Feat: implement supply chain attack mitigation

- Add yarn resolutions for vulnerable packages (chalk, strip-ansi, color-convert, etc.)
- Add .npmrc and .nvmrc security configurations

.github/CODEOWNERS

@@ -14,7 +14,6 @@
 # contracts
 /contracts/mixnet @durch @jstuczyn
 /contracts/vesting @durch @jstuczyn
-/contracts/service-provider-directory @octol
 
 # crypto code
 /common/crypto/ @jstuczyn
@@ -22,14 +21,5 @@
 /common/dkg/ @jstuczyn
 /common/nymsphinx/ @jstuczyn
 
-# rust sdk
-/sdk/rust/ @octol
-
-# nym-connect (rust)
-/nym-connect/desktop/src-tauri/ @octol
-
-# nym-wallet (rust)
-/nym-wallet/src-tauri/ @octol
-
 # documentation
-/documentation @mfahampshire
+/documentation @mfahampshire

.github/actions/nym-hash-releases/src/package-lock.json

@@ -415,9 +415,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
       "license": "MIT",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"

.github/dependabot.yml

@@ -31,5 +31,3 @@ updates:
         update-types:
           - "patch"
     open-pull-requests-limit: 10
-    assignees:
-      - "octol"

.github/workflows/cd-docs.yml

@@ -21,7 +21,7 @@ jobs:
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4.0.0
+        uses: pnpm/action-setup@v4.1.0
         with:
           version: 9
       - uses: actions/setup-node@v4

.github/workflows/ci-build-upload-binaries.yml

@@ -38,15 +38,14 @@ jobs:
           rm -rf ci-builds || true
           mkdir -p $OUTPUT_DIR
           echo $OUTPUT_DIR
-
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get -y install libudev-dev
 
       - name: Sets env vars for tokio if set in manual dispatch inputs
-        run: |
-          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
         if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
-
+        run: |
+          echo "RUSTFLAGS=--cfg tokio_unstable" >> $GITHUB_ENV
+          echo "CARGO_FEATURES=--features tokio-console" >> $GITHUB_ENV
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -103,7 +102,6 @@ jobs:
           if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
             cp target/debian/*.deb $OUTPUT_DIR
           fi
-
       - name: Deploy branch to CI www
         continue-on-error: true
         uses: easingthemes/ssh-deploy@main

.github/workflows/ci-build.yml

@@ -5,7 +5,6 @@ on:
     paths:
       - 'clients/**'
       - 'common/**'
-      - 'explorer-api/**'
       - 'gateway/**'
       - 'integrations/**'
       - 'nym-api/**'
@@ -13,6 +12,7 @@ on:
       - 'nym-network-monitor/**'
       - 'nym-node/**'
       - 'nym-node-status-api/**'
+      - 'nym-statistics-api/**'
       - 'nym-outfox/**'
       - 'nym-validator-rewarder/**'
       - 'nyx-chain-watcher/**'
@@ -38,7 +38,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ arc-ubuntu-22.04, custom-windows-11, custom-runner-mac-m1 ]
+        os: [ arc-linux-latest, custom-windows-11, custom-macos-15 ]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
@@ -46,9 +46,9 @@ jobs:
       RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler cmake
         continue-on-error: true
-        if: contains(matrix.os, 'ubuntu')
+        if: contains(matrix.os, 'linux')
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -63,7 +63,7 @@ jobs:
 
       # To avoid running out of disk space, skip generating debug symbols
       - name: Set debug to false (unix)
-        if: contains(matrix.os, 'ubuntu') || contains(matrix.os, 'mac')
+        if: contains(matrix.os, 'linux') || contains(matrix.os, 'mac')
         run: |
           sed -i.bak 's/\[profile.dev\]/\[profile.dev\]\ndebug = false/' Cargo.toml
           git diff
@@ -93,14 +93,14 @@ jobs:
           command: build
 
       - name: Build all examples
-        if: contains(matrix.os, 'ubuntu')
+        if: contains(matrix.os, 'linux')
         uses: actions-rs/cargo@v1
         with:
           command: build
           args: --workspace --examples
 
       - name: Run all tests
-        if: contains(matrix.os, 'ubuntu')
+        if: contains(matrix.os, 'linux')
         uses: actions-rs/cargo@v1
         env:
           NYM_API: https://sandbox-nym-api1.nymtech.net/api
@@ -109,7 +109,7 @@ jobs:
           args: --workspace
 
       - name: Run expensive tests
-        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && contains(matrix.os, 'ubuntu')
+        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && contains(matrix.os, 'linux')
         uses: actions-rs/cargo@v1
         with:
           command: test

.github/workflows/ci-check-ns-api-version.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -44,8 +44,10 @@ jobs:
             echo "Tag is empty"
             exit 1
           fi
+          # first, list all tags for logging purposes
           curl -su ${{ secrets.HARBOR_ROBOT_USERNAME }}:${{ secrets.HARBOR_ROBOT_SECRET }} "$registry/v2/$repo_name/tags/list" | jq
-          exists=$(curl -su ${{ secrets.HARBOR_ROBOT_USERNAME }}:${{ secrets.HARBOR_ROBOT_SECRET }} "$registry/v2/$repo_name/tags/list" | jq --arg tag $TAG '.tags | contains([$tag])' )
+          # check if there's a matching tag
+          exists=$(curl -su ${{ secrets.HARBOR_ROBOT_USERNAME }}:${{ secrets.HARBOR_ROBOT_SECRET }} "$registry/v2/$repo_name/tags/list" | jq -r --arg tag "$TAG" 'any(.tags[]; . == $tag)' )
           if [[ $exists = "true" ]]; then
             echo "Version '$TAG' defined in Cargo.toml ALREADY EXISTS as tag in harbor repo"
             exit 1
@@ -53,5 +55,5 @@ jobs:
             echo "Version '$TAG' doesn't exist on the remote"
           else
             echo "Unknown output '$exists'"
-            exit 1
+            exit 2
           fi

.github/workflows/ci-check-nym-stats-api-version.yml

@@ -0,0 +1,59 @@
+name: ci-check-nym-stats-api-version
+
+on:
+  pull_request:
+    paths:
+      - "nym-statistics-api/**"
+
+env:
+  WORKING_DIRECTORY: "nym-statistics-api"
+
+jobs:
+  check-if-tag-exists:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.47.1
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if git tag exists
+        run: |
+          TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          if [[ -z "$TAG" ]]; then
+            echo "Tag is empty"
+            exit 1
+          fi
+          git ls-remote --tags origin | awk '{print $2}'
+          if git ls-remote --tags origin | awk '{print $2}' | grep -q "refs/tags/$TAG$" ; then
+              echo "Tag '$TAG' ALREADY EXISTS on the remote"
+              exit 1
+          else
+              echo "Tag '$TAG' does not exist on the remote"
+          fi
+      - name: Check if harbor tag exists
+        run: |
+          TAG=${{ steps.get_version.outputs.result }}
+          registry=https://harbor.nymte.ch
+          repo_name=nym/nym-statistics-api
+          if [[ -z $TAG ]]; then
+            echo "Tag is empty"
+            exit 1
+          fi
+          # first, list all tags for logging purposes
+          curl -su ${{ secrets.HARBOR_ROBOT_USERNAME }}:${{ secrets.HARBOR_ROBOT_SECRET }} "$registry/v2/$repo_name/tags/list" | jq
+          # check if there's a matching tag
+          exists=$(curl -su ${{ secrets.HARBOR_ROBOT_USERNAME }}:${{ secrets.HARBOR_ROBOT_SECRET }} "$registry/v2/$repo_name/tags/list" | jq -r --arg tag "$TAG" 'any(.tags[]; . == $tag)' )
+          if [[ $exists = "true" ]]; then
+            echo "Version '$TAG' defined in Cargo.toml ALREADY EXISTS as tag in harbor repo"
+            exit 1
+          elif [[ $exists = "false" ]]; then
+            echo "Version '$TAG' doesn't exist on the remote"
+          else
+            echo "Unknown output '$exists'"
+            exit 2
+          fi

.github/workflows/ci-contracts-upload-binaries.yml

@@ -31,31 +31,26 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
+          toolchain: stable
           target: wasm32-unknown-unknown
           override: true
 
-      - name: Install wasm-opt
-        uses: ./.github/actions/install-wasm-opt
-        with:
-          version: '114'
-
       - name: Install cosmwasm-check
         run: cargo install cosmwasm-check
 
       - name: Build release contracts
-        run: make contracts
+        run: make publish-contracts
 
       - name: Prepare build output
         shell: bash
         env:
           OUTPUT_DIR: ci-contract-builds/${{ github.ref_name }}
         run: |
-          cp contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/nym_coconut_dkg.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/cw3_flex_multisig.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/cw4_group.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/nym_ecash.wasm $OUTPUT_DIR
+          find contracts/artifacts -maxdepth 1 -type f -name '*.wasm' -exec cp {} $OUTPUT_DIR \;
+          # Also include the optimizer-generated checksums if present
+          if [ -f contracts/artifacts/checksums.txt ]; then
+            cp contracts/artifacts/checksums.txt $OUTPUT_DIR
+          fi
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/ci-contracts.yml

@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-22.04
     env:
       CARGO_TERM_COLOR: always
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - uses: actions/checkout@v4
 
@@ -27,7 +28,8 @@ jobs:
         uses: actions-rs/toolchain@v1
         with:
           profile: minimal
-          toolchain: stable
+          # pinned due to issues building contracts
+          toolchain: 1.86.0
           target: wasm32-unknown-unknown
           override: true
           components: rustfmt, clippy

.github/workflows/ci-docs.yml

@@ -28,7 +28,7 @@ jobs:
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4.0.0
+        uses: pnpm/action-setup@v4.1.0
         with:
           version: 9
       - uses: actions/setup-node@v4

.github/workflows/ci-sonar.yml

@@ -0,0 +1,19 @@
+name: Run SonarQube Scan
+on:
+  push:
+    branches:
+      - develop
+#  pull_request:
+#    types: [opened, synchronize, reopened]
+jobs:
+  sonarqube:
+    name: SonarQube
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@v5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/greetings.yml

@@ -6,7 +6,7 @@ jobs:
   greeting:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/first-interaction@v1
+    - uses: actions/first-interaction@v3
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         issue-message: 'Thank you for raising this issue'

.github/workflows/nightly-security-audit.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v4
       - name: Download report from previous job
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: report
           path: .github/workflows/support-files/notifications

.github/workflows/nym-api-integration-tests.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install Rust
         uses: actions-rs/toolchain@v1

.github/workflows/publish-nym-binaries.yml

@@ -20,8 +20,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [custom-ubuntu-22.04]
-    runs-on: ${{ matrix.platform }}
+        include:
+          - os: arc-ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+    runs-on:  ${{ matrix.os }}
 
     outputs:
       release_id: ${{ steps.create-release.outputs.id }}
@@ -54,7 +56,7 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: stable
+          toolchain: 1.86.0
           override: true
 
       - name: Build all binaries
@@ -68,7 +70,6 @@ jobs:
         with:
           name: my-artifact
           path: |
-            target/release/explorer-api
             target/release/nym-client
             target/release/nym-socks5-client
             target/release/nym-api
@@ -77,14 +78,13 @@ jobs:
             target/release/nymvisor
             target/release/nym-node
           retention-days: 30
-
+    
       - id: create-release
         name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
         if: github.event_name == 'release'
         with:
           files: |
-            target/release/explorer-api
             target/release/nym-client
             target/release/nym-socks5-client
             target/release/nym-api

.github/workflows/publish-nyms5-android-apk.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -91,7 +91,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Download binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: nyms5-apk-arch64
           path: apk

.github/workflows/push-credential-proxy.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml

.github/workflows/push-data-observatory.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-network-monitor.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml

.github/workflows/push-node-status-agent.yaml

@@ -5,8 +5,15 @@ on:
     inputs:
       gateway_probe_git_ref:
         type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
         description: Which gateway probe git ref to build the image with
-
+      release_image:
+        description: 'Tag image as a release'
+        required: true
+        default: false
+        type: boolean
+        
 env:
   WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-agent"
   CONTAINER_NAME: "node-status-agent"
@@ -31,10 +38,10 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
         id: get_version
-        with:
-          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
 
       - name: cleanup-gateway-probe-ref
         id: cleanup_gateway_probe_ref
@@ -43,19 +50,35 @@ jobs:
           GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
           echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
 
-      - name: Remove existing tag if exists
-        run: |
-          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} >/dev/null 2>&1; then
-            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
-            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
-          fi
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
 
-      - name: Create tag
-        run: |
-          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
-          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+      
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+      
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+        
+      - name: New env vars
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-api.yaml

@@ -1,7 +1,13 @@
 name: Build and upload Node Status API container to harbor.nymte.ch
 on:
   workflow_dispatch:
-
+    inputs:
+      release_image:
+        description: 'Tag image as a release'
+        required: true
+        default: false
+        type: boolean
+        
 env:
   WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-api"
   CONTAINER_NAME: "node-status-api"
@@ -26,30 +32,43 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
         id: get_version
-        with:
-          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
-
-      - name: Check if tag exists
         run: |
-          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
-            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
-          fi
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Remove existing tag if exists
-        run: |
-          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
-            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
-            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
-          fi
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
 
-      - name: Create tag
-        run: |
-          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
-          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+      - name: Initialise RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+      
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+      
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        
+      - name: New env vars
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists, then create
+      #   run: |
+      #     if git rev-parse "$GIT_TAG" >/dev/null 2>&1; then
+      #       echo "Tag '$GIT_TAG' already exists, deleting"
+      #       git push --delete origin "$GIT_TAG"
+      #       git tag -d "$GIT_TAG"
+      #       echo "Tag '$GIT_TAG' deleted"
+      #     else
+      #       echo "Tag '$GIT_TAG' does not exist, creating it"
+      #       git tag -a $GIT_TAG -m "Version ${{ steps.get_version.outputs.result }}"
+      #       git push origin $GIT_TAG
+      #       echo "Tag '$GIT_TAG' created"
+      #     fi
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile-pg . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
+

.github/workflows/push-nym-api.yaml

@@ -0,0 +1,51 @@
+name: Build and upload Nym APU container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "."
+  CONTAINER_NAME: "nym-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.47.1
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml
+
+      - name: Remove existing tag if exists
+        run: |
+          echo "Checking if tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} exists..."
+          if git rev-parse ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} already exists"
+            git push --delete origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+          
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f nym-api.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-nym-node.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-nym-statistics-api.yaml

@@ -0,0 +1,42 @@
+name: Build and upload Nym Statistics API container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-statistics-api"
+  CONTAINER_NAME: "nym-statistics-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.47.1
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-nyx-chain-watcher.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-validator-rewarder.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.gitignore

@@ -35,12 +35,13 @@ validator-api/keypair
 contracts/mixnet/code_id
 contracts/mixnet/Justfile
 contracts/mixnet/Makefile
+artifacts
+contracts/artifacts
 validator-config
 *.patch
 validator-api-config.toml
 dist
 storybook-static
-envs/qwerty.env
 .parcel-cache
 **/.DS_Store
 cpu-cycles/libcpucycles/build
@@ -59,3 +60,6 @@ nym-api/redocly/formatted-openapi.json
 
 *.sqlite
 .build
+
+**/settings.sql
+**/enter_db.sh

.npmignore

@@ -0,0 +1,58 @@
+# Security and sensitive files
+.env*
+*.key
+*.pem
+*.p12
+*.pfx
+secrets/
+private/
+config/secrets/
+
+# Development files
+node_modules/
+.npm/
+.npmrc
+.nvmrc
+*.log
+*.tmp
+.DS_Store
+Thumbs.db
+
+# Build artifacts
+dist/
+build/
+target/
+*.tgz
+*.tar.gz
+
+# IDE files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Test files
+test/
+tests/
+__tests__/
+*.test.js
+*.test.ts
+*.spec.js
+*.spec.ts
+
+# Documentation
+docs/
+*.md
+!README.md
+
+# CI/CD files
+.github/
+.gitlab-ci.yml
+.travis.yml
+.circleci/
+azure-pipelines.yml
+
+# Scripts
+scripts/
+!scripts/security-check.sh

.npmrc

@@ -0,0 +1,21 @@
+audit-level=moderate
+fund=false
+update-notifier=false
+ignore-scripts=false
+strict-ssl=true
+
+registry=https://registry.npmjs.org/
+audit=true
+package-lock=true
+package-lock-only=false
+save-exact=false
+
+# use npm ci for production builds (faster and more secure)
+# this will be enforced in CI/CD scripts
+
+# prevent installation of optional dependencies that might contain vulnerabilities
+optional=false
+audit=true
+update-notifier=false
+
+save-exact=false

.nvmrc

@@ -0,0 +1 @@
+20.18.0

CHANGELOG.md

@@ -4,6 +4,308 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2025.15-gruyere] (2025-08-20)
+
+- Migrate strum to 0.27.2 ([#5960])
+- WG exit policy scripts update ([#5921])
+- Make DNS Resolver fallback optional ([#5920])
+- nym-node debug command to reset providers db ([#5914])
+- basic zulip client for sending messages ([#5913])
+- chore: allow compatibility with 'CDLA-Permissive-2.0' ([#5910])
+- feat: ecash liveness check ([#5890])
+- Remove old free credential handle ([#5864])
+
+[#5960]: https://github.com/nymtech/nym/pull/5960
+[#5921]: https://github.com/nymtech/nym/pull/5921
+[#5920]: https://github.com/nymtech/nym/pull/5920
+[#5914]: https://github.com/nymtech/nym/pull/5914
+[#5913]: https://github.com/nymtech/nym/pull/5913
+[#5910]: https://github.com/nymtech/nym/pull/5910
+[#5890]: https://github.com/nymtech/nym/pull/5890
+[#5864]: https://github.com/nymtech/nym/pull/5864
+
+## [2025.14-feta] (2025-08-05)
+
+- chore: nym node tokio console ([#5909])
+- Feature/dkg snapshot epoch ([#5900])
+- Feature/dkg epoch dealers query ([#5899])
+- sqlx-pool-guard: allocate more memory on windows ([#5896])
+- Support mnemonic in the NS agent ([#5883])
+- Allow PG database backend ([#5880])
+
+[#5909]: https://github.com/nymtech/nym/pull/5909
+[#5900]: https://github.com/nymtech/nym/pull/5900
+[#5899]: https://github.com/nymtech/nym/pull/5899
+[#5896]: https://github.com/nymtech/nym/pull/5896
+[#5883]: https://github.com/nymtech/nym/pull/5883
+[#5880]: https://github.com/nymtech/nym/pull/5880
+
+## [2025.13-emmental] (2025-07-22)
+
+- fix: don't allow mixnode running in exit mode ([#5898])
+- fix contract build process in Makefile ([#5892])
+- bugfix: ignore 'Send' responses when claiming bandwidth ([#5884])
+- Update push-node-status-agent.yaml ([#5882])
+- listen for shutdown signals during nym-node startup ([#5879])
+- feat: forbid running mixnode + entry on the same node ([#5878])
+- chore: 1.88 clippy ([#5877])
+- Batch SQL writes for packet stats ([#5874])
+- fix the broken link ([#5873])
+- Set busy_timeout in sqlx ([#5872])
+- feat: basic performance contract integration [within Nym API] ([#5871])
+- scraper bugfix: ignore precommits from missing validators ([#5867])
+- Return true remaining ([#5866])
+- Make Mix hops optional for Mixnet Client SURBs ([#5861])
+- Check gateway supported versions ([#5860])
+- Add build info endpoints ([#5857])
+- Clear out screaming logs ([#5856])
+- fix removal of qa env ([#5855])
+- Use display when printing paths ([#5853])
+- feat: initial performance contract ([#5833])
+- Security patches for the `dkg` crate ([#5828])
+- HTTP Discovery objects & network defaults ([#5814])
+
+[#5898]: https://github.com/nymtech/nym/pull/5898
+[#5892]: https://github.com/nymtech/nym/pull/5892
+[#5884]: https://github.com/nymtech/nym/pull/5884
+[#5882]: https://github.com/nymtech/nym/pull/5882
+[#5879]: https://github.com/nymtech/nym/pull/5879
+[#5878]: https://github.com/nymtech/nym/pull/5878
+[#5877]: https://github.com/nymtech/nym/pull/5877
+[#5874]: https://github.com/nymtech/nym/pull/5874
+[#5873]: https://github.com/nymtech/nym/pull/5873
+[#5872]: https://github.com/nymtech/nym/pull/5872
+[#5871]: https://github.com/nymtech/nym/pull/5871
+[#5867]: https://github.com/nymtech/nym/pull/5867
+[#5866]: https://github.com/nymtech/nym/pull/5866
+[#5861]: https://github.com/nymtech/nym/pull/5861
+[#5860]: https://github.com/nymtech/nym/pull/5860
+[#5857]: https://github.com/nymtech/nym/pull/5857
+[#5856]: https://github.com/nymtech/nym/pull/5856
+[#5855]: https://github.com/nymtech/nym/pull/5855
+[#5853]: https://github.com/nymtech/nym/pull/5853
+[#5833]: https://github.com/nymtech/nym/pull/5833
+[#5828]: https://github.com/nymtech/nym/pull/5828
+[#5814]: https://github.com/nymtech/nym/pull/5814
+
+## [2025.12-dolcelatte] (2025-07-07)
+
+- bugfix: key-rotation + reply SURBs ([#5876])
+- Bugfix/backwards compat ([#5865])
+- bugfix: allow gateways to permit authentication from v4 clients ([#5862])
+- fixed client route for obtaining v2 list of gateways ([#5859])
+- Updated browser extension piece removal ([#5849])
+- Remove/old env references ([#5848])
+- Remove qa env ([#5847])
+- remove not used old mock-api ([#5845])
+- remove bity dir ([#5844])
+- build(deps-dev): bump webpack-dev-server from 4.13.2 to 5.2.1 in /wasm/mix-fetch/internal-dev ([#5843])
+- Amended the buy section ([#5841])
+- Removing test-net faucet ([#5840])
+- Feature/node status dvpn directory ([#5829])
+- build(deps-dev): bump webpack-dev-server from 4.15.2 to 5.2.1 in /nym-credential-proxy/vpn-api-lib-wasm/internal-dev ([#5826])
+- bugfix: fix swapped total and circulating supplies ([#5822])
+- build(deps): bump tar-fs from 3.0.8 to 3.0.9 in /sdk/typescript/tests/integration-tests/mix-fetch ([#5821])
+- Url scheme warning log ([#5819])
+- chore: adjust heuristic for wireguard peer activity ([#5818])
+- Use the same client bandwidth for top up ([#5813])
+- Replace chrono with time in NS API ([#5811])
+- build(deps-dev): bump http-proxy-middleware from 2.0.4 to 2.0.9 in /clients/native/examples/js-examples/websocket ([#5810])
+- build(deps): bump tokio from 1.44.2 to 1.45.1 ([#5798])
+- Close sqlite pool before moving or reopening databases ([#5796])
+- HTTP Client Retries, Fallbacks, and Redirects ([#5789])
+- feat: key rotation ([#5777])
+- build(deps): bump next from 14.2.15 to 14.2.26 in /documentation/docs ([#5772])
+- build(deps): bump undici from 5.28.5 to 5.29.0 in /.github/actions/nym-hash-releases/src ([#5771])
+- build(deps): bump cargo_metadata from 0.18.1 to 0.19.2 ([#5765])
+- build(deps): bump tempfile from 3.19.1 to 3.20.0 ([#5764])
+- [Feature] Noise XKpsk3 integration (2025 version) ([#5692])
+- feature: nympool contract ([#5464])
+- chore: fixed typo in API endpoint parameter ([#5449])
+
+[#5876]: https://github.com/nymtech/nym/pull/5876
+[#5865]: https://github.com/nymtech/nym/pull/5865
+[#5862]: https://github.com/nymtech/nym/pull/5862
+[#5859]: https://github.com/nymtech/nym/pull/5859
+[#5849]: https://github.com/nymtech/nym/pull/5849
+[#5848]: https://github.com/nymtech/nym/pull/5848
+[#5847]: https://github.com/nymtech/nym/pull/5847
+[#5845]: https://github.com/nymtech/nym/pull/5845
+[#5844]: https://github.com/nymtech/nym/pull/5844
+[#5843]: https://github.com/nymtech/nym/pull/5843
+[#5841]: https://github.com/nymtech/nym/pull/5841
+[#5840]: https://github.com/nymtech/nym/pull/5840
+[#5829]: https://github.com/nymtech/nym/pull/5829
+[#5826]: https://github.com/nymtech/nym/pull/5826
+[#5822]: https://github.com/nymtech/nym/pull/5822
+[#5821]: https://github.com/nymtech/nym/pull/5821
+[#5819]: https://github.com/nymtech/nym/pull/5819
+[#5818]: https://github.com/nymtech/nym/pull/5818
+[#5813]: https://github.com/nymtech/nym/pull/5813
+[#5811]: https://github.com/nymtech/nym/pull/5811
+[#5810]: https://github.com/nymtech/nym/pull/5810
+[#5798]: https://github.com/nymtech/nym/pull/5798
+[#5796]: https://github.com/nymtech/nym/pull/5796
+[#5789]: https://github.com/nymtech/nym/pull/5789
+[#5777]: https://github.com/nymtech/nym/pull/5777
+[#5772]: https://github.com/nymtech/nym/pull/5772
+[#5771]: https://github.com/nymtech/nym/pull/5771
+[#5765]: https://github.com/nymtech/nym/pull/5765
+[#5764]: https://github.com/nymtech/nym/pull/5764
+[#5692]: https://github.com/nymtech/nym/pull/5692
+[#5464]: https://github.com/nymtech/nym/pull/5464
+[#5449]: https://github.com/nymtech/nym/pull/5449
+
+## [2025.11-cheddar] (2025-06-10)
+
+- No autoremoval of peers ([#5831])
+- Set cached storage counters to 0 ([#5812])
+- hack: temporarily use next.config.js instead of next.config.ts ([#5805])
+- chore: resolve 1.87 clippy warnings ([#5802])
+- Nym Statistics API ([#5800])
+- QoL: RequestPath trait for http-api-client ([#5788])
+- Fix contains ticketbook function that always returned true ([#5787])
+- swap a decode into a fromrow to please future postgres feature ([#5785])
+- Make address cache configurable ([#5784])
+- Track wireguard credential retries ([#5783])
+
+[#5831]: https://github.com/nymtech/nym/pull/5831
+[#5812]: https://github.com/nymtech/nym/pull/5812
+[#5805]: https://github.com/nymtech/nym/pull/5805
+[#5802]: https://github.com/nymtech/nym/pull/5802
+[#5800]: https://github.com/nymtech/nym/pull/5800
+[#5788]: https://github.com/nymtech/nym/pull/5788
+[#5787]: https://github.com/nymtech/nym/pull/5787
+[#5785]: https://github.com/nymtech/nym/pull/5785
+[#5784]: https://github.com/nymtech/nym/pull/5784
+[#5783]: https://github.com/nymtech/nym/pull/5783
+
+## [2025.10-brie] (2025-05-27)
+
+- Backport PR 5779 ([#5801])
+- Expanded Accept Encoding for `reqwest` ([#5779])
+- Teach HttpClientError how to report its status code and timeout ([#5770])
+- Skip refreshing the topology on startup as we already have an initial set ([#5768])
+- Fetch the topology from the nym-api concurrently ([#5767])
+- feat: use bincode by default in NymApiClient + remove feature-lock ([#5761])
+- Instrument create_request ([#5760])
+- Add node_bonded field to delegations ([#5759])
+- build(deps): bump mikefarah/yq from 4.45.1 to 4.45.4 ([#5758])
+- Raw route submissions ([#5756])
+- feat: expires header for `/active` nym-api responses ([#5755])
+- Decrease default average packet delay to 15 ms ([#5754])
+- build(deps): bump the patch-updates group across 1 directory with 12 updates ([#5753])
+- Remove pretty_env_logger and switch remaining crates to use tracing ([#5749])
+- Update pretty_env_logger to latest to not depend on unmaintained crate atty ([#5748])
+- Upgrade prometheus crate to fix security warning ([#5747])
+- Downgrade deranged crate to 0.4.0 ([#5746])
+- feat: nym-api bincode + yaml support ([#5745])
+- fix parallel feature in ecash crate with send + sync ([#5744])
+- Remove old test directory - Update validator docker ([#5743])
+- [Feature] `RememberMe` is the new don't `ForgetMe` ([#5742])
+- build(deps): bump ammonia from 4.0.0 to 4.1.0 ([#5739])
+- build(deps): bump base-x from 3.0.9 to 3.0.11 in /testnet-faucet ([#5737])
+- build(deps): bump http-proxy-middleware from 2.0.8 to 2.0.9 ([#5730])
+
+[#5801]: https://github.com/nymtech/nym/pull/5801
+[#5779]: https://github.com/nymtech/nym/pull/5779
+[#5770]: https://github.com/nymtech/nym/pull/5770
+[#5768]: https://github.com/nymtech/nym/pull/5768
+[#5767]: https://github.com/nymtech/nym/pull/5767
+[#5761]: https://github.com/nymtech/nym/pull/5761
+[#5760]: https://github.com/nymtech/nym/pull/5760
+[#5759]: https://github.com/nymtech/nym/pull/5759
+[#5758]: https://github.com/nymtech/nym/pull/5758
+[#5756]: https://github.com/nymtech/nym/pull/5756
+[#5755]: https://github.com/nymtech/nym/pull/5755
+[#5754]: https://github.com/nymtech/nym/pull/5754
+[#5753]: https://github.com/nymtech/nym/pull/5753
+[#5749]: https://github.com/nymtech/nym/pull/5749
+[#5748]: https://github.com/nymtech/nym/pull/5748
+[#5747]: https://github.com/nymtech/nym/pull/5747
+[#5746]: https://github.com/nymtech/nym/pull/5746
+[#5745]: https://github.com/nymtech/nym/pull/5745
+[#5744]: https://github.com/nymtech/nym/pull/5744
+[#5743]: https://github.com/nymtech/nym/pull/5743
+[#5742]: https://github.com/nymtech/nym/pull/5742
+[#5739]: https://github.com/nymtech/nym/pull/5739
+[#5737]: https://github.com/nymtech/nym/pull/5737
+[#5730]: https://github.com/nymtech/nym/pull/5730
+
+## [2025.9-appenzeller] (2025-05-13)
+
+- build(deps): bump clap from 4.5.36 to 4.5.37 in the patch-updates group ([#5722])
+- build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in /wasm/mix-fetch/go-mix-conn ([#5720])
+- build(deps-dev): bump http-proxy-middleware from 2.0.6 to 2.0.9 in /wasm/client/internal-dev ([#5719])
+- Add /account/{address} ([#5673])
+- Add contains ticketbook data db query ([#5670])
+
+[#5722]: https://github.com/nymtech/nym/pull/5722
+[#5720]: https://github.com/nymtech/nym/pull/5720
+[#5719]: https://github.com/nymtech/nym/pull/5719
+[#5673]: https://github.com/nymtech/nym/pull/5673
+[#5670]: https://github.com/nymtech/nym/pull/5670
+
+## [2025.8-tourist] (2025-04-29)
+
+- add reserved byte to reply surb serialisation ([#5731])
+- Remove inactive peers ([#5721])
+- Update Hickory DNS "0.24.4" to "0.25" ([#5709])
+- build(deps): bump the patch-updates group across 1 directory with 7 updates ([#5708])
+- Peer handle should die more gracefully ([#5704])
+- build(deps): bump crossbeam-channel from 0.5.14 to 0.5.15 ([#5702])
+- build(deps): bump actions/checkout from 3 to 4 ([#5700])
+- Feature/updated sphinx payload keys ([#5698])
+- Bump the nym-vpn deb metapackage to 1.0 ([#5697])
+- Make mix hops optional for Mixnet Client ([#5696])
+- build(deps): bump tokio from 1.44.1 to 1.44.2 ([#5693])
+- Feature/replay protection ([#5682])
+- Adding fresh nym-api tests and workflow ([#5659])
+- build(deps): bump next from 14.2.21 to 14.2.25 ([#5655])
+- build(deps): bump pnpm/action-setup from 4.0.0 to 4.1.0 ([#5436])
+
+[#5731]: https://github.com/nymtech/nym/pull/5731
+[#5721]: https://github.com/nymtech/nym/pull/5721
+[#5709]: https://github.com/nymtech/nym/pull/5709
+[#5708]: https://github.com/nymtech/nym/pull/5708
+[#5704]: https://github.com/nymtech/nym/pull/5704
+[#5702]: https://github.com/nymtech/nym/pull/5702
+[#5700]: https://github.com/nymtech/nym/pull/5700
+[#5698]: https://github.com/nymtech/nym/pull/5698
+[#5697]: https://github.com/nymtech/nym/pull/5697
+[#5696]: https://github.com/nymtech/nym/pull/5696
+[#5693]: https://github.com/nymtech/nym/pull/5693
+[#5682]: https://github.com/nymtech/nym/pull/5682
+[#5659]: https://github.com/nymtech/nym/pull/5659
+[#5655]: https://github.com/nymtech/nym/pull/5655
+[#5436]: https://github.com/nymtech/nym/pull/5436
+
+## [2025.7-tex] (2025-04-14)
+
+- Expand /v3/nym-nodes with geodata ([#5686])
+- chore: clippy for 1.86 ([#5685])
+- Featrure: Bash scripts to init and configure VMs conveniently and update docs ([#5681])
+- Update node versions in CI ([#5677])
+- build(deps): bump the patch-updates group across 1 directory with 8 updates ([#5668])
+- Update log crate ([#5667])
+- Minor fixes involving key cloning and hashing ([#5664])
+- mix throughput tester ([#5661])
+- build(deps): bump blake3 from 1.6.1 to 1.7.0 ([#5658])
+- build(deps): bump elliptic from 6.5.5 to 6.6.1 ([#5483])
+- Move all workflows on ubuntu-20 to ubuntu-22 ([#5455])
+
+[#5686]: https://github.com/nymtech/nym/pull/5686
+[#5685]: https://github.com/nymtech/nym/pull/5685
+[#5681]: https://github.com/nymtech/nym/pull/5681
+[#5677]: https://github.com/nymtech/nym/pull/5677
+[#5668]: https://github.com/nymtech/nym/pull/5668
+[#5667]: https://github.com/nymtech/nym/pull/5667
+[#5664]: https://github.com/nymtech/nym/pull/5664
+[#5661]: https://github.com/nymtech/nym/pull/5661
+[#5658]: https://github.com/nymtech/nym/pull/5658
+[#5483]: https://github.com/nymtech/nym/pull/5483
+[#5455]: https://github.com/nymtech/nym/pull/5455
+
 ## [2025.6-chuckles] (2025-03-31)
 
 - Remove Google public DNS ([#5660])

CLAUDE.md

@@ -0,0 +1,686 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Nym is a privacy platform that uses mixnet technology to protect against metadata surveillance. The platform consists of several key components:
+- Mixnet nodes (mixnodes) for packet mixing
+- Gateways (entry/exit points for the network)
+- Clients for interacting with the network
+- Network monitoring tools
+- Validators for network consensus
+- Various service providers and integrations
+
+## Build Commands
+
+### Rust Components
+
+```bash
+# Default build (debug)
+cargo build
+
+# Release build
+cargo build --release
+
+# Build a specific package
+cargo build -p <package-name>
+
+# Build main components
+make build
+
+# Build release versions of main binaries and contracts
+make build-release
+
+# Build specific binaries
+make build-nym-cli
+cargo build -p nym-node --release
+cargo build -p nym-api --release
+```
+
+### Testing
+
+```bash
+# Run clippy, unit tests, and formatting
+make test
+
+# Run all tests including slow tests
+make test-all
+
+# Run clippy on all workspaces
+make clippy
+
+# Run unit tests for a specific package
+cargo test -p <package-name>
+
+# Run only expensive/ignored tests
+cargo test --workspace -- --ignored
+
+# Run API tests
+dotenv -f envs/sandbox.env -- cargo test --test public-api-tests
+
+# Run tests with specific log level
+RUST_LOG=debug cargo test -p <package-name>
+
+# Run specific test scripts
+./nym-node/tests/test_apis.sh
+./scripts/wireguard-exit-policy/exit-policy-tests.sh
+```
+
+### Linting and Formatting
+
+```bash
+# Run rustfmt on all code
+make fmt
+
+# Check formatting without modifying
+cargo fmt --all -- --check
+
+# Run clippy with all targets
+cargo clippy --workspace --all-targets -- -D warnings
+
+# TypeScript linting
+yarn lint
+yarn lint:fix
+yarn types:lint:fix
+
+# Check dependencies for security/licensing issues
+cargo deny check
+```
+
+### WASM Components
+
+```bash
+# Build all WASM components
+make sdk-wasm-build
+
+# Build TypeScript SDK
+yarn build:sdk
+npx lerna run --scope @nymproject/sdk build --stream
+
+# Build and test WASM components
+make sdk-wasm
+
+# Build specific WASM packages
+cd wasm/client && make
+cd wasm/mix-fetch && make
+cd wasm/node-tester && make
+```
+
+### Contract Development
+
+```bash
+# Build all contracts
+make contracts
+
+# Build contracts in release mode
+make build-release-contracts
+
+# Generate contract schemas
+make contract-schema
+
+# Run wasm-opt on contracts
+make wasm-opt-contracts
+
+# Check contracts with cosmwasm-check
+make cosmwasm-check-contracts
+```
+
+### Running Components
+
+```bash
+# Run nym-node as a mixnode
+cargo run -p nym-node -- run --mode mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway
+
+# Run the network monitor
+cargo run -p nym-network-monitor
+
+# Run the API server
+cargo run -p nym-api
+
+# Run with specific environment
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Start a local network
+./scripts/localnet_start.sh
+```
+
+## Architecture
+
+The Nym platform consists of various components organized as a monorepo:
+
+1. **Core Mixnet Infrastructure**:
+   - `nym-node`: Core binary supporting mixnode and gateway modes
+   - `common/nymsphinx`: Implementation of the Sphinx packet format
+   - `common/topology`: Network topology management
+   - `common/types`: Shared data types across components
+
+2. **Network Monitoring**:
+   - `nym-network-monitor`: Monitors the network's reliability and performance
+   - `nym-api`: API server for network stats and monitoring data
+   - Metrics tracking for nodes, routes, and overall network health
+
+3. **Client Implementations**:
+   - `clients/native`: Native Rust client implementation
+   - `clients/socks5`: SOCKS5 proxy client for standard applications
+   - `wasm`: WebAssembly client implementations (for browsers)
+   - `nym-connect`: Desktop and mobile clients
+
+4. **Blockchain & Smart Contracts**:
+   - `common/cosmwasm-smart-contracts`: Smart contract implementations
+   - `contracts`: CosmWasm contracts for the Nym network
+   - `common/ledger`: Blockchain integration
+
+5. **Utilities & Tools**:
+   - `tools`: Various CLI tools and utilities
+   - `sdk`: SDKs for different languages and platforms
+   - `documentation`: Documentation generation and management
+
+## Packet System
+
+Nym uses a modified Sphinx packet format for its mixnet:
+
+1. **Message Chunking**:
+   - Messages are divided into "sets" and "fragments"
+   - Each fragment fits in a single Sphinx packet
+   - The `common/nymsphinx/chunking` module handles message fragmentation
+
+2. **Routing**:
+   - Packets traverse through 3 layers of mixnodes
+   - Routing information is encrypted in layers (onion routing)
+   - The final gateway receives and processes the messages
+
+3. **Monitoring**:
+   - Monitoring system tracks packet delivery through the network
+   - Routes are analyzed for reliability statistics
+   - Node performance metrics are collected
+
+## Network Protocol
+
+Nym implements the Loopix mixnet design with several key privacy features:
+
+1. **Continuous-time Mixing**:
+   - Each mixnode delays messages independently with an exponential distribution
+   - This creates random reordering of packets, destroying timing correlations
+   - Offers better anonymity properties than batch mixing approaches
+
+2. **Cover Traffic**:
+   - Clients and nodes generate dummy "loop" packets that circulate through the network
+   - These packets are indistinguishable from real traffic
+   - Creates a baseline level of traffic that hides actual communication patterns
+   - Provides unobservability (hiding when and how much real traffic is being sent)
+
+3. **Stratified Network Architecture**:
+   - Traffic flows through Entry Gateway → 3 Mixnode Layers → Exit Gateway
+   - Path selection is independent per-message (unlike Tor)
+   - Each node connects only to adjacent layers
+
+4. **Anonymous Replies**:
+   - Single-Use Reply Blocks (SURBs) allow receiving messages without revealing identity
+   - Enables bidirectional communication while maintaining privacy
+
+## Network Monitoring Architecture
+
+The network monitoring system is a core component that measures mixnet reliability:
+
+1. The `nym-network-monitor` sends test packets through the network
+2. These packets follow predefined routes through multiple mixnodes
+3. Metrics are collected about:
+   - Successful and failed packet deliveries
+   - Node reliability (percentage of successful packet handling)
+   - Route reliability (which specific route combinations work best)
+4. Results are stored in the database and used by `nym-api` to:
+   - Present node performance statistics
+   - Determine network rewards
+   - Provide route selection guidance to clients
+
+In the current branch, metrics collection is being enhanced with a fanout approach to submit to multiple API endpoints.
+
+## Development Environment
+
+### Required Dependencies
+
+- Rust toolchain (stable, 1.80+)
+- Node.js (v20+) and yarn for TypeScript components
+- SQLite for local database development
+- PostgreSQL for API database (optional, for full API functionality)
+- CosmWasm tools for contract development
+- For building contracts: `wasm-opt` tool from `binaryen`
+- Python 3.8+ for some scripts
+- Docker (optional, for containerized development)
+- protoc (Protocol Buffers compiler) for some components
+
+### Environment Configurations
+
+The `envs/` directory contains pre-configured environments:
+
+#### Available Environments
+
+- **`local.env`**: Local development environment
+  - Points to local services (localhost)
+  - Uses test mnemonics and keys
+  - Ideal for testing without external dependencies
+
+- **`sandbox.env`**: Sandbox test network
+  - Public test network with real nodes
+  - Test tokens available from faucet
+  - Contract addresses for sandbox deployment
+  - API: https://sandbox-nym-api1.nymtech.net
+
+- **`mainnet.env`**: Production mainnet
+  - Real network with real tokens
+  - Production contract addresses
+  - API: https://validator.nymtech.net
+  - Use with caution!
+
+- **`canary.env`**: Canary deployment
+  - Pre-release testing environment
+  - Tests new features before mainnet
+
+- **`mainnet-local-api.env`**: Hybrid environment
+  - Uses mainnet contracts but local API
+  - Useful for API development against mainnet data
+
+#### Key Environment Variables
+
+```bash
+# Network configuration
+NETWORK_NAME=sandbox              # Network identifier
+BECH32_PREFIX=n                   # Address prefix (n for sandbox, n for mainnet)
+NYM_API=https://sandbox-nym-api1.nymtech.net/api
+NYXD=https://rpc.sandbox.nymtech.net
+NYM_API_NETWORK=sandbox
+
+# Contract addresses (network-specific)
+MIXNET_CONTRACT_ADDRESS=n1xr3rq8yvd7qplsw5yx90ftsr2zdhg4e9z60h5duusgxpv72hud3sjkxkav
+VESTING_CONTRACT_ADDRESS=n1unyuj8qnmygvzuex3dwmg9yzt9alhvyeat0uu0jedg2wj33efl5qackslz
+# ... other contract addresses
+
+# Mnemonic for testing (NEVER use in production)
+MNEMONIC="clutch captain shoe salt awake harvest setup primary inmate ugly among become"
+
+# API Keys and tokens
+IPINFO_API_TOKEN=your_token_here
+AUTHENTICATOR_PASSWORD=password_here
+
+# Logging
+RUST_LOG=info                    # Options: error, warn, info, debug, trace
+RUST_BACKTRACE=1                # Enable backtraces
+
+# Database
+DATABASE_URL=postgresql://user:pass@localhost/nym_api
+```
+
+#### Using Environment Files
+
+```bash
+# Load environment and run command
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Export to shell
+source envs/sandbox.env
+
+# Use with make targets
+dotenv -f envs/sandbox.env -- make run-api-tests
+```
+
+## Initial Setup
+
+### First Time Setup
+
+1. **Install Prerequisites**
+   ```bash
+   # Install Rust
+   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+   
+   # Install Node.js and yarn
+   # Via nvm (recommended):
+   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+   nvm install 20
+   npm install -g yarn
+   
+   # Install build tools
+   # Ubuntu/Debian:
+   sudo apt-get install build-essential pkg-config libssl-dev protobuf-compiler libpq-dev
+   
+   # macOS:
+   brew install protobuf postgresql
+   
+   # Install wasm-opt for contract builds
+   npm install -g wasm-opt
+   
+   # Add wasm target for Rust
+   rustup target add wasm32-unknown-unknown
+   ```
+
+2. **Clone and Setup Repository**
+   ```bash
+   git clone https://github.com/nymtech/nym.git
+   cd nym/nym
+   
+   # Install JavaScript dependencies
+   yarn install
+   
+   # Build the project
+   make build
+   ```
+
+3. **Database Setup (Optional, for API development)**
+   ```bash
+   # Install PostgreSQL
+   # Create database
+   createdb nym_api
+   
+   # Run migrations (from nym-api directory)
+   cd nym-api
+   sqlx migrate run
+   ```
+
+### Quick Start
+
+```bash
+# Run a mixnode locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run a gateway locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode gateway --id my-gateway
+
+# Run the API server
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Run a client
+cargo run -p nym-client -- init --id my-client
+cargo run -p nym-client -- run --id my-client
+```
+
+## CI/CD Pipeline
+
+The project uses GitHub Actions for CI/CD with several key workflows:
+
+1. **Build and Test**:
+   - `ci-build.yml`: Main build workflow for Rust components
+   - Tests are run on multiple platforms (Linux, Windows, macOS)
+   - Includes formatting check (rustfmt) and linting (clippy)
+
+2. **Release Process**:
+   - Binary artifacts are published on release tags
+   - Multiple platform builds are created
+
+3. **Documentation**:
+   - Documentation is automatically built and deployed
+
+## Database Structure
+
+The system uses SQLite databases with tables like:
+- `mixnode_status`: Status information about mixnodes
+- `gateway_status`: Status information about gateways
+- `routes`: Route performance information (success/failure of specific paths)
+- `monitor_run`: Information about monitoring test runs
+
+## Development Workflows
+
+### Running a Node
+
+To run the mixnode or gateway:
+
+```bash
+# Run nym-node as a mixnode with specified identity
+cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway --id my-gateway
+```
+
+### Configuration
+
+Nodes can be configured with files in various locations:
+- Command-line arguments
+- Environment variables
+- `.env` files specified with `--config-env-file`
+
+### Monitoring
+
+To monitor the health of your node:
+- View logs for real-time information
+- Use the node's HTTP API for status information
+- Check the explorer for public node statistics
+
+## Common Libraries
+
+- `common/types`: Shared data types across all components
+- `common/crypto`: Cryptographic primitives and wrappers
+- `common/client-core`: Core client functionality
+- `common/gateway-client`: Client-gateway communication
+- `common/task`: Task management and concurrency utilities
+- `common/nymsphinx`: Sphinx packet implementation for mixnet
+- `common/topology`: Network topology management
+- `common/credentials`: Credential system for privacy-preserving authentication
+- `common/bandwidth-controller`: Bandwidth management and accounting
+
+## Code Conventions
+
+- Error handling: Use anyhow/thiserror for structured error handling
+- Logging: Use the tracing framework for logging and diagnostics
+- State management: Generally use Tokio/futures for async code
+- Configuration: Use the config crate and env vars with defaults
+- Database: Use sqlx for type-safe database queries
+- Follow clippy recommendations and rustfmt formatting
+- Use semantic commit messages: feat, fix, docs, refactor, test, chore
+
+## When Making Changes
+
+- Run `make test` before submitting PRs
+- Follow Rust naming conventions
+- Use `clippy` to check for common issues
+- Update SQLx query caches when modifying DB queries: `cargo sqlx prepare`
+- Consider backward compatibility for protocol changes
+- Use lefthook pre-commit hooks for TypeScript formatting
+- Run `cargo deny check` to verify dependency compliance
+- Test against both sandbox and local environments when possible
+- Update relevant documentation and CHANGELOG.md
+
+## Development Tools
+
+### Useful Cargo Commands
+
+```bash
+# Check for outdated dependencies
+cargo outdated
+
+# Analyze binary size
+cargo bloat --release -p nym-node
+
+# Generate dependency graph
+cargo tree -p nym-api
+
+# Run with instrumentation
+cargo run --features profiling -p nym-node
+
+# Check for security advisories
+cargo audit
+```
+
+### Database Tools
+
+```bash
+# SQLx CLI for migrations
+cargo install sqlx-cli
+
+# Create new migration
+cd nym-api && sqlx migrate add <migration_name>
+
+# Prepare query metadata for offline compilation
+cargo sqlx prepare --workspace
+
+# View database schema
+./nym-api/enter_db.sh
+```
+
+### Development Scripts
+
+- `scripts/build_topology.py`: Generate network topology files
+- `scripts/node_api_check.py`: Verify node API endpoints
+- `scripts/network_tunnel_manager.sh`: Manage network tunnels
+- `scripts/localnet_start.sh`: Start a local test network
+- Various deployment scripts in `deployment/` for different environments
+
+## Debugging
+
+- Enable more verbose logging with the RUST_LOG environment variable:
+  ```
+  RUST_LOG=debug,nym_node=trace cargo run -p nym-node -- run --mode mixnode
+  ```
+- Use the HTTP API endpoints for status information
+- Check monitoring data in the database for network performance metrics
+- For complex issues, use tracing tools to follow packet flow
+- Enable backtraces: `RUST_BACKTRACE=full`
+- For WASM debugging: Use browser developer tools with source maps
+
+## Deployment and Advanced Configurations
+
+### Deployment Structure
+
+The `deployment/` directory contains Ansible playbooks and configurations for various deployment scenarios:
+
+- **`aws/`**: AWS-specific deployment configurations
+- **`mixnode/`**: Mixnode deployment playbooks
+- **`gateway/`**: Gateway deployment playbooks
+- **`validator/`**: Validator node deployment
+- **`sandbox-v2/`**: Complete sandbox environment setup
+- **`big-dipper-2/`**: Block explorer deployment
+
+### Sandbox V2 Deployment
+
+The sandbox-v2 deployment (`deployment/sandbox-v2/`) provides a complete test environment:
+
+```bash
+# Key playbooks:
+- deploy.yaml              # Main deployment orchestrator
+- deploy-mixnodes.yaml    # Deploy mixnodes
+- deploy-gateways.yaml    # Deploy gateways
+- deploy-validators.yaml  # Deploy validator nodes
+- deploy-nym-api.yaml     # Deploy API services
+```
+
+### Custom Environment Setup
+
+To create a custom environment:
+
+1. Copy an existing env file: `cp envs/sandbox.env envs/custom.env`
+2. Modify the network endpoints and contract addresses
+3. Update the `NETWORK_NAME` to your identifier
+4. Set appropriate mnemonics and keys (use fresh ones for production!)
+
+### Contract Addresses
+
+Contract addresses are network-specific and defined in environment files:
+- Mixnet contract: Manages mixnode/gateway registry
+- Vesting contract: Handles token vesting schedules
+- Coconut contracts: Privacy-preserving credentials
+- Name service: Human-readable address mapping
+- Ecash contract: Electronic cash functionality
+
+### Local Network Setup
+
+For a completely local network:
+```bash
+# Start local chain
+./scripts/localnet_start.sh
+
+# Deploy contracts
+cd contracts
+make deploy-local
+
+# Start nodes with local config
+dotenv -f envs/local.env -- cargo run -p nym-node -- run --mode mixnode
+```
+
+## Common Issues and Troubleshooting
+
+### Database Issues
+
+- When modifying database queries, you must update SQLx query caches:
+  ```bash
+  cargo sqlx prepare
+  ```
+- If you see SQLx errors about missing query files, this is likely the cause
+- For "database is locked" errors with SQLite, ensure only one process accesses the DB
+- For PostgreSQL connection issues, verify DATABASE_URL and that the server is running
+
+### API Connection Issues
+
+- Check the environment variables pointing to the APIs (NYM_API, NYXD)
+- Verify network connectivity and API health endpoints
+- For authentication issues, check node keys and credentials
+- Common endpoints to verify:
+  - API health: `$NYM_API/health`
+  - Chain status: `$NYXD/status`
+  - Contract info: `$NYXD/cosmwasm/wasm/v1/contract/$CONTRACT_ADDRESS`
+
+### Build Problems
+
+- Clean dependencies with `cargo clean` for a fresh build
+- Check for compatible Rust version (1.80+ recommended)
+- For smart contract builds, ensure wasm-opt is installed: `npm install -g wasm-opt`
+- For cross-compilation issues, check target-specific dependencies
+- WASM build issues: Ensure wasm32-unknown-unknown target is installed:
+  ```bash
+  rustup target add wasm32-unknown-unknown
+  ```
+- For "cannot find -lpq" errors, install PostgreSQL development files:
+  ```bash
+  # Ubuntu/Debian
+  sudo apt-get install libpq-dev
+  # macOS
+  brew install postgresql
+  ```
+
+### Environment Issues
+
+- Contract address mismatches: Ensure you're using the correct environment file
+- "Account sequence mismatch": The account nonce is out of sync, wait and retry
+- Token decimal issues: Sandbox uses different decimal places than mainnet
+- API version mismatches: Ensure your local API version matches the network
+- "Insufficient funds": Get test tokens from faucet (sandbox) or check balance
+- Gateway/mixnode bonding issues: Verify minimum stake requirements
+
+## Working with Routes and Monitoring
+
+1. Route monitoring metrics are stored in a `routes` table with:
+   - Layer node IDs (layer1, layer2, layer3, gw)
+   - Success flag (boolean)
+   - Timestamp
+
+2. To analyze routes:
+   - Check `NetworkAccount` and `AccountingRoute` in `nym-network-monitor/src/accounting.rs`
+   - View monitoring logic in `common/nymsphinx/chunking/monitoring.rs`
+   - Observe how routes are submitted to the database in the `submit_accounting_routes_to_db` function
+
+## Performance Optimization
+
+### Profiling and Benchmarking
+
+```bash
+# Run benchmarks
+cargo bench -p nym-node
+
+# Profile with perf (Linux)
+cargo build --release --features profiling
+perf record --call-graph=dwarf ./target/release/nym-node run --mode mixnode
+perf report
+
+# Generate flamegraph
+cargo install flamegraph
+cargo flamegraph --bin nym-node -- run --mode mixnode
+```
+
+### Common Performance Considerations
+
+- Use bounded channels for backpressure
+- Batch database operations where possible
+- Monitor memory usage with `RUST_LOG=nym_node::metrics=debug`
+- Use connection pooling for database connections
+- Consider using `jemalloc` for better memory allocation performance

Cargo.toml

@@ -33,12 +33,17 @@ members = [
     "common/commands",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-dkg",
-    "common/cosmwasm-smart-contracts/contracts-common", "common/cosmwasm-smart-contracts/easy_addr",
+    "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/contracts-common-testing",
+    "common/cosmwasm-smart-contracts/easy_addr",
     "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
+    "common/cosmwasm-smart-contracts/nym-performance-contract",
+    "common/cosmwasm-smart-contracts/nym-pool-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
+    "common/credential-proxy",
     "common/credential-storage",
     "common/credential-utils",
     "common/credential-verification",
@@ -46,8 +51,9 @@ members = [
     "common/credentials-interface",
     "common/crypto",
     "common/dkg",
+    "common/ecash-signer-check",
+    "common/ecash-signer-check-types",
     "common/ecash-time",
-    "common/execute",
     "common/exit-policy",
     "common/gateway-requests",
     "common/gateway-stats-storage",
@@ -64,6 +70,8 @@ members = [
     "common/nym-id",
     "common/nym-metrics",
     "common/nym_offline_compact_ecash",
+    "common/nymnoise",
+    "common/nymnoise/keys",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -84,26 +92,32 @@ members = [
     "common/socks5/requests",
     "common/statistics",
     "common/store-cipher",
-    "common/task",
+    "common/task", "common/test-utils",
     "common/ticketbooks-merkle",
     "common/topology",
     "common/tun",
-    "common/types",
+    "common/types", "common/upgrade-mode-check",
     "common/verloc",
     "common/wasm/client-core",
     "common/wasm/storage",
     "common/wasm/utils",
     "common/wireguard",
+    "common/wireguard-private-metadata/client",
+    "common/wireguard-private-metadata/server",
+    "common/wireguard-private-metadata/shared",
+    "common/wireguard-private-metadata/tests",
     "common/wireguard-types",
+    "common/zulip-client",
     "documentation/autodoc",
     "gateway",
-    "integrations/bity",
     "nym-api",
     "nym-api/nym-api-requests",
+    "nym-authenticator-client",
     "nym-browser-extension/storage",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-credential-proxy/nym-credential-proxy-requests",
     "nym-credential-proxy/vpn-api-lib-wasm",
+    "nym-ip-packet-client",
     "nym-network-monitor",
     "nym-node",
     "nym-node-status-api/nym-node-status-agent",
@@ -111,18 +125,19 @@ members = [
     "nym-node-status-api/nym-node-status-client",
     "nym-node/nym-node-metrics",
     "nym-node/nym-node-requests",
-    "nym-outfox",
+    "nym-outfox", "nym-signers-monitor",
+    "nym-statistics-api",
     "nym-validator-rewarder",
+    "nym-wg-gateway-client",
     "nyx-chain-watcher",
     "sdk/ffi/cpp",
     "sdk/ffi/go",
     "sdk/ffi/shared",
     "sdk/rust/nym-sdk",
-    "service-providers/authenticator",
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
-    "tools/echo-server",
+    "sqlx-pool-guard",
     "tools/echo-server",
     "tools/internal/contract-state-importer/importer-cli",
     "tools/internal/contract-state-importer/importer-contract",
@@ -132,7 +147,7 @@ members = [
     "tools/internal/testnet-manager",
     "tools/internal/testnet-manager",
     "tools/internal/testnet-manager/dkg-bypass-contract",
-    "tools/internal/testnet-manager/dkg-bypass-contract", "tools/internal/validator-status-check",
+    "tools/internal/validator-status-check",
     "tools/nym-cli",
     "tools/nym-id-cli",
     "tools/nym-nr-query",
@@ -153,20 +168,15 @@ default-members = [
     "nym-node",
     "nym-node-status-api/nym-node-status-agent",
     "nym-node-status-api/nym-node-status-api",
+    "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
-    "service-providers/authenticator",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
     "tools/nymvisor",
 ]
 
-exclude = [
-    "explorer",
-    "contracts",
-    "nym-wallet",
-    "cpu-cycles",
-]
+exclude = ["explorer", "contracts", "nym-wallet", "cpu-cycles"]
 
 [workspace.package]
 authors = ["Nym Technologies SA"]
@@ -175,7 +185,7 @@ homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
 edition = "2021"
 license = "Apache-2.0"
-rust-version = "1.80"
+rust-version = "1.81"
 readme = "README.md"
 
 [workspace.dependencies]
@@ -185,7 +195,7 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 ammonia = "4"
-anyhow = "1.0.97"
+anyhow = "1.0.98"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
 async-trait = "0.1.88"
@@ -204,20 +214,20 @@ bloomfilter = "3.0.1"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
 bytes = "1.10.1"
-cargo_metadata = "0.18.1"
+cargo_metadata = "0.19.2"
 celes = "2.6.0"
 cfg-if = "1.0.0"
 chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
-chrono = "0.4.40"
+chrono = "0.4.41"
 cipher = "0.4.3"
-clap = "4.5.34"
+clap = "4.5.38"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.2"
 comfy-table = "7.1.4"
-console = "0.15.11"
-console-subscriber = "0.1.1"
+console = "0.16.0"
+console-subscriber = "0.4.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
 const_format = "0.2.34"
@@ -233,15 +243,16 @@ digest = "0.10.7"
 dirs = "5.0"
 doc-comment = "0.3"
 dotenvy = "0.15.6"
+dyn-clone = "1.0.19"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
 encoding_rs = "0.8.35"
-env_logger = "0.11.7"
+env_logger = "0.11.8"
 envy = "0.4"
 etherparse = "0.13.0"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.1.0"
+flate2 = "1.1.1"
 futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
@@ -251,7 +262,7 @@ handlebars = "3.5.5"
 headers = "0.4.0"
 hex = "0.4.3"
 hex-literal = "0.3.3"
-hickory-resolver = "0.24.4"
+hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -262,11 +273,12 @@ humantime = "2.2.0"
 humantime-serde = "1.1.1"
 hyper = "1.6.0"
 hyper-util = "0.1"
-indicatif = "0.17.11"
+indicatif = "0.18.0"
 inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
@@ -286,8 +298,8 @@ pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.1"
 pin-project-lite = "0.2.16"
-pretty_env_logger = "0.4.0"
 publicsuffix = "2.3.0"
+proc_pidinfo = "0.1.3"
 quote = "1"
 rand = "0.8.5"
 rand_chacha = "0.3"
@@ -310,28 +322,30 @@ serde_json_path = "0.7.2"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
-sha2 = "0.10.8"
+sha2 = "0.10.9"
 si-scale = "0.2.3"
+snow = "0.9.6"
 sphinx-packet = "=0.6.0"
-sqlx = "0.7.4"
-strum = "0.26"
-strum_macros = "0.26"
+sqlx = "0.8.6"
+strum = "0.27.2"
+strum_macros = "0.27.2"
 subtle-encoding = "0.5"
-syn = "1"
-sysinfo = "0.33.0"
+syn = "2"
+sysinfo = "0.37.0"
 tap = "1.0.1"
 tar = "0.4.44"
-tempfile = "3.19"
+test-with = { version = "0.15.4", default-features = false }
+tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
-tokio = "1.44"
+tokio = "1.47"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
 tokio-tungstenite = { version = "0.20.1" }
-tokio-util = "0.7.14"
-toml = "0.8.20"
+tokio-util = "0.7.15"
+toml = "0.8.22"
 tower = "0.5.2"
 tower-http = "0.5.2"
 tracing = "0.1.41"
@@ -342,7 +356,7 @@ tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
 ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
-uniffi = "0.29.1"
+uniffi = "0.29.2"
 uniffi_build = "0.29.0"
 url = "2.5"
 utoipa = "5.2"
@@ -351,11 +365,10 @@ utoipauto = "0.2"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 walkdir = "2"
-wasm-bindgen-test = "0.3.49"
 x25519-dalek = "2.0.0"
 zeroize = "1.7.0"
 
-prometheus = { version = "0.13.0" }
+prometheus = { version = "0.14.0" }
 
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
@@ -369,9 +382,6 @@ subtle = "2.5.0"
 # cosmwasm-related
 cosmwasm-schema = "=2.2.2"
 cosmwasm-std = "=2.2.2"
-# use 1.0.1 as that's the version used by cosmwasm-std 2.2.1
-# (and ideally we don't want to pull the same dependency twice)
-serde-json-wasm = "=1.0.1"
 # same version as used by cosmwasm
 cw-utils = "=2.0.0"
 cw-storage-plus = "=2.0.0"
@@ -379,26 +389,28 @@ cw2 = { version = "=2.0.0" }
 cw3 = { version = "=2.0.0" }
 cw4 = { version = "=2.0.0" }
 cw-controllers = { version = "=2.0.0" }
+cw-multi-test = "=2.3.2"
 
 # cosmrs-related
 bip32 = { version = "0.5.3", default-features = false }
 
 
 cosmrs = { version = "0.21.1" }
-tendermint = "0.40.0"
-tendermint-rpc = "0.40.0"
+tendermint = "0.40.4"
+tendermint-rpc = "0.40.4"
 prost = { version = "0.13", default-features = false }
 
 # wasm-related dependencies
 gloo-utils = "0.2.0"
 gloo-net = "0.6.0"
 
-indexed_db_futures = "0.6.1"
+indexed_db_futures = "0.6.4"
 js-sys = "0.3.76"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
 wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
+wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
 web-sys = "0.3.76"
 
@@ -434,6 +446,9 @@ opt-level = 'z'
 # lto = true
 opt-level = 'z'
 
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
+
 [workspace.lints.clippy]
 unwrap_used = "deny"
 expect_used = "deny"

Makefile

@@ -12,7 +12,11 @@ help:
 	@echo "  clippy: run clippy for all workspaces"
 	@echo "  test: run clippy, unit tests, and formatting."
 	@echo "  test-all: like test, but also includes the expensive tests"
-	@echo "  deb: build debian packages
+	@echo "  deb: build debian packages"
+	@echo ""
+	@echo "Contract building targets:"
+	@echo "  contracts: build contracts for development (includes wasm-opt)"
+	@echo "  publish-contracts: build contracts using Docker optimizer (deterministic)"
 
 # -----------------------------------------------------------------------------
 # Meta targets
@@ -130,25 +134,69 @@ cargo-test: sdk-wasm-test
 clippy: sdk-wasm-lint
 
 # -----------------------------------------------------------------------------
-# Build contracts ready for deploy
+# Build CosmWasm contracts (deterministic docker build)
 # -----------------------------------------------------------------------------
 
-CONTRACTS=vesting_contract mixnet_contract nym_ecash cw3_flex_multisig cw4_group nym_coconut_dkg
-CONTRACTS_WASM=$(addsuffix .wasm, $(CONTRACTS))
-CONTRACTS_OUT_DIR=contracts/target/wasm32-unknown-unknown/release
 
-contracts: build-release-contracts wasm-opt-contracts cosmwasm-check-contracts
+WASM_CONTRACT_DIR := contracts/target/wasm32-unknown-unknown/release
+# Find every direct contract folder that contains a Cargo.toml
+CONTRACT_DIRS := $(shell find contracts -type f -name Cargo.toml \( ! -path "contracts/Cargo.toml" \) | grep -v integration-tests | xargs -n1 dirname | sort -u)
+
+CONTRACTS_OUT_DIR = contracts/artifacts
+
+# Build all contracts via the official CosmWasm optimizer image (one invocation per contract)
+# See : https://github.com/CosmWasm/optimizer?tab=readme-ov-file#contracts-excluded-from-workspace
+# The optimizer ships separate multi-arch images. ARM builds are *not* bit-for-bit identical to the
+# canonical x86_64 build (see README notice in CosmWasm/optimizer).  For reproducible artefacts we
+# therefore always run the amd64 variant by default.
+#   Override with :
+#   $ COSMWASM_OPTIMIZER_IMAGE=cosmwasm/optimizer-arm64:0.17.0 make contracts-publish
+#
+COSMWASM_OPTIMIZER_IMAGE ?= cosmwasm/optimizer:0.17.0
+COSMWASM_OPTIMIZER_PLATFORM ?= linux/amd64
+
+# Ensure clean build environment and run the optimizer
+optimize-contracts:
+	@rm -rf artifacts 2>/dev/null || true
+	@echo "=== Ensuring clean build environment"
+	docker volume rm nym_contracts_cache 2>/dev/null || true
+	docker volume rm registry_cache 2>/dev/null || true
+	@for DIR in $(CONTRACT_DIRS); do \
+	  echo "=== Optimizing $${DIR}"; \
+	  docker run --rm --platform $(COSMWASM_OPTIMIZER_PLATFORM) \
+	    -v $(CURDIR):/code \
+	    --mount type=volume,source=nym_contracts_cache,target=/target \
+	    --mount type=volume,source=registry_cache,target=/usr/local/cargo/registry \
+	    -e CARGO_BUILD_INCREMENTAL=false \
+	    -e RUSTFLAGS="-C target-cpu=generic -C debuginfo=0" \
+	    -e SOURCE_DATE_EPOCH=1 \
+	    $(COSMWASM_OPTIMIZER_IMAGE) $${DIR}; \
+	done
+	@mkdir -p $(CONTRACTS_OUT_DIR)
+	@cp artifacts/*.wasm $(CONTRACTS_OUT_DIR)/ 2>/dev/null || true
+
+	@cd $(CONTRACTS_OUT_DIR) && sha256sum *.wasm > checksums.txt
+	# Cleanup temporary artefacts directory
+	@rm -rf artifacts 2>/dev/null || true
 
 wasm-opt-contracts:
-	for contract in $(CONTRACTS_WASM); do \
-	  wasm-opt --signext-lowering -Os $(CONTRACTS_OUT_DIR)/$$contract -o $(CONTRACTS_OUT_DIR)/$$contract; \
+	@for WASM in $(WASM_CONTRACT_DIR)/*.wasm; do \
+	  echo "Running wasm-opt on $$WASM"; \
+	  wasm-opt --signext-lowering -Os $$WASM -o $$WASM ; \
 	done
 
 cosmwasm-check-contracts:
-	for contract in $(CONTRACTS_WASM); do \
-	  cosmwasm-check $(CONTRACTS_OUT_DIR)/$$contract; \
+	@for WASM in $(WASM_CONTRACT_DIR)/*.wasm; do \
+	  echo "Checking $$WASM"; \
+	  cosmwasm-check $$WASM ; \
 	done
 
+# Default development build
+contracts: build-release-contracts wasm-opt-contracts cosmwasm-check-contracts
+
+# Publishing build used by CI – deterministic Docker optimiser
+publish-contracts: optimize-contracts cosmwasm-check-contracts
+
 # Consider adding 's' to make plural consistent (beware: used in github workflow)
 contract-schema:
 	$(MAKE) -C contracts schema

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.53"
+version = "1.1.61"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -46,6 +46,7 @@ nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = [
     "output_format",
     "clap",
+    "basic_tracing",
 ] }
 nym-client-core = { path = "../../common/client-core", features = [
     "fs-credentials-storage",

clients/native/examples/js-examples/websocket/package-lock.json

@@ -2048,10 +2048,11 @@
       }
     },
     "node_modules/http-proxy-middleware": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.4.tgz",
-      "integrity": "sha512-m/4FxX17SUvz4lJ5WPXOHDUuCwIqXLfLHs1s0uZ3oYjhoXlx9csYxaOa0ElDEJ+h8Q4iJ1s+lTMbiCa4EXIJqg==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.9.tgz",
+      "integrity": "sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "@types/http-proxy": "^1.17.8",
         "http-proxy": "^1.18.1",
@@ -6095,9 +6096,9 @@
       }
     },
     "http-proxy-middleware": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.4.tgz",
-      "integrity": "sha512-m/4FxX17SUvz4lJ5WPXOHDUuCwIqXLfLHs1s0uZ3oYjhoXlx9csYxaOa0ElDEJ+h8Q4iJ1s+lTMbiCa4EXIJqg==",
+      "version": "2.0.9",
+      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.9.tgz",
+      "integrity": "sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==",
       "dev": true,
       "requires": {
         "@types/http-proxy": "^1.17.8",

clients/native/src/client/config/mod.rs

@@ -25,6 +25,7 @@ pub mod old_config_v1_1_13;
 pub mod old_config_v1_1_20;
 pub mod old_config_v1_1_20_2;
 pub mod old_config_v1_1_33;
+pub mod old_config_v1_1_54;
 mod persistence;
 mod template;
 

clients/native/src/client/config/old_config_v1_1_33.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::config::persistence::ClientPaths;
-use crate::client::config::{default_config_filepath, Config, Socket, SocketType};
+use crate::client::config::{default_config_filepath, Socket, SocketType};
 use crate::error::ClientError;
 use nym_bin_common::logging::LoggingSettings;
 use nym_client_core::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
@@ -14,6 +14,8 @@ use std::io;
 use std::net::{IpAddr, Ipv4Addr};
 use std::path::Path;
 
+use super::old_config_v1_1_54::ConfigV1_1_54;
+
 #[derive(Debug, Deserialize, PartialEq, Eq, Serialize, Clone)]
 pub struct ClientPathsV1_1_33 {
     #[serde(flatten)]
@@ -33,6 +35,21 @@ pub struct ConfigV1_1_33 {
     pub logging: LoggingSettings,
 }
 
+impl TryFrom<ConfigV1_1_33> for ConfigV1_1_54 {
+    type Error = ClientError;
+
+    fn try_from(value: ConfigV1_1_33) -> Result<Self, Self::Error> {
+        Ok(ConfigV1_1_54 {
+            base: value.base.into(),
+            socket: value.socket.into(),
+            storage_paths: ClientPaths {
+                common_paths: value.storage_paths.common_paths.upgrade_default()?,
+            },
+            logging: value.logging,
+        })
+    }
+}
+
 impl ConfigV1_1_33 {
     pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
         read_config_from_toml_file(path)
@@ -41,17 +58,6 @@ impl ConfigV1_1_33 {
     pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
         Self::read_from_toml_file(default_config_filepath(id))
     }
-
-    pub fn try_upgrade(self) -> Result<Config, ClientError> {
-        Ok(Config {
-            base: self.base.into(),
-            socket: self.socket.into(),
-            storage_paths: ClientPaths {
-                common_paths: self.storage_paths.common_paths.upgrade_default()?,
-            },
-            logging: self.logging,
-        })
-    }
 }
 
 #[derive(Debug, Deserialize, PartialEq, Eq, Serialize, Clone, Copy)]

clients/native/src/client/config/old_config_v1_1_54.rs

@@ -0,0 +1,41 @@
+use std::{io, path::Path};
+
+use nym_bin_common::logging::LoggingSettings;
+use nym_client_core::config::old_config_v1_1_54::ConfigV1_1_54 as BaseConfigV1_1_54;
+use nym_config::read_config_from_toml_file;
+use serde::{Deserialize, Serialize};
+
+use crate::error::ClientError;
+
+use super::{default_config_filepath, persistence::ClientPaths, Config, Socket};
+
+#[derive(Debug, Deserialize, PartialEq, Serialize, Clone)]
+pub struct ConfigV1_1_54 {
+    #[serde(flatten)]
+    pub base: BaseConfigV1_1_54,
+
+    pub socket: Socket,
+
+    pub storage_paths: ClientPaths,
+
+    pub logging: LoggingSettings,
+}
+
+impl ConfigV1_1_54 {
+    pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
+        read_config_from_toml_file(path)
+    }
+
+    pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
+        Self::read_from_toml_file(default_config_filepath(id))
+    }
+
+    pub fn try_upgrade(self) -> Result<Config, ClientError> {
+        Ok(Config {
+            base: self.base.into(),
+            socket: self.socket,
+            storage_paths: self.storage_paths,
+            logging: self.logging,
+        })
+    }
+}

clients/native/src/client/config/template.rs

@@ -92,10 +92,6 @@ host = '{{ socket.host }}'
 
 [debug]
 
-[debug.traffic]
-average_packet_delay = '{{ debug.traffic.average_packet_delay }}'
-message_sending_average_delay = '{{ debug.traffic.message_sending_average_delay }}'
-
 [debug.acknowledgements]
 average_ack_delay = '{{ debug.acknowledgements.average_ack_delay }}'
 

clients/native/src/client/mod.rs

@@ -111,7 +111,7 @@ impl SocketClient {
         let dkg_query_client = if self.config.base.client.disabled_credentials_mode {
             None
         } else {
-            Some(default_query_dkg_client_from_config(&self.config.base))
+            Some(default_query_dkg_client_from_config(&self.config.base)?)
         };
 
         let storage = self.initialise_storage().await?;

clients/native/src/commands/mod.rs

@@ -5,6 +5,7 @@ use crate::client::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::client::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::client::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::client::config::old_config_v1_1_33::ConfigV1_1_33;
+use crate::client::config::old_config_v1_1_54::ConfigV1_1_54;
 use crate::client::config::{BaseClientConfig, Config};
 use crate::commands::ecash::Ecash;
 use crate::error::ClientError;
@@ -177,7 +178,8 @@ async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {
     let updated_step2: ConfigV1_1_20_2 = updated_step1.into();
     let (updated_step3, gateway_config) = updated_step2.upgrade()?;
     let old_paths = updated_step3.storage_paths.clone();
-    let updated = updated_step3.try_upgrade()?;
+    let updated_step4: ConfigV1_1_54 = updated_step3.try_into()?;
+    let updated = updated_step4.try_upgrade()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
@@ -205,7 +207,8 @@ async fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, ClientError> {
     let updated_step1: ConfigV1_1_20_2 = old_config.into();
     let (updated_step2, gateway_config) = updated_step1.upgrade()?;
     let old_paths = updated_step2.storage_paths.clone();
-    let updated = updated_step2.try_upgrade()?;
+    let updated_step3: ConfigV1_1_54 = updated_step2.try_into()?;
+    let updated = updated_step3.try_upgrade()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
@@ -229,7 +232,8 @@ async fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, ClientError> {
 
     let (updated_step1, gateway_config) = old_config.upgrade()?;
     let old_paths = updated_step1.storage_paths.clone();
-    let updated = updated_step1.try_upgrade()?;
+    let updated_step2: ConfigV1_1_54 = updated_step1.try_into()?;
+    let updated = updated_step2.try_upgrade()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
@@ -252,7 +256,8 @@ async fn try_upgrade_v1_1_33_config(id: &str) -> Result<bool, ClientError> {
     info!("It is going to get updated to the current specification.");
 
     let old_paths = old_config.storage_paths.clone();
-    let updated = old_config.try_upgrade()?;
+    let updated_step1: ConfigV1_1_54 = old_config.try_into()?;
+    let updated = updated_step1.try_upgrade()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
@@ -265,6 +270,22 @@ async fn try_upgrade_v1_1_33_config(id: &str) -> Result<bool, ClientError> {
     Ok(true)
 }
 
+async fn try_upgrade_v1_1_54_config(id: &str) -> Result<bool, ClientError> {
+    // explicitly load it as v1.1.54 (which is incompatible with the current one, i.e. +1.1.55)
+    let Ok(old_config) = ConfigV1_1_54::read_from_default_path(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(false);
+    };
+    info!("It seems the client is using <= v1.1.54 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let updated = old_config.try_upgrade()?;
+
+    updated.save_to_default_location()?;
+    Ok(true)
+}
+
 async fn try_upgrade_config(id: &str) -> Result<(), ClientError> {
     if try_upgrade_v1_1_13_config(id).await? {
         return Ok(());
@@ -278,6 +299,9 @@ async fn try_upgrade_config(id: &str) -> Result<(), ClientError> {
     if try_upgrade_v1_1_33_config(id).await? {
         return Ok(());
     }
+    if try_upgrade_v1_1_54_config(id).await? {
+        return Ok(());
+    }
 
     Ok(())
 }

clients/native/src/main.rs

@@ -4,7 +4,7 @@
 use std::error::Error;
 
 use clap::{crate_name, crate_version, Parser};
-use nym_bin_common::logging::{maybe_print_banner, setup_logging};
+use nym_bin_common::logging::{maybe_print_banner, setup_tracing_logger};
 use nym_network_defaults::setup_env;
 
 pub mod client;
@@ -20,7 +20,7 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
     if !args.no_banner {
         maybe_print_banner(crate_name!(), crate_version!());
     }
-    setup_logging();
+    setup_tracing_logger();
 
     if let Err(err) = commands::execute(args).await {
         log::error!("{err}");

clients/native/src/websocket/handler.rs

@@ -318,7 +318,7 @@ impl Handler {
 
     async fn handle_text_message(&mut self, msg: String) -> Option<WsMessage> {
         debug!("Handling text message request");
-        trace!("Content: {:?}", msg);
+        trace!("Content: {msg:?}");
 
         self.received_response_type = ReceivedResponseType::Text;
         let client_request = ClientRequest::try_from_text(msg);

clients/native/src/websocket/listener.rs

@@ -68,9 +68,9 @@ impl Listener {
                 new_conn = tcp_listener.accept() => {
                     match new_conn {
                         Ok((mut socket, remote_addr)) => {
-                            debug!("Received connection from {:?}", remote_addr);
+                            debug!("Received connection from {remote_addr:?}");
                             if self.state.is_connected() {
-                                warn!("Tried to open a duplicate websocket connection. The request came from {}", remote_addr);
+                                warn!("Tried to open a duplicate websocket connection. The request came from {remote_addr}");
                                 // if we've already got a connection, don't allow another one
                                 // while we only ever want to accept a single connection, we don't want
                                 // to leave clients hanging (and also allow for reconnection if it somehow

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.53"
+version = "1.1.61"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -27,6 +27,7 @@ zeroize = { workspace = true }
 nym-bin-common = { path = "../../common/bin-common", features = [
     "output_format",
     "clap",
+    "basic_tracing",
 ] }
 nym-client-core = { path = "../../common/client-core", features = [
     "fs-credentials-storage",

clients/socks5/src/commands/mod.rs

@@ -7,6 +7,7 @@ use crate::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::config::old_config_v1_1_30::ConfigV1_1_30;
 use crate::config::old_config_v1_1_33::ConfigV1_1_33;
+use crate::config::old_config_v1_1_54::ConfigV1_1_54;
 use crate::config::{BaseClientConfig, Config};
 use crate::error::Socks5ClientError;
 use clap::CommandFactory;
@@ -204,15 +205,16 @@ async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError>
     let old_paths = updated_step3.storage_paths.clone();
 
     let updated_step4: ConfigV1_1_33 = updated_step3.into();
-    let updated = updated_step4.try_upgrade()?;
+    let updated_step5: ConfigV1_1_54 = updated_step4.try_into()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
-        &updated.storage_paths.common_paths,
+        &updated_step5.storage_paths.common_paths,
         Some(gateway_config),
     )
     .await?;
 
+    let updated = updated_step5.try_upgrade()?;
     updated.save_to_default_location()?;
     Ok(true)
 }
@@ -234,15 +236,16 @@ async fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, Socks5ClientError>
     let old_paths = updated_step2.storage_paths.clone();
 
     let updated_step3: ConfigV1_1_33 = updated_step2.into();
-    let updated = updated_step3.try_upgrade()?;
+    let updated_step4: ConfigV1_1_54 = updated_step3.try_into()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
-        &updated.storage_paths.common_paths,
+        &updated_step4.storage_paths.common_paths,
         Some(gateway_config),
     )
     .await?;
 
+    let updated = updated_step4.try_upgrade()?;
     updated.save_to_default_location()?;
     Ok(true)
 }
@@ -261,15 +264,17 @@ async fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, Socks5ClientErro
     let old_paths = updated_step1.storage_paths.clone();
 
     let updated_step2: ConfigV1_1_33 = updated_step1.into();
-    let updated = updated_step2.try_upgrade()?;
+    let updated_step3: ConfigV1_1_54 = updated_step2.try_into()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
-        &updated.storage_paths.common_paths,
+        &updated_step3.storage_paths.common_paths,
         Some(gateway_config),
     )
     .await?;
 
+    let updated = updated_step3.try_upgrade()?;
+
     updated.save_to_default_location()?;
     Ok(true)
 }
@@ -287,15 +292,16 @@ async fn try_upgrade_v1_1_30_config(id: &str) -> Result<bool, Socks5ClientError>
     let old_paths = old_config.storage_paths.clone();
 
     let updated_step1: ConfigV1_1_33 = old_config.into();
-    let updated = updated_step1.try_upgrade()?;
+    let updated_step2: ConfigV1_1_54 = updated_step1.try_into()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
-        &updated.storage_paths.common_paths,
+        &updated_step2.storage_paths.common_paths,
         None,
     )
     .await?;
 
+    let updated = updated_step2.try_upgrade()?;
     updated.save_to_default_location()?;
     Ok(true)
 }
@@ -312,15 +318,32 @@ async fn try_upgrade_v1_1_33_config(id: &str) -> Result<bool, Socks5ClientError>
 
     let old_paths = old_config.storage_paths.clone();
 
-    let updated = old_config.try_upgrade()?;
+    let updated_step1: ConfigV1_1_54 = old_config.try_into()?;
 
     v1_1_33::migrate_gateway_details(
         &old_paths.common_paths,
-        &updated.storage_paths.common_paths,
+        &updated_step1.storage_paths.common_paths,
         None,
     )
     .await?;
 
+    let updated = updated_step1.try_upgrade()?;
+    updated.save_to_default_location()?;
+    Ok(true)
+}
+
+async fn try_upgrade_v1_1_54_config(id: &str) -> Result<bool, Socks5ClientError> {
+    // explicitly load it as v1.1.54 (which is incompatible with the current one, i.e. +1.1.55)
+    let Ok(old_config) = ConfigV1_1_54::read_from_default_path(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(false);
+    };
+    info!("It seems the client is using <= v1.1.54 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let updated = old_config.try_upgrade()?;
+
     updated.save_to_default_location()?;
     Ok(true)
 }
@@ -341,6 +364,9 @@ async fn try_upgrade_config(id: &str) -> Result<(), Socks5ClientError> {
     if try_upgrade_v1_1_33_config(id).await? {
         return Ok(());
     }
+    if try_upgrade_v1_1_54_config(id).await? {
+        return Ok(());
+    }
 
     Ok(())
 }

clients/socks5/src/config/mod.rs

@@ -25,6 +25,7 @@ pub mod old_config_v1_1_20;
 pub mod old_config_v1_1_20_2;
 pub mod old_config_v1_1_30;
 pub mod old_config_v1_1_33;
+pub mod old_config_v1_1_54;
 mod persistence;
 mod template;
 

clients/socks5/src/config/old_config_v1_1_33.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::config::{default_config_filepath, Config, SocksClientPaths};
+use crate::config::{default_config_filepath, SocksClientPaths};
 use crate::error::Socks5ClientError;
 use nym_bin_common::logging::LoggingSettings;
 use nym_client_core::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
@@ -11,6 +11,8 @@ use serde::{Deserialize, Serialize};
 use std::io;
 use std::path::Path;
 
+use super::old_config_v1_1_54::ConfigV1_1_54;
+
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
 pub struct SocksClientPathsV1_1_33 {
     #[serde(flatten)]
@@ -28,6 +30,20 @@ pub struct ConfigV1_1_33 {
     pub logging: LoggingSettings,
 }
 
+impl TryFrom<ConfigV1_1_33> for ConfigV1_1_54 {
+    type Error = Socks5ClientError;
+
+    fn try_from(value: ConfigV1_1_33) -> Result<Self, Self::Error> {
+        Ok(ConfigV1_1_54 {
+            core: value.core.into(),
+            storage_paths: SocksClientPaths {
+                common_paths: value.storage_paths.common_paths.upgrade_default()?,
+            },
+            logging: value.logging,
+        })
+    }
+}
+
 impl ConfigV1_1_33 {
     pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
         read_config_from_toml_file(path)
@@ -36,14 +52,4 @@ impl ConfigV1_1_33 {
     pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
         Self::read_from_toml_file(default_config_filepath(id))
     }
-
-    pub fn try_upgrade(self) -> Result<Config, Socks5ClientError> {
-        Ok(Config {
-            core: self.core.into(),
-            storage_paths: SocksClientPaths {
-                common_paths: self.storage_paths.common_paths.upgrade_default()?,
-            },
-            logging: self.logging,
-        })
-    }
 }

clients/socks5/src/config/old_config_v1_1_54.rs

@@ -0,0 +1,39 @@
+use std::{io, path::Path};
+
+use nym_bin_common::logging::LoggingSettings;
+use nym_config::read_config_from_toml_file;
+use nym_socks5_client_core::config::old_config_v1_1_54::ConfigV1_1_54 as CoreConfigV1_1_54;
+use serde::{Deserialize, Serialize};
+
+use crate::config::Config;
+use crate::error::Socks5ClientError;
+
+use super::{default_config_filepath, SocksClientPaths};
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConfigV1_1_54 {
+    pub core: CoreConfigV1_1_54,
+
+    pub storage_paths: SocksClientPaths,
+
+    pub logging: LoggingSettings,
+}
+
+impl ConfigV1_1_54 {
+    pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
+        read_config_from_toml_file(path)
+    }
+
+    pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
+        Self::read_from_toml_file(default_config_filepath(id))
+    }
+
+    pub fn try_upgrade(self) -> Result<Config, Socks5ClientError> {
+        Ok(Config {
+            core: self.core.into(),
+            storage_paths: self.storage_paths,
+            logging: self.logging,
+        })
+    }
+}

clients/socks5/src/config/template.rs

@@ -98,10 +98,6 @@ send_anonymously = {{ core.socks5.send_anonymously }}
 
 [core.debug]
 
-[core.debug.traffic]
-average_packet_delay = '{{ core.debug.traffic.average_packet_delay }}'
-message_sending_average_delay = '{{ core.debug.traffic.message_sending_average_delay }}'
-
 [core.debug.acknowledgements]
 average_ack_delay = '{{ core.debug.acknowledgements.average_ack_delay }}'
 

clients/socks5/src/main.rs

@@ -4,7 +4,7 @@
 use std::error::Error;
 
 use clap::{crate_name, crate_version, Parser};
-use nym_bin_common::logging::{maybe_print_banner, setup_logging};
+use nym_bin_common::logging::{maybe_print_banner, setup_tracing_logger};
 use nym_network_defaults::setup_env;
 
 mod commands;
@@ -19,7 +19,7 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
     if !args.no_banner {
         maybe_print_banner(crate_name!(), crate_version!());
     }
-    setup_logging();
+    setup_tracing_logger();
 
     if let Err(err) = commands::execute(args).await {
         log::error!("{err}");

common/async-file-watcher/src/lib.rs

@@ -137,7 +137,7 @@ impl AsyncFileWatcher {
                             log::error!("the file watcher receiver has been dropped!");
                         }
                     } else {
-                        log::debug!("will not propagate information about {:?}", event);
+                        log::debug!("will not propagate information about {event:?}");
                     }
                 }
                 Err(err) => {

common/authenticator-requests/src/v1/registration.rs

@@ -108,7 +108,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // use gateways key as a ref to an x25519_dalek key
-        let dh = (gateway_key.as_ref()).diffie_hellman(&self.pub_key);
+        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
 
         // TODO: change that to use our nym_crypto::hmac module instead
         #[allow(clippy::expect_used)]

common/authenticator-requests/src/v2/registration.rs

@@ -117,7 +117,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // use gateways key as a ref to an x25519_dalek key
-        let dh = (gateway_key.as_ref()).diffie_hellman(&self.pub_key);
+        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
 
         // TODO: change that to use our nym_crypto::hmac module instead
         #[allow(clippy::expect_used)]

common/authenticator-requests/src/v3/registration.rs

@@ -117,7 +117,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // use gateways key as a ref to an x25519_dalek key
-        let dh = (gateway_key.as_ref()).diffie_hellman(&self.pub_key);
+        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
 
         // TODO: change that to use our nym_crypto::hmac module instead
         #[allow(clippy::expect_used)]

common/authenticator-requests/src/v4/registration.rs

@@ -169,7 +169,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // use gateways key as a ref to an x25519_dalek key
-        let dh = (gateway_key.as_ref()).diffie_hellman(&self.pub_key);
+        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
 
         // TODO: change that to use our nym_crypto::hmac module instead
         #[allow(clippy::expect_used)]

common/authenticator-requests/src/v5/registration.rs

@@ -28,8 +28,6 @@ pub type HmacSha256 = Hmac<Sha256>;
 pub type Nonce = u64;
 pub type Taken = Option<SystemTime>;
 
-pub const BANDWIDTH_CAP_PER_DAY: u64 = 250 * 1024 * 1024 * 1024; // 250 GB
-
 #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct IpPair {
     pub ipv4: Ipv4Addr,
@@ -169,7 +167,7 @@ impl GatewayClient {
     #[cfg(feature = "verify")]
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // use gateways key as a ref to an x25519_dalek key
-        let dh = (gateway_key.as_ref()).diffie_hellman(&self.pub_key);
+        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
 
         // TODO: change that to use our nym_crypto::hmac module instead
         #[allow(clippy::expect_used)]

common/bandwidth-controller/src/event.rs

@@ -11,7 +11,7 @@ impl std::fmt::Display for BandwidthStatusMessage {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
             BandwidthStatusMessage::RemainingBandwidth(b) => {
-                write!(f, "remaining bandwidth: {}", b)
+                write!(f, "remaining bandwidth: {b}")
             }
             BandwidthStatusMessage::NoBandwidth => write!(f, "no bandwidth left"),
         }

common/bandwidth-controller/src/utils.rs

@@ -207,7 +207,7 @@ where
     <St as Storage>::StorageError: Send + Sync + 'static,
 {
     if let Some(stored) = storage
-        .get_expiration_date_signatures(expiration_date)
+        .get_expiration_date_signatures(expiration_date, epoch_id)
         .await
         .map_err(BandwidthControllerError::credential_storage_error)?
     {
@@ -220,7 +220,7 @@ where
         ecash_apis,
         |api| async move {
             api.api_client
-                .global_expiration_date_signatures(Some(expiration_date))
+                .global_expiration_date_signatures(Some(expiration_date), Some(epoch_id))
                 .await
         },
         format!("aggregated coin index signatures for date {expiration_date}"),

common/bin-common/Cargo.toml

@@ -13,7 +13,6 @@ clap_complete = { workspace = true, optional = true }
 clap_complete_fig = { workspace = true, optional = true }
 const-str = { workspace = true }
 log = { workspace = true }
-pretty_env_logger = { workspace = true }
 schemars = { workspace = true, features = ["preserve_order"], optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }

common/bin-common/src/logging/mod.rs

@@ -21,29 +21,6 @@ pub struct LoggingSettings {
     // well, we need to implement something here at some point...
 }
 
-// I'd argue we should start transitioning from `log` to `tracing`
-pub fn setup_logging() {
-    let mut log_builder = pretty_env_logger::formatted_timed_builder();
-    if let Ok(s) = ::std::env::var("RUST_LOG") {
-        log_builder.parse_filters(&s);
-    } else {
-        // default to 'Info'
-        log_builder.filter(None, log::LevelFilter::Info);
-    }
-
-    log_builder
-        .filter_module("hyper", log::LevelFilter::Warn)
-        .filter_module("tokio_reactor", log::LevelFilter::Warn)
-        .filter_module("reqwest", log::LevelFilter::Warn)
-        .filter_module("mio", log::LevelFilter::Warn)
-        .filter_module("want", log::LevelFilter::Warn)
-        .filter_module("tungstenite", log::LevelFilter::Warn)
-        .filter_module("tokio_tungstenite", log::LevelFilter::Warn)
-        .filter_module("handlebars", log::LevelFilter::Warn)
-        .filter_module("sled", log::LevelFilter::Warn)
-        .init();
-}
-
 // don't call init so that we could attach additional layers
 #[cfg(feature = "basic_tracing")]
 pub fn build_tracing_logger() -> impl tracing_subscriber::layer::SubscriberExt {

common/client-core/Cargo.toml

@@ -13,10 +13,10 @@ async-trait = { workspace = true }
 base64 = { workspace = true }
 bs58 = { workspace = true }
 clap = { workspace = true, optional = true }
+cfg-if = { workspace = true }
 comfy-table = { workspace = true, optional = true }
 futures = { workspace = true }
-humantime-serde = { workspace = true }
-log = { workspace = true }
+humantime = { workspace = true }
 rand = { workspace = true }
 rand_chacha = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -25,25 +25,23 @@ sha2 = { workspace = true }
 si-scale = { workspace = true }
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
-tokio = { workspace = true, features = ["macros"] }
 time = { workspace = true }
+tokio = { workspace = true, features = ["sync", "macros"] }
+tracing = { workspace = true }
 zeroize = { workspace = true }
 
 # internal
 nym-id = { path = "../nym-id" }
 nym-bandwidth-controller = { path = "../bandwidth-controller" }
-nym-config = { path = "../config" }
 nym-crypto = { path = "../crypto" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../gateway-requests" }
 nym-http-api-client = { path = "../http-api-client" }
-nym-metrics = { path = "../nym-metrics" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-statistics-common = { path = "../statistics" }
 nym-pemstore = { path = "../pemstore" }
 nym-topology = { path = "../topology", features = ["persistence"] }
-nym-mixnet-client = { path = "../client-libs/mixnet-client", default-features = false }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-task = { path = "../task" }
 nym-credentials-interface = { path = "../credentials-interface" }
@@ -56,6 +54,9 @@ nym-client-core-surb-storage = { path = "./surb-storage" }
 nym-client-core-gateways-storage = { path = "./gateways-storage" }
 nym-ecash-time = { path = "../ecash-time" }
 
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies]
+nym-mixnet-client = { path = "../client-libs/mixnet-client", default-features = false }
+
 ### For serving prometheus metrics
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
 workspace = true
@@ -123,3 +124,6 @@ fs-surb-storage = ["nym-client-core-surb-storage/fs-surb-storage"]
 fs-gateways-storage = ["nym-client-core-gateways-storage/fs-gateways-storage"]
 wasm = ["nym-gateway-client/wasm"]
 metrics-server = []
+
+[lints]
+workspace = true

common/client-core/config-types/Cargo.toml

@@ -19,6 +19,7 @@ nym-pemstore = { path = "../../pemstore", optional = true }
 # those are pulling so many deps T.T
 nym-sphinx-params = { path = "../../nymsphinx/params" }
 nym-sphinx-addressing = { path = "../../nymsphinx/addressing" }
+nym-statistics-common = { path = "../../statistics" }
 
 
 [features]

common/client-core/config-types/src/lib.rs

@@ -5,6 +5,7 @@ use nym_config::defaults::NymNetworkDetails;
 use nym_config::serde_helpers::{de_maybe_stringified, ser_maybe_stringified};
 use nym_sphinx_addressing::Recipient;
 use nym_sphinx_params::{PacketSize, PacketType};
+use nym_statistics_common::types::SessionType;
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
 use url::Url;
@@ -22,7 +23,7 @@ const DEFAULT_ACK_WAIT_MULTIPLIER: f64 = 1.5;
 const DEFAULT_ACK_WAIT_ADDITION: Duration = Duration::from_millis(1_500);
 const DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY: Duration = Duration::from_millis(200);
 const DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY: Duration = Duration::from_millis(20);
-const DEFAULT_AVERAGE_PACKET_DELAY: Duration = Duration::from_millis(50);
+const DEFAULT_AVERAGE_PACKET_DELAY: Duration = Duration::from_millis(15);
 const DEFAULT_TOPOLOGY_REFRESH_RATE: Duration = Duration::from_secs(5 * 60); // every 5min
 const DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT: Duration = Duration::from_millis(5_000);
 
@@ -56,9 +57,7 @@ const DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE: u32 = 500;
 
 const DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD: Duration = Duration::from_secs(10);
 const DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD: Duration = Duration::from_secs(5 * 60);
-
-// 12 hours
-const DEFAULT_MAXIMUM_REPLY_SURB_AGE: Duration = Duration::from_secs(12 * 60 * 60);
+const DEFAULT_MAXIMUM_REPLY_SURB_REREQUESTS: usize = 5;
 
 // 24 hours
 const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60);
@@ -375,14 +374,12 @@ pub struct Traffic {
     /// sent packet is going to be delayed at any given mix node.
     /// So for a packet going through three mix nodes, on average, it will take three times this value
     /// until the packet reaches its destination.
-    #[serde(with = "humantime_serde")]
     pub average_packet_delay: Duration,
 
     /// The parameter of Poisson distribution determining how long, on average,
     /// it is going to take another 'real traffic stream' message to be sent.
     /// If no real packets are available and cover traffic is enabled,
     /// a loop cover message is sent instead in order to preserve the rate.
-    #[serde(with = "humantime_serde")]
     pub message_sending_average_delay: Duration,
 
     /// Controls whether the main packet stream constantly produces packets according to the predefined
@@ -414,6 +411,15 @@ pub struct Traffic {
     pub use_legacy_sphinx_format: bool,
 
     pub packet_type: PacketType,
+
+    /// Indicates whether to mix hops or not. If mix hops are enabled, traffic
+    /// will be routed as usual, to the entry gateway, through three mix nodes, egressing
+    /// through the exit gateway. If mix hops are disabled, traffic will be routed directly
+    /// from the entry gateway to the exit gateway, bypassing the mix nodes.
+    ///
+    /// This overrides the `use_legacy_sphinx_format` setting as reduced mix hops
+    /// requires use of the updated SURB packet format.
+    pub disable_mix_hops: bool,
 }
 
 impl Traffic {
@@ -444,6 +450,7 @@ impl Default for Traffic {
             // we should use the legacy format until sufficient number of nodes understand the
             // improved encoding
             use_legacy_sphinx_format: true,
+            disable_mix_hops: false,
         }
     }
 }
@@ -619,10 +626,9 @@ pub struct ReplySurbs {
     #[serde(with = "humantime_serde")]
     pub maximum_reply_surb_drop_waiting_period: Duration,
 
-    /// Defines maximum amount of time given reply surb is going to be valid for.
-    /// This is going to be superseded by key rotation once implemented.
-    #[serde(with = "humantime_serde")]
-    pub maximum_reply_surb_age: Duration,
+    /// Defines maximum number of times the client is going to re-request reply surbs
+    /// for clearing pending messages before giving up after making no progress.
+    pub maximum_reply_surbs_rerequests: usize,
 
     /// Defines maximum amount of time given reply key is going to be valid for.
     /// This is going to be superseded by key rotation once implemented.
@@ -632,9 +638,6 @@ pub struct ReplySurbs {
     /// Specifies the number of mixnet hops the packet should go through. If not specified, then
     /// the default value is used.
     pub surb_mix_hops: Option<u8>,
-
-    /// Specifies if we should reset all the sender tags on startup
-    pub fresh_sender_tags: bool,
 }
 
 impl Default for ReplySurbs {
@@ -649,10 +652,9 @@ impl Default for ReplySurbs {
             maximum_reply_surb_rerequest_waiting_period:
                 DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD,
             maximum_reply_surb_drop_waiting_period: DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD,
-            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
+            maximum_reply_surbs_rerequests: DEFAULT_MAXIMUM_REPLY_SURB_REREQUESTS,
             maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
             surb_mix_hops: None,
-            fresh_sender_tags: false,
         }
     }
 }
@@ -711,6 +713,9 @@ pub struct DebugConfig {
 
     /// Defines all configuration options related to the forget me flag.
     pub forget_me: ForgetMe,
+
+    /// Defines all configuration options related to the remember me flag.
+    pub remember_me: RememberMe,
 }
 
 impl DebugConfig {
@@ -734,6 +739,7 @@ impl Default for DebugConfig {
             reply_surbs: Default::default(),
             stats_reporting: Default::default(),
             forget_me: Default::default(),
+            remember_me: Default::default(),
         }
     }
 }
@@ -799,3 +805,57 @@ impl ForgetMe {
         }
     }
 }
+
+#[derive(Clone, Default, Debug, Deserialize, PartialEq, Serialize, Copy)]
+pub struct RememberMe {
+    /// Signal that this client should be accounted for in the stats
+    stats: bool,
+
+    /// Type of the session to remember, if it should be remembered
+    session_type: SessionType,
+}
+
+impl RememberMe {
+    pub fn new_vpn() -> Self {
+        Self {
+            stats: true,
+            session_type: SessionType::Vpn,
+        }
+    }
+
+    pub fn new_mixnet() -> Self {
+        Self {
+            stats: true,
+            session_type: SessionType::Mixnet,
+        }
+    }
+
+    pub fn new_native() -> Self {
+        Self {
+            stats: true,
+            session_type: SessionType::Native,
+        }
+    }
+
+    pub fn new(stats: bool, session_type: SessionType) -> Self {
+        Self {
+            stats,
+            session_type,
+        }
+    }
+
+    pub fn new_none() -> Self {
+        Self {
+            stats: false,
+            session_type: SessionType::Unknown,
+        }
+    }
+
+    pub fn session_type(&self) -> SessionType {
+        self.session_type
+    }
+
+    pub fn stats(&self) -> bool {
+        self.stats
+    }
+}

common/client-core/config-types/src/old/mod.rs

@@ -6,6 +6,7 @@ pub mod v2;
 pub mod v3;
 pub mod v4;
 pub mod v5;
+pub mod v6;
 
 // aliases for backwards compatibility
 pub use v1 as old_config_v1_1_13;
@@ -13,3 +14,4 @@ pub use v2 as old_config_v1_1_20;
 pub use v3 as old_config_v1_1_20_2;
 pub use v4 as old_config_v1_1_30;
 pub use v5 as old_config_v1_1_33;
+pub use v6 as old_config_v1_1_54;

common/client-core/config-types/src/old/v5.rs

@@ -1,16 +1,14 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::{
-    Acknowledgements, Client, Config, CoverTraffic, DebugConfig, GatewayConnection, ReplySurbs,
-    Topology, Traffic,
-};
 use nym_sphinx_addressing::Recipient;
 use nym_sphinx_params::{PacketSize, PacketType};
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
 use url::Url;
 
+use super::v6::*;
+
 // 'DEBUG'
 const DEFAULT_ACK_WAIT_MULTIPLIER: f64 = 1.5;
 
@@ -87,18 +85,18 @@ pub struct ConfigV5 {
     pub debug: DebugConfigV5,
 }
 
-impl From<ConfigV5> for Config {
+impl From<ConfigV5> for ConfigV6 {
     fn from(value: ConfigV5) -> Self {
-        Config {
-            client: Client {
+        ConfigV6 {
+            client: ClientV6 {
                 version: value.client.version,
                 id: value.client.id,
                 disabled_credentials_mode: value.client.disabled_credentials_mode,
                 nyxd_urls: value.client.nyxd_urls,
                 nym_api_urls: value.client.nym_api_urls,
             },
-            debug: DebugConfig {
-                traffic: Traffic {
+            debug: DebugConfigV6 {
+                traffic: TrafficV6 {
                     average_packet_delay: value.debug.traffic.average_packet_delay,
                     message_sending_average_delay: value
                         .debug
@@ -113,7 +111,7 @@ impl From<ConfigV5> for Config {
                     packet_type: value.debug.traffic.packet_type,
                     ..Default::default()
                 },
-                cover_traffic: CoverTraffic {
+                cover_traffic: CoverTrafficV6 {
                     loop_cover_traffic_average_delay: value
                         .debug
                         .cover_traffic
@@ -127,18 +125,18 @@ impl From<ConfigV5> for Config {
                         .cover_traffic
                         .disable_loop_cover_traffic_stream,
                 },
-                gateway_connection: GatewayConnection {
+                gateway_connection: GatewayConnectionV6 {
                     gateway_response_timeout: value
                         .debug
                         .gateway_connection
                         .gateway_response_timeout,
                 },
-                acknowledgements: Acknowledgements {
+                acknowledgements: AcknowledgementsV6 {
                     average_ack_delay: value.debug.acknowledgements.average_ack_delay,
                     ack_wait_multiplier: value.debug.acknowledgements.ack_wait_multiplier,
                     ack_wait_addition: value.debug.acknowledgements.ack_wait_addition,
                 },
-                topology: Topology {
+                topology: TopologyV6 {
                     topology_refresh_rate: value.debug.topology.topology_refresh_rate,
                     topology_resolution_timeout: value.debug.topology.topology_resolution_timeout,
                     disable_refreshing: value.debug.topology.disable_refreshing,
@@ -148,7 +146,7 @@ impl From<ConfigV5> for Config {
                         .max_startup_gateway_waiting_period,
                     ..Default::default()
                 },
-                reply_surbs: ReplySurbs {
+                reply_surbs: ReplySurbsV6 {
                     minimum_reply_surb_storage_threshold: value
                         .debug
                         .reply_surbs

common/client-core/config-types/src/old/v6.rs

@@ -0,0 +1,622 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    Acknowledgements, Client, Config, CoverTraffic, DebugConfig, ForgetMe, GatewayConnection,
+    RememberMe, ReplySurbs, StatsReporting, Topology, Traffic,
+};
+use nym_config::serde_helpers::{de_maybe_stringified, ser_maybe_stringified};
+use nym_sphinx_addressing::Recipient;
+use nym_sphinx_params::{PacketSize, PacketType};
+use nym_statistics_common::types::SessionType;
+use serde::{Deserialize, Serialize};
+use std::time::Duration;
+use url::Url;
+
+// 'DEBUG'
+const DEFAULT_ACK_WAIT_MULTIPLIER: f64 = 1.5;
+
+const DEFAULT_ACK_WAIT_ADDITION: Duration = Duration::from_millis(1_500);
+const DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY: Duration = Duration::from_millis(200);
+const DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY: Duration = Duration::from_millis(20);
+const DEFAULT_AVERAGE_PACKET_DELAY: Duration = Duration::from_millis(15);
+const DEFAULT_TOPOLOGY_REFRESH_RATE: Duration = Duration::from_secs(5 * 60); // every 5min
+const DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT: Duration = Duration::from_millis(5_000);
+
+// the same values as our current (10.06.24) blacklist
+const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
+const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
+
+const DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD: Duration = Duration::from_secs(70 * 60); // 70min -> full epoch (1h) + a bit of overhead
+
+// Set this to a high value for now, so that we don't risk sporadic timeouts that might cause
+// bought bandwidth tokens to not have time to be spent; Once we remove the gateway from the
+// bandwidth bridging protocol, we can come back to a smaller timeout value
+const DEFAULT_GATEWAY_RESPONSE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+
+const DEFAULT_COVER_TRAFFIC_PRIMARY_SIZE_RATIO: f64 = 0.70;
+
+// reply-surbs related:
+
+// define when to request
+// clients/client-core/src/client/replies/reply_storage/surb_storage.rs
+const DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD: usize = 10;
+const DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD: usize = 200;
+const DEFAULT_MINIMUM_REPLY_SURB_THRESHOLD_BUFFER: usize = 0;
+
+// define how much to request at once
+// clients/client-core/src/client/replies/reply_controller.rs
+const DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 10;
+const DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 50;
+
+const DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE: u32 = 500;
+
+const DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD: Duration = Duration::from_secs(10);
+const DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD: Duration = Duration::from_secs(5 * 60);
+
+// 12 hours
+const DEFAULT_MAXIMUM_REPLY_SURB_AGE: Duration = Duration::from_secs(12 * 60 * 60);
+
+// 24 hours
+const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60);
+
+// stats reporting related
+
+/// Time interval between reporting statistics to the given provider if it exists
+const STATS_REPORT_INTERVAL_SECS: Duration = Duration::from_secs(300);
+
+// aliases for backwards compatibility
+pub type ConfigV1_1_54 = ConfigV6;
+pub type ClientV1_1_54 = ClientV6;
+pub type DebugConfigV1_1_54 = DebugConfigV6;
+
+pub type TrafficV1_1_54 = TrafficV6;
+pub type CoverTrafficV1_1_54 = CoverTrafficV6;
+pub type GatewayConnectionV1_1_54 = GatewayConnectionV6;
+pub type AcknowledgementsV1_1_54 = AcknowledgementsV6;
+pub type TopologyV1_1_54 = TopologyV6;
+pub type ReplySurbsV1_1_54 = ReplySurbsV6;
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConfigV6 {
+    pub client: ClientV6,
+
+    #[serde(default)]
+    pub debug: DebugConfigV6,
+}
+
+impl From<ConfigV6> for Config {
+    fn from(value: ConfigV6) -> Self {
+        Config {
+            client: Client {
+                version: value.client.version,
+                id: value.client.id,
+                disabled_credentials_mode: value.client.disabled_credentials_mode,
+                nyxd_urls: value.client.nyxd_urls,
+                nym_api_urls: value.client.nym_api_urls,
+            },
+            debug: DebugConfig {
+                traffic: Traffic {
+                    average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+                    message_sending_average_delay: value
+                        .debug
+                        .traffic
+                        .message_sending_average_delay,
+                    disable_main_poisson_packet_distribution: value
+                        .debug
+                        .traffic
+                        .disable_main_poisson_packet_distribution,
+                    primary_packet_size: value.debug.traffic.primary_packet_size,
+                    secondary_packet_size: value.debug.traffic.secondary_packet_size,
+                    packet_type: value.debug.traffic.packet_type,
+                    deterministic_route_selection: value
+                        .debug
+                        .traffic
+                        .deterministic_route_selection,
+                    maximum_number_of_retransmissions: value
+                        .debug
+                        .traffic
+                        .maximum_number_of_retransmissions,
+                    use_legacy_sphinx_format: value.debug.traffic.use_legacy_sphinx_format,
+                    disable_mix_hops: value.debug.traffic.disable_mix_hops,
+                },
+                cover_traffic: CoverTraffic {
+                    loop_cover_traffic_average_delay: value
+                        .debug
+                        .cover_traffic
+                        .loop_cover_traffic_average_delay,
+                    cover_traffic_primary_size_ratio: value
+                        .debug
+                        .cover_traffic
+                        .cover_traffic_primary_size_ratio,
+                    disable_loop_cover_traffic_stream: value
+                        .debug
+                        .cover_traffic
+                        .disable_loop_cover_traffic_stream,
+                },
+                gateway_connection: GatewayConnection {
+                    gateway_response_timeout: value
+                        .debug
+                        .gateway_connection
+                        .gateway_response_timeout,
+                },
+                acknowledgements: Acknowledgements {
+                    average_ack_delay: value.debug.acknowledgements.average_ack_delay,
+                    ack_wait_multiplier: value.debug.acknowledgements.ack_wait_multiplier,
+                    ack_wait_addition: value.debug.acknowledgements.ack_wait_addition,
+                },
+                topology: Topology {
+                    topology_refresh_rate: value.debug.topology.topology_refresh_rate,
+                    topology_resolution_timeout: value.debug.topology.topology_resolution_timeout,
+                    disable_refreshing: value.debug.topology.disable_refreshing,
+                    max_startup_gateway_waiting_period: value
+                        .debug
+                        .topology
+                        .max_startup_gateway_waiting_period,
+                    minimum_mixnode_performance: value.debug.topology.minimum_mixnode_performance,
+                    minimum_gateway_performance: value.debug.topology.minimum_gateway_performance,
+                    use_extended_topology: value.debug.topology.use_extended_topology,
+                    ignore_egress_epoch_role: value.debug.topology.ignore_egress_epoch_role,
+                    ignore_ingress_epoch_role: value.debug.topology.ignore_ingress_epoch_role,
+                },
+                reply_surbs: ReplySurbs {
+                    minimum_reply_surb_storage_threshold: value
+                        .debug
+                        .reply_surbs
+                        .minimum_reply_surb_storage_threshold,
+                    maximum_reply_surb_storage_threshold: value
+                        .debug
+                        .reply_surbs
+                        .maximum_reply_surb_storage_threshold,
+                    minimum_reply_surb_request_size: value
+                        .debug
+                        .reply_surbs
+                        .minimum_reply_surb_request_size,
+                    maximum_reply_surb_request_size: value
+                        .debug
+                        .reply_surbs
+                        .maximum_reply_surb_request_size,
+                    maximum_allowed_reply_surb_request_size: value
+                        .debug
+                        .reply_surbs
+                        .maximum_allowed_reply_surb_request_size,
+                    maximum_reply_surb_rerequest_waiting_period: value
+                        .debug
+                        .reply_surbs
+                        .maximum_reply_surb_rerequest_waiting_period,
+                    maximum_reply_surb_drop_waiting_period: value
+                        .debug
+                        .reply_surbs
+                        .maximum_reply_surb_drop_waiting_period,
+                    maximum_reply_key_age: value.debug.reply_surbs.maximum_reply_key_age,
+                    surb_mix_hops: value.debug.reply_surbs.surb_mix_hops,
+                    minimum_reply_surb_threshold_buffer: value
+                        .debug
+                        .reply_surbs
+                        .minimum_reply_surb_threshold_buffer,
+                    ..Default::default()
+                },
+                stats_reporting: StatsReporting {
+                    enabled: value.debug.stats_reporting.enabled,
+                    provider_address: value.debug.stats_reporting.provider_address,
+                    reporting_interval: value.debug.stats_reporting.reporting_interval,
+                },
+                forget_me: ForgetMe {
+                    client: value.debug.forget_me.client,
+                    stats: value.debug.forget_me.stats,
+                },
+                remember_me: RememberMe {
+                    stats: value.debug.remember_me.stats,
+                    session_type: value.debug.remember_me.session_type.into(),
+                },
+            },
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq, Serialize)]
+// note: the deny_unknown_fields is VITAL here to allow upgrades from v1.1.20_2
+#[serde(deny_unknown_fields)]
+pub struct ClientV6 {
+    /// Version of the client for which this configuration was created.
+    pub version: String,
+
+    /// ID specifies the human readable ID of this particular client.
+    pub id: String,
+
+    /// Indicates whether this client is running in a disabled credentials mode, thus attempting
+    /// to claim bandwidth without presenting bandwidth credentials.
+    // TODO: this should be moved to `debug.gateway_connection`
+    #[serde(default)]
+    pub disabled_credentials_mode: bool,
+
+    /// Addresses to nyxd validators via which the client can communicate with the chain.
+    #[serde(alias = "validator_urls")]
+    pub nyxd_urls: Vec<Url>,
+
+    /// Addresses to APIs running on validator from which the client gets the view of the network.
+    #[serde(alias = "validator_api_urls")]
+    pub nym_api_urls: Vec<Url>,
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct TrafficV6 {
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// sent packet is going to be delayed at any given mix node.
+    /// So for a packet going through three mix nodes, on average, it will take three times this value
+    /// until the packet reaches its destination.
+    #[serde(with = "humantime_serde")]
+    pub average_packet_delay: Duration,
+
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take another 'real traffic stream' message to be sent.
+    /// If no real packets are available and cover traffic is enabled,
+    /// a loop cover message is sent instead in order to preserve the rate.
+    #[serde(with = "humantime_serde")]
+    pub message_sending_average_delay: Duration,
+
+    /// Controls whether the main packet stream constantly produces packets according to the predefined
+    /// poisson distribution.
+    pub disable_main_poisson_packet_distribution: bool,
+
+    /// Specify whether route selection should be determined by the packet header.
+    pub deterministic_route_selection: bool,
+
+    /// Specify how many times particular packet can be retransmitted
+    /// None - no limit
+    pub maximum_number_of_retransmissions: Option<u32>,
+
+    /// Specifies the packet size used for sent messages.
+    /// Do not override it unless you understand the consequences of that change.
+    pub primary_packet_size: PacketSize,
+
+    /// Specifies the optional auxiliary packet size for optimizing message streams.
+    /// Note that its use decreases overall anonymity.
+    /// Do not set it unless you understand the consequences of that change.
+    pub secondary_packet_size: Option<PacketSize>,
+
+    /// Specify whether any constructed sphinx packets should use the legacy format,
+    /// where the payload keys are explicitly attached rather than using the seeds
+    /// this affects any forward packets, acks and reply surbs
+    /// this flag should remain disabled until sufficient number of nodes on the network has upgraded
+    /// and support updated format.
+    /// in the case of reply surbs, the recipient must also understand the new encoding
+    pub use_legacy_sphinx_format: bool,
+
+    pub packet_type: PacketType,
+
+    /// Indicates whether to mix hops or not. If mix hops are enabled, traffic
+    /// will be routed as usual, to the entry gateway, through three mix nodes, egressing
+    /// through the exit gateway. If mix hops are disabled, traffic will be routed directly
+    /// from the entry gateway to the exit gateway, bypassing the mix nodes.
+    pub disable_mix_hops: bool,
+}
+
+impl Default for TrafficV6 {
+    fn default() -> Self {
+        TrafficV6 {
+            average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
+            disable_main_poisson_packet_distribution: false,
+            deterministic_route_selection: false,
+            maximum_number_of_retransmissions: None,
+            primary_packet_size: PacketSize::RegularPacket,
+            secondary_packet_size: None,
+            packet_type: PacketType::Mix,
+
+            // we should use the legacy format until sufficient number of nodes understand the
+            // improved encoding
+            use_legacy_sphinx_format: true,
+            disable_mix_hops: false,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct CoverTrafficV6 {
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take for another loop cover traffic message to be sent.
+    #[serde(with = "humantime_serde")]
+    pub loop_cover_traffic_average_delay: Duration,
+
+    /// Specifies the ratio of `primary_packet_size` to `secondary_packet_size` used in cover traffic.
+    /// Only applicable if `secondary_packet_size` is enabled.
+    pub cover_traffic_primary_size_ratio: f64,
+
+    /// Controls whether the dedicated loop cover traffic stream should be enabled.
+    /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay])
+    pub disable_loop_cover_traffic_stream: bool,
+}
+
+impl Default for CoverTrafficV6 {
+    fn default() -> Self {
+        CoverTrafficV6 {
+            loop_cover_traffic_average_delay: DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY,
+            cover_traffic_primary_size_ratio: DEFAULT_COVER_TRAFFIC_PRIMARY_SIZE_RATIO,
+            disable_loop_cover_traffic_stream: false,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct GatewayConnectionV6 {
+    /// How long we're willing to wait for a response to a message sent to the gateway,
+    /// before giving up on it.
+    #[serde(with = "humantime_serde")]
+    pub gateway_response_timeout: Duration,
+}
+
+impl Default for GatewayConnectionV6 {
+    fn default() -> Self {
+        GatewayConnectionV6 {
+            gateway_response_timeout: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct AcknowledgementsV6 {
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// sent acknowledgement is going to be delayed at any given mix node.
+    /// So for an ack going through three mix nodes, on average, it will take three times this value
+    /// until the packet reaches its destination.
+    #[serde(with = "humantime_serde")]
+    pub average_ack_delay: Duration,
+
+    /// Value multiplied with the expected round trip time of an acknowledgement packet before
+    /// it is assumed it was lost and retransmission of the data packet happens.
+    /// In an ideal network with 0 latency, this value would have been 1.
+    pub ack_wait_multiplier: f64,
+
+    /// Value added to the expected round trip time of an acknowledgement packet before
+    /// it is assumed it was lost and retransmission of the data packet happens.
+    /// In an ideal network with 0 latency, this value would have been 0.
+    #[serde(with = "humantime_serde")]
+    pub ack_wait_addition: Duration,
+}
+
+impl Default for AcknowledgementsV6 {
+    fn default() -> Self {
+        AcknowledgementsV6 {
+            average_ack_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            ack_wait_multiplier: DEFAULT_ACK_WAIT_MULTIPLIER,
+            ack_wait_addition: DEFAULT_ACK_WAIT_ADDITION,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct TopologyV6 {
+    /// The uniform delay every which clients are querying the directory server
+    /// to try to obtain a compatible network topology to send sphinx packets through.
+    #[serde(with = "humantime_serde")]
+    pub topology_refresh_rate: Duration,
+
+    /// During topology refresh, test packets are sent through every single possible network
+    /// path. This timeout determines waiting period until it is decided that the packet
+    /// did not reach its destination.
+    #[serde(with = "humantime_serde")]
+    pub topology_resolution_timeout: Duration,
+
+    /// Specifies whether the client should not refresh the network topology after obtaining
+    /// the first valid instance.
+    /// Supersedes `topology_refresh_rate_ms`.
+    pub disable_refreshing: bool,
+
+    /// Defines how long the client is going to wait on startup for its gateway to come online,
+    /// before abandoning the procedure.
+    #[serde(with = "humantime_serde")]
+    pub max_startup_gateway_waiting_period: Duration,
+
+    /// Specifies a minimum performance of a mixnode that is used on route construction.
+    /// This setting is only applicable when `NymApi` topology is used.
+    pub minimum_mixnode_performance: u8,
+
+    /// Specifies a minimum performance of a gateway that is used on route construction.
+    /// This setting is only applicable when `NymApi` topology is used.
+    pub minimum_gateway_performance: u8,
+
+    /// Specifies whether this client should attempt to retrieve all available network nodes
+    /// as opposed to just active mixnodes/gateways.
+    pub use_extended_topology: bool,
+
+    /// Specifies whether this client should ignore the current epoch role of the target egress node
+    /// when constructing the final hop packets.
+    pub ignore_egress_epoch_role: bool,
+
+    /// Specifies whether this client should ignore the current epoch role of the ingress node
+    /// when attempting to establish new connection
+    pub ignore_ingress_epoch_role: bool,
+}
+
+impl Default for TopologyV6 {
+    fn default() -> Self {
+        TopologyV6 {
+            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
+            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
+            disable_refreshing: false,
+            max_startup_gateway_waiting_period: DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD,
+            minimum_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
+            minimum_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
+            use_extended_topology: false,
+
+            ignore_egress_epoch_role: true,
+            ignore_ingress_epoch_role: true,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct ReplySurbsV6 {
+    /// Defines the minimum number of reply surbs the client wants to keep in its storage at all times.
+    /// It can only allow to go below that value if its to request additional reply surbs.
+    pub minimum_reply_surb_storage_threshold: usize,
+
+    /// Defines the maximum number of reply surbs the client wants to keep in its storage at any times.
+    pub maximum_reply_surb_storage_threshold: usize,
+
+    /// Defines the soft threshold ontop of the minimum reply surb storage threshold for when the client
+    /// should proactively request additional reply surbs.
+    pub minimum_reply_surb_threshold_buffer: usize,
+
+    /// Defines the minimum number of reply surbs the client would request.
+    pub minimum_reply_surb_request_size: u32,
+
+    /// Defines the maximum number of reply surbs the client would request.
+    pub maximum_reply_surb_request_size: u32,
+
+    /// Defines the maximum number of reply surbs a remote party is allowed to request from this client at once.
+    pub maximum_allowed_reply_surb_request_size: u32,
+
+    /// Defines maximum amount of time the client is going to wait for reply surbs before explicitly asking
+    /// for more even though in theory they wouldn't need to.
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_rerequest_waiting_period: Duration,
+
+    /// Defines maximum amount of time the client is going to wait for reply surbs before
+    /// deciding it's never going to get them and would drop all pending messages
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_drop_waiting_period: Duration,
+
+    /// Defines maximum amount of time given reply surb is going to be valid for.
+    /// This is going to be superseded by key rotation once implemented.
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_age: Duration,
+
+    /// Defines maximum amount of time given reply key is going to be valid for.
+    /// This is going to be superseded by key rotation once implemented.
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_key_age: Duration,
+
+    /// Specifies the number of mixnet hops the packet should go through. If not specified, then
+    /// the default value is used.
+    pub surb_mix_hops: Option<u8>,
+
+    /// Specifies if we should reset all the sender tags on startup
+    pub fresh_sender_tags: bool,
+}
+
+impl Default for ReplySurbsV6 {
+    fn default() -> Self {
+        ReplySurbsV6 {
+            minimum_reply_surb_storage_threshold: DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD,
+            maximum_reply_surb_storage_threshold: DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD,
+            minimum_reply_surb_threshold_buffer: DEFAULT_MINIMUM_REPLY_SURB_THRESHOLD_BUFFER,
+            minimum_reply_surb_request_size: DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE,
+            maximum_reply_surb_request_size: DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE,
+            maximum_allowed_reply_surb_request_size: DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE,
+            maximum_reply_surb_rerequest_waiting_period:
+                DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD,
+            maximum_reply_surb_drop_waiting_period: DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD,
+            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
+            maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
+            surb_mix_hops: None,
+            fresh_sender_tags: false,
+        }
+    }
+}
+
+#[derive(Debug, Default, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct DebugConfigV6 {
+    /// Defines all configuration options related to traffic streams.
+    pub traffic: TrafficV6,
+
+    /// Defines all configuration options related to cover traffic stream(s).
+    pub cover_traffic: CoverTrafficV6,
+
+    /// Defines all configuration options related to the gateway connection.
+    pub gateway_connection: GatewayConnectionV6,
+
+    /// Defines all configuration options related to acknowledgements, such as delays or wait timeouts.
+    pub acknowledgements: AcknowledgementsV6,
+
+    /// Defines all configuration options related topology, such as refresh rates or timeouts.
+    pub topology: TopologyV6,
+
+    /// Defines all configuration options related to reply SURBs.
+    pub reply_surbs: ReplySurbsV6,
+
+    /// Defines all configuration options related to stats reporting.
+    pub stats_reporting: StatsReportingV6,
+
+    /// Defines all configuration options related to the forget me flag.
+    pub forget_me: ForgetMeV6,
+
+    /// Defines all configuration options related to the remember me flag.
+    pub remember_me: RememberMeV6,
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct StatsReportingV6 {
+    /// Is stats reporting enabled
+    pub enabled: bool,
+
+    /// Address of the stats collector. If this is none, no reporting will happen, regardless of `enabled`
+    #[serde(
+        serialize_with = "ser_maybe_stringified",
+        deserialize_with = "de_maybe_stringified"
+    )]
+    pub provider_address: Option<Recipient>,
+
+    /// With what frequence will statistics be sent
+    #[serde(with = "humantime_serde")]
+    pub reporting_interval: Duration,
+}
+
+impl Default for StatsReportingV6 {
+    fn default() -> Self {
+        StatsReportingV6 {
+            enabled: true,
+            provider_address: None,
+            reporting_interval: STATS_REPORT_INTERVAL_SECS,
+        }
+    }
+}
+
+#[derive(Clone, Default, Debug, Deserialize, PartialEq, Serialize, Copy)]
+pub struct ForgetMeV6 {
+    client: bool,
+    stats: bool,
+}
+
+#[derive(Clone, Default, Debug, Deserialize, PartialEq, Serialize, Copy)]
+pub struct RememberMeV6 {
+    /// Signal that this client should be accounted for in the stats
+    stats: bool,
+
+    /// Type of the session to remember, if it should be remembered
+    session_type: SessionTypeV6,
+}
+
+#[derive(PartialEq, Copy, Clone, Serialize, Deserialize, Default, Debug)]
+pub enum SessionTypeV6 {
+    Vpn,
+    Mixnet,
+    Wasm,
+    Native,
+    Socks5,
+    #[default]
+    Unknown,
+}
+
+impl From<SessionTypeV6> for SessionType {
+    fn from(value: SessionTypeV6) -> Self {
+        match value {
+            SessionTypeV6::Vpn => Self::Vpn,
+            SessionTypeV6::Mixnet => Self::Mixnet,
+            SessionTypeV6::Wasm => Self::Wasm,
+            SessionTypeV6::Native => Self::Native,
+            SessionTypeV6::Socks5 => Self::Socks5,
+            SessionTypeV6::Unknown => Self::Unknown,
+        }
+    }
+}

common/client-core/gateways-storage/Cargo.toml

@@ -3,17 +3,18 @@ name = "nym-client-core-gateways-storage"
 version = "0.1.0"
 edition = "2021"
 license.workspace = true
+rust-version.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
 async-trait.workspace = true
 cosmrs.workspace = true
-log.workspace = true
 serde = { workspace = true, features = ["derive"] }
 thiserror.workspace = true
 time.workspace = true
 tokio = { workspace = true, features = ["sync"] }
+tracing.workspace = true
 url.workspace = true
 zeroize = { workspace = true, features = ["zeroize_derive"] }
 
@@ -26,6 +27,7 @@ features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"]
 optional = true
 
 [build-dependencies]
+anyhow = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 sqlx = { workspace = true, features = [
     "runtime-tokio-rustls",

common/client-core/gateways-storage/build.rs

@@ -2,23 +2,30 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #[tokio::main]
-async fn main() {
+async fn main() -> anyhow::Result<()> {
     #[cfg(feature = "fs-gateways-storage")]
     {
+        use anyhow::Context;
         use sqlx::{Connection, SqliteConnection};
         use std::env;
 
-        let out_dir = env::var("OUT_DIR").unwrap();
+        let out_dir = env::var("OUT_DIR")?;
         let database_path = format!("{out_dir}/gateways-storage-example.sqlite");
 
+        // remove the db file if it already existed from previous build
+        // in case it was from a different branch
+        if std::fs::exists(&database_path)? {
+            std::fs::remove_file(&database_path)?;
+        }
+
         let mut conn = SqliteConnection::connect(&format!("sqlite://{database_path}?mode=rwc"))
             .await
-            .expect("Failed to create SQLx database connection");
+            .context("Failed to create SQLx database connection")?;
 
         sqlx::migrate!("./fs_gateways_migrations")
             .run(&mut conn)
             .await
-            .expect("Failed to perform SQLx migrations");
+            .context("Failed to perform SQLx migrations")?;
 
         #[cfg(target_family = "unix")]
         println!("cargo:rustc-env=DATABASE_URL=sqlite://{}", &database_path);
@@ -28,4 +35,6 @@ async fn main() {
         // not a valid windows path... but hey, it works...
         println!("cargo:rustc-env=DATABASE_URL=sqlite:///{}", &database_path);
     }
+
+    Ok(())
 }

common/client-core/gateways-storage/src/backend/fs_backend/error.rs

@@ -2,8 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::BadGateway;
-use std::io;
-use std::path::PathBuf;
+use std::{io, path::PathBuf};
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -19,7 +18,6 @@ pub enum StorageError {
 
     #[error("failed to perform sqlx migration: {source}")]
     MigrationError {
-        #[source]
         #[from]
         source: sqlx::migrate::MigrateError,
     },
@@ -32,7 +30,6 @@ pub enum StorageError {
 
     #[error("failed to run the SQL query: {source}")]
     QueryError {
-        #[source]
         #[from]
         source: sqlx::error::Error,
     },

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -7,12 +7,12 @@ use crate::{
         RawActiveGateway, RawCustomGatewayDetails, RawRegisteredGateway, RawRemoteGatewayDetails,
     },
 };
-use log::{debug, error};
 use sqlx::{
     sqlite::{SqliteAutoVacuum, SqliteSynchronous},
     ConnectOptions,
 };
 use std::path::Path;
+use tracing::{debug, error};
 
 #[derive(Debug, Clone)]
 pub struct StorageManager {
@@ -87,7 +87,7 @@ impl StorageManager {
         sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
             .fetch_one(&self.connection_pool)
             .await
-            .map(|result| result.exists == Some(1))
+            .map(|result| result.exists == 1)
     }
 
     pub(crate) async fn maybe_get_registered_gateway(

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -12,12 +12,12 @@ use crate::{
     error::ClientCoreError,
     init::types::{GatewaySelectionSpecification, GatewaySetup},
 };
-use log::info;
 use nym_client_core_gateways_storage::GatewayDetails;
 use nym_crypto::asymmetric::ed25519;
 use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
 use std::path::PathBuf;
+use tracing::info;
 
 #[cfg_attr(feature = "cli", derive(clap::Args))]
 #[derive(Debug, Clone)]
@@ -81,14 +81,14 @@ where
 
     // Attempt to use a user-provided gateway, if possible
     let user_chosen_gateway_id = common_args.gateway_id;
-    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+    tracing::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
 
     let selection_spec = GatewaySelectionSpecification::new(
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
     );
-    log::debug!("Gateway selection specification: {selection_spec:?}");
+    tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
     let registered_gateways = get_all_registered_identities(&details_store).await?;
 

common/client-core/src/cli_helpers/client_import_coin_index_signatures.rs

@@ -58,6 +58,7 @@ where
         Some(data) => data,
         None => {
             // SAFETY: one of those arguments must have been set
+            #[allow(clippy::unwrap_used)]
             fs::read(common_args.signatures_path.unwrap())?
         }
     };

common/client-core/src/cli_helpers/client_import_credential.rs

@@ -64,6 +64,7 @@ where
         Some(data) => data,
         None => {
             // SAFETY: one of those arguments must have been set
+            #[allow(clippy::unwrap_used)]
             fs::read(common_args.credential_path.unwrap())?
         }
     };

common/client-core/src/cli_helpers/client_import_expiration_date_signatures.rs

@@ -58,6 +58,7 @@ where
         Some(data) => data,
         None => {
             // SAFETY: one of those arguments must have been set
+            #[allow(clippy::unwrap_used)]
             fs::read(common_args.signatures_path.unwrap())?
         }
     };

common/client-core/src/cli_helpers/client_import_master_verification_key.rs

@@ -58,6 +58,7 @@ where
         Some(data) => data,
         None => {
             // SAFETY: one of those arguments must have been set
+            #[allow(clippy::unwrap_used)]
             fs::read(common_args.key_path.unwrap())?
         }
     };

common/client-core/src/cli_helpers/client_init.rs

@@ -12,7 +12,6 @@ use crate::{
     },
     init::types::{GatewaySelectionSpecification, GatewaySetup, InitResults},
 };
-use log::info;
 use nym_client_core_gateways_storage::GatewayDetails;
 use nym_crypto::asymmetric::ed25519;
 use nym_sphinx::addressing::Recipient;
@@ -20,6 +19,7 @@ use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
 use rand::rngs::OsRng;
 use std::path::PathBuf;
+use tracing::info;
 
 // we can suppress this warning (as suggested by linter itself) since we're only using it in our own code
 #[allow(async_fn_in_trait)]
@@ -130,23 +130,23 @@ where
 
     // Attempt to use a user-provided gateway, if possible
     let user_chosen_gateway_id = common_args.gateway;
-    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+    tracing::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
 
     let selection_spec = GatewaySelectionSpecification::new(
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
     );
-    log::debug!("Gateway selection specification: {selection_spec:?}");
+    tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
     // Load and potentially override config
-    log::debug!("Init arguments: {init_args:#?}");
+    tracing::debug!("Init arguments: {init_args:#?}");
     let config = C::construct_config(&init_args);
-    log::debug!("Constructed config: {config:#?}");
+    tracing::debug!("Constructed config: {config:#?}");
     let paths = config.common_paths();
     let core = config.core_config();
 
-    log::info!(
+    tracing::info!(
         "Using nym-api: {}",
         core.client
             .nym_api_urls

common/client-core/src/client/base_client/mod.rs

@@ -18,6 +18,7 @@ use crate::client::received_buffer::{
     ReceivedBufferRequestReceiver, ReceivedBufferRequestSender, ReceivedMessagesBufferController,
 };
 use crate::client::replies::reply_controller;
+use crate::client::replies::reply_controller::key_rotation_helpers::KeyRotationConfig;
 use crate::client::replies::reply_controller::{ReplyControllerReceiver, ReplyControllerSender};
 use crate::client::replies::reply_storage::{
     CombinedReplyStorage, PersistentReplyStorage, ReplyStorageBackend, SentReplyKeys,
@@ -34,9 +35,8 @@ use crate::init::{
 };
 use crate::{config, spawn_future};
 use futures::channel::mpsc;
-use log::*;
 use nym_bandwidth_controller::BandwidthController;
-use nym_client_core_config_types::ForgetMe;
+use nym_client_core_config_types::{ForgetMe, RememberMe};
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::{ed25519, x25519};
@@ -56,13 +56,18 @@ use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender,
 use nym_task::{TaskClient, TaskHandle};
 use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
-use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, UserAgent};
+use nym_validator_client::nym_api::NymApiClientExt;
+use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, NymApiClient, UserAgent};
+use rand::prelude::SliceRandom;
 use rand::rngs::OsRng;
+use rand::thread_rng;
 use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
+use time::OffsetDateTime;
 use tokio::sync::mpsc::Sender;
+use tracing::*;
 use url::Url;
 
 #[cfg(all(
@@ -130,9 +135,11 @@ pub enum ClientInputStatus {
 }
 
 impl ClientInputStatus {
+    #[allow(clippy::panic)]
     pub fn register_producer(&mut self) -> ClientInput {
         match std::mem::replace(self, ClientInputStatus::Connected) {
             ClientInputStatus::AwaitingProducer { client_input } => client_input,
+            // critical failure implying misuse of software
             ClientInputStatus::Connected => panic!("producer was already registered before"),
         }
     }
@@ -144,9 +151,11 @@ pub enum ClientOutputStatus {
 }
 
 impl ClientOutputStatus {
+    #[allow(clippy::panic)]
     pub fn register_consumer(&mut self) -> ClientOutput {
         match std::mem::replace(self, ClientOutputStatus::Connected) {
             ClientOutputStatus::AwaitingConsumer { client_output } => client_output,
+            // critical failure implying misuse of software
             ClientOutputStatus::Connected => panic!("consumer was already registered before"),
         }
     }
@@ -238,6 +247,12 @@ where
         self
     }
 
+    #[must_use]
+    pub fn with_remember_me(mut self, remember_me: &RememberMe) -> Self {
+        self.config.debug.remember_me = *remember_me;
+        self
+    }
+
     #[must_use]
     pub fn with_gateway_setup(mut self, setup: GatewaySetup) -> Self {
         self.setup_method = setup;
@@ -332,6 +347,7 @@ where
     #[allow(clippy::too_many_arguments)]
     fn start_real_traffic_controller(
         controller_config: real_messages_control::Config,
+        key_rotation_config: KeyRotationConfig,
         topology_accessor: TopologyAccessor,
         ack_receiver: AcknowledgementReceiver,
         input_receiver: InputMessageReceiver,
@@ -349,6 +365,7 @@ where
 
         RealMessagesController::new(
             controller_config,
+            key_rotation_config,
             ack_receiver,
             input_receiver,
             mix_sender,
@@ -447,10 +464,10 @@ where
             };
 
         let gateway_failure = |err| {
-            log::error!("Could not authenticate and start up the gateway connection - {err}");
+            tracing::error!("Could not authenticate and start up the gateway connection - {err}");
             ClientCoreError::GatewayClientError {
                 gateway_id: details.gateway_id.to_base58_string(),
-                source: err,
+                source: Box::new(err),
             }
         };
 
@@ -549,14 +566,14 @@ where
         custom_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
         config_topology: config::Topology,
         nym_api_urls: Vec<Url>,
-        user_agent: Option<UserAgent>,
+        nym_api_client: NymApiClient,
     ) -> Box<dyn TopologyProvider + Send + Sync> {
         // if no custom provider was ... provided ..., create one using nym-api
         custom_provider.unwrap_or_else(|| {
             Box::new(NymApiTopologyProvider::new(
                 config_topology,
                 nym_api_urls,
-                user_agent,
+                nym_api_client,
             ))
         })
     }
@@ -592,7 +609,7 @@ where
         topology_refresher.try_refresh().await;
 
         if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
-            log::error!(
+            tracing::error!(
                 "The current network topology seem to be insufficient to route any packets through \
                 - check if enough nodes and a gateway are online - source: {err}"
             );
@@ -668,27 +685,40 @@ where
     // TODO: rename it as it implies the data is persistent whilst one can use InMemBackend
     async fn setup_persistent_reply_storage(
         backend: S::ReplyStore,
+        key_rotation_config: KeyRotationConfig,
         shutdown: TaskClient,
     ) -> Result<CombinedReplyStorage, ClientCoreError>
     where
         <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
         S::ReplyStore: Send + Sync,
     {
-        log::trace!("Setup persistent reply storage");
+        tracing::trace!("Setup persistent reply storage");
+        let now = OffsetDateTime::now_utc();
+        let expected_current_key_rotation_start =
+            key_rotation_config.expected_current_key_rotation_start(now);
+        // time of the start of one epoch BEFORE the CURRENT rotation has begun
+        // this indicates the starting time of when packets with the current keys might have been constructed
+        // (i.e. any surbs OLDER than that MUST BE invalid)
+        let prior_epoch_start =
+            expected_current_key_rotation_start - key_rotation_config.epoch_duration;
+
         let persistent_storage = PersistentReplyStorage::new(backend);
         let mem_store = persistent_storage
-            .load_state_from_backend()
+            .load_state_from_backend(prior_epoch_start)
             .await
             .map_err(|err| ClientCoreError::SurbStorageError {
                 source: Box::new(err),
             })?;
 
         let store_clone = mem_store.clone();
-        spawn_future(async move {
-            persistent_storage
-                .flush_on_shutdown(store_clone, shutdown)
-                .await
-        });
+        spawn_future!(
+            async move {
+                persistent_storage
+                    .flush_on_shutdown(store_clone, shutdown)
+                    .await
+            },
+            "PersistentReplyStorage::flush_on_shutdown"
+        );
 
         Ok(mem_store)
     }
@@ -709,7 +739,7 @@ where
             let mut rng = OsRng;
             let keys = if let Some(derivation_material) = derivation_material {
                 ClientKeys::from_master_key(&mut rng, &derivation_material)
-                    .map_err(|_| ClientCoreError::HkdfDerivationError {})?
+                    .map_err(|_| ClientCoreError::HkdfDerivationError)?
             } else {
                 ClientKeys::generate_new(&mut rng)
             };
@@ -719,6 +749,23 @@ where
         setup_gateway(setup_method, key_store, details_store).await
     }
 
+    fn construct_nym_api_client(config: &Config, user_agent: Option<UserAgent>) -> NymApiClient {
+        let mut nym_api_urls = config.get_nym_api_endpoints();
+        nym_api_urls.shuffle(&mut thread_rng());
+
+        if let Some(user_agent) = user_agent {
+            NymApiClient::new_with_user_agent(nym_api_urls[0].clone(), user_agent)
+        } else {
+            NymApiClient::new(nym_api_urls[0].clone())
+        }
+    }
+
+    async fn determine_key_rotation_state(
+        client: &NymApiClient,
+    ) -> Result<KeyRotationConfig, ClientCoreError> {
+        Ok(client.nym_api.get_key_rotation_info().await?.into())
+    }
+
     pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
     where
         S::ReplyStore: Send + Sync,
@@ -783,11 +830,14 @@ where
             .dkg_query_client
             .map(|client| BandwidthController::new(credential_store, client));
 
+        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone());
+        let key_rotation_config = Self::determine_key_rotation_state(&nym_api_client).await?;
+
         let topology_provider = Self::setup_topology_provider(
             self.custom_topology_provider.take(),
             self.config.debug.topology,
             self.config.get_nym_api_endpoints(),
-            self.user_agent.clone(),
+            nym_api_client,
         );
 
         let stats_reporter = Self::start_statistics_control(
@@ -832,6 +882,7 @@ where
 
         let reply_storage = Self::setup_persistent_reply_storage(
             reply_storage_backend,
+            key_rotation_config,
             shutdown.fork("persistent_reply_storage"),
         )
         .await?;
@@ -872,6 +923,7 @@ where
 
         Self::start_real_traffic_controller(
             controller_config,
+            key_rotation_config,
             shared_topology_accessor.clone(),
             ack_receiver,
             input_receiver,
@@ -930,6 +982,7 @@ where
             task_handle: shutdown,
             client_request_sender,
             forget_me: self.config.debug.forget_me,
+            remember_me: self.config.debug.remember_me,
         })
     }
 }
@@ -944,4 +997,5 @@ pub struct BaseClient {
     pub client_request_sender: ClientRequestSender,
     pub task_handle: TaskHandle,
     pub forget_me: ForgetMe,
+    pub remember_me: RememberMe,
 }

common/client-core/src/client/base_client/non_wasm_helpers.rs

@@ -1,32 +1,30 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::replies::reply_storage::{
-    fs_backend, CombinedReplyStorage, ReplyStorageBackend,
+use crate::{
+    client::replies::reply_storage::{fs_backend, CombinedReplyStorage, ReplyStorageBackend},
+    config,
+    config::Config,
+    error::ClientCoreError,
 };
-use crate::config;
-use crate::config::Config;
-use crate::error::ClientCoreError;
-use log::{error, info, trace};
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::OnDiskGatewaysDetails;
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_validator_client::nyxd;
-use nym_validator_client::QueryHttpRpcNyxdClient;
-use std::path::Path;
-use std::{fs, io};
+use nym_validator_client::{nyxd, QueryHttpRpcNyxdClient};
+use std::{io, path::Path};
 use time::OffsetDateTime;
+use tracing::{error, info, trace};
 use url::Url;
 
 async fn setup_fresh_backend<P: AsRef<Path>>(
     db_path: P,
     surb_config: &config::ReplySurbs,
 ) -> Result<fs_backend::Backend, ClientCoreError> {
-    info!("creating fresh surb database");
+    info!("Creating fresh surb database");
     let mut storage_backend = match fs_backend::Backend::init(db_path).await {
         Ok(backend) => backend,
         Err(err) => {
-            error!("failed to setup persistent storage backend for our reply needs: {err}");
+            error!("setup_fresh_backend: Failed to setup persistent storage backend for our reply needs: {err}");
             return Err(ClientCoreError::SurbStorageError {
                 source: Box::new(err),
             });
@@ -40,14 +38,15 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
         surb_config.minimum_reply_surb_storage_threshold,
         surb_config.maximum_reply_surb_storage_threshold,
     );
-    storage_backend
-        .init_fresh(&mem_store)
-        .await
-        .map_err(|err| ClientCoreError::SurbStorageError {
-            source: Box::new(err),
-        })?;
-
-    Ok(storage_backend)
+    match storage_backend.init_fresh(&mem_store).await {
+        Ok(()) => Ok(storage_backend),
+        Err(err) => {
+            storage_backend.shutdown().await;
+            Err(ClientCoreError::SurbStorageError {
+                source: Box::new(err),
+            })
+        }
+    }
 }
 
 // fn setup_inactive_backend(surb_config: &config::ReplySurbs) -> fs_backend::Backend {
@@ -58,12 +57,11 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
 //     )
 // }
 
-fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
+async fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
     let db_path = db_path.as_ref();
     debug_assert!(db_path.exists());
 
     let now = OffsetDateTime::now_utc().unix_timestamp();
-
     let suffix = format!("_{now}.corrupted");
 
     let new_extension =
@@ -72,11 +70,15 @@ fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
         } else {
             suffix
         };
+    let renamed = db_path.with_extension(new_extension);
 
-    let mut renamed = db_path.to_owned();
-    renamed.set_extension(new_extension);
-
-    fs::rename(db_path, renamed)
+    tokio::fs::rename(db_path, &renamed).await.inspect_err(|_| {
+        error!(
+            "Failed to rename corrupt database file: {} to {}",
+            db_path.display(),
+            renamed.display()
+        );
+    })
 }
 
 pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
@@ -87,13 +89,12 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
     // the existing one
     let db_path = db_path.as_ref();
     if db_path.exists() {
-        info!("loading existing surb database");
-        match fs_backend::Backend::try_load(db_path, surb_config.fresh_sender_tags).await {
+        info!("Loading existing surb database");
+        match fs_backend::Backend::try_load(db_path).await {
             Ok(backend) => Ok(backend),
             Err(err) => {
-                error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
-
-                archive_corrupted_database(db_path)?;
+                error!("setup_fs_reply_surb_backend: Failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
+                archive_corrupted_database(db_path).await?;
                 setup_fresh_backend(db_path, surb_config).await
             }
         }
@@ -113,41 +114,32 @@ pub async fn setup_fs_gateways_storage<P: AsRef<Path>>(
         })
 }
 
-pub fn create_bandwidth_controller<St: CredentialStorage>(
-    config: &Config,
-    storage: St,
-) -> BandwidthController<QueryHttpRpcNyxdClient, St> {
-    let nyxd_url = config
-        .get_validator_endpoints()
-        .pop()
-        .expect("No nyxd validator endpoint provided");
-
-    create_bandwidth_controller_with_urls(nyxd_url, storage)
-}
-
 pub fn create_bandwidth_controller_with_urls<St: CredentialStorage>(
     nyxd_url: Url,
     storage: St,
-) -> BandwidthController<QueryHttpRpcNyxdClient, St> {
-    let client = default_query_dkg_client(nyxd_url);
+) -> Result<BandwidthController<QueryHttpRpcNyxdClient, St>, ClientCoreError> {
+    let client = default_query_dkg_client(nyxd_url)?;
 
-    BandwidthController::new(storage, client)
+    Ok(BandwidthController::new(storage, client))
 }
 
-pub fn default_query_dkg_client_from_config(config: &Config) -> QueryHttpRpcNyxdClient {
+pub fn default_query_dkg_client_from_config(
+    config: &Config,
+) -> Result<QueryHttpRpcNyxdClient, ClientCoreError> {
     let nyxd_url = config
         .get_validator_endpoints()
         .pop()
-        .expect("No nyxd validator endpoint provided");
+        .ok_or(ClientCoreError::RpcClientMissingUrl)?;
 
     default_query_dkg_client(nyxd_url)
 }
 
-pub fn default_query_dkg_client(nyxd_url: Url) -> QueryHttpRpcNyxdClient {
+pub fn default_query_dkg_client(nyxd_url: Url) -> Result<QueryHttpRpcNyxdClient, ClientCoreError> {
     let details = nym_network_defaults::NymNetworkDetails::new_from_env();
     let client_config = nyxd::Config::try_from_nym_network_details(&details)
-        .expect("failed to construct validator client config");
+        .map_err(|source| ClientCoreError::InvalidNetworkDetails { source })?;
     // overwrite env configuration with config URLs
+
     QueryHttpRpcNyxdClient::connect(client_config, nyxd_url.as_str())
-        .expect("Could not construct query client")
+        .map_err(|source| ClientCoreError::RpcClientCreationFailure { source })
 }

common/client-core/src/client/cover_traffic_stream.rs

@@ -6,7 +6,6 @@ use crate::client::topology_control::TopologyAccessor;
 use crate::{config, spawn_future};
 use futures::task::{Context, Poll};
 use futures::{Future, Stream, StreamExt};
-use log::*;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::cover::generate_loop_cover_packet;
@@ -19,6 +18,7 @@ use std::pin::Pin;
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::mpsc::error::TrySendError;
+use tracing::*;
 
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::{sleep, Sleep};
@@ -210,10 +210,10 @@ impl LoopCoverTrafficStream<OsRng> {
                 TrySendError::Full(_) => {
                     // This isn't a problem, if the channel is full means we're already sending the
                     // max amount of messages downstream can handle.
-                    log::debug!("Failed to send cover message - channel full");
+                    tracing::debug!("Failed to send cover message - channel full");
                 }
                 TrySendError::Closed(_) => {
-                    log::warn!("Failed to send cover message - channel closed");
+                    tracing::warn!("Failed to send cover message - channel closed");
                 }
             }
         } else {
@@ -235,6 +235,7 @@ impl LoopCoverTrafficStream<OsRng> {
         tokio::task::yield_now().await;
     }
 
+    #[allow(clippy::panic)]
     pub fn start(mut self) {
         if self.cover_traffic.disable_loop_cover_traffic_stream {
             // we should have never got here in the first place - the task should have never been created to begin with
@@ -251,27 +252,30 @@ impl LoopCoverTrafficStream<OsRng> {
 
         let mut shutdown = self.task_client.fork("select");
 
-        spawn_future(async move {
-            debug!("Started LoopCoverTrafficStream with graceful shutdown support");
+        spawn_future!(
+            async move {
+                debug!("Started LoopCoverTrafficStream with graceful shutdown support");
 
-            while !shutdown.is_shutdown() {
-                tokio::select! {
-                    biased;
-                    _ = shutdown.recv() => {
-                        log::trace!("LoopCoverTrafficStream: Received shutdown");
-                    }
-                    next = self.next() => {
-                        if next.is_some() {
-                            self.on_new_message().await;
-                        } else {
-                            log::trace!("LoopCoverTrafficStream: Stopping since channel closed");
-                            break;
+                while !shutdown.is_shutdown() {
+                    tokio::select! {
+                        biased;
+                        _ = shutdown.recv() => {
+                            tracing::trace!("LoopCoverTrafficStream: Received shutdown");
+                        }
+                        next = self.next() => {
+                            if next.is_some() {
+                                self.on_new_message().await;
+                            } else {
+                                tracing::trace!("LoopCoverTrafficStream: Stopping since channel closed");
+                                break;
+                            }
                         }
                     }
                 }
-            }
-            shutdown.recv_timeout().await;
-            log::debug!("LoopCoverTrafficStream: Exiting");
-        })
+                shutdown.recv_timeout().await;
+                tracing::debug!("LoopCoverTrafficStream: Exiting");
+            },
+            "LoopCoverTrafficStream"
+        )
     }
 }

common/client-core/src/client/inbound_messages.rs

@@ -135,7 +135,9 @@ impl InputMessage {
             recipient_tag,
             data,
             lane,
-            max_retransmissions: None,
+            // \/ set it to SOME sane default so that if we run out of surbs and constantly
+            // fail to request more, we wouldn't be stuck in limbo
+            max_retransmissions: Some(10),
         };
         if let Some(packet_type) = packet_type {
             InputMessage::new_wrapper(message, packet_type)

common/client-core/src/client/mix_traffic/mod.rs

@@ -4,10 +4,10 @@
 use crate::client::mix_traffic::transceiver::GatewayTransceiver;
 use crate::error::ClientCoreError;
 use crate::spawn_future;
-use log::*;
 use nym_gateway_requests::ClientRequest;
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::TaskClient;
+use tracing::*;
 use transceiver::ErasedGatewayError;
 
 pub type BatchMixMessageSender = tokio::sync::mpsc::Sender<Vec<MixPacket>>;
@@ -96,72 +96,94 @@ impl MixTrafficController {
         mut mix_packets: Vec<MixPacket>,
     ) -> Result<(), ErasedGatewayError> {
         debug_assert!(!mix_packets.is_empty());
-
-        let result = if mix_packets.len() == 1 {
+        let send_future = if mix_packets.len() == 1 {
+            // SAFETY: we just checked we have one packet
+            #[allow(clippy::unwrap_used)]
             let mix_packet = mix_packets.pop().unwrap();
-            self.gateway_transceiver.send_mix_packet(mix_packet).await
+            self.gateway_transceiver.send_mix_packet(mix_packet)
         } else {
-            self.gateway_transceiver
-                .batch_send_mix_packets(mix_packets)
-                .await
+            self.gateway_transceiver.batch_send_mix_packets(mix_packets)
         };
 
-        if result.is_err() {
-            self.consecutive_gateway_failure_count += 1;
-        } else {
-            trace!("We *might* have managed to forward sphinx packet(s) to the gateway!");
-            self.consecutive_gateway_failure_count = 0;
-        }
+        tokio::select! {
+            biased;
+            _ = self.task_client.recv() => {
+                trace!("received shutdown while handling messages");
+                Ok(())
+            }
+            result = send_future => {
+                if result.is_err() {
+                    self.consecutive_gateway_failure_count += 1;
+                } else {
+                    trace!("We *might* have managed to forward sphinx packet(s) to the gateway!");
+                    self.consecutive_gateway_failure_count = 0;
+                }
 
-        result
+                result
+            }
+        }
+    }
+
+    async fn on_client_request(&mut self, client_request: ClientRequest) {
+        tokio::select! {
+            biased;
+             _ = self.task_client.recv() => {
+                trace!("received shutdown while handling client request");
+            }
+            result = self.gateway_transceiver.send_client_request(client_request) => {
+                if let Err(err) = result {
+                    error!("Failed to send client request: {err}")
+                }
+            }
+        }
     }
 
     pub fn start(mut self) {
-        spawn_future(async move {
-            debug!("Started MixTrafficController with graceful shutdown support");
-
-            while !self.task_client.is_shutdown() {
-                tokio::select! {
-                    mix_packets = self.mix_rx.recv() => match mix_packets {
-                        Some(mix_packets) => {
-                            if let Err(err) = self.on_messages(mix_packets).await {
-                                error!("Failed to send sphinx packet(s) to the gateway: {err}");
-                                if self.consecutive_gateway_failure_count == MAX_FAILURE_COUNT {
-                                    // Disconnect from the gateway. If we should try to re-connect
-                                    // is handled at a higher layer.
-                                    error!("Failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead");
-                                    // Do we need to handle the embedded mixnet client case
-                                    // separately?
-                                    self.task_client.send_we_stopped(Box::new(ClientCoreError::GatewayFailedToForwardMessages));
-                                    break;
-                                }
-                            }
-                        },
-                        None => {
-                            log::trace!("MixTrafficController: Stopping since channel closed");
+        spawn_future!(
+            async move {
+                debug!("Started MixTrafficController with graceful shutdown support");
+                while !self.task_client.is_shutdown() {
+                    tokio::select! {
+                        biased;
+                        _ = self.task_client.recv() => {
+                            tracing::trace!("MixTrafficController: Received shutdown");
                             break;
                         }
-                    },
-                    client_request = self.client_rx.recv() => match client_request {
-                        Some(client_request) => {
-                            match self.gateway_transceiver.send_client_request(client_request).await {
-                                Ok(_) => (),
-                                Err(e) => error!("Failed to send client request: {}", e),
-                            };
+                        mix_packets = self.mix_rx.recv() => match mix_packets {
+                            Some(mix_packets) => {
+                                if let Err(err) = self.on_messages(mix_packets).await {
+                                    error!("Failed to send sphinx packet(s) to the gateway: {err}");
+                                    if self.consecutive_gateway_failure_count == MAX_FAILURE_COUNT {
+                                        // Disconnect from the gateway. If we should try to re-connect
+                                        // is handled at a higher layer.
+                                        error!("Failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead");
+                                        // Do we need to handle the embedded mixnet client case
+                                        // separately?
+                                        self.task_client.send_we_stopped(Box::new(ClientCoreError::GatewayFailedToForwardMessages));
+                                        break;
+                                    }
+                                }
+                            },
+                            None => {
+                                tracing::trace!("MixTrafficController: Stopping since channel closed");
+                                break;
+                            }
+                        },
+                        client_request = self.client_rx.recv() => match client_request {
+                            Some(client_request) => {
+                                self.on_client_request(client_request).await;
+                            },
+                            None => {
+                                tracing::trace!("MixTrafficController, client request channel closed");
+                                break
+                            }
                         },
-                        None => {
-                            log::trace!("MixTrafficController, client request channel closed");
-                        }
-                    },
-                    _ = self.task_client.recv() => {
-                        log::trace!("MixTrafficController: Received shutdown");
-                        break;
                     }
                 }
-            }
-            self.task_client.recv_timeout().await;
-
-            log::debug!("MixTrafficController: Exiting");
-        });
+                self.task_client.recv_timeout().await;
+                tracing::debug!("MixTrafficController: Exiting");
+            },
+            "MixTrafficController"
+        );
     }
 }

common/client-core/src/client/mix_traffic/transceiver.rs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use async_trait::async_trait;
-use log::{debug, error};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::ed25519;
 use nym_gateway_client::error::GatewayClientError;
@@ -14,6 +13,7 @@ use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use thiserror::Error;
+use tracing::{debug, error};
 
 #[cfg(not(target_arch = "wasm32"))]
 use futures::channel::oneshot;
@@ -27,7 +27,7 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
     ErasedGatewayError(Box::new(err))
 }
 
-/// This combines combines the functionalities of being able to send and receive mix packets.
+/// This combines the functionalities of being able to send and receive mix packets.
 #[async_trait]
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
     fn gateway_identity(&self) -> ed25519::PublicKey;
@@ -87,7 +87,7 @@ impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
         message: ClientRequest,
     ) -> Result<(), GatewayClientError> {
         let _ = (**self).send_client_request(message.clone()).await?;
-        log::debug!("Sent client request: {:?}", message);
+        tracing::debug!("Sent client request: {:?}", message);
         Ok(())
     }
 }
@@ -269,6 +269,8 @@ pub struct MockGateway {
 }
 
 impl Default for MockGateway {
+    // test code
+    #[allow(clippy::unwrap_used)]
     fn default() -> Self {
         MockGateway {
             dummy_identity: "3ebjp1Fb9hdcS1AR6AZihgeJiMHkB5jjJUsvqNnfQwU7"

common/client-core/src/client/real_messages_control/acknowledgement_control/acknowledgement_listener.rs

@@ -5,7 +5,6 @@ use super::action_controller::{AckActionSender, Action};
 use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
 
 use futures::StreamExt;
-use log::*;
 use nym_gateway_client::AcknowledgementReceiver;
 use nym_sphinx::{
     acknowledgements::{identifier::recover_identifier, AckKey},
@@ -13,6 +12,7 @@ use nym_sphinx::{
 };
 use nym_task::TaskClient;
 use std::sync::Arc;
+use tracing::*;
 
 /// Module responsible for listening for any data resembling acknowledgements from the network
 /// and firing actions to remove them from the 'Pending' state.
@@ -65,7 +65,7 @@ impl AcknowledgementListener {
             return;
         }
 
-        trace!("Received {} from the mix network", frag_id);
+        trace!("Received {frag_id} from the mix network");
         self.stats_tx
             .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()).into());
         if let Err(err) = self
@@ -93,16 +93,16 @@ impl AcknowledgementListener {
                 acks = self.ack_receiver.next() => match acks {
                     Some(acks) => self.handle_ack_receiver_item(acks).await,
                     None => {
-                        log::trace!("AcknowledgementListener: Stopping since channel closed");
+                        tracing::trace!("AcknowledgementListener: Stopping since channel closed");
                         break;
                     }
                 },
                 _ = self.task_client.recv() => {
-                    log::trace!("AcknowledgementListener: Received shutdown");
+                    tracing::trace!("AcknowledgementListener: Received shutdown");
                 }
             }
         }
         self.task_client.recv_timeout().await;
-        log::debug!("AcknowledgementListener: Exiting");
+        tracing::debug!("AcknowledgementListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/action_controller.rs

@@ -5,7 +5,6 @@ use super::PendingAcknowledgement;
 use crate::client::real_messages_control::acknowledgement_control::RetransmissionRequestSender;
 use futures::channel::mpsc;
 use futures::StreamExt;
-use log::*;
 use nym_nonexhaustive_delayqueue::{Expired, NonExhaustiveDelayQueue, QueueKey};
 use nym_sphinx::chunking::fragment::FragmentIdentifier;
 use nym_sphinx::Delay as SphinxDelay;
@@ -13,6 +12,7 @@ use nym_task::TaskClient;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
+use tracing::*;
 
 pub(crate) type AckActionSender = mpsc::UnboundedSender<Action>;
 pub(crate) type AckActionReceiver = mpsc::UnboundedReceiver<Action>;
@@ -126,7 +126,7 @@ impl ActionController {
     fn handle_insert(&mut self, pending_acks: Vec<PendingAcknowledgement>) {
         for pending_ack in pending_acks {
             let frag_id = pending_ack.message_chunk.fragment_identifier();
-            trace!("{} is inserted", frag_id);
+            trace!("{frag_id} is inserted");
 
             if self
                 .pending_acks_data
@@ -161,22 +161,16 @@ impl ActionController {
             let new_queue_key = self.pending_acks_timers.insert(frag_id, timeout);
             *queue_key = Some(new_queue_key)
         } else {
-            debug!(
-                "Tried to START TIMER on pending ack that is already gone! - {}",
-                frag_id
-            );
+            debug!("Tried to START TIMER on pending ack that is already gone! - {frag_id}");
         }
     }
 
     fn handle_remove(&mut self, frag_id: FragmentIdentifier) {
-        trace!("{} is getting removed", frag_id);
+        trace!("{frag_id} is getting removed");
 
         match self.pending_acks_data.remove(&frag_id) {
             None => {
-                debug!(
-                    "Tried to REMOVE pending ack that is already gone! - {}",
-                    frag_id
-                );
+                debug!("Tried to REMOVE pending ack that is already gone! - {frag_id}");
             }
             Some((_, queue_key)) => {
                 if let Some(queue_key) = queue_key {
@@ -188,10 +182,7 @@ impl ActionController {
                 } else {
                     // I'm not 100% sure if having a `None` key is even possible here
                     // (REMOVE would have to be called before START TIMER),
-                    debug!(
-                        "Tried to REMOVE pending ack without TIMER active - {}",
-                        frag_id
-                    );
+                    debug!("Tried to REMOVE pending ack without TIMER active - {frag_id}");
                 }
             }
         }
@@ -200,27 +191,26 @@ impl ActionController {
     // initiated basically as a first step of retransmission. At first data has its delay updated
     // (as new sphinx packet was created with new expected delivery time)
     fn handle_update_pending_ack(&mut self, frag_id: FragmentIdentifier, delay: SphinxDelay) {
-        trace!("{} is updating its delay", frag_id);
+        trace!("{frag_id} is updating its delay");
         // TODO: is it possible to solve this without either locking or temporarily removing the value?
         if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.remove(&frag_id) {
-            // this Action is triggered by `RetransmissionRequestListener` (for 'normal' packets)
+            // SAFETY: this Action is triggered by `RetransmissionRequestListener` (for 'normal' packets)
             // or `ReplyController` (for 'reply' packets) which held the other potential
             // reference to this Arc. HOWEVER, before the Action was pushed onto the queue, the reference
             // was dropped hence this unwrap is safe.
+            #[allow(clippy::unwrap_used)]
             let mut inner_data = Arc::try_unwrap(pending_ack_data).unwrap();
             inner_data.update_retransmitted(delay);
 
             self.pending_acks_data
                 .insert(frag_id, (Arc::new(inner_data), queue_key));
         } else {
-            debug!(
-                "Tried to UPDATE TIMER on pending ack that is already gone! - {}",
-                frag_id
-            );
+            debug!("Tried to UPDATE TIMER on pending ack that is already gone! - {frag_id}");
         }
     }
 
     // note: when the entry expires it's automatically removed from pending_acks_timers
+    #[allow(clippy::panic)]
     fn handle_expired_ack_timer(&mut self, expired_ack: Expired<FragmentIdentifier>) {
         let frag_id = expired_ack.into_inner();
 
@@ -241,7 +231,7 @@ impl ActionController {
                 .unbounded_send(Arc::downgrade(pending_ack_data))
             {
                 if !self.task_client.is_shutdown_poll() {
-                    log::error!("Failed to send pending ack for retransmission: {err}");
+                    tracing::error!("Failed to send pending ack for retransmission: {err}");
                 }
             }
         } else {
@@ -269,7 +259,7 @@ impl ActionController {
                 action = self.incoming_actions.next() => match action {
                     Some(action) => self.process_action(action),
                     None => {
-                        log::trace!(
+                        tracing::trace!(
                             "ActionController: Stopping since incoming actions channel closed"
                         );
                         break;
@@ -278,17 +268,17 @@ impl ActionController {
                 expired_ack = self.pending_acks_timers.next() => match expired_ack {
                     Some(expired_ack) => self.handle_expired_ack_timer(expired_ack),
                     None => {
-                        log::trace!("ActionController: Stopping since ack channel closed");
+                        tracing::trace!("ActionController: Stopping since ack channel closed");
                         break;
                     }
                 },
                 _ = self.task_client.recv() => {
-                    log::trace!("ActionController: Received shutdown");
+                    tracing::trace!("ActionController: Received shutdown");
                     break;
                 }
             }
         }
         self.task_client.recv_timeout().await;
-        log::debug!("ActionController: Exiting");
+        tracing::debug!("ActionController: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/input_message_listener.rs

@@ -5,7 +5,6 @@ use crate::client::inbound_messages::{InputMessage, InputMessageReceiver};
 use crate::client::real_messages_control::message_handler::MessageHandler;
 use crate::client::real_messages_control::real_traffic_stream::RealMessage;
 use crate::client::replies::reply_controller::ReplyControllerSender;
-use log::*;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx::forwarding::packet::MixPacket;
@@ -13,6 +12,7 @@ use nym_sphinx::params::PacketType;
 use nym_task::connections::TransmissionLane;
 use nym_task::TaskClient;
 use rand::{CryptoRng, Rng};
+use tracing::*;
 
 /// Module responsible for dealing with the received messages: splitting them, creating acknowledgements,
 /// putting everything into sphinx packets, etc.
@@ -120,6 +120,7 @@ where
         }
     }
 
+    #[allow(clippy::panic)]
     async fn on_input_message(&mut self, msg: InputMessage) {
         match msg {
             InputMessage::Regular {
@@ -213,7 +214,9 @@ where
                     self.handle_premade_packets(msgs, lane).await
                 }
                 // MessageWrappers can't be nested
-                InputMessage::MessageWrapper { .. } => unimplemented!(),
+                InputMessage::MessageWrapper { .. } => {
+                    panic!("attempted to use nested MessageWrapper")
+                }
             },
         };
     }
@@ -223,21 +226,24 @@ where
 
         while !self.task_client.is_shutdown() {
             tokio::select! {
+                biased;
+                _ = self.task_client.recv() => {
+                    tracing::trace!("InputMessageListener: Received shutdown");
+                    break;
+                }
                 input_msg = self.input_receiver.recv() => match input_msg {
                     Some(input_msg) => {
                         self.on_input_message(input_msg).await;
                     },
                     None => {
-                        log::trace!("InputMessageListener: Stopping since channel closed");
+                        tracing::trace!("InputMessageListener: Stopping since channel closed");
                         break;
                     }
                 },
-                _ = self.task_client.recv() => {
-                    log::trace!("InputMessageListener: Received shutdown");
-                }
+
             }
         }
         self.task_client.recv_timeout().await;
-        log::debug!("InputMessageListener: Exiting");
+        tracing::debug!("InputMessageListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/mod.rs

@@ -13,7 +13,6 @@ use crate::client::replies::reply_controller::ReplyControllerSender;
 use crate::spawn_future;
 use action_controller::AckActionReceiver;
 use futures::channel::mpsc;
-use log::*;
 use nym_gateway_client::AcknowledgementReceiver;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx::params::{PacketSize, PacketType};
@@ -30,6 +29,7 @@ use std::{
     sync::{Arc, Weak},
     time::Duration,
 };
+use tracing::*;
 
 pub(crate) use action_controller::{AckActionSender, Action};
 
@@ -298,29 +298,44 @@ where
         let mut sent_notification_listener = self.sent_notification_listener;
         let mut action_controller = self.action_controller;
 
-        spawn_future(async move {
-            acknowledgement_listener.run().await;
-            debug!("The acknowledgement listener has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                acknowledgement_listener.run().await;
+                debug!("The acknowledgement listener has finished execution!");
+            },
+            "AcknowledgementController::AcknowledgementListener"
+        );
 
-        spawn_future(async move {
-            input_message_listener.run().await;
-            debug!("The input listener has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                input_message_listener.run().await;
+                debug!("The input listener has finished execution!");
+            },
+            "AcknowledgementController::InputMessageListener"
+        );
 
-        spawn_future(async move {
-            retransmission_request_listener.run(packet_type).await;
-            debug!("The retransmission request listener has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                retransmission_request_listener.run(packet_type).await;
+                debug!("The retransmission request listener has finished execution!");
+            },
+            "AcknowledgementController::RetransmissionRequestListener"
+        );
 
-        spawn_future(async move {
-            sent_notification_listener.run().await;
-            debug!("The sent notification listener has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                sent_notification_listener.run().await;
+                debug!("The sent notification listener has finished execution!");
+            },
+            "AcknowledgementController::SentNotificationListener"
+        );
 
-        spawn_future(async move {
-            action_controller.run().await;
-            debug!("The controller has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                action_controller.run().await;
+                debug!("The controller has finished execution!");
+            },
+            "AcknowledgementController::ActionController"
+        );
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/retransmission_request_listener.rs

@@ -10,13 +10,13 @@ use crate::client::real_messages_control::message_handler::{MessageHandler, Prep
 use crate::client::real_messages_control::real_traffic_stream::RealMessage;
 use crate::client::replies::reply_controller::ReplyControllerSender;
 use futures::StreamExt;
-use log::*;
 use nym_sphinx::chunking::fragment::Fragment;
 use nym_sphinx::preparer::PreparedFragment;
 use nym_sphinx::{addressing::clients::Recipient, params::PacketType};
 use nym_task::{connections::TransmissionLane, TaskClient};
 use rand::{CryptoRng, Rng};
 use std::sync::{Arc, Weak};
+use tracing::*;
 
 // responsible for packet retransmission upon fired timer
 pub(super) struct RetransmissionRequestListener<R> {
@@ -179,19 +179,22 @@ where
 
         while !self.task_client.is_shutdown() {
             tokio::select! {
+                biased;
+                 _ = self.task_client.recv() => {
+                    tracing::trace!("RetransmissionRequestListener: Received shutdown");
+                    break;
+                }
                 timed_out_ack = self.request_receiver.next() => match timed_out_ack {
                     Some(timed_out_ack) => self.on_retransmission_request(timed_out_ack, packet_type).await,
                     None => {
-                        log::trace!("RetransmissionRequestListener: Stopping since channel closed");
+                        tracing::trace!("RetransmissionRequestListener: Stopping since channel closed");
                         break;
                     }
                 },
-                _ = self.task_client.recv() => {
-                    log::trace!("RetransmissionRequestListener: Received shutdown");
-                }
+
             }
         }
         self.task_client.recv_timeout().await;
-        log::debug!("RetransmissionRequestListener: Exiting");
+        tracing::debug!("RetransmissionRequestListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/sent_notification_listener.rs

@@ -4,9 +4,9 @@
 use super::action_controller::{AckActionSender, Action};
 use super::SentPacketNotificationReceiver;
 use futures::StreamExt;
-use log::*;
 use nym_sphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};
 use nym_task::TaskClient;
+use tracing::*;
 
 /// Module responsible for starting up retransmission timers.
 /// It is required because when we send our packet to the `real traffic stream` controlled
@@ -56,17 +56,17 @@ impl SentNotificationListener {
                         self.on_sent_message(frag_id).await;
                     }
                     None => {
-                        log::trace!("SentNotificationListener: Stopping since channel closed");
+                        tracing::trace!("SentNotificationListener: Stopping since channel closed");
                         break;
                     }
                 },
                 _ = self.task_client.recv() => {
-                    log::trace!("SentNotificationListener: Received shutdown");
+                    tracing::trace!("SentNotificationListener: Received shutdown");
                     break;
                 }
             }
         }
         assert!(self.task_client.is_shutdown_poll());
-        log::debug!("SentNotificationListener: Exiting");
+        tracing::debug!("SentNotificationListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/message_handler.rs

@@ -9,11 +9,11 @@ use crate::client::real_messages_control::{AckActionSender, Action};
 use crate::client::replies::reply_controller::MaxRetransmissions;
 use crate::client::replies::reply_storage::{ReceivedReplySurbsMap, SentReplyKeys, UsedSenderTags};
 use crate::client::topology_control::{TopologyAccessor, TopologyReadPermit};
-use log::{debug, error, info, trace, warn};
+use nym_client_core_surb_storage::RetrievedReplySurb;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, RepliableMessage, ReplyMessage};
-use nym_sphinx::anonymous_replies::{ReplySurb, SurbEncryptionKey};
+use nym_sphinx::anonymous_replies::ReplySurbWithKeyRotation;
 use nym_sphinx::chunking::fragment::{Fragment, FragmentIdentifier};
 use nym_sphinx::message::NymMessage;
 use nym_sphinx::params::{PacketSize, PacketType};
@@ -27,6 +27,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 use thiserror::Error;
+use tracing::{debug, error, info, trace, warn};
 
 // TODO: move that error elsewhere since it seems to be contaminating different files
 #[derive(Debug, Error)]
@@ -34,6 +35,9 @@ pub enum PreparationError {
     #[error(transparent)]
     NymTopologyError(#[from] NymTopologyError),
 
+    #[error("message wasn't split into any fragments!")]
+    EmptyFragments,
+
     #[error("message too long for a single SURB, splitting into {fragments} fragments.")]
     MessageTooLongForSingleSurb { fragments: usize },
 
@@ -44,7 +48,7 @@ pub enum PreparationError {
 }
 
 impl PreparationError {
-    fn return_surbs(self, returned_surbs: Vec<ReplySurb>) -> SurbWrappedPreparationError {
+    fn return_surbs(self, returned_surbs: Vec<RetrievedReplySurb>) -> SurbWrappedPreparationError {
         SurbWrappedPreparationError {
             source: self,
             returned_surbs: Some(returned_surbs),
@@ -58,7 +62,7 @@ pub struct SurbWrappedPreparationError {
     #[source]
     source: PreparationError,
 
-    returned_surbs: Option<Vec<ReplySurb>>,
+    returned_surbs: Option<Vec<RetrievedReplySurb>>,
 }
 
 impl<T> From<T> for SurbWrappedPreparationError
@@ -80,7 +84,7 @@ impl SurbWrappedPreparationError {
         target: &AnonymousSenderTag,
     ) -> PreparationError {
         if let Some(reply_surbs) = self.returned_surbs {
-            surb_storage.insert_surbs(target, reply_surbs)
+            surb_storage.re_insert_reply_surbs(target, reply_surbs)
         }
         self.source
     }
@@ -98,6 +102,15 @@ pub(crate) struct Config {
     /// Specify whether route selection should be determined by the packet header.
     deterministic_route_selection: bool,
 
+    /// Indicates whether to mix hops or not. If mix hops are enabled, traffic
+    /// will be routed as usual, to the entry gateway, through three mix nodes, egressing
+    /// through the exit gateway. If mix hops are disabled, traffic will be routed directly
+    /// from the entry gateway to the exit gateway, bypassing the mix nodes.
+    ///
+    /// This overrides the `use_legacy_sphinx_format` setting as reduced mix hops
+    /// requires use of the updated SURB packet format.
+    disable_mix_hops: bool,
+
     /// Average delay a data packet is going to get delay at a single mixnode.
     average_packet_delay: Duration,
 
@@ -133,6 +146,7 @@ impl Config {
             primary_packet_size: PacketSize::default(),
             secondary_packet_size: None,
             use_legacy_sphinx_format: use_legacy_reply_surb_format,
+            disable_mix_hops: false,
         }
     }
 
@@ -147,6 +161,16 @@ impl Config {
         self.secondary_packet_size = packet_size;
         self
     }
+
+    /// Configure whether messages senders using this config should use mix hops or not when sending messages.
+    ///
+    /// This overrides the `use_legacy_sphinx_format` setting as disabled mix hops
+    /// requires use of the updated SURB packet format.
+    pub fn disable_mix_hops(mut self, disable_mix_hops: bool) -> Self {
+        self.disable_mix_hops = disable_mix_hops;
+        self.use_legacy_sphinx_format = false;
+        self
+    }
 }
 
 #[derive(Clone)]
@@ -193,6 +217,7 @@ where
             config.average_packet_delay,
             config.average_ack_delay,
             config.use_legacy_sphinx_format,
+            config.disable_mix_hops,
         );
         MessageHandler {
             config,
@@ -207,6 +232,10 @@ where
         }
     }
 
+    pub(crate) fn topology_access_handle(&self) -> &TopologyAccessor {
+        &self.topology_access
+    }
+
     fn get_or_create_sender_tag(&mut self, recipient: &Recipient) -> AnonymousSenderTag {
         if let Some(existing) = self.tag_storage.try_get_existing(recipient) {
             trace!("we already had sender tag for {recipient}");
@@ -254,10 +283,10 @@ where
         }
     }
 
-    async fn generate_reply_surbs_with_keys(
+    async fn generate_reply_surbs(
         &mut self,
         amount: usize,
-    ) -> Result<(Vec<ReplySurb>, Vec<SurbEncryptionKey>), PreparationError> {
+    ) -> Result<Vec<ReplySurbWithKeyRotation>, PreparationError> {
         let topology_permit = self.topology_access.get_read_permit().await;
         let topology = self.get_topology(&topology_permit)?;
 
@@ -267,24 +296,19 @@ where
             topology,
         )?;
 
-        let reply_keys = reply_surbs
-            .iter()
-            .map(|s| *s.encryption_key())
-            .collect::<Vec<_>>();
-
-        Ok((reply_surbs, reply_keys))
+        Ok(reply_surbs)
     }
 
     pub(crate) async fn try_send_single_surb_message(
         &mut self,
         target: AnonymousSenderTag,
         message: ReplyMessage,
-        reply_surb: ReplySurb,
+        reply_surb: RetrievedReplySurb,
         is_extra_surb_request: bool,
     ) -> Result<(), SurbWrappedPreparationError> {
         let msg = NymMessage::new_reply(message);
         let packet_size = self.optimal_packet_size(&msg);
-        debug!("Using {packet_size} packets for {msg}");
+        trace!("Using {packet_size} packets for {msg}");
 
         let mut fragment = self
             .message_preparer
@@ -299,6 +323,16 @@ where
             });
         }
 
+        if fragment.is_empty() {
+            error!("CRITICAL FAILURE: our split message didn't result in any sendable fragments");
+            return Err(SurbWrappedPreparationError {
+                source: PreparationError::EmptyFragments,
+                returned_surbs: Some(vec![reply_surb]),
+            });
+        }
+
+        // SAFETY: we just checked we have one fragment
+        #[allow(clippy::unwrap_used)]
         let chunk = fragment.pop().unwrap();
         let chunk_clone = chunk.clone();
         let prepared_fragment = self
@@ -310,7 +344,10 @@ where
             Some(chunk.fragment_identifier()),
         );
         let delay = prepared_fragment.total_delay;
-        let max_retransmissions = None;
+
+        // we have to set a maximum number of retransmissions in case we fail to retrieve
+        // surbs for a long period of time; we don't want to be stuck constantly resending the data
+        let max_retransmissions = Some(10);
         let pending_ack = PendingAcknowledgement::new_anonymous(
             chunk,
             delay,
@@ -333,7 +370,7 @@ where
     pub(crate) async fn try_request_additional_reply_surbs(
         &mut self,
         from: AnonymousSenderTag,
-        reply_surb: ReplySurb,
+        reply_surb: RetrievedReplySurb,
         amount: u32,
     ) -> Result<(), SurbWrappedPreparationError> {
         debug!("requesting {amount} reply SURBs from {from}");
@@ -348,7 +385,7 @@ where
     pub(crate) fn split_reply_message(&mut self, message: Vec<u8>) -> Vec<Fragment> {
         let msg = NymMessage::new_reply(ReplyMessage::new_data_message(message));
         let packet_size = self.optimal_packet_size(&msg);
-        debug!("Using {packet_size} packets for {msg}");
+        trace!("Using {packet_size} packets for {msg}");
 
         self.message_preparer
             .pad_and_split_message(msg, packet_size)
@@ -373,11 +410,9 @@ where
         &mut self,
         target: AnonymousSenderTag,
         fragments: Vec<FragmentWithMaxRetransmissions>,
-        reply_surbs: Vec<ReplySurb>,
+        reply_surbs: impl IntoIterator<Item = RetrievedReplySurb>,
         lane: TransmissionLane,
     ) -> Result<(), SurbWrappedPreparationError> {
-        // TODO: technically this is performing an unnecessary cloning, but in the grand scheme of things
-        // is it really that bad?
         self.try_send_reply_chunks(
             target,
             fragments.into_iter().map(|f| (lane, f)).collect(),
@@ -390,7 +425,7 @@ where
         &mut self,
         target: AnonymousSenderTag,
         fragments: Vec<(TransmissionLane, FragmentWithMaxRetransmissions)>,
-        reply_surbs: Vec<ReplySurb>,
+        reply_surbs: impl IntoIterator<Item = RetrievedReplySurb>,
     ) -> Result<(), SurbWrappedPreparationError> {
         let prepared_fragments = self
             .prepare_reply_chunks_for_sending(
@@ -481,7 +516,7 @@ where
         } else {
             self.optimal_packet_size(&message)
         };
-        debug!("Using {packet_size} packets for {message}");
+        trace!("Using {packet_size} packets for {message}");
         let fragments = self
             .message_preparer
             .pad_and_split_message(message, packet_size);
@@ -513,6 +548,7 @@ where
             pending_acks.push(pending_ack);
         }
 
+        drop(topology_permit);
         self.insert_pending_acks(pending_acks);
         self.forward_messages(real_messages, lane).await;
 
@@ -527,8 +563,12 @@ where
     ) -> Result<(), PreparationError> {
         debug!("Sending additional reply SURBs with packet type {packet_type}");
         let sender_tag = self.get_or_create_sender_tag(&recipient);
-        let (reply_surbs, reply_keys) =
-            self.generate_reply_surbs_with_keys(amount as usize).await?;
+        let reply_surbs = self.generate_reply_surbs(amount as usize).await?;
+
+        let reply_keys = reply_surbs
+            .iter()
+            .map(|s| *s.encryption_key())
+            .collect::<Vec<_>>();
 
         let message = NymMessage::new_repliable(RepliableMessage::new_additional_surbs(
             self.config.use_legacy_sphinx_format,
@@ -548,7 +588,7 @@ where
         )
         .await?;
 
-        log::trace!("storing {} reply keys", reply_keys.len());
+        tracing::trace!("storing {} reply keys", reply_keys.len());
         self.reply_key_storage.insert_multiple(reply_keys);
 
         Ok(())
@@ -565,9 +605,12 @@ where
     ) -> Result<(), SurbWrappedPreparationError> {
         debug!("Sending message with reply SURBs with packet type {packet_type}");
         let sender_tag = self.get_or_create_sender_tag(&recipient);
-        let (reply_surbs, reply_keys) = self
-            .generate_reply_surbs_with_keys(num_reply_surbs as usize)
-            .await?;
+        let reply_surbs = self.generate_reply_surbs(num_reply_surbs as usize).await?;
+
+        let reply_keys = reply_surbs
+            .iter()
+            .map(|s| *s.encryption_key())
+            .collect::<Vec<_>>();
 
         let message = NymMessage::new_repliable(RepliableMessage::new_data(
             self.config.use_legacy_sphinx_format,
@@ -585,7 +628,7 @@ where
         )
         .await?;
 
-        log::trace!("storing {} reply keys", reply_keys.len());
+        tracing::trace!("storing {} reply keys", reply_keys.len());
         self.reply_key_storage.insert_multiple(reply_keys);
 
         Ok(())
@@ -615,20 +658,12 @@ where
     pub(crate) async fn prepare_reply_chunks_for_sending(
         &mut self,
         fragments: Vec<Fragment>,
-        reply_surbs: Vec<ReplySurb>,
+        reply_surbs: impl IntoIterator<Item = RetrievedReplySurb>,
     ) -> Result<Vec<PreparedFragment>, SurbWrappedPreparationError> {
-        debug_assert_eq!(
-            fragments.len(),
-            reply_surbs.len(),
-            "attempted to send {} fragments with {} reply surbs",
-            fragments.len(),
-            reply_surbs.len()
-        );
-
         let topology_permit = self.topology_access.get_read_permit().await;
         let topology = match self.get_topology(&topology_permit) {
             Ok(topology) => topology,
-            Err(err) => return Err(err.return_surbs(reply_surbs)),
+            Err(err) => return Err(err.return_surbs(reply_surbs.into_iter().collect())),
         };
 
         Ok(fragments
@@ -636,12 +671,13 @@ where
             .zip(reply_surbs.into_iter())
             .map(|(fragment, reply_surb)| {
                 // unwrap here is fine as we know we have a valid topology
+                #[allow(clippy::unwrap_used)]
                 self.message_preparer
                     .prepare_reply_chunk_for_sending(
                         fragment,
                         topology,
                         &self.config.ack_key,
-                        reply_surb,
+                        reply_surb.into(),
                         PacketType::Mix,
                     )
                     .unwrap()
@@ -651,7 +687,7 @@ where
 
     pub(crate) async fn try_prepare_single_reply_chunk_for_sending(
         &mut self,
-        reply_surb: ReplySurb,
+        reply_surb: RetrievedReplySurb,
         chunk: Fragment,
     ) -> Result<PreparedFragment, SurbWrappedPreparationError> {
         let topology_permit = self.topology_access.get_read_permit().await;
@@ -664,7 +700,7 @@ where
             chunk,
             topology,
             &self.config.ack_key,
-            reply_surb,
+            reply_surb.into(),
             PacketType::Mix,
         )?;
 
@@ -695,17 +731,21 @@ where
 
     // tells real message sender (with the poisson timer) to send this to the mix network
     pub(crate) async fn forward_messages(
-        &self,
+        &mut self,
         messages: Vec<RealMessage>,
         transmission_lane: TransmissionLane,
     ) {
-        if let Err(err) = self
-            .real_message_sender
-            .send((messages, transmission_lane))
-            .await
-        {
-            if !self.task_client.is_shutdown_poll() {
-                error!("Failed to forward messages to the real message sender: {err}");
+        tokio::select! {
+            biased;
+            _ = self.task_client.recv() => {
+                trace!("received shutdown while attempting to forward mixnet messages");
+            }
+            sending_res = self.real_message_sender.send((messages, transmission_lane)) => {
+                if sending_res.is_err() {
+                    error!(
+                        "failed to forward mixnet messages due to closed channel (outside of shutdown!)"
+                    );
+                }
             }
         }
     }

common/client-core/src/client/real_messages_control/mod.rs

@@ -24,7 +24,6 @@ use crate::{
     spawn_future,
 };
 use futures::channel::mpsc;
-use log::*;
 use nym_gateway_client::AcknowledgementReceiver;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
@@ -34,7 +33,9 @@ use nym_task::connections::{ConnectionCommandReceiver, LaneQueueLengths};
 use nym_task::TaskClient;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::sync::Arc;
+use tracing::*;
 
+use crate::client::replies::reply_controller::key_rotation_helpers::KeyRotationConfig;
 pub(crate) use acknowledgement_control::{AckActionSender, Action};
 
 pub(crate) mod acknowledgement_control;
@@ -85,12 +86,6 @@ impl<'a> From<&'a Config> for real_traffic_stream::Config {
     }
 }
 
-impl<'a> From<&'a Config> for reply_controller::Config {
-    fn from(cfg: &'a Config) -> Self {
-        reply_controller::Config::new(cfg.reply_surbs)
-    }
-}
-
 impl<'a> From<&'a Config> for message_handler::Config {
     fn from(cfg: &'a Config) -> Self {
         message_handler::Config::new(
@@ -103,6 +98,7 @@ impl<'a> From<&'a Config> for message_handler::Config {
         )
         .with_custom_primary_packet_size(cfg.traffic.primary_packet_size)
         .with_custom_secondary_packet_size(cfg.traffic.secondary_packet_size)
+        .disable_mix_hops(cfg.traffic.disable_mix_hops)
     }
 }
 
@@ -138,6 +134,7 @@ impl RealMessagesController<OsRng> {
     #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
         config: Config,
+        key_rotation_config: KeyRotationConfig,
         ack_receiver: AcknowledgementReceiver,
         input_receiver: InputMessageReceiver,
         mix_sender: BatchMixMessageSender,
@@ -168,7 +165,8 @@ impl RealMessagesController<OsRng> {
         // create all configs for the components
         let ack_control_config = (&config).into();
         let out_queue_config = (&config).into();
-        let reply_controller_config = (&config).into();
+        let reply_controller_config =
+            reply_controller::Config::new(config.reply_surbs, key_rotation_config);
         let message_handler_config = (&config).into();
 
         // create the actual components
@@ -226,14 +224,20 @@ impl RealMessagesController<OsRng> {
         let ack_control = self.ack_control;
         let mut reply_control = self.reply_control;
 
-        spawn_future(async move {
-            out_queue_control.run().await;
-            debug!("The out queue controller has finished execution!");
-        });
-        spawn_future(async move {
-            reply_control.run().await;
-            debug!("The reply controller has finished execution!");
-        });
+        spawn_future!(
+            async move {
+                out_queue_control.run().await;
+                debug!("The out queue controller has finished execution!");
+            },
+            "RealMessagesController::OutQueueControl)"
+        );
+        spawn_future!(
+            async move {
+                reply_control.run().await;
+                debug!("The reply controller has finished execution!");
+            },
+            "RealMessagesController::ReplyController"
+        );
 
         ack_control.start(packet_type);
     }

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -9,7 +9,6 @@ use crate::client::transmission_buffer::TransmissionBuffer;
 use crate::config;
 use futures::task::{Context, Poll};
 use futures::{Future, Stream, StreamExt};
-use log::*;
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::chunking::fragment::FragmentIdentifier;
@@ -27,6 +26,7 @@ use rand::{CryptoRng, Rng};
 use std::pin::Pin;
 use std::sync::Arc;
 use std::time::Duration;
+use tracing::*;
 
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::{sleep, Sleep};
@@ -202,7 +202,7 @@ where
         // well technically the message was not sent just yet, but now it's up to internal
         // queues and client load rather than the required delay. So realistically we can treat
         // whatever is about to happen as negligible additional delay.
-        trace!("{} is about to get sent to the mixnet", frag_id);
+        trace!("{frag_id} is about to get sent to the mixnet");
         if let Err(err) = self.sent_notifier.unbounded_send(frag_id) {
             error!("Failed to notify about sent message: {err}");
         }
@@ -249,6 +249,8 @@ where
                     }
                 };
 
+                // SAFETY: our topology must be valid at this point
+                #[allow(clippy::expect_used)]
                 (
                     generate_loop_cover_packet(
                         &mut self.rng,
@@ -278,17 +280,33 @@ where
             }
         };
 
-        if let Err(err) = self.mix_tx.send(vec![next_message]).await {
-            if !self.task_client.is_shutdown_poll() {
-                log::error!("Failed to send: {err}");
+        let sending_res = tokio::select! {
+            biased;
+            _ = self.task_client.recv() => {
+                trace!("received shutdown signal while attempting to send mix message");
+                return
+            }
+            sending_res = self.mix_tx.send(vec![next_message]) => {
+                sending_res
+            }
+        };
+
+        match sending_res {
+            Err(_) => {
+                if !self.task_client.is_shutdown_poll() {
+                    tracing::error!(
+                        "failed to send mixnet packet due to closed channel (outside of shutdown!)"
+                    );
+                }
+            }
+            Ok(_) => {
+                let event = if fragment_id.is_some() {
+                    PacketStatisticsEvent::RealPacketSent(packet_size)
+                } else {
+                    PacketStatisticsEvent::CoverPacketSent(packet_size)
+                };
+                self.stats_tx.report(event.into());
             }
-        } else {
-            let event = if fragment_id.is_some() {
-                PacketStatisticsEvent::RealPacketSent(packet_size)
-            } else {
-                PacketStatisticsEvent::CoverPacketSent(packet_size)
-            };
-            self.stats_tx.report(event.into());
         }
 
         // notify ack controller about sending our message only after we actually managed to push it
@@ -313,7 +331,7 @@ where
     }
 
     fn on_close_connection(&mut self, connection_id: ConnectionId) {
-        log::debug!("Removing lane for connection: {connection_id}");
+        tracing::debug!("Removing lane for connection: {connection_id}");
         self.transmission_buffer
             .remove(&TransmissionLane::ConnectionId(connection_id));
     }
@@ -325,7 +343,7 @@ where
 
     fn adjust_current_average_message_sending_delay(&mut self) {
         let used_slots = self.mix_tx.max_capacity() - self.mix_tx.capacity();
-        log::trace!(
+        tracing::trace!(
             "used_slots: {used_slots}, current_multiplier: {}",
             self.sending_delay_controller.current_multiplier()
         );
@@ -334,7 +352,7 @@ where
             .sending_delay_controller
             .is_backpressure_currently_detected(used_slots)
         {
-            log::trace!("Backpressure detected");
+            tracing::trace!("Backpressure detected");
             self.sending_delay_controller.record_backpressure_detected();
         }
 
@@ -436,9 +454,11 @@ where
                 Poll::Ready(None) => Poll::Ready(None),
 
                 Poll::Ready(Some((real_messages, conn_id))) => {
-                    log::trace!("handling real_messages: size: {}", real_messages.len());
+                    tracing::trace!("handling real_messages: size: {}", real_messages.len());
 
                     self.transmission_buffer.store(&conn_id, real_messages);
+                    // SAFETY: we just stored the message
+                    #[allow(clippy::expect_used)]
                     let real_next = self.pop_next_message().expect("Just stored one");
 
                     Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
@@ -483,10 +503,12 @@ where
             Poll::Ready(None) => Poll::Ready(None),
 
             Poll::Ready(Some((real_messages, conn_id))) => {
-                log::trace!("handling real_messages: size: {}", real_messages.len());
+                tracing::trace!("handling real_messages: size: {}", real_messages.len());
 
                 // First store what we got for the given connection id
                 self.transmission_buffer.store(&conn_id, real_messages);
+                // SAFETY: we just stored the message
+                #[allow(clippy::expect_used)]
                 let real_next = self.pop_next_message().expect("we just added one");
 
                 Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
@@ -538,11 +560,11 @@ where
         };
 
         if packets > 1000 {
-            log::warn!("{status_str}");
+            tracing::warn!("{status_str}");
         } else if packets > 0 {
-            log::info!("{status_str}");
+            tracing::info!("{status_str}");
         } else {
-            log::debug!("{status_str}");
+            tracing::debug!("{status_str}");
         }
 
         // Send status message to whoever is listening (possibly UI)
@@ -566,7 +588,7 @@ where
                 tokio::select! {
                     biased;
                     _ = shutdown.recv() => {
-                        log::trace!("OutQueueControl: Received shutdown");
+                        tracing::trace!("OutQueueControl: Received shutdown");
                         break;
                     }
                     _ = status_timer.tick() => {
@@ -575,7 +597,7 @@ where
                     next_message = self.next() => if let Some(next_message) = next_message {
                         self.on_message(next_message).await;
                     } else {
-                        log::trace!("OutQueueControl: Stopping since channel closed");
+                        tracing::trace!("OutQueueControl: Stopping since channel closed");
                         break;
                     }
                 }
@@ -589,18 +611,18 @@ where
                 tokio::select! {
                     biased;
                     _ = shutdown.recv() => {
-                        log::trace!("OutQueueControl: Received shutdown");
+                        tracing::trace!("OutQueueControl: Received shutdown");
                     }
                     next_message = self.next() => if let Some(next_message) = next_message {
                         self.on_message(next_message).await;
                     } else {
-                        log::trace!("OutQueueControl: Stopping since channel closed");
+                        tracing::trace!("OutQueueControl: Stopping since channel closed");
                         break;
                     }
                 }
             }
         }
-        log::debug!("OutQueueControl: Exiting");
+        tracing::debug!("OutQueueControl: Exiting");
     }
 }
 

common/client-core/src/client/real_messages_control/real_traffic_stream/sending_delay_controller.rs

@@ -98,12 +98,12 @@ impl SendingDelayController {
             self.current_multiplier =
                 (self.current_multiplier + 1).clamp(self.lower_bound, self.upper_bound);
             self.time_when_changed = get_time_now();
-            log::debug!(
+            tracing::debug!(
                 "Increasing sending delay multiplier to: {}",
                 self.current_multiplier
             );
         } else {
-            log::warn!("Trying to increase delay multipler higher than allowed");
+            tracing::warn!("Trying to increase delay multipler higher than allowed");
         }
     }
 
@@ -112,7 +112,7 @@ impl SendingDelayController {
             self.current_multiplier =
                 (self.current_multiplier - 1).clamp(self.lower_bound, self.upper_bound);
             self.time_when_changed = get_time_now();
-            log::debug!(
+            tracing::debug!(
                 "Decreasing sending delay multiplier to: {}",
                 self.current_multiplier
             );
@@ -164,11 +164,11 @@ impl SendingDelayController {
                 self.current_multiplier()
             );
             if self.current_multiplier() > 0 {
-                log::debug!("{}", status_str);
+                tracing::debug!("{status_str}");
             } else if self.current_multiplier() > 1 {
-                log::info!("{}", status_str);
+                tracing::info!("{status_str}");
             } else if self.current_multiplier() > 2 {
-                log::warn!("{}", status_str);
+                tracing::warn!("{status_str}");
             }
             self.time_when_logged_about_elevated_multiplier = now;
         }

common/client-core/src/client/received_buffer.rs

@@ -1,6 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::client::helpers::get_time_now;
 use crate::client::replies::{
     reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys,
 };
@@ -8,7 +9,6 @@ use crate::spawn_future;
 use futures::channel::mpsc;
 use futures::lock::Mutex;
 use futures::StreamExt;
-use log::*;
 use nym_crypto::asymmetric::x25519;
 use nym_crypto::Digest;
 use nym_gateway_client::MixnetMessageReceiver;
@@ -23,7 +23,8 @@ use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, C
 use nym_task::TaskClient;
 use std::collections::HashSet;
 use std::sync::Arc;
-use std::time::{Duration, Instant};
+use std::time::Duration;
+use tracing::*;
 
 // The interval at which we check for stale buffers
 const STALE_BUFFER_CHECK_INTERVAL: Duration = Duration::from_secs(10);
@@ -54,7 +55,7 @@ struct ReceivedMessagesBufferInner<R: MessageReceiver> {
     stats_tx: ClientStatsSender,
 
     // Periodically check for stale buffers to clean up
-    last_stale_check: Instant,
+    last_stale_check: crate::client::helpers::Instant,
 }
 
 impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
@@ -154,7 +155,7 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
     }
 
     fn cleanup_stale_buffers(&mut self) {
-        let now = Instant::now();
+        let now = get_time_now();
         if now - self.last_stale_check > STALE_BUFFER_CHECK_INTERVAL {
             self.last_stale_check = now;
             self.message_receiver
@@ -190,7 +191,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 message_sender: None,
                 recently_reconstructed: HashSet::new(),
                 stats_tx,
-                last_stale_check: Instant::now(),
+                last_stale_check: get_time_now(),
             })),
             reply_key_storage,
             reply_controller_sender,
@@ -198,6 +199,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         }
     }
 
+    #[allow(clippy::panic)]
     async fn disconnect_sender(&mut self) {
         let mut guard = self.inner.lock().await;
         if guard.message_sender.is_none() {
@@ -208,6 +210,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         guard.message_sender = None;
     }
 
+    #[allow(clippy::panic)]
     async fn connect_sender(&mut self, sender: ReconstructedMessagesSender) {
         let mut guard = self.inner.lock().await;
         if guard.message_sender.is_some() {
@@ -221,10 +224,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         let stored_messages = std::mem::take(&mut guard.messages);
         if !stored_messages.is_empty() {
             if let Err(err) = sender.unbounded_send(stored_messages) {
-                error!(
-                    "The sender channel we just received is already invalidated - {:?}",
-                    err
-                );
+                error!("The sender channel we just received is already invalidated - {err:?}");
                 // put the values back to the buffer
                 // the returned error has two fields: err: SendError and val: T,
                 // where val is the value that was failed to get sent;
@@ -310,13 +310,15 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 }
             };
 
-            if let Err(err) = self.reply_controller_sender.send_additional_surbs(
-                msg.sender_tag,
-                reply_surbs,
-                from_surb_request,
-            ) {
-                if !self.task_client.is_shutdown_poll() {
-                    error!("{err}");
+            if !reply_surbs.is_empty() {
+                if let Err(err) = self.reply_controller_sender.send_additional_surbs(
+                    msg.sender_tag,
+                    reply_surbs,
+                    from_surb_request,
+                ) {
+                    if !self.task_client.is_shutdown_poll() {
+                        error!("{err}");
+                    }
                 }
             }
         }
@@ -500,20 +502,20 @@ impl<R: MessageReceiver> RequestReceiver<R> {
             tokio::select! {
                 biased;
                 _ = self.task_client.recv() => {
-                    log::trace!("RequestReceiver: Received shutdown");
+                    tracing::trace!("RequestReceiver: Received shutdown");
                 }
                 request = self.query_receiver.next() => {
                     if let Some(message) = request {
                         self.handle_message(message).await
                     } else {
-                        log::trace!("RequestReceiver: Stopping since channel closed");
+                        tracing::trace!("RequestReceiver: Stopping since channel closed");
                         break;
                     }
                 },
             }
         }
         self.task_client.recv().await;
-        log::debug!("RequestReceiver: Exiting");
+        tracing::debug!("RequestReceiver: Exiting");
     }
 }
 
@@ -544,17 +546,17 @@ impl<R: MessageReceiver> FragmentedMessageReceiver<R> {
                     if let Some(new_messages) = new_messages {
                         self.received_buffer.handle_new_received(new_messages).await?;
                     } else {
-                        log::trace!("FragmentedMessageReceiver: Stopping since channel closed");
+                        tracing::trace!("FragmentedMessageReceiver: Stopping since channel closed");
                         break;
                     }
                 },
                 _ = self.task_client.recv_with_delay() => {
-                    log::trace!("FragmentedMessageReceiver: Received shutdown");
+                    tracing::trace!("FragmentedMessageReceiver: Received shutdown");
                 }
             }
         }
         self.task_client.recv_timeout().await;
-        log::debug!("FragmentedMessageReceiver: Exiting");
+        tracing::debug!("FragmentedMessageReceiver: Exiting");
         Ok(())
     }
 }
@@ -600,14 +602,20 @@ impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferControll
         let mut fragmented_message_receiver = self.fragmented_message_receiver;
         let mut request_receiver = self.request_receiver;
 
-        spawn_future(async move {
-            match fragmented_message_receiver.run().await {
-                Ok(_) => {}
-                Err(e) => error!("{e}"),
-            }
-        });
-        spawn_future(async move {
-            request_receiver.run().await;
-        });
+        spawn_future!(
+            async move {
+                match fragmented_message_receiver.run().await {
+                    Ok(_) => {}
+                    Err(e) => error!("{e}"),
+                }
+            },
+            "ReceivedMessagesBufferController::FragmentedMessageReceiver"
+        );
+        spawn_future!(
+            async move {
+                request_receiver.run().await;
+            },
+            "ReceivedMessagesBufferController::RequestReceiver"
+        );
     }
 }

common/client-core/src/client/replies/reply_controller/key_rotation_helpers.rs

@@ -0,0 +1,169 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_topology::NymTopologyMetadata;
+use nym_validator_client::models::{
+    EpochId, KeyRotationId, KeyRotationInfoResponse, KeyRotationState,
+};
+use std::time::Duration;
+use time::OffsetDateTime;
+
+#[derive(Clone, Copy)]
+pub(crate) enum SurbRefreshState {
+    WaitingForNextRotation { last_known: KeyRotationId },
+    ScheduledForNextInvocation,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct ReferenceEpoch {
+    pub(crate) absolute_epoch_id: EpochId,
+    pub(crate) start_time: OffsetDateTime,
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct KeyRotationConfig {
+    pub(crate) epoch_duration: Duration,
+    pub(crate) rotation_state: KeyRotationState,
+    pub(crate) reference_epoch: ReferenceEpoch,
+}
+
+impl From<KeyRotationInfoResponse> for KeyRotationConfig {
+    fn from(value: KeyRotationInfoResponse) -> Self {
+        KeyRotationConfig {
+            epoch_duration: value.details.epoch_duration,
+            rotation_state: value.details.key_rotation_state,
+            reference_epoch: ReferenceEpoch {
+                absolute_epoch_id: value.details.current_absolute_epoch_id,
+                start_time: value.details.current_epoch_start,
+            },
+        }
+    }
+}
+
+impl KeyRotationConfig {
+    pub(crate) fn rotation_lifetime(&self) -> Duration {
+        (self.rotation_state.validity_epochs + 1) * self.epoch_duration
+    }
+
+    pub(crate) fn key_rotation_id(&self, current_absolute_epoch_id: EpochId) -> KeyRotationId {
+        self.rotation_state
+            .key_rotation_id(current_absolute_epoch_id)
+    }
+
+    // this is called with the assumption that now is always > reference epoch start
+    pub(crate) fn expected_current_epoch_id(&self, now: OffsetDateTime) -> EpochId {
+        let diff_secs = (now - self.reference_epoch.start_time).as_seconds_f64();
+        let epochs = (diff_secs / self.epoch_duration.as_secs_f64()).floor() as u32;
+
+        self.reference_epoch.absolute_epoch_id + epochs
+    }
+
+    fn initial_rotation_epoch_start(&self) -> OffsetDateTime {
+        let epochs_diff = self
+            .reference_epoch
+            .absolute_epoch_id
+            .saturating_sub(self.rotation_state.initial_epoch_id);
+
+        self.reference_epoch.start_time - epochs_diff * self.epoch_duration
+    }
+
+    pub(crate) fn key_rotation_start(&self, key_rotation_id: KeyRotationId) -> OffsetDateTime {
+        let rotation_duration = self.rotation_state.validity_epochs * self.epoch_duration;
+        let initial_start = self.initial_rotation_epoch_start();
+
+        // note: key rotation starts from 0
+        initial_start + rotation_duration * key_rotation_id
+    }
+
+    pub(crate) fn expected_current_key_rotation_id(&self, now: OffsetDateTime) -> KeyRotationId {
+        let expected_current_epoch = self.expected_current_epoch_id(now);
+        self.key_rotation_id(expected_current_epoch)
+    }
+
+    pub(crate) fn expected_current_key_rotation_start(
+        &self,
+        now: OffsetDateTime,
+    ) -> OffsetDateTime {
+        let expected_current_key_rotation_id = self.expected_current_key_rotation_id(now);
+        self.key_rotation_start(expected_current_key_rotation_id)
+    }
+
+    pub(crate) fn epoch_stuck(&self, topology_metadata: NymTopologyMetadata) -> bool {
+        // add leeway of 2mins each direction since transition is not instantaneous
+        let lower_bound = topology_metadata.refreshed_at - Duration::from_secs(2);
+        let upper_bound = topology_metadata.refreshed_at + Duration::from_secs(2);
+
+        let expected_epoch_lower = self.expected_current_epoch_id(lower_bound);
+        let expected_epoch_upper = self.expected_current_epoch_id(upper_bound);
+
+        topology_metadata.absolute_epoch_id != expected_epoch_lower
+            && topology_metadata.absolute_epoch_id != expected_epoch_upper
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use time::macros::datetime;
+
+    fn mock_config() -> KeyRotationConfig {
+        KeyRotationConfig {
+            epoch_duration: Duration::from_secs(60 * 60),
+            rotation_state: KeyRotationState {
+                validity_epochs: 10,
+                initial_epoch_id: 80,
+            },
+            reference_epoch: ReferenceEpoch {
+                absolute_epoch_id: 100,
+                start_time: datetime!(2025-06-30 12:00:00+00:00),
+            },
+        }
+    }
+
+    #[test]
+    fn expected_current_key_rotation_start() {
+        // rot0: 80-89
+        // rot1: 90-99
+        // rot2: 100-109
+        // rot3: 110-119
+        // ... etc
+        let cfg = mock_config();
+
+        assert_eq!(
+            cfg.initial_rotation_epoch_start(),
+            datetime!(2025-06-29 16:00:00+00:00)
+        );
+
+        let fake_now = datetime!(2025-06-30 12:00:00+00:00);
+        assert_eq!(cfg.expected_current_epoch_id(fake_now), 100);
+        assert_eq!(cfg.expected_current_key_rotation_id(fake_now), 2);
+        assert_eq!(
+            cfg.expected_current_key_rotation_start(fake_now),
+            datetime!(2025-06-30 12:00:00+00:00)
+        );
+
+        let fake_now = datetime!(2025-06-30 12:30:00+00:00);
+        assert_eq!(cfg.expected_current_epoch_id(fake_now), 100);
+        assert_eq!(cfg.expected_current_key_rotation_id(fake_now), 2);
+        assert_eq!(
+            cfg.expected_current_key_rotation_start(fake_now),
+            datetime!(2025-06-30 12:00:00+00:00)
+        );
+
+        let fake_now = datetime!(2025-06-30 13:01:00+00:00);
+        assert_eq!(cfg.expected_current_epoch_id(fake_now), 101);
+        assert_eq!(cfg.expected_current_key_rotation_id(fake_now), 2);
+        assert_eq!(
+            cfg.expected_current_key_rotation_start(fake_now),
+            datetime!(2025-06-30 12:00:00+00:00)
+        );
+
+        let fake_now = datetime!(2025-06-30 22:02:00+00:00);
+        assert_eq!(cfg.expected_current_epoch_id(fake_now), 110);
+        assert_eq!(cfg.expected_current_key_rotation_id(fake_now), 3);
+        assert_eq!(
+            cfg.expected_current_key_rotation_start(fake_now),
+            datetime!(2025-06-30 22:00:00+00:00)
+        );
+    }
+}

common/client-core/src/client/replies/reply_controller/receiver_controller.rs

@@ -0,0 +1,901 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::real_messages_control::acknowledgement_control::PendingAcknowledgement;
+use crate::client::real_messages_control::message_handler::{
+    FragmentWithMaxRetransmissions, MessageHandler, PreparationError,
+};
+use crate::client::replies::reply_controller::key_rotation_helpers::SurbRefreshState;
+use crate::client::replies::reply_controller::Config;
+use crate::client::topology_control::TopologyAccessor;
+use crate::client::transmission_buffer::TransmissionBuffer;
+use futures::channel::oneshot;
+use nym_client_core_surb_storage::{ReceivedReplySurb, ReceivedReplySurbsMap};
+use nym_crypto::aes::cipher::crypto_common::rand_core::CryptoRng;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::anonymous_replies::ReplySurbWithKeyRotation;
+use nym_sphinx::chunking::fragment::FragmentIdentifier;
+use nym_task::connections::{ConnectionId, TransmissionLane};
+use nym_topology::NymTopologyMetadata;
+use rand::Rng;
+use std::cmp::{max, min};
+use std::collections::btree_map::Entry;
+use std::collections::{BTreeMap, HashMap};
+use std::mem;
+use std::sync::{Arc, Weak};
+use time::OffsetDateTime;
+use tracing::{debug, error, info, trace, warn};
+
+struct SenderData {
+    current_clear_rerequest_counter: usize,
+    pending_replies: TransmissionBuffer<FragmentWithMaxRetransmissions>,
+    pending_retransmissions: BTreeMap<FragmentIdentifier, Weak<PendingAcknowledgement>>,
+    last_request_failure: OffsetDateTime,
+}
+
+impl Default for SenderData {
+    fn default() -> Self {
+        SenderData {
+            current_clear_rerequest_counter: 0,
+            pending_replies: Default::default(),
+            pending_retransmissions: Default::default(),
+            last_request_failure: OffsetDateTime::UNIX_EPOCH,
+        }
+    }
+}
+
+impl SenderData {
+    fn total_pending(&self) -> usize {
+        let pending_replies = self.pending_replies.total_size();
+        let pending_retransmissions = self.pending_retransmissions.len();
+        let total_pending = pending_retransmissions + pending_replies;
+
+        debug!("total queue size: {total_pending} = pending data {pending_replies} + pending retransmission {pending_retransmissions}");
+
+        total_pending
+    }
+
+    pub(crate) fn increment_current_clear_rerequest_counter(&mut self) {
+        self.current_clear_rerequest_counter += 1;
+    }
+
+    pub(crate) fn reset_current_clear_rerequest_counter(&mut self) {
+        self.current_clear_rerequest_counter = 0;
+    }
+
+    pub(crate) fn reset_last_request_failure(&mut self, now: OffsetDateTime) -> OffsetDateTime {
+        mem::replace(&mut self.last_request_failure, now)
+    }
+}
+
+/// Reply controller responsible for controlling receiver-related part
+/// of replies, such as requesting additional reply SURBs
+pub struct ReceiverReplyController<R> {
+    config: Config,
+
+    surb_refresh_state: SurbRefreshState,
+    topology_access: TopologyAccessor,
+
+    surb_senders: HashMap<AnonymousSenderTag, SenderData>,
+    unavailable: HashMap<AnonymousSenderTag, OffsetDateTime>,
+    surbs_storage: ReceivedReplySurbsMap,
+
+    // TODO: incorporate that field at some point
+    // and use binomial distribution to determine the expected required number
+    // of surbs required to send the message through
+    // expected_reliability: f32,
+    message_handler: MessageHandler<R>,
+}
+
+impl<R> ReceiverReplyController<R>
+where
+    R: CryptoRng + Rng,
+{
+    pub(crate) fn new(
+        config: Config,
+        storage: ReceivedReplySurbsMap,
+        message_handler: MessageHandler<R>,
+    ) -> Self {
+        let topology_access = message_handler.topology_access_handle().clone();
+
+        ReceiverReplyController {
+            config,
+            surb_refresh_state: SurbRefreshState::WaitingForNextRotation {
+                last_known: config
+                    .key_rotation
+                    .expected_current_key_rotation_id(OffsetDateTime::now_utc()),
+            },
+            topology_access,
+            surb_senders: Default::default(),
+            unavailable: Default::default(),
+            surbs_storage: storage,
+            message_handler,
+        }
+    }
+
+    fn get_or_create_surb_sender(&mut self, tag: &AnonymousSenderTag) -> &mut SenderData {
+        self.surb_senders.entry(*tag).or_default()
+    }
+
+    async fn current_topology_metadata(&self) -> Option<NymTopologyMetadata> {
+        self.topology_access.current_metadata().await
+    }
+
+    fn insert_pending_replies<I: IntoIterator<Item = FragmentWithMaxRetransmissions>>(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        fragments: I,
+        lane: TransmissionLane,
+    ) {
+        trace!("buffering pending replies for {recipient}");
+        self.surb_senders
+            .entry(*recipient)
+            .or_default()
+            .pending_replies
+            .store(&lane, fragments)
+    }
+
+    fn re_insert_pending_replies(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        fragments: Vec<(TransmissionLane, FragmentWithMaxRetransmissions)>,
+    ) {
+        trace!("re-inserting pending replies for {recipient}");
+        // the buffer should ALWAYS exist at this point, if it doesn't, it's a bug...
+        self.surb_senders
+            .entry(*recipient)
+            .or_default()
+            .pending_replies
+            .store_multiple(fragments)
+    }
+
+    fn re_insert_pending_retransmission(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        data: Vec<Arc<PendingAcknowledgement>>,
+    ) {
+        trace!("re-inserting pending retransmissions for {recipient}");
+        // SAFETY: the underlying entry MUST exist as we've just got data from there
+        // and we hold a mut reference
+        #[allow(clippy::expect_used)]
+        let map_entry = &mut self
+            .surb_senders
+            .get_mut(recipient)
+            .expect("our pending retransmission entry is somehow gone!")
+            .pending_retransmissions;
+
+        for pending in data {
+            // if it's 0, we don't need to do anything - we just got that ack!
+            if Arc::strong_count(&pending) > 1 {
+                let id = pending.inner_fragment_identifier();
+                let downgraded = Arc::downgrade(&pending);
+                map_entry.insert(id, downgraded);
+            }
+        }
+    }
+
+    fn should_request_more_surbs(&self, target: &AnonymousSenderTag) -> bool {
+        trace!("checking if we should request more surbs from {target}");
+
+        let total_queue = self
+            .surb_senders
+            .get(target)
+            .map(|pending| pending.total_pending())
+            .unwrap_or_default();
+
+        // only consider 'fresh' surbs
+        let available_surbs = self.surbs_storage.available_fresh_surbs(target);
+        let pending_surbs = self.surbs_storage.pending_reception(target) as usize;
+        let min_surbs_threshold = self.surbs_storage.min_surb_threshold();
+        let max_surbs_threshold = self.surbs_storage.max_surb_threshold();
+        let min_surbs_threshold_buffer =
+            self.config.reply_surbs.minimum_reply_surb_threshold_buffer;
+
+        // After clearing the queue, we want to have at least `min_surbs_threshold` surbs available
+        // and reserved for requesting additional surbs, and in addition to that we also want to
+        // have `min_surbs_threshold_buffer` surbs available proactively.
+        let target_surbs_after_clearing_queue = min_surbs_threshold + min_surbs_threshold_buffer;
+
+        // Check if we have enough surbs to handle the total queue and maintain minimum thresholds
+        let total_required_surbs = total_queue + target_surbs_after_clearing_queue;
+        let total_available_surbs = pending_surbs + available_surbs;
+
+        debug!("available surbs: {available_surbs} pending surbs: {pending_surbs} threshold range: {min_surbs_threshold}..+{min_surbs_threshold_buffer}..{max_surbs_threshold}");
+
+        // We should request more surbs if:
+        // 1. We haven't hit the maximum surb threshold, and
+        // 2. We don't have enough surbs to handle the queue plus minimum thresholds
+        let is_below_max_threshold = total_available_surbs < max_surbs_threshold;
+        let is_below_required_surbs = total_available_surbs < total_required_surbs;
+
+        is_below_max_threshold && is_below_required_surbs
+    }
+
+    pub(crate) async fn handle_send_reply(
+        &mut self,
+        recipient_tag: AnonymousSenderTag,
+        data: Vec<u8>,
+        lane: TransmissionLane,
+        max_retransmissions: Option<u32>,
+    ) {
+        if !self.surbs_storage.contains_surbs_for(&recipient_tag) {
+            if self
+                .unavailable
+                .insert(recipient_tag, OffsetDateTime::now_utc())
+                .is_none()
+            {
+                // don't report it every single time
+                warn!("received reply request for {recipient_tag} but we don't have any surbs stored for that recipient!");
+            } else {
+                trace!("received reply request for {recipient_tag} but we don't have any surbs stored for that recipient!");
+            }
+            return;
+        }
+
+        trace!("handling reply to {recipient_tag}");
+        let mut fragments = self.message_handler.split_reply_message(data);
+        let total_size = fragments.len();
+        trace!("This reply requires {total_size} SURBs");
+
+        // for the purposes of sending reply, do allow using possibly stale entries
+        let available_surbs = self.surbs_storage.available_surbs(&recipient_tag);
+        let min_surbs_threshold = self.surbs_storage.min_surb_threshold();
+
+        let max_to_send = if available_surbs > min_surbs_threshold {
+            min(fragments.len(), available_surbs - min_surbs_threshold)
+        } else {
+            0
+        };
+
+        if max_to_send > 0 {
+            let (surbs, surbs_left) = self
+                .surbs_storage
+                .get_reply_surbs(&recipient_tag, max_to_send);
+
+            debug!(
+                "retrieved {} reply surbs. {surbs_left} surbs remaining in storage",
+                surbs.as_ref().map(|s| s.len()).unwrap_or_default()
+            );
+            if let Some(reply_surbs) = surbs {
+                let to_send = fragments
+                    .drain(..reply_surbs.len())
+                    .map(|f| FragmentWithMaxRetransmissions {
+                        fragment: f,
+                        max_retransmissions,
+                    })
+                    .collect::<Vec<_>>();
+
+                if let Err(err) = self
+                    .message_handler
+                    .try_send_reply_chunks_on_lane(
+                        recipient_tag,
+                        to_send.clone(),
+                        reply_surbs,
+                        lane,
+                    )
+                    .await
+                {
+                    let err = err.return_unused_surbs(&self.surbs_storage, &recipient_tag);
+                    warn!("failed to send reply to {recipient_tag}: {err}");
+                    info!(
+                        "buffering {no_fragments} fragments for {recipient_tag}",
+                        no_fragments = to_send.len()
+                    );
+                    self.insert_pending_replies(&recipient_tag, to_send, lane);
+                }
+            }
+        }
+
+        // if there's leftover data we didn't send because we didn't have enough (or any) surbs - buffer it
+        if !fragments.is_empty() {
+            // Ideally we should have enough surbs above the minimum threshold to handle sending
+            // new replies without having to first request more surbs. That's why I'd like to log
+            // these cases as they might indicate a problem with the surb management.
+            debug!(
+                "buffering {no_fragments} fragments for {recipient_tag}",
+                no_fragments = fragments.len()
+            );
+            let fragments: Vec<_> = fragments
+                .into_iter()
+                .map(|fragment| FragmentWithMaxRetransmissions {
+                    fragment,
+                    max_retransmissions,
+                })
+                .collect();
+            self.insert_pending_replies(&recipient_tag, fragments, lane);
+        }
+
+        if self.should_request_more_surbs(&recipient_tag) {
+            self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                .await;
+        }
+    }
+
+    async fn request_additional_reply_surbs(
+        &mut self,
+        target: AnonymousSenderTag,
+        amount: u32,
+    ) -> Result<(), PreparationError> {
+        debug!("requesting {amount} additional reply surbs for {target}");
+        let (reply_surb, _) = self
+            .surbs_storage
+            .get_reply_surb_ignoring_threshold(&target);
+
+        let reply_surb = reply_surb.ok_or(PreparationError::NotEnoughSurbs {
+            available: 0,
+            required: 1,
+        })?;
+
+        if let Err(err) = self
+            .message_handler
+            .try_request_additional_reply_surbs(target, reply_surb, amount)
+            .await
+        {
+            let err = err.return_unused_surbs(&self.surbs_storage, &target);
+            warn!("failed to request additional surbs from {target}: {err}",);
+            return Err(err);
+        } else {
+            self.surbs_storage
+                .increment_pending_reception(&target, amount);
+        }
+
+        Ok(())
+    }
+
+    async fn try_clear_pending_retransmission(&mut self, target: AnonymousSenderTag) {
+        trace!("trying to clear pending retransmission queue");
+        let available_surbs = self.surbs_storage.available_surbs(&target);
+        let min_surbs_threshold = self.surbs_storage.min_surb_threshold();
+
+        let max_to_clear = if available_surbs > min_surbs_threshold {
+            available_surbs - min_surbs_threshold
+        } else {
+            trace!("we don't have enough surbs for retransmission queue clearing...");
+            return;
+        };
+        trace!("we can clear up to {max_to_clear} entries");
+
+        let Some(pending) = self.surb_senders.get_mut(&target) else {
+            trace!("no pending entry for {target}!");
+            return;
+        };
+
+        let mut to_take = Vec::new();
+
+        while to_take.len() < max_to_clear {
+            if let Some((_, data)) = pending.pending_retransmissions.pop_first() {
+                // no need to do anything if we failed to upgrade the reference,
+                // it means we got the ack while the data was waiting in the queue
+                if let Some(upgraded) = data.upgrade() {
+                    to_take.push(upgraded)
+                }
+            } else {
+                // our map is empty!
+                break;
+            }
+        }
+
+        if to_take.is_empty() {
+            // no need to do anything
+            return;
+        }
+
+        let (surbs_for_reply, _) = self.surbs_storage.get_reply_surbs(&target, to_take.len());
+
+        let Some(surbs_for_reply) = surbs_for_reply else {
+            error!("somehow different task has stolen our reply surbs! - this should have been impossible");
+            self.re_insert_pending_retransmission(&target, to_take);
+            return;
+        };
+
+        let to_send_vec = to_take.iter().map(|ack| ack.fragment_data()).collect();
+
+        let prepared_fragments = match self
+            .message_handler
+            .prepare_reply_chunks_for_sending(to_send_vec, surbs_for_reply)
+            .await
+        {
+            Ok(prepared) => prepared,
+            Err(err) => {
+                let err = err.return_unused_surbs(&self.surbs_storage, &target);
+                self.re_insert_pending_retransmission(&target, to_take);
+
+                warn!("failed to clear pending retransmission queue for {target}: {err}",);
+                return;
+            }
+        };
+
+        // we can't fail at this point, so drop all references to acks so that timer updates wouldn't blow up
+        drop(to_take);
+
+        self.message_handler
+            .send_retransmission_reply_chunks(prepared_fragments, TransmissionLane::Retransmission)
+            .await;
+    }
+
+    fn pop_at_most_pending_replies(
+        &mut self,
+        from: &AnonymousSenderTag,
+        amount: usize,
+    ) -> Option<Vec<(TransmissionLane, FragmentWithMaxRetransmissions)>> {
+        // if possible, pop all pending replies, if not, pop only entries for which we'd have a reply surb
+        let pending = self.surb_senders.get_mut(from)?;
+        let total = pending.pending_replies.total_size();
+        trace!("pending queue has {total} elements");
+        if total == 0 {
+            return None;
+        }
+        pending
+            .pending_replies
+            .pop_at_most_n_next_messages_at_random(amount)
+    }
+
+    #[allow(clippy::panic)]
+    async fn try_clear_pending_queue(&mut self, target: AnonymousSenderTag) {
+        trace!("trying to clear pending queue");
+        let available_surbs = self.surbs_storage.available_surbs(&target);
+        let min_surbs_threshold = self.surbs_storage.min_surb_threshold();
+
+        let max_to_clear = if available_surbs > min_surbs_threshold {
+            available_surbs - min_surbs_threshold
+        } else {
+            trace!("we don't have enough surbs for queue clearing...");
+            return;
+        };
+        trace!("we can clear up to {max_to_clear} entries");
+
+        // we're guaranteed to not get more entries than we have reply surbs for
+        if let Some(to_send) = self.pop_at_most_pending_replies(&target, max_to_clear) {
+            let to_send_clone = to_send.clone();
+
+            if to_send_clone.is_empty() {
+                panic!(
+                    "please let the devs know if you ever see this message (reply_controller.rs)"
+                );
+            }
+
+            let (surbs_for_reply, _) = self
+                .surbs_storage
+                .get_reply_surbs(&target, to_send_clone.len());
+
+            let Some(surbs_for_reply) = surbs_for_reply else {
+                error!("somehow different task has stolen our reply surbs! - this should have been impossible");
+                self.re_insert_pending_replies(&target, to_send);
+                return;
+            };
+
+            if let Err(err) = self
+                .message_handler
+                .try_send_reply_chunks(target, to_send_clone, surbs_for_reply)
+                .await
+            {
+                let err = err.return_unused_surbs(&self.surbs_storage, &target);
+                self.re_insert_pending_replies(&target, to_send);
+                warn!("failed to clear pending queue for {target}: {err}");
+            }
+        } else {
+            trace!("the pending queue is empty");
+        }
+    }
+
+    fn reset_rerequest_counter(&mut self, from: &AnonymousSenderTag) {
+        if let Some(pending) = self.surb_senders.get_mut(from) {
+            pending.reset_current_clear_rerequest_counter()
+        }
+    }
+
+    pub(crate) async fn handle_received_surbs(
+        &mut self,
+        from: AnonymousSenderTag,
+        reply_surbs: Vec<ReplySurbWithKeyRotation>,
+        from_surb_request: bool,
+    ) {
+        trace!("handling received surbs");
+
+        // clear the requesting flag since we should have been asking for surbs
+        if from_surb_request {
+            self.surbs_storage
+                .decrement_pending_reception(&from, reply_surbs.len() as u32);
+        }
+
+        // store received surbs
+        self.surbs_storage.insert_fresh_surbs(&from, reply_surbs);
+
+        // reset, if applicable, request counter
+        self.reset_rerequest_counter(&from);
+
+        // use as many as we can for clearing pending retransmission queue
+        self.try_clear_pending_retransmission(from).await;
+
+        // use as many as we can for clearing pending 'normal' queue
+        self.try_clear_pending_queue(from).await;
+
+        // if we have to, request more
+        if self.should_request_more_surbs(&from) {
+            self.request_reply_surbs_for_queue_clearing(from).await;
+        }
+    }
+    fn buffer_pending_ack(
+        &mut self,
+        recipient: AnonymousSenderTag,
+        ack_ref: Arc<PendingAcknowledgement>,
+        weak_ack_ref: Weak<PendingAcknowledgement>,
+    ) {
+        let frag_id = ack_ref.inner_fragment_identifier();
+
+        let pending = self.surb_senders.entry(recipient).or_default();
+        if let Entry::Vacant(e) = pending.pending_retransmissions.entry(frag_id) {
+            e.insert(weak_ack_ref);
+        } else {
+            warn!(
+                "we're already trying to retransmit {frag_id}. We must be really behind in surbs!"
+            );
+        }
+    }
+
+    pub(crate) async fn handle_reply_retransmission(
+        &mut self,
+        recipient_tag: AnonymousSenderTag,
+        timed_out_ack: Weak<PendingAcknowledgement>,
+        extra_surbs_request: bool,
+    ) {
+        // seems we got the ack in the end
+        let ack_ref = match timed_out_ack.upgrade() {
+            Some(ack) => ack,
+            None => {
+                debug!("we received the ack for one of the reply packets as we were putting it in the retransmission queue");
+                return;
+            }
+        };
+
+        // if this is retransmission for obtaining additional reply surbs,
+        // we can dip below the storage threshold
+        let (maybe_reply_surb, _) = if extra_surbs_request {
+            self.surbs_storage
+                .get_reply_surb_ignoring_threshold(&recipient_tag)
+        } else {
+            self.surbs_storage.get_reply_surb(&recipient_tag)
+        };
+
+        if let Some(reply_surb) = maybe_reply_surb {
+            match self
+                .message_handler
+                .try_prepare_single_reply_chunk_for_sending(reply_surb, ack_ref.fragment_data())
+                .await
+            {
+                Ok(prepared) => {
+                    // drop the ack ref so that controller would not panic on `UpdateTimer` if that task
+                    // got to handle the action before this function terminated (which is very much
+                    // possible if `forward_messages` takes a while)
+                    drop(ack_ref);
+
+                    self.message_handler
+                        .update_ack_delay(prepared.fragment_identifier, prepared.total_delay);
+                    self.message_handler
+                        .forward_messages(vec![prepared.into()], TransmissionLane::Retransmission)
+                        .await;
+                }
+                Err(err) => {
+                    let err = err.return_unused_surbs(&self.surbs_storage, &recipient_tag);
+                    warn!("failed to prepare message for retransmission - {err}");
+                    // we buffer that packet and to try another day
+                    self.buffer_pending_ack(recipient_tag, ack_ref, timed_out_ack);
+
+                    if self.should_request_more_surbs(&recipient_tag) {
+                        self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                            .await;
+                    }
+                }
+            };
+        } else {
+            self.buffer_pending_ack(recipient_tag, ack_ref, timed_out_ack);
+
+            if self.should_request_more_surbs(&recipient_tag) {
+                self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                    .await;
+            }
+        }
+    }
+
+    // to be honest this doesn't make a lot of sense in the context of `connection_id`,
+    // it should really be asked per tag
+    pub(crate) fn handle_lane_queue_length(
+        &self,
+        connection_id: ConnectionId,
+        response_channel: oneshot::Sender<usize>,
+    ) {
+        // TODO: if we ever have duplicate ids for different senders, it means our rng is super weak
+        // thus I don't think we have to worry about it?
+        let lane = TransmissionLane::ConnectionId(connection_id);
+        for buf in self.surb_senders.values().map(|p| &p.pending_replies) {
+            if let Some(length) = buf.lane_length(&lane) {
+                if response_channel.send(length).is_err() {
+                    error!("the requester for lane queue length has dropped the response channel!")
+                }
+                return;
+            }
+        }
+        // make sure that if we didn't find that lane, we reply with 0
+        if response_channel.send(0).is_err() {
+            error!("the requester for lane queue length has dropped the response channel!")
+        }
+    }
+
+    // TODO: modify this method to more accurately determine the amount of surbs it needs to request
+    // it should take into consideration the average latency, sending rate and queue size.
+    // it should request as many surbs as it takes to saturate its sending rate before next batch arrives
+    async fn request_reply_surbs_for_queue_clearing(&mut self, target: AnonymousSenderTag) {
+        trace!("requesting surbs for queue clearing");
+
+        let total_queue = self
+            .surb_senders
+            .get(&target)
+            .map(|pending| pending.total_pending() as u32)
+            .unwrap_or_default();
+
+        let min_surbs_buffer = self.config.reply_surbs.minimum_reply_surb_threshold_buffer as u32;
+
+        // To proactively request additional surbs, we aim to have a buffer of extra surbs in our
+        // storage.
+        let total_queue_with_buffer = total_queue + min_surbs_buffer;
+
+        let request_size = min(
+            self.config.reply_surbs.maximum_reply_surb_request_size,
+            max(
+                total_queue_with_buffer,
+                self.config.reply_surbs.minimum_reply_surb_request_size,
+            ),
+        );
+
+        if let Err(err) = self
+            .request_additional_reply_surbs(target, request_size)
+            .await
+        {
+            let now = OffsetDateTime::now_utc();
+            let sender_info = self.get_or_create_surb_sender(&target);
+            let last_failure = sender_info.reset_last_request_failure(now);
+
+            // only log at higher level if it's the first time this error has occurred in a while
+            if now - last_failure > time::Duration::seconds(30) {
+                warn!("failed to request more surbs to clear pending queue of size {total_queue} (attempted to request: {request_size}): {err}")
+            } else {
+                debug!("failed to request more surbs to clear pending queue of size {total_queue} (attempted to request: {request_size}): {err}")
+            }
+        }
+    }
+
+    pub(crate) async fn inspect_stale_pending_data(&mut self) {
+        let mut to_request = Vec::new();
+        let mut to_remove = Vec::new();
+
+        let now = OffsetDateTime::now_utc();
+        for (pending_reply_target, vals) in self.surb_senders.iter_mut() {
+            // for now recreate old behaviour
+            let retransmission_buf = &vals.pending_replies;
+
+            if retransmission_buf.is_empty() {
+                continue;
+            }
+
+            let Some(last_received_time) = self
+                .surbs_storage
+                .surbs_last_received_at(pending_reply_target)
+            else {
+                error!("we have {} pending replies for {pending_reply_target}, but we somehow never received any reply surbs from them!", retransmission_buf.total_size());
+                to_remove.push(*pending_reply_target);
+                continue;
+            };
+
+            let diff = now - last_received_time;
+            let max_rerequest_wait = self
+                .config
+                .reply_surbs
+                .maximum_reply_surb_rerequest_waiting_period;
+            let max_drop_wait = self
+                .config
+                .reply_surbs
+                .maximum_reply_surb_drop_waiting_period;
+            let max_rerequests = self.config.reply_surbs.maximum_reply_surbs_rerequests;
+
+            // if we have already requested extra surbs because of the stale entry,
+            // don't do it again (otherwise we'll get stuck in a constant cycle of requesting more surbs
+            // if client is offline)
+            if vals.current_clear_rerequest_counter > max_rerequests {
+                to_remove.push(*pending_reply_target);
+                debug!("we have reached the maximum threshold of attempting to request surbs from {pending_reply_target}. dropping the sender");
+                continue;
+            }
+
+            if diff > max_rerequest_wait {
+                if diff > max_drop_wait {
+                    to_remove.push(*pending_reply_target)
+                } else {
+                    debug!("We haven't received any surbs in {} from {pending_reply_target}. Going to explicitly ask for more", humantime::format_duration(diff.unsigned_abs()));
+                    vals.increment_current_clear_rerequest_counter();
+                    to_request.push(*pending_reply_target);
+                }
+            }
+        }
+
+        for pending_reply_target in to_request {
+            self.request_reply_surbs_for_queue_clearing(pending_reply_target)
+                .await;
+            self.surbs_storage
+                .reset_pending_reception(&pending_reply_target)
+        }
+        for to_remove in to_remove {
+            // TODO: in the 'old' version we just removed pending messages,
+            // not retransmissions, but I think those should follow the same logic.
+            // if something breaks because of that. I guess here is your explanation, future reader
+            self.surb_senders.remove(&to_remove);
+        }
+    }
+
+    pub(crate) async fn check_surb_refresh(&mut self) {
+        let Some(current_rotation_id) = self.topology_access.current_key_rotation_id().await else {
+            warn!("failed to retrieve current key rotation id from the network topology");
+            return;
+        };
+
+        if let SurbRefreshState::WaitingForNextRotation { last_known } = self.surb_refresh_state {
+            if last_known == current_rotation_id {
+                trace!("no changes in key rotation id");
+            } else {
+                // key rotation actually changed and given the polling rate (1/8th epoch) we should have plenty
+                // of time to perform the upgrade.
+                // but wait for one more call before doing this so that the clients could also resync
+                // their topologies and discover new rotation
+                self.surb_refresh_state = SurbRefreshState::ScheduledForNextInvocation;
+            }
+            return;
+        }
+
+        // here we are in `SurbRefreshState::ScheduledForNextInvocation` state
+
+        let mut marked_as_stale = HashMap::new();
+
+        // 1. mark all existing surbs we have as possibly stale
+        for mut map_entry in self.surbs_storage.as_raw_iter_mut() {
+            let (sender, received) = map_entry.pair_mut();
+            let num_downgraded = received.downgrade_freshness();
+            trace!("{sender}: {num_downgraded} downgraded");
+            if num_downgraded != 0 {
+                marked_as_stale.insert(*sender, num_downgraded);
+            }
+        }
+
+        // 2. attempt to re-request the equivalent number of fresh surbs
+        // TODO PROBLEM: if our request gets lost, we might be in trouble...
+        // we need some sort of retry mechanism
+        for (sender, num_to_request) in marked_as_stale {
+            if self
+                .request_additional_reply_surbs(sender, num_to_request as u32)
+                .await
+                .is_err()
+            {
+                warn!("surb refresh request failed")
+            }
+        }
+
+        self.surb_refresh_state = SurbRefreshState::WaitingForNextRotation {
+            last_known: current_rotation_id,
+        };
+    }
+
+    pub(crate) async fn inspect_and_clear_stale_data(&mut self, now: OffsetDateTime) {
+        // technically we don't know if epoch is stuck, but we're flying in blind here,
+        // so we have to assume the worst and not purge anything depending on proper epoch progression
+        let is_epoch_stuck = self
+            .current_topology_metadata()
+            .await
+            .map(|m| self.config.key_rotation.epoch_stuck(m))
+            .unwrap_or(false);
+
+        // expected time of when the CURRENT key rotation has begun
+        let expected_current_key_rotation_start = self
+            .config
+            .key_rotation
+            .expected_current_key_rotation_start(now);
+
+        // expected ID of the CURRENT key rotation
+        let expected_current_key_rotation = self
+            .config
+            .key_rotation
+            .expected_current_key_rotation_id(now);
+
+        // time of the start of one epoch BEFORE the CURRENT rotation has begun
+        // this indicates the starting time of when packets with the current keys might have been constructed
+        let prior_epoch_start =
+            expected_current_key_rotation_start - self.config.key_rotation.epoch_duration;
+
+        // time of the start of one epoch AFTER the current rotation has begun
+        // this indicates the end of transition period and any packets constructed with keys different
+        // from the current one are definitely invalid
+        let following_epoch_start =
+            expected_current_key_rotation_start + self.config.key_rotation.epoch_duration;
+
+        // define a closure for validating individual surbs
+        // (we have to run it twice for different piles)
+        let basic_surb_retention_logic = |received_surb: &ReceivedReplySurb| {
+            if is_epoch_stuck {
+                let diff = now - received_surb.received_at();
+                return diff < self.config.key_rotation.rotation_lifetime();
+            }
+
+            if received_surb.received_at() < prior_epoch_start {
+                // it's definitely from previous rotation
+                return false;
+            }
+            let surb_rotation = received_surb.key_rotation();
+
+            if surb_rotation.is_unknown() {
+                // can't do anything, so just retain it
+                return true;
+            }
+
+            // TODO: will this backfire during transition period where we need surbs to refresh surbs
+            // and we failed to send a request?
+            if surb_rotation.is_even() && expected_current_key_rotation % 2 == 1 {
+                return false;
+            }
+
+            if surb_rotation.is_odd() && expected_current_key_rotation % 2 == 0 {
+                return false;
+            }
+
+            true
+        };
+
+        // 1. purge full old clients data (this applies to RECEIVER)
+        self.surbs_storage.retain(|_, received| {
+            if is_epoch_stuck {
+                // if epoch is stuck, we can't do much (because we don't know for certain if rotation has advanced)
+                // apart from the basic check of surbs being received more than maximum lifetime of a rotation
+                // because at that point we know they must be invalid
+                let diff = now - received.surbs_last_received_at();
+                return diff < self.config.key_rotation.rotation_lifetime();
+            }
+
+            // if surbs were received more than 1h before the start of the current rotation,
+            // they're DEFINITELY invalid.
+            // if it was up until 1h AFTER the start of the current rotation they MIGHT be valid -
+            // we don't know for sure, unless the client explicitly attached rotation information
+            // (which only applies to more recent versions of clients so we can't 100% rely on that)
+            if received.surbs_last_received_at() < prior_epoch_start {
+                return false;
+            }
+
+            // 1.1. check individual surbs (same basic logic applies)
+            received.retain_fresh_surbs(&basic_surb_retention_logic);
+
+            // 1.2. check the possibly stale entries
+            // 1.2.1. check if we're beyond the key rotation transition period,
+            // if so those surbs are definitely unusable
+            if now > following_epoch_start {
+                received.drop_possibly_stale_surbs();
+            }
+
+            // 1.2.2. otherwise continue with the same logic as the fresh ones
+            received.retain_possibly_stale_surbs(&basic_surb_retention_logic);
+
+            // no surbs left, we're not expecting any AND we haven't received anything in a while
+            // (i.e. sender probably abandoned us)
+            let max_drop_wait = self
+                .config
+                .reply_surbs
+                .maximum_reply_surb_drop_waiting_period;
+            let last_received = received.surbs_last_received_at();
+
+            let possibly_abandoned = last_received + max_drop_wait < now;
+            if received.is_empty() && received.pending_reception() == 0 && possibly_abandoned {
+                return false;
+            }
+
+            true
+        });
+
+        // 1.3 inspect old unavailable receivers to clear any stale data
+        self.unavailable
+            .retain(|_, last_reported| now - *last_reported < time::Duration::seconds(30));
+    }
+}