cleanup final

cleanup and PR ready
refactor init tracer and use of tracing_opentelemetry span for async tracing
2025-10-21 13:10:10 +02:00 · 2025-10-20 11:22:42 +02:00 · 2025-10-17 11:27:45 +02:00 · 2025-10-16 13:53:52 +02:00 · 2025-10-14 09:33:54 +02:00 · 2025-10-08 16:14:05 +02:00
733 changed files with 18778 additions and 39488 deletions
@@ -81,21 +81,12 @@ jobs:
          command: fmt
          args: --all -- --check

-      - name: Clippy (macos)
-        if: contains(matrix.os, 'mac')
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe -- -D warnings
-
-      - name: Clippy (non-macos)
-        if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
+      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
          args: --workspace --all-targets -- -D warnings

-
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -10,7 +10,7 @@ env:

 jobs:
  check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -11,7 +11,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ arc-linux-latest-dind ]
+        platform: [ arc-ubuntu-22.04 ]

    runs-on: ${{ matrix.platform }}
    env:
@@ -28,11 +28,18 @@ jobs:
          mkdir -p $OUTPUT_DIR
          echo $OUTPUT_DIR

-      - name: Build contracts
-        run: make optimize-contracts
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true

-      - name: Check optimized contracts
-        run: make docker-check-contracts
+      - name: Install cosmwasm-check
+        run: cargo install cosmwasm-check
+
+      - name: Build release contracts
+        run: make publish-contracts

      - name: Prepare build output
        shell: bash
@@ -17,7 +17,7 @@ jobs:
  build:
    # since it's going to be compiled into wasm, there's absolutely
    # no point in running CI on different OS-es
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
    env:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
@@ -4,10 +4,10 @@ on:
  workflow_dispatch:
  pull_request:
    paths:
-      - "wasm/**"
-      - "clients/client-core/**"
-      - "common/**"
-      - ".github/workflows/ci-sdk-wasm.yml"
+      - 'wasm/**'
+      - 'clients/client-core/**'
+      - 'common/**'
+      - '.github/workflows/ci-sdk-wasm.yml'

 jobs:
  wasm:
@@ -33,7 +33,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -41,7 +41,7 @@ jobs:
      - name: Install wasm-opt
        uses: ./.github/actions/install-wasm-opt
        with:
-          version: "116"
+          version: '116'

      - name: Install wasm-bindgen-cli
        run: cargo install wasm-bindgen-cli
@@ -21,7 +21,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: arc-linux-latest
+          - os: arc-ubuntu-22.04
            target: x86_64-unknown-linux-gnu
    runs-on:  ${{ matrix.os }}

@@ -30,13 +30,11 @@ jobs:
      release_date: ${{ fromJSON(steps.create-release.outputs.assets)[0].published_at }}
      client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
      nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
-      nymnode_hash: ${{ steps.binary-hashes.outputs.nymnode_hash }}
      socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
      netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
      cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
      client_version: ${{ steps.binary-versions.outputs.client_version }}
      nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
-      nymnode_version: ${{ steps.binary-versions.outputs.nymnode_version }}
      socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
      netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
      cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -76,7 +74,6 @@ jobs:
            target/release/nym-network-requester
            target/release/nym-cli
            target/release/nymvisor
-            target/release/nym-node
          retention-days: 30
    
      - id: create-release
@@ -91,7 +88,6 @@ jobs:
            target/release/nym-network-requester
            target/release/nym-cli
            target/release/nymvisor
-            target/release/nym-node

  push-release-data-client:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
@@ -8,7 +8,7 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -20,7 +20,7 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -14,7 +14,7 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -8,7 +8,7 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -4,84 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.17-isabirra] (2025-09-29)
-
- Bugfix | Fix the registration handshake ([#6062])
- Convenience for ShutdownTracker ([#6038])
- chore: made http-api-client-macro doctest compile ([#6037])
- feat: refresh mixnet contract on epoch progression ([#6023])
- chore: remove legacy nodes from nym api [and kinda-ish from node status api] ([#6021])
- Feature/credential proxy crate ([#6018])
- Moving clients crate from vpn-client repo to here ([#6015])
- Feature/cancellation migration ([#6014])
- Use default value for the ports until api is deployed ([#6007])
- bugfix: return from MixTrafficController if client request channel has closed ([#6002])
- Revert "Create an axum_test client for more integrated unit testing (… ([#5999])
- chore: upgraded syn to 2.0 and removed nym-execute ([#5998])
- feat: use `ShutdownToken` (`CancellationToken` inside) for nym-api ([#5997])
- bugfix: Recipient deserialisation for deserialisers missing bytes specialisation ([#5991])
- chore: use updated version of simulate endpoint ([#5988])
- chore: purge temp databases on build ([#5984])
- Bump sha.js from 2.4.11 to 2.4.12 ([#5983])
- Feature: Delegation program stake checker and adjuster ([#5980])
- build(deps): bump actions/setup-java from 4 to 5 ([#5975])
- Domain fronting integration ([#5974])
- chore: internal hidden command to force advance nyx epoch ([#5964])
- Create an axum_test client for more integrated unit testing ([#5956])
- feat: shared library for attempting to retrieve update mode attestation ([#5954])
- Bump slab from 0.4.10 to 0.4.11 ([#5952])
- build(deps): bump actions/first-interaction from 1 to 3 ([#5950])
- fix: use WASM compatible time API in client ([#5948])
- feat: credential proxy deposit pool ([#5945])
- build(deps): bump actions/download-artifact from 4 to 5 ([#5939])
- feat: nym signers monitor ([#5933])
- Bump console from 0.15.11 to 0.16.0 ([#5931])
- Bump mock_instant from 0.5.3 to 0.6.0 ([#5930])
- Bump tokio from 1.46.1 to 1.47.1 ([#5929])
- Bump defguard_wireguard_rs from v0.4.7 to v0.7.5 ([#5928])
- Bump indicatif from 0.17.11 to 0.18.0 ([#5924])
- Feature: Nym node autorun CLI ([#5916])
- build(deps): bump mikefarah/yq from 4.45.4 to 4.47.1 ([#5911])
- build(deps): bump pbkdf2 from 3.1.2 to 3.1.3 ([#5869])
-
-[#6062]: https://github.com/nymtech/nym/pull/6062
-[#6038]: https://github.com/nymtech/nym/pull/6038
-[#6037]: https://github.com/nymtech/nym/pull/6037
-[#6023]: https://github.com/nymtech/nym/pull/6023
-[#6021]: https://github.com/nymtech/nym/pull/6021
-[#6018]: https://github.com/nymtech/nym/pull/6018
-[#6015]: https://github.com/nymtech/nym/pull/6015
-[#6014]: https://github.com/nymtech/nym/pull/6014
-[#6007]: https://github.com/nymtech/nym/pull/6007
-[#6002]: https://github.com/nymtech/nym/pull/6002
-[#5999]: https://github.com/nymtech/nym/pull/5999
-[#5998]: https://github.com/nymtech/nym/pull/5998
-[#5997]: https://github.com/nymtech/nym/pull/5997
-[#5991]: https://github.com/nymtech/nym/pull/5991
-[#5988]: https://github.com/nymtech/nym/pull/5988
-[#5984]: https://github.com/nymtech/nym/pull/5984
-[#5983]: https://github.com/nymtech/nym/pull/5983
-[#5980]: https://github.com/nymtech/nym/pull/5980
-[#5975]: https://github.com/nymtech/nym/pull/5975
-[#5974]: https://github.com/nymtech/nym/pull/5974
-[#5964]: https://github.com/nymtech/nym/pull/5964
-[#5956]: https://github.com/nymtech/nym/pull/5956
-[#5954]: https://github.com/nymtech/nym/pull/5954
-[#5952]: https://github.com/nymtech/nym/pull/5952
-[#5950]: https://github.com/nymtech/nym/pull/5950
-[#5948]: https://github.com/nymtech/nym/pull/5948
-[#5945]: https://github.com/nymtech/nym/pull/5945
-[#5939]: https://github.com/nymtech/nym/pull/5939
-[#5933]: https://github.com/nymtech/nym/pull/5933
-[#5931]: https://github.com/nymtech/nym/pull/5931
-[#5930]: https://github.com/nymtech/nym/pull/5930
-[#5929]: https://github.com/nymtech/nym/pull/5929
-[#5928]: https://github.com/nymtech/nym/pull/5928
-[#5924]: https://github.com/nymtech/nym/pull/5924
-[#5916]: https://github.com/nymtech/nym/pull/5916
-[#5911]: https://github.com/nymtech/nym/pull/5911
-[#5869]: https://github.com/nymtech/nym/pull/5869
-
 ## [2025.16-halloumi] (2025-09-16)

 - Backport metadata endpoint ([#6010])
@@ -31,7 +31,6 @@ members = [
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
    "common/commands",
-    "common/nym-common",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
@@ -59,8 +58,7 @@ members = [
    "common/gateway-requests",
    "common/gateway-stats-storage",
    "common/gateway-storage",
-    "common/http-api-client",
-    "common/http-api-client-macro",
+    "common/http-api-client", "common/http-api-client-macro",
    "common/http-api-common",
    "common/inclusion-probability",
    "common/ip-packet-requests",
@@ -69,8 +67,6 @@ members = [
    "common/network-defaults",
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
-    "common/nym-cache",
-    "common/nym-connection-monitor",
    "common/nym-id",
    "common/nym-metrics",
    "common/nym_offline_compact_ecash",
@@ -89,7 +85,6 @@ members = [
    "common/nymsphinx/types",
    "common/nyxd-scraper",
    "common/pemstore",
-    "common/registration",
    "common/serde-helpers",
    "common/service-provider-requests-common",
    "common/socks5-client-core",
@@ -97,13 +92,11 @@ members = [
    "common/socks5/requests",
    "common/statistics",
    "common/store-cipher",
-    "common/task",
-    "common/test-utils",
+    "common/task", "common/test-utils",
    "common/ticketbooks-merkle",
    "common/topology",
    "common/tun",
-    "common/types",
-    "common/upgrade-mode-check",
+    "common/types", "common/upgrade-mode-check",
    "common/verloc",
    "common/wasm/client-core",
    "common/wasm/storage",
@@ -132,11 +125,10 @@ members = [
    "nym-node-status-api/nym-node-status-client",
    "nym-node/nym-node-metrics",
    "nym-node/nym-node-requests",
-    "nym-outfox",
-    "nym-registration-client",
-    "nym-signers-monitor",
+    "nym-outfox", "nym-signers-monitor",
    "nym-statistics-api",
    "nym-validator-rewarder",
+    "nym-wg-gateway-client",
    "nyx-chain-watcher",
    "sdk/ffi/cpp",
    "sdk/ffi/go",
@@ -153,6 +145,7 @@ members = [
    # "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/internal/validator-status-check",
    "tools/nym-cli",
@@ -165,7 +158,6 @@ members = [
    "wasm/mix-fetch",
    "wasm/node-tester",
    "wasm/zknym-lib",
-    "nym-gateway-probe"
 ]

 default-members = [
@@ -184,16 +176,16 @@ default-members = [
    "tools/nymvisor",
 ]

-exclude = ["contracts", "nym-wallet", "cpu-cycles"]
+exclude = ["explorer", "contracts", "nym-wallet", "cpu-cycles"]

 [workspace.package]
 authors = ["Nym Technologies SA"]
 repository = "https://github.com/nymtech/nym"
 homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
-edition = "2024"
+edition = "2021"
 license = "Apache-2.0"
-rust-version = "1.85"
+rust-version = "1.81"
 readme = "README.md"

 [workspace.dependencies]
@@ -300,13 +292,15 @@ nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
 once_cell = "1.21.3"
-opentelemetry = "0.19.0"
-opentelemetry-jaeger = "0.18.0"
+opentelemetry = "0.30.0"
+opentelemetry-otlp = "0.30.0"
+opentelemetry-semantic-conventions = "0.30.0"
+opentelemetry_sdk = "0.30.0"
+opentelemetry-stdout = "0.30.0"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.1"
-pnet_packet = "0.35.0"
 pin-project-lite = "0.2.16"
 publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
@@ -360,12 +354,13 @@ toml = "0.8.22"
 tower = "0.5.2"
 tower-http = "0.5.2"
 tracing = "0.1.41"
+tracing-core = "0.1.33"
 tracing-log = "0.2"
-tracing-opentelemetry = "0.19.0"
+tracing-opentelemetry = "0.31.0"
+tracing-serde = "0.2.0"
 tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
-tracing-test = "0.2.5"
 ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
 uniffi = "0.29.2"
@@ -376,7 +371,6 @@ utoipa-swagger-ui = "8.1"
 utoipauto = "0.2"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
-vergen-gitcl = { version = "1.0.8", default-features = false }
 walkdir = "2"
 x25519-dalek = "2.0.0"
 zeroize = "1.7.0"
@@ -416,19 +410,18 @@ prost = { version = "0.13", default-features = false }
 # wasm-related dependencies
 gloo-utils = "0.2.0"
 gloo-net = "0.6.0"
-gloo-timers = "0.3.0"

 indexed_db_futures = "0.6.4"
 js-sys = "0.3.76"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-tokio_with_wasm = { version = "0.8.7" }
 wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
 web-sys = "0.3.76"

+
 # for local development:
 #[patch.crates-io]
 #sphinx-packet = { path = "../sphinx" }
@@ -107,16 +107,16 @@ sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
-	# $(MAKE) -C wasm/mix-fetch
+	$(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
-	# $(MAKE) -C wasm/full-nym-wasm
+	#$(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	# npx lerna run --scope @nymproject/mix-fetch build --stream
-	# npx lerna run --scope @nymproject/node-tester build --stream
-	# yarn --cwd sdk/typescript/codegen/contract-clients build
+	npx lerna run --scope @nymproject/mix-fetch build --stream
+	npx lerna run --scope @nymproject/node-tester build --stream
+	yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
 WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
@@ -154,7 +154,6 @@ CONTRACTS_OUT_DIR = contracts/artifacts
 #
 COSMWASM_OPTIMIZER_IMAGE ?= cosmwasm/optimizer:0.17.0
 COSMWASM_OPTIMIZER_PLATFORM ?= linux/amd64
-COSMWASM_CHECK_IMAGE ?= rust:1.88

 # Ensure clean build environment and run the optimizer
 optimize-contracts:
@@ -180,13 +179,6 @@ optimize-contracts:
 	# Cleanup temporary artefacts directory
 	@rm -rf artifacts 2>/dev/null || true

-# Check artifacts with cosmwasm-check inside the optimizer image
-docker-check-contracts:
-	@docker run --rm --platform $(COSMWASM_OPTIMIZER_PLATFORM) \
-	  -v $(CURDIR):/code --workdir /code \
-	  --entrypoint /bin/sh \
-	  $(COSMWASM_CHECK_IMAGE) -lc 'apt-get update && apt-get install -y --no-install-recommends llvm-dev libclang-dev pkg-config && export PATH="/usr/local/cargo/bin:/usr/local/rustup/bin:$$PATH" && cargo install cosmwasm-check --locked && WASMER_ENGINE=universal WASMER_COMPILER=singlepass cosmwasm-check contracts/artifacts/*.wasm'
-
 wasm-opt-contracts:
 	@for WASM in $(WASM_CONTRACT_DIR)/*.wasm; do \
 	  echo "Running wasm-opt on $$WASM"; \
@@ -4,7 +4,7 @@ version = "1.1.63"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.70"
 license.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -46,7 +46,6 @@ nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = [
    "output_format",
    "clap",
-    "basic_tracing",
 ] }
 nym-client-core = { path = "../../common/client-core", features = [
    "fs-credentials-storage",
@@ -4,7 +4,7 @@
 use std::error::Error;

 use clap::{crate_name, crate_version, Parser};
-use nym_bin_common::logging::{maybe_print_banner, setup_tracing_logger};
+use nym_bin_common::logging::{maybe_print_banner, setup_no_otel_logger};
 use nym_network_defaults::setup_env;

 pub mod client;
@@ -20,7 +20,7 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    if !args.no_banner {
        maybe_print_banner(crate_name!(), crate_version!());
    }
-    setup_tracing_logger();
+    setup_no_otel_logger().expect("failed to initialize logging");

    if let Err(err) = commands::execute(args).await {
        log::error!("{err}");
@@ -184,7 +184,7 @@ impl Handler {
        });

        // the ack control is now responsible for chunking, etc.
-        let input_msg = InputMessage::new_regular(recipient, message, lane, self.packet_type);
+        let input_msg = InputMessage::new_regular(recipient, message, lane, self.packet_type, None);
        if let Err(err) = self.msg_input.send(input_msg).await {
            if !self.shutdown_token.is_cancelled() {
                error!("Failed to send message to the input buffer: {err}");
@@ -217,7 +217,7 @@ impl Handler {
        });

        let input_msg =
-            InputMessage::new_anonymous(recipient, message, reply_surbs, lane, self.packet_type);
+            InputMessage::new_anonymous(recipient, message, reply_surbs, lane, self.packet_type, None);
        if let Err(err) = self.msg_input.send(input_msg).await {
            if !self.shutdown_token.is_cancelled() {
                error!("Failed to send anonymous message to the input buffer: {err}");
@@ -4,7 +4,7 @@ version = "1.1.63"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.70"
 license.workspace = true

 [dependencies]
@@ -27,7 +27,6 @@ zeroize = { workspace = true }
 nym-bin-common = { path = "../../common/bin-common", features = [
    "output_format",
    "clap",
-    "basic_tracing",
 ] }
 nym-client-core = { path = "../../common/client-core", features = [
    "fs-credentials-storage",
@@ -4,7 +4,7 @@
 use std::error::Error;

 use clap::{crate_name, crate_version, Parser};
-use nym_bin_common::logging::{maybe_print_banner, setup_tracing_logger};
+use nym_bin_common::logging::{maybe_print_banner, setup_no_otel_logger};
 use nym_network_defaults::setup_env;

 mod commands;
@@ -19,7 +19,7 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    if !args.no_banner {
        maybe_print_banner(crate_name!(), crate_version!());
    }
-    setup_tracing_logger();
+    setup_no_otel_logger().expect("failed to initialize logging");

    if let Err(err) = commands::execute(args).await {
        log::error!("{err}");
@@ -1,8 +1,8 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use futures::StreamExt;
 use futures::channel::mpsc;
+use futures::StreamExt;
 use notify::event::{DataChange, MetadataKind, ModifyKind};
 use notify::{Config, Event, EventKind, RecommendedWatcher, RecursiveMode, Watcher};
 use std::collections::HashMap;
@@ -96,10 +96,10 @@ impl AsyncFileWatcher {
        // when testing I was consistently getting two `Modify(Data(Any))` events in quick succession
        // (probably to modify content and metadata).
        // we really only want to propagate one of them
-        if let Some(previous) = self.last_received.get(&event.kind)
-            && now.duration_since(*previous) < self.tick_duration
-        {
-            return false;
+        if let Some(previous) = self.last_received.get(&event.kind) {
+            if now.duration_since(*previous) < self.tick_duration {
+                return false;
+            }
        }

        let Some(filters) = &self.filters else {
@@ -13,8 +13,6 @@ base64 = { workspace = true }
 bincode = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
-semver = { workspace = true }
-strum_macros = { workspace = true }
 thiserror = { workspace = true }

 nym-credentials-interface = { path = "../credentials-interface" }
@@ -1,273 +0,0 @@
-// Copyright 2025 Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
-use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::PeerPublicKey;
-
-use crate::{
-    AuthenticatorVersion, Error,
-    latest::registration::IpPair,
-    traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, Versionable},
-    v2, v3, v4, v5,
-};
-
-// This is very redundant with AuthenticatorRequest and I reckon they could be smooshed.
-// It is a bit out of scope for me at the moment though
-#[derive(Debug)]
-pub enum ClientMessage {
-    Initial(Box<dyn InitMessage + Send + Sync + 'static>),
-    Final(Box<dyn FinalMessage + Send + Sync + 'static>),
-    Query(Box<dyn QueryBandwidthMessage + Send + Sync + 'static>),
-    TopUp(Box<dyn TopUpMessage + Send + Sync + 'static>),
-}
-
-impl ClientMessage {
-    // check if message is wasteful e.g. contains a credential
-    pub fn is_wasteful(&self) -> bool {
-        match self {
-            Self::Final(msg) => msg.credential().is_some(),
-            Self::TopUp(_) => true,
-            Self::Initial(_) | Self::Query(_) => false,
-        }
-    }
-
-    fn version(&self) -> AuthenticatorVersion {
-        match self {
-            ClientMessage::Initial(msg) => msg.version(),
-            ClientMessage::Final(msg) => msg.version(),
-            ClientMessage::Query(msg) => msg.version(),
-            ClientMessage::TopUp(msg) => msg.version(),
-        }
-    }
-
-    pub fn bytes(&self, reply_to: Recipient) -> Result<(Vec<u8>, u64), Error> {
-        match self.version() {
-            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
-            AuthenticatorVersion::V2 => {
-                use v2::{
-                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-                    request::AuthenticatorRequest,
-                };
-                match self {
-                    ClientMessage::Initial(init_message) => {
-                        let (req, id) = AuthenticatorRequest::new_initial_request(
-                            InitMessage {
-                                pub_key: init_message.pub_key(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Final(final_message) => {
-                        let (req, id) = AuthenticatorRequest::new_final_request(
-                            FinalMessage {
-                                gateway_client: GatewayClient {
-                                    pub_key: final_message.gateway_client_pub_key(),
-                                    private_ip: final_message
-                                        .gateway_client_ipv4()
-                                        .ok_or(Error::UnsupportedMessage)?
-                                        .into(),
-                                    mac: ClientMac::new(final_message.gateway_client_mac()),
-                                },
-                                credential: final_message.credential(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Query(query_message) => {
-                        let (req, id) = AuthenticatorRequest::new_query_request(
-                            query_message.pub_key(),
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    _ => Err(Error::UnsupportedMessage),
-                }
-            }
-            AuthenticatorVersion::V3 => {
-                use v3::{
-                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-                    request::AuthenticatorRequest,
-                    topup::TopUpMessage,
-                };
-                match self {
-                    ClientMessage::Initial(init_message) => {
-                        let (req, id) = AuthenticatorRequest::new_initial_request(
-                            InitMessage {
-                                pub_key: init_message.pub_key(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Final(final_message) => {
-                        let (req, id) = AuthenticatorRequest::new_final_request(
-                            FinalMessage {
-                                gateway_client: GatewayClient {
-                                    pub_key: final_message.gateway_client_pub_key(),
-                                    private_ip: final_message
-                                        .gateway_client_ipv4()
-                                        .ok_or(Error::UnsupportedMessage)?
-                                        .into(),
-                                    mac: ClientMac::new(final_message.gateway_client_mac()),
-                                },
-                                credential: final_message.credential(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Query(query_message) => {
-                        let (req, id) = AuthenticatorRequest::new_query_request(
-                            query_message.pub_key(),
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::TopUp(top_up_message) => {
-                        let (req, id) = AuthenticatorRequest::new_topup_request(
-                            TopUpMessage {
-                                pub_key: top_up_message.pub_key(),
-                                credential: top_up_message.credential(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                }
-            }
-            AuthenticatorVersion::V4 => {
-                use v4::{
-                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-                    request::AuthenticatorRequest,
-                    topup::TopUpMessage,
-                };
-                match self {
-                    ClientMessage::Initial(init_message) => {
-                        let (req, id) = AuthenticatorRequest::new_initial_request(
-                            InitMessage {
-                                pub_key: init_message.pub_key(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Final(final_message) => {
-                        let (req, id) = AuthenticatorRequest::new_final_request(
-                            FinalMessage {
-                                gateway_client: GatewayClient {
-                                    pub_key: final_message.gateway_client_pub_key(),
-                                    private_ips: IpPair {
-                                        ipv4: final_message
-                                            .gateway_client_ipv4()
-                                            .ok_or(Error::UnsupportedMessage)?,
-                                        ipv6: final_message
-                                            .gateway_client_ipv6()
-                                            .ok_or(Error::UnsupportedMessage)?,
-                                    }
-                                    .into(),
-                                    mac: ClientMac::new(final_message.gateway_client_mac()),
-                                },
-                                credential: final_message.credential(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Query(query_message) => {
-                        let (req, id) = AuthenticatorRequest::new_query_request(
-                            query_message.pub_key(),
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::TopUp(top_up_message) => {
-                        let (req, id) = AuthenticatorRequest::new_topup_request(
-                            TopUpMessage {
-                                pub_key: top_up_message.pub_key(),
-                                credential: top_up_message.credential(),
-                            },
-                            reply_to,
-                        );
-                        Ok((req.to_bytes()?, id))
-                    }
-                }
-            }
-            AuthenticatorVersion::V5 => {
-                use v5::{
-                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-                    request::AuthenticatorRequest,
-                    topup::TopUpMessage,
-                };
-                match self {
-                    ClientMessage::Initial(init_message) => {
-                        let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                            pub_key: init_message.pub_key(),
-                        });
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Final(final_message) => {
-                        let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                            gateway_client: GatewayClient {
-                                pub_key: final_message.gateway_client_pub_key(),
-                                private_ips: IpPair {
-                                    ipv4: final_message
-                                        .gateway_client_ipv4()
-                                        .ok_or(Error::UnsupportedMessage)?,
-                                    ipv6: final_message
-                                        .gateway_client_ipv6()
-                                        .ok_or(Error::UnsupportedMessage)?,
-                                },
-                                mac: ClientMac::new(final_message.gateway_client_mac()),
-                            },
-                            credential: final_message.credential(),
-                        });
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::Query(query_message) => {
-                        let (req, id) =
-                            AuthenticatorRequest::new_query_request(query_message.pub_key());
-                        Ok((req.to_bytes()?, id))
-                    }
-                    ClientMessage::TopUp(top_up_message) => {
-                        let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                            pub_key: top_up_message.pub_key(),
-                            credential: top_up_message.credential(),
-                        });
-                        Ok((req.to_bytes()?, id))
-                    }
-                }
-            }
-            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
-        }
-    }
-
-    pub fn use_surbs(&self) -> bool {
-        use AuthenticatorVersion::*;
-        match self.version() {
-            V1 | V2 | V3 | V4 => false,
-            V5 => true,
-            UNKNOWN => true,
-        }
-    }
-}
-
-// Same comment as above struct
-#[derive(Debug)]
-pub struct QueryMessageImpl {
-    pub pub_key: PeerPublicKey,
-    pub version: AuthenticatorVersion,
-}
-
-impl Versionable for QueryMessageImpl {
-    fn version(&self) -> AuthenticatorVersion {
-        self.version
-    }
-}
-
-impl QueryBandwidthMessage for QueryMessageImpl {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
@@ -23,17 +23,6 @@ pub enum Error {
    #[error("conversion: {0}")]
    Conversion(String),

-    // TODO add version number for debugging
-    #[error("unknown version number")]
-    UnknownVersion,
-
-    // TODO add version number for debugging
-    #[error("unsupported request version")]
-    UnsupportedVersion,
-
-    #[error("gateway doesn't support this type of message")]
-    UnsupportedMessage,
-
-    #[error(transparent)]
-    Bincode(#[from] bincode::Error),
+    #[error("failed to serialize response packet: {source}")]
+    FailedToSerializeResponsePacket { source: Box<bincode::ErrorKind> },
 }
@@ -1,9 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-pub mod client_message;
-pub mod request;
-pub mod response;
 pub mod traits;
 pub mod v1;
 pub mod v2;
@@ -13,13 +10,11 @@ pub mod v5;

 mod error;
 mod util;
-mod version;

 pub use error::Error;
 pub use v5 as latest;
-pub use version::AuthenticatorVersion;

-pub const CURRENT_VERSION: u8 = latest::VERSION;
+pub const CURRENT_VERSION: u8 = 5;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -1,204 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-use nym_sphinx::addressing::Recipient;
-
-use crate::traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage};
-use crate::{v1, v2, v3, v4, v5};
-
-#[derive(Debug)]
-pub enum AuthenticatorRequest {
-    Initial {
-        msg: Box<dyn InitMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    Final {
-        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    QueryBandwidth {
-        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    TopUpBandwidth {
-        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-}
-
-impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v1::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v1::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: Protocol {
-                    version: value.version,
-                    service_provider_type: ServiceProviderType::Authenticator,
-                },
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
-                msg: Box::new(gateway_client),
-                protocol: Protocol {
-                    version: value.version,
-                    service_provider_type: ServiceProviderType::Authenticator,
-                },
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: Protocol {
-                        version: value.version,
-                        service_provider_type: ServiceProviderType::Authenticator,
-                    },
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v2::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v3::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v4::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v5::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v5::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
@@ -1,106 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::traits::{
-    Id, PendingRegistrationResponse, RegisteredResponse, RemainingBandwidthResponse,
-    TopUpBandwidthResponse,
-};
-use crate::{v2, v3, v4, v5};
-
-#[derive(Debug)]
-pub enum AuthenticatorResponse {
-    PendingRegistration(Box<dyn PendingRegistrationResponse + Send + Sync + 'static>),
-    Registered(Box<dyn RegisteredResponse + Send + Sync + 'static>),
-    RemainingBandwidth(Box<dyn RemainingBandwidthResponse + Send + Sync + 'static>),
-    TopUpBandwidth(Box<dyn TopUpBandwidthResponse + Send + Sync + 'static>),
-}
-
-impl Id for AuthenticatorResponse {
-    fn id(&self) -> u64 {
-        match self {
-            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
-                pending_registration_response.id()
-            }
-            AuthenticatorResponse::Registered(registered_response) => registered_response.id(),
-            AuthenticatorResponse::RemainingBandwidth(remaining_bandwidth_response) => {
-                remaining_bandwidth_response.id()
-            }
-            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
-                top_up_bandwidth_response.id()
-            }
-        }
-    }
-}
-
-impl From<v2::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v2::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v2::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v2::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-        }
-    }
-}
-
-impl From<v3::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v3::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v3::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v3::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v3::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v3::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
-
-impl From<v4::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v4::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v4::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v4::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v4::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v4::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
-
-impl From<v5::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v5::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v5::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v5::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
@@ -1,105 +1,49 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use std::fmt;
-use std::net::{Ipv4Addr, Ipv6Addr};
-
 use nym_credentials_interface::CredentialSpendingData;
 use nym_crypto::asymmetric::x25519::PrivateKey;
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::clients::Recipient;
 use nym_wireguard_types::PeerPublicKey;

-use crate::latest::registration::IpPair;
-use crate::{AuthenticatorVersion, Error, v1, v2, v3, v4, v5};
+use crate::{
+    v1, v2, v3, v4,
+    v5::{self, registration::IpPair},
+    Error,
+};

-pub trait Versionable {
-    fn version(&self) -> AuthenticatorVersion;
+#[derive(Copy, Clone, Debug)]
+pub enum AuthenticatorVersion {
+    V1,
+    V2,
+    V3,
+    V4,
+    V5,
+    UNKNOWN,
 }

-impl Versionable for v1::GatewayClient {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V1
+impl From<Protocol> for AuthenticatorVersion {
+    fn from(value: Protocol) -> Self {
+        if value.service_provider_type != ServiceProviderType::Authenticator {
+            AuthenticatorVersion::UNKNOWN
+        } else if value.version == v1::VERSION {
+            AuthenticatorVersion::V1
+        } else if value.version == v2::VERSION {
+            AuthenticatorVersion::V2
+        } else if value.version == v3::VERSION {
+            AuthenticatorVersion::V3
+        } else if value.version == v4::VERSION {
+            AuthenticatorVersion::V4
+        } else if value.version == v5::VERSION {
+            AuthenticatorVersion::V5
+        } else {
+            AuthenticatorVersion::UNKNOWN
+        }
    }
 }

-impl Versionable for v1::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V1
-    }
-}
-
-impl Versionable for v2::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V2
-    }
-}
-
-impl Versionable for v3::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V3
-    }
-}
-
-impl Versionable for v4::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V4
-    }
-}
-
-impl Versionable for v5::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V5
-    }
-}
-
-impl Versionable for v2::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V2
-    }
-}
-
-impl Versionable for v3::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V3
-    }
-}
-
-impl Versionable for v4::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V4
-    }
-}
-
-impl Versionable for v5::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V5
-    }
-}
-
-impl Versionable for PeerPublicKey {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V3
-    }
-}
-
-impl Versionable for v3::topup::TopUpMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V3
-    }
-}
-
-impl Versionable for v4::topup::TopUpMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V4
-    }
-}
-
-impl Versionable for v5::topup::TopUpMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V5
-    }
-}
-
-pub trait InitMessage: Versionable + fmt::Debug {
+pub trait InitMessage {
    fn pub_key(&self) -> PeerPublicKey;
 }

@@ -133,18 +77,15 @@ impl InitMessage for v5::registration::InitMessage {
    }
 }

-pub trait FinalMessage: Versionable + fmt::Debug {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey;
+pub trait FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey;
    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
    fn private_ips(&self) -> IpPair;
-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr>;
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr>;
-    fn gateway_client_mac(&self) -> Vec<u8>;
    fn credential(&self) -> Option<CredentialSpendingData>;
 }

 impl FinalMessage for v1::GatewayClient {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
        self.pub_key
    }

@@ -156,28 +97,13 @@ impl FinalMessage for v1::GatewayClient {
        self.private_ip.into()
    }

-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        match self.private_ip {
-            std::net::IpAddr::V4(ipv4_addr) => Some(ipv4_addr),
-            std::net::IpAddr::V6(_) => None,
-        }
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        None
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.mac.to_vec()
-    }
-
    fn credential(&self) -> Option<CredentialSpendingData> {
        None
    }
 }

 impl FinalMessage for v2::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
        self.gateway_client.pub_key
    }

@@ -189,28 +115,13 @@ impl FinalMessage for v2::registration::FinalMessage {
        self.gateway_client.private_ip.into()
    }

-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        match self.gateway_client.private_ip {
-            std::net::IpAddr::V4(ipv4_addr) => Some(ipv4_addr),
-            std::net::IpAddr::V6(_) => None,
-        }
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        None
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
    fn credential(&self) -> Option<CredentialSpendingData> {
        self.credential.clone()
    }
 }

 impl FinalMessage for v3::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
        self.gateway_client.pub_key
    }

@@ -222,28 +133,13 @@ impl FinalMessage for v3::registration::FinalMessage {
        self.gateway_client.private_ip.into()
    }

-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        match self.gateway_client.private_ip {
-            std::net::IpAddr::V4(ipv4_addr) => Some(ipv4_addr),
-            std::net::IpAddr::V6(_) => None,
-        }
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        None
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
    fn credential(&self) -> Option<CredentialSpendingData> {
        self.credential.clone()
    }
 }

 impl FinalMessage for v4::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
        self.gateway_client.pub_key
    }

@@ -255,25 +151,13 @@ impl FinalMessage for v4::registration::FinalMessage {
        self.gateway_client.private_ips.into()
    }

-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        Some(self.gateway_client.private_ips.ipv4)
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        Some(self.gateway_client.private_ips.ipv6)
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
    fn credential(&self) -> Option<CredentialSpendingData> {
        self.credential.clone()
    }
 }

 impl FinalMessage for v5::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
        self.gateway_client.pub_key
    }

@@ -285,24 +169,12 @@ impl FinalMessage for v5::registration::FinalMessage {
        self.gateway_client.private_ips
    }

-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        Some(self.gateway_client.private_ips.ipv4)
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        Some(self.gateway_client.private_ips.ipv6)
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
    fn credential(&self) -> Option<CredentialSpendingData> {
        self.credential.clone()
    }
 }

-pub trait QueryBandwidthMessage: Versionable + fmt::Debug {
+pub trait QueryBandwidthMessage {
    fn pub_key(&self) -> PeerPublicKey;
 }

@@ -312,7 +184,7 @@ impl QueryBandwidthMessage for PeerPublicKey {
    }
 }

-pub trait TopUpMessage: Versionable + fmt::Debug {
+pub trait TopUpMessage {
    fn pub_key(&self) -> PeerPublicKey;
    fn credential(&self) -> CredentialSpendingData;
 }
@@ -347,286 +219,197 @@ impl TopUpMessage for v5::topup::TopUpMessage {
    }
 }

-pub trait Id {
-    fn id(&self) -> u64;
+pub enum AuthenticatorRequest {
+    Initial {
+        msg: Box<dyn InitMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Option<Recipient>,
+        request_id: u64,
+    },
+    Final {
+        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Option<Recipient>,
+        request_id: u64,
+    },
+    QueryBandwidth {
+        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Option<Recipient>,
+        request_id: u64,
+    },
+    TopUpBandwidth {
+        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Option<Recipient>,
+        request_id: u64,
+    },
 }

-impl Id for v2::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
+impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v1::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v1::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
+                msg: Box::new(gateway_client),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: Protocol {
+                        version: value.version,
+                        service_provider_type: ServiceProviderType::Authenticator,
+                    },
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+        }
    }
 }

-impl Id for v3::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
+impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v2::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+        }
    }
 }

-impl Id for v4::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
+impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v3::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+        }
    }
 }

-impl Id for v5::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
+impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v4::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: Some(value.reply_to),
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: Some(value.reply_to),
+                    request_id: value.request_id,
+                }
+            }
+        }
    }
 }

-impl Id for v2::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v3::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v4::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v5::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v2::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v3::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v4::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v5::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v3::response::TopUpBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v4::response::TopUpBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v5::response::TopUpBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-pub trait PendingRegistrationResponse: Id + fmt::Debug {
-    fn nonce(&self) -> u64;
-    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error>;
-    fn pub_key(&self) -> PeerPublicKey;
-    fn private_ips(&self) -> IpPair;
-}
-
-impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        self.reply.gateway_data.private_ip.into()
-    }
-}
-
-impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        self.reply.gateway_data.private_ip.into()
-    }
-}
-
-impl PendingRegistrationResponse for v4::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        self.reply.gateway_data.private_ips.into()
-    }
-}
-
-impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        self.reply.gateway_data.private_ips
-    }
-}
-
-pub trait RegisteredResponse: Id + fmt::Debug {
-    fn private_ips(&self) -> IpPair;
-    fn pub_key(&self) -> PeerPublicKey;
-    fn wg_port(&self) -> u16;
-}
-
-impl RegisteredResponse for v2::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ip.into()
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-
-impl RegisteredResponse for v3::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ip.into()
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-impl RegisteredResponse for v4::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ips.into()
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-
-impl RegisteredResponse for v5::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ips
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-
-pub trait RemainingBandwidthResponse: Id + fmt::Debug {
-    fn available_bandwidth(&self) -> Option<i64>;
-}
-
-impl RemainingBandwidthResponse for v2::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-impl RemainingBandwidthResponse for v3::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-impl RemainingBandwidthResponse for v4::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-impl RemainingBandwidthResponse for v5::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-pub trait TopUpBandwidthResponse: Id + fmt::Debug {
-    fn available_bandwidth(&self) -> i64;
-}
-
-impl TopUpBandwidthResponse for v3::response::TopUpBandwidthResponse {
-    fn available_bandwidth(&self) -> i64 {
-        self.reply.available_bandwidth
-    }
-}
-
-impl TopUpBandwidthResponse for v4::response::TopUpBandwidthResponse {
-    fn available_bandwidth(&self) -> i64 {
-        self.reply.available_bandwidth
-    }
-}
-
-impl TopUpBandwidthResponse for v5::response::TopUpBandwidthResponse {
-    fn available_bandwidth(&self) -> i64 {
-        self.reply.available_bandwidth
+impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v5::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v5::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: None,
+                request_id: value.request_id,
+            },
+            v5::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: None,
+                request_id: value.request_id,
+            },
+            v5::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: None,
+                    request_id: value.request_id,
+                }
+            }
+            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: None,
+                    request_id: value.request_id,
+                }
+            }
+        }
    }
 }
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
@@ -1,195 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::{v1, v2, v3, v4, v5};
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-
-#[derive(Copy, Clone, Debug, PartialEq, strum_macros::Display)]
-#[strum(serialize_all = "snake_case")]
-pub enum AuthenticatorVersion {
-    /// introduced in wispa release (1.1.5)
-    V1,
-
-    /// introduced in aero release (1.1.9)
-    V2,
-
-    /// introduced in magura release (1.1.10)
-    V3,
-
-    /// introduced in crunch release (1.2.0)
-    V4,
-
-    /// introduced in dorina-patched release (1.6.1)
-    V5,
-
-    UNKNOWN,
-}
-
-impl AuthenticatorVersion {
-    pub const LATEST: Self = Self::V5;
-
-    pub const fn release_version(&self) -> semver::Version {
-        match self {
-            AuthenticatorVersion::V1 => semver::Version::new(1, 1, 5),
-            AuthenticatorVersion::V2 => semver::Version::new(1, 1, 9),
-            AuthenticatorVersion::V3 => semver::Version::new(1, 1, 10),
-            AuthenticatorVersion::V4 => semver::Version::new(1, 2, 0),
-            AuthenticatorVersion::V5 => semver::Version::new(1, 6, 1),
-            AuthenticatorVersion::UNKNOWN => semver::Version::new(0, 0, 0),
-        }
-    }
-}
-
-impl From<Protocol> for AuthenticatorVersion {
-    fn from(value: Protocol) -> Self {
-        if value.service_provider_type != ServiceProviderType::Authenticator {
-            AuthenticatorVersion::UNKNOWN
-        } else if value.version == v1::VERSION {
-            AuthenticatorVersion::V1
-        } else if value.version == v2::VERSION {
-            AuthenticatorVersion::V2
-        } else if value.version == v3::VERSION {
-            AuthenticatorVersion::V3
-        } else if value.version == v4::VERSION {
-            AuthenticatorVersion::V4
-        } else if value.version == v5::VERSION {
-            AuthenticatorVersion::V5
-        } else {
-            AuthenticatorVersion::UNKNOWN
-        }
-    }
-}
-
-impl From<u8> for AuthenticatorVersion {
-    fn from(value: u8) -> Self {
-        if value == v1::VERSION {
-            AuthenticatorVersion::V1
-        } else if value == v2::VERSION {
-            AuthenticatorVersion::V2
-        } else if value == v3::VERSION {
-            AuthenticatorVersion::V3
-        } else if value == v4::VERSION {
-            AuthenticatorVersion::V4
-        } else if value == v5::VERSION {
-            AuthenticatorVersion::V5
-        } else {
-            AuthenticatorVersion::UNKNOWN
-        }
-    }
-}
-
-impl From<&str> for AuthenticatorVersion {
-    fn from(value: &str) -> Self {
-        let Ok(semver) = semver::Version::parse(value) else {
-            return Self::UNKNOWN;
-        };
-
-        semver.into()
-    }
-}
-
-impl From<Option<&String>> for AuthenticatorVersion {
-    fn from(value: Option<&String>) -> Self {
-        match value {
-            None => Self::UNKNOWN,
-            Some(value) => value.as_str().into(),
-        }
-    }
-}
-
-impl From<String> for AuthenticatorVersion {
-    fn from(value: String) -> Self {
-        Self::from(value.as_str())
-    }
-}
-
-impl From<Option<String>> for AuthenticatorVersion {
-    fn from(value: Option<String>) -> Self {
-        value.as_ref().into()
-    }
-}
-
-impl From<semver::Version> for AuthenticatorVersion {
-    fn from(semver: semver::Version) -> Self {
-        if semver < AuthenticatorVersion::V1.release_version() {
-            return Self::UNKNOWN;
-        }
-        if semver < AuthenticatorVersion::V2.release_version() {
-            return Self::V1;
-        }
-        if semver < AuthenticatorVersion::V3.release_version() {
-            return Self::V2;
-        }
-        if semver < AuthenticatorVersion::V4.release_version() {
-            return Self::V3;
-        }
-        if semver < AuthenticatorVersion::V5.release_version() {
-            return Self::V4;
-        }
-        // if provided version is higher (or equal) to release version of V5,
-        // we return the latest (i.e. v5)
-
-        debug_assert_eq!(
-            Self::V5,
-            Self::LATEST,
-            "a new AuthenticatorVersion variant has been introduced without adjusting the `From<semver::Version>` trait"
-        );
-        Self::LATEST
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::latest;
-    use super::*;
-
-    #[test]
-    fn strum_display() {
-        // sanity check on formatting and casing
-        assert_eq!("v1", AuthenticatorVersion::V1.to_string());
-        assert_eq!("v2", AuthenticatorVersion::V2.to_string());
-        assert_eq!("unknown", AuthenticatorVersion::UNKNOWN.to_string());
-    }
-
-    #[test]
-    fn u8_conversion() {
-        assert_eq!(AuthenticatorVersion::V1, AuthenticatorVersion::from(1u8));
-        assert_eq!(AuthenticatorVersion::V2, AuthenticatorVersion::from(2u8));
-
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(latest::VERSION + 1)
-        );
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(0u8)
-        );
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(255u8)
-        );
-    }
-
-    #[test]
-    fn semver_checks() {
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "1.1.4".into());
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "0.1.0".into());
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "1.0.4".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.5".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.6".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.8".into());
-        assert_eq!(AuthenticatorVersion::V2, "1.1.9".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.10".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.11".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.60".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.2.0".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.2.1".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.5.1".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.6.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.6.1".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.6.11".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.7.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.16.11".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.17.0".into());
-    }
-}
@@ -7,7 +7,6 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
-async-trait = { workspace =  true }
 bip39 = { workspace = true }
 log = { workspace = true }
 rand = { workspace = true }
@@ -23,12 +23,10 @@ use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;

 pub use event::BandwidthStatusMessage;
-pub use traits::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND};

 pub mod acquire;
 pub mod error;
 mod event;
-mod traits;
 mod utils;

 #[derive(Debug)]
@@ -1,42 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use async_trait::async_trait;
-use nym_credential_storage::storage::Storage;
-use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::ed25519;
-use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
-
-use crate::{error::BandwidthControllerError, BandwidthController, PreparedCredential};
-
-pub const DEFAULT_TICKETS_TO_SPEND: u32 = 1;
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait BandwidthTicketProvider: Send + Sync {
-    async fn get_ecash_ticket(
-        &self,
-        ticket_type: TicketType,
-        gateway_id: ed25519::PublicKey,
-        tickets_to_spend: u32,
-    ) -> Result<PreparedCredential, BandwidthControllerError>;
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl<C, St> BandwidthTicketProvider for BandwidthController<C, St>
-where
-    C: DkgQueryClient + Sync + Send,
-    St: nym_credential_storage::storage::Storage,
-    <St as Storage>::StorageError: Send + Sync + 'static,
-{
-    async fn get_ecash_ticket(
-        &self,
-        ticket_type: TicketType,
-        gateway_id: ed25519::PublicKey,
-        tickets_to_spend: u32,
-    ) -> Result<PreparedCredential, BandwidthControllerError> {
-        self.prepare_ecash_ticket(ticket_type, gateway_id.to_bytes(), tickets_to_spend)
-            .await
-    }
-}
@@ -8,24 +8,30 @@ license = { workspace = true }
 repository = { workspace = true }

 [dependencies]
+chrono = { workspace = true, optional = true }
+cfg-if = { workspace = true }
 clap = { workspace = true, features = ["derive"], optional = true }
 clap_complete = { workspace = true, optional = true }
 clap_complete_fig = { workspace = true, optional = true }
 const-str = { workspace = true }
-log = { workspace = true }
+opentelemetry = { workspace = true, optional = true }
+opentelemetry-otlp = { workspace = true,features=["metrics", "grpc-tonic", "tls",
+    "tls-webpki-roots"], optional = true }
+opentelemetry-semantic-conventions = { workspace = true, features = ["semconv_experimental"], optional = true }
+opentelemetry-stdout = { workspace = true, features = ["trace", "metrics"], optional = true }
+opentelemetry_sdk = { workspace = true, optional = true }
+rand = { workspace = true, optional = true }
 schemars = { workspace = true, features = ["preserve_order"], optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }
-
-## tracing
-tracing-subscriber = { workspace = true, features = ["env-filter"], optional = true }
-tracing-tree = { workspace = true, optional = true }
-tracing = { workspace = true, optional = true }
-opentelemetry-jaeger = { workspace = true, features = ["rt-tokio", "collector_client", "isahc_collector_client"], optional = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+tracing-core = { workspace = true }
 tracing-opentelemetry = { workspace = true, optional = true }
+tracing-serde = { workspace = true }
+tracing-subscriber = { workspace = true, features = ["env-filter", "json"] }
+tracing-tree = { workspace = true }
 utoipa = { workspace = true, optional = true }
-opentelemetry = { workspace = true, features = ["rt-tokio"], optional = true }
-

 [build-dependencies]
 vergen = { workspace = true, features = ["build", "git", "gitcl", "rustc", "cargo"] }
@@ -35,13 +41,17 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json", "dep:clap"]
 bin_info_schema = ["schemars"]
-basic_tracing = ["dep:tracing", "tracing-subscriber"]
-tracing = [
-    "basic_tracing",
-    "tracing-tree",
-    "opentelemetry-jaeger",
+tokio-console = ["otel"]
+otel = [
+    "chrono",
    "tracing-opentelemetry",
    "opentelemetry",
+    "opentelemetry-otlp",
+    "opentelemetry-semantic-conventions",
+    "opentelemetry-stdout",
+    "opentelemetry_sdk",
+    "serde_json",
+    "rand",
 ]
 clap = ["dep:clap", "dep:clap_complete", "dep:clap_complete_fig"]
 models = []
@@ -1,8 +1,8 @@
-use clap::Args;
 use clap::builder::Command;
 use clap::clap_derive::ValueEnum;
-use clap_complete::Shell as ClapShell;
+use clap::Args;
 use clap_complete::generator::generate;
+use clap_complete::Shell as ClapShell;
 use std::io;

 pub fn fig_generate(command: &mut Command, name: &str) {
@@ -4,6 +4,9 @@
 pub mod build_information;
 pub mod logging;

+#[cfg(feature = "otel")]
+pub mod opentelemetry;
+
 #[cfg(feature = "clap")]
 pub mod completions;

@@ -0,0 +1,20 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+#[cfg(feature = "otel")]
+use opentelemetry_otlp::ExporterBuildError;
+
+#[derive(thiserror::Error, Debug)]
+pub enum TracingError {
+    #[error("tracing logger already initialised")]
+    TracingLoggerAlreadyInitialised,
+
+    #[error("Logging error: {0}")]
+    TracingTryInitError(tracing_subscriber::util::TryInitError),
+
+    #[cfg(feature = "otel")]
+    #[error("{0}")]
+    TracingExporterBuildError(#[from] ExporterBuildError),
+
+    #[error("{0}")]
+    TracingFilterParseError(#[from] tracing_subscriber::filter::ParseError),
+}
@@ -1,19 +1,12 @@
 // Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+pub mod error;
+
+use error::TracingError;
 use serde::{Deserialize, Serialize};
 use std::io::IsTerminal;
-
-#[cfg(feature = "tracing")]
-pub use opentelemetry;
-#[cfg(feature = "tracing")]
-pub use opentelemetry_jaeger;
-#[cfg(feature = "tracing")]
-pub use tracing_opentelemetry;
-#[cfg(feature = "tracing")]
-pub use tracing_subscriber;
-#[cfg(feature = "tracing")]
-pub use tracing_tree;
+use tracing_subscriber::{filter::Directive, layer::SubscriberExt, util::SubscriberInitExt};

 #[derive(Debug, Default, Copy, Clone, Deserialize, PartialEq, Eq, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -22,7 +15,6 @@ pub struct LoggingSettings {
 }

 // don't call init so that we could attach additional layers
-#[cfg(feature = "basic_tracing")]
 pub fn build_tracing_logger() -> impl tracing_subscriber::layer::SubscriberExt {
    use tracing_subscriber::prelude::*;

@@ -31,7 +23,6 @@ pub fn build_tracing_logger() -> impl tracing_subscriber::layer::SubscriberExt {
        .with(default_tracing_env_filter())
 }

-#[cfg(feature = "basic_tracing")]
 pub fn default_tracing_env_filter() -> tracing_subscriber::filter::EnvFilter {
    if ::std::env::var("RUST_LOG").is_ok() {
        tracing_subscriber::filter::EnvFilter::from_default_env()
@@ -43,7 +34,6 @@ pub fn default_tracing_env_filter() -> tracing_subscriber::filter::EnvFilter {
    }
 }

-#[cfg(feature = "basic_tracing")]
 pub fn default_tracing_fmt_layer<S, W>(
    writer: W,
 ) -> impl tracing_subscriber::Layer<S> + Sync + Send + 'static
@@ -63,45 +53,47 @@ where
        .with_target(false)
 }

-#[cfg(feature = "basic_tracing")]
-pub fn setup_tracing_logger() {
-    use tracing_subscriber::util::SubscriberInitExt;
-    build_tracing_logger().init()
+/// Creates a tracing filter that sets more granular log levels for specific crates.
+/// This allows for finer control over logging verbosity.
+pub(crate) fn granual_filtered_env() -> Result<tracing_subscriber::filter::EnvFilter, TracingError>
+{
+    fn directive_checked(directive: impl Into<String>) -> Result<Directive, TracingError> {
+        directive.into().parse().map_err(From::from)
+    }
+
+    let mut filter = default_tracing_env_filter();
+
+    // these crates are more granularly filtered
+    let filter_crates = ["defguard_wireguard_rs"];
+    for crate_name in filter_crates {
+        filter = filter.add_directive(directive_checked(format!("{crate_name}=warn"))?);
+    }
+    Ok(filter)
+}
+
+pub fn setup_no_otel_logger() -> Result<(), TracingError> {
+    // Only set up if not already initialized
+    if tracing::dispatcher::has_been_set() {
+        // It shouldn't be - this is really checking that it is torn down between async command executions
+        return Err(TracingError::TracingLoggerAlreadyInitialised);
+    }
+
+    let registry = tracing_subscriber::registry()
+        .with(default_tracing_fmt_layer(std::io::stderr))
+        .with(granual_filtered_env()?);
+
+    registry
+        .try_init()
+        .map_err(|e| TracingError::TracingTryInitError(e))?;
+
+    Ok(())
 }

 // TODO: This has to be a macro, running it as a function does not work for the file_appender for some reason
-#[cfg(feature = "tracing")]
 #[macro_export]
 macro_rules! setup_tracing {
    ($service_name: expr) => {
-        use nym_bin_common::logging::tracing_subscriber::layer::SubscriberExt;
-        use nym_bin_common::logging::tracing_subscriber::util::SubscriberInitExt;
-
-        let registry = nym_bin_common::logging::tracing_subscriber::Registry::default()
-            .with(nym_bin_common::logging::tracing_subscriber::EnvFilter::from_default_env())
-            .with(
-                nym_bin_common::logging::tracing_tree::HierarchicalLayer::new(4)
-                    .with_targets(true)
-                    .with_bracketed_fields(true),
-            );
-
-        let tracer = nym_bin_common::logging::opentelemetry_jaeger::new_collector_pipeline()
-            .with_endpoint("http://44.199.230.10:14268/api/traces")
-            .with_service_name($service_name)
-            .with_isahc()
-            .with_trace_config(
-                nym_bin_common::logging::opentelemetry::sdk::trace::config().with_sampler(
-                    nym_bin_common::logging::opentelemetry::sdk::trace::Sampler::TraceIdRatioBased(
-                        0.1,
-                    ),
-                ),
-            )
-            .install_batch(nym_bin_common::logging::opentelemetry::runtime::Tokio)
-            .expect("Could not init tracer");
-
-        let telemetry = nym_bin_common::logging::tracing_opentelemetry::layer().with_tracer(tracer);
-
-        registry.with(telemetry).init();
+        setup_no_otel_logger()
    };
 }

@@ -0,0 +1,47 @@
+use opentelemetry_sdk::trace::IdGenerator;
+use opentelemetry::trace::{TraceId, SpanId};
+use rand::RngCore;
+
+#[derive(Clone, Debug)]
+pub struct Compact13BytesIdGenerator;
+
+impl IdGenerator for Compact13BytesIdGenerator {
+    fn new_trace_id(&self) -> TraceId {
+        let mut rng = rand::thread_rng();
+        let mut bytes = [0u8; 16];
+
+        // Fill the first 13 bytes with random data
+        rng.fill_bytes(&mut bytes[0..12]);
+        // Set the last 4 bytes to zero
+        bytes[12] = 0;
+        bytes[13] = 0;
+        bytes[14] = 0;
+        bytes[15] = 0;
+
+        TraceId::from_bytes(bytes)
+    }
+
+    fn new_span_id(&self) -> SpanId {
+        let mut rng = rand::thread_rng();
+        let mut bytes = [0u8; 8];
+        rng.fill_bytes(&mut bytes);
+        
+        SpanId::from_bytes(bytes)
+    }
+}
+
+pub fn compress_trace_id(trace_id: &TraceId) -> [u8; 12] {
+    let bytes = trace_id.to_bytes();
+
+    let mut compressed = [0u8; 12];
+    compressed.copy_from_slice(&bytes[0..12]);
+
+    compressed
+}
+
+pub fn decompress_trace_id(compressed: &[u8; 12]) -> [u8; 16] {
+    let mut bytes = [0u8; 16];
+    bytes[0..12].copy_from_slice(compressed);
+    bytes[12..].copy_from_slice(&[0u8; 4]);
+    bytes
+}
@@ -0,0 +1,156 @@
+use opentelemetry::{Context, TraceFlags};
+use opentelemetry::propagation::{Injector, Extractor, TextMapPropagator};
+use opentelemetry::trace::{SpanContext, TraceContextExt, TraceId};
+use opentelemetry_sdk::{propagation::TraceContextPropagator, trace::IdGenerator};
+use tracing_opentelemetry::OpenTelemetrySpanExt;
+use std::collections::HashMap;
+use std::fmt::Display;
+use tracing::instrument;
+
+/// Make a Carrier for context propagation
+pub struct ContextCarrier {
+    data: HashMap<String, String>,
+}
+
+impl ContextCarrier {
+    pub fn new_empty() -> Self {
+        ContextCarrier {
+            data: HashMap::new(),
+        }
+    }
+
+    pub fn new_with_data(data: HashMap<String, String>) -> Self {
+        if data.is_empty() {
+            return ContextCarrier::new_empty();
+        }
+        
+        ContextCarrier { data }
+    }
+
+    pub fn new_with_current_context(context: Context) -> Self {
+        let mut carrier = ContextCarrier::new_empty();
+        let propagator = TraceContextPropagator::new();
+        propagator.inject_context(&context, &mut carrier);
+        carrier
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = (&String, &String)> {
+        self.data.iter()
+    }
+
+    pub fn from_map(data: HashMap<String, String>) -> Self {
+        ContextCarrier { data }
+    }
+
+    pub fn into_map(self) -> HashMap<String, String> {
+        self.data
+    }
+
+    pub fn extract_trace_id(&self) -> Option<TraceId> {
+        self.get("traceparent").and_then(|tp| {
+            let parts: Vec<&str> = tp.split('-').collect();
+            if parts.len() == 4 {
+                TraceId::from_hex(parts[1]).ok()
+            } else {
+                None
+            }
+        })
+    }
+
+    pub fn extract_trace_id_into_bytes(&self) -> Option<[u8; 16]> {
+        self.extract_trace_id().map(|id| id.to_bytes())
+    }
+
+    pub fn extract_traceparent(&self) -> Option<String> {
+        self.get("traceparent").map(|s| s.to_string())
+    }
+}
+
+impl Injector for ContextCarrier {
+    fn set(&mut self, key: &str, value: String) {
+        self.data.insert(key.to_string(), value);
+    }
+}
+
+impl Extractor for ContextCarrier {
+    fn get(&self, key: &str) -> Option<&str> {
+        self.data.get(key).map(|s| s.as_str())
+    }
+
+    fn keys(&self) -> Vec<&str> {
+        self.data.keys().map(|k| k.as_str()).collect()
+    }
+}
+
+impl Display for ContextCarrier {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self.data)
+    }
+}
+
+pub struct ManualContextPropagator {
+    pub root_span: tracing::Span,
+    pub trace_id: TraceId,
+}
+
+impl ManualContextPropagator {
+    #[instrument(skip_all, level = "debug")]
+    pub fn new(name: &str, context: HashMap<String, String>) -> Self {
+        let carrier = ContextCarrier::new_with_data(context);
+        let trace_id = match carrier.extract_trace_id() {
+            Some(id) => id,
+            None => Context::current().span().span_context().trace_id(),
+        };
+
+        let root_span_builder = new_span_context_with_id(trace_id.clone());
+
+        let root_span = tracing::info_span!("trace_root", name = %name, trace_id = %trace_id);
+        root_span.set_parent(root_span_builder);
+
+        ManualContextPropagator {
+            root_span,
+            trace_id,
+        }
+    }
+
+    #[instrument(skip_all, level = "debug")]
+    pub fn new_from_tid(name: &str, trace_id: TraceId) -> Self {
+        let root_span_builder = new_span_context_with_id(trace_id.clone());
+
+        let root_span = tracing::info_span!("trace_root", name = %name, trace_id = %trace_id);
+        root_span.set_parent(root_span_builder);
+
+        ManualContextPropagator {
+            root_span,
+            trace_id,
+        }
+    }
+
+    pub fn root_span(&self) -> &tracing::Span {
+        &self.root_span
+    }
+
+}
+
+#[instrument(skip_all, level = "debug")]
+pub fn new_span_context_with_id(trace_id: TraceId) -> Context {
+    let id_gen = opentelemetry_sdk::trace::RandomIdGenerator::default();
+    let span_id = id_gen.new_span_id();
+    let span_context = SpanContext::new(
+        trace_id,
+        span_id,
+        TraceFlags::SAMPLED,
+        true,
+        Default::default(),
+    );
+
+    Context::current().with_remote_span_context(span_context)
+}
+
+#[instrument(skip_all, level = "debug")]
+pub fn extract_trace_id_from_tracing_cx() -> TraceId {
+    let cx = tracing::Span::current().context();
+    let binding = cx.span();
+    let trace_id = binding.span_context().trace_id();
+    trace_id
+}
@@ -0,0 +1,308 @@
+pub mod context;
+pub mod compact_id_generator;
+mod trace_id_format;
+
+use tracing::{info, Level};
+use tracing_subscriber::filter::Directive;
+use tracing_subscriber::layer::SubscriberExt;
+use tracing_subscriber::util::SubscriberInitExt;
+use tracing_subscriber::fmt;
+
+use crate::logging::default_tracing_env_filter;
+use crate::logging::error::TracingError;
+use crate::opentelemetry::compact_id_generator::Compact13BytesIdGenerator;
+use opentelemetry::trace::TracerProvider;
+use opentelemetry::{global, KeyValue};
+use opentelemetry_otlp::tonic_types::metadata::MetadataMap;
+use opentelemetry_otlp::tonic_types::transport::ClientTlsConfig;
+use opentelemetry_otlp::{WithExportConfig, WithTonicConfig};
+use opentelemetry_sdk::metrics::{MeterProviderBuilder, PeriodicReader, SdkMeterProvider};
+use opentelemetry_sdk::trace::SdkTracerProvider;
+use opentelemetry_sdk::{trace::Sampler, Resource};
+use opentelemetry_semantic_conventions::resource::{DEPLOYMENT_ENVIRONMENT_NAME, SERVICE_VERSION};
+use opentelemetry_semantic_conventions::SCHEMA_URL;
+use tracing_opentelemetry::{MetricsLayer, OpenTelemetryLayer};
+use tracing_subscriber::fmt::format::FmtSpan;
+
+pub struct TracerProviderGuard(Option<SdkTracerProvider>);
+
+impl Drop for TracerProviderGuard {
+    fn drop(&mut self) {
+        if let Some(tracer_provider) = self.0.take() {
+            // Ensure all spans are flushed before exit
+            if let Err(e) = tracer_provider.shutdown() {
+                eprintln!("Error shutting down tracer provider: {:?}", e);
+            }
+        }
+    }
+}
+
+pub(crate) fn granual_filtered_env() -> Result<tracing_subscriber::filter::EnvFilter, TracingError>
+{
+    fn directive_checked(directive: impl Into<String>) -> Result<Directive, TracingError> {
+        directive.into().parse().map_err(From::from)
+    }
+
+    let mut filter = default_tracing_env_filter();
+
+    // these crates are more granularly filtered
+    let filter_crates = ["defguard_wireguard_rs"];
+    for crate_name in filter_crates {
+        filter = filter.add_directive(directive_checked(format!("{crate_name}=warn"))?);
+    }
+    Ok(filter)
+}
+
+pub fn setup_tracing_logger(service_name: String) -> Result<TracerProviderGuard, TracingError> {
+    if tracing::dispatcher::has_been_set() {
+        // It shouldn't be - this is really checking that it is torn down between async command executions
+        return Err(TracingError::TracingLoggerAlreadyInitialised);
+    }
+
+    // define ingestion points
+    let endpoint = std::env::var("SIGNOZ_ENDPOINT").expect("SIGNOZ_ENDPOINT not set");
+    let key = std::env::var("SIGNOZ_INGESTION_KEY").expect("SIGNOZ_INGESTION_KEY not set");
+    let mut metadata = MetadataMap::new();
+    metadata.insert(
+        "signoz-ingestion-key",
+        key.parse().expect("Could not parse signoz ingestion key"),
+    );
+
+    // Build resources
+    let resource = build_resource(&service_name);
+
+    // Initialize tracer and meter providers
+    let tracer_provider = init_tracer_provider(&endpoint, metadata.clone(), resource.clone())?;
+    let meter_provider = init_meter_provider(&endpoint, metadata.clone(), resource.clone())?;
+
+    // Bridge tracing and opentelemetry
+    let tracer = tracer_provider.tracer("otel-subscriber");
+    let fmt_layer = fmt::layer()
+        .json()
+        .with_writer(std::io::stderr)
+        .with_span_events(FmtSpan::NEW | FmtSpan::CLOSE)
+        .with_span_list(false)
+        .with_current_span(true)
+        .event_format(trace_id_format::TraceIdFormat);
+
+    let registry = tracing_subscriber::registry()
+        .with(fmt_layer)
+        .with(granual_filtered_env()?)
+        .with(tracing_subscriber::filter::LevelFilter::from_level(Level::INFO))
+        .with(MetricsLayer::new(meter_provider.clone()))
+        .with(OpenTelemetryLayer::new(tracer));
+
+    registry.try_init().map_err(TracingError::TracingTryInitError)?;
+
+    global::set_tracer_provider(tracer_provider.clone());
+    global::set_meter_provider(meter_provider.clone());
+
+    info!("Tracing initialized with service name: {}", service_name);
+
+    Ok(TracerProviderGuard(Some(tracer_provider)))
+}
+
+fn build_resource(service_name: &str) -> Resource {
+    Resource::builder()
+        .with_service_name(service_name.to_string())
+        .with_schema_url(
+            [
+                KeyValue::new(SERVICE_VERSION, env!("CARGO_PKG_VERSION")),
+                KeyValue::new(DEPLOYMENT_ENVIRONMENT_NAME, "develop"),
+            ],
+            SCHEMA_URL,
+        )
+        .build()
+}
+
+fn init_tracer_provider(
+    endpoint: &str,
+    metadata: MetadataMap,
+    resource: Resource,
+) -> Result<SdkTracerProvider, TracingError> {
+    let mut exporter_builder = opentelemetry_otlp::SpanExporter::builder()
+        .with_tonic()
+        .with_metadata(metadata)
+        .with_endpoint(endpoint);
+
+    if endpoint.starts_with("https://") {
+        exporter_builder =
+            exporter_builder.with_tls_config(ClientTlsConfig::new().with_enabled_roots());
+    }
+
+    let exporter = exporter_builder.build()?;
+
+    let tracer = SdkTracerProvider::builder()
+        .with_sampler(Sampler::ParentBased(Box::new(Sampler::TraceIdRatioBased(
+            1.0,
+        ))))
+        .with_id_generator(Compact13BytesIdGenerator)
+        .with_resource(resource)
+        .with_batch_exporter(exporter)
+        .build();
+
+    global::set_tracer_provider(tracer.clone());
+    Ok(tracer)
+}
+
+fn init_meter_provider(
+    endpoint: &str,
+    metadata: MetadataMap,
+    resource: Resource,
+) -> Result<SdkMeterProvider, TracingError> {
+    let mut exporter_builder = opentelemetry_otlp::MetricExporter::builder()
+        .with_tonic()
+        .with_metadata(metadata)
+        .with_endpoint(endpoint)
+        .with_temporality(opentelemetry_sdk::metrics::Temporality::default());
+
+    if endpoint.starts_with("https://") {
+        exporter_builder = exporter_builder.with_tls_config(ClientTlsConfig::new().with_enabled_roots());
+    }
+
+    let exporter = exporter_builder.build()?;
+
+    let reader = PeriodicReader::builder(exporter)
+        .with_interval(std::time::Duration::from_secs(30))
+        .build();
+
+    let stdout_reader =
+        PeriodicReader::builder(opentelemetry_stdout::MetricExporter::default()).build();
+
+    let meter_provider = MeterProviderBuilder::default()
+        .with_resource(resource)
+        .with_reader(reader)
+        .with_reader(stdout_reader)
+        .build();
+
+    global::set_meter_provider(meter_provider.clone());
+
+    Ok(meter_provider)
+}
+
+// pub fn setup_tracing_logger(service_name: String) -> Result<(), TracingError> {
+//     if tracing::dispatcher::has_been_set() {
+//         // It shouldn't be - this is really checking that it is torn down between async command executions
+//         return Err(TracingError::TracingLoggerAlreadyInitialised);
+//     }
+
+//     let key =
+//         std::env::var("SIGNOZ_INGESTION_KEY".to_string()).expect("SIGNOZ_INGESTION_KEY not set");
+//     let mut metadata = MetadataMap::new();
+//     metadata.insert(
+//         "signoz-ingestion-key",
+//         key.parse().expect("Could not parse signoz ingestion key"),
+//     );
+
+//     let tracer_provider = init_tracer_provider(metadata.clone(), service_name.clone())?;
+//     let meter_provider = init_meter_provider(metadata.clone(), service_name.clone())?;
+//     let tracer = tracer_provider.tracer("tracing-otel-subscriber");
+//     let fmt_layer = fmt::layer()
+//         .json()
+//         .with_writer(std::io::stderr)
+//         .with_span_events(FmtSpan::NEW | FmtSpan::CLOSE)
+//         .with_span_list(false)
+//         .with_current_span(true)
+//         .event_format(trace_id_format::TraceIdFormat);
+
+//     cfg_if::cfg_if! {if #[cfg(feature = "tokio-console")] {
+//         // instrument tokio console subscriber needs RUSTFLAGS="--cfg tokio_unstable" at build time
+//         let console_layer = console_subscriber::spawn();
+
+//         tracing_subscriber::registry()
+//             .with(console_layer)
+//             .with(fmt_layer)
+//             .with(granual_filtered_env()?)
+//             .with(tracing_subscriber::filter::LevelFilter::from_level(Level::INFO))
+//             .with(MetricsLayer::new(meter_provider))
+//             .with(OpenTelemetryLayer::new(tracer))
+//             .try_init()
+//             .map_err(|e| TracingError::TracingTryInitError(e))?;
+//     } else {
+//         tracing_subscriber::registry()
+//             .with(fmt_layer)
+//             .with(granual_filtered_env()?)
+//             .with(tracing_subscriber::filter::LevelFilter::from_level(Level::INFO))
+//             .with(MetricsLayer::new(meter_provider))
+//             .with(OpenTelemetryLayer::new(tracer))
+//             .try_init()
+//             .map_err(|e| TracingError::TracingTryInitError(e))?;
+//     }}
+
+//     Ok(())
+// }
+
+// fn resource(service_name: String) -> Resource {
+//     Resource::builder()
+//         .with_service_name(service_name)
+//         .with_schema_url(
+//             [
+//                 KeyValue::new(SERVICE_VERSION, env!("CARGO_PKG_VERSION")),
+//                 KeyValue::new(DEPLOYMENT_ENVIRONMENT_NAME, "develop"),
+//             ],
+//             SCHEMA_URL,
+//         )
+//         .build()
+// }
+
+// fn init_tracer_provider(metadata: MetadataMap, service_name: String) -> Result<SdkTracerProvider, TracingError> {
+//     let endpoint = std::env::var("SIGNOZ_ENDPOINT".to_string()).expect("SIGNOZ_ENDPOINT not set");
+//     info!("SIGNOZ_ENDPOINT = {}", endpoint);
+
+//     let mut exporter_builder = opentelemetry_otlp::SpanExporter::builder()
+//         .with_tonic()
+//         .with_metadata(metadata)
+//         .with_endpoint(&endpoint);
+
+//     if endpoint.starts_with("https://") {
+//         exporter_builder =
+//             exporter_builder.with_tls_config(ClientTlsConfig::new().with_enabled_roots());
+//     }
+
+//     let exporter = exporter_builder.build()?;
+
+//     let tracer = SdkTracerProvider::builder()
+//         .with_sampler(Sampler::ParentBased(Box::new(Sampler::TraceIdRatioBased(
+//             1.0,
+//         ))))
+//         .with_id_generator(Compact13BytesIdGenerator)
+//         .with_resource(resource(service_name))
+//         .with_batch_exporter(exporter)
+//         .build();
+
+//     global::set_tracer_provider(tracer.clone());
+//     Ok(tracer)
+// }
+
+// fn init_meter_provider(metadata: MetadataMap, service_name: String) -> Result<SdkMeterProvider, TracingError> {
+//     let endpoint = std::env::var("SIGNOZ_ENDPOINT".to_string()).expect("SIGNOZ_ENDPOINT not set");
+
+//     let mut exporter_builder = opentelemetry_otlp::MetricExporter::builder()
+//         .with_tonic()
+//         .with_metadata(metadata)
+//         .with_endpoint(&endpoint)
+//         .with_temporality(opentelemetry_sdk::metrics::Temporality::default());
+
+//     if endpoint.starts_with("https://") {
+//         exporter_builder = exporter_builder.with_tls_config(ClientTlsConfig::new().with_enabled_roots());
+//     }
+
+//     let exporter = exporter_builder.build()?;
+
+//     let reader = PeriodicReader::builder(exporter)
+//         .with_interval(std::time::Duration::from_secs(30))
+//         .build();
+
+//     let stdout_reader =
+//         PeriodicReader::builder(opentelemetry_stdout::MetricExporter::default()).build();
+
+//     let meter_provider = MeterProviderBuilder::default()
+//         .with_resource(resource(service_name))
+//         .with_reader(reader)
+//         .with_reader(stdout_reader)
+//         .build();
+
+//     global::set_meter_provider(meter_provider.clone());
+
+//     Ok(meter_provider)
+// }
@@ -0,0 +1,88 @@
+use chrono::Utc;
+use opentelemetry::trace::TraceContextExt;
+use opentelemetry::{SpanId, TraceId};
+use serde::ser::{SerializeMap, Serializer as _};
+use std::io;
+use tracing::{Event, Subscriber};
+use tracing_opentelemetry::OpenTelemetrySpanExt;
+use tracing_serde::fields::AsMap;
+use tracing_serde::AsSerde;
+use tracing_subscriber::fmt::format::Writer;
+use tracing_subscriber::fmt::{FmtContext, FormatEvent, FormatFields};
+use tracing_subscriber::registry::LookupSpan;
+
+pub struct WriteAdaptor<'a> {
+    fmt_write: &'a mut dyn std::fmt::Write,
+}
+
+impl<'a> WriteAdaptor<'a> {
+    pub fn new(fmt_write: &'a mut dyn std::fmt::Write) -> Self {
+        Self { fmt_write }
+    }
+}
+
+impl<'a> io::Write for WriteAdaptor<'a> {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        let s =
+            std::str::from_utf8(buf).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+
+        self.fmt_write
+            .write_str(s)
+            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+
+        Ok(s.as_bytes().len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+pub struct TraceIdFormat;
+
+impl<S, N> FormatEvent<S, N> for TraceIdFormat
+where
+    S: Subscriber + for<'lookup> LookupSpan<'lookup>,
+    N: for<'writer> FormatFields<'writer> + 'static,
+{
+    fn format_event(
+        &self,
+        _ctx: &FmtContext<'_, S, N>,
+        mut writer: Writer<'_>,
+        event: &Event<'_>,
+    ) -> std::fmt::Result
+    where
+        S: Subscriber + for<'a> LookupSpan<'a>,
+    {
+        let meta = event.metadata();
+
+        let mut visit = || {
+            let mut serializer = serde_json::Serializer::new(WriteAdaptor::new(&mut writer));
+            let mut serializer = serializer.serialize_map(None)?;
+            serializer.serialize_entry("timestamp", &Utc::now().to_rfc3339())?;
+            serializer.serialize_entry("level", &meta.level().as_serde())?;
+            serializer.serialize_entry("fields", &event.field_map())?;
+            serializer.serialize_entry("target", meta.target())?;
+
+            let current_span = tracing::Span::current();
+            let context = current_span.context();
+            let span_ref = context.span();
+            let span_context = span_ref.span_context();
+
+            let trace_id = span_context.trace_id();
+            if trace_id != TraceId::INVALID {
+                serializer.serialize_entry("trace_id", &trace_id.to_string())?;
+
+                let span_id = span_context.span_id();
+                if span_id != SpanId::INVALID {
+                    serializer.serialize_entry("span_id", &span_id.to_string())?;
+                }
+            }
+
+            serializer.end()
+        };
+
+        visit().map_err(|_| std::fmt::Error)?;
+        writeln!(writer)
+    }
+}
@@ -3,7 +3,7 @@ name = "nym-client-core"
 version = "1.1.15"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.76"
 license.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -69,6 +69,7 @@ workspace = true
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
 workspace = true
 features = ["tokio"]
+###

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 workspace = true
@@ -102,7 +103,7 @@ workspace = true
 features = ["tokio"]

 [target."cfg(target_arch = \"wasm32\")".dependencies.gloo-timers]
-workspace = true
+version = "0.3.0"
 features = ["futures"]

 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]
@@ -113,10 +114,6 @@ features = ["websocket"]
 workspace = true
 features = ["wasm-bindgen"]

-[target."cfg(target_arch = \"wasm32\")".dependencies.tokio_with_wasm]
-workspace = true
-features = ["full"]
-
 [dev-dependencies]
 tempfile = { workspace = true }

@@ -126,6 +123,7 @@ cli = ["clap", "comfy-table"]
 fs-credentials-storage = ["nym-credential-storage/persistent-storage"]
 fs-surb-storage = ["nym-client-core-surb-storage/fs-surb-storage"]
 fs-gateways-storage = ["nym-client-core-gateways-storage/fs-gateways-storage"]
+otel = ["nym-sphinx/otel"]
 wasm = ["nym-gateway-client/wasm"]
 metrics-server = []

@@ -707,10 +707,13 @@ pub struct DebugConfig {

    /// Defines all configuration options related to reply SURBs.
    pub reply_surbs: ReplySurbs,
+
    /// Defines all configuration options related to stats reporting.
    pub stats_reporting: StatsReporting,
+
    /// Defines all configuration options related to the forget me flag.
    pub forget_me: ForgetMe,
+
    /// Defines all configuration options related to the remember me flag.
    pub remember_me: RememberMe,
 }
@@ -543,8 +543,10 @@ pub struct DebugConfigV6 {

    /// Defines all configuration options related to reply SURBs.
    pub reply_surbs: ReplySurbsV6,
+
    /// Defines all configuration options related to stats reporting.
    pub stats_reporting: StatsReportingV6,
+
    /// Defines all configuration options related to the forget me flag.
    pub forget_me: ForgetMeV6,

@@ -31,6 +31,7 @@ impl StorageManager {
                }
            })?;
        }
+
        let opts = sqlx::sqlite::SqliteConnectOptions::new()
            .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
            .synchronous(SqliteSynchronous::Normal)
@@ -69,10 +69,6 @@ use tokio::sync::mpsc::Sender;
 use tracing::*;
 use url::Url;

-#[cfg(target_arch = "wasm32")]
-#[cfg(debug_assertions)]
-use wasm_utils::console_log;
-
 #[cfg(all(
    not(target_arch = "wasm32"),
    feature = "fs-surb-storage",
@@ -103,6 +99,7 @@ pub struct ClientOutput {
 }

 impl ClientOutput {
+    #[instrument(name = "ClientOutput::register_receiver", skip_all)]
    pub fn register_receiver(
        &mut self,
    ) -> Result<mpsc::UnboundedReceiver<Vec<ReconstructedMessage>>, ClientCoreError> {
@@ -437,6 +434,7 @@ where

    // buffer controlling all messages fetched from provider
    // required so that other components would be able to use them (say the websocket)
+    #[instrument(skip_all)]
    fn start_received_messages_buffer_controller(
        local_encryption_keypair: Arc<x25519::KeyPair>,
        query_receiver: ReceivedBufferRequestReceiver,
@@ -469,6 +467,7 @@ where
    }

    #[allow(clippy::too_many_arguments)]
+    #[instrument(skip_all)]
    async fn start_gateway_client(
        config: &Config,
        initialisation_result: InitialisationResult,
@@ -575,6 +574,7 @@ where
    }

    #[allow(clippy::too_many_arguments)]
+    #[instrument(skip_all)]
    async fn setup_gateway_transceiver(
        custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
        config: &Config,
@@ -732,7 +732,7 @@ where
            shutdown_tracker,
        )
    }
-
+    #[instrument(skip_all)]
    fn start_mix_traffic_controller(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
        shutdown_tracker: &ShutdownTracker,
@@ -842,6 +842,7 @@ where
        Ok(client.get_key_rotation_info().await?.into())
    }

+    #[instrument(skip_all)]
    pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
    where
        S::ReplyStore: Send + Sync,
@@ -851,11 +852,6 @@ where
        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
    {
        info!("Starting nym client");
-        #[cfg(debug_assertions)]
-        #[cfg(target_arch = "wasm32")]
-        {
-            console_log!("Starting base Nym Client");
-        }

        // derive (or load) client keys and gateway configuration
        let init_res = Self::initialise_keys_and_gateway(
@@ -1038,13 +1034,6 @@ where
        debug!("Core client startup finished!");
        debug!("The address of this client is: {self_address}");

-        #[cfg(debug_assertions)]
-        #[cfg(target_arch = "wasm32")]
-        {
-            console_log!("Core client startup finished!");
-            console_log!("Rust::start_base: the address of this client is: {self_address}");
-        }
-
        Ok(BaseClient {
            address: self_address,
            identity_keys,
@@ -1066,7 +1055,7 @@ where
                gateway_connection: GatewayConnection { gateway_ws_fd },
            },
            stats_reporter,
-            shutdown_handle: shutdown_tracker, // The primary tracker for this client
+            shutdown_handle: Some(shutdown_tracker), // The primary tracker for this client
            client_request_sender,
            forget_me: self.config.debug.forget_me,
            remember_me: self.config.debug.remember_me,
@@ -1082,7 +1071,7 @@ pub struct BaseClient {
    pub client_state: ClientState,
    pub stats_reporter: ClientStatsSender,
    pub client_request_sender: ClientRequestSender,
-    pub shutdown_handle: ShutdownTracker,
+    pub shutdown_handle: Option<ShutdownTracker>,
    pub forget_me: ForgetMe,
    pub remember_me: RememberMe,
 }
@@ -225,15 +225,9 @@ impl LoopCoverTrafficStream<OsRng> {
        // JS: due to identical logical structure to OutQueueControl::on_message(), this is also
        // presumably required to prevent bugs in the future. Exact reason is still unknown to me.

+        // TODO: temporary and BAD workaround for wasm (we should find a way to yield here in wasm)
        #[cfg(not(target_arch = "wasm32"))]
-        {
-            tokio::task::yield_now().await;
-        }
-
-        #[cfg(target_arch = "wasm32")]
-        {
-            tokio_with_wasm::task::yield_now().await;
-        }
+        tokio::task::yield_now().await;
    }

    // it's fine if cover traffic stream task gets killed whilst processing next message
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 #![allow(unused_imports)]
+
 use std::time::Duration;

-#[cfg(target_arch = "wasm32")]
 pub use wasmtimer::{std::Instant, tokio::*};
 pub type IntervalStream = gloo_timers::future::IntervalStream;

@@ -29,6 +29,8 @@ pub enum InputMessage {
        data: Vec<u8>,
        lane: TransmissionLane,
        max_retransmissions: Option<u32>,
+        // add trace_id for optional tracing of individual messages in debug mode
+        trace_id: Option<[u8; 12]>,
    },

    /// Creates a message used for a duplex anonymous communication where the recipient
@@ -45,6 +47,7 @@ pub enum InputMessage {
        reply_surbs: u32,
        lane: TransmissionLane,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    },

    /// Attempt to use our internally received and stored `ReplySurb` to send the message back
@@ -90,12 +93,14 @@ impl InputMessage {
        data: Vec<u8>,
        lane: TransmissionLane,
        packet_type: Option<PacketType>,
+        trace_id: Option<[u8; 12]>,
    ) -> Self {
        let message = InputMessage::Regular {
            recipient,
            data,
            lane,
            max_retransmissions: None,
+            trace_id,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -110,6 +115,7 @@ impl InputMessage {
        reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: Option<PacketType>,
+        trace_id: Option<[u8; 12]>,
    ) -> Self {
        let message = InputMessage::Anonymous {
            recipient,
@@ -117,6 +123,7 @@ impl InputMessage {
            reply_surbs,
            lane,
            max_retransmissions: None,
+            trace_id,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -185,4 +192,13 @@ impl InputMessage {
        self.set_max_retransmissions(max_retransmissions);
        self
    }
+
+    pub fn trace_id(&self) -> Option<[u8; 12]> {
+        match self {
+            InputMessage::Regular { trace_id, .. } => *trace_id,
+            InputMessage::Anonymous { trace_id, .. } => *trace_id,
+            InputMessage::Premade { .. } | InputMessage::Reply { .. } => None,
+            InputMessage::MessageWrapper { message, .. } => message.trace_id(),
+        }
+    }
 }
@@ -170,8 +170,7 @@ impl MixTrafficController {
                    },
                    None => {
                        trace!("MixTrafficController, client request channel closed");
-                        break
-                    }
+                    break}
                },
            }
        }
@@ -70,6 +70,7 @@ where
                .send_reply(recipient_tag, data, lane, max_retransmissions);
    }

+    #[instrument(skip_all)]
    async fn handle_plain_message(
        &mut self,
        recipient: Recipient,
@@ -77,16 +78,18 @@ where
        lane: TransmissionLane,
        packet_type: PacketType,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    ) {
        if let Err(err) = self
            .message_handler
-            .try_send_plain_message(recipient, content, lane, packet_type, max_retransmissions)
+            .try_send_plain_message(recipient, content, lane, packet_type, max_retransmissions, trace_id)
            .await
        {
            warn!("failed to send a plain message - {err}")
        }
    }

+    #[instrument(skip_all)]
    async fn handle_repliable_message(
        &mut self,
        recipient: Recipient,
@@ -95,6 +98,7 @@ where
        lane: TransmissionLane,
        packet_type: PacketType,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    ) {
        if let Err(err) = self
            .message_handler
@@ -105,6 +109,7 @@ where
                lane,
                packet_type,
                max_retransmissions,
+                trace_id,
            )
            .await
        {
@@ -113,20 +118,29 @@ where
    }

    #[allow(clippy::panic)]
+    #[instrument(skip_all)]
    async fn on_input_message(&mut self, msg: InputMessage) {
+        let trace_id = msg.trace_id();
+        if let Some(tid) = trace_id {
+            tracing::warn!("Processing input message with trace_id: {:?}", tid);
+        }
+
        match msg {
            InputMessage::Regular {
                recipient,
                data,
                lane,
                max_retransmissions,
+                ..
            } => {
+                warn!("Handling regular input message with trace_id: {:?}", trace_id);
                self.handle_plain_message(
                    recipient,
                    data,
                    lane,
                    PacketType::Mix,
                    max_retransmissions,
+                    trace_id
                )
                .await
            }
@@ -136,7 +150,9 @@ where
                reply_surbs,
                lane,
                max_retransmissions,
+                ..
            } => {
+                warn!("Handling anonymous input message with trace_id: {:?}", trace_id);
                self.handle_repliable_message(
                    recipient,
                    data,
@@ -144,6 +160,7 @@ where
                    lane,
                    PacketType::Mix,
                    max_retransmissions,
+                    trace_id
                )
                .await
            }
@@ -153,6 +170,7 @@ where
                lane,
                max_retransmissions,
            } => {
+                warn!("Handling reply input message with trace_id: {:?}", trace_id);
                self.handle_reply(recipient_tag, data, lane, max_retransmissions)
                    .await;
            }
@@ -166,13 +184,16 @@ where
                    data,
                    lane,
                    max_retransmissions,
+                    ..
                } => {
+                    tracing::warn!("Handling regular input message with trace_id: {:?}", trace_id);
                    self.handle_plain_message(
                        recipient,
                        data,
                        lane,
                        packet_type,
                        max_retransmissions,
+                        trace_id
                    )
                    .await
                }
@@ -182,6 +203,7 @@ where
                    reply_surbs,
                    lane,
                    max_retransmissions,
+                    ..
                } => {
                    self.handle_repliable_message(
                        recipient,
@@ -190,6 +212,7 @@ where
                        lane,
                        packet_type,
                        max_retransmissions,
+                        trace_id
                    )
                    .await
                }
@@ -213,6 +236,7 @@ where
        };
    }

+    #[instrument(skip_all)]
    pub(crate) async fn run(&mut self, shutdown_token: ShutdownToken) {
        debug!("Started InputMessageListener with graceful shutdown support");

@@ -60,7 +60,7 @@ where

        // TODO: Figure out retransmission packet type signaling
        self.message_handler
-            .try_prepare_single_chunk_for_sending(packet_recipient, chunk_data, packet_type)
+            .try_prepare_single_chunk_for_sending(packet_recipient, chunk_data, packet_type, None)
            .await
    }

@@ -27,7 +27,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 use thiserror::Error;
-use tracing::{debug, error, info, trace, warn};
+use tracing::{debug, error, info, instrument, trace, warn};

 // TODO: move that error elsewhere since it seems to be contaminating different files
 #[derive(Debug, Error)]
@@ -476,6 +476,7 @@ where
        self.forward_messages(msgs, lane).await;
    }

+    #[instrument(skip_all)]
    pub(crate) async fn try_send_plain_message(
        &mut self,
        recipient: Recipient,
@@ -483,6 +484,7 @@ where
        lane: TransmissionLane,
        packet_type: PacketType,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    ) -> Result<(), PreparationError> {
        let message = NymMessage::new_plain(message);
        self.try_split_and_send_non_reply_message(
@@ -491,10 +493,12 @@ where
            lane,
            packet_type,
            max_retransmissions,
+            trace_id,
        )
        .await
    }

+    #[instrument(skip_all)]
    pub(crate) async fn try_split_and_send_non_reply_message(
        &mut self,
        message: NymMessage,
@@ -502,6 +506,7 @@ where
        lane: TransmissionLane,
        packet_type: PacketType,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    ) -> Result<(), PreparationError> {
        debug!("Sending non-reply message with packet type {packet_type}");
        // TODO: I really dislike existence of this assertion, it implies code has to be re-organised
@@ -534,6 +539,7 @@ where
                &self.config.ack_key,
                &recipient,
                packet_type,
+                trace_id
            )?;

            let real_message = RealMessage::new(
@@ -585,6 +591,7 @@ where
            TransmissionLane::AdditionalReplySurbs,
            packet_type,
            max_retransmissions,
+            None,
        )
        .await?;

@@ -602,6 +609,7 @@ where
        lane: TransmissionLane,
        packet_type: PacketType,
        max_retransmissions: Option<u32>,
+        trace_id: Option<[u8; 12]>,
    ) -> Result<(), SurbWrappedPreparationError> {
        debug!("Sending message with reply SURBs with packet type {packet_type}");
        let sender_tag = self.get_or_create_sender_tag(&recipient);
@@ -625,6 +633,7 @@ where
            lane,
            packet_type,
            max_retransmissions,
+            trace_id,
        )
        .await?;

@@ -639,6 +648,7 @@ where
        recipient: Recipient,
        chunk: Fragment,
        packet_type: PacketType,
+        trace_id: Option<[u8; 12]>,
    ) -> Result<PreparedFragment, PreparationError> {
        debug!("Sending single chunk with packet type {packet_type}");
        let topology_permit = self.topology_access.get_read_permit().await;
@@ -650,6 +660,7 @@ where
            &self.config.ack_key,
            &recipient,
            packet_type,
+            trace_id,
        )?;

        Ok(prepared_fragment)
@@ -31,9 +31,9 @@ use tracing::*;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::{sleep, Sleep};

-// use wasm_utils::console_log;
 #[cfg(target_arch = "wasm32")]
 use wasmtimer::tokio::{sleep, Sleep};
+
 mod sending_delay_controller;

 /// Configurable parameters of the `OutQueueControl`
@@ -325,15 +325,9 @@ where
        // ready and hence was immediately re-scheduled causing other tasks to be starved;
        // yield makes it go back the scheduling queue regardless of its value availability

+        // TODO: temporary and BAD workaround for wasm (we should find a way to yield here in wasm)
        #[cfg(not(target_arch = "wasm32"))]
-        {
-            tokio::task::yield_now().await;
-        }
-
-        #[cfg(target_arch = "wasm32")]
-        {
-            tokio_with_wasm::task::yield_now().await;
-        }
+        tokio::task::yield_now().await;
    }

    fn on_close_connection(&mut self, connection_id: ConnectionId) {
@@ -80,6 +80,7 @@ impl StatisticsControl {
            stats_report.into(),
            TransmissionLane::General,
            None,
+            None,
        );
        if let Err(err) = self.report_tx.send(report_message).await {
            tracing::error!("Failed to report client stats: {err:?}");
@@ -24,9 +24,7 @@ pub fn spawn_future<F>(future: F)
 where
    F: Future<Output = ()> + 'static,
 {
-    wasm_bindgen_futures::spawn_local(async move {
-        future.await;
-    });
+    wasm_bindgen_futures::spawn_local(future);
 }

 #[deprecated(note = "use spawn_future from nym_task crate instead")]
@@ -1043,6 +1043,12 @@ impl<C, St> GatewayClient<C, St> {
    }

    // Note: this requires prior authentication
+    #[instrument(skip_all,
+        fields(
+            gateway = %self.gateway_identity,
+            gateway_address = %self.gateway_address
+        )
+    )]
    pub fn start_listening_for_mixnet_messages(&mut self) -> Result<(), GatewayClientError> {
        if !self.authenticated {
            return Err(GatewayClientError::NotAuthenticated);
@@ -3,7 +3,7 @@ name = "nym-validator-client"
 version = "0.1.0"
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.56"
 license.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -136,27 +136,6 @@ pub trait DkgSigningClient {
        self.execute_dkg_contract(fee, req, "trigger DKG resharing".to_string(), vec![])
            .await
    }
-
-    async fn transfer_ownership(
-        &self,
-        transfer_to: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::TransferOwnership { transfer_to };
-
-        self.execute_dkg_contract(fee, req, "".to_string(), vec![])
-            .await
-    }
-    async fn update_announce_address(
-        &self,
-        new_address: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::UpdateAnnounceAddress { new_address };
-
-        self.execute_dkg_contract(fee, req, "".to_string(), vec![])
-            .await
-    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -189,7 +168,6 @@ where
 mod tests {
    use super::*;
    use crate::nyxd::contract_traits::tests::IgnoreValue;
-    use nym_coconut_dkg_common::msg::ExecuteMsg;

    // it's enough that this compiles and clippy is happy about it
    #[allow(dead_code)]
@@ -232,12 +210,6 @@ mod tests {
            DkgExecuteMsg::AdvanceEpochState {} => client.advance_dkg_epoch_state(None).ignore(),
            DkgExecuteMsg::TriggerReset {} => client.trigger_dkg_reset(None).ignore(),
            DkgExecuteMsg::TriggerResharing {} => client.trigger_dkg_resharing(None).ignore(),
-            ExecuteMsg::TransferOwnership { transfer_to } => {
-                client.transfer_ownership(transfer_to, None).ignore()
-            }
-            ExecuteMsg::UpdateAnnounceAddress { new_address } => {
-                client.update_announce_address(new_address, None).ignore()
-            }
        };
    }
 }
@@ -5,16 +5,6 @@ use crate::types::{EncodedBTEPublicKeyWithProof, NodeIndex};
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Addr;

-pub type BlockHeight = u64;
-pub type TransactionIndex = u32;
-
-#[cw_serde]
-pub struct OwnershipTransfer {
-    pub node_index: NodeIndex,
-    pub from: Addr,
-    pub to: Addr,
-}
-
 #[cw_serde]
 pub struct DealerDetails {
    pub address: Addr,
@@ -73,17 +73,6 @@ pub enum ExecuteMsg {
    TriggerReset {},

    TriggerResharing {},
-
-    /// Transfers ownership of the epoch dealer to another address.
-    /// This assumes off-chain hand-over of keys
-    TransferOwnership {
-        transfer_to: String,
-    },
-
-    /// Update announce address of this signer
-    UpdateAnnounceAddress {
-        new_address: String,
-    },
 }

 #[cw_serde]
@@ -20,7 +20,5 @@ rand_chacha = { workspace = true }
 rand = { workspace = true }
 cw-multi-test = { workspace = true }

-nym-contracts-common = { path = "../contracts-common" }
-
 [lints]
 workspace = true
@@ -1,100 +1,20 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use cosmwasm_std::testing::{MockApi, MockQuerier, MockStorage, message_info};
+use cosmwasm_std::testing::{message_info, MockApi, MockQuerier, MockStorage};
 use cosmwasm_std::{
-    Addr, BankMsg, CosmosMsg, Decimal, Empty, Env, MemoryStorage, MessageInfo, Order, OwnedDeps,
-    Response, StdResult, Storage, coins,
+    coins, Addr, BankMsg, CosmosMsg, Empty, Env, MemoryStorage, MessageInfo, Order, OwnedDeps,
+    Response, StdResult, Storage,
 };
 use cw_storage_plus::{KeyDeserialize, Map, Prefix, PrimaryKey};
-use nym_contracts_common::events::may_find_attribute;
 use rand::{RngCore, SeedableRng};
 use rand_chacha::ChaCha20Rng;
-use serde::Serialize;
 use serde::de::DeserializeOwned;
-use std::fmt::Debug;
-use std::str::FromStr;
+use serde::Serialize;

 pub const TEST_DENOM: &str = "unym";
 pub const TEST_PREFIX: &str = "n";

-pub trait FindAttribute {
-    fn attribute<E, S>(&self, event_type: E, attribute: &str) -> String
-    where
-        E: Into<Option<S>>,
-        S: Into<String>;
-
-    fn any_attribute(&self, attribute: &str) -> String {
-        self.attribute::<_, String>(None, attribute)
-    }
-
-    fn any_parsed_attribute<T>(&self, attribute: &str) -> T
-    where
-        T: FromStr,
-        <T as FromStr>::Err: Debug,
-    {
-        self.parsed_attribute::<_, String, T>(None, attribute)
-    }
-
-    fn parsed_attribute<E, S, T>(&self, event_type: E, attribute: &str) -> T
-    where
-        E: Into<Option<S>>,
-        S: Into<String>,
-        T: FromStr,
-        <T as FromStr>::Err: Debug;
-
-    fn decimal<E, S>(&self, event_type: E, attribute: &str) -> Decimal
-    where
-        E: Into<Option<S>>,
-        S: Into<String>,
-    {
-        self.parsed_attribute(event_type, attribute)
-    }
-}
-
-#[track_caller]
-pub fn find_attribute<S: Into<String>>(
-    event_type: Option<S>,
-    attribute: &str,
-    response: &Response,
-) -> String {
-    let event_type = event_type.map(Into::into);
-    for event in &response.events {
-        if let Some(typ) = &event_type {
-            if &event.ty != typ {
-                continue;
-            }
-        }
-        if let Some(attr) = may_find_attribute(event, attribute) {
-            return attr;
-        }
-    }
-    // this is only used in tests so panic here is fine
-    panic!("did not find the attribute")
-}
-
-impl FindAttribute for Response {
-    fn attribute<E, S>(&self, event_type: E, attribute: &str) -> String
-    where
-        E: Into<Option<S>>,
-        S: Into<String>,
-    {
-        find_attribute(event_type.into(), attribute, self)
-    }
-
-    fn parsed_attribute<E, S, T>(&self, event_type: E, attribute: &str) -> T
-    where
-        E: Into<Option<S>>,
-        S: Into<String>,
-        T: FromStr,
-        <T as FromStr>::Err: Debug,
-    {
-        find_attribute(event_type.into(), attribute, self)
-            .parse()
-            .unwrap()
-    }
-}
-
 pub fn mock_api() -> MockApi {
    MockApi::default().with_prefix(TEST_PREFIX)
 }
@@ -4,12 +4,12 @@
 use crate::{ContractTester, TestableNymContract};
 use cosmwasm_std::testing::{message_info, mock_env};
 use cosmwasm_std::{
-    Addr, BlockInfo, Coin, ContractInfo, Deps, DepsMut, Env, MessageInfo, Response, StdResult,
-    Storage, Timestamp, from_json,
+    from_json, Addr, Coin, ContractInfo, Deps, DepsMut, Env, MessageInfo, Response, StdResult,
+    Storage, Timestamp,
 };
-use cw_multi_test::{AppResponse, Executor, next_block};
-use serde::Serialize;
+use cw_multi_test::{next_block, AppResponse, Executor};
 use serde::de::DeserializeOwned;
+use serde::Serialize;
 use std::any::type_name;
 use std::fmt::Debug;

@@ -62,8 +62,6 @@ pub trait ContractOpts {
        coins: &[Coin],
        message: Self::ExecuteMsg,
    ) -> Result<Response, Self::ContractError>;
-
-    fn unchecked_contract_address<D: TestableNymContract>(&self) -> Addr;
 }

 impl<C> ContractOpts for ContractTester<C>
@@ -132,47 +130,14 @@ where

        C::execute()(self.deps_mut(), env, info, message)
    }
-
-    fn unchecked_contract_address<D: TestableNymContract>(&self) -> Addr {
-        self.unchecked_contract_address::<D>()
-    }
 }

 pub trait ChainOpts: ContractOpts {
    fn set_contract_balance(&mut self, balance: Coin);

-    fn update_block<F: Fn(&mut BlockInfo)>(&mut self, action: F);
-    fn set_to_epoch(&mut self) {
-        self.set_block_time(Timestamp::from_seconds(0))
-    }
+    fn next_block(&mut self);

-    fn set_to_genesis(&mut self) {
-        self.update_block(|block| {
-            block.height = 1;
-        })
-    }
-
-    fn next_block(&mut self) {
-        self.update_block(next_block)
-    }
-
-    fn advance_day_of_blocks(&mut self) {
-        self.update_block(|block| {
-            block.time = block.time.plus_seconds(24 * 60 * 60);
-            block.height += 17280;
-        })
-    }
-
-    fn advance_time_by(&mut self, delta_secs: u64) {
-        self.update_block(|block| {
-            block.time = block.time.plus_seconds(delta_secs);
-            block.height += 1
-        })
-    }
-
-    fn set_block_time(&mut self, time: Timestamp) {
-        self.update_block(|b| b.time = time)
-    }
+    fn set_block_time(&mut self, time: Timestamp);

    fn execute_msg(
        &mut self,
@@ -221,9 +186,12 @@ where
            )
            .unwrap();
    }
+    fn next_block(&mut self) {
+        self.app.update_block(next_block)
+    }

-    fn update_block<F: Fn(&mut BlockInfo)>(&mut self, action: F) {
-        self.app.update_block(action)
+    fn set_block_time(&mut self, time: Timestamp) {
+        self.app.update_block(|b| b.time = time)
    }

    fn execute_msg(
@@ -2,23 +2,22 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::{
-    CommonStorageKeys, ContractOpts, ContractTester, StorageWrapper, TEST_DENOM,
-    TestableNymContract,
+    CommonStorageKeys, ContractOpts, ContractTester, StorageWrapper, TestableNymContract,
+    TEST_DENOM,
 };
 use cosmwasm_std::testing::message_info;
 use cosmwasm_std::{
-    Addr, Coin, MessageInfo, StdError, StdResult, Storage, coin, coins, from_json, to_json_vec,
+    coin, coins, from_json, to_json_vec, Addr, Coin, MessageInfo, StdError, StdResult, Storage,
 };
 use cw_multi_test::Executor;
 use cw_storage_plus::{Key, Path, PrimaryKey};
+use rand::RngCore;
 use rand_chacha::ChaCha20Rng;
-use serde::Serialize;
 use serde::de::DeserializeOwned;
+use serde::Serialize;
 use std::any::type_name;
 use std::ops::Deref;

-pub use rand::prelude::*;
-
 pub trait StorageReader {
    fn common_key(&self, key: CommonStorageKeys) -> Option<&[u8]>;

@@ -1,16 +1,16 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::{TEST_DENOM, mock_api, test_rng};
+use crate::{mock_api, test_rng, TEST_DENOM};
 use cosmwasm_std::testing::MockApi;
 use cosmwasm_std::{
-    Addr, Binary, Deps, DepsMut, Empty, Env, MessageInfo, Order, QuerierWrapper, Record, Response,
-    Storage, coin, coins,
+    coin, coins, Addr, Binary, Deps, DepsMut, Empty, Env, MessageInfo, Order, QuerierWrapper,
+    Record, Response, Storage,
 };
 use cw_multi_test::{App, AppBuilder, BankKeeper, Contract, ContractWrapper, Executor};
 use rand_chacha::ChaCha20Rng;
-use serde::Serialize;
 use serde::de::DeserializeOwned;
+use serde::Serialize;
 use std::collections::HashMap;
 use std::fmt::{Debug, Display};
 use std::marker::PhantomData;
@@ -47,11 +47,27 @@ pub trait TestableNymContract {
    fn query() -> QueryFn<Self::QueryMsg, Self::ContractError>;
    fn migrate() -> PermissionedFn<Self::MigrateMsg, Self::ContractError>;

-    // not all instances will require default init message, some will always have to provide customised values
-    #[allow(clippy::unimplemented)]
-    fn base_init_msg() -> Self::InitMsg {
-        unimplemented!("attempted to instantiate contract without defining instantiate message")
-    }
+    fn base_init_msg() -> Self::InitMsg;
+
+    // // for now we don't care about custom queriers
+    // fn contract_wrapper() -> ContractWrapper<
+    //     Self::ExecuteMsg,
+    //     Self::InitMsg,
+    //     Self::QueryMsg,
+    //     Self::ContractError,
+    //     anyhow::Error,
+    //     anyhow::Error,
+    //     Empty,
+    //     Empty,
+    //     Empty,
+    //     Self::ContractError,
+    //     Self::ContractError,
+    //     Self::MigrateMsg,
+    //     Self::ContractError,
+    // > {
+    //     ContractWrapper::new(Self::execute(), Self::instantiate(), Self::query())
+    //         .with_migrate(Self::migrate())
+    // }

    fn dyn_contract() -> Box<dyn Contract<Empty>> {
        Box::new(
@@ -76,7 +92,6 @@ pub struct ContractTesterBuilder<C> {
    app: App<BankKeeper, MockApi, StorageWrapper>,
    storage: StorageWrapper,
    pub well_known_contracts: HashMap<&'static str, Addr>,
-    code_ids: HashMap<&'static str, u64>,
 }

 impl<C> ContractTesterBuilder<C> {
@@ -110,33 +125,20 @@ impl<C> ContractTesterBuilder<C> {
            app,
            storage,
            well_known_contracts: Default::default(),
-            code_ids: Default::default(),
        }
    }

-    pub fn master_address(&self) -> Addr {
-        self.master_address.clone()
-    }
-
    pub fn instantiate<D: TestableNymContract>(
        mut self,
        custom_init_msg: Option<D::InitMsg>,
    ) -> ContractTesterBuilder<C> {
-        self.instantiate_contract::<D>(custom_init_msg);
-        self
-    }
-
-    pub fn instantiate_contract<D: TestableNymContract>(
-        &mut self,
-        custom_init_msg: Option<D::InitMsg>,
-    ) {
        let code_id = self.app.store_code(D::dyn_contract());
        let contract_address = self
            .app
            .instantiate_contract(
                code_id,
                self.master_address.clone(),
-                &custom_init_msg.unwrap_or_else(|| D::base_init_msg()),
+                &custom_init_msg.unwrap_or(D::base_init_msg()),
                &[],
                D::NAME,
                Some(self.master_address.to_string()),
@@ -152,28 +154,8 @@ impl<C> ContractTesterBuilder<C> {
            )
            .unwrap();

-        self.code_ids.insert(D::NAME, code_id);
        self.well_known_contracts.insert(D::NAME, contract_address);
-    }
-
-    // uses the SAME code
-    pub fn migrate_contract<D: TestableNymContract>(&mut self, migrate_msg: &D::MigrateMsg) {
-        self.app
-            .migrate_contract(
-                self.master_address.clone(),
-                self.unchecked_contract_address::<D>(),
-                migrate_msg,
-                self.unchecked_contract_code_id::<D>(),
-            )
-            .unwrap();
-    }
-
-    pub fn unchecked_contract_address<D: TestableNymContract>(&self) -> Addr {
-        self.well_known_contracts.get(D::NAME).unwrap().clone()
-    }
-
-    fn unchecked_contract_code_id<D: TestableNymContract>(&self) -> u64 {
-        *self.code_ids.get(D::NAME).unwrap()
+        self
    }

    pub fn build(self) -> ContractTester<C>
@@ -247,10 +229,6 @@ where
        self.insert_common_storage_key(key, value);
        self
    }
-
-    pub fn unchecked_contract_address<D: TestableNymContract>(&self) -> Addr {
-        self.well_known_contracts.get(D::NAME).unwrap().clone()
-    }
 }

 impl<C> Storage for ContractTester<C>
@@ -1,53 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use cosmwasm_std::{Binary, CustomQuery, QuerierWrapper, StdResult, from_json};
-use serde::Serialize;
-use serde::de::DeserializeOwned;
-
-// re-expose methods from QuerierWrapper as traits so that we could more easily define extension traits
-pub trait ContractQuerier {
-    fn query_contract<T: DeserializeOwned>(
-        &self,
-        address: impl Into<String>,
-        msg: &impl Serialize,
-    ) -> StdResult<T>;
-
-    fn query_contract_storage(
-        &self,
-        address: impl Into<String>,
-        key: impl Into<Binary>,
-    ) -> StdResult<Option<Vec<u8>>>;
-
-    fn query_contract_storage_value<T: DeserializeOwned>(
-        &self,
-        address: impl Into<String>,
-        key: impl Into<Binary>,
-    ) -> StdResult<Option<T>> {
-        match self.query_contract_storage(address, key)? {
-            None => Ok(None),
-            Some(value) => Ok(Some(from_json(&value)?)),
-        }
-    }
-}
-
-impl<C> ContractQuerier for QuerierWrapper<'_, C>
-where
-    C: CustomQuery,
-{
-    fn query_contract<T: DeserializeOwned>(
-        &self,
-        address: impl Into<String>,
-        msg: &impl Serialize,
-    ) -> StdResult<T> {
-        self.query_wasm_smart(address, msg)
-    }
-
-    fn query_contract_storage(
-        &self,
-        address: impl Into<String>,
-        key: impl Into<Binary>,
-    ) -> StdResult<Option<Vec<u8>>> {
-        self.query_wasm_raw(address, key)
-    }
-}
@@ -10,7 +10,6 @@ pub mod events;
 pub mod signing;
 pub mod types;

-pub mod contract_querier;
 pub mod helpers;

 pub use types::*;
@@ -1,10 +1,10 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use cosmwasm_std::{Addr, Coin, MessageInfo, StdResult, from_json, to_json_vec};
+use cosmwasm_std::{from_json, to_json_vec, Addr, Coin, MessageInfo, StdResult};
 use schemars::JsonSchema;
 use serde::de::DeserializeOwned;
-use serde::{Deserialize, Deserializer, Serialize, Serializer, de};
+use serde::{de, Deserialize, Deserializer, Serialize, Serializer};
 use std::fmt::{Display, Formatter};
 use std::str::FromStr;
 pub use verifier::Verifier;
@@ -2,7 +2,7 @@
 name = "nym-mixnet-contract-common"
 version = "0.6.0"
 description = "Common library for the Nym mixnet contract"
-rust-version = "1.85"
+rust-version = "1.62"
 edition = { workspace = true }
 authors = { workspace = true }
 license = { workspace = true }
@@ -5,8 +5,8 @@ use crate::nym_node::Role;
 use crate::{
    EpochEventId, EpochState, IntervalEventId, NodeId, OperatingCostRange, ProfitMarginRange,
 };
-use contracts_common::Percent;
 use contracts_common::signing::verifier::ApiVerifierError;
+use contracts_common::Percent;
 use cosmwasm_std::{Addr, Coin, Decimal, Uint128};
 use cw_controllers::AdminError;
 use thiserror::Error;
@@ -47,9 +47,7 @@ pub enum MixnetContractError {
    )]
    InvalidPubKey,

-    #[error(
-        "Attempted to reduce node pledge ({current}{denom} - {decrease_by}{denom}) below the minimum amount: {minimum}{denom}"
-    )]
+    #[error("Attempted to reduce node pledge ({current}{denom} - {decrease_by}{denom}) below the minimum amount: {minimum}{denom}")]
    InvalidPledgeReduction {
        current: Uint128,
        decrease_by: Uint128,
@@ -125,9 +123,7 @@ pub enum MixnetContractError {
    #[error("Provided ed25519 signature did not verify correctly")]
    InvalidEd25519Signature,

-    #[error(
-        "Can't perform the specified action as the current epoch is still progress. It started at {epoch_start} and finishes at {epoch_end}, while the current block time is {current_block_time}"
-    )]
+    #[error("Can't perform the specified action as the current epoch is still progress. It started at {epoch_start} and finishes at {epoch_end}, while the current block time is {current_block_time}")]
    EpochInProgress {
        current_block_time: u64,
        epoch_start: i64,
@@ -137,9 +133,7 @@ pub enum MixnetContractError {
    #[error("attempted to reward a gateway node - this has not been fully integrated yet")]
    GatewayRewarding,

-    #[error(
-        "node {node_id} has already been rewarded during the current rewarding epoch ({absolute_epoch_id})"
-    )]
+    #[error("node {node_id} has already been rewarded during the current rewarding epoch ({absolute_epoch_id})")]
    NodeAlreadyRewarded {
        node_id: NodeId,
        absolute_epoch_id: u32,
@@ -178,9 +172,7 @@ pub enum MixnetContractError {
    #[error("one of the roles in the new active set is empty")]
    EmptyRoleAssignment,

-    #[error(
-        "the number of mixnodes in the rewarded set is not divisible by the number of mix-layers (3)"
-    )]
+    #[error("the number of mixnodes in the rewarded set is not divisible by the number of mix-layers (3)")]
    UnevenLayerAssignment,

    #[error("provided active set is bigger than the rewarded set")]
@@ -204,35 +196,25 @@ pub enum MixnetContractError {
    #[error("key rotation validity below minimum value")]
    TooShortRotationInterval,

-    #[error(
-        "this validator ({current_validator}) is not the one responsible for advancing this epoch. It's responsibility of {chosen_validator}."
-    )]
+    #[error("this validator ({current_validator}) is not the one responsible for advancing this epoch. It's responsibility of {chosen_validator}.")]
    RewardingValidatorMismatch {
        current_validator: Addr,
        chosen_validator: Addr,
    },

-    #[error(
-        "the epoch is currently in the process of being advanced. (the state is {current_state}) Please try sending your transaction again once this has finished"
-    )]
+    #[error("the epoch is currently in the process of being advanced. (the state is {current_state}) Please try sending your transaction again once this has finished")]
    EpochAdvancementInProgress { current_state: EpochState },

-    #[error(
-        "the epoch is in an unexpected state. expected 'mix rewarding' state, but we're in {current_state} instead."
-    )]
+    #[error("the epoch is in an unexpected state. expected 'mix rewarding' state, but we're in {current_state} instead.")]
    UnexpectedNonRewardingEpochState { current_state: EpochState },

-    #[error(
-        "attempted to reward mixnode out of order. Attempted to reward {attempted_to_reward} while last rewarded was {last_rewarded}."
-    )]
+    #[error("attempted to reward mixnode out of order. Attempted to reward {attempted_to_reward} while last rewarded was {last_rewarded}.")]
    RewardingOutOfOrder {
        last_rewarded: NodeId,
        attempted_to_reward: NodeId,
    },

-    #[error(
-        "the epoch is currently not in the 'event reconciliation' state. (the state is {current_state})"
-    )]
+    #[error("the epoch is currently not in the 'event reconciliation' state. (the state is {current_state})")]
    EpochNotInEventReconciliationState { current_state: EpochState },

    #[error(
@@ -243,18 +225,14 @@ pub enum MixnetContractError {
    #[error("unexpected role assignment. got: {got} while expected: {expected}")]
    UnexpectedRoleAssignment { expected: Role, got: Role },

-    #[error(
-        "attempted to assign an invalid number of nodes for a role of {role}. got {assigned}, but the maximum allowed is {allowed}"
-    )]
+    #[error("attempted to assign an invalid number of nodes for a role of {role}. got {assigned}, but the maximum allowed is {allowed}")]
    IllegalRoleCount {
        role: Role,
        assigned: u32,
        allowed: u32,
    },

-    #[error(
-        "the epoch is currently not in the 'epoch advancement' state. (the state is {current_state})"
-    )]
+    #[error("the epoch is currently not in the 'epoch advancement' state. (the state is {current_state})")]
    EpochNotInAdvancementState { current_state: EpochState },

    #[error("failed to verify message signature: {source}")]
@@ -263,9 +241,7 @@ pub enum MixnetContractError {
        source: ApiVerifierError,
    },

-    #[error(
-        "this operation is no longer allowed to be performed with vesting tokens. please move them to your liquid balance and try again"
-    )]
+    #[error("this operation is no longer allowed to be performed with vesting tokens. please move them to your liquid balance and try again")]
    DisabledVestingOperation,

    #[error(
@@ -273,9 +249,7 @@ pub enum MixnetContractError {
    )]
    NotAVestingMixnode,

-    #[error(
-        "this delegation has not been performed with the vesting tokens or has already been migrated"
-    )]
+    #[error("this delegation has not been performed with the vesting tokens or has already been migrated")]
    NotAVestingDelegation,

    #[error("the provided profit margin ({provided}) is outside the allowed range: {range}")]
@@ -284,9 +258,7 @@ pub enum MixnetContractError {
        range: ProfitMarginRange,
    },

-    #[error(
-        "the provided interval operating cost ({provided}{denom}) is outside the allowed range: {range}"
-    )]
+    #[error("the provided interval operating cost ({provided}{denom}) is outside the allowed range: {range}")]
    OperatingCostOutsideRange {
        denom: String,
        provided: Uint128,
@@ -307,9 +279,7 @@ pub enum MixnetContractError {
    #[error("the provided nym-node version is not a valid semver. got: {provided}")]
    InvalidNymNodeSemver { provided: String },

-    #[error(
-        "the provided nym-node version is not greater than the current one. got: {provided}. current: {current}"
-    )]
+    #[error("the provided nym-node version is not greater than the current one. got: {provided}. current: {current}")]
    NonIncreasingSemver { provided: String, current: String },
 }

@@ -9,7 +9,7 @@ use crate::reward_params::{ActiveSetUpdate, IntervalRewardParams, IntervalReward
 use crate::rewarding::RewardDistribution;
 use crate::{BlockHeight, ContractStateParamsUpdate, EpochId, IdentityKeyRef, Interval, NodeId};
 pub use contracts_common::events::*;
-use cosmwasm_std::{Addr, Coin, Decimal, Event, attr};
+use cosmwasm_std::{attr, Addr, Coin, Decimal, Event};
 use std::fmt::Display;

 pub const EVENT_VERSION_PREFIX: &str = "v2_";
@@ -3,7 +3,7 @@

 use crate::{IdentityKey, NodeId, SphinxKey};
 use cosmwasm_schema::cw_serde;
-use cosmwasm_std::{Addr, Coin, to_json_string};
+use cosmwasm_std::{to_json_string, Addr, Coin};
 use std::cmp::Ordering;
 use std::fmt::Display;

@@ -1,13 +1,13 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::NodeId;
 use crate::error::MixnetContractError;
 use crate::nym_node::Role;
+use crate::NodeId;
 use cosmwasm_schema::cw_serde;
-use cosmwasm_schema::schemars::JsonSchema;
-use cosmwasm_schema::schemars::r#gen::SchemaGenerator;
+use cosmwasm_schema::schemars::gen::SchemaGenerator;
 use cosmwasm_schema::schemars::schema::{InstanceType, Schema, SchemaObject};
+use cosmwasm_schema::schemars::JsonSchema;
 use cosmwasm_std::{Addr, Env};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
@@ -27,8 +27,8 @@ pub(crate) mod string_rfc3339_offset_date_time {
    use serde::ser::Error;
    use serde::{Deserializer, Serialize, Serializer};
    use std::fmt::Formatter;
-    use time::OffsetDateTime;
    use time::format_description::well_known::Rfc3339;
+    use time::OffsetDateTime;

    struct Rfc3339OffsetDateTimeVisitor;

@@ -91,7 +91,7 @@ impl EpochStatus {
    ) -> Result<bool, MixnetContractError> {
        match &mut self.state {
            EpochState::Rewarding {
-                last_rewarded,
+                ref mut last_rewarded,
                final_node_id,
            } => {
                if new_last_rewarded <= *last_rewarded {
@@ -254,7 +254,7 @@ impl JsonSchema for Interval {
        "Interval".to_owned()
    }

-    fn json_schema(r#gen: &mut SchemaGenerator) -> Schema {
+    fn json_schema(gen: &mut SchemaGenerator) -> Schema {
        let mut schema_object = SchemaObject {
            instance_type: Some(InstanceType::Object.into()),
            ..SchemaObject::default()
@@ -263,13 +263,12 @@ impl JsonSchema for Interval {
        let object_validation = schema_object.object();
        object_validation
            .properties
-            .insert("id".to_owned(), r#gen.subschema_for::<IntervalId>());
+            .insert("id".to_owned(), gen.subschema_for::<IntervalId>());
        object_validation.required.insert("id".to_owned());

-        object_validation.properties.insert(
-            "epochs_in_interval".to_owned(),
-            r#gen.subschema_for::<u32>(),
-        );
+        object_validation
+            .properties
+            .insert("epochs_in_interval".to_owned(), gen.subschema_for::<u32>());
        object_validation
            .required
            .insert("epochs_in_interval".to_owned());
@@ -278,7 +277,7 @@ impl JsonSchema for Interval {
        // serialization to string, so we just specify the schema to be String.
        object_validation.properties.insert(
            "current_epoch_start".to_owned(),
-            r#gen.subschema_for::<String>(),
+            gen.subschema_for::<String>(),
        );
        object_validation
            .required
@@ -286,7 +285,7 @@ impl JsonSchema for Interval {

        object_validation.properties.insert(
            "current_epoch_id".to_owned(),
-            r#gen.subschema_for::<EpochId>(),
+            gen.subschema_for::<EpochId>(),
        );
        object_validation
            .required
@@ -294,12 +293,12 @@ impl JsonSchema for Interval {

        object_validation
            .properties
-            .insert("epoch_length".to_owned(), r#gen.subschema_for::<Duration>());
+            .insert("epoch_length".to_owned(), gen.subschema_for::<Duration>());
        object_validation.required.insert("epoch_length".to_owned());

        object_validation.properties.insert(
            "total_elapsed_epochs".to_owned(),
-            r#gen.subschema_for::<EpochId>(),
+            gen.subschema_for::<EpochId>(),
        );
        object_validation
            .required
@@ -9,14 +9,14 @@ use crate::error::MixnetContractError;
 use crate::helpers::IntoBaseDecimal;
 use crate::nym_node::Role;
 use crate::reward_params::{NodeRewardingParameters, RewardingParams};
-use crate::rewarding::RewardDistribution;
 use crate::rewarding::helpers::truncate_reward;
+use crate::rewarding::RewardDistribution;
 use crate::{
    Delegation, EpochEventId, EpochId, IdentityKey, IntervalEventId, NodeId, OperatingCostRange,
    Percent, ProfitMarginRange, SphinxKey,
 };
 use cosmwasm_schema::cw_serde;
-use cosmwasm_std::{Addr, Coin, Decimal, StdResult, Uint128, to_json_string};
+use cosmwasm_std::{to_json_string, Addr, Coin, Decimal, StdResult, Uint128};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_repr::{Deserialize_repr, Serialize_repr};
@@ -18,7 +18,7 @@ use crate::{
    VersionScoreFormulaParams,
 };
 use crate::{OperatingCostRange, ProfitMarginRange};
-use contracts_common::{IdentityKey, Percent, signing::MessageSignature};
+use contracts_common::{signing::MessageSignature, IdentityKey, Percent};
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::{Coin, Decimal};
 use std::time::Duration;
@@ -55,7 +55,7 @@ use crate::{
    types::{ContractState, ContractStateParams},
 };
 #[cfg(feature = "schema")]
-use contracts_common::{ContractBuildInformation, signing::Nonce};
+use contracts_common::{signing::Nonce, ContractBuildInformation};
 #[cfg(feature = "schema")]
 use cosmwasm_schema::QueryResponses;

@@ -3,9 +3,9 @@

 use crate::helpers::IntoBaseDecimal;
 use crate::nym_node::Role;
-use crate::{Percent, error::MixnetContractError};
+use crate::{error::MixnetContractError, Percent};
 use cosmwasm_schema::cw_serde;
-use cosmwasm_std::{Decimal, to_json_string};
+use cosmwasm_std::{to_json_string, Decimal};

 pub type Performance = Percent;
 pub type WorkFactor = Decimal;
@@ -4,8 +4,8 @@
 use crate::error::MixnetContractError;
 use crate::helpers::IntoBaseDecimal;
 use crate::reward_params::{NodeRewardingParameters, WorkFactor};
-use crate::rewarding::RewardDistribution;
 use crate::rewarding::simulator::simulated_node::SimulatedNode;
+use crate::rewarding::RewardDistribution;
 use crate::{Delegation, Interval, IntervalRewardParams, NodeCostParams, NodeId, RewardingParams};
 use cosmwasm_std::{Coin, Decimal};
 use std::collections::BTreeMap;
@@ -226,9 +226,9 @@ impl Simulator {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::Percent;
    use crate::helpers::compare_decimals;
    use crate::reward_params::RewardedSetParams;
+    use crate::Percent;
    use cosmwasm_std::testing::mock_env;
    use std::time::Duration;

@@ -1,10 +1,10 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::EpochId;
 use crate::config_score::{ConfigScoreParams, OutdatedVersionWeights, VersionScoreFormulaParams};
 use crate::nym_node::Role;
 use crate::reward_params::RewardedSetParams;
+use crate::EpochId;
 use contracts_common::Percent;
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Coin;
@@ -23,9 +23,7 @@ pub enum NymPerformanceContractError {
    #[error("{address} is not an authorised network monitor")]
    NotAuthorised { address: Addr },

-    #[error(
-        "attempted to submit performance data for epoch {epoch_id} and node {node_id} whilst last submitted was {last_epoch_id} for node {last_node_id}"
-    )]
+    #[error("attempted to submit performance data for epoch {epoch_id} and node {node_id} whilst last submitted was {last_epoch_id} for node {last_node_id}")]
    StalePerformanceSubmission {
        epoch_id: EpochId,
        node_id: NodeId,
@@ -16,9 +16,7 @@ pub enum NymPoolContractError {
    #[error(transparent)]
    StdErr(#[from] cosmwasm_std::StdError),

-    #[error(
-        "this sender is not authorised to revoke this grant. its neither the admin or the original (and still whitelisted) granter"
-    )]
+    #[error("this sender is not authorised to revoke this grant. its neither the admin or the original (and still whitelisted) granter")]
    UnauthorizedGrantRevocation,

    #[error("the specified address is already a whitelisted granter")]
@@ -30,9 +28,7 @@ pub enum NymPoolContractError {
    #[error("invalid coin denomination. got {got}, but expected {expected}")]
    InvalidDenom { expected: String, got: String },

-    #[error(
-        "there already exists an active grant for {grantee}. it was granted by {granter} at block height {created_at_height}"
-    )]
+    #[error("there already exists an active grant for {grantee}. it was granted by {granter} at block height {created_at_height}")]
    GrantAlreadyExist {
        granter: String,
        grantee: String,
@@ -42,17 +38,13 @@ pub enum NymPoolContractError {
    #[error("could not find any active grants for {grantee}")]
    GrantNotFound { grantee: String },

-    #[error(
-        "the provided timestamp value ({timestamp}) is set in the past. the current block timestamp is {current_block_timestamp}"
-    )]
+    #[error("the provided timestamp value ({timestamp}) is set in the past. the current block timestamp is {current_block_timestamp}")]
    TimestampInThePast {
        timestamp: u64,
        current_block_timestamp: u64,
    },

-    #[error(
-        "there are not enough tokens to process this request. {available} are available, but {required} is needed."
-    )]
+    #[error("there are not enough tokens to process this request. {available} are available, but {required} is needed.")]
    InsufficientTokens { available: Coin, required: Coin },

    #[error("the period length can't be zero")]
@@ -61,30 +53,22 @@ pub enum NymPoolContractError {
    #[error("the provided coin value is zero")]
    ZeroAmount,

-    #[error(
-        "the periodic spend limit of {periodic} was set to be higher than the total spend limit {total_limit}"
-    )]
+    #[error("the periodic spend limit of {periodic} was set to be higher than the total spend limit {total_limit}")]
    PeriodicGrantOverSpendLimit { periodic: Coin, total_limit: Coin },

-    #[error(
-        "the accumulation spend limit of {accumulation} was set to be lower than the periodic grant amount of {periodic_grant}"
-    )]
+    #[error("the accumulation spend limit of {accumulation} was set to be lower than the periodic grant amount of {periodic_grant}")]
    AccumulationBelowGrantAmount {
        accumulation: Coin,
        periodic_grant: Coin,
    },

-    #[error(
-        "the accumulation spend limit of {accumulation} was set to be higher than the total spend limit of {total_limit}"
-    )]
+    #[error("the accumulation spend limit of {accumulation} was set to be higher than the total spend limit of {total_limit}")]
    AccumulationOverSpendLimit {
        accumulation: Coin,
        total_limit: Coin,
    },

-    #[error(
-        "the specified delayed allowance would never be available. it would become active at {available_timestamp} yet it expires at {expiration_timestamp}"
-    )]
+    #[error("the specified delayed allowance would never be available. it would become active at {available_timestamp} yet it expires at {expiration_timestamp}")]
    UnattainableDelayedAllowance {
        expiration_timestamp: u64,
        available_timestamp: u64,
@@ -88,10 +88,10 @@ pub mod grants {

        pub fn basic_mut(&mut self) -> &mut BasicAllowance {
            match self {
-                Allowance::Basic(allowance) => allowance,
-                Allowance::ClassicPeriodic(allowance) => &mut allowance.basic,
-                Allowance::CumulativePeriodic(allowance) => &mut allowance.basic,
-                Allowance::Delayed(allowance) => &mut allowance.basic,
+                Allowance::Basic(ref mut allowance) => allowance,
+                Allowance::ClassicPeriodic(ref mut allowance) => &mut allowance.basic,
+                Allowance::CumulativePeriodic(ref mut allowance) => &mut allowance.basic,
+                Allowance::Delayed(ref mut allowance) => &mut allowance.basic,
            }
        }

@@ -752,7 +752,7 @@ pub mod query_responses {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use cosmwasm_std::{Uint128, coin};
+    use cosmwasm_std::{coin, Uint128};

    const TEST_DENOM: &str = "unym";

@@ -873,8 +873,8 @@ mod tests {
        #[cfg(test)]
        mod basic_allowance {
            use super::*;
-            use cosmwasm_std::Timestamp;
            use cosmwasm_std::testing::mock_env;
+            use cosmwasm_std::Timestamp;

            #[test]
            fn doesnt_allow_expirations_in_the_past() {
@@ -1158,8 +1158,8 @@ mod tests {
        #[cfg(test)]
        mod delayed_allowance {
            use super::*;
-            use cosmwasm_std::Timestamp;
            use cosmwasm_std::testing::mock_env;
+            use cosmwasm_std::Timestamp;

            #[test]
            fn doesnt_allow_availability_in_the_past() {
@@ -20,8 +20,8 @@ pub fn ensure_unix_timestamp_not_in_the_past(
 #[cfg(test)]
 mod tests {
    use super::*;
-    use cosmwasm_std::Timestamp;
    use cosmwasm_std::testing::mock_env;
+    use cosmwasm_std::Timestamp;
    use time::macros::datetime;

    #[test]
@@ -61,9 +61,7 @@ pub enum VestingContractError {
    #[error("VESTING ({l}): No bond found for account {0}", l = line!())]
    NoBondFound(String),

-    #[error(
-        "VESTING: Attempted to reduce mixnode bond pledge below zero! The current pledge is {current} and we attempted to reduce it by {decrease_by}."
-    )]
+    #[error("VESTING: Attempted to reduce mixnode bond pledge below zero! The current pledge is {current} and we attempted to reduce it by {decrease_by}.")]
    InvalidBondPledgeReduction { current: Coin, decrease_by: Coin },

    #[error("VESTING ({l}): Action can only be executed by account owner -> {0}", l = line!())]
@@ -87,17 +85,13 @@ pub enum VestingContractError {
    #[error("VESTING: ({l}: Account owned by {owner} has unpopulated vesting periods!", l = line!())]
    UnpopulatedVestingPeriods { owner: Addr },

-    #[error(
-        "VESTING: Vesting account associated with {0} already exists, only addresses with not existing vesting accounts can be added as staking addresses"
-    )]
+    #[error("VESTING: Vesting account associated with {0} already exists, only addresses with not existing vesting accounts can be added as staking addresses")]
    StakingAccountExists(String),

    #[error("VESTING: {address} is not permitted to perform staking on behalf of {for_account}")]
    InvalidStakingAccount { address: Addr, for_account: Addr },

-    #[error(
-        "VESTING: {address} ({acc_id} has already performed {num} individual delegations towards {mix_id}. No further delegations are allowed. Please consider consolidating those delegations instead. The current cap is {cap}."
-    )]
+    #[error("VESTING: {address} ({acc_id} has already performed {num} individual delegations towards {mix_id}. No further delegations are allowed. Please consider consolidating those delegations instead. The current cap is {cap}.")]
    TooManyDelegations {
        address: Addr,
        acc_id: VestingAccountStorageKey,
@@ -6,9 +6,9 @@ use contracts_common::signing::MessageSignature;
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::{Coin, Timestamp};
 use mixnet_contract_common::{
-    Gateway, MixNode, NodeId,
    gateway::GatewayConfigUpdate,
    mixnode::{MixNodeConfigUpdate, NodeCostParams},
+    Gateway, MixNode, NodeId,
 };

 #[cfg(feature = "schema")]
@@ -18,10 +18,10 @@ use cosmwasm_schema::QueryResponses;

 #[cfg(feature = "schema")]
 use crate::{
-    AccountsResponse, AllDelegationsResponse, DelegationTimesResponse, OriginalVestingResponse,
-    VestingCoinsResponse,
    account::Account,
    types::{Period, PledgeData, VestingDelegation},
+    AccountsResponse, AllDelegationsResponse, DelegationTimesResponse, OriginalVestingResponse,
+    VestingCoinsResponse,
 };

 #[cw_serde]
@@ -42,7 +42,6 @@ nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract
 nym-compact-ecash = { path = "../nym_offline_compact_ecash" }
 nym-validator-client = { path = "../client-libs/validator-client" }
 nym-network-defaults = { path = "../network-defaults" }
-nym-cache = { path = "../nym-cache" }

 [dev-dependencies]
 tempfile = { workspace = true }
@@ -2,18 +2,12 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use crate::error::CredentialProxyError;
-use crate::shared_state::nyxd_client::ChainClient;
 use crate::storage::models::StorableEcashDeposit;
 use nym_compact_ecash::WithdrawalRequest;
 use nym_credentials::IssuanceTicketBook;
 use nym_crypto::asymmetric::ed25519;
-use nym_validator_client::nyxd::cosmwasm_client::ContractResponseData;
 use nym_validator_client::nyxd::{Coin, Hash};
-use rand::rngs::OsRng;
-use std::fmt::Debug;
 use time::OffsetDateTime;
-use tokio_util::sync::CancellationToken;
-use tracing::{error, info, instrument};
 use zeroize::Zeroizing;

 pub struct BufferedDeposit {
@@ -82,87 +76,7 @@ impl PerformedDeposits {
    }
 }

-#[instrument(skip(client, cancellation_on_critical_failure), err(Display))]
-pub async fn make_deposits_request(
-    client: &ChainClient,
-    deposit_amount: Coin,
-    memo: impl Into<String> + Debug,
-    amount: usize,
-    cancellation_on_critical_failure: &CancellationToken,
-) -> Result<PerformedDeposits, CredentialProxyError> {
-    let requested_on = OffsetDateTime::now_utc();
-    let chain_write_permit = client.start_chain_tx().await;
-    let mut rng = OsRng;
-
-    let keys = (0..amount)
-        .map(|_| ed25519::PrivateKey::new(&mut rng))
-        .collect::<Vec<_>>();
-
-    info!("starting {amount} deposits");
-    let mut contents = Vec::new();
-    for key in &keys {
-        let public_key: ed25519::PublicKey = key.into();
-        contents.push((public_key.to_base58_string(), deposit_amount.clone()));
-    }
-
-    let execute_res = chain_write_permit
-        .make_deposits(memo.into(), contents)
-        .await?;
-
-    let tx_hash = execute_res.transaction_hash;
-    info!("{amount} deposits made in transaction: {tx_hash}");
-
-    let contract_data = match execute_res.to_contract_data() {
-        Ok(contract_data) => contract_data,
-        Err(err) => {
-            // that one is tricky. deposits technically got made, but we somehow failed to parse response,
-            // in this case terminate the proxy with 0 exit code so it wouldn't get automatically restarted
-            // because it requires some serious MANUAL intervention
-            error!(
-                "CRITICAL FAILURE: failed to parse out deposit information from the contract transaction. either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually. error was: {err}"
-            );
-            cancellation_on_critical_failure.cancel();
-            return Err(CredentialProxyError::DepositFailure);
-        }
-    };
-
-    if contract_data.len() != amount {
-        // another critical failure, that one should be quite impossible and thus has to be manually inspected
-        error!(
-            "CRITICAL FAILURE: failed to parse out all deposit information from the contract transaction. got {} responses while we sent {amount} deposits! either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually",
-            contract_data.len()
-        );
-        cancellation_on_critical_failure.cancel();
-        return Err(CredentialProxyError::DepositFailure);
-    }
-
-    let mut deposits_data = Vec::new();
-    for (key, response) in keys.into_iter().zip(contract_data) {
-        let response_index = response.message_index;
-        let deposit_id = match response.parse_singleton_u32_contract_data() {
-            Ok(deposit_id) => deposit_id,
-            Err(err) => {
-                // another impossibility
-                error!(
-                    "CRITICAL FAILURE: failed to parse out deposit id out of the response at index {response_index}: {err}. either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually"
-                );
-                cancellation_on_critical_failure.cancel();
-                return Err(CredentialProxyError::DepositFailure);
-            }
-        };
-
-        deposits_data.push(BufferedDeposit::new(deposit_id, key));
-    }
-
-    Ok(PerformedDeposits {
-        deposits_data,
-        tx_hash,
-        requested_on,
-        deposit_amount,
-    })
-}
-
-pub fn split_deposits(total: usize, max_request_size: usize) -> impl Iterator<Item = usize> {
+pub(super) fn request_sizes(total: usize, max_request_size: usize) -> impl Iterator<Item = usize> {
    (0..total)
        .step_by(max_request_size)
        .map(move |start| std::cmp::min(max_request_size, total - start))
@@ -175,13 +89,13 @@ mod tests {
    #[test]
    fn request_sizes_test() {
        assert_eq!(
-            split_deposits(100, 32).collect::<Vec<_>>(),
+            request_sizes(100, 32).collect::<Vec<_>>(),
            vec![32, 32, 32, 4]
        );

-        assert_eq!(split_deposits(10, 32).collect::<Vec<_>>(), vec![10]);
-        assert_eq!(split_deposits(32, 32).collect::<Vec<_>>(), vec![32]);
-        assert_eq!(split_deposits(33, 32).collect::<Vec<_>>(), vec![32, 1]);
-        assert_eq!(split_deposits(1, 32).collect::<Vec<_>>(), vec![1]);
+        assert_eq!(request_sizes(10, 32).collect::<Vec<_>>(), vec![10]);
+        assert_eq!(request_sizes(32, 32).collect::<Vec<_>>(), vec![32]);
+        assert_eq!(request_sizes(33, 32).collect::<Vec<_>>(), vec![32, 1]);
+        assert_eq!(request_sizes(1, 32).collect::<Vec<_>>(), vec![1]);
    }
 }
@@ -1,23 +1,27 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

+use crate::deposits_buffer::helpers::request_sizes;
 use crate::deposits_buffer::refill_task::RefillTask;
 use crate::error::CredentialProxyError;
 use crate::shared_state::nyxd_client::ChainClient;
 use crate::shared_state::required_deposit_cache::RequiredDepositCache;
 use crate::storage::CredentialProxyStorage;
 use nym_compact_ecash::PublicKeyUser;
+use nym_crypto::asymmetric::ed25519;
 use nym_ecash_contract_common::deposit::DepositId;
+use nym_validator_client::nyxd::cosmwasm_client::ContractResponseData;
 use nym_validator_client::nyxd::Coin;
+use rand::rngs::OsRng;
 use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 use tokio::sync::Mutex as AsyncMutex;
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, info, instrument, warn};
+use tracing::{debug, error, info, instrument, warn};
 use uuid::Uuid;

-pub use helpers::{BufferedDeposit, PerformedDeposits, make_deposits_request, split_deposits};
+pub use helpers::{BufferedDeposit, PerformedDeposits};

 pub(crate) mod helpers;
 mod refill_task;
@@ -85,20 +89,70 @@ impl DepositsBuffer {
        &self,
        amount: usize,
    ) -> Result<PerformedDeposits, CredentialProxyError> {
-        let memo = format!(
-            "credential-proxy-{}: performing {amount} deposits",
-            self.inner.short_sha
-        );
-        let deposit_amount = self.deposit_amount().await?;
+        let requested_on = OffsetDateTime::now_utc();
+        let chain_write_permit = self.inner.client.start_chain_tx().await;
+        let mut rng = OsRng;

-        make_deposits_request(
-            &self.inner.client,
+        let deposit_amount = self.deposit_amount().await?;
+        let keys = (0..amount)
+            .map(|_| ed25519::PrivateKey::new(&mut rng))
+            .collect::<Vec<_>>();
+
+        info!("starting {amount} deposits");
+        let mut contents = Vec::new();
+        for key in &keys {
+            let public_key: ed25519::PublicKey = key.into();
+            contents.push((public_key.to_base58_string(), deposit_amount.clone()));
+        }
+
+        let execute_res = chain_write_permit
+            .make_deposits(self.inner.short_sha, contents)
+            .await?;
+
+        let tx_hash = execute_res.transaction_hash;
+        info!("{amount} deposits made in transaction: {tx_hash}");
+
+        let contract_data = match execute_res.to_contract_data() {
+            Ok(contract_data) => contract_data,
+            Err(err) => {
+                // that one is tricky. deposits technically got made, but we somehow failed to parse response,
+                // in this case terminate the proxy with 0 exit code so it wouldn't get automatically restarted
+                // because it requires some serious MANUAL intervention
+                error!("CRITICAL FAILURE: failed to parse out deposit information from the contract transaction. either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually. error was: {err}");
+                self.inner.cancellation_token.cancel();
+                return Err(CredentialProxyError::DepositFailure);
+            }
+        };
+
+        if contract_data.len() != amount {
+            // another critical failure, that one should be quite impossible and thus has to be manually inspected
+            error!("CRITICAL FAILURE: failed to parse out all deposit information from the contract transaction. got {} responses while we sent {amount} deposits! either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually", contract_data.len());
+            self.inner.cancellation_token.cancel();
+            return Err(CredentialProxyError::DepositFailure);
+        }
+
+        let mut deposits_data = Vec::new();
+        for (key, response) in keys.into_iter().zip(contract_data) {
+            let response_index = response.message_index;
+            let deposit_id = match response.parse_singleton_u32_contract_data() {
+                Ok(deposit_id) => deposit_id,
+                Err(err) => {
+                    // another impossibility
+                    error!("CRITICAL FAILURE: failed to parse out deposit id out of the response at index {response_index}: {err}. either the chain got upgraded and the schema changed or the ecash contract got changed! terminating the process. it has to be inspected manually");
+                    self.inner.cancellation_token.cancel();
+                    return Err(CredentialProxyError::DepositFailure);
+                }
+            };
+
+            deposits_data.push(BufferedDeposit::new(deposit_id, key));
+        }
+
+        Ok(PerformedDeposits {
+            deposits_data,
+            tx_hash,
+            requested_on,
            deposit_amount,
-            &memo,
-            amount,
-            &self.inner.cancellation_token,
-        )
-        .await
+        })
    }

    async fn insert_new_deposits(
@@ -126,7 +180,7 @@ impl DepositsBuffer {
        let target = self.deposits_upper_threshold();
        let to_request = target - available;

-        for request_chunk in split_deposits(to_request, self.inner.max_concurrent_deposits) {
+        for request_chunk in request_sizes(to_request, self.inner.max_concurrent_deposits) {
            // note: we check for cancellation between individual requests
            // as opposed to wrapping that in tokio::select! so that we would never abandon chain operations
            // as we wouldn't want to lose funds
@@ -219,9 +273,7 @@ impl DepositsBuffer {

        match maybe_deposit {
            None => {
-                warn!(
-                    "we currently don't have any usable deposits! are we using them up faster than we request them?"
-                );
+                warn!("we currently don't have any usable deposits! are we using them up faster than we request them?");

                // we have to wait until refill task has completed (either initiated by this or another fn call)
                self.wait_for_deposit(request_uuid, requested_on, client_pubkey)
@@ -244,9 +296,7 @@ impl DepositsBuffer {
        let task_handle = self.inner.deposits_refill_task.take_task_join_handle();
        if let Some(task_handle) = task_handle {
            if !task_handle.is_finished() {
-                info!(
-                    "the deposit refill task is currently in progress - waiting for the current transaction to finish before concluding shutdown"
-                );
+                info!("the deposit refill task is currently in progress - waiting for the current transaction to finish before concluding shutdown");
                let _ = task_handle.await;
            }
        }
@@ -42,9 +42,7 @@ impl RefillTask {

        if let Some(existing_handle) = guard.as_ref() {
            if !existing_handle.is_finished() {
-                error!(
-                    "CRITICAL BUG: there was already a deposit refill task spawned that hasn't yet finished"
-                )
+                error!("CRITICAL BUG: there was already a deposit refill task spawned that hasn't yet finished")
            }
        }

@@ -3,7 +3,7 @@

 use nym_ecash_signer_check::SignerCheckError;
 use nym_validator_client::coconut::EcashApiError;
-use nym_validator_client::nym_api::{EpochId, error::NymAPIError};
+use nym_validator_client::nym_api::{error::NymAPIError, EpochId};
 use nym_validator_client::nyxd::error::NyxdError;
 use std::io;
 use std::net::SocketAddr;
@@ -33,9 +33,7 @@ pub enum CredentialProxyError {
    #[error("the provided expiration date is too early")]
    ExpirationDateTooEarly,

-    #[error(
-        "failed to bind to {address}: {source}. Are you sure nothing else is running on the specified port and your user has sufficient permission to bind to the requested address?"
-    )]
+    #[error("failed to bind to {address}: {source}. Are you sure nothing else is running on the specified port and your user has sufficient permission to bind to the requested address?")]
    SocketBindFailure {
        address: SocketAddr,
        source: io::Error,
@@ -91,7 +89,7 @@ pub enum CredentialProxyError {
    InsufficientNumberOfSigners { available: usize, threshold: u64 },

    #[error(
-        "we have only managed to obtain {available} partial credentials while the minimum threshold is {threshold}"
+    "we have only managed to obtain {available} partial credentials while the minimum threshold is {threshold}"
    )]
    InsufficientNumberOfCredentials { available: usize, threshold: u64 },

@@ -104,9 +102,7 @@ pub enum CredentialProxyError {
    #[error("the DKG has not yet been initialised in the system")]
    UninitialisedDkg,

-    #[error(
-        "credentials can't yet be issued in the system. approximate expected availability: {availability}"
-    )]
+    #[error("credentials can't yet be issued in the system. approximate expected availability: {availability}")]
    CredentialsNotYetIssuable { availability: OffsetDateTime },

    #[error("reached seemingly impossible ecash failure")]
@@ -144,9 +140,7 @@ pub enum CredentialProxyError {
    #[error("failed to obtain wallet shares with id {id}: {message}")]
    ShareByIdLoadError { message: String, id: i64 },

-    #[error(
-        "failed to obtain wallet shares with device_id {device_id} and credential_id: {credential_id}: {message}"
-    )]
+    #[error("failed to obtain wallet shares with device_id {device_id} and credential_id: {credential_id}: {message}")]
    ShareByDeviceLoadError {
        message: String,
        device_id: String,
@@ -1,8 +1,8 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

-use rand::RngCore;
 use rand::rngs::OsRng;
+use rand::RngCore;
 use time::OffsetDateTime;
 use tracing::{debug, info, warn};
 use uuid::Uuid;
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::CredentialProxyError;
-use axum::Json;
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
+use axum::Json;
 use nym_credential_proxy_requests::api::v1::ErrorResponse;
 use tracing::warn;
 use uuid::Uuid;
@@ -5,16 +5,18 @@
 // it should have been therefore extracted to a common crate instead and imported as dependency

 use crate::error::CredentialProxyError;
-use futures::{StreamExt, stream};
-use nym_cache::CachedImmutableItems;
-use nym_credentials::ecash::utils::{EcashTime, cred_exp_date, ecash_today};
-use nym_validator_client::EcashApiClient;
+use futures::{stream, StreamExt};
+use nym_credentials::ecash::utils::{cred_exp_date, ecash_today, EcashTime};
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::dkg_query_client::Epoch;
+use nym_validator_client::EcashApiClient;
 use std::cmp::min;
+use std::collections::HashMap;
 use std::future::Future;
+use std::hash::Hash;
+use std::ops::Deref;
 use time::{Date, OffsetDateTime};
-use tokio::sync::Mutex;
+use tokio::sync::{Mutex, RwLock, RwLockReadGuard};
 use tracing::warn;

 pub struct CachedEpoch {
@@ -55,9 +57,74 @@ impl CachedEpoch {
    }
 }

+// a map of items that never change for given key
+pub struct CachedImmutableItems<K, V> {
+    // I wonder if there's a more efficient structure with OnceLock or OnceCell or something
+    inner: RwLock<HashMap<K, V>>,
+}
+
 // an item that stays constant throughout given epoch
 pub type CachedImmutableEpochItem<T> = CachedImmutableItems<EpochId, T>;

+impl<K, V> Default for CachedImmutableItems<K, V> {
+    fn default() -> Self {
+        CachedImmutableItems {
+            inner: RwLock::new(HashMap::new()),
+        }
+    }
+}
+
+impl<K, V> Deref for CachedImmutableItems<K, V> {
+    type Target = RwLock<HashMap<K, V>>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+impl<K, V> CachedImmutableItems<K, V>
+where
+    K: Eq + Hash,
+{
+    pub async fn get_or_init<F, U, E>(&self, key: K, f: F) -> Result<RwLockReadGuard<'_, V>, E>
+    where
+        F: FnOnce() -> U,
+        U: Future<Output = Result<V, E>>,
+        K: Clone,
+    {
+        // 1. see if we already have the item cached
+        let guard = self.inner.read().await;
+        if let Ok(item) = RwLockReadGuard::try_map(guard, |map| map.get(&key)) {
+            return Ok(item);
+        }
+
+        // 2. attempt to retrieve (and cache) it
+        let mut write_guard = self.inner.write().await;
+
+        // see if another task has already set the item whilst we were waiting for the lock
+        if write_guard.get(&key).is_some() {
+            let read_guard = write_guard.downgrade();
+
+            // SAFETY: we just checked the entry exists and we never dropped the guard
+            #[allow(clippy::unwrap_used)]
+            return Ok(RwLockReadGuard::map(read_guard, |map| {
+                map.get(&key).unwrap()
+            }));
+        }
+
+        let init = f().await?;
+        write_guard.insert(key.clone(), init);
+
+        let guard = write_guard.downgrade();
+
+        // SAFETY:
+        // we just inserted the entry into the map while NEVER dropping the lock (only downgraded it)
+        // so it MUST exist and thus the unwrap is fine
+        #[allow(clippy::unwrap_used)]
+        Ok(RwLockReadGuard::map(guard, |map| map.get(&key).unwrap()))
+    }
+}
+
 pub fn ensure_sane_expiration_date(expiration_date: Date) -> Result<(), CredentialProxyError> {
    let today = ecash_today();

@@ -5,8 +5,8 @@ use crate::error::CredentialProxyError;
 use crate::shared_state::nyxd_client::ChainClient;
 use nym_ecash_signer_check::{check_known_dealers, dkg_details_with_client};
 use std::ops::Deref;
-use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
 use std::time::Duration;
 use tokio_util::sync::CancellationToken;
 use tracing::{error, info, warn};
@@ -67,9 +67,7 @@ impl QuorumStateChecker {
        let res = check_known_dealers(dkg_details).await?;

        let Some(signing_threshold) = res.threshold else {
-            warn!(
-                "signing threshold is currently unavailable and we have not yet implemented credential issuance during DKG transition"
-            );
+            warn!("signing threshold is currently unavailable and we have not yet implemented credential issuance during DKG transition");
            return Ok(false);
        };

@@ -1,37 +1,15 @@
 // Copyright 2025 Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

-use crate::error::CredentialProxyError;
-use crate::nym_api_helpers::{
-    CachedEpoch, CachedImmutableEpochItem, ensure_sane_expiration_date, query_all_threshold_apis,
-};
+use crate::nym_api_helpers::{CachedEpoch, CachedImmutableEpochItem, CachedImmutableItems};
 use crate::quorum_checker::QuorumState;
-use crate::shared_state::nyxd_client::ChainClient;
 use crate::shared_state::required_deposit_cache::RequiredDepositCache;
-use crate::storage::traits::GlobalEcashDataCache;
-use nym_cache::CachedImmutableItems;
-use nym_compact_ecash::scheme::coin_indices_signatures::aggregate_annotated_indices_signatures;
-use nym_compact_ecash::scheme::expiration_date_signatures::aggregate_annotated_expiration_signatures;
-use nym_credentials::ecash::utils::EcashTime;
-use nym_credentials::{
-    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures, EpochVerificationKey,
-};
-use nym_validator_client::EcashApiClient;
-use nym_validator_client::client::NymApiClientExt;
-use nym_validator_client::coconut::EcashApiError;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::{AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures};
 use nym_validator_client::nym_api::EpochId;
-use nym_validator_client::nyxd::Coin;
-use nym_validator_client::nyxd::contract_traits::dkg_query_client::Epoch;
-use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
-use time::{Date, OffsetDateTime};
-use tokio::sync::{RwLock, RwLockReadGuard};
-use tracing::info;
-
-pub use nym_compact_ecash::VerificationKeyAuth;
-pub use nym_compact_ecash::scheme::coin_indices_signatures::CoinIndexSignatureShare;
-pub use nym_compact_ecash::scheme::expiration_date_signatures::ExpirationDateSignatureShare;
-pub use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
-pub use nym_credentials_interface::{TicketType, TicketTypeRepr};
+use nym_validator_client::EcashApiClient;
+use time::Date;
+use tokio::sync::RwLock;

 pub struct EcashState {
    pub required_deposit_cache: RequiredDepositCache,
@@ -68,309 +46,4 @@ impl EcashState {
            expiration_date_signatures: Default::default(),
        }
    }
-
-    pub async fn ensure_credentials_issuable(
-        &self,
-        client: &ChainClient,
-    ) -> Result<(), CredentialProxyError> {
-        let epoch = self.current_epoch(client).await?;
-
-        if epoch.state.is_final() {
-            Ok(())
-        } else if let Some(final_timestamp) = epoch.final_timestamp_secs() {
-            // SAFETY: the timestamp values in our DKG contract should be valid timestamps,
-            // otherwise it means the chain is seriously misbehaving
-            #[allow(clippy::unwrap_used)]
-            let finish_dt = OffsetDateTime::from_unix_timestamp(final_timestamp as i64).unwrap();
-
-            Err(CredentialProxyError::CredentialsNotYetIssuable {
-                availability: finish_dt,
-            })
-        } else if epoch.state.is_waiting_initialisation() {
-            Err(CredentialProxyError::UninitialisedDkg)
-        } else {
-            Err(CredentialProxyError::UnknownEcashFailure)
-        }
-    }
-
-    pub async fn deposit_amount(&self, client: &ChainClient) -> Result<Coin, CredentialProxyError> {
-        self.required_deposit_cache.get_or_update(client).await
-    }
-
-    pub async fn ecash_clients(
-        &self,
-        client: &ChainClient,
-        epoch_id: EpochId,
-    ) -> Result<RwLockReadGuard<'_, Vec<EcashApiClient>>, CredentialProxyError> {
-        self.epoch_clients
-            .get_or_init(epoch_id, || async {
-                Ok(client
-                    .query_chain()
-                    .await
-                    .get_all_verification_key_shares(epoch_id)
-                    .await?
-                    .into_iter()
-                    .map(TryInto::try_into)
-                    .collect::<anyhow::Result<Vec<_>, EcashApiError>>()?)
-            })
-            .await
-    }
-
-    pub async fn current_epoch(&self, client: &ChainClient) -> Result<Epoch, CredentialProxyError> {
-        let read_guard = self.cached_epoch.read().await;
-        if read_guard.is_valid() {
-            return Ok(read_guard.current_epoch);
-        }
-
-        // update cache
-        drop(read_guard);
-        let mut write_guard = self.cached_epoch.write().await;
-        let epoch = client.query_chain().await.get_current_epoch().await?;
-
-        write_guard.update(epoch);
-        Ok(epoch)
-    }
-
-    pub async fn current_epoch_id(
-        &self,
-        client: &ChainClient,
-    ) -> Result<EpochId, CredentialProxyError> {
-        let read_guard = self.cached_epoch.read().await;
-        if read_guard.is_valid() {
-            return Ok(read_guard.current_epoch.epoch_id);
-        }
-
-        // update cache
-        drop(read_guard);
-        let mut write_guard = self.cached_epoch.write().await;
-        let epoch = client.query_chain().await.get_current_epoch().await?;
-
-        write_guard.update(epoch);
-        Ok(epoch.epoch_id)
-    }
-
-    pub async fn master_verification_key<S>(
-        &self,
-        client: &ChainClient,
-        storage: &S,
-        epoch_id: Option<EpochId>,
-    ) -> Result<RwLockReadGuard<'_, VerificationKeyAuth>, CredentialProxyError>
-    where
-        S: GlobalEcashDataCache,
-    {
-        let epoch_id = match epoch_id {
-            Some(id) => id,
-            None => self.current_epoch_id(client).await?,
-        };
-
-        self.master_verification_key
-            .get_or_init(epoch_id, || async {
-                // 1. check the storage
-                if let Some(stored) = storage.get_master_verification_key(epoch_id).await? {
-                    return Ok(stored.key);
-                }
-
-                info!("attempting to establish master verification key for epoch {epoch_id}...");
-
-                // 2. perform actual aggregation
-                let all_apis = self.ecash_clients(client, epoch_id).await?;
-                let threshold = self.ecash_threshold(client, epoch_id).await?;
-
-                if all_apis.len() < threshold as usize {
-                    return Err(CredentialProxyError::InsufficientNumberOfSigners {
-                        threshold,
-                        available: all_apis.len(),
-                    });
-                }
-
-                let master_key = nym_credentials::aggregate_verification_keys(&all_apis)?;
-
-                let epoch = EpochVerificationKey {
-                    epoch_id,
-                    key: master_key,
-                };
-
-                // 3. save the key in the storage for when we reboot
-                storage.insert_master_verification_key(&epoch).await?;
-
-                Ok(epoch.key)
-            })
-            .await
-    }
-
-    pub async fn master_coin_index_signatures<S>(
-        &self,
-        client: &ChainClient,
-        storage: &S,
-        epoch_id: Option<EpochId>,
-    ) -> Result<RwLockReadGuard<'_, AggregatedCoinIndicesSignatures>, CredentialProxyError>
-    where
-        S: GlobalEcashDataCache,
-    {
-        let epoch_id = match epoch_id {
-            Some(id) => id,
-            None => self.current_epoch_id(client).await?,
-        };
-
-        self.coin_index_signatures
-            .get_or_init(epoch_id, || async {
-                // 1. check the storage
-                if let Some(master_sigs) =
-                    storage.get_master_coin_index_signatures(epoch_id).await?
-                {
-                    return Ok(master_sigs);
-                }
-
-                info!(
-                    "attempting to establish master coin index signatures for epoch {epoch_id}..."
-                );
-
-                // 2. go around APIs and attempt to aggregate the data
-                let master_vk = self
-                    .master_verification_key(client, storage, Some(epoch_id))
-                    .await?;
-                let all_apis = self.ecash_clients(client, epoch_id).await?;
-                let threshold = self.ecash_threshold(client, epoch_id).await?;
-
-                let get_partial_signatures = |api: EcashApiClient| async {
-                    // move the api into the closure
-                    let api = api;
-                    let node_index = api.node_id;
-                    let partial_vk = api.verification_key;
-
-                    let partial = api
-                        .api_client
-                        .partial_coin_indices_signatures(Some(epoch_id))
-                        .await?
-                        .signatures;
-                    Ok(CoinIndexSignatureShare {
-                        index: node_index,
-                        key: partial_vk,
-                        signatures: partial,
-                    })
-                };
-
-                let shares =
-                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
-                        .await?;
-
-                let aggregated = aggregate_annotated_indices_signatures(
-                    nym_credentials_interface::ecash_parameters(),
-                    &master_vk,
-                    &shares,
-                )?;
-
-                let sigs = AggregatedCoinIndicesSignatures {
-                    epoch_id,
-                    signatures: aggregated,
-                };
-
-                // 3. save the signatures in the storage for when we reboot
-                storage.insert_master_coin_index_signatures(&sigs).await?;
-
-                Ok(sigs)
-            })
-            .await
-    }
-
-    pub async fn master_expiration_date_signatures<S>(
-        &self,
-        client: &ChainClient,
-        storage: &S,
-        epoch_id: EpochId,
-        expiration_date: Date,
-    ) -> Result<RwLockReadGuard<'_, AggregatedExpirationDateSignatures>, CredentialProxyError>
-    where
-        S: GlobalEcashDataCache,
-    {
-        self
-            .expiration_date_signatures
-            .get_or_init((epoch_id, expiration_date), || async {
-                // 1. sanity check to see if the expiration_date is not nonsense
-                ensure_sane_expiration_date(expiration_date)?;
-
-                // 2. check the storage
-                if let Some(master_sigs) = storage
-                    .get_master_expiration_date_signatures(expiration_date, epoch_id)
-                    .await?
-                {
-                    return Ok(master_sigs);
-                }
-
-
-                info!(
-                    "attempting to establish master expiration date signatures for {expiration_date} and epoch {epoch_id}..."
-                );
-
-                // 3. go around APIs and attempt to aggregate the data
-                let epoch_id = self.current_epoch_id(client).await?;
-                let master_vk = self.master_verification_key(client, storage, Some(epoch_id)).await?;
-                let all_apis = self.ecash_clients(client, epoch_id).await?;
-                let threshold = self.ecash_threshold(client, epoch_id).await?;
-
-                let get_partial_signatures = |api: EcashApiClient| async {
-                    // move the api into the closure
-                    let api = api;
-                    let node_index = api.node_id;
-                    let partial_vk = api.verification_key;
-
-                    let partial = api
-                        .api_client
-                        .partial_expiration_date_signatures(Some(expiration_date), Some(epoch_id))
-                        .await?
-                        .signatures;
-                    Ok(ExpirationDateSignatureShare {
-                        index: node_index,
-                        key: partial_vk,
-                        signatures: partial,
-                    })
-                };
-
-                let shares =
-                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
-                        .await?;
-
-                let aggregated = aggregate_annotated_expiration_signatures(
-                    &master_vk,
-                    expiration_date.ecash_unix_timestamp(),
-                    &shares,
-                )?;
-
-                let sigs = AggregatedExpirationDateSignatures {
-                    epoch_id,
-                    expiration_date,
-                    signatures: aggregated,
-                };
-
-                // 4. save the signatures in the storage for when we reboot
-                storage
-                    .insert_master_expiration_date_signatures(&sigs)
-                    .await?;
-
-                Ok(sigs)
-            })
-            .await
-    }
-
-    pub async fn ecash_threshold(
-        &self,
-        client: &ChainClient,
-        epoch_id: EpochId,
-    ) -> Result<u64, CredentialProxyError> {
-        self.threshold_values
-            .get_or_init(epoch_id, || async {
-                if let Some(threshold) = client
-                    .query_chain()
-                    .await
-                    .get_epoch_threshold(epoch_id)
-                    .await?
-                {
-                    Ok(threshold)
-                } else {
-                    Err(CredentialProxyError::UnavailableThreshold { epoch_id })
-                }
-            })
-            .await
-            .map(|t| *t)
-    }
 }
@@ -3,26 +3,39 @@

 use crate::deposits_buffer::{BufferedDeposit, DepositsBuffer};
 use crate::error::CredentialProxyError;
+use crate::nym_api_helpers::{ensure_sane_expiration_date, query_all_threshold_apis};
 use crate::shared_state::ecash_state::EcashState;
 use crate::shared_state::nyxd_client::ChainClient;
 use crate::storage::CredentialProxyStorage;
+use nym_compact_ecash::scheme::coin_indices_signatures::{
+    aggregate_annotated_indices_signatures, CoinIndexSignatureShare,
+};
+use nym_compact_ecash::scheme::expiration_date_signatures::{
+    aggregate_annotated_expiration_signatures, ExpirationDateSignatureShare,
+};
 use nym_compact_ecash::{Base58, PublicKeyUser, VerificationKeyAuth};
 use nym_credential_proxy_requests::api::v1::ticketbook::models::{
    AggregatedCoinIndicesSignaturesResponse, AggregatedExpirationDateSignaturesResponse,
    GlobalDataParams, MasterVerificationKeyResponse,
 };
-use nym_credentials::{AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures};
+use nym_credentials::ecash::utils::EcashTime;
+use nym_credentials::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures, EpochVerificationKey,
+};
 use nym_ecash_contract_common::deposit::DepositId;
-use nym_validator_client::EcashApiClient;
+use nym_validator_client::client::NymApiClientExt;
+use nym_validator_client::coconut::EcashApiError;
 use nym_validator_client::nym_api::EpochId;
-use nym_validator_client::nyxd::Coin;
 use nym_validator_client::nyxd::contract_traits::dkg_query_client::Epoch;
+use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
+use nym_validator_client::nyxd::Coin;
+use nym_validator_client::{DirectSigningHttpRpcNyxdClient, EcashApiClient};
 use std::sync::Arc;
 use std::time::Duration;
 use time::{Date, OffsetDateTime};
 use tokio::sync::RwLockReadGuard;
 use tokio::time::Instant;
-use tracing::{debug, error, warn};
+use tracing::{debug, error, info, warn};
 use uuid::Uuid;

 pub mod ecash_state;
@@ -56,7 +69,10 @@ impl CredentialProxyState {
    }

    pub async fn deposit_amount(&self) -> Result<Coin, CredentialProxyError> {
-        self.ecash_state().deposit_amount(self.client()).await
+        self.ecash_state()
+            .required_deposit_cache
+            .get_or_update(self.client())
+            .await
    }

    pub fn client(&self) -> &ChainClient {
@@ -71,10 +87,29 @@ impl CredentialProxyState {
        &self.inner.ecash_state
    }

+    pub(crate) async fn query_chain(&self) -> RwLockReadGuard<'_, DirectSigningHttpRpcNyxdClient> {
+        self.inner.client.query_chain().await
+    }
+
    pub async fn ensure_credentials_issuable(&self) -> Result<(), CredentialProxyError> {
-        self.ecash_state()
-            .ensure_credentials_issuable(self.client())
-            .await
+        let epoch = self.current_epoch().await?;
+
+        if epoch.state.is_final() {
+            Ok(())
+        } else if let Some(final_timestamp) = epoch.final_timestamp_secs() {
+            // SAFETY: the timestamp values in our DKG contract should be valid timestamps,
+            // otherwise it means the chain is seriously misbehaving
+            #[allow(clippy::unwrap_used)]
+            let finish_dt = OffsetDateTime::from_unix_timestamp(final_timestamp as i64).unwrap();
+
+            Err(CredentialProxyError::CredentialsNotYetIssuable {
+                availability: finish_dt,
+            })
+        } else if epoch.state.is_waiting_initialisation() {
+            Err(CredentialProxyError::UninitialisedDkg)
+        } else {
+            Err(CredentialProxyError::UnknownEcashFailure)
+        }
    }

    pub async fn get_deposit(
@@ -92,9 +127,7 @@ impl CredentialProxyState {
        let time_taken = start.elapsed();
        let formatted = humantime::format_duration(time_taken);
        if time_taken > Duration::from_secs(10) {
-            warn!(
-                "attempting to get buffered deposit took {formatted}. perhaps the buffer is too small or the process/chain is overloaded?"
-            )
+            warn!("attempting to get buffered deposit took {formatted}. perhaps the buffer is too small or the process/chain is overloaded?")
        } else {
            debug!("attempting to get buffered deposit took {formatted}")
        };
@@ -108,18 +141,38 @@ impl CredentialProxyState {
            .insert_deposit_usage_error(deposit_id, error)
            .await
        {
-            error!(
-                "failed to insert information about deposit (id: {deposit_id}) usage failure: {err}"
-            )
+            error!("failed to insert information about deposit (id: {deposit_id}) usage failure: {err}")
        }
    }

    pub async fn current_epoch_id(&self) -> Result<EpochId, CredentialProxyError> {
-        self.ecash_state().current_epoch_id(self.client()).await
+        let read_guard = self.inner.ecash_state.cached_epoch.read().await;
+        if read_guard.is_valid() {
+            return Ok(read_guard.current_epoch.epoch_id);
+        }
+
+        // update cache
+        drop(read_guard);
+        let mut write_guard = self.inner.ecash_state.cached_epoch.write().await;
+        let epoch = self.query_chain().await.get_current_epoch().await?;
+
+        write_guard.update(epoch);
+        Ok(epoch.epoch_id)
    }

    pub async fn current_epoch(&self) -> Result<Epoch, CredentialProxyError> {
-        self.ecash_state().current_epoch(self.client()).await
+        let read_guard = self.ecash_state().cached_epoch.read().await;
+        if read_guard.is_valid() {
+            return Ok(read_guard.current_epoch);
+        }
+
+        // update cache
+        drop(read_guard);
+        let mut write_guard = self.ecash_state().cached_epoch.write().await;
+        let epoch = self.query_chain().await.get_current_epoch().await?;
+
+        write_guard.update(epoch);
+        Ok(epoch)
    }

    pub async fn global_data(
@@ -190,8 +243,53 @@ impl CredentialProxyState {
        &self,
        epoch_id: Option<EpochId>,
    ) -> Result<RwLockReadGuard<'_, VerificationKeyAuth>, CredentialProxyError> {
-        self.ecash_state()
-            .master_verification_key(self.client(), self.storage(), epoch_id)
+        let epoch_id = match epoch_id {
+            Some(id) => id,
+            None => self.current_epoch_id().await?,
+        };
+
+        self.inner
+            .ecash_state
+            .master_verification_key
+            .get_or_init(epoch_id, || async {
+                // 1. check the storage
+                if let Some(stored) = self
+                    .inner
+                    .storage
+                    .get_master_verification_key(epoch_id)
+                    .await?
+                {
+                    return Ok(stored.key);
+                }
+
+                info!("attempting to establish master verification key for epoch {epoch_id}...");
+
+                // 2. perform actual aggregation
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                if all_apis.len() < threshold as usize {
+                    return Err(CredentialProxyError::InsufficientNumberOfSigners {
+                        threshold,
+                        available: all_apis.len(),
+                    });
+                }
+
+                let master_key = nym_credentials::aggregate_verification_keys(&all_apis)?;
+
+                let epoch = EpochVerificationKey {
+                    epoch_id,
+                    key: master_key,
+                };
+
+                // 3. save the key in the storage for when we reboot
+                self.inner
+                    .storage
+                    .insert_master_verification_key(&epoch)
+                    .await?;
+
+                Ok(epoch.key)
+            })
            .await
    }

@@ -199,8 +297,75 @@ impl CredentialProxyState {
        &self,
        epoch_id: Option<EpochId>,
    ) -> Result<RwLockReadGuard<'_, AggregatedCoinIndicesSignatures>, CredentialProxyError> {
-        self.ecash_state()
-            .master_coin_index_signatures(self.client(), self.storage(), epoch_id)
+        let epoch_id = match epoch_id {
+            Some(id) => id,
+            None => self.current_epoch_id().await?,
+        };
+
+        self.inner
+            .ecash_state
+            .coin_index_signatures
+            .get_or_init(epoch_id, || async {
+                // 1. check the storage
+                if let Some(master_sigs) = self
+                    .inner
+                    .storage
+                    .get_master_coin_index_signatures(epoch_id)
+                    .await?
+                {
+                    return Ok(master_sigs);
+                }
+
+                info!(
+                    "attempting to establish master coin index signatures for epoch {epoch_id}..."
+                );
+
+                // 2. go around APIs and attempt to aggregate the data
+                let master_vk = self.master_verification_key(Some(epoch_id)).await?;
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                let get_partial_signatures = |api: EcashApiClient| async {
+                    // move the api into the closure
+                    let api = api;
+                    let node_index = api.node_id;
+                    let partial_vk = api.verification_key;
+
+                    let partial = api
+                        .api_client
+                        .partial_coin_indices_signatures(Some(epoch_id))
+                        .await?
+                        .signatures;
+                    Ok(CoinIndexSignatureShare {
+                        index: node_index,
+                        key: partial_vk,
+                        signatures: partial,
+                    })
+                };
+
+                let shares =
+                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
+                        .await?;
+
+                let aggregated = aggregate_annotated_indices_signatures(
+                    nym_credentials_interface::ecash_parameters(),
+                    &master_vk,
+                    &shares,
+                )?;
+
+                let sigs = AggregatedCoinIndicesSignatures {
+                    epoch_id,
+                    signatures: aggregated,
+                };
+
+                // 3. save the signatures in the storage for when we reboot
+                self.inner
+                    .storage
+                    .insert_master_coin_index_signatures(&sigs)
+                    .await?;
+
+                Ok(sigs)
+            })
            .await
    }

@@ -209,13 +374,73 @@ impl CredentialProxyState {
        epoch_id: EpochId,
        expiration_date: Date,
    ) -> Result<RwLockReadGuard<'_, AggregatedExpirationDateSignatures>, CredentialProxyError> {
-        self.ecash_state()
-            .master_expiration_date_signatures(
-                self.client(),
-                self.storage(),
-                epoch_id,
-                expiration_date,
-            )
+        self.inner.ecash_state
+            .expiration_date_signatures
+            .get_or_init((epoch_id, expiration_date), || async {
+                // 1. sanity check to see if the expiration_date is not nonsense
+                ensure_sane_expiration_date(expiration_date)?;
+
+                // 2. check the storage
+                if let Some(master_sigs) = self
+                    .storage()
+                    .get_master_expiration_date_signatures(expiration_date, epoch_id)
+                    .await?
+                {
+                    return Ok(master_sigs);
+                }
+
+
+                info!(
+                    "attempting to establish master expiration date signatures for {expiration_date} and epoch {epoch_id}..."
+                );
+
+                // 3. go around APIs and attempt to aggregate the data
+                let epoch_id = self.current_epoch_id().await?;
+                let master_vk = self.master_verification_key(Some(epoch_id)).await?;
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                let get_partial_signatures = |api: EcashApiClient| async {
+                    // move the api into the closure
+                    let api = api;
+                    let node_index = api.node_id;
+                    let partial_vk = api.verification_key;
+
+                    let partial = api
+                        .api_client
+                        .partial_expiration_date_signatures(Some(expiration_date), Some(epoch_id))
+                        .await?
+                        .signatures;
+                    Ok(ExpirationDateSignatureShare {
+                        index: node_index,
+                        key: partial_vk,
+                        signatures: partial,
+                    })
+                };
+
+                let shares =
+                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
+                        .await?;
+
+                let aggregated = aggregate_annotated_expiration_signatures(
+                    &master_vk,
+                    expiration_date.ecash_unix_timestamp(),
+                    &shares,
+                )?;
+
+                let sigs = AggregatedExpirationDateSignatures {
+                    epoch_id,
+                    expiration_date,
+                    signatures: aggregated,
+                };
+
+                // 4. save the signatures in the storage for when we reboot
+                self.inner.storage
+                    .insert_master_expiration_date_signatures(&sigs)
+                    .await?;
+
+                Ok(sigs)
+            })
            .await
    }

@@ -223,15 +448,40 @@ impl CredentialProxyState {
        &self,
        epoch_id: EpochId,
    ) -> Result<RwLockReadGuard<'_, Vec<EcashApiClient>>, CredentialProxyError> {
-        self.ecash_state()
-            .ecash_clients(self.client(), epoch_id)
+        self.inner
+            .ecash_state
+            .epoch_clients
+            .get_or_init(epoch_id, || async {
+                Ok(self
+                    .query_chain()
+                    .await
+                    .get_all_verification_key_shares(epoch_id)
+                    .await?
+                    .into_iter()
+                    .map(TryInto::try_into)
+                    .collect::<anyhow::Result<Vec<_>, EcashApiError>>()?)
+            })
            .await
    }

    pub async fn ecash_threshold(&self, epoch_id: EpochId) -> Result<u64, CredentialProxyError> {
-        self.ecash_state()
-            .ecash_threshold(self.client(), epoch_id)
+        self.inner
+            .ecash_state
+            .threshold_values
+            .get_or_init(epoch_id, || async {
+                if let Some(threshold) = self
+                    .query_chain()
+                    .await
+                    .get_epoch_threshold(epoch_id)
+                    .await?
+                {
+                    Ok(threshold)
+                } else {
+                    Err(CredentialProxyError::UnavailableThreshold { epoch_id })
+                }
+            })
            .await
+            .map(|t| *t)
    }
 }

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Floriane TUERNAL SABOTINOV	a19a6e3348	cleanup final	2025-10-21 13:10:10 +02:00
Floriane TUERNAL SABOTINOV	e9135d54fc	cleanup and PR ready	2025-10-20 11:22:42 +02:00
Floriane TUERNAL SABOTINOV	32f1ebebf9	refactor init tracer and use of tracing_opentelemetry span for async tracing	2025-10-17 11:27:45 +02:00
Floriane TUERNAL SABOTINOV	12f7f7b669	featurized otel	2025-10-16 13:53:52 +02:00
Floriane TUERNAL SABOTINOV	f3f75ae751	cleanup and add guard to keep the tracer provider alive	2025-10-14 09:33:54 +02:00
Floriane TUERNAL SABOTINOV	20c1717a65	continue trace)id propagation into sphinx	2025-10-08 16:14:05 +02:00
Floriane TUERNAL SABOTINOV	6ae78d9f4d	add trace_id to sphinx packet	2025-10-07 16:57:02 +02:00
Floriane TUERNAL SABOTINOV	afb2467afc	otel adaptation for sphinx instrumentation	2025-10-02 15:54:46 +02:00
Floriane TUERNAL SABOTINOV	44a7df511a	traceparent injection into headers	2025-10-01 10:35:21 +02:00
Floriane TUERNAL SABOTINOV	c89ca8075f	add traceparent to http headers	2025-09-30 12:30:00 +02:00
Floriane TUERNAL SABOTINOV	5f9f4fb1ab	websocket otel trace handling correction	2025-09-29 16:31:16 +02:00
Floriane TUERNAL SABOTINOV	75e146c301	wip	2025-09-26 13:33:47 +02:00
Floriane TUERNAL SABOTINOV	2ed1a0000b	wip	2025-09-26 13:33:47 +02:00
Floriane TUERNAL SABOTINOV	ee138fe751	add instrument to sdk send message	2025-09-26 13:33:47 +02:00
Floriane TUERNAL SABOTINOV	6b988e591d	wip	2025-09-26 13:33:47 +02:00
Floriane TUERNAL SABOTINOV	6cc12a4aad	debug node	2025-09-26 13:33:10 +02:00
Floriane TUERNAL SABOTINOV	e1398f4422	add manual spans to handle_request functions	2025-09-26 13:27:57 +02:00
Floriane TUERNAL SABOTINOV	20b0be351d	cleanup	2025-09-26 13:25:56 +02:00
Floriane TUERNAL SABOTINOV	af824b7043	use otel span to parent tracing span	2025-09-26 13:23:58 +02:00
Floriane TUERNAL SABOTINOV	d32332a82e	add context to message handling	2025-09-26 13:22:21 +02:00
Floriane TUERNAL SABOTINOV	5e8f402c5d	change context propagation method to trace_id sharing to go accros async move barrier	2025-09-26 13:22:19 +02:00
Floriane TUERNAL SABOTINOV	ad4ae0d00d	wip	2025-09-26 13:18:13 +02:00
Floriane TUERNAL SABOTINOV	aed16fcacd	wip	2025-09-26 13:17:24 +02:00
Floriane TUERNAL SABOTINOV	14f983c481	wip	2025-09-26 13:17:22 +02:00
Floriane TUERNAL SABOTINOV	587e2f4b53	wip	2025-09-26 13:16:43 +02:00
Floriane TUERNAL SABOTINOV	4d8348b304	context extraction	2025-09-26 13:15:44 +02:00
Floriane TUERNAL SABOTINOV	750df1e0bd	parent/chil propagation explicitation	2025-09-26 13:13:07 +02:00
Floriane TUERNAL SABOTINOV	94614e9d90	try debug panic when using parent span	2025-09-26 13:13:06 +02:00
Floriane TUERNAL SABOTINOV	002055cb9f	rm clone because panic	2025-09-26 13:10:14 +02:00
Floriane TUERNAL SABOTINOV	a117d9089b	propagation to parent function	2025-09-26 13:10:12 +02:00
Floriane TUERNAL SABOTINOV	ed8ca4e4ea	wip	2025-09-26 13:09:19 +02:00
Floriane TUERNAL SABOTINOV	587f6bf8a8	add method to extract trace_id from ContextCarrier	2025-09-26 13:09:17 +02:00
Floriane TUERNAL SABOTINOV	55a7f67407	use attach() instead of creating new span	2025-09-26 13:08:19 +02:00
Floriane TUERNAL SABOTINOV	e5c88e30b4	forget to enter span	2025-09-26 13:08:19 +02:00
Floriane TUERNAL SABOTINOV	dd4945e269	verify existence of context	2025-09-26 13:08:19 +02:00
Floriane TUERNAL SABOTINOV	0adeb6e677	use authenticatev2 and not authenticate	2025-09-26 13:08:19 +02:00
Floriane TUERNAL SABOTINOV	b7b399d71c	manual propagators for context from client to node	2025-09-26 13:08:16 +02:00
Floriane TUERNAL SABOTINOV	65b5c258e8	wip	2025-09-26 13:05:33 +02:00
Floriane TUERNAL SABOTINOV	da1463924f	experiment do I preserve trace_id with with method	2025-09-26 13:05:32 +02:00
Floriane TUERNAL SABOTINOV	749ceec727	try debug with otel specific tools	2025-09-26 13:05:32 +02:00
Floriane TUERNAL SABOTINOV	c639a7e1c1	print debug trace	2025-09-26 13:05:31 +02:00
Floriane TUERNAL SABOTINOV	e0876a6238	establishing initial authentication common trace_id	2025-09-26 13:04:23 +02:00
Floriane TUERNAL SABOTINOV	89f5ab11a5	context propagation helpers	2025-09-26 13:01:43 +02:00
Floriane TUERNAL SABOTINOV	4063071e08	Revert "broken: context won't satisfy spawn async move" This reverts commit 2b11479ad4801e1efa8ab0aca4ca577bd3f195fe.	2025-09-26 13:01:42 +02:00
Floriane TUERNAL SABOTINOV	99a0f4ea30	broken: context won't satisfy spawn async move	2025-09-26 12:59:24 +02:00
Floriane TUERNAL SABOTINOV	dfa969d754	try debug fresh handler context	2025-09-26 12:50:06 +02:00
Floriane TUERNAL SABOTINOV	428dd0543f	debug surb_reply client	2025-09-26 12:50:06 +02:00
Floriane TUERNAL SABOTINOV	b90088148c	try debug client gets stuck	2025-09-26 12:50:06 +02:00
Floriane TUERNAL SABOTINOV	08a45c188d	try keep context accross async call	2025-09-26 12:50:05 +02:00
Floriane TUERNAL SABOTINOV	806e8629fe	instrumentation of nym-node to nym-gateway workflow	2025-09-26 12:48:27 +02:00
Floriane TUERNAL SABOTINOV	c22bb99da6	fixed trace_id distibuted from sdk to gateway	2025-09-26 12:45:08 +02:00
Floriane TUERNAL SABOTINOV	91ee54e5a7	fix trace_id propagation from sdk to mix-node	2025-09-26 12:45:08 +02:00
Floriane TUERNAL SABOTINOV	572fc331b0	try debug difference trace_id otel by use async for gateway and attach it to span in surb_reply	2025-09-26 12:45:07 +02:00
Floriane TUERNAL SABOTINOV	c5590bddc5	add context propagation	2025-09-26 12:44:04 +02:00
Floriane TUERNAL SABOTINOV	c9aed048d0	change surb_reply to test relation with nym-node + basic instrumentation	2025-09-26 12:43:08 +02:00
Floriane TUERNAL SABOTINOV	b8f7d54f18	fix signoz ingestion	2025-09-26 12:39:12 +02:00
Floriane TUERNAL SABOTINOV	c04e173ee6	configure format for sending logs to signoz	2025-09-26 12:39:12 +02:00
Floriane TUERNAL SABOTINOV	34143f1d58	setup otel for surb_reply	2025-09-26 12:39:12 +02:00
Floriane TUERNAL SABOTINOV	47b88737e6	fix otel panic	2025-09-26 12:39:12 +02:00
Floriane TUERNAL SABOTINOV	76ddef285c	setup otel from run to forward_sphinx_packet	2025-09-26 12:39:08 +02:00
Floriane TUERNAL SABOTINOV	89fe17f19c	revert changes from previous commit	2025-09-26 12:22:54 +02:00
Mark Sinclair	57d2824521	wip: sdk surb-reply example add otel tracing	2025-09-26 12:22:54 +02:00
Mark Sinclair	b8058dd7ba	wip: tracing in nym-node	2025-09-26 12:22:51 +02:00
Mark Sinclair	95d08c7f21	add opentelemetry for debugging and testing behind `otel` feature flag	2025-09-26 12:16:10 +02:00