6 +131,7 @@ where
                reply_surbs,
                lane,
            } => {
+                log::info!("input_message_listener: anonymous");
                self.handle_repliable_message(recipient, data, reply_surbs, lane, PacketType::Mix)
                    .await
            }
@@ -134,9 +140,13 @@ where
                data,
                lane,
            } => {
+                log::info!("input_message_listener: reply");
                self.handle_reply(recipient_tag, data, lane).await;
            }
-            InputMessage::Premade { msgs, lane } => self.handle_premade_packets(msgs, lane).await,
+            InputMessage::Premade { msgs, lane } => {
+                log::info!("input_message_listener: premade");
+                self.handle_premade_packets(msgs, lane).await
+            }
            InputMessage::MessageWrapper {
                message,
                packet_type,
@@ -146,6 +156,8 @@ where
                    data,
                    lane,
                } => {
+                    log::info!("input_message_listener: wrapper regular");
+
                    self.handle_plain_message(recipient, data, lane, packet_type)
                        .await
                }
@@ -155,6 +167,7 @@ where
                    reply_surbs,
                    lane,
                } => {
+                    log::info!("input_message_listener: wrapper anonymous");
                    self.handle_repliable_message(recipient, data, reply_surbs, lane, packet_type)
                        .await
                }
@@ -163,9 +176,11 @@ where
                    data,
                    lane,
                } => {
+                    log::info!("input_message_listener: wrapper reply");
                    self.handle_reply(recipient_tag, data, lane).await;
                }
                InputMessage::Premade { msgs, lane } => {
+                    log::info!("input_message_listener: wrapper premade");
                    self.handle_premade_packets(msgs, lane).await
                }
                // MessageWrappers can't be nested
@@ -99,11 +99,15 @@ where
            } => {
                // if this is retransmission for reply, offload it to the dedicated task
                // that deals with all the surbs
-                if let Err(err) = self.reply_controller_sender.send_retransmission_data(
-                    *recipient_tag,
-                    weak_timed_out_ack,
-                    *extra_surb_request,
-                ) {
+                if let Err(err) = self
+                    .reply_controller_sender
+                    .send_retransmission_data(
+                        *recipient_tag,
+                        weak_timed_out_ack,
+                        *extra_surb_request,
+                    )
+                    .await
+                {
                    if !self.task_client.is_shutdown_poll() {
                        error!("Failed to send retransmission data to the reply controller: {err}");
                    }
@@ -33,10 +33,12 @@ pub enum PreparationError {
    #[error(transparent)]
    NymTopologyError(#[from] NymTopologyError),

-    #[error("The received message cannot be sent using a single reply surb. It ended up getting split into {fragments} fragments.")]
+    #[error("message too long for a single SURB, splitting into {fragments} fragments.")]
    MessageTooLongForSingleSurb { fragments: usize },

-    #[error("Not enough reply SURBs to send the message. We have {available} available and require at least {required}.")]
+    #[error(
+        "not enough reply SURBs to send the message, available: {available} required: {required}."
+    )]
    NotEnoughSurbs { available: usize, required: usize },
 }

@@ -230,7 +230,7 @@ where
        let (next_message, fragment_id, packet_size) = match next_message {
            StreamMessage::Cover => {
                let cover_traffic_packet_size = self.loop_cover_message_size();
-                trace!("the next loop cover message will be put in a {cover_traffic_packet_size} packet");
+                info!("the next loop cover message will be put in a {cover_traffic_packet_size} packet");

                // TODO for way down the line: in very rare cases (during topology update) we might have
                // to wait a really tiny bit before actually obtaining the permit hence messing with our
@@ -277,6 +277,8 @@ where
            }
        };

+        let mix_tx_capacity = self.mix_tx.capacity();
+        log::info!("mix_tx_capacity: {mix_tx_capacity}");
        if let Err(err) = self.mix_tx.send(vec![next_message]).await {
            if !self.task_client.is_shutdown_poll() {
                log::error!("Failed to send: {err}");
@@ -536,13 +538,13 @@ where
            format!("Packet backlog: {lane_status}, avg delay: {delay}ms ({mult})")
        };

-        if packets > 1000 {
-            log::warn!("{status_str}");
-        } else if packets > 0 {
+        // if packets > 1000 {
+            // log::warn!("{status_str}");
+        // } else if packets > 0 {
            log::info!("{status_str}");
-        } else {
-            log::debug!("{status_str}");
-        }
+        // } else {
+            // log::debug!("{status_str}");
+        // }

        // Send status message to whoever is listening (possibly UI)
        if mult == self.sending_delay_controller.max_multiplier() {
@@ -559,7 +561,7 @@ where

        #[cfg(not(target_arch = "wasm32"))]
        {
-            let mut status_timer = tokio::time::interval(Duration::from_secs(5));
+            let mut status_timer = tokio::time::interval(Duration::from_secs(1));

            while !shutdown.is_shutdown() {
                tokio::select! {
@@ -572,6 +574,7 @@ where
                        self.log_status(&mut shutdown);
                    }
                    next_message = self.next() => if let Some(next_message) = next_message {
+                        self.log_status(&mut shutdown);
                        self.on_message(next_message).await;
                    } else {
                        log::trace!("OutQueueControl: Stopping since channel closed");
@@ -224,7 +224,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
        msgs.into_iter().map(Into::into).collect()
    }

-    fn handle_reconstructed_repliable_messages(
+    async fn handle_reconstructed_repliable_messages(
        &mut self,
        msgs: Vec<RepliableMessage>,
    ) -> Vec<ReconstructedMessage> {
@@ -261,11 +261,11 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                }
            };

-            if let Err(err) = self.reply_controller_sender.send_additional_surbs(
-                msg.sender_tag,
-                reply_surbs,
-                from_surb_request,
-            ) {
+            if let Err(err) = self
+                .reply_controller_sender
+                .send_additional_surbs(msg.sender_tag, reply_surbs, from_surb_request)
+                .await
+            {
                if !self.task_client.is_shutdown_poll() {
                    error!("{err}");
                }
@@ -274,7 +274,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
        reconstructed
    }

-    fn handle_reconstructed_reply_messages(
+    async fn handle_reconstructed_reply_messages(
        &mut self,
        msgs: Vec<ReplyMessage>,
    ) -> Vec<ReconstructedMessage> {
@@ -287,6 +287,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                    if let Err(err) = self
                        .reply_controller_sender
                        .send_additional_surbs_request(*recipient, amount)
+                        .await
                    {
                        if !self.task_client.is_shutdown_poll() {
                            error!("{err}");
@@ -316,10 +317,16 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
        }

        let mut reconstructed_messages = self.handle_reconstructed_plain_messages(plain_messages);
-        reconstructed_messages
-            .append(&mut self.handle_reconstructed_repliable_messages(repliable_messages));
-        reconstructed_messages
-            .append(&mut self.handle_reconstructed_reply_messages(reply_messages));
+        reconstructed_messages.append(
+            &mut self
+                .handle_reconstructed_repliable_messages(repliable_messages)
+                .await,
+        );
+        reconstructed_messages.append(
+            &mut self
+                .handle_reconstructed_reply_messages(reply_messages)
+                .await,
+        );

        let mut inner_guard = self.inner.lock().await;
        debug!(
@@ -746,7 +746,7 @@ where
            .request_additional_reply_surbs(target, request_size)
            .await
        {
-            warn!("failed to request additional surbs... - {err}")
+            info!("{err}")
        }
    }

@@ -2,7 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::client::real_messages_control::acknowledgement_control::PendingAcknowledgement;
-use futures::channel::{mpsc, oneshot};
+use futures::{
+    channel::{mpsc, oneshot},
+    SinkExt,
+};
 use log::error;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
@@ -11,117 +14,128 @@ use nym_task::connections::{ConnectionId, TransmissionLane};
 use std::sync::Weak;

 pub(crate) fn new_control_channels() -> (ReplyControllerSender, ReplyControllerReceiver) {
-    let (tx, rx) = mpsc::unbounded();
+    let (tx, rx) = mpsc::channel(8);
    (tx.into(), rx)
 }

 #[derive(Debug, thiserror::Error)]
 pub enum ReplyControllerSenderError {
    #[error("failed to send retransmission data to reply controller")]
-    SendRetransmissionData(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    // SendRetransmissionData(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    SendRetransmissionData,

    #[error("failed to send reply to reply controller")]
-    SendReply(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    // SendReply(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    SendReply,

    #[error("failed to send additional surbs to reply controller")]
-    AdditionalSurbs(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    // AdditionalSurbs(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    AdditionalSurbs,

    #[error("failed to send additional surbs request to reply controller")]
-    AdditionalSurbsRequest(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    // AdditionalSurbsRequest(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    AdditionalSurbsRequest,

    #[error("failed to request lane queue length from reply controller")]
-    LaneQueueLength(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    // LaneQueueLength(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+    LaneQueueLength,

    #[error("response channel was dropped before we could receive the response")]
-    ResponseChannelDropped(#[source] oneshot::Canceled),
+    // ResponseChannelDropped(#[source] oneshot::Canceled),
+    ResponseChannelDropped,
 }

 #[derive(Debug, Clone)]
-pub struct ReplyControllerSender(mpsc::UnboundedSender<ReplyControllerMessage>);
+pub struct ReplyControllerSender(mpsc::Sender<ReplyControllerMessage>);

-impl From<mpsc::UnboundedSender<ReplyControllerMessage>> for ReplyControllerSender {
-    fn from(inner: mpsc::UnboundedSender<ReplyControllerMessage>) -> Self {
+impl From<mpsc::Sender<ReplyControllerMessage>> for ReplyControllerSender {
+    fn from(inner: mpsc::Sender<ReplyControllerMessage>) -> Self {
        ReplyControllerSender(inner)
    }
 }

 impl ReplyControllerSender {
-    pub(crate) fn send_retransmission_data(
-        &self,
+    pub(crate) async fn send_retransmission_data(
+        &mut self,
        recipient: AnonymousSenderTag,
        timed_out_ack: Weak<PendingAcknowledgement>,
        extra_surb_request: bool,
    ) -> Result<(), ReplyControllerSenderError> {
        self.0
-            .unbounded_send(ReplyControllerMessage::RetransmitReply {
+            .send(ReplyControllerMessage::RetransmitReply {
                recipient,
                timed_out_ack,
                extra_surb_request,
            })
-            .map_err(ReplyControllerSenderError::SendRetransmissionData)
+            .await
+            .map_err(|_| ReplyControllerSenderError::SendRetransmissionData)
    }

-    pub(crate) fn send_reply(
-        &self,
+    pub(crate) async fn send_reply(
+        &mut self,
        recipient: AnonymousSenderTag,
        message: Vec<u8>,
        lane: TransmissionLane,
    ) -> Result<(), ReplyControllerSenderError> {
        self.0
-            .unbounded_send(ReplyControllerMessage::SendReply {
+            .send(ReplyControllerMessage::SendReply {
                recipient,
                message,
                lane,
            })
-            .map_err(ReplyControllerSenderError::SendReply)
+            .await
+            .map_err(|_| ReplyControllerSenderError::SendReply)
    }

-    pub(crate) fn send_additional_surbs(
-        &self,
+    pub(crate) async fn send_additional_surbs(
+        &mut self,
        sender_tag: AnonymousSenderTag,
        reply_surbs: Vec<ReplySurb>,
        from_surb_request: bool,
    ) -> Result<(), ReplyControllerSenderError> {
        self.0
-            .unbounded_send(ReplyControllerMessage::AdditionalSurbs {
+            .send(ReplyControllerMessage::AdditionalSurbs {
                sender_tag,
                reply_surbs,
                from_surb_request,
            })
-            .map_err(ReplyControllerSenderError::AdditionalSurbs)
+            .await
+            .map_err(|_| ReplyControllerSenderError::AdditionalSurbs)
    }

-    pub(crate) fn send_additional_surbs_request(
-        &self,
+    pub(crate) async fn send_additional_surbs_request(
+        &mut self,
        recipient: Recipient,
        amount: u32,
    ) -> Result<(), ReplyControllerSenderError> {
        self.0
-            .unbounded_send(ReplyControllerMessage::AdditionalSurbsRequest {
+            .send(ReplyControllerMessage::AdditionalSurbsRequest {
                recipient: Box::new(recipient),
                amount,
            })
-            .map_err(ReplyControllerSenderError::AdditionalSurbsRequest)
+            .await
+            .map_err(|_| ReplyControllerSenderError::AdditionalSurbsRequest)
    }

    pub async fn get_lane_queue_length(
-        &self,
+        &mut self,
        connection_id: ConnectionId,
    ) -> Result<usize, ReplyControllerSenderError> {
        let (response_tx, response_rx) = oneshot::channel();
-        if let Err(err) = self
+        if let Err(_err) = self
            .0
-            .unbounded_send(ReplyControllerMessage::LaneQueueLength {
+            .send(ReplyControllerMessage::LaneQueueLength {
                connection_id,
                response_channel: response_tx,
            })
+            .await
        {
-            return Err(ReplyControllerSenderError::LaneQueueLength(err));
+            return Err(ReplyControllerSenderError::LaneQueueLength);
        }

        response_rx
            .await
-            .map_err(ReplyControllerSenderError::ResponseChannelDropped)
+            .map_err(|_| ReplyControllerSenderError::ResponseChannelDropped)
    }
 }

@@ -137,7 +151,7 @@ impl ReplyQueueLengths {
    }

    pub async fn get_lane_queue_length(
-        &self,
+        &mut self,
        connection_id: ConnectionId,
    ) -> Result<usize, ReplyControllerSenderError> {
        self.reply_controller_sender
@@ -146,7 +160,7 @@ impl ReplyQueueLengths {
    }
 }

-pub(crate) type ReplyControllerReceiver = mpsc::UnboundedReceiver<ReplyControllerMessage>;
+pub(crate) type ReplyControllerReceiver = mpsc::Receiver<ReplyControllerMessage>;

 #[derive(Debug)]
 pub enum ReplyControllerMessage {
@@ -10,7 +10,7 @@ use crate::{
    CombinedReplyStorage, ReceivedReplySurbsMap, ReplyStorageBackend, SentReplyKeys, UsedSenderTags,
 };
 use async_trait::async_trait;
-use log::{error, info, warn};
+use log::{debug, error, info, warn};
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use std::fs;
 use std::path::{Path, PathBuf};
@@ -52,7 +52,10 @@ impl Backend {
        Ok(backend)
    }

-    pub async fn try_load<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+    pub async fn try_load<P: AsRef<Path>>(
+        database_path: P,
+        fresh_sender_tags: bool,
+    ) -> Result<Self, StorageError> {
        let owned_path: PathBuf = database_path.as_ref().into();
        if owned_path.file_name().is_none() {
            return Err(StorageError::DatabasePathWithoutFilename {
@@ -118,6 +121,9 @@ impl Backend {
        if days > 2 {
            info!("it's been over {days} days and {hours} hours since we last used our data store. our used sender tags are already outdated - we're going to purge them now.");
            manager.delete_all_tags().await?;
+        } else if fresh_sender_tags {
+            debug!("starting with fresh sender tags");
+            manager.delete_all_tags().await?;
        }

        Ok(Backend {
@@ -21,6 +21,12 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }

+# used for decoding text responses (they were already implicitly included)
+bytes = { workspace = true }
+encoding_rs = { workspace = true }
+mime = { workspace = true }
+
+
 nym-bin-common = { path = "../bin-common" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies]
@@ -32,4 +38,4 @@ workspace = true
 features = ["tokio"]

 [dev-dependencies]
-tokio = { workspace = true, features=["rt", "macros"] }
+tokio = { workspace = true, features = ["rt", "macros"] }
@@ -147,13 +147,13 @@ use thiserror::Error;
 use tracing::{instrument, warn};
 use url::Url;

+use http::HeaderMap;
+pub use reqwest::IntoUrl;
 #[cfg(not(target_arch = "wasm32"))]
 use std::net::SocketAddr;
 #[cfg(not(target_arch = "wasm32"))]
 use std::sync::Arc;

-pub use reqwest::IntoUrl;
-
 mod user_agent;
 pub use user_agent::UserAgent;

@@ -210,6 +210,12 @@ pub enum HttpClientError<E: Display = String> {
    #[error("failed to resolve request. status: '{status}', additional error message: {error}")]
    EndpointFailure { status: StatusCode, error: E },

+    #[error("failed to decode response body: {source} from {content}")]
+    ResponseDecodeFailure {
+        source: serde_json::Error,
+        content: String,
+    },
+
    #[cfg(target_arch = "wasm32")]
    #[error("the request has timed out")]
    RequestTimeout,
@@ -849,6 +855,26 @@ fn sanitize_url<K: AsRef<str>, V: AsRef<str>>(
    url
 }

+fn decode_as_text(bytes: &bytes::Bytes, headers: HeaderMap) -> String {
+    use encoding_rs::{Encoding, UTF_8};
+    use mime::Mime;
+
+    let content_type = headers
+        .get(http::header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.parse::<Mime>().ok());
+
+    let encoding_name = content_type
+        .as_ref()
+        .and_then(|mime| mime.get_param("charset").map(|charset| charset.as_str()))
+        .unwrap_or("utf-8");
+
+    let encoding = Encoding::for_label(encoding_name.as_bytes()).unwrap_or(UTF_8);
+
+    let (text, _, _) = encoding.decode(bytes);
+    text.into_owned()
+}
+
 /// Attempt to parse a json object from an HTTP response
 #[instrument(level = "debug", skip_all)]
 pub async fn parse_response<T, E>(res: Response, allow_empty: bool) -> Result<T, HttpClientError<E>>
@@ -864,21 +890,23 @@ where
            return Err(HttpClientError::EmptyResponse { status });
        }
    }
+    let headers = res.headers().clone();
+    tracing::trace!("headers: {:?}", headers);

    if res.status().is_success() {
-        #[cfg(debug_assertions)]
-        {
-            let text = res.text().await.inspect_err(|err| {
-                tracing::error!("Couldn't even get response text: {err}");
-            })?;
-            tracing::trace!("Result:\n{:#?}", text);
-
-            serde_json::from_str(&text)
-                .map_err(|err| HttpClientError::GenericRequestFailure(err.to_string()))
+        // internally reqwest is first retrieving bytes and then performing parsing via serde_json
+        // (and similarly does the same thing for text())
+        let full = res.bytes().await?;
+        match serde_json::from_slice(&full) {
+            Ok(data) => Ok(data),
+            Err(err) => {
+                let content = decode_as_text(&full, headers);
+                Err(HttpClientError::ResponseDecodeFailure {
+                    source: err,
+                    content,
+                })
+            }
        }
-
-        #[cfg(not(debug_assertions))]
-        Ok(res.json().await?)
    } else if res.status() == StatusCode::NOT_FOUND {
        Err(HttpClientError::NotFound)
    } else {
@@ -21,3 +21,5 @@ thiserror = { workspace = true }
 time = { workspace = true }
 tokio = { workspace = true, features = ["time"] }
 tokio-util = { workspace = true, features = ["codec"] }
+nym-sdk = { path = "../../sdk/rust/nym-sdk" }
+tracing.workspace = true
@@ -74,6 +74,39 @@ impl MultiIpPacketCodec {
            Some(packets)
        }
    }
+
+    pub async fn buffer_timeout2(
+        &mut self,
+        lane_queue_lengths: nym_sdk::mixnet::LaneQueueLengths,
+    ) -> Option<Bytes> {
+        // Wait for buffer_timeout to tick
+        let _ = self.buffer_timeout.tick().await;
+
+        // wait for lane_queue_lenghts to go to zero
+        {
+            let now = std::time::Instant::now();
+            loop {
+                let lane_queue_lengths = lane_queue_lengths.lock().unwrap().total();
+                if lane_queue_lengths < 10 {
+                    break;
+                }
+                tokio::time::sleep(Duration::from_millis(100)).await;
+            }
+            let elapsed = now.elapsed();
+            tracing::error!(
+                "Waited for lane_queue_lengths to go to zero for {:?}",
+                elapsed
+            );
+        }
+
+        // Flush the buffer and return it
+        let packets = self.flush_current_buffer();
+        if packets.is_empty() {
+            None
+        } else {
+            Some(packets)
+        }
+    }
 }

 impl Encoder<Bytes> for MultiIpPacketCodec {
@@ -7,7 +7,7 @@ use nym_sphinx_addressing::clients::Recipient;
 use nym_sphinx_addressing::nodes::{NymNodeRoutingAddress, MAX_NODE_ADDRESS_UNPADDED_LEN};
 use nym_sphinx_params::packet_sizes::PacketSize;
 use nym_sphinx_params::{PacketType, ReplySurbKeyDigestAlgorithm};
-use nym_sphinx_types::{NymPacket, SURBMaterial, SphinxError, SURB};
+use nym_sphinx_types::{NymPacket, SURBMaterial, SphinxError, SURB, UPDATED_LEGACY_VERSION};
 use nym_topology::{NymRouteProvider, NymTopologyError};
 use rand::{CryptoRng, RngCore};
 use serde::de::{Error as SerdeError, Visitor};
@@ -101,7 +101,8 @@ impl ReplySurb {
        let delays = nym_sphinx_routing::generate_hop_delays(average_delay, route.len());
        let destination = recipient.as_sphinx_destination();

-        let surb_material = SURBMaterial::new(route, delays, destination);
+        let surb_material =
+            SURBMaterial::new(route, delays, destination).with_version(UPDATED_LEGACY_VERSION);

        // this can't fail as we know we have a valid route to gateway and have correct number of delays
        Ok(ReplySurb {
@@ -9,3 +9,4 @@ repository = { workspace = true }

 [dependencies]
 pem = { workspace = true }
+tracing = { workspace = true }
@@ -6,6 +6,7 @@ use pem::Pem;
 use std::fs::File;
 use std::io::{self, Read, Write};
 use std::path::{Path, PathBuf};
+use tracing::debug;

 pub mod traits;

@@ -46,6 +47,10 @@ where
    T: PemStorableKey,
    P: AsRef<Path>,
 {
+    debug!(
+        "attempting to load key with the following pem type: {}",
+        T::pem_type()
+    );
    let key_pem = read_pem_file(path)?;

    if T::pem_type() != key_pem.tag {
@@ -103,4 +103,8 @@ impl LaneQueueLengthsInner {
    {
        self.map.entry(*lane).and_modify(f);
    }
+
+    pub fn total(&self) -> usize {
+        self.map.values().sum()
+    }
 }
@@ -494,6 +494,9 @@ pub struct ReplySurbsWasm {
    /// Defines how many mix nodes the reply surb should go through.
    /// If not set, the default value is going to be used.
    pub surb_mix_hops: Option<u8>,
+
+    /// Specifies if we should reset all the sender tags on startup
+    pub fresh_sender_tags: bool,
 }

 impl Default for ReplySurbsWasm {
@@ -525,6 +528,7 @@ impl From<ReplySurbsWasm> for ConfigReplySurbs {
                reply_surbs.maximum_reply_key_age_ms as u64,
            ),
            surb_mix_hops: reply_surbs.surb_mix_hops,
+            fresh_sender_tags: reply_surbs.fresh_sender_tags,
        }
    }
 }
@@ -548,6 +552,7 @@ impl From<ConfigReplySurbs> for ReplySurbsWasm {
            maximum_reply_surb_age_ms: reply_surbs.maximum_reply_surb_age.as_millis() as u32,
            maximum_reply_key_age_ms: reply_surbs.maximum_reply_key_age.as_millis() as u32,
            surb_mix_hops: reply_surbs.surb_mix_hops,
+            fresh_sender_tags: reply_surbs.fresh_sender_tags,
        }
    }
 }
@@ -378,6 +378,9 @@ pub struct ReplySurbsWasmOverride {

    #[tsify(optional)]
    pub surb_mix_hops: Option<u8>,
+
+    /// Specifies if we should reset all the sender tags on startup
+    pub fresh_sender_tags: bool,
 }

 impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
@@ -416,6 +419,7 @@ impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
                .maximum_reply_key_age_ms
                .unwrap_or(def.maximum_reply_key_age_ms),
            surb_mix_hops: value.surb_mix_hops,
+            fresh_sender_tags: value.fresh_sender_tags,
        }
    }
 }
@@ -1522,18 +1522,18 @@ dependencies = [

 [[package]]
 name = "semver"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
 "serde_derive",
 ]
@@ -1558,9 +1558,9 @@ dependencies = [

 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1777,9 +1777,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.37"
+version = "0.3.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+checksum = "dad298b01a40a23aac4580b67e3dbedb7cc8402f3592d7f49469de2ea4aecdd8"
 dependencies = [
 "deranged",
 "itoa",
@@ -1794,15 +1794,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "765c97a5b985b7c11d7bc27fa927dc4fe6af3a6dfb021d28deb60d3bf51e76ef"

 [[package]]
 name = "time-macros"
-version = "0.2.19"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+checksum = "e8093bc3e81c3bc5f7879de09619d06c9a5a5e45ca44dfeeb7225bae38005c5c"
 dependencies = [
 "num-conv",
 "time-core",
@@ -7,4 +7,6 @@ package-lock.json

 # local env files
 .env*.local
-.env
+.env
+
+scratch.md
@@ -0,0 +1,10 @@
+- Run synchronization against [pool.ntp.org](https://www.ntppool.org/en/):
+```bash
+ntpdate -q pool.ntp.org
+```
+- Enable `ntp` service, start and review the status:
+```bash
+systemctl enable --now ntp
+service ntp start
+service ntp status
+```
@@ -1 +1 @@
-807_251_217
+808_623_916
@@ -1 +1 @@
-0.64%
+0.68%
@@ -1 +1 @@
-44.811
+42.157
@@ -1 +1 @@
-1_025_628
+1_028_488
@@ -1 +1 @@
-403_625_608
+404_311_958
@@ -1,7 +1,7 @@
 | **Item**           | **Description**                                       |   **Amount in NYM** |
 |:-------------------|:------------------------------------------------------|--------------------:|
 | Total Supply       | Maximum amount of NYM token in existence              |       1_000_000_000 |
-| Mixmining Reserve  | Tokens releasing for operators rewards                |         192_748_782 |
+| Mixmining Reserve  | Tokens releasing for operators rewards                |         191_376_083 |
 | Vesting Tokens     | Tokens locked outside of cicrulation for future claim |                   0 |
-| Circulating Supply | Amount of unlocked tokens                             |         807_251_217 |
-| Stake Saturation   | Optimal size of node self-bond + delegation           |           1_025_628 |
+| Circulating Supply | Amount of unlocked tokens                             |         808_623_916 |
+| Stake Saturation   | Optimal size of node self-bond + delegation           |           1_028_488 |
@@ -1 +1 @@
-Wednesday, February 26th 2025, 16:02:47 UTC
+Tuesday, March 11th 2025, 11:04:18 UTC
@@ -0,0 +1,5 @@
+
+{
+  "mainnet":"Mainnet Endpoints",
+  "sandbox":"Sandbox Endpoints"
+}
@@ -0,0 +1,5 @@
+
+{
+  "mainnet":"Mainnet Endpoints",
+  "sandbox":"Sandbox Endpoints"
+}
@@ -1,11 +1,8 @@
 import { Callout } from 'nextra/components'

 # Node Status API
-
-The Node Status API contains information about the network, its topology, and the routing scores of all nodes within it. It offers broadly similar information to the experimental [Habourmaster frontend](https://harbourmaster.nymtech.net/) but is stable where the Harbourmaster is subject to sudden changes as we modify and experiment with how we scrape and present data about the Mixnet infrastructure.
+The Node Status API serves information about individual `nym-nodes` in the Mixnet, such as which role they are operating in, statistics about them, services such as Network Requesters, as well as summaries of the state of the Mixnet.

 <Callout type="info">
-People building applications or dashboards which requires information about nodes, their uptime, and their delegations should use this instead of Habourmaster.
+We recommend that developers building applications such as explorers or analytics interfaces about the Mixnet run their own instance of the API, in order to promote a robust network of downstream services, and spread the load of API calls amongst as many endpoints as possible.
 </Callout>
-
-The code for this service can be found [in our monorepo](https://github.com/nymtech/nym/tree/develop/nym-node-status-api). In the future we will encourage developers to run their own instance of this API in order to distribute endpoints and query load.
@@ -0,0 +1,5 @@
+{
+  "ns-api-run-deploy":"Run Instance",
+  "mainnet":"Mainnet Endpoints",
+  "sandbox":"Sandbox Endpoints"
+}
@@ -1,9 +1,11 @@
 import { RedocStandalone } from 'redoc';
+import { Callout } from 'nextra/components'

 The information below is generated with [Redoc](https://redocly.com/docs/redoc) consuming the OpenAPI spec found at [https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json](https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json) which is also used to generate the Swagger docs deployed at [https://mainnet-node-status-api.nymtech.cc/swagger/](https://mainnet-node-status-api.nymtech.cc/swagger/).

 <br /><br />

+
 <RedocStandalone
  specUrl="https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json"
  options={{
@@ -0,0 +1,336 @@
+import { Callout } from 'nextra/components'
+import { AccordionTemplate } from 'components/accordion-template.tsx'
+
+# NS API: Deployment Guide
+
+## Components
+The Node Status API is made up of 3 components:
+- `nym-node-status-api`
+- `nym-node-status-client`
+- `nym-node-status-agent`
+
+The API stores its data in a local SQLite database. It periodically gets most of its data from a [NymAPI](./nym-api) instance, and for instances also running with the Gateway Probe, uses the stored topology to conduct performance probe tests.
+
+## Gateway Probe
+You can run the `nym-node-status-api` alone, but if you want to run probes for `nym-node`s running as Gateways, you have to also run the `nym-node-status-agent` (which consumes the `nym-node-status-client` lib). The probe will run a set of tests per Gateway node, and return the sort of results seen [here](https://harbourmaster.nymtech.net/gateway/23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb).
+
+## UI
+The API exposes a [Swagger](https://swagger.io/docs/) documentation UI by default on port `8000` (see an example [here](https://mainnet-node-status-api.nymtech.cc/swagger/)).
+
+Currently we are not shipping a custom UI component for the Node Status API. The [Harbourmaster](https://harbourmaster.nymtech.net/) frontend consumes this API, amongst other things, but this is an internal repo we use to experiment with new APIs and data on, so it is not public yet.
+
+<Callout type="info">
+We invite developers to roll their own UI for their Node Status API instance.
+</Callout>
+
+## Docker Images
+We will ship Docker images for both the `agent` and `api` in the future. There are Docker images for both in root of each corresponding crate ([`agent`](https://github.com/nymtech/nym/blob/09ea406c02e9a3beebc062f525e4ea1b4222dcbb/nym-node-status-api/nym-node-status-agent/Dockerfile), [`api`](https://github.com/nymtech/nym/blob/develop/nym-node-status-api/nym-node-status-api/Dockerfile)) which are used internally, which could be a starting point for developers to dockerize their instance for the moment.
+
+## Build
+### Prerequisites
+- Rust
+- SQLite
+- Get an `ipinfo` key following instructions [here](https://github.com/ipinfo/rust?tab=readme-ov-file#getting-started).
+
+### Compilation
+```shell
+cargo build --release --package nym-node-status-api --package nym-node-status-agent --package nym-node-status-client
+```
+
+## Run
+Since the Node Status API depends on both flags and environmental variables, it might be easier to run the binary via a script like the one below - this this script essentially just `source`-s the defined `.env` file after exporting certain binary-specific variables, and then runs the binary. You can find the `.env` files [here](https://github.com/nymtech/nym/tree/master/envs).
+
+<Callout type="info">
+    All CLI flags are configurable as environmental variables and vice versa, so take the following scripts / setups as guides that you can change however best suits your setup. You can see all definitions [here](https://github.com/nymtech/nym/blob/develop/nym-node-status-api/nym-node-status-api/src/cli/mod.rs#L14).
+</Callout>
+
+```bash
+#!/bin/bash
+
+set -e
+
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"} # see nym/envs/ for all possible environments
+export NYM_API_CLIENT_TIMEOUT=60
+export NODE_STATUS_API_TESTRUN_REFRESH_INTERVAL=120
+export IPINFO_API_TOKEN=<YOUR_IPINFO_API_KEY>
+
+monorepo_root=<PATH/TO/NYM/>
+set -a
+source "${monorepo_root}/envs/${ENVIRONMENT}.env"
+echo ${monorepo_root}/envs/${ENVIRONMENT}.env
+set +a
+export RUST_LOG=${RUST_LOG:-debug} # debug is useful to check everything is working initially, but quite verbose
+
+echo "Verifying environment variables were properly sourced:"
+echo "RUST_LOG=${RUST_LOG}"
+echo "BECH32_PREFIX=${BECH32_PREFIX}"
+echo "NETWORK_NAME=${NETWORK_NAME}"
+
+<PATH/TO/>nym-node-status-api -- --ipinfo-api-token $IPINFO_API_TOKEN
+```
+
+### Functionality Without Gateway Probe
+Data will be restricted to information that doesn't involve Probe results; `routing` and `config` scores will be `0` and `last_probe` results `null`, as you can see in this snipped output of the `gateways` endpoint:
+
+<AccordionTemplate name="Output">
+```shell
+{
+      "gateway_identity_key": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
+      "bonded": true,
+      "performance": 99,
+      "self_described": {
+        "authenticator": {
+          "address": "6Gdtw13Fa46AvkqkHELZZCMKWASDodoJeK9APRNpjjdj.7ji8DDkpjA2AdgwK7wbZm8yi4xZGogGJeypBQt4hAw3P@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb"
+        },
+        "auxiliary_details": {
+          "accepted_operator_terms_and_conditions": true,
+          "announce_ports": {
+            "mix_port": null,
+            "verloc_port": null
+          },
+          "location": null
+        },
+        "build_information": {
+          "binary_name": "nym-node",
+          "build_timestamp": "2025-02-13T11:49:34.670488195Z",
+          "build_version": "1.5.0",
+          "cargo_profile": "release",
+          "cargo_triple": "x86_64-unknown-linux-gnu",
+          "commit_branch": "HEAD",
+          "commit_sha": "a3e19b4563843055b305ea9a397eb1ad84b5c378",
+          "commit_timestamp": "2025-02-10T18:14:47.000000000+01:00",
+          "rustc_channel": "stable",
+          "rustc_version": "1.84.1"
+        },
+        "declared_role": {
+          "entry": true,
+          "exit_ipr": true,
+          "exit_nr": true,
+          "mixnode": false
+        },
+        "host_information": {
+          "hostname": "bwng1.bwnym.xyz",
+          "ip_address": [
+            "95.164.2.86"
+          ],
+          "keys": {
+            "ed25519": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
+            "x25519": "H6pFjqtdSVxkxEQ3wFnuSoobDAUqHx1bYMVJzPZdRByn",
+            "x25519_noise": null
+          }
+        },
+        "ip_packet_router": {
+          "address": "7ms2D2uYiTuhX6MKeVL5rz5usgehEoxAAovwYm9nJyBF.3siMjk3wTU7ykaXLNi9c7LpX8yonYKPCA4BQoMwhsfTV@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb"
+        },
+        "last_polled": "2025-03-03 09:48:03.635274187 +00:00:00",
+        "mixnet_websockets": {
+          "ws_port": 9000,
+          "wss_port": 9001
+        },
+        "network_requester": {
+          "address": "HuNL1pFprNSKW6jdqppibXP5KNKCNJxDh7ivpYcoULN9.C62NahRTUf6kqpNtDVHXoVriQr6yyaU5LtxdgpbsGrtA@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
+          "uses_exit_policy": true
+        },
+        "wireguard": {
+          "port": 51822,
+          "public_key": "6o8x9GitFjcrkjrJnivWaQCPnxXykQPYLneNr2FEB8Vq"
+        }
+      },
+      "explorer_pretty_bond": {
+        "identity_key": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
+        "location": {
+          "latitude": 52.5083,
+          "longitude": 5.475,
+          "two_letter_iso_country_code": "NL"
+        },
+        "owner": "n1cp5gq0apat6c7qmenqp5zjprn2vwvc7jl29j8r",
+        "pledge_amount": {
+          "amount": "100000000",
+          "denom": "unym"
+        }
+      },
+      "description": {
+        "moniker": "bwn_g1",
+        "website": "https://bwnym.xyz",
+        "security_contact": "bwnym@proton.me",
+        "details": "This gateway is part of the NYM project, which is dedicated to create outstanding privacy software that is legally compliant without sacrificing integrity or having any backdoors."
+      },
+      "last_probe_result": null,
+      "last_probe_log": null,
+      "last_testrun_utc": null,
+      "last_updated_utc": "2025-03-03T10:45:48+00:00",
+      "routing_score": 0.0,
+      "config_score": 0
+    },
+```
+</AccordionTemplate>
+
+If you have already run the API before, make sure to add the following to your script `--database-url "sqlite://node-status-api.sqlite?mode=rwc` so it will continue using the same DB.
+
+### Functionality with Gateway Probe
+If you want to enable Gateway node probes and have the NS API store that data, you need to periodically run the `nym-node-status-agent`, authenticated with your `nym-node-status-api` instance. Authentication is to make sure that only the `-agent` you are operating (or others you trust) are submitting data to your API instance.
+
+#### Compile Gateway Probe
+The `nym-node-status-agent` is a thin wrapper around the Gateway Probe binary which currently is in the NymVPN repo. `git checkout` to the most recent [release](https://github.com/nymtech/nym-vpn-client/releases), and compile the probe by following the [readme instructions](https://github.com/nymtech/nym-vpn-client/tree/develop/nym-vpn-core/crates/nym-gateway-probe). You will point the `-agent` at this binary when doing Probe testruns.
+
+#### Generate Keypair
+```shell
+<PATH/TO/>nym-node-status-agent generate-keypair --path <PATH/TO/KEY/FILE/TO/GENERATE>/<KEY_NAME>
+# e.g.
+# nym-node-status-agent generate-keypair --path ~/.ssh/ns-agent-key
+```
+
+You will then want to export the generated `public-key` so its accessible to the `nym-node-status-api` however you are setting your environmental variables, as `NODE_STATUS_API_AGENT_KEY_LIST`:
+
+```bash
+export NODE_STATUS_API_AGENT_KEY_LIST=<YOUR_KEY> # e.g. "H4z8kx5Kkf5JNQHfxaE1MwRndjDCD1C7HsVhHTFfBZ4J"
+```
+
+In this situation, you are probably only using one key. However, it is possible to set multiple keys as a comma seperated list, in case you wish to whitelist multiple `-agent`s to be able to submit to a single `-api` instance.
+
+#### Run the Node Status Agent
+```shell
+<PATH/TO/>nym-node-status-agent run-probe --server-address http://127.0.0.1 --server-port 8000 --ns-api-auth-key "<NS_AGENT_PRIVATE_KEY>" --probe-path <PATH/TO/> nym-gateway-probe
+```
+
+You will see a lot of output like so:
+
+<AccordionTemplate name="Output">
+```shell
+listen_port=48586
+public_key=3f95caf771b8a63b9bdae6c186f7aba2eae93483f1c82c0243b5e00c85b4ec26
+preshared_key=0000000000000000000000000000000000000000000000000000000000000000
+protocol_version=1
+endpoint=185.186.78.251:51822
+last_handshake_time_sec=0
+last_handshake_time_nsec=0
+tx_bytes=0
+rx_bytes=0
+persistent_keepalive_interval=0
+allowed_ip=0.0.0.0/0
+2025/03/03 18:58:28 Pinging nymtech.net seq=0
+2025/03/03 18:58:29 Ping latency: 44.503483ms
+2025/03/03 18:58:29 Pinging nymtech.net seq=1
+2025/03/03 18:58:29 Ping latency: 42.852414ms
+2025/03/03 18:58:29 Pinging nymtech.net seq=2
+2025/03/03 18:58:29 Ping latency: 43.627256ms
+2025/03/03 18:58:29 Pinging nymtech.net seq=3
+2025/03/03 18:58:29 Ping latency: 43.638839ms
+2025/03/03 18:58:29 Pinging nymtech.net seq=4
+2025/03/03 18:58:29 Ping latency: 43.345357ms
+2025/03/03 18:58:29 Pinging 1.1.1.1 seq=0
+2025/03/03 18:58:29 Ping latency: 46.327233ms
+2025/03/03 18:58:34 Pinging 1.1.1.1 seq=1
+2025/03/03 18:58:34 Ping latency: 46.273726ms
+2025/03/03 18:58:39 Pinging 1.1.1.1 seq=2
+2025/03/03 18:58:39 Ping latency: 46.542774ms
+2025/03/03 18:58:44 Pinging 1.1.1.1 seq=3
+2025/03/03 18:58:44 Ping latency: 45.663545ms
+2025/03/03 18:58:49 Pinging 1.1.1.1 seq=4
+2025/03/03 18:58:49 Ping latency: 43.803063ms
+2025/03/03 18:58:56 Downloaded file content length: 1.00 MB
+2025/03/03 18:58:56 Download duration: 1.308072386s
+2025/03/03 18:58:56 private_key=1083749e43f4f8fb008f3f7deef9107ef86a68969670ddbb9f07bf85f94fb564
+listen_port=39129
+public_key=3f95caf771b8a63b9bdae6c186f7aba2eae93483f1c82c0243b5e00c85b4ec26
+preshared_key=0000000000000000000000000000000000000000000000000000000000000000
+protocol_version=1
+endpoint=185.186.78.251:51822
+last_handshake_time_sec=0
+last_handshake_time_nsec=0
+tx_bytes=0
+rx_bytes=0
+persistent_keepalive_interval=0
+allowed_ip=::/0
+2025/03/03 18:58:56 Pinging ipv6.google.com seq=0
+2025/03/03 18:58:56 Ping latency: 42.839528ms
+2025/03/03 18:58:56 Pinging ipv6.google.com seq=1
+2025/03/03 18:58:56 Ping latency: 54.844651ms
+2025/03/03 18:58:56 Pinging ipv6.google.com seq=2
+2025/03/03 18:58:56 Ping latency: 51.23104ms
+2025/03/03 18:58:56 Pinging ipv6.google.com seq=3
+2025/03/03 18:58:56 Ping latency: 43.320409ms
+2025/03/03 18:58:56 Pinging ipv6.google.com seq=4
+2025/03/03 18:58:56 Ping latency: 63.517358ms
+2025/03/03 18:58:56 Pinging 2001:4860:4860::8888 seq=0
+2025/03/03 18:58:56 Ping latency: 54.682534ms
+2025/03/03 18:59:01 Pinging 2001:4860:4860::8888 seq=1
+2025/03/03 18:59:01 Ping latency: 55.56235ms
+2025/03/03 18:59:06 Pinging 2001:4860:4860::8888 seq=2
+2025/03/03 18:59:06 Ping latency: 55.970418ms
+2025/03/03 18:59:11 Pinging 2001:4860:4860::8888 seq=3
+2025/03/03 18:59:14 Failed to send ping: i/o timeout
+2025/03/03 18:59:19 Pinging 2001:4860:4860::8888 seq=4
+2025/03/03 18:59:22 Failed to send ping: i/o timeout
+2025/03/03 18:59:27 Pinging 2606:4700:4700::1111 seq=0
+2025/03/03 18:59:27 Ping latency: 45.072616ms
+2025/03/03 18:59:32 Pinging 2606:4700:4700::1111 seq=1
+2025/03/03 18:59:32 Ping latency: 44.357306ms
+2025/03/03 18:59:37 Pinging 2606:4700:4700::1111 seq=2
+2025/03/03 18:59:37 Ping latency: 44.013562ms
+2025/03/03 18:59:42 Pinging 2606:4700:4700::1111 seq=3
+2025/03/03 18:59:42 Ping latency: 46.94342ms
+2025/03/03 18:59:47 Pinging 2606:4700:4700::1111 seq=4
+2025/03/03 18:59:48 Ping latency: 43.372288ms
+2025/03/03 18:59:53 Pinging 2620:fe::fe seq=0
+2025/03/03 18:59:53 Ping latency: 42.164952ms
+2025/03/03 18:59:58 Pinging 2620:fe::fe seq=1
+2025/03/03 18:59:58 Ping latency: 42.295812ms
+2025/03/03 19:00:03 Pinging 2620:fe::fe seq=2
+2025/03/03 19:00:03 Ping latency: 43.117534ms
+2025/03/03 19:00:08 Pinging 2620:fe::fe seq=3
+2025/03/03 19:00:08 Ping latency: 44.26068ms
+2025/03/03 19:00:13 Pinging 2620:fe::fe seq=4
+2025/03/03 19:00:13 Ping latency: 45.29956ms
+2025/03/03 19:00:21 Downloaded file content length: 10.00 MB
+2025/03/03 19:00:21 Download duration: 3.39529252s
+```
+</AccordionTemplate>
+
+Whilst you can run the `-agent` directly, it might be easier to run multiple instances in parallel with a script like so:
+
+```bash
+#!/bin/bash
+
+set -eu
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
+
+probe_git_ref="nym-vpn-core-v1.4.0" # check for the most recent release
+monorepo_root=<PATH/TO/NYM/>
+
+set -a
+source "${monorepo_root}/envs/${ENVIRONMENT}.env"
+set +a
+
+export RUST_LOG="info"
+export NODE_STATUS_AGENT_SERVER_ADDRESS="http://127.0.0.1"
+export NODE_STATUS_AGENT_SERVER_PORT="8000"
+export NODE_STATUS_AGENT_AUTH_KEY=<NS_AGENT_PRIVATE_KEY>
+export NODE_STATUS_AGENT_PROBE_EXTRA_ARGS="netstack-download-timeout-sec=30,netstack-num-ping=2,netstack-send-timeout-sec=1,netstack-recv-timeout-sec=1"
+
+workers=${1:-1}
+echo "Running $workers workers in parallel"
+
+function swarm() {
+  local workers=$1
+
+  for ((i = 1; i <= workers; i++)); do
+    ${monorepo_root}/target/release/nym-node-status-agent run-probe --probe-path ~/<PATH/TO>/nym-vpn-client/nym-vpn-core/target/debug/nym-gateway-probe &
+  done
+
+  wait
+
+  echo "All agents completed"
+}
+
+swarm $workers
+```
+
+And run specifying the number of workers with `./<SCRIPT_NAME>.sh <NUMBER_OF_WORKERS>`.
+
+<Callout type="info">
+When running the probe, use logging level `RUST_LOG=info`. The Node Status API relies on that granularity for parsing probe results, and the logs grow incessantly if a lower level (e.g. `DEBUG`) is used.
+</Callout>
+
+### Ports
+By default the API listens on `8000`, so you will need to configure this post to be reachable on your remote server. You can modify this with the `--http_port` flag.
@@ -0,0 +1,3 @@
+{
+  "mainnet":"Mainnet Endpoints"
+}
@@ -47,6 +47,218 @@ This page displays a full list of all the changes during our release cycle from

 <VarInfo />

+## `v2025.4-dorina-patched`
+
+Patched version of `dorina` with a few fixes and tweaks to the release. We would like to ask `nym-node` operators to upgrade to this version as quickly as possible to implement the fixes across the network and improve general quality before NymVPN launch. 
+
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.4-dorina-patched)
+- [`nym-node`](nodes/nym-node.mdx) version `1.6.2`
+
+```shell
+nym-node
+Binary Name:        nym-node
+Build Timestamp:    2025-03-06T20:32:36.922212778Z
+Build Version:      1.6.2
+Commit SHA:         247ebb7c4339de0a298a7fcb2574122a8306c3b8
+Commit Date:        2025-03-06T21:26:16.000000000+01:00
+Commit Branch:      HEAD
+rustc Version:      1.85.0
+rustc Channel:      stable
+cargo Profile:      release
+```
+
+- Use legacy crypto for constructing SURB headers ([#5579])
+- Bugfix: make sure to correctly decode response content when putting it into error message ([#5571])
+- Tweak surb management to be more conservative ([#5570])
+- Deserialize v5 authenticator requests ([#5568])
+- Chore: additional logs when attempting to load ecash keys ([#5567])
+- Add full response body to error message upon decoding failure ([#5566])
+- Hotfix: ensure we bail on merkle leaves insertion upon missing data ([#5565])
+- Feature: v2 authentication request (#5537) ([#5563])
+- Create authenticator v5 request/response types ([#5561])
+
+[#5579]: https://github.com/nymtech/nym/pull/5579
+[#5571]: https://github.com/nymtech/nym/pull/5571
+[#5570]: https://github.com/nymtech/nym/pull/5570
+[#5568]: https://github.com/nymtech/nym/pull/5568
+[#5567]: https://github.com/nymtech/nym/pull/5567
+[#5566]: https://github.com/nymtech/nym/pull/5566
+[#5565]: https://github.com/nymtech/nym/pull/5565
+[#5563]: https://github.com/nymtech/nym/pull/5563
+[#5561]: https://github.com/nymtech/nym/pull/5561
+
+
+## `v2025.4-dorina`
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.4-dorina)
+- [`nym-node`](nodes/nym-node.mdx) version `1.6.0`
+```shell
+Binary Name:        nym-node
+Build Timestamp:    2025-03-04T09:03:11.322601809Z
+Build Version:      1.6.0
+Commit SHA:         7060fa6dad58f17543f5086c73b1854ad1ceae60
+Commit Date:        2025-03-03T17:24:10.000000000Z
+Commit Branch:      release/2025.4-dorina
+rustc Version:      1.86.0-nightly
+rustc Channel:      nightly
+cargo Profile:      release
+```
+
+### Operators Updates & Tools
+
+- New advanced [guide to virtualise a dedicated server](nodes/preliminary-steps/vps-setup/advanced), providing steps for experienced operators and aspiring sys-admins who seek for higher optimisation and better efficiency of their work orchestrating multiple nodes.
+- New Service Grant program is being implemented by operators setting up new ~150 Exit Gateways following the updated [specs for `nym-node`](nodes#minimum-requirements)
+
+### Features
+- [Feature/chain status api](https://github.com/nymtech/nym/pull/5539):
+this PR introduces `/v1/network/chain-status` endpoint on nym api to give basic information about the current block as seen by this API (with some caching) and updates `/health` endpoint to give stall information.
+
+- [Add SURBs soft threshold](https://github.com/nymtech/nym/pull/5535): the IPR should try to keep a buffer of available SURBs to reduce latency.
+
+- [Simplify IPR v8](https://github.com/nymtech/nym/pull/5532): purge stuff from IPR v8 to simplify; use protocol field in v8.
+
+- [Shared instance for DNS AsyncResolver](https://github.com/nymtech/nym/pull/5523):
+make the `HickoryDnsResolver` use a shared instance by default to limit fd use. Now the multiple `nym_http_api_client::Client`s that get built should take advantage of a shared connection pool for DNS lookups. If for some reason a client does need an independent AsyncResolver this can still be done with the added `thread_resolver`  function.
+
+- [cherry-pick 17d3ff2d775f61aee381d90a304ed416c08f33fc onto dorina](https://github.com/nymtech/nym/pull/5519)
+
+- [cherry-pick 6e5d0dac1b75413c5f09122b0d953f8ec6ef48df onto dorina](https://github.com/nymtech/nym/pull/5518)
+
+- [feat: add config option for maximum number of client connections](https://github.com/nymtech/nym/pull/5513)
+
+- [IPR request types v8](https://github.com/nymtech/nym/pull/5498): Bump IPR request/response types to v8
+
+- [Support static routes for HTTP requests](https://github.com/nymtech/nym/pull/5487)
+
+- [added missing import to doctest](https://github.com/nymtech/nym/pull/5480)
+
+- [adjusted TestSetup::new_complex to ensure bonded node's existence](https://github.com/nymtech/nym/pull/5478)
+
+- [Trigger contracts CI on main workspace Cargo changes](https://github.com/nymtech/nym/pull/5477): since the contracts workspace depends on the common code in the main workspace, and since the contracts are critical to not have regressions in, trigger contracts CI on any changes to the workspace Cargo.toml and lock files.
+
+- [Run cargo autoinherit](https://github.com/nymtech/nym/pull/5460): run `cargo autoinherit` to move a bunch of dependencies to the workspace level. `Cargo.lock` remains untouched.
+
+- [Disable debug in wasm and wallet workflows too](https://github.com/nymtech/nym/pull/5459)
+
+- [Fix clippy::precedence](https://github.com/nymtech/nym/pull/5457): fix clippy warnings for the Rust beta toolchain.
+
+- [Provide Interval context with node descriptor endpoints](https://github.com/nymtech/nym/pull/5456): add current interval context information to existing enpoints using `build_skimmed_nodes_response` under the hood. This allows clients checking for a refresh to send the `epoch_uid` as a query parameter when fetching updates so the server can tell it that there have been no changes, instead of sending duplicate data over and over. The changes in this PR should be backwards compatible and never interfere with existing clients. The additions to the `NodeParams` are optional, so there is no error if a client does not send them. Old clients will not send `epoch_uid` by accident so they cannot accidentally clear their set of known nodes. In the response the status field is optional so if it is missing (e.g. if a new client talks to an old server) the connection still works. For old clients speaking to new servers, the json parsing will simply ignore extra information not included in the objects json spec.
+
+<AccordionTemplate name={<TestingSteps/>}>
+
+ Made a request to the `/api/v1/unstable/nym-nodes/semi-skimmed` endpoint:
+ - without entering an epoch_id
+ - with entering the current epoch_id
+ - with entering an old epoch_id
+ - with entering a future epoch_id
+ All results returned the same data, as expected
+
+</AccordionTemplate>
+
+- [Feature/add gbp currency](https://github.com/nymtech/nym/pull/5453)
+
+- [Add helper to extract a list of sqlite files with journal files wal/shm](https://github.com/nymtech/nym/pull/5452)
+
+- [Add a middleware layer to the nym api allowing for data compression](https://github.com/nymtech/nym/pull/5451): after Testing in a minimal example, this does work as expected. Routes still default to plain encoding, however if a client indicates support for a compressed encoding using the `Accept-Encoding` header then the served response will be compressed with the appropriate `Content-Encoding` header. ([Proof-of-Concept](https://gist.github.com/jmwample/c15a983e804fc338fee3d1b037d216b0))
+
+<AccordionTemplate name={<TestingSteps/>}>
+ Sent requests with and without Accept-Encoding: gzip to observe response behaviour
+ Verified if responses included content-encoding: gzip when compression was requested
+ Checked response file output to confirm actual compression occurred
+</AccordionTemplate>
+
+- [Condense core API functionalities and enable gzip decompression for reqwest payloads](https://github.com/nymtech/nym/pull/5450): this PR is intended to take out variables from our usage of HTTP requests in the `nym-http-api-client`. To do this the PR: (1) adds the `ApiClientCore` trait with the minimal feature required to send a request, (2) turns all request sending into trait extension automatically implemented for any type that implements `ApiClientCore`. This has the benefit of consistent expected behavior for all clients using `nym-http-api-client`, including features added going forward. FOR EXAMPLE this pr adds a default header `"accept-encoding: gzip;q=1.0, *;q=0.5"` which indicates that compression is preferred whenever available. Other features to keep in mind here are things like configurable retries, domain fallbacks, etc. Note: the `Apiclient` interface could be simplified, but that would require refactoring our downstream usages of the API. For now this isn't necessary as `ApiClient` is implemented automatically so it costs nothing to have it this way. It just allows divergent usage in downstream crates.
+
+<AccordionTemplate name={<TestingSteps/>}>
+ Measured nym-api response times before and after updating the API client using curl
+ Checked if the client automatically decompressed Gzip responses
+</AccordionTemplate>
+
+- [Seedable clients](https://github.com/nymtech/nym/pull/5440): Adds `DerivationMaterial` and accompanying methods to builders. `DerivationMaterial` encapsulates parameters for deterministic key derivation using HKDF (SHA-512). Use the `derive_secret()` method to generate a 32-byte secret. To prepare for a new derivation, call the `next()` method which increments the index. **It is the caller's responsibility to track and persist the derivation index if keys need to be rederived.**
+
+<AccordionTemplate name="Example">
+
+ ```rust
+ let master_key = [0u8; 32]; // your secret master key
+ let salt = "unique-salt-value".to_string();
+ let material = DerivationMaterial::new(master_key, 0, salt.as_bytes());
+
+ // Derive a secret
+ let secret = material.derive_secret().expect("Failed to derive secret");
+
+ // Prepare for the next derivation
+ let next_material = material.next();
+ ```
+
+</AccordionTemplate>
+
+- [Remove all recv_with_delay and add shutdown condition to loops in client-core](https://github.com/nymtech/nym/pull/5435): inside client-core we want to prepare the ground for moving a behaviour close to what we have in the vpn client. Remove all the recv_with_delay since we want to just stop. Add shutdown condition to all select loops to guard against the shutdown listener being polled inside the select blocks. Remove unwraps when sending on unbounded channels in case the receiver exits before the sender. Move `TaskClient` to be a member field so make it easier to wrap log errors in a shutdown check. Update all fork names to use underscore consistently, since the task separator is hyphen
+
+<AccordionTemplate name={<TestingSteps/>}>
+ Validated that all binaries including `nym-node`, `nym-client`, `nym-network-requester`, and `nym-socks5-client` are behaving well without indicating the presence of any unexpected errors or crashes
+</AccordionTemplate>
+
+- [Disable the test for checking the remaining bandwidth in nym-node-status-api](https://github.com/nymtech/nym/pull/5425): this check fails almost every time on CI, possibly due to rate limiting? It's not good to disable the check, but it's blocking CI as it stands now. Given that we have the check above for locating the ip, we at least have a little coverage.
+
+- [Dz nym node stats](https://github.com/nymtech/nym/pull/5418): removed obsolete fields from stats (blacklisted mixnodes, blacklisted gateways, bonded mixnodes, bonded gateways). Introduced nym-node scraping, beside just mixnodes. `/mixnodes/stats` now returns data for nym-nodes as well, which results in much more accurate "packets mixed" stats.
+
+- [Nymnode entrypoint docker](https://github.com/nymtech/nym/pull/5300)
+
+### Bugfix
+- [bugfix: dont query for ecash apis unless necessary when spending ticketbooks](https://github.com/nymtech/nym/pull/5508)
+
+- [bugfix: bound check when recovering a reply SURB](https://github.com/nymtech/nym/pull/5502)
+
+- [fix: update fx average rate calcs to ignore 0 values](https://github.com/nymtech/nym/pull/5454)
+
+### Chore
+- [chore: workspace global panic preventing lints](https://github.com/nymtech/nym/pull/5512)
+
+- [chore: removed all old coconut code](https://github.com/nymtech/nym/pull/5500)
+
+- [build(deps): bump the patch-updates group across 1 directory with 3 updates](https://github.com/nymtech/nym/pull/5482): updates `clap` from 4.5.28 to 4.5.30, updates `clap` from 4.5.28 to 4.5.30, updates `prost` from 0.13.4 to 0.13.5.
+
+- [build(deps): bump http from 1.1.0 to 1.2.0](https://github.com/nymtech/nym/pull/5472)
+
+- [build(deps): bump utoipa-swagger-ui from 8.0.3 to 8.1.0](https://github.com/nymtech/nym/pull/5471)
+
+- [build(deps): bump colored from 2.1.0 to 2.2.0](https://github.com/nymtech/nym/pull/5470)
+
+- [build(deps): bump celes from 2.4.0 to 2.5.0](https://github.com/nymtech/nym/pull/5469)
+
+- [build(deps): bump the patch-updates group with 2 updates](https://github.com/nymtech/nym/pull/5467): updates `clap` from 4.5.28 to 4.5.29, updates `prost` from 0.13.4 to 0.13.5.
+
+- [build(deps): bump elliptic from 6.5.4 to 6.6.1 in /docker/typescript_client/upload_contract](https://github.com/nymtech/nym/pull/5463): bumps [elliptic](https://github.com/indutny/elliptic) from 6.5.4 to 6.6.1.
+
+- [build(deps): bump uniffi_build from 0.25.3 to 0.29.0](https://github.com/nymtech/nym/pull/5448)
+
+- [Upgrade tower to 0.5.2](https://github.com/nymtech/nym/pull/5446)
+
+- [build(deps): bump hickory-proto from 0.24.2 to 0.24.3 in /nym-wallet](https://github.com/nymtech/nym/pull/5445)
+
+- [build(deps): bump hickory-proto from 0.24.2 to 0.24.3](https://github.com/nymtech/nym/pull/5444)
+
+- [build(deps): bump the patch-updates group across 1 directory with 10 updates](https://github.com/nymtech/nym/pull/5439):
+Bumps the patch-updates group with 10 updates in the directory:
+
+| Package | From | To |
+| --- | --- | --- |
+| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.85` | `0.1.86` |
+| [clap](https://github.com/clap-rs/clap) | `4.5.27` | `4.5.28` |
+| [comfy-table](https://github.com/nukesor/comfy-table) | `7.1.3` | `7.1.4` |
+| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.24.2` | `0.24.3` |
+| [once_cell](https://github.com/matklad/once_cell) | `1.20.2` | `1.20.3` |
+| [pin-project](https://github.com/taiki-e/pin-project) | `1.1.8` | `1.1.9` |
+| [serde_json_path](https://github.com/hiltontj/serde_json_path) | `0.7.1` | `0.7.2` |
+| [toml](https://github.com/toml-rs/toml) | `0.8.19` | `0.8.20` |
+| [cosmrs](https://github.com/cosmos/cosmos-rust) | `0.21.0` | `0.21.1` |
+| [tokio-postgres](https://github.com/sfackler/rust-postgres) | `0.7.12` | `0.7.13` |
+
+- [build(deps): bump openssl from 0.10.56 to 0.10.70 in /nym-wallet](https://github.com/nymtech/nym/pull/5422)
+
+- [build(deps): bump hyper from 1.4.1 to 1.6.0](https://github.com/nymtech/nym/pull/5416)
+
+- [build(deps): bump publicsuffix from 2.2.3 to 2.3.0](https://github.com/nymtech/nym/pull/5367)
+
 ## `v2025.3-ruta`

 - [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.3-ruta)
@@ -97,7 +309,7 @@ As we announced in [`hu` release notes](#service-grant-program-v2), we are opene

 ##### Locations

-These locations and slots are approximate and constantly change based on new operators submissions. Please keep in mind that we are going to chose people with respect to empty slots in the given location at the time of their submission. In case of competing submissions in the same location we will take the one with better specs vs price ratio. 
+These locations and slots are approximate and constantly change based on new operators submissions. Please keep in mind that we are going to chose people with respect to empty slots in the given location at the time of their submission. In case of competing submissions in the same location we will take the one with better specs vs price ratio.

 | LOCATION       | SLOTS |
 | :--            | --:   |
@@ -151,7 +363,7 @@ These locations and slots are approximate and constantly change based on new ope

 - [Send shutdown instead of panic when reaching max fail](https://github.com/nymtech/nym/pull/5398): Remove a panic and an unwrap inside `client-core` that is hit occasionally in the vpn client. This is a change that can have wide ranging impact since it changes the task handling and it's inside `client-core`, which is used in many components and services, so preventing regressions is important.

- [Relocate a validator api function](https://github.com/nymtech/nym/pull/5401): Adds a function to the `nym-validator-client` crate that hits the network details endpoint and returns an object parsed from `json`. This was floating loose in the `nym-vpn-client` repo. 
+- [Relocate a validator api function](https://github.com/nymtech/nym/pull/5401): Adds a function to the `nym-validator-client` crate that hits the network details endpoint and returns an object parsed from `json`. This was floating loose in the `nym-vpn-client` repo.

 - [Bump the patch-updates group across 1 directory with 9 updates](https://github.com/nymtech/nym/pull/5406)

@@ -199,7 +411,7 @@ From `nym-node v1.3.0` operators can technically choose multiple functionalities

 - Updated maintenance guides to [backup](nodes/maintenance#backup-a-node), [restore](nodes/maintenance#restoring-a-node) and [move](nodes/maintenance#moving-a-node) a node, containing a new and important commands to backup and restore `clients.sqlite` database.

- [New explanation of `nym-node` functionalities](nodes/nym-node/setup#functionality-mode) describing how Gateways get selected in Mixnet mode and Wireguard mode. 
+- [New explanation of `nym-node` functionalities](nodes/nym-node/setup#functionality-mode) describing how Gateways get selected in Mixnet mode and Wireguard mode.

 <Callout type="warning">
 Wireguard nodes route data directly to the open internet. Therefore it exposes IP of operators server (VPS) to abuse complains. Before you decide to run a node with active wireguard routing, please read our [Community Counsel pages](community-counsel/exit-gateway) containing more information and some legal content.
@@ -223,7 +435,7 @@ We have been notified that a handful of nodes have been taken down by abuse repo
 - Join [Community legal counsel](https://nym.com/docs/operators/community-counsel) - our collective knowledge hub. Add your findings by opening a [Pull Request](https://nym.com/docs/operators/add-content)

 - While we are working on a new list of more friendly providers, consider to move away from these provides as soon as possible:
-    
+
    - Servinga / VPS2day (AS39378)
    - Frantech / Ponynet / BuyVM (AS53667)
    - OVH SAS / OVHcloud (AS16276)
@@ -233,7 +445,7 @@ We have been notified that a handful of nodes have been taken down by abuse repo
    - Psychz Networks (AS40676)
    - 1337 Services GmbH / RDP.sh (AS210558)

- Backup your nodes to have access to `.nym` directory locally. Follow [node](nodes/maintenance#backup-a-node) and [proxy configuration](nodes/maintenance#backup-proxy-configuration) backup guides to be able to [restore your node](nodes/maintenance#restoring-a-node) later on on another machine, without losing your delegation.  
+- Backup your nodes to have access to `.nym` directory locally. Follow [node](nodes/maintenance#backup-a-node) and [proxy configuration](nodes/maintenance#backup-proxy-configuration) backup guides to be able to [restore your node](nodes/maintenance#restoring-a-node) later on on another machine, without losing your delegation.

 - We would like to ask operators who use reverse proxy and a domain (required for Gateways) to start using a common convention starting with `nym-exit` for their nodes URL. The entire address should have this new format:
 ```
@@ -258,7 +470,7 @@ nym-exit.mysquad.org

 **The `NYM-EXIT` part in the beginning is what's important.**

- When registering a domain, check [Top Level Domain (TLD)](https://www.techopedia.com/definition/1348/top-level-domain-tld) terms and conditions. For example `.icu` is a no go. Having a wrong TLD may lead to your domain being taken away from you when facing a DMCA report.  
+- When registering a domain, check [Top Level Domain (TLD)](https://www.techopedia.com/definition/1348/top-level-domain-tld) terms and conditions. For example `.icu` is a no go. Having a wrong TLD may lead to your domain being taken away from you when facing a DMCA report.

 - Write a message to your provider and introduce your intention to run a Nym Node on their service
 <AccordionTemplate name="Email template: Introduce yourself to your VPS provider">
@@ -322,7 +534,7 @@ Undelegated due to high saturation:

 #### Service Grant Program v2

-Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to support Exit Gateway operators before they will be rewarded by collecting [zk-nym tickets](../network/cryptography/zk-nym) from users subscription. Operators included in SGP are long term active community members with the highest requirements on the technical setup and upgrading pace. We are about to start a second iteration of SGP very soon (SGPv2). The final slots and locations are yet to be concluded. Priority to participate in SGPv2 will be given to the current operators in SGP. Based on the number of slots, we will then determine how many more operators can sign up. 
+Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to support Exit Gateway operators before they will be rewarded by collecting [zk-nym tickets](../network/cryptography/zk-nym) from users subscription. Operators included in SGP are long term active community members with the highest requirements on the technical setup and upgrading pace. We are about to start a second iteration of SGP very soon (SGPv2). The final slots and locations are yet to be concluded. Priority to participate in SGPv2 will be given to the current operators in SGP. Based on the number of slots, we will then determine how many more operators can sign up.

 ##### Rules of SGPv2

@@ -330,7 +542,7 @@ Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to
 **We will share more info soon in the channels. The rules are not set in stone and could potentially be altered or updated in the future! Do *not* purchase new servers neither migrate your nodes just yet.**
 </Callout>

-As we finalising last details of *"Project Smoosh"*, where one binary - `nym-node` - can run as an `entry-gateway`, `mixnode` or `exit-gateway` in Mixnet mode as well as `entry-gateway` or `exit-gateway` in Wireguard mode, we plan to step up the game. SGPv2 grants will be higher if operators can meet new requirements. 
+As we finalising last details of *"Project Smoosh"*, where one binary - `nym-node` - can run as an `entry-gateway`, `mixnode` or `exit-gateway` in Mixnet mode as well as `entry-gateway` or `exit-gateway` in Wireguard mode, we plan to step up the game. SGPv2 grants will be higher if operators can meet new requirements.

 **Minimum Specs & Requirements**

@@ -402,7 +614,7 @@ These are minimum requirements to become a part of SGPv2. We aim to have nodes o

 - [build(deps): bump criterion from `0.4.0` to `0.5.1`](https://github.com/nymtech/nym/pull/4911): Bumps [criterion](https://github.com/bheisler/criterion.rs) from `0.4.0` to `0.5.1`.

- [NS API: add mixnet scraper](https://github.com/nymtech/nym/pull/5200) 
+- [NS API: add mixnet scraper](https://github.com/nymtech/nym/pull/5200)

 - [build(deps): bump http from `1.1.0` to `1.2.0`](https://github.com/nymtech/nym/pull/5228): Bumps [http](https://github.com/hyperium/http) from `1.1.0` to `1.2.0`.

@@ -410,41 +622,41 @@ These are minimum requirements to become a part of SGPv2. We aim to have nodes o

 - [Add windows to CI builds](https://github.com/nymtech/nym/pull/5269)

- [nym topology revamp](https://github.com/nymtech/nym/pull/5271): This PR changes the internals of the `NymTopology` to blur the lines between explicit mixnodes and gateways so that what used to be considered a "mixnode" could be a valid egress point of the network. `NymTopology` is no longer divided into `BTreeMap<MixLayer, Vec<mix::Node>>` and `Vec<gateway::Node>`. instead there's information about the current rewarded set (to support future VRF work) and a simple map of `HashMap<NodeId, RoutingNode>`. The new features are mostly controlled via 2 new flags/config values: 
+- [nym topology revamp](https://github.com/nymtech/nym/pull/5271): This PR changes the internals of the `NymTopology` to blur the lines between explicit mixnodes and gateways so that what used to be considered a "mixnode" could be a valid egress point of the network. `NymTopology` is no longer divided into `BTreeMap<MixLayer, Vec<mix::Node>>` and `Vec<gateway::Node>`. instead there's information about the current rewarded set (to support future VRF work) and a simple map of `HashMap<NodeId, RoutingNode>`. The new features are mostly controlled via 2 new flags/config values:
    - `use_extended_topology` that tells the client to retrieve **all** network nodes rather than the ones that got assigned "active" mixnode role (or support being a gateway)
    - `ignore_egress_epoch_role` that tells the client it's  fine to construct egress packets to nodes that are **not** assigned entry or exit gateway role
- 
+
 - [Nyx Chain Watcher](https://github.com/nymtech/nym/pull/5274)

 - [Include `IPINFO_API_TOKEN` in nightly CI](https://github.com/nymtech/nym/pull/5285)

- [Move tun constants to network defaults](https://github.com/nymtech/nym/pull/5286): 
+- [Move tun constants to network defaults](https://github.com/nymtech/nym/pull/5286):
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Regression Testing**:
- Verified no issues arose when running tests for the affected files.  
- Tested TUN behaviour with new nym-nodes in the hu branch.  
- 
-**Results**:  
+- Verified no issues arose when running tests for the affected files.
+- Tested TUN behaviour with new nym-nodes in the hu branch.

- **No bugs detected**.  
- Tunnels are functioning as expected, with traffic routing and IP generation working seamlessly.  
-</AccordionTemplate> 
+**Results**:
+
+- **No bugs detected**.
+- Tunnels are functioning as expected, with traffic routing and IP generation working seamlessly.
+</AccordionTemplate>

 - [Add dependabot assignes for the root cargo ecosystem](https://github.com/nymtech/nym/pull/5297)

 - [build(deps): bump the patch-updates group across 1 directory with 35 updates](https://github.com/nymtech/nym/pull/5310): Bumps the `patch-updates` group with 33 updates

- [Periodically remove stale gateway messages](https://github.com/nymtech/nym/pull/5312): This PR introduces a simple task that removes gateway messages that haven't been retrieved in (by default) 24h.  
+- [Periodically remove stale gateway messages](https://github.com/nymtech/nym/pull/5312): This PR introduces a simple task that removes gateway messages that haven't been retrieved in (by default) 24h.
 <AccordionTemplate name={<TestingSteps/>}>
 **Automation Script for Data Cleanup Validation**

 Test Objective: Validate that the stale message cleanup mechanism in the database correctly removes records older than the configured threshold (24 hours).
- 
+
 Test Setup:
 1. Environment:
    * SQLite database
    * Bash script: used to insert data.
- 
+
 Steps Performed:
 1. Ran the insert_data.sh script to populate the database with test data:
    * Recent records inserted successfully.
@@ -452,8 +664,8 @@ Steps Performed:
 3. Confirmed that all 20 records (10 recent + 10 stale) were present.
 4. Allowed the system to run for 24 hours to trigger the cleanup mechanism.
 5. Queried the database again after 24 hours: sqlite3 gateway_storage.db "SELECT * FROM message_store;"
-6. 
- 
+6.
+
 Expected Result:
 * All stale records (older than 24 hours) should be removed.
 * Recent records should remain in the database.
@@ -464,18 +676,18 @@ Actual Result:

 - [Use expect in geodata test to give error message on failure](https://github.com/nymtech/nym/pull/5314): Keep hitting this error on CI, from what I think is network hickup. But it's hard to tell form the log since the error is swallowed.  Explicitly unwrap the result so we get a more detailed error output.
 <AccordionTemplate name={<TestingSteps/>}>
-**Quick Code Review**  
- 
-**Summary**  
+**Quick Code Review**
+
+**Summary**
 1. **CI Workflow**: Adjusted paths to optimise build triggers, avoiding unnecessary CI runs while ensuring coverage for key directories
 2. **Geolocation Test**: Improved error handling by replacing assertions with `.expect` for clearer debugging in API regression tests
- 
-**Conclusion**  
+
+**Conclusion**

 Regression testing confirms everything works as intended. **Approved**.
 </AccordionTemplate>

- [`CancellationToken`-based shutdowns](https://github.com/nymtech/nym/pull/5325): This PR introduces scaffolding for using `CancellationToken` and `TaskTracker` for our graceful shutdowns rather than the existing `TaskClient` and `TaskManager`. 
+- [`CancellationToken`-based shutdowns](https://github.com/nymtech/nym/pull/5325): This PR introduces scaffolding for using `CancellationToken` and `TaskTracker` for our graceful shutdowns rather than the existing `TaskClient` and `TaskManager`.

 - [Introduce `/load` endpoint for self-reported quantised Nym Node load](https://github.com/nymtech/nym/pull/5326): This PR introduces a new `/load` endpoint on a `NymNode` to return its current load. It returns the following data:
 ```rust
@@ -505,7 +717,7 @@ The actual values  for`NodeLoad` are determined as follows:
    - Thus we calculate two additional auxiliary `Load` values, for memory usage and swap usage, i.e.: `used_memory / total_memory` and `used_swap / total_swap` respectively.
    - Then we check whether either of the `MemoryLoad` or `SwapLoad` is bigger than the current base `Load` of the machine we have determined, if so, it's increased by one tier / bucket. For example, say the current machine load is `Load::Low`, but the memory usage is at 90% (`Load::VeryHigh`). that would result in the reported `Load` being bumped up to `Load::Medium` instead. The same logic applies with swap load, **however, only if the total swap > 1GB**. this is to prevent weird edge cases where the machine has hardly any swap.
    - Finally, the `.total` `Load` uses the same "tier bumping" behaviour using the `.total` and `.network` loads, i.e. `if network > machine`, then `total = machine + 1`. for example if `machine` `Load` is `Load::Low`, but `network` `Load` is `Load::Medium`, then the `total` `Load` is set to `Load::Medium` instead.
-</AccordionTemplate> 
+</AccordionTemplate>

 - [Bump the `patch-updates` group with 8 updates](https://github.com/nymtech/nym/pull/5336)

@@ -517,29 +729,29 @@ The actual values  for`NodeLoad` are determined as follows:

 - [Bump mikefarah/yq from `4.44.6` to `4.45.1`](https://github.com/nymtech/nym/pull/5342)

- [Update `indexed_db_futures`](https://github.com/nymtech/nym/pull/5347): Updates the `indexed_db_futures` dependency to stop relying on the fork. 
+- [Update `indexed_db_futures`](https://github.com/nymtech/nym/pull/5347): Updates the `indexed_db_futures` dependency to stop relying on the fork.

 - [Refresh wasm sdk](https://github.com/nymtech/nym/pull/5353): This PR refreshes the wasm clients to make them usable in the current network

 - [Client gateway selection](https://github.com/nymtech/nym/pull/5358): Changed how gateway is selected.
    - For init the target gateway can't support mixing
    - For egress, unless `ignore_epoch_roles` is specified, the gateway can't be currently assigned to a mixing layer. But it can be standby or inactive
-    
+
 - [Exposed `NymApiClient` method for obtaining node performance history](https://github.com/nymtech/nym/pull/5360)

 - [Bind to `[::]` on `nym-node` for both IP versions](https://github.com/nymtech/nym/pull/5361)
 <AccordionTemplate name={<TestingSteps/>}>
 **IPv4 Configuration and Migration Testing**
- 
+
 Testing Steps:
 - Initiated and ran a nym-node with version 1.3.1 on an IPv4-only machine, then updated it to the new 'hu', 1.4.0 version.
 - Initiated and ran a new nym-node with 'hu', 1.4.0 always on a machine with only IPv4.
 - Initiated and ran a new nym-node with 'hu', 1.4.0 on a machine with both IPv4 and IPv6 for regression testing.
- 
+
 Results:
 - No functional issues during version updates.
 - Logged message on all versions: "no registered client for destination: ff02::2"
- 
+
 Status: Pass
 </ AccordionTemplate>

@@ -554,10 +766,10 @@ Status: Pass
 - Ensured a client is able to select a node which aside from a gateway, can also act as a mixnode
 - Verified 'ignore_epoch_roles' is the default mode
 - _note; this is most likely not going to be a permanent solution_
- 
+
 **Results:**
- Clients and topology are behaving correctly 
-  
+- Clients and topology are behaving correctly
+
 Status: Pass
 </ AccordionTemplate>

@@ -612,7 +824,7 @@ We are developing a design where operators can enable multiple modes, and let th
    - Moved top level `authenticator` section to `service_providers` so that it'd live alongside NR and IPR
    - Added general `debug` section
    - Added `metrics` section
- All documentation migrated to a new URL [nym.com/docs](https://nym.com/docs) alongside the rebranding of Nym organisation. 
+- All documentation migrated to a new URL [nym.com/docs](https://nym.com/docs) alongside the rebranding of Nym organisation.
    - Updated [network architecture diagrams](https://nym.com/docs/network/architecture)
    - New blow-by-blow mixnet [traffic flow](https://nym.com/docs/network/architecture) section
 - [Winter Nym Squad League started](https://forum.nym.com/t/nym-squad-league-farewell-fall-welcome-winter/977)
@@ -648,11 +860,11 @@ We are developing a design where operators can enable multiple modes, and let th
    - Everything in `mixnode` directory has been removed because there was nothing really left there. The mixing socket listener was unified in `nym-node` and similarly `verloc` was also moved there
    - `gateway` directory was similarly reduced in size. Now it also creates appropriate tasks as opposed to the whole gateway process. eventually it might also be further stripped, but today is not that day.
    - Removed the generic parameter on the `GatewayStorage` to simplify all the generics down the stack. it wasn't used anyway
- 
+
 CLI:
    - Added `--modes` argument to specify all node modes with a single command (or `env` variable). for example: `--modes="mixnode,entry"`. Can't be used alongside `--modes`
    - Extended `--mode` argument to allow specifying it multiple times, for example: `--mode mixnode --mode entry`. can't be used alongside `--mode`
- 
+
 Config changes:
    - Replaced `mode` with `modes` to allow setting the node to run with say, `entry` + `mixnode` roles simultaneously
    - Added `maximum_forward_packet_delay` to `mixnet.debug` section
@@ -677,17 +889,17 @@ Config changes:
 - [Remove unneeded async function annotation](https://github.com/nymtech/nym/pull/5246)
 - [Add control messages to `GatewayTransciver`](https://github.com/nymtech/nym/pull/5247)
 <AccordionTemplate name={<TestingSteps/>}>
-**Review and Testing: Forget Me Implementation**  
+**Review and Testing: Forget Me Implementation**

- Validated the encryption and delivery of `ForgetMe` control messages to the gateway 
- 
-**Testing: MixTrafficController Integration**  
+- Validated the encryption and delivery of `ForgetMe` control messages to the gateway

- Verified that the `MixTrafficController` invokes `ForgetMe` logic correctly during shutdown  
- Tested behaviour for gateway transceiver failures while sending control messages  
- 
-**Testing: Gateway Storage Updates**  
- Confirmed successful deletion of client data (e.g., inbox messages, bandwidth allocations) from persistent storage  
+**Testing: MixTrafficController Integration**
+
+- Verified that the `MixTrafficController` invokes `ForgetMe` logic correctly during shutdown
+- Tested behaviour for gateway transceiver failures while sending control messages
+
+**Testing: Gateway Storage Updates**
+- Confirmed successful deletion of client data (e.g., inbox messages, bandwidth allocations) from persistent storage
 </AccordionTemplate>

 - [Add conversion unit tests for auth msg](https://github.com/nymtech/nym/pull/5251)
@@ -704,13 +916,13 @@ Config changes:
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Review File: `common/credential-storage/src/backends/sqlite.rs`**
 - Verified addition of `close` method for the SQLite backend
- 
+
 2. **Review File: `common/credential-storage/src/ephemeral_storage.rs`**
 - Confirmed addition of `close` method for ephemeral storage with no action required
- 
+
 3. **Review File: `common/credential-storage/src/persistent_storage/mod.rs`**
 - Ensured `close` method integration for persistent storage
- 
+
 4. **Review File: `common/credential-storage/src/storage.rs`**
 - Verified updates to the `Storage` trait to include `close` and `cleanup_expired` methods
 </AccordionTemplate>
@@ -719,15 +931,15 @@ Config changes:
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Review File: `common/network-defaults/src/constants.rs`**
 - Confirmed updated `mixnet_vpn` constants were added.
- 
+
 2. **Review File: `service-providers/ip-packet-router/src/constants.rs`**
 - Checked replacement of legacy `TUN_*` constants with new `mixnet_vpn` constants.
 - Validated alignment of routing traffic configurations.
- 
+
 3. **Review File: `service-providers/ip-packet-router/src/ip_packet_router.rs`**
 - Ensured new `nym_network_defaults::constants::mixnet_vpn` constants replaced old references.
 - Verified `TunDeviceConfig` consistency.
- 
+
 4. **Review File: `service-providers/ip-packet-router/src/util/generate_new_ip.rs`**
 - Confirmed substitution of `TUN_DEVICE_*` constants with `NYM_TUN_DEVICE_*` constants.
 - Tested functionality for generating random IPs within subnet.
@@ -743,54 +955,54 @@ Config changes:
     - `nym_node_mixnet_ingress_excessive_delay_packets`
     - `nym_node_mixnet_ingress_forward_hop_packets_dropped`
     - `nym_node_mixnet_ingress_final_hop_packets_dropped`
-     
+
     - `nym_node_mixnet_ingress_forward_hop_packets_received_rate`
-     - `nym_node_mixnet_ingress_final_hop_packets_received_rate`      
-     - `nym_node_mixnet_ingress_malformed_packets_received_rate`         
-     - `nym_node_mixnet_ingress_excessive_delay_packets_rate`       
+     - `nym_node_mixnet_ingress_final_hop_packets_received_rate`
+     - `nym_node_mixnet_ingress_malformed_packets_received_rate`
+     - `nym_node_mixnet_ingress_excessive_delay_packets_rate`
     - `nym_node_mixnet_ingress_forward_hop_packets_dropped_rate`
     - `nym_node_mixnet_ingress_final_hop_packets_dropped_rate`
- 
+
   - egress:
     - `nym_node_mixnet_egress_stored_on_disk_final_hop_packets`
     - `nym_node_mixnet_egress_forward_hop_packets_sent`
     - `nym_node_mixnet_egress_ack_packets_sent`
     - `nym_node_mixnet_egress_forward_hop_packets_dropped`
-     
+
     - `nym_node_mixnet_egress_forward_hop_packets_sent_rate`
     - `nym_node_mixnet_egress_ack_packets_sent_rate`
     - `nym_node_mixnet_egress_forward_hop_packets_dropped_rate`
- 
+
 - client sessions
   - `nym_node_entry_client_sessions_unique_users`
   - `nym_node_entry_client_sessions_sessions_started`
   - `nym_node_entry_client_sessions_finished_sessions`
   - `nym_node_entry_client_sessions_durations_{TYP}` (histogram), for example `nym_node_entry_client_sessions_durations_vpn`
- 
+
 - wireguard:
   - `nym_node_wireguard_bytes_rx`
   - `nym_node_wireguard_bytes_tx`
   - `nym_node_wireguard_bytes_total_peers`
   - `nym_node_wireguard_bytes_active_peers`
-   
+
   - `nym_node_wireguard_bytes_rx_rate`
   - `nym_node_wireguard_bytes_tx_rate`
- 
- 
+
+
 - network
   - `nym_node_network_active_ingress_mixnet_connections`
   - `nym_node_network_active_ingress_web_socket_connections`
   - `nym_node_network_active_egress_mixnet_connections`
- 
+
 - process
   - `nym_node_process_forward_hop_packets_being_delayed`
   - `nym_node_process_packet_forwarder_queue_size`
   - `nym_node_process_topology_query_resolution_latency` (histogram)
   - `nym_node_process_final_hop_packets_pending_delivery`
-   - `nym_node_process_forward_hop_packets_pending_delivery` 
+   - `nym_node_process_forward_hop_packets_pending_delivery`
 </AccordionTemplate>

- [Amend 250gb limit](https://github.com/nymtech/nym/pull/5313): Change bandwidth cap to 250gb 
+- [Amend 250gb limit](https://github.com/nymtech/nym/pull/5313): Change bandwidth cap to 250gb
 - [Warn users if node is run in exit mode only](https://github.com/nymtech/nym/pull/5320): Throws a warning if node is run in "exit" mode only as by default, this will **NOT** enable entry capabilities, i.e. opening the websocket. thus making it ineligible for rewarded set selection (and rewards)
 - [Reduce log severity for number of packets being delayed](https://github.com/nymtech/nym/pull/5321)
 - [Apply 1.84 linter suggestions](https://github.com/nymtech/nym/pull/5330)
@@ -806,7 +1018,7 @@ Config changes:
 - [Make sure to apply gateway score filtering when choosing initial node](https://github.com/nymtech/nym/pull/5256)
 - [Fixed client session histogram buckets](https://github.com/nymtech/nym/pull/5316)
 - [Contract version assignment](https://github.com/nymtech/nym/pull/5318): This PR fixes updates to current nym-node version as well as introduces migration to fix the existing state of the mainnet contract
- - [Make sure refresh data key matches bond info](https://github.com/nymtech/nym/pull/5329): This is to forbid operators from reusing the same underlying identity key for multiple nodes by overwriting the describe data. the reported key has to always match what the node has bonded with (and the contract enforces uniqueness) 
+ - [Make sure refresh data key matches bond info](https://github.com/nymtech/nym/pull/5329): This is to forbid operators from reusing the same underlying identity key for multiple nodes by overwriting the describe data. the reported key has to always match what the node has bonded with (and the contract enforces uniqueness)

 ## Archived Changelog

@@ -128,10 +128,15 @@ mkdir -pv <PATH_TO_TARGET_DIRECTORY>

 ###### 2. Backup `clients.sqlite` database

+
 - Install `sqlite3`
 ```sh
 apt install sqlite3
 ```
+- **Stop your node**
+```sh
+service nym-node stop
+```
 - Open sqlite CLI shell inside `clients.sqlite` database
 ```sh
 sqlite3 ~/.nym/nym-nodes/default-nym-node/data/clients.sqlite
@@ -151,10 +156,14 @@ sqlite3 ~/.nym/nym-nodes/default-nym-node/data/clients.sqlite
 scp -r <SOURCE_USER_NAME>@<SOURCE_HOST_ADDRESS>:~/.nym/nym-nodes/<ID> <PATH_TO_TARGET_DIRECTORY>
 ```

-###### 4. Verify the success of the backup
+###### 4. Verify the success of the backup & start your node

 The `scp` command should print logs, an operator can see directly whether it was successful or if it encountered any error. However, double check that all your needed configuration is in the backup target directory.

+- Start your node
+```sh
+service nym-node start && journalctl -u nym-node -f
+```
 </Steps>

 Now you have everything needed to restore your `nym-node` on another server. If you are in a need of doing so, follow the steps in [*Restoring a node*](#restoring-a-node) chapter below.
@@ -360,7 +369,7 @@ mkdir ~/.nym/nym-nodes
 ```
 ###### 2. Backup `clients.sqlite` database

- Stop your node
+- **Stop your node**
 ```sh
 service nym-node stop
 ```
@@ -20,12 +20,12 @@ This documentation page provides a guide on how to set up and run a [NYM NODE](.
 ```sh
 nym-node
 Binary Name:        nym-node
-Build Timestamp:    2025-02-13T11:49:34.670488195Z
-Build Version:      1.5.0
-Commit SHA:         a3e19b4563843055b305ea9a397eb1ad84b5c378
-Commit Date:        2025-02-10T18:14:47.000000000+01:00
+Build Timestamp:    2025-03-06T20:32:36.922212778Z
+Build Version:      1.6.2
+Commit SHA:         247ebb7c4339de0a298a7fcb2574122a8306c3b8
+Commit Date:        2025-03-06T21:26:16.000000000+01:00
 Commit Branch:      HEAD
-rustc Version:      1.84.1
+rustc Version:      1.85.0
 rustc Channel:      stable
 cargo Profile:      release
 ```
@@ -3,8 +3,9 @@ import { VarInfo } from 'components/variable-info.tsx';
 import { Steps } from 'nextra/components';import { Tabs } from 'nextra/components';
 import { MyTab } from 'components/generic-tabs.tsx';
 import PortsNymNode from 'components/operators/snippets/ports-nym-node.mdx';
-import PortsValidator from 'components/operators/snippets/ports-validator.mdx'
-import NymNodeSpecs from 'components/operators/snippets/nym-node-specs.mdx'
+import PortsValidator from 'components/operators/snippets/ports-validator.mdx';
+import NymNodeSpecs from 'components/operators/snippets/nym-node-specs.mdx';
+import NTPSync from 'components/operators/snippets/ntp-time-sync.mdx'

 # VPS Setup & Configuration

@@ -42,14 +43,18 @@ apt update -y && apt --fix-broken install
 ```
 - Install dependencies
 ```sh
-apt -y install ca-certificates jq curl wget ufw jq tmux pkg-config build-essential libssl-dev git
+apt -y install ca-certificates jq curl wget ufw jq tmux pkg-config build-essential libssl-dev git ntp ntpdate
 ```
 - Double check ufw is installed correctly
 ```sh
 apt install ufw --fix-missing
 ```

-###### 2. Configure your firewall using Uncomplicated Firewall (UFW)
+###### 2. Synchronize time of your server
+
+<NTPSync />
+
+###### 3. Configure your firewall using Uncomplicated Firewall (UFW)

 For a `nym-node` or Nyx validator to recieve traffic, you need to open ports on the server. The following commands will allow you to set up a firewall using `ufw`.

@@ -70,7 +75,7 @@ ufw enable
 ufw status
 ```

-###### 3. Open all needed ports to have your firewall for `nym-node` working correctly
+###### 4. Open all needed ports to have your firewall for `nym-node` working correctly

 <div>
  <Tabs items={[
@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.47"
+version = "1.1.48"
 edition = "2021"
 license.workspace = true

@@ -426,6 +426,11 @@ impl<R, S> FreshHandler<R, S> {
            return Ok(2);
        }

+        // a v4 gateway will understand v3 requests (aes256gcm-siv)
+        if client_protocol_version == 3 {
+            return Ok(3);
+        }
+
        // we can't handle clients with higher protocol than ours
        // (perhaps we could try to negotiate downgrade on our end? sounds like a nice future improvement)
        if client_protocol_version <= CURRENT_PROTOCOL_VERSION {
@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.51"
+version = "1.1.53"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -144,4 +144,4 @@ rand_chacha = { workspace = true }
 sha2 = "0.9"

 [lints]
-workspace = true
+workspace = true
@@ -10,7 +10,7 @@ use nym_dkg::bte::keys::KeyPair as DkgKeyPair;
 use rand::{CryptoRng, RngCore};
 use std::path::Path;
 use thiserror::__private::AsDisplay;
-use tracing::warn;
+use tracing::{debug, warn};

 pub(crate) fn init_bte_keypair<R: RngCore + CryptoRng>(
    rng: &mut R,
@@ -39,17 +39,20 @@ pub(crate) fn load_bte_keypair(config: &config::EcashSigner) -> anyhow::Result<D
 pub(crate) fn load_ecash_keypair_if_exists(
    config: &config::EcashSigner,
 ) -> anyhow::Result<Option<KeyPairWithEpoch>> {
+    let storage_path = &config.storage_paths.ecash_key_path;
+    debug!(
+        "attempting to ecash keypair from {}",
+        storage_path.display()
+    );
    if !config.storage_paths.ecash_key_path.exists() {
+        debug!("the provided filepath doesn't exist - the key won't be loaded");
        return Ok(None);
    }

-    if let Ok(ecash_key) =
+    let ecash_key =
        nym_pemstore::load_key::<KeyPairWithEpoch, _>(&config.storage_paths.ecash_key_path)
-    {
-        return Ok(Some(ecash_key));
-    }
-
-    bail!("ecash key load failure")
+            .context("failed to load ecash key")?;
+    Ok(Some(ecash_key))
 }

 // the keys can be considered valid if they were generated for the current dkg epoch
@@ -33,14 +33,17 @@ impl DailyMerkleTree {
            .into_iter()
            .map(|l| (l.merkle_index, l))
            .collect();
+        let total_leaves = leaves.len();

        let mut sorted_leaves = Vec::new();
        for i in 0..leaves.len() {
            if let Some(next_leaf) = leaves.remove(&i) {
                sorted_leaves.push(next_leaf);
            } else {
-                let lost = leaves.len() - i + 1;
-                error!("failed to produce consistent merkle tree. there was no leaf with index {i}. at least {lost} leaves got lost")
+                let lost = total_leaves - i + 1;
+                error!("failed to produce consistent merkle tree. there was no leaf with index {i}. at least {lost} leaves got lost");
+                // we have to drop all data above that height because we can't rebuild the full tree
+                break;
            }
        }

@@ -0,0 +1,6 @@
+# Nym Node Status API
+The Node Status API serves information about individual `nym-nodes` in the Mixnet, such as which role they are operating in, statistics about them, services such as Network Requesters, as well as summaries of the state of the Mixnet.
+
+We recommend that developers building applications such as explorers or analytics interfaces about the Mixnet run their own instance of the API, in order to promote a robust network of downstream services, and spread the load of API calls amongst as many endpoints as possible.
+
+You can find build and operation instructions in the [docs](https://nym.com/docs/apis/ns-api).
@@ -10,7 +10,8 @@ pub(crate) fn generate_key_pair(path: impl AsRef<Path>) -> anyhow::Result<()> {
    let mut private_key_file = File::create(priv_key_path)?;
    private_key_file.write_all(keypair.private_key().to_base58_string().as_bytes())?;

-    let pub_key_path = priv_key_path.with_extension("public");
+    let pub_key_path = priv_key_path.with_file_name("public-key");
+
    let mut public_key_file = File::create(&pub_key_path)?;
    public_key_file.write_all(keypair.public_key().to_base58_string().as_bytes())?;

@@ -1,4 +1,4 @@
-use tracing::error;
+use tracing::{debug, error, info};

 pub(crate) struct GwProbe {
    path: String,
@@ -10,21 +10,62 @@ impl GwProbe {
    }

    pub(crate) async fn version(&self) -> String {
+        debug!("Attempting to execute binary at: {}", &self.path);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+
+            match tokio::fs::metadata(&self.path).await {
+                Ok(metadata) => {
+                    let perms = metadata.permissions();
+                    let mode = perms.mode();
+                    if mode & 0o111 == 0 {
+                        error!(
+                            "Binary is not executable: {} (mode: {:o})",
+                            &self.path, mode
+                        );
+                        return "Binary is not executable".to_string();
+                    }
+                    debug!("Binary exists with permissions: {:o}", mode);
+                }
+                Err(e) => {
+                    error!("Failed to stat binary at {}: {}", &self.path, e);
+                    return format!("Failed to access binary: {}", e);
+                }
+            }
+        }
+
        let mut command = tokio::process::Command::new(&self.path);
        command.stdout(std::process::Stdio::piped());
        command.arg("--version");

+        info!("Executing command: {:?} --version", &self.path);
+
        match command.spawn() {
-            Ok(child) => {
-                if let Ok(output) = child.wait_with_output().await {
-                    return String::from_utf8(output.stdout)
-                        .unwrap_or("Unable to get log from test run".to_string());
+            Ok(child) => match child.wait_with_output().await {
+                Ok(output) => {
+                    if output.status.success() {
+                        String::from_utf8(output.stdout)
+                            .unwrap_or_else(|_| "Unable to parse version output".to_string())
+                    } else {
+                        let stderr = String::from_utf8(output.stderr)
+                            .unwrap_or_else(|_| "Unable to parse error output".to_string());
+                        error!(
+                            "Command failed with exit code {}: {}",
+                            output.status.code().unwrap_or(-1),
+                            stderr
+                        );
+                        format!("Command failed: {}", stderr)
+                    }
                }
-                "Unable to get probe version".to_string()
-            }
+                Err(e) => {
+                    error!("Failed to get command output: {}", e);
+                    format!("Failed to get command output: {}", e)
+                }
+            },
            Err(e) => {
-                error!("Failed to get probe version: {}", e);
-                "Failed to get probe version".to_string()
+                error!("Failed to spawn process: {}", e);
+                format!("Failed to spawn process: {}", e)
            }
        }
    }
@@ -296,9 +296,14 @@ impl Monitor {
            Some(location) => return location,
            None => {
                for ip in node.description.host_information.ip_address.iter() {
-                    if let Ok(location) = self.ipinfo.locate_ip(ip.to_string()).await {
-                        self.geocache.insert(node_id, location.clone()).await;
-                        return location;
+                    match self.ipinfo.locate_ip(ip.to_string()).await {
+                        Ok(location) => {
+                            self.geocache.insert(node_id, location.clone()).await;
+                            return location;
+                        }
+                        Err(err) => {
+                            tracing::warn!("Couldn't locate IP {} due to: {}", ip, err)
+                        }
                    }
                }
                // if no data could be retrieved
@@ -3,7 +3,7 @@

 [package]
 name = "nym-node"
-version = "1.6.0"
+version = "1.6.2"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -101,4 +101,4 @@ cargo_metadata = { workspace = true }


 [lints]
-workspace = true
+workspace = true
@@ -68,7 +68,7 @@ impl Debug {
    pub const DEFAULT_MESSAGE_RETRIEVAL_LIMIT: i64 = 100;
    pub const DEFAULT_MINIMUM_MIX_PERFORMANCE: u8 = 50;
    pub const DEFAULT_MAXIMUM_AUTH_REQUEST_AGE: Duration = Duration::from_secs(30);
-    const DEFAULT_MAXIMUM_OPEN_CONNECTIONS: usize = 8192;
+    pub const DEFAULT_MAXIMUM_OPEN_CONNECTIONS: usize = 8192;
 }

 impl Default for Debug {
@@ -465,9 +465,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.5.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2bd12c1caf447e69cd4528f47f94d203fd2582878ecb9e9465484c4148a8223"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 dependencies = [
 "serde",
 ]
@@ -1487,9 +1487,9 @@ checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"

 [[package]]
 name = "encoding_rs"
-version = "0.8.32"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
 "cfg-if",
 ]
@@ -1583,9 +1583,9 @@ dependencies = [

 [[package]]
 name = "ff"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
 "rand_core 0.6.4",
 "subtle",
@@ -3463,8 +3463,11 @@ name = "nym-http-api-client"
 version = "0.1.0"
 dependencies = [
 "async-trait",
+ "bytes",
+ "encoding_rs",
 "hickory-resolver",
 "http 1.1.0",
+ "mime",
 "nym-bin-common",
 "once_cell",
 "reqwest 0.12.4",
@@ -3554,6 +3557,7 @@ name = "nym-pemstore"
 version = "0.3.0"
 dependencies = [
 "pem",
+ "tracing",
 ]

 [[package]]
@@ -5059,18 +5063,18 @@ dependencies = [

 [[package]]
 name = "semver"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
 "serde_derive",
 ]
@@ -5086,18 +5090,18 @@ dependencies = [

 [[package]]
 name = "serde_bytes"
-version = "0.11.16"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "364fec0df39c49a083c9a8a18a23a6bcfd9af130fe9fe321d18520a0d113e09e"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6052,9 +6056,9 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.37"
+version = "0.3.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+checksum = "dad298b01a40a23aac4580b67e3dbedb7cc8402f3592d7f49469de2ea4aecdd8"
 dependencies = [
 "deranged",
 "itoa 1.0.9",
@@ -6069,15 +6073,15 @@ dependencies = [

 [[package]]
 name = "time-core"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+checksum = "765c97a5b985b7c11d7bc27fa927dc4fe6af3a6dfb021d28deb60d3bf51e76ef"

 [[package]]
 name = "time-macros"
-version = "0.2.19"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+checksum = "e8093bc3e81c3bc5f7879de09619d06c9a5a5e45ca44dfeeb7225bae38005c5c"
 dependencies = [
 "num-conv",
 "time-core",
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n        INSERT INTO watcher_execution(start, end, error_message)\n        VALUES (?, ?, ?)\n    ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "1aa7733ad4bbf3e6b8db909b8646bee247bc021b9534f1d4b0fcad32e2e56218"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "SQLite",
-  "query": "\n                    SELECT * FROM transactions\n                    WHERE height > ? \n                    ORDER BY height ASC, message_index ASC\n                    ",
+  "query": "\n                SELECT id, tx_hash, height, message_index, sender, recipient, amount, memo, created_at as \"created_at: ::time::OffsetDateTime\"\n                FROM transactions\n                WHERE height > ?\n                ORDER BY height ASC, message_index ASC\n            ",
  "describe": {
    "columns": [
      {
@@ -44,7 +44,7 @@
        "type_info": "Text"
      },
      {
-        "name": "created_at",
+        "name": "created_at: ::time::OffsetDateTime",
        "ordinal": 8,
        "type_info": "Datetime"
      }
@@ -64,5 +64,5 @@
      true
    ]
  },
-  "hash": "7b9abf4ff422b8d7a942955dc4fba380e7d5f0127f4745705b8ac9af6c170d19"
+  "hash": "f69907735e9b1e1572c4bf6fe8d44d4ea4e55c2a9c4d4f7e1c7e57bcb848ee08"
 }
@@ -3,7 +3,7 @@

 [package]
 name = "nyx-chain-watcher"
-version = "0.1.11"
+version = "0.1.13"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -29,7 +29,6 @@ nym-node-requests = { path = "../nym-node/nym-node-requests", features = [
 nym-validator-client = { path = "../common/client-libs/validator-client" }
 nyxd-scraper = { path = "../common/nyxd-scraper" }
 reqwest = { workspace = true, features = ["rustls-tls"] }
-rocket = { workspace = true }
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
@@ -0,0 +1,11 @@
+/*
+ * Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: GPL-3.0-only
+ */
+
+CREATE TABLE watcher_execution
+(
+    start         TIMESTAMP WITHOUT TIME ZONE NOT NULL,
+    end           TIMESTAMP WITHOUT TIME ZONE NOT NULL,
+    error_message TEXT
+)
@@ -1,4 +1,4 @@
-use crate::config::PaymentWatcherConfig;
+use crate::config::PaymentWatchersConfig;
 use crate::env::vars::{
    NYXD_SCRAPER_START_HEIGHT, NYXD_SCRAPER_UNSAFE_NUKE_DB,
    NYXD_SCRAPER_USE_BEST_EFFORT_START_HEIGHT,
@@ -10,7 +10,7 @@ use nyxd_scraper::{
 };
 use sqlx::SqlitePool;
 use std::fs;
-use tracing::{info, warn};
+use tracing::{error, info, warn};

 pub(crate) async fn run_chain_scraper(
    config: &crate::config::Config,
@@ -60,7 +60,7 @@ pub(crate) async fn run_chain_scraper(
    })
    .with_tx_module(EventScraperModule::new(
        db_pool,
-        config.payment_watcher_config.clone().unwrap_or_default(),
+        config.payment_watcher_config.clone(),
    ));

    let instance = scraper.build_and_start().await?;
@@ -73,11 +73,11 @@ pub(crate) async fn run_chain_scraper(

 pub struct EventScraperModule {
    db_pool: SqlitePool,
-    payment_config: PaymentWatcherConfig,
+    payment_config: PaymentWatchersConfig,
 }

 impl EventScraperModule {
-    pub fn new(db_pool: SqlitePool, payment_config: PaymentWatcherConfig) -> Self {
+    pub fn new(db_pool: SqlitePool, payment_config: PaymentWatchersConfig) -> Self {
        Self {
            db_pool,
            payment_config,
@@ -132,6 +132,12 @@ impl TxModule for EventScraperModule {
            return Ok(());
        }

+        if tx.tx.body.messages.len() > 1 {
+            error!(
+                "this transaction has more than 1 message in it - payment information will be lost"
+            );
+        }
+
        // Process each event
        for event in events {
            // Only process transfer events
@@ -157,17 +163,7 @@ impl TxModule for EventScraperModule {
                // If we have all required fields, check if recipient is watched and store
                if let (Some(recipient), Some(sender), Some(amount)) = (recipient, sender, amount) {
                    // Check if any watcher is watching this recipient
-                    let is_watched = self.payment_config.watchers.iter().any(|watcher| {
-                        if let Some(watched_accounts) =
-                            &watcher.watch_for_transfer_recipient_accounts
-                        {
-                            watched_accounts
-                                .iter()
-                                .any(|account| account.to_string() == recipient)
-                        } else {
-                            false
-                        }
-                    });
+                    let is_watched = self.payment_config.is_being_watched(&recipient);

                    if is_watched {
                        if let Err(e) = self
@@ -3,8 +3,8 @@

 use crate::cli::DEFAULT_NYX_CHAIN_WATCHER_ID;
 use crate::config::payments_watcher::HttpAuthenticationOptions::AuthorizationBearerToken;
-use crate::config::payments_watcher::PaymentWatcherEntry;
-use crate::config::{default_config_filepath, Config, ConfigBuilder, PaymentWatcherConfig};
+use crate::config::payments_watcher::PaymentWatcherConfig;
+use crate::config::{default_config_filepath, Config, ConfigBuilder, PaymentWatchersConfig};
 use crate::error::NyxChainWatcherError;
 use nym_config::save_unformatted_config_to_file;
 use nym_validator_client::nyxd::AccountId;
@@ -18,22 +18,22 @@ pub(crate) async fn execute(_args: Args) -> Result<(), NyxChainWatcherError> {
    let data_dir = Config::default_data_directory(&config_path)?;

    let builder = ConfigBuilder::new(config_path.clone(), data_dir).with_payment_watcher_config(
-        PaymentWatcherConfig {
-            watchers: vec![PaymentWatcherEntry {
+        PaymentWatchersConfig {
+            watchers: vec![PaymentWatcherConfig {
                id: DEFAULT_NYX_CHAIN_WATCHER_ID.to_string(),
                webhook_url: "https://webhook.site".to_string(),
-                watch_for_transfer_recipient_accounts: Some(vec![AccountId::from_str(
+                watch_for_transfer_recipient_accounts: vec![AccountId::from_str(
                    "n17g9a2pwwkg8m60wf59pq6mv0c2wusg9ukparkz",
                )
-                .unwrap()]),
+                .unwrap()],
                authentication: Some(AuthorizationBearerToken {
                    token: "1234".to_string(),
                }),
                description: None,
-                watch_for_chain_message_types: Some(vec![
+                watch_for_chain_message_types: vec![
                    "/cosmos.bank.v1beta1.MsgSend".to_string(),
                    "/ibc.applications.transfer.v1.MsgTransfer".to_string(),
-                ]),
+                ],
            }],
        },
    );
@@ -20,7 +20,7 @@ pub(crate) struct Args {
        value_delimiter = ',',
        env = NYX_CHAIN_WATCHER_WATCH_ACCOUNTS
    )]
-    pub watch_for_transfer_recipient_accounts: Option<Vec<AccountId>>,
+    pub watch_for_transfer_recipient_accounts: Vec<AccountId>,

    /// (Override) Watch for chain messages of these types
    #[clap(
@@ -28,7 +28,7 @@ pub(crate) struct Args {
        value_delimiter = ',',
        env = NYX_CHAIN_WATCHER_WATCH_CHAIN_MESSAGE_TYPES
    )]
-    pub watch_for_chain_message_types: Option<Vec<String>>,
+    pub watch_for_chain_message_types: Vec<String>,

    /// (Override) The webhook to call when we find something
    #[clap(
@@ -1,7 +1,7 @@
 use crate::cli::commands::run::args::Args;
 use crate::cli::DEFAULT_NYX_CHAIN_WATCHER_ID;
-use crate::config::payments_watcher::{HttpAuthenticationOptions, PaymentWatcherEntry};
-use crate::config::{default_config_filepath, Config, ConfigBuilder, PaymentWatcherConfig};
+use crate::config::payments_watcher::{HttpAuthenticationOptions, PaymentWatcherConfig};
+use crate::config::{default_config_filepath, Config, ConfigBuilder, PaymentWatchersConfig};
 use crate::error::NyxChainWatcherError;
 use tracing::{info, warn};

@@ -18,8 +18,8 @@ pub(crate) fn get_run_config(args: Args) -> Result<Config, NyxChainWatcherError>
    } = args;

    // if there are no args set, then try load the config
-    if args.watch_for_transfer_recipient_accounts.is_none()
-        && args.watch_for_transfer_recipient_accounts.is_none()
+    if args.watch_for_transfer_recipient_accounts.is_empty()
+        && args.watch_for_transfer_recipient_accounts.is_empty()
        && args.chain_watcher_db_path.is_none()
    {
        info!("Loading default config file...");
@@ -27,12 +27,12 @@ pub(crate) fn get_run_config(args: Args) -> Result<Config, NyxChainWatcherError>
    }

    // set default messages
-    if watch_for_chain_message_types.is_none() {
-        watch_for_chain_message_types = Some(vec!["/cosmos.bank.v1beta1.MsgSend".to_string()]);
+    if watch_for_chain_message_types.is_empty() {
+        watch_for_chain_message_types = vec!["/cosmos.bank.v1beta1.MsgSend".to_string()];
    }

    // warn if no accounts set
-    if watch_for_transfer_recipient_accounts.is_none() {
+    if watch_for_transfer_recipient_accounts.is_empty() {
        warn!(
            "You did not specify any accounts to watch in {}. Only chain data will be stored.",
            crate::env::vars::NYX_CHAIN_WATCHER_WATCH_ACCOUNTS
@@ -58,8 +58,8 @@ pub(crate) fn get_run_config(args: Args) -> Result<Config, NyxChainWatcherError>
        let authentication =
            webhook_auth.map(|token| HttpAuthenticationOptions::AuthorizationBearerToken { token });

-        let watcher_config = PaymentWatcherConfig {
-            watchers: vec![PaymentWatcherEntry {
+        let watcher_config = PaymentWatchersConfig {
+            watchers: vec![PaymentWatcherConfig {
                id: DEFAULT_NYX_CHAIN_WATCHER_ID.to_string(),
                description: None,
                watch_for_transfer_recipient_accounts: watch_for_transfer_recipient_accounts
@@ -2,19 +2,114 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use crate::error::NyxChainWatcherError;
-use tokio::join;
-use tracing::{error, info, trace};
+use anyhow::Context;
+use std::time::Duration;
+use time::OffsetDateTime;
+use tokio::task::{JoinHandle, JoinSet};
+use tokio_util::sync::CancellationToken;
+use tracing::{error, info};

 mod args;
 mod config;

 use crate::chain_scraper::run_chain_scraper;
-use crate::{db, http, payment_listener, price_scraper};
+use crate::db::DbPool;
+use crate::http::state::PaymentListenerState;
+use crate::payment_listener::PaymentListener;
+use crate::{db, http, price_scraper};
 pub(crate) use args::Args;
 use nym_task::signal::wait_for_signal;

+async fn try_insert_watcher_execution_information(
+    db_pool: DbPool,
+    start: OffsetDateTime,
+    end: OffsetDateTime,
+    error_message: Option<String>,
+) {
+    let _ = sqlx::query!(
+        r#"
+        INSERT INTO watcher_execution(start, end, error_message)
+        VALUES (?, ?, ?)
+    "#,
+        start,
+        end,
+        error_message
+    )
+    .execute(&db_pool)
+    .await
+    .inspect_err(|err| error!("failed to insert run information: {err}"));
+}
+
+async fn wait_for_shutdown(
+    db_pool: DbPool,
+    start: OffsetDateTime,
+    main_cancellation_token: CancellationToken,
+    scraper_cancellation_token: CancellationToken,
+    mut tasks: JoinSet<Option<anyhow::Result<()>>>,
+) {
+    async fn finalize_shutdown(
+        db_pool: DbPool,
+        start: OffsetDateTime,
+        main_cancellation_token: CancellationToken,
+        scraper_cancellation_token: CancellationToken,
+        mut tasks: JoinSet<Option<anyhow::Result<()>>>,
+        error_message: Option<String>,
+    ) {
+        // cancel all tasks
+        main_cancellation_token.cancel();
+        scraper_cancellation_token.cancel();
+
+        // stupid nasty and hacky workaround to make sure all relevant tasks have finished before hard aborting them
+        // nasty stupid and hacky workaround
+        tokio::time::sleep(Duration::from_secs(1)).await;
+        tasks.abort_all();
+
+        // insert execution result into the db
+        try_insert_watcher_execution_information(
+            db_pool,
+            start,
+            OffsetDateTime::now_utc(),
+            error_message,
+        )
+        .await
+    }
+
+    tokio::select! {
+        // graceful shutdown
+        _ = wait_for_signal() => {
+            info!("received shutdown signal");
+            finalize_shutdown(db_pool, start, main_cancellation_token, scraper_cancellation_token, tasks, None).await;
+        }
+        _ = scraper_cancellation_token.cancelled() => {
+            info!("the scraper has issued cancellation");
+            finalize_shutdown(db_pool, start, main_cancellation_token, scraper_cancellation_token, tasks, Some("unexpected scraper task cancellation".into())).await;
+        }
+        _ = main_cancellation_token.cancelled() => {
+            info!("one of the tasks has cancelled the token");
+            finalize_shutdown(db_pool, start, main_cancellation_token, scraper_cancellation_token, tasks, Some("unexpected main task cancellation".into())).await;
+        }
+        task_result = tasks.join_next() => {
+            // the first unwrap is fine => join set was not empty
+            let error_message = match task_result.unwrap() {
+                Err(_join_err) => Some("unexpected join error".to_string()),
+                Ok(Some(Ok(_))) => None,
+                Ok(Some(Err(err))) => Some(err.to_string()),
+                Ok(None) => {
+                    Some("unexpected task cancellation".to_string())
+                }
+            };
+
+            error!("unexpected task termination: {error_message:?}");
+            finalize_shutdown(db_pool, start, main_cancellation_token, scraper_cancellation_token, tasks, error_message).await;
+        }
+
+    }
+}
+
 pub(crate) async fn execute(args: Args, http_port: u16) -> Result<(), NyxChainWatcherError> {
-    trace!("passed arguments: {args:#?}");
+    let start = OffsetDateTime::now_utc();
+
+    info!("passed arguments: {args:#?}");

    let config = config::get_run_config(args)?;

@@ -29,9 +124,7 @@ pub(crate) async fn execute(args: Args, http_port: u16) -> Result<(), NyxChainWa
    );
    info!(
        "Chain History Database path is {:?}",
-        std::path::Path::new(&config.chain_scraper_database_path())
-            .canonicalize()
-            .unwrap_or_default()
+        std::path::Path::new(&config.chain_scraper_database_path()).canonicalize()
    );

    // Ensure parent directory exists
@@ -41,50 +134,109 @@ pub(crate) async fn execute(args: Args, http_port: u16) -> Result<(), NyxChainWa

    let connection_url = format!("sqlite://{}?mode=rwc", db_path);
    let storage = db::Storage::init(connection_url).await?;
-    let watcher_pool = storage.pool_owned().await;
+    let watcher_pool = storage.pool_owned();

-    // Spawn the chain scraper and get its storage
+    let mut tasks = JoinSet::new();
+    let cancellation_token = CancellationToken::new();

-    // Spawn the payment listener task
-    let payment_listener_handle = tokio::spawn({
-        let price_scraper_pool = storage.pool_owned().await;
-        let scraper_pool = storage.pool_owned().await;
-        run_chain_scraper(&config, scraper_pool).await?;
-        let payment_watcher_config = config.payment_watcher_config.unwrap_or_default();
+    let price_scraper_pool = storage.pool_owned();
+    let scraper_pool = storage.pool_owned();
+    let shutdown_pool = storage.pool_owned();

+    // construct shared state
+    let payment_listener_shared_state = PaymentListenerState::new();
+
+    // spawn all the tasks
+
+    // 1. chain scraper (note: this doesn't really spawn the full scraper on this task, but we don't want to be blocking waiting for its startup)
+    let scraper_token_handle: JoinHandle<anyhow::Result<CancellationToken>> = tokio::spawn({
+        let config = config.clone();
        async move {
-            if let Err(e) =
-                payment_listener::run_payment_listener(payment_watcher_config, price_scraper_pool)
-                    .await
-            {
-                error!("Payment listener error: {}", e);
-            }
-            Ok::<_, anyhow::Error>(())
+            // this only blocks until startup sync is done; it then runs on its own set of tasks
+            let scraper = run_chain_scraper(&config, scraper_pool).await?;
+            Ok(scraper.cancel_token())
        }
    });

-    // Clone pool for each task that needs it
-    //let background_pool = db_pool.clone();
+    // 2. payment listener
+    let token = cancellation_token.clone();
+    let payment_watcher_config = config.payment_watcher_config.clone();
+    let payment_listener = PaymentListener::new(
+        price_scraper_pool,
+        payment_watcher_config,
+        payment_listener_shared_state.clone(),
+    )?;
+    {
+        tasks.spawn(async move {
+            token
+                .run_until_cancelled(async move {
+                    payment_listener.run().await;
+                    Ok(())
+                })
+                .await
+        });
+    }

-    let price_scraper_handle = tokio::spawn(async move {
-        price_scraper::run_price_scraper(&watcher_pool).await;
-    });
+    // 3. price scraper (note, this task never terminates on its own)
+    {
+        let token = cancellation_token.clone();
+        tasks.spawn(async move {
+            token
+                .run_until_cancelled(async move {
+                    price_scraper::run_price_scraper(&watcher_pool).await;
+                    Ok(())
+                })
+                .await
+        });
+    }

-    let shutdown_handles = http::server::start_http_api(storage.pool_owned().await, http_port)
-        .await
-        .expect("Failed to start server");
+    // 4. http api
+    let http_server = http::server::build_http_api(
+        storage.pool_owned(),
+        &config,
+        http_port,
+        payment_listener_shared_state,
+    )
+    .await?;
+    {
+        let token = cancellation_token.clone();
+        tasks.spawn(async move {
+            info!("Starting HTTP server on port {http_port}",);
+            async move {
+                Some(
+                    http_server
+                        .run(token.cancelled_owned())
+                        .await
+                        .context("http server failure"),
+                )
+            }
+            .await
+        });
+    }

-    info!("Started HTTP server on port {}", http_port);
+    // 1. wait for either shutdown or scraper having finished startup
+    tokio::select! {
+        _ = wait_for_signal() => {
+            info!("received shutdown signal while waiting for scraper to finish its startup");
+            return Ok(())
+        }
+        scraper_token = scraper_token_handle => {
+            let scraper_token = match scraper_token {
+                Ok(Ok(token)) => token,
+                Ok(Err(startup_err)) => {
+                    error!("failed to startup the chain scraper: {startup_err}");
+                    return Err(startup_err.into());
+                }
+                Err(runtime_err) => {
+                    error!("failed to finish the scraper startup task: {runtime_err}");
+                    return Ok(())

-    // Wait for the short-lived tasks to complete
-    let _ = join!(price_scraper_handle, payment_listener_handle);
+                }
+            };

-    // Wait for a signal to terminate the long-running task
-    wait_for_signal().await;
-
-    if let Err(err) = shutdown_handles.shutdown().await {
-        error!("{err}");
-    };
+            wait_for_shutdown(shutdown_pool, start, cancellation_token, scraper_token, tasks).await
+        }
+    }

    Ok(())
 }
@@ -14,7 +14,7 @@ use tracing::{debug, error};
 pub(crate) mod payments_watcher;
 mod template;

-pub use crate::config::payments_watcher::PaymentWatcherConfig;
+pub use crate::config::payments_watcher::PaymentWatchersConfig;
 use crate::error::NyxChainWatcherError;

 const DEFAULT_NYM_CHAIN_WATCHER_DIR: &str = "nym-chain-watcher";
@@ -46,7 +46,7 @@ pub struct ConfigBuilder {

    pub chain_scraper_db_path: Option<String>,

-    pub payment_watcher_config: Option<PaymentWatcherConfig>,
+    pub payment_watcher_config: Option<PaymentWatchersConfig>,

    pub logging: Option<LoggingSettings>,
 }
@@ -76,7 +76,7 @@ impl ConfigBuilder {
    #[allow(dead_code)]
    pub fn with_payment_watcher_config(
        mut self,
-        payment_watcher_config: impl Into<PaymentWatcherConfig>,
+        payment_watcher_config: impl Into<PaymentWatchersConfig>,
    ) -> Self {
        self.payment_watcher_config = Some(payment_watcher_config.into());
        self
@@ -92,7 +92,7 @@ impl ConfigBuilder {
        Config {
            logging: self.logging.unwrap_or_default(),
            save_path: Some(self.config_path),
-            payment_watcher_config: self.payment_watcher_config,
+            payment_watcher_config: self.payment_watcher_config.unwrap_or_default(),
            data_dir: self.data_dir,
            db_path: self.db_path,
            chain_scraper_db_path: self.chain_scraper_db_path,
@@ -116,7 +116,8 @@ pub struct Config {
    #[serde(skip)]
    chain_scraper_db_path: Option<String>,

-    pub payment_watcher_config: Option<PaymentWatcherConfig>,
+    #[serde(default)]
+    pub payment_watcher_config: PaymentWatchersConfig,

    #[serde(default)]
    pub logging: LoggingSettings,
@@ -1,19 +1,29 @@
 use nym_validator_client::nyxd::AccountId;
 use serde::{Deserialize, Serialize};

-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct PaymentWatcherConfig {
-    pub watchers: Vec<PaymentWatcherEntry>,
+#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+pub struct PaymentWatchersConfig {
+    pub watchers: Vec<PaymentWatcherConfig>,
+}
+
+impl PaymentWatchersConfig {
+    pub fn is_being_watched(&self, account: &str) -> bool {
+        self.watchers.iter().any(|watcher| {
+            watcher
+                .watch_for_transfer_recipient_accounts
+                .iter()
+                .any(|acc| acc.as_ref() == account)
+        })
+    }
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PaymentWatcherEntry {
+pub struct PaymentWatcherConfig {
    pub id: String,
    pub description: Option<String>,
    pub webhook_url: String,
-    pub watch_for_transfer_recipient_accounts: Option<Vec<AccountId>>,
-    pub watch_for_chain_message_types: Option<Vec<String>>,
+    pub watch_for_transfer_recipient_accounts: Vec<AccountId>,
+    pub watch_for_chain_message_types: Vec<String>,
    pub authentication: Option<HttpAuthenticationOptions>,
 }

@@ -34,7 +34,7 @@ impl Storage {
    }

    /// Cloning pool is cheap, it's the same underlying set of connections
-    pub async fn pool_owned(&self) -> DbPool {
+    pub fn pool_owned(&self) -> DbPool {
        self.pool.clone()
    }
 }
@@ -1,4 +1,8 @@
+use anyhow::Context;
+use nym_validator_client::nyxd::Coin;
 use serde::{Deserialize, Serialize};
+use sqlx::FromRow;
+use time::OffsetDateTime;
 use utoipa::ToSchema;

 #[derive(Clone, Deserialize, Debug, ToSchema)]
@@ -41,3 +45,25 @@ pub(crate) struct PaymentRecord {
    pub(crate) timestamp: i64,
    pub(crate) height: i64,
 }
+
+#[derive(Serialize, Deserialize, Debug, FromRow)]
+pub(crate) struct Transaction {
+    pub(crate) id: i64,
+    pub(crate) tx_hash: String,
+    pub(crate) height: i64,
+    pub(crate) message_index: i64,
+    pub(crate) sender: String,
+    pub(crate) recipient: String,
+    pub(crate) amount: String,
+    pub(crate) memo: Option<String>,
+    pub(crate) created_at: Option<OffsetDateTime>,
+}
+
+impl Transaction {
+    pub(crate) fn funds(&self) -> anyhow::Result<Coin> {
+        self.amount
+            .as_str()
+            .parse()
+            .context("failed to parse transaction amount")
+    }
+}
@@ -0,0 +1,55 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use serde::{Deserialize, Serialize};
+use std::collections::vec_deque::{IntoIter, Iter};
+use std::collections::VecDeque;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct RingBuffer<T> {
+    #[serde(flatten)]
+    inner: VecDeque<T>,
+}
+
+impl<T> RingBuffer<T> {
+    pub fn new(capacity: usize) -> Self {
+        Self {
+            inner: VecDeque::with_capacity(capacity),
+        }
+    }
+
+    pub fn push(&mut self, item: T) {
+        if self.inner.len() == self.inner.capacity() {
+            self.inner.pop_front();
+            self.inner.push_back(item);
+            debug_assert!(self.inner.len() == self.inner.capacity());
+        } else {
+            self.inner.push_back(item);
+        }
+    }
+
+    pub fn iter(&self) -> Iter<'_, T> {
+        self.inner.iter()
+    }
+}
+
+impl<T> From<RingBuffer<T>> for VecDeque<T> {
+    fn from(value: RingBuffer<T>) -> Self {
+        value.inner
+    }
+}
+
+impl<T> From<RingBuffer<T>> for Vec<T> {
+    fn from(value: RingBuffer<T>) -> Self {
+        value.inner.into()
+    }
+}
+
+impl<T> IntoIterator for RingBuffer<T> {
+    type Item = T;
+    type IntoIter = IntoIter<T>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.inner.into_iter()
+    }
+}
@@ -8,6 +8,7 @@ use utoipa_swagger_ui::SwaggerUi;
 use crate::http::{api_docs, server::HttpServer, state::AppState};

 pub(crate) mod price;
+pub(crate) mod status;
 pub(crate) mod watcher;

 pub(crate) struct RouterBuilder {
@@ -25,8 +26,13 @@ impl RouterBuilder {
                "/",
                axum::routing::get(|| async { Redirect::permanent("/swagger") }),
            )
-            .nest("/v1", Router::new().nest("/price", price::routes()))
-            .nest("/v1", Router::new().nest("/watcher", watcher::routes()));
+            .nest(
+                "/v1",
+                Router::new()
+                    .nest("/status", status::routes())
+                    .nest("/price", price::routes())
+                    .nest("/watcher", watcher::routes()),
+            );

        Self {
            unfinished_router: router,
@@ -0,0 +1,98 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::http::models::status::{
+    ActivePaymentWatchersResponse, PaymentListenerFailureDetails, PaymentListenerStatusResponse,
+    ProcessedPayment, WatcherFailureDetails, WatcherState,
+};
+use crate::http::state::{AppState, PaymentListenerState};
+use axum::extract::State;
+use axum::routing::get;
+use axum::{Json, Router};
+use std::ops::Deref;
+
+pub(crate) fn routes() -> Router<AppState> {
+    Router::new()
+        .route("/active-payment-watchers", get(active_payment_watchers))
+        .route("/payment-listener", get(payment_listener_status))
+}
+
+#[utoipa::path(
+    tag = "Status",
+    get,
+    path = "/active-payment-watchers",
+    context_path = "/v1/status",
+    responses(
+        (status = 200, body = ActivePaymentWatchersResponse)
+    )
+)]
+pub(crate) async fn active_payment_watchers(
+    State(state): State<AppState>,
+) -> Json<ActivePaymentWatchersResponse> {
+    Json(ActivePaymentWatchersResponse {
+        watchers: state.registered_payment_watchers.deref().clone(),
+    })
+}
+
+#[utoipa::path(
+    tag = "Status",
+    get,
+    path = "/payment-listener",
+    context_path = "/v1/status",
+    responses(
+        (status = 200, body = PaymentListenerStatusResponse)
+    )
+)]
+pub(crate) async fn payment_listener_status(
+    State(state): State<PaymentListenerState>,
+) -> Json<PaymentListenerStatusResponse> {
+    let guard = state.inner.read().await;
+
+    // sorry for the nasty conversion code here, run out of time : (
+    Json(PaymentListenerStatusResponse {
+        last_checked: guard.last_checked,
+        processed_payments_since_startup: guard.processed_payments_since_startup,
+        watcher_errors_since_startup: guard.watcher_errors_since_startup,
+        payment_listener_errors_since_startup: guard.payment_listener_errors_since_startup,
+        last_processed_payment: guard
+            .last_processed_payment
+            .as_ref()
+            .map(|p| ProcessedPayment {
+                processed_at: p.processed_at,
+                tx_hash: p.tx_hash.clone(),
+                message_index: p.message_index,
+                height: p.height,
+                sender: p.sender.clone(),
+                receiver: p.receiver.clone(),
+                funds: p.funds.clone(),
+                memo: p.memo.clone(),
+            }),
+        latest_failures: guard
+            .latest_failures
+            .iter()
+            .map(|f| PaymentListenerFailureDetails {
+                timestamp: f.timestamp,
+                error: f.error.clone(),
+            })
+            .collect(),
+        watchers: guard
+            .watchers
+            .iter()
+            .map(|(w, state)| {
+                (
+                    w.clone(),
+                    WatcherState {
+                        latest_failures: state
+                            .latest_failures
+                            .iter()
+                            .map(|f| WatcherFailureDetails {
+                                timestamp: f.timestamp,
+                                error: f.error.clone(),
+                            })
+                            .collect(),
+                    },
+                )
+            })
+            .collect(),
+    })
+}
@@ -1,9 +1,7 @@
-use crate::config::Config;
-use crate::env;
 use crate::http::error::HttpResult;
 use crate::http::state::AppState;
+use axum::extract::State;
 use axum::{Json, Router};
-use std::env::var;

 pub(crate) fn routes() -> Router<AppState> {
    Router::new().route("/addresses", axum::routing::get(get_addresses))
@@ -19,30 +17,6 @@ pub(crate) fn routes() -> Router<AppState> {
 )]

 /// Fetch the addresses being watched by the chain watcher
-async fn get_addresses() -> HttpResult<Json<Vec<String>>> {
-    let addresses = match Config::read_from_toml_file_in_default_location() {
-        Ok(config) => config
-            .payment_watcher_config
-            .as_ref()
-            .and_then(|config| {
-                config.watchers.iter().find_map(|watcher| {
-                    watcher
-                        .watch_for_transfer_recipient_accounts
-                        .as_ref()
-                        .map(|accounts| {
-                            accounts
-                                .iter()
-                                .map(|account| account.to_string())
-                                .collect::<Vec<_>>()
-                        })
-                })
-            })
-            .unwrap_or_default(),
-        // If the config file doesn't exist, fall back to env variable
-        Err(_) => var(env::vars::NYX_CHAIN_WATCHER_WATCH_ACCOUNTS)
-            .map(|accounts| accounts.split(',').map(String::from).collect())
-            .unwrap_or_default(),
-    };
-
-    Ok(Json(addresses))
+async fn get_addresses(State(state): State<AppState>) -> HttpResult<Json<Vec<String>>> {
+    Ok(Json(state.watched_accounts()))
 }
@@ -1,5 +1,6 @@
 pub(crate) mod api;
 pub(crate) mod api_docs;
 pub(crate) mod error;
+pub(crate) mod models;
 pub(crate) mod server;
 pub(crate) mod state;
@@ -0,0 +1,92 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+// if we ever create some sort of chain watcher client, those would need to be extracted
+
+pub mod status {
+    use crate::config::payments_watcher::PaymentWatcherConfig;
+    use crate::models::openapi_schema;
+    use nym_validator_client::nyxd::Coin;
+    use serde::{Deserialize, Serialize};
+    use std::collections::HashMap;
+    use time::OffsetDateTime;
+    use utoipa::ToSchema;
+
+    #[derive(Debug, Serialize, Deserialize, ToSchema)]
+    pub struct ActivePaymentWatchersResponse {
+        pub watchers: Vec<PaymentWatcher>,
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub struct PaymentWatcher {
+        pub id: String,
+        pub description: String,
+        pub webhook_url: String,
+        pub watched_accounts: Vec<String>,
+        pub watched_message_types: Vec<String>,
+    }
+
+    impl From<&PaymentWatcherConfig> for PaymentWatcher {
+        fn from(value: &PaymentWatcherConfig) -> Self {
+            PaymentWatcher {
+                id: value.id.clone(),
+                description: value.description.clone().unwrap_or_default(),
+                webhook_url: value.webhook_url.clone(),
+                watched_accounts: value
+                    .watch_for_transfer_recipient_accounts
+                    .iter()
+                    .map(|a| a.to_string())
+                    .collect(),
+                watched_message_types: value.watch_for_chain_message_types.clone(),
+            }
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub struct PaymentListenerStatusResponse {
+        #[serde(with = "time::serde::rfc3339")]
+        pub last_checked: OffsetDateTime,
+
+        pub processed_payments_since_startup: u64,
+        pub watcher_errors_since_startup: u64,
+        pub payment_listener_errors_since_startup: u64,
+
+        pub last_processed_payment: Option<ProcessedPayment>,
+
+        pub latest_failures: Vec<PaymentListenerFailureDetails>,
+        pub watchers: HashMap<String, WatcherState>,
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub(crate) struct ProcessedPayment {
+        pub processed_at: OffsetDateTime,
+
+        pub tx_hash: String,
+        pub message_index: u64,
+        pub height: u64,
+        pub sender: String,
+        pub receiver: String,
+
+        #[schema(value_type = openapi_schema::Coin)]
+        pub funds: Coin,
+
+        pub memo: String,
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub(crate) struct PaymentListenerFailureDetails {
+        pub(crate) timestamp: OffsetDateTime,
+        pub(crate) error: String,
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub(crate) struct WatcherState {
+        pub(crate) latest_failures: Vec<WatcherFailureDetails>,
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+    pub(crate) struct WatcherFailureDetails {
+        pub(crate) timestamp: OffsetDateTime,
+        pub(crate) error: String,
+    }
+}
@@ -1,70 +1,38 @@
 use axum::Router;
 use core::net::SocketAddr;
-use tokio::{net::TcpListener, task::JoinHandle};
-use tokio_util::sync::{CancellationToken, WaitForCancellationFutureOwned};
+use tokio::net::TcpListener;
+use tokio_util::sync::WaitForCancellationFutureOwned;

+use crate::config::Config;
+use crate::http::state::PaymentListenerState;
 use crate::{
    db::DbPool,
    http::{api::RouterBuilder, state::AppState},
 };

-/// Return handles that allow for graceful shutdown of server + awaiting its
-/// background tokio task
-pub(crate) async fn start_http_api(
+pub(crate) async fn build_http_api(
    db_pool: DbPool,
+    config: &Config,
    http_port: u16,
-) -> anyhow::Result<ShutdownHandles> {
+    payment_listener_state: PaymentListenerState,
+) -> anyhow::Result<HttpServer> {
    let router_builder = RouterBuilder::with_default_routes();

-    let state = AppState::new(db_pool);
+    let state = AppState::new(
+        db_pool,
+        config
+            .payment_watcher_config
+            .watchers
+            .iter()
+            .map(Into::into)
+            .collect(),
+        payment_listener_state,
+    );
    let router = router_builder.with_state(state);

    let bind_addr = format!("0.0.0.0:{}", http_port);
    let server = router.build_server(bind_addr).await?;
-
-    Ok(start_server(server))
-}
-
-fn start_server(server: HttpServer) -> ShutdownHandles {
-    // one copy is stored to trigger a graceful shutdown later
-    let shutdown_button = CancellationToken::new();
-    // other copy is given to server to listen for a shutdown
-    let shutdown_receiver = shutdown_button.clone();
-    let shutdown_receiver = shutdown_receiver.cancelled_owned();
-
-    let server_handle = tokio::spawn(async move { server.run(shutdown_receiver).await });
-
-    ShutdownHandles {
-        server_handle,
-        shutdown_button,
-    }
-}
-
-pub(crate) struct ShutdownHandles {
-    server_handle: JoinHandle<std::io::Result<()>>,
-    shutdown_button: CancellationToken,
-}
-
-impl ShutdownHandles {
-    /// Send graceful shutdown signal to server and wait for server task to complete
-    pub(crate) async fn shutdown(self) -> anyhow::Result<()> {
-        self.shutdown_button.cancel();
-
-        match self.server_handle.await {
-            Ok(Ok(_)) => {
-                tracing::info!("HTTP server shut down without errors");
-            }
-            Ok(Err(err)) => {
-                tracing::error!("HTTP server terminated with: {err}");
-                anyhow::bail!(err)
-            }
-            Err(err) => {
-                tracing::error!("Server task panicked: {err}");
-            }
-        };
-
-        Ok(())
-    }
+    Ok(server)
 }

 pub(crate) struct HttpServer {
@@ -1,16 +1,183 @@
 use crate::db::DbPool;
+use crate::helpers::RingBuffer;
+use crate::http::models::status::PaymentWatcher;
+use crate::models::WebhookPayload;
+use axum::extract::FromRef;
+use nym_validator_client::nyxd::Coin;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::sync::Arc;
+use time::OffsetDateTime;
+use tokio::sync::RwLock;

 #[derive(Debug, Clone)]
 pub(crate) struct AppState {
    db_pool: DbPool,
+    pub(crate) registered_payment_watchers: Arc<Vec<PaymentWatcher>>,
+    pub(crate) payment_listener_state: PaymentListenerState,
 }

 impl AppState {
-    pub(crate) fn new(db_pool: DbPool) -> Self {
-        Self { db_pool }
+    pub(crate) fn new(
+        db_pool: DbPool,
+        registered_payment_watchers: Vec<PaymentWatcher>,
+        payment_listener_state: PaymentListenerState,
+    ) -> Self {
+        Self {
+            db_pool,
+            registered_payment_watchers: Arc::new(registered_payment_watchers),
+            payment_listener_state,
+        }
    }

    pub(crate) fn db_pool(&self) -> &DbPool {
        &self.db_pool
    }
+
+    pub(crate) fn watched_accounts(&self) -> Vec<String> {
+        self.registered_payment_watchers
+            .iter()
+            .flat_map(|w| w.watched_accounts.iter())
+            .cloned()
+            .collect()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct PaymentListenerState {
+    pub(crate) inner: Arc<RwLock<PaymentListenerStateInner>>,
+}
+
+impl PaymentListenerState {
+    // TODO: make those configurable
+    const MAX_WATCHER_FAILURES: usize = 20;
+    const MAX_PAYMENT_LISTENER_FAILURES: usize = 50;
+
+    pub(crate) fn new() -> Self {
+        PaymentListenerState {
+            inner: Arc::new(RwLock::new(PaymentListenerStateInner {
+                last_checked: OffsetDateTime::UNIX_EPOCH,
+                processed_payments_since_startup: 0,
+                watcher_errors_since_startup: 0,
+                payment_listener_errors_since_startup: 0,
+                last_processed_payment: None,
+                latest_failures: RingBuffer::new(Self::MAX_PAYMENT_LISTENER_FAILURES),
+                watchers: Default::default(),
+            })),
+        }
+    }
+
+    pub(crate) async fn insert_listener_failure(&self, failure: PaymentListenerFailureDetails) {
+        let mut guard = self.inner.write().await;
+
+        guard.payment_listener_errors_since_startup += 1;
+        guard.latest_failures.push(failure);
+    }
+
+    pub(crate) async fn insert_watcher_failure(&self, id: &str, failure: WatcherFailureDetails) {
+        self.inner
+            .write()
+            .await
+            .watchers
+            .entry(id.to_string())
+            .or_insert(WatcherState {
+                latest_failures: RingBuffer::new(Self::MAX_WATCHER_FAILURES),
+            })
+            .latest_failures
+            .push(failure);
+    }
+
+    pub(crate) async fn processed_payment_transaction(&self, payment: ProcessedPayment) {
+        let mut guard = self.inner.write().await;
+
+        guard.processed_payments_since_startup += 1;
+        guard.last_processed_payment = Some(payment)
+    }
+
+    pub(crate) async fn update_last_checked(&self) {
+        self.inner.write().await.last_checked = OffsetDateTime::now_utc();
+    }
+}
+
+impl FromRef<AppState> for PaymentListenerState {
+    fn from_ref(input: &AppState) -> Self {
+        input.payment_listener_state.clone()
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct PaymentListenerStateInner {
+    pub(crate) last_checked: OffsetDateTime,
+
+    pub(crate) processed_payments_since_startup: u64,
+    pub(crate) watcher_errors_since_startup: u64,
+    pub(crate) payment_listener_errors_since_startup: u64,
+
+    pub(crate) last_processed_payment: Option<ProcessedPayment>,
+
+    pub(crate) latest_failures: RingBuffer<PaymentListenerFailureDetails>,
+    pub(crate) watchers: HashMap<String, WatcherState>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub(crate) struct ProcessedPayment {
+    pub processed_at: OffsetDateTime,
+
+    pub tx_hash: String,
+    pub message_index: u64,
+    pub height: u64,
+    pub sender: String,
+    pub receiver: String,
+    pub funds: Coin,
+    pub memo: String,
+}
+
+impl From<WebhookPayload> for ProcessedPayment {
+    fn from(payload: WebhookPayload) -> Self {
+        ProcessedPayment {
+            processed_at: OffsetDateTime::now_utc(),
+            tx_hash: payload.transaction_hash,
+            message_index: payload.message_index,
+            height: payload.height as u64,
+            sender: payload.sender_address,
+            receiver: payload.receiver_address,
+            funds: payload.funds.into(),
+            memo: payload.memo.unwrap_or_default(),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct PaymentListenerFailureDetails {
+    pub(crate) timestamp: OffsetDateTime,
+    pub(crate) error: String,
+}
+
+impl PaymentListenerFailureDetails {
+    pub(crate) fn new(error: String) -> Self {
+        PaymentListenerFailureDetails {
+            timestamp: OffsetDateTime::now_utc(),
+            error,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct WatcherState {
+    pub(crate) latest_failures: RingBuffer<WatcherFailureDetails>,
+}
+
+#[derive(Debug)]
+pub(crate) struct WatcherFailureDetails {
+    pub(crate) timestamp: OffsetDateTime,
+    pub(crate) error: String,
+}
+
+impl WatcherFailureDetails {
+    pub(crate) fn new(error: String) -> Self {
+        WatcherFailureDetails {
+            timestamp: OffsetDateTime::now_utc(),
+            error,
+        }
+    }
 }
@@ -10,6 +10,7 @@ mod config;
 mod db;
 mod env;
 mod error;
+pub(crate) mod helpers;
 mod http;
 mod logging;
 pub mod models;
@@ -1,6 +1,6 @@
 use nym_validator_client::nyxd::CosmWasmCoin;
-use rocket::serde::{Deserialize, Serialize};
 use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;

 #[derive(Serialize, Deserialize, Clone, JsonSchema, ToSchema)]
@@ -1,108 +1,152 @@
-use crate::config::payments_watcher::HttpAuthenticationOptions;
-use crate::config::PaymentWatcherConfig;
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::config::PaymentWatchersConfig;
+use crate::db::models::Transaction;
 use crate::db::queries;
+use crate::http::state::{
+    PaymentListenerFailureDetails, PaymentListenerState, ProcessedPayment, WatcherFailureDetails,
+};
 use crate::models::WebhookPayload;
-use nym_validator_client::nyxd::Coin;
-use reqwest::Client;
+use crate::payment_listener::watcher::PaymentWatcher;
+use anyhow::Context;
 use sqlx::SqlitePool;
-use std::str::FromStr;
 use tokio::time::{self, Duration};
-use tracing::{error, info};
+use tracing::{debug, error, info};

-pub(crate) async fn run_payment_listener(
-    payment_watcher_config: PaymentWatcherConfig,
-    watcher_pool: SqlitePool,
-) -> anyhow::Result<()> {
-    let client = Client::new();
+pub(crate) mod watcher;

-    loop {
-        // 1. get the last height this watcher ran at
-        let last_checked_height = queries::payments::get_last_checked_height(&watcher_pool).await?;
-        info!("Last checked height: {}", last_checked_height);
+pub(crate) struct PaymentListener {
+    db_pool: SqlitePool,
+    payment_watchers: Vec<PaymentWatcher>,
+    shared_state: PaymentListenerState,
+}

-        // 2. iterate through watchers
-        for watcher in &payment_watcher_config.watchers {
-            if watcher.watch_for_transfer_recipient_accounts.is_some() {
-                // 3. Query new transactions for this watcher's recipient accounts
-                let transactions = sqlx::query!(
-                    r#"
-                    SELECT * FROM transactions
-                    WHERE height > ? 
-                    ORDER BY height ASC, message_index ASC
-                    "#,
-                    last_checked_height
-                )
-                .fetch_all(&watcher_pool)
-                .await?;
+impl PaymentListener {
+    pub(crate) fn new(
+        db_pool: SqlitePool,
+        config: PaymentWatchersConfig,
+        shared_state: PaymentListenerState,
+    ) -> anyhow::Result<Self> {
+        Ok(PaymentListener {
+            db_pool,
+            payment_watchers: config
+                .watchers
+                .iter()
+                .map(|watcher_cfg| PaymentWatcher::new(watcher_cfg.clone()))
+                .collect::<anyhow::Result<Vec<_>>>()?,
+            shared_state,
+        })
+    }

-                if !transactions.is_empty() {
-                    info!(
-                        "[watcher = {}] Processing {} transactions",
-                        watcher.id,
-                        transactions.len()
-                    );
-                }
+    async fn retrieve_unprocessed_transactions(&self) -> anyhow::Result<Vec<Transaction>> {
+        let last_checked_height = queries::payments::get_last_checked_height(&self.db_pool).await?;
+        let txs = sqlx::query_as!(
+            Transaction,
+            r#"
+                SELECT id, tx_hash, height, message_index, sender, recipient, amount, memo, created_at as "created_at: ::time::OffsetDateTime"
+                FROM transactions
+                WHERE height > ?
+                ORDER BY height ASC, message_index ASC
+            "#,
+            last_checked_height
+        )
+        .fetch_all(&self.db_pool)
+        .await?;

-                for tx in transactions {
-                    let funds = Coin::from_str(&tx.amount)?;
-                    let amount: f64 = funds.amount as f64 / 1e6f64; // convert to major value, there will be precision loss
+        Ok(txs)
+    }

-                    // Store transaction hash for later use
-                    let tx_hash = tx.tx_hash.clone();
-                    let message_index = tx.message_index;
+    async fn process_transaction(&self, tx: Transaction) -> anyhow::Result<()> {
+        // 3.1 process any payments
+        let funds = tx.funds()?;
+        let amount: f64 = funds.amount as f64 / 1e6f64; // convert to major value, there will be precision loss

-                    queries::payments::insert_payment(
-                        &watcher_pool,
-                        tx.tx_hash,
-                        tx.sender.clone(),
-                        tx.recipient.clone(),
-                        amount,
-                        tx.height,
-                        tx.memo.clone(),
+        // TODO: FIXME: it may happen that we insert a payment but fail to invoke all webhooks
+
+        queries::payments::insert_payment(
+            &self.db_pool,
+            tx.tx_hash.clone(),
+            tx.sender.clone(),
+            tx.recipient.clone(),
+            amount,
+            tx.height,
+            tx.memo.clone(),
+        )
+        .await?;
+
+        // 3.1. invoke all relevant webhooks for all registered watchers
+        let webhook_data = WebhookPayload {
+            transaction_hash: tx.tx_hash,
+            message_index: tx.message_index as u64,
+            sender_address: tx.sender,
+            receiver_address: tx.recipient,
+            funds: funds.into(),
+            height: tx.height as u128,
+            memo: tx.memo,
+        };
+
+        for watcher in &self.payment_watchers {
+            if let Err(err) = watcher.invoke_webhook(&webhook_data).await {
+                error!("watcher {} failure: {err:#}", watcher.id());
+                self.shared_state
+                    .insert_watcher_failure(
+                        watcher.id(),
+                        WatcherFailureDetails::new(err.to_string()),
                    )
-                    .await?;
-
-                    let webhook_data = WebhookPayload {
-                        transaction_hash: tx_hash.clone(),
-                        message_index: message_index as u64,
-                        sender_address: tx.sender,
-                        receiver_address: tx.recipient,
-                        funds: funds.into(),
-                        height: tx.height as u128,
-                        memo: tx.memo,
-                    };
-
-                    let mut request_builder = client.post(&watcher.webhook_url).json(&webhook_data);
-
-                    if let Some(auth) = &watcher.authentication {
-                        match auth {
-                            HttpAuthenticationOptions::AuthorizationBearerToken { token } => {
-                                request_builder = request_builder.bearer_auth(token);
-                            }
-                        }
-                    }
-
-                    match request_builder.send().await {
-                        Ok(res) => info!(
-                            "[watcher = {}] ✅ Webhook {} {} - tx {}, index {}",
-                            watcher.id,
-                            res.status(),
-                            res.url(),
-                            tx_hash,
-                            message_index,
-                        ),
-                        Err(e) => error!(
-                            "[watcher = {}] ❌ Webhook {:?} {:?} error = {}",
-                            watcher.id,
-                            e.status(),
-                            e.url(),
-                            e,
-                        ),
-                    }
-                }
+                    .await
            }
        }

-        time::sleep(Duration::from_secs(10)).await;
+        self.shared_state
+            .processed_payment_transaction(ProcessedPayment::from(webhook_data))
+            .await;
+
+        Ok(())
+    }
+
+    async fn check_for_unprocessed_payments(&self) -> anyhow::Result<()> {
+        // 1. retrieve any unprocessed transactions
+        let unprocessed_transactions = self
+            .retrieve_unprocessed_transactions()
+            .await
+            .context("failed to retrieve unprocessed transactions")?;
+
+        if unprocessed_transactions.is_empty() {
+            debug!("no payment transactions to process.");
+            return Ok(());
+        } else {
+            info!(
+                "processing {} payment transactions",
+                unprocessed_transactions.len()
+            );
+        }
+
+        // 2. attempt to process them
+        for tx in unprocessed_transactions {
+            let hash = tx.tx_hash.clone();
+            let height = tx.height;
+            self.process_transaction(tx).await.with_context(|| {
+                format!("failed to process transaction {hash} at height {height}")
+            })?;
+        }
+
+        Ok(())
+    }
+
+    pub(crate) async fn run(&self) {
+        loop {
+            time::sleep(Duration::from_secs(10)).await;
+
+            if let Err(err) = self.check_for_unprocessed_payments().await {
+                error!("failed to fully process payments: {err:#}");
+                self.shared_state
+                    .insert_listener_failure(PaymentListenerFailureDetails::new(err.to_string()))
+                    .await;
+                continue;
+            }
+
+            self.shared_state.update_last_checked().await;
+        }
    }
 }
@@ -0,0 +1,73 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::config::payments_watcher::{HttpAuthenticationOptions, PaymentWatcherConfig};
+use crate::models::WebhookPayload;
+use anyhow::Context;
+use reqwest::{Client, Url};
+use tracing::{error, info};
+
+pub(crate) struct PaymentWatcher {
+    webhook_url: Url,
+    config: PaymentWatcherConfig,
+}
+
+impl PaymentWatcher {
+    pub(crate) fn new(config: PaymentWatcherConfig) -> anyhow::Result<Self> {
+        Ok(PaymentWatcher {
+            webhook_url: config
+                .webhook_url
+                .as_str()
+                .parse()
+                .context("couldn't create payment watcher: provided webhook URL is malformed")?,
+            config,
+        })
+    }
+
+    pub(super) fn id(&self) -> &str {
+        &self.config.id
+    }
+
+    pub(crate) async fn invoke_webhook(&self, payload: &WebhookPayload) -> anyhow::Result<()> {
+        let client = Client::builder()
+            .user_agent(format!(
+                "nyx-chain-watcher/{}/watcher-{}",
+                env!("CARGO_PKG_VERSION"),
+                self.config.id
+            ))
+            .build()
+            .context("failed to build reqwest client")?;
+
+        let mut request_builder = client.post(self.webhook_url.clone()).json(payload);
+
+        if let Some(auth) = &self.config.authentication {
+            match auth {
+                HttpAuthenticationOptions::AuthorizationBearerToken { token } => {
+                    request_builder = request_builder.bearer_auth(token);
+                }
+            }
+        }
+
+        match request_builder.send().await {
+            Ok(res) => info!(
+                "[watcher = {}] ✅ Webhook {} {} - tx {}, index {}",
+                self.config.id,
+                res.status(),
+                res.url(),
+                payload.transaction_hash,
+                payload.message_index,
+            ),
+            Err(err) => {
+                error!(
+                    "[watcher = {}] ❌ Webhook {:?} {:?} error = {err}",
+                    self.config.id,
+                    err.status(),
+                    err.url(),
+                );
+                return Err(err.into());
+            }
+        }
+
+        Ok(())
+    }
+}
@@ -3,7 +3,6 @@ use crate::db::{
    queries::price::insert_nym_prices,
 };
 use core::str;
-use tokio::task::JoinHandle;
 use tokio::time::Duration;

 use crate::db::DbPool;
@@ -13,7 +12,7 @@ const FAILURE_RETRY_DELAY: Duration = Duration::from_secs(60 * 2);
 const COINGECKO_API_URL: &str =
    "https://api.coingecko.com/api/v3/simple/price?ids=nym&vs_currencies=chf,usd,eur,gbp,btc";

-pub(crate) async fn run_price_scraper(db_pool: &DbPool) -> JoinHandle<()> {
+pub(crate) async fn run_price_scraper(db_pool: &DbPool) {
    loop {
        tracing::info!("Running in a loop 🏃");
        if let Err(e) = get_coingecko_prices(db_pool).await {
@@ -58,6 +58,7 @@ tap = { workspace = true }
 thiserror = { workspace = true }
 url = { workspace = true }
 toml = { workspace = true }
+tempfile = { workspace = true }

 # tcpproxy dependencies
 clap = { workspace = true, features = ["derive"] }
@@ -3,13 +3,14 @@ use nym_sdk::mixnet::{
    StoragePaths,
 };
 use std::path::PathBuf;
+use tempfile::TempDir;

 #[tokio::main]
 async fn main() {
    nym_bin_common::logging::setup_logging();

    // Specify some config options
-    let config_dir = PathBuf::from("/tmp/surb-example");
+    let config_dir: PathBuf = TempDir::new().unwrap().path().to_path_buf();
    let storage_paths = StoragePaths::new_from_dir(&config_dir).unwrap();

    // Create the client with a storage backend, and enable it by giving it some paths. If keys
@@ -82,7 +82,7 @@ pub use nym_sphinx::{
 pub use nym_statistics_common::clients::{
    connection::ConnectionStatsEvent, ClientStatsEvents, ClientStatsSender,
 };
-pub use nym_task::connections::TransmissionLane;
+pub use nym_task::connections::{LaneQueueLengths, TransmissionLane};
 pub use nym_topology::{provider_trait::TopologyProvider, NymTopology};
 pub use paths::StoragePaths;
 pub use socks5_client::Socks5MixnetClient;
@@ -111,16 +111,16 @@ pub(crate) async fn execute(args: &Request) -> Result<(), AuthenticatorError> {
    let authenticator_recipient = Recipient::from_str(&args.authenticator_recipient)?;
    let (request, _) = match request_data {
        AuthenticatorRequestData::Initial(init_message) => {
-            AuthenticatorRequest::new_initial_request(init_message, *mixnet_client.nym_address())
+            AuthenticatorRequest::new_initial_request(init_message)
        }
        AuthenticatorRequestData::Final(final_message) => {
-            AuthenticatorRequest::new_final_request(*final_message, *mixnet_client.nym_address())
+            AuthenticatorRequest::new_final_request(*final_message)
        }
        AuthenticatorRequestData::QueryBandwidth(query_message) => {
-            AuthenticatorRequest::new_query_request(query_message, *mixnet_client.nym_address())
+            AuthenticatorRequest::new_query_request(query_message)
        }
        AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-            AuthenticatorRequest::new_topup_request(*top_up_message, *mixnet_client.nym_address())
+            AuthenticatorRequest::new_topup_request(*top_up_message)
        }
    };
    mixnet_client
@@ -89,6 +89,9 @@ pub enum AuthenticatorError {
    #[error("unknown version number")]
    UnknownVersion,

+    #[error("missing reply_to for old client")]
+    MissingReplyToForOldClient,
+
    #[error("{0}")]
    PublicKey(#[from] nym_wireguard_types::Error),

@@ -21,7 +21,7 @@ use nym_authenticator_requests::{
        AuthenticatorRequest, AuthenticatorVersion, FinalMessage, InitMessage,
        QueryBandwidthMessage, TopUpMessage,
    },
-    v1, v2, v3, v4, CURRENT_VERSION,
+    v1, v2, v3, v4, v5, CURRENT_VERSION,
 };
 use nym_credential_verification::{
    bandwidth_storage_manager::BandwidthStorageManager, ecash::EcashManager,
@@ -42,7 +42,7 @@ use rand::{prelude::IteratorRandom, thread_rng};
 use tokio::sync::RwLock;
 use tokio_stream::wrappers::IntervalStream;

-type AuthenticatorHandleResult = Result<(Vec<u8>, Recipient)>;
+type AuthenticatorHandleResult = Result<(Vec<u8>, Option<Recipient>)>;
 const DEFAULT_REGISTRATION_TIMEOUT_CHECK: Duration = Duration::from_secs(60); // 1 minute

 pub(crate) struct RegistredAndFree {
@@ -155,7 +155,7 @@ impl MixnetListener {
        init_message: Box<dyn InitMessage + Send + Sync + 'static>,
        protocol: Protocol,
        request_id: u64,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
    ) -> AuthenticatorHandleResult {
        let remote_public = init_message.pub_key();
        let nonce: u64 = fastrand::u64(..);
@@ -178,7 +178,7 @@ impl MixnetListener {
                            wg_port: registration_data.wg_port,
                        },
                        request_id,
-                        reply_to,
+                        reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    )
                    .to_bytes()
                    .map_err(|err| {
@@ -198,7 +198,7 @@ impl MixnetListener {
                            wg_port: registration_data.wg_port,
                        },
                        request_id,
-                        reply_to,
+                        reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    )
                    .to_bytes()
                    .map_err(|err| {
@@ -218,7 +218,7 @@ impl MixnetListener {
                            wg_port: registration_data.wg_port,
                        },
                        request_id,
-                        reply_to,
+                        reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    )
                    .to_bytes()
                    .map_err(|err| {
@@ -228,12 +228,26 @@ impl MixnetListener {
                AuthenticatorVersion::V4 => {
                    v4::response::AuthenticatorResponse::new_pending_registration_success(
                        v4::registration::RegistrationData {
+                            nonce: registration_data.nonce,
+                            gateway_data: registration_data.gateway_data.clone().into(),
+                            wg_port: registration_data.wg_port,
+                        },
+                        request_id,
+                        reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
+                    )
+                    .to_bytes()
+                    .map_err(|err| {
+                        AuthenticatorError::FailedToSerializeResponsePacket { source: err }
+                    })?
+                }
+                AuthenticatorVersion::V5 => {
+                    v5::response::AuthenticatorResponse::new_pending_registration_success(
+                        v5::registration::RegistrationData {
                            nonce: registration_data.nonce,
                            gateway_data: registration_data.gateway_data.clone(),
                            wg_port: registration_data.wg_port,
                        },
                        request_id,
-                        reply_to,
                    )
                    .to_bytes()
                    .map_err(|err| {
@@ -272,7 +286,7 @@ impl MixnetListener {
                        private_ip: allowed_ipv4.into(),
                        wg_port: self.config.authenticator.announced_port,
                    },
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -285,7 +299,7 @@ impl MixnetListener {
                        private_ip: allowed_ipv4.into(),
                        wg_port: self.config.authenticator.announced_port,
                    },
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -298,7 +312,7 @@ impl MixnetListener {
                        private_ip: allowed_ipv4.into(),
                        wg_port: self.config.authenticator.announced_port,
                    },
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -311,7 +325,19 @@ impl MixnetListener {
                        private_ips: (allowed_ipv4, allowed_ipv6).into(),
                        wg_port: self.config.authenticator.announced_port,
                    },
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
+                    request_id,
+                )
+                .to_bytes()
+                .map_err(|err| {
+                    AuthenticatorError::FailedToSerializeResponsePacket { source: err }
+                })?,
+                AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::new_registered(
+                    v5::registration::RegistredData {
+                        pub_key: PeerPublicKey::new(self.keypair().public_key().to_bytes().into()),
+                        private_ips: (allowed_ipv4, allowed_ipv6).into(),
+                        wg_port: self.config.authenticator.announced_port,
+                    },
                    request_id,
                )
                .to_bytes()
@@ -360,7 +386,7 @@ impl MixnetListener {
                        wg_port: registration_data.wg_port,
                    },
                    request_id,
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                )
                .to_bytes()
                .map_err(|err| {
@@ -380,7 +406,7 @@ impl MixnetListener {
                        wg_port: registration_data.wg_port,
                    },
                    request_id,
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                )
                .to_bytes()
                .map_err(|err| {
@@ -400,7 +426,7 @@ impl MixnetListener {
                        wg_port: registration_data.wg_port,
                    },
                    request_id,
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                )
                .to_bytes()
                .map_err(|err| {
@@ -410,12 +436,26 @@ impl MixnetListener {
            AuthenticatorVersion::V4 => {
                v4::response::AuthenticatorResponse::new_pending_registration_success(
                    v4::registration::RegistrationData {
+                        nonce: registration_data.nonce,
+                        gateway_data: registration_data.gateway_data.into(),
+                        wg_port: registration_data.wg_port,
+                    },
+                    request_id,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
+                )
+                .to_bytes()
+                .map_err(|err| {
+                    AuthenticatorError::FailedToSerializeResponsePacket { source: err }
+                })?
+            }
+            AuthenticatorVersion::V5 => {
+                v5::response::AuthenticatorResponse::new_pending_registration_success(
+                    v5::registration::RegistrationData {
                        nonce: registration_data.nonce,
                        gateway_data: registration_data.gateway_data,
                        wg_port: registration_data.wg_port,
                    },
                    request_id,
-                    reply_to,
                )
                .to_bytes()
                .map_err(|err| {
@@ -433,7 +473,7 @@ impl MixnetListener {
        final_message: Box<dyn FinalMessage + Send + Sync + 'static>,
        protocol: Protocol,
        request_id: u64,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
    ) -> AuthenticatorHandleResult {
        let mut registred_and_free = self.registred_and_free.write().await;
        let registration_data = registred_and_free
@@ -500,7 +540,7 @@ impl MixnetListener {
                    private_ip: registration_data.gateway_data.private_ips.ipv4.into(),
                    wg_port: registration_data.wg_port,
                },
-                reply_to,
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                request_id,
            )
            .to_bytes()
@@ -511,7 +551,7 @@ impl MixnetListener {
                    private_ip: registration_data.gateway_data.private_ips.ipv4.into(),
                    wg_port: registration_data.wg_port,
                },
-                reply_to,
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                request_id,
            )
            .to_bytes()
@@ -522,18 +562,28 @@ impl MixnetListener {
                    private_ip: registration_data.gateway_data.private_ips.ipv4.into(),
                    wg_port: registration_data.wg_port,
                },
-                reply_to,
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                request_id,
            )
            .to_bytes()
            .map_err(|err| AuthenticatorError::FailedToSerializeResponsePacket { source: err })?,
            AuthenticatorVersion::V4 => v4::response::AuthenticatorResponse::new_registered(
                v4::registration::RegistredData {
+                    pub_key: registration_data.gateway_data.pub_key,
+                    private_ips: registration_data.gateway_data.private_ips.into(),
+                    wg_port: registration_data.wg_port,
+                },
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
+                request_id,
+            )
+            .to_bytes()
+            .map_err(|err| AuthenticatorError::FailedToSerializeResponsePacket { source: err })?,
+            AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::new_registered(
+                v5::registration::RegistredData {
                    pub_key: registration_data.gateway_data.pub_key,
                    private_ips: registration_data.gateway_data.private_ips,
                    wg_port: registration_data.wg_port,
                },
-                reply_to,
                request_id,
            )
            .to_bytes()
@@ -579,7 +629,7 @@ impl MixnetListener {
        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
        protocol: Protocol,
        request_id: u64,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
    ) -> AuthenticatorHandleResult {
        let bandwidth_data = self.peer_manager.query_bandwidth(msg).await?;
        let bytes = match AuthenticatorVersion::from(protocol) {
@@ -589,7 +639,7 @@ impl MixnetListener {
                        available_bandwidth: data.available_bandwidth as u64,
                        suspended: false,
                    }),
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -602,7 +652,7 @@ impl MixnetListener {
                    bandwidth_data.map(|data| v2::registration::RemainingBandwidthData {
                        available_bandwidth: data.available_bandwidth,
                    }),
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -615,7 +665,7 @@ impl MixnetListener {
                    bandwidth_data.map(|data| v3::registration::RemainingBandwidthData {
                        available_bandwidth: data.available_bandwidth,
                    }),
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                    request_id,
                )
                .to_bytes()
@@ -628,7 +678,19 @@ impl MixnetListener {
                    bandwidth_data.map(|data| v4::registration::RemainingBandwidthData {
                        available_bandwidth: data.available_bandwidth,
                    }),
-                    reply_to,
+                    reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
+                    request_id,
+                )
+                .to_bytes()
+                .map_err(|err| {
+                    AuthenticatorError::FailedToSerializeResponsePacket { source: err }
+                })?
+            }
+            AuthenticatorVersion::V5 => {
+                v5::response::AuthenticatorResponse::new_remaining_bandwidth(
+                    bandwidth_data.map(|data| v5::registration::RemainingBandwidthData {
+                        available_bandwidth: data.available_bandwidth,
+                    }),
                    request_id,
                )
                .to_bytes()
@@ -646,7 +708,7 @@ impl MixnetListener {
        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
        protocol: Protocol,
        request_id: u64,
-        reply_to: Recipient,
+        reply_to: Option<Recipient>,
    ) -> AuthenticatorHandleResult {
        let Some(ecash_verifier) = self.ecash_verifier.clone() else {
            return Err(AuthenticatorError::UnsupportedOperation);
@@ -681,11 +743,19 @@ impl MixnetListener {
        let available_bandwidth = verifier.verify().await?;

        let bytes = match AuthenticatorVersion::from(protocol) {
+            AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::new_topup_bandwidth(
+                v5::registration::RemainingBandwidthData {
+                    available_bandwidth,
+                },
+                request_id,
+            )
+            .to_bytes()
+            .map_err(|err| AuthenticatorError::FailedToSerializeResponsePacket { source: err })?,
            AuthenticatorVersion::V4 => v4::response::AuthenticatorResponse::new_topup_bandwidth(
                v4::registration::RemainingBandwidthData {
                    available_bandwidth,
                },
-                reply_to,
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                request_id,
            )
            .to_bytes()
@@ -694,7 +764,7 @@ impl MixnetListener {
                v3::registration::RemainingBandwidthData {
                    available_bandwidth,
                },
-                reply_to,
+                reply_to.ok_or(AuthenticatorError::MissingReplyToForOldClient)?,
                request_id,
            )
            .to_bytes()
@@ -762,10 +832,10 @@ impl MixnetListener {
    async fn handle_response(
        &self,
        response: Vec<u8>,
-        recipient: Recipient,
+        recipient: Option<Recipient>,
        sender_tag: Option<AnonymousSenderTag>,
    ) -> Result<()> {
-        let input_message = create_input_message(recipient, sender_tag, response);
+        let input_message = create_input_message(recipient, sender_tag, response)?;
        self.mixnet_client
            .send(input_message)
            .await
@@ -858,6 +928,17 @@ fn deserialize_request(reconstructed: &ReconstructedMessage) -> Result<Authentic
                Err(AuthenticatorError::InvalidPacketType(request_type))
            }
        }
+        [5, request_type] => {
+            if request_type == ServiceProviderType::Authenticator as u8 {
+                v5::request::AuthenticatorRequest::from_reconstructed_message(reconstructed)
+                    .map_err(|err| AuthenticatorError::FailedToDeserializeTaggedPacket {
+                        source: err,
+                    })
+                    .map(Into::into)
+            } else {
+                Err(AuthenticatorError::InvalidPacketType(request_type))
+            }
+        }
        [version, _] => {
            log::info!("Received packet with invalid version: v{version}");
            Err(AuthenticatorError::InvalidPacketVersion(version))
@@ -866,17 +947,30 @@ fn deserialize_request(reconstructed: &ReconstructedMessage) -> Result<Authentic
 }

 fn create_input_message(
-    nym_address: Recipient,
+    nym_address: Option<Recipient>,
    reply_to_tag: Option<AnonymousSenderTag>,
    response_packet: Vec<u8>,
-) -> InputMessage {
+) -> Result<InputMessage> {
    let lane = TransmissionLane::General;
    let packet_type = None;
    if let Some(reply_to_tag) = reply_to_tag {
        log::debug!("Creating message using SURB");
-        InputMessage::new_reply(reply_to_tag, response_packet, lane, packet_type)
-    } else {
+        Ok(InputMessage::new_reply(
+            reply_to_tag,
+            response_packet,
+            lane,
+            packet_type,
+        ))
+    } else if let Some(nym_address) = nym_address {
        log::debug!("Creating message using nym_address");
-        InputMessage::new_regular(nym_address, response_packet, lane, packet_type)
+        Ok(InputMessage::new_regular(
+            nym_address,
+            response_packet,
+            lane,
+            packet_type,
+        ))
+    } else {
+        log::error!("No nym-address or sender tag provided");
+        Err(AuthenticatorError::MissingReplyToForOldClient)
    }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jon Häggblad	3bbc812c2c	wip	2025-03-12 11:44:39 +01:00
Jon Häggblad	b2fb2c79b2	wip	2025-03-12 11:44:39 +01:00
Jon Häggblad	2df817082b	wip	2025-03-12 11:44:39 +01:00
Jędrzej Stuczyński	a7fcfef5a3	Merge pull request #5601 from nymtech/chore/payment-watcher-debug-endpoints Chore/payment watcher debug endpoints	2025-03-11 16:47:30 +00:00
dependabot[bot]	fa927b82d8	Merge pull request #5541 from nymtech/dependabot/cargo/rs_merkle-1.5.0 build(deps): bump rs_merkle from 1.4.2 to 1.5.0	2025-03-11 16:02:00 +01:00
import this	f724478763	[DOCs/operators]: Add steps to synchronize server time, using NTP (#5603 )	2025-03-11 11:18:18 +00:00
Jędrzej Stuczyński	040f4f2500	Merge pull request #5602 from nymtech/merge/release/2025.4-dorina-patched merge release/2025.4-dorina-patched into develop	2025-03-11 10:36:50 +00:00
Jędrzej Stuczyński	63002e784a	Merge branch 'develop' into merge/release/2025.4-dorina-patched	2025-03-11 09:53:56 +00:00
Jon Häggblad	4a0b683b70	Merge pull request #5583 from nymtech/dependabot/cargo/ring-0.17.13 build(deps): bump ring from 0.17.9 to 0.17.13	2025-03-11 10:37:21 +01:00
Jędrzej Stuczyński	9e84b1f0c1	ci clippy	2025-03-11 09:33:44 +00:00
Jon Häggblad	bf031ad6de	Merge pull request #5587 from nymtech/dependabot/cargo/tokio-1.44.0 build(deps): bump tokio from 1.43.0 to 1.44.0	2025-03-11 09:36:43 +01:00
dependabot[bot]	933769401c	build(deps): bump tokio from 1.43.0 to 1.44.0 Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.43.0 to 1.44.0. - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.43.0...tokio-1.44.0) --- updated-dependencies: - dependency-name: tokio dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-03-11 08:07:30 +00:00
Jon Häggblad	ddd85704bb	Merge pull request #5576 from nymtech/max/update-surb-example-tempdir2 Rust SDK SURB example: change hardcoded file to tempdir	2025-03-11 09:05:25 +01:00
Jon Häggblad	17860c809f	Merge pull request #5588 from nymtech/dependabot/cargo/tempfile-3.18.0 build(deps): bump tempfile from 3.17.1 to 3.18.0	2025-03-11 08:38:11 +01:00
Jon Häggblad	2d00fcd934	Allow resetting all SURB sender tags (#5600 ) * Allow resetting all SURB sender tags * wasm fixes * More wasm fixes	2025-03-11 08:35:40 +01:00
Jędrzej Stuczyński	c2c3df98cb	updated payment watcher version	2025-03-10 17:28:24 +00:00
Jędrzej Stuczyński	f429092e21	added basic payment listener information to status api	2025-03-10 17:28:12 +00:00
Jędrzej Stuczyński	d7ef68d8d1	remove fallback to env values for watched addresses	2025-03-10 17:28:12 +00:00
Jędrzej Stuczyński	1a334b575d	feat: make sure any terminated task kills the watcher and write run info to db (#5517 ) * feat: make sure any terminated task kills the watcher and write run info to db * updated chain watcher version	2025-03-10 13:34:08 +00:00
dependabot[bot]	2126736aff	build(deps): bump tempfile from 3.17.1 to 3.18.0 Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.17.1 to 3.18.0. - [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stebalien/tempfile/compare/v3.17.1...v3.18.0) --- updated-dependencies: - dependency-name: tempfile dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-03-10 10:37:03 +00:00
dependabot[bot]	a69aa23609	build(deps): bump the patch-updates group with 8 updates (#5585 ) Bumps the patch-updates group with 8 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [bytes](https://github.com/tokio-rs/bytes) \| `1.10.0` \| `1.10.1` \| \| [semver](https://github.com/dtolnay/semver) \| `1.0.25` \| `1.0.26` \| \| [serde](https://github.com/serde-rs/serde) \| `1.0.218` \| `1.0.219` \| \| [serde_bytes](https://github.com/serde-rs/bytes) \| `0.11.16` \| `0.11.17` \| \| [serde_derive](https://github.com/serde-rs/serde) \| `1.0.218` \| `1.0.219` \| \| [serde_repr](https://github.com/dtolnay/serde-repr) \| `0.1.19` \| `0.1.20` \| \| [time](https://github.com/time-rs/time) \| `0.3.37` \| `0.3.39` \| \| [ff](https://github.com/zkcrypto/ff) \| `0.13.0` \| `0.13.1` \| Updates `bytes` from 1.10.0 to 1.10.1 - [Release notes](https://github.com/tokio-rs/bytes/releases) - [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/bytes/compare/v1.10.0...v1.10.1) Updates `semver` from 1.0.25 to 1.0.26 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.25...1.0.26) Updates `serde` from 1.0.218 to 1.0.219 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](https://github.com/serde-rs/serde/compare/v1.0.218...v1.0.219) Updates `serde_bytes` from 0.11.16 to 0.11.17 - [Release notes](https://github.com/serde-rs/bytes/releases) - [Commits](https://github.com/serde-rs/bytes/compare/0.11.16...0.11.17) Updates `serde_derive` from 1.0.218 to 1.0.219 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](https://github.com/serde-rs/serde/compare/v1.0.218...v1.0.219) Updates `serde_repr` from 0.1.19 to 0.1.20 - [Release notes](https://github.com/dtolnay/serde-repr/releases) - [Commits](https://github.com/dtolnay/serde-repr/compare/0.1.19...0.1.20) Updates `time` from 0.3.37 to 0.3.39 - [Release notes](https://github.com/time-rs/time/releases) - [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md) - [Commits](https://github.com/time-rs/time/compare/v0.3.37...v0.3.39) Updates `ff` from 0.13.0 to 0.13.1 - [Changelog](https://github.com/zkcrypto/ff/blob/main/CHANGELOG.md) - [Commits](https://github.com/zkcrypto/ff/commits) --- updated-dependencies: - dependency-name: bytes dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: semver dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: serde dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: serde_bytes dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: serde_derive dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: serde_repr dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: time dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: ff dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-10 11:35:14 +01:00
dependabot[bot]	8a2d98e3ce	build(deps): bump ring from 0.17.9 to 0.17.13 Bumps [ring](https://github.com/briansmith/ring) from 0.17.9 to 0.17.13. - [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md) - [Commits](https://github.com/briansmith/ring/commits) --- updated-dependencies: - dependency-name: ring dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-03-07 17:16:05 +00:00
mfahampshire	9c4243914e	Max/ns api docs (#5544 ) * first pass * cleanup * added qu * add readme * more verbose err * reword explainer @ top * rename private-key.public to public-key * move instructions to own file + add _meta.json files * first pass probe * remove unnecessary doubled notice to developers * added extra debug log to version() * include PR suggestions * remove commented out function	2025-03-07 09:57:52 +00:00
import this	143ede268d	[DOCs/operators]: Fix typo (#5581 )	2025-03-07 09:56:45 +00:00
import this	81bddb5f6d	[DOCs/operators]: Second patch version changelog (#5580 )	2025-03-07 09:46:08 +00:00
benedettadavico	247ebb7c43	update changelog	2025-03-06 21:26:16 +01:00
Jędrzej Stuczyński	01c052e9a4	use legacy crypto for constructing SURB headers (#5579 )	2025-03-06 20:13:16 +00:00
benedettadavico	6bd31b9521	bump nym-node version	2025-03-06 18:08:58 +01:00
Jon Häggblad	430c33eb04	Set DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE to 50	2025-03-06 18:03:08 +01:00
mfahampshire	d45d1eb313	change hardcoded file to tempdir	2025-03-06 17:37:19 +01:00
import this	3cb3ebd79b	[DOCs/operators]: Release ntoes for patched version (#5573 )	2025-03-06 14:56:40 +00:00
benedettadavico	b42e5b063e	bump api version	2025-03-06 15:45:02 +01:00
benedettadavico	f6b30d0db6	update changelog for patched-dorina	2025-03-06 15:06:24 +01:00
benedettadavico	c33e4c0836	bumping versions dorina patched	2025-03-06 15:03:43 +01:00
Jędrzej Stuczyński	be92ccf0da	bugfix: make sure to correctly decode response content when putting it into error message (#5571 )	2025-03-06 11:24:16 +00:00
Jędrzej Stuczyński	35bf49c48c	chore: additional logs when attempting to load ecash keys (#5567 )	2025-03-06 11:24:03 +00:00
Jędrzej Stuczyński	7335a3dad4	fix: gateway protocol negotation for v3/v4	2025-03-06 11:08:52 +00:00
Jędrzej Stuczyński	698883c03f	feature: v2 authentication request (#5537 ) (#5563 ) * introduced v2 authentication request between clients and gateways * client to send v2 auth when possible * added persistence to last used authentication timestamp * added clients identity to signed plaintext	2025-03-06 09:18:39 +00:00
Jon Häggblad	8ddef08c72	Tweak surb management to be more conservative (#5570 ) To reduce the risk of the IPR DoS the client: - Lower the timeout until the IPR will disconnect a client - Reduce fewer surbs at a time. Large surb requests increases the latency until all fragments in the response have been delivered. The efficiency gains of having large surb requests dimishes quickly for large sizes as well	2025-03-06 10:09:15 +01:00
Jon Häggblad	0d8b3abc6f	Deserialize v5 authenticator requests (#5568 )	2025-03-05 23:07:32 +01:00
Jędrzej Stuczyński	aa2f336904	hotfix: ensure we bail on merkle leaves insertion upon missing data (#5565 ) * hotfix: ensure we bail on merkle leaves insertion upon missing data * Update Cargo.toml --------- Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-03-05 16:44:35 +00:00
Jędrzej Stuczyński	eacaf84430	add full response body to error message upon decoding failure (#5566 )	2025-03-05 16:43:56 +00:00
Jon Häggblad	c284b1e8b1	Create authenticator v5 request/response types (#5561 ) * Create authenticator v5 request/response types * Support v5 in the authenticator * Fix tests * Bump nym-node version	2025-03-05 15:41:44 +01:00
Jon Häggblad	7785d085cf	Handle disconnect in IPR (#5547 ) * Implement disconnect in the IPR * Remove unused async	2025-03-05 15:17:51 +01:00
Jon Häggblad	bb5b2eafcf	Allow IPR reconnect to session (#5562 )	2025-03-05 15:02:07 +01:00
mfahampshire	09ea406c02	DOCS v2025.4-dorina release notes (#5552 ) * WIP changelog * [DOCs/operators]: Adding operators notes to new changelog PR(#5564) --------- Co-authored-by: import this <97586125+serinko@users.noreply.github.com>	2025-03-05 11:39:55 +00:00
@@ -1 +1 @@
 .64%
 .68%
@@ -1 +1 @@
 .811
 .157