Remove mixnode modifications

Bundle libcpucycles
mixnode feature
2023-03-27 14:21:44 +02:00 · 2023-03-27 14:11:03 +02:00 · 2023-03-27 09:57:28 +02:00 · 2023-03-27 09:13:20 +02:00 · 2023-03-15 11:21:48 +00:00 · 2023-03-14 14:38:34 +00:00
2069 changed files with 134312 additions and 73471 deletions
@@ -3,3 +3,21 @@

 RUST_LOG=info
 RUST_BACKTRACE=1
+
+#########################################
+# geoipupdate (needed for explorer-api) #
+#########################################
+# MaxMind account ID (change it to a valid account ID)
+GEOIPUPDATE_ACCOUNT_ID=xxx
+# MaxMind license key (change it to a valid license key)
+GEOIPUPDATE_LICENSE_KEY=xxx
+# List of space-separated database edition IDs. Edition IDs may
+# consist of letters, digits, and dashes. For example, GeoIP2-City
+# would download the GeoIP2 City database (GeoIP2-City).
+GEOIPUPDATE_EDITION_IDS=GeoLite2-City
+# The number of hours between geoipupdate runs. If this is not set
+# or is set to 0, geoipupdate will run once and exit.
+GEOIPUPDATE_FREQUENCY=72
+# The path to the directory where geoipupdate will download the
+# database.
+GEOIP_DB_DIRECTORY=./explorer-api/geo_ip
@@ -1,36 +1,57 @@
 name: Daily security audit

-on: workflow_dispatch
+on:
+  schedule:
+    - cron: '5 9 * * *'
 jobs:
-  security_audit:
-    runs-on: ubuntu-latest
+  cargo-deny:
+    runs-on: ubuntu-20.04
    steps:
-      - uses: actions/checkout@v1
-      - uses: actions-rs/audit-check@v1
+      - name: Checkout repository code
+        uses: actions/checkout@v2
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
+          toolchain: stable
+      - name: Install cargo deny
+        run: cargo install --locked cargo-deny
+      - name: Run cargo deny
+        run: |
+          find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
+            advisories -A advisory-not-detected  --hide-inclusion-graph \; &> \
+            >(uniq  &> .github/workflows/support-files/notifications/deny.message )
+      - uses: actions/upload-artifact@v3
+        with:
+          name: report
+          path: .github/workflows/support-files/notifications/deny.message
  notification:
-    if: ${{ failure() }}
-    needs: security_audit
-    runs-on: ubuntu-latest
+    needs: cargo-deny
+    runs-on: custom-runner-linux
    steps:
      - name: Check out repository code
        uses: actions/checkout@v2
-      - name: Keybase - Node Install
+      - name: Download report from previous job
+        uses: actions/download-artifact@v3
+        with:
+          name: report
+          path: .github/workflows/support-files/notifications
+      - name: install npm
+        uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - name: Matrix - Node Install
        run: npm install
        working-directory: .github/workflows/support-files
-      - name: Keybase - Send Notification
+      - name: Matrix - Send Notification
        env:
-          NYM_NOTIFICATION_KIND: nightly
-          NYM_PROJECT_NAME: "Nym daily audit"
+          NYM_NOTIFICATION_KIND: security
+          NYM_PROJECT_NAME: "Daily security report"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-          KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-          KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBTECH_TEAM }}"
-          KEYBASE_NYM_CHANNEL: "test"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_AUDIT }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -0,0 +1,116 @@
+name: Build and upload binaries to CI
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'contracts/**'
+      - 'explorer-api/**'
+      - 'gateway/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+      - 'nym-api/**'
+      - 'nym-outfox/**'
+      - 'tools/nym-cli/**'
+      - 'tools/ts-rs-cli/**'
+  pull_request:
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'contracts/**'
+      - 'explorer-api/**'
+      - 'gateway/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+      - 'nym-api/**'
+      - 'nym-outfox/**'
+      - 'tools/nym-cli/**'
+      - 'tools/ts-rs-cli/**'
+
+env:
+  NETWORK: mainnet
+
+jobs:
+  publish-nym:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-20.04]
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare build output directory
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: |
+          rm -rf ci-builds || true
+          mkdir -p $OUTPUT_DIR
+          echo $OUTPUT_DIR
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --release --all
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-opt
+        run: cargo install wasm-opt
+
+      - name: Build release contracts
+        run: make wasm
+
+      - name: Prepare build output
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: |
+          cp target/release/nym-client $OUTPUT_DIR
+          cp target/release/nym-gateway $OUTPUT_DIR
+          cp target/release/nym-mixnode $OUTPUT_DIR
+          cp target/release/nym-socks5-client $OUTPUT_DIR
+          cp target/release/nym-api $OUTPUT_DIR
+          cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nym-network-statistics $OUTPUT_DIR
+          cp target/release/nym-cli $OUTPUT_DIR
+          cp target/release/credential $OUTPUT_DIR
+          
+          cp contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm $OUTPUT_DIR
+          cp contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm $OUTPUT_DIR
+
+      - name: Deploy branch to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "ci-builds/"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/
+          EXCLUDE: "/dist/, /node_modules/"
@@ -0,0 +1,59 @@
+name: Build and upload binaries to artifact storage
+
+on:
+  workflow_dispatch:
+    inputs:  
+      add_tokio_unstable:
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
+        default: false
+        type: boolean 
+    
+env:
+  NETWORK: mainnet    
+
+jobs:
+  publish-nym:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-20.04]
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+
+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        run: |
+          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --release
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: nym-binaries-artifacts
+          path: |
+            target/release/nym-client
+            target/release/nym-gateway
+            target/release/nym-mixnode
+            target/release/nym-socks5-client
+            target/release/nym-api
+            target/release/nym-network-requester
+            target/release/nym-network-statistics
+            target/release/nym-cli
+          retention-days: 30
@@ -12,6 +12,7 @@ jobs:
    - uses: actions/checkout@v2
    - name: Install rsync
      run: sudo apt-get install rsync
+      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
    - uses: actions/setup-node@v3
      with:
@@ -42,10 +43,10 @@ jobs:
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ts-${{ env.GITHUB_REF_SLUG }}-example
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Keybase - Node Install
+    - name: Matrix - Node Install
      run: npm install
      working-directory: .github/workflows/support-files
-    - name: Keybase - Send Notification
+    - name: Matrix - Send Notification
      env:
        NYM_NOTIFICATION_KIND: ts-packages
        NYM_PROJECT_NAME: "ts-packages"
@@ -53,11 +54,12 @@ jobs:
        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
        GIT_BRANCH: "${GITHUB_REF##*/}"
-        KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-        KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-        KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-        KEYBASE_NYM_CHANNEL: "ci-ts-packages"
        IS_SUCCESS: "${{ job.status == 'success' }}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
      uses: docker://keybaseio/client:stable-node
      with:
        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -2,21 +2,44 @@ name: Continuous integration

 on:
  push:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'explorer-api/**'
+      - 'gateway/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+      - 'nym-api/**'
+      - 'nym-outfox/**'
+      - 'tools/nym-cli/**'
+      - 'tools/ts-rs-cli/**'
  pull_request:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'explorer-api/**'
+      - 'gateway/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+      - 'nym-api/**'
+      - 'nym-outfox/**'
+      - 'tools/nym-cli/**'
+      - 'tools/ts-rs-cli/**'

 jobs:
  build:
    runs-on: [ self-hosted, custom-linux ]
-    # Enable sccache via environment variable
+    # Enable sccache via environment variable
    env:
      RUSTC_WRAPPER: /home/ubuntu/.cargo/bin/sccache
    steps:
      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true

      - name: Check out repository code
        uses: actions/checkout@v2
@@ -29,57 +52,46 @@ jobs:
          override: true
          components: rustfmt, clippy

-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace
-
-      - name: Run all tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --all-features
-
-      - name: Run expensive tests
-        if: github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master'
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --all-features -- --ignored
-
      - name: Check formatting
        uses: actions-rs/cargo@v1
        with:
          command: fmt
          args: --all -- --check

+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace
+
+      - name: Build all examples
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Run all tests
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace
+
+      - name: Run expensive tests
+        if: github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master'
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace -- --ignored
+
      - uses: actions-rs/clippy-check@v1
        name: Clippy checks
+        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace --all-features
+          args: --workspace

      - name: Run clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace -- -D warnings
-
-      - name: Build all binaries with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --features=coconut
-
-      - name: Run all tests with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features=coconut
-
-      - name: Run clippy with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --features=coconut -- -D warnings
+          args: --workspace --all-targets -- -D warnings
@@ -1,6 +1,6 @@
 [
  {
-    "os":"ubuntu-latest",
+    "os":"ubuntu-20.04",
    "rust":"stable",
    "runOnEvent":"always"
  },
@@ -1,72 +0,0 @@
-name: Continuous integration on dispatch
-
-on: workflow_dispatch
-
-jobs:
-  build:
-    runs-on: [ self-hosted, custom-linux ]
-    # Enable sccache via environment variable
-    env:
-      RUSTC_WRAPPER: /home/ubuntu/.cargo/bin/sccache
-    steps:
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
-
-      - name: Check out repository code
-        uses: actions/checkout@v2
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
-
-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace
-
-      - name: Run all tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --all-features
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
-
-      - uses: actions-rs/clippy-check@v1
-        name: Clippy checks
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features
-
-      - name: Run clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace -- -D warnings
-
-      - name: Build all binaries with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --features=coconut
-
-      - name: Run all tests with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features=coconut
-
-      - name: Run clippy with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --features=coconut -- -D warnings
@@ -0,0 +1,61 @@
+name: check-merge-conflicts
+
+# Check that the latest release branch merges into master and develop without
+# any conflicts that git is not able to resolve
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '5 6 * * *'
+
+jobs:
+  get_release:
+    runs-on: ubuntu-latest
+    outputs:
+      output1: ${{ steps.step2.outputs.latest_release }}
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set output variable to latest release branch
+        id: step2
+        run: echo "latest_release=$(git branch -r | grep -E 'release/v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1)" >> $GITHUB_OUTPUT
+
+  check-merge-release-into-master:
+    name: Check that the release branch merges into master
+    needs: get_release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup git user
+        run: |
+          git config --global user.name "ci"
+          git config --global user.email "ci@localhost"
+      - name: Check merge release branch into master
+        run: |
+          ./.github/workflows/support-files/git-merge-check.sh origin/master $branch1
+        env:
+          branch1: ${{needs.get_release.outputs.output1}}
+
+  check-merge-release-into-develop:
+    name: Check that the release branch merges into develop
+    needs: get_release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup git user
+        run: |
+          git config --global user.name "ci"
+          git config --global user.email "ci@localhost"
+      - name: Check merge release branch into develop
+        run: |
+          ./.github/workflows/support-files/git-merge-check.sh origin/develop $branch1
+        env:
+          branch1: ${{needs.get_release.outputs.output1}}
@@ -0,0 +1,56 @@
+name: Run config checks on all binaries
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+  push:
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'contracts/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+  pull_request:
+    paths:
+      - 'clients/**'
+      - 'common/**'
+      - 'gateway/**'
+      - 'integrations/**'
+      - 'mixnode/**'
+      - 'sdk/rust/nym-sdk/**'
+      - 'service-providers/**'
+
+env:
+  NETWORK: mainnet
+
+jobs:
+  publish-nym:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [custom-runner-linux]
+         
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install jq vim libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          
+      - name: Branch name
+        run: echo running on branch ${GITHUB_REF##*/}
+                    
+      - name: Run tests against binaries
+        run: ./build_and_run.sh ${{ github.head_ref || github.ref_name }}
+        working-directory: tests/
+        
+      
@@ -0,0 +1,138 @@
+name: Nym Connect - Android APK Build
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "release/nc-android-v[0-9].[0-9].[0-9]*"
+
+jobs:
+  build:
+    name: Build APK
+    runs-on: custom-runner-linux
+    env:
+      ANDROID_HOME: ${{ github.workspace }}/android-sdk
+      NDK_VERSION: 25.1.8937393
+      NDK_HOME: ${{ github.workspace }}/android-sdk/ndk/25.1.8937393
+      SDK_PLATFORM_VERSION: android-33
+      SDK_BUILDTOOLS_VERSION: 33.0.1
+
+    steps:
+      - name: Install Dependencies (Linux)
+        # https://next--tauri.netlify.app/next/guides/getting-started/prerequisites/linux/#1-system-dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install \
+          build-essential \
+          unzip \
+          curl \
+          wget \
+          libssl-dev \
+          squashfs-tools \
+          librsvg2-dev
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Install Java
+        uses: actions/setup-java@v3
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: Install Android SDK manager
+        # https://developer.android.com/studio/command-line/sdkmanager
+        run: |
+          curl -sS https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip -o cmdline-tools.zip
+          unzip cmdline-tools.zip
+          mkdir -p $ANDROID_HOME/cmdline-tools/latest
+          mv cmdline-tools/* $ANDROID_HOME/cmdline-tools/latest
+          rm -rf cmdline-tools
+
+      - name: Install Android S/NDK
+        run: |
+          echo y | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses
+          echo y | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager \
+            "platforms;$SDK_PLATFORM_VERSION" \
+            "platform-tools" \
+            "ndk;$NDK_VERSION" \
+            "build-tools;$SDK_BUILDTOOLS_VERSION"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # TODO this step takes a considerable amount of time
+      # We could avoid to compile from source tauri-cli and use instead
+      # pre-compiled binary provided by the node package `@tauri-apps/cli`
+      # But when using the later the build fails for some reason
+      # so keep installing and using tauri-cli
+      - name: Install tauri cli
+        run: cargo install tauri-cli --version "^2.0.0-alpha.2"
+
+      - name: Install rust android targets
+        run: |
+          rustup target add aarch64-linux-android \
+            armv7-linux-androideabi \
+            i686-linux-android \
+            x86_64-linux-android
+
+      - name: Setup Nodejs
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18
+
+      - name: Install yarn
+        run: |
+          npm i -g yarn
+          yarn --version
+
+      - name: Build frontend code
+        run: |
+          yarn install --frozen-lockfile
+          yarn build
+          yarn workspace @nym/nym-connect-mobile webpack:prod
+
+      - name: Build APK
+        working-directory: nym-connect/mobile
+        env:
+          # NODE_TAURI_CLI=${{ github.workspace }}/nym-connect/mobile/node_modules/.bin/tauri
+          ANDROID_SDK_ROOT: ${{ env.ANDROID_HOME }}
+          WRY_ANDROID_PACKAGE: net.nymtech.nym_connect
+          WRY_ANDROID_LIBRARY: nym_connect
+        # TODO build with release profile (--release), it will requires
+        # to sign the APK. For now build with debug profile to avoid that
+        # TODO build using `yarn tauri`, provide NODE_TAURI_CLI, see TODO notes above
+        run: cargo tauri android build --debug --apk --split-per-abi -t aarch64
+
+      # TODO add the version number to APK name
+      - name: Rename APK artifact
+        run: |
+          mkdir apk/
+          mv nym-connect/mobile/src-tauri/gen/android/nym_connect/app/build/outputs/apk/arm64/debug/app-arm64-debug.apk \
+            apk/nym-connect-arm64-debug.apk
+          mv nym-connect/mobile/src-tauri/gen/android/nym_connect/app/build/outputs/apk/x86_64/debug/app-x86_64-debug.apk \
+            apk/nym-connect-x86_64-debug.apk
+
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: nc-apk-debug
+          path: |
+            apk/nym-connect-arm64-debug.apk
+            apk/nym-connect-x86_64-debug.apk
+
+  # publish:
+  #   name: Publish APK
+  #   needs: build
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Checkout
+  #       uses: actions/checkout@v3
+  #     - name: Download binary artifact
+  #       uses: actions/download-artifact@v3
+  #       with:
+  #         name: nc-apk-debug
+  #         path: apk
+  #     # TODO add a step to upload the APK somewhere
+  #     - name: Publish
+  #       uses: ???
@@ -1,13 +1,13 @@
-name: CI for nym-connect
+name: CI for nym-connect - Desktop

 on:
  push:
    paths:
-      - 'nym-connect/**'
+      - 'nym-connect/desktop/**'

 defaults:
  run:
-    working-directory: nym-connect
+    working-directory: nym-connect/desktop

 jobs:
  build:
@@ -16,6 +16,7 @@ jobs:
    - uses: actions/checkout@v2
    - name: Install rsync
      run: sudo apt-get install rsync
+      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
    - uses: actions/setup-node@v3
      with:
@@ -33,27 +34,28 @@ jobs:
      env:
        SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
        ARGS: "-rltgoDzvO --delete"
-        SOURCE: "nym-connect/storybook-static/"
+        SOURCE: "nym-connect/desktop/storybook-static/"
        REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/nym-connect-${{ env.GITHUB_REF_SLUG }}
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Keybase - Node Install
+    - name: Matrix - Node Install
      run: npm install
      working-directory: .github/workflows/support-files
-#    - name: Keybase - Send Notification
-#      env:
-#        NYM_NOTIFICATION_KIND: nym-connect
-#        NYM_PROJECT_NAME: "nym-connect"
-#        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-#        NYM_CI_WWW_LOCATION: "nym-connect-${{ env.GITHUB_REF_SLUG }}"
-#        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-#        GIT_BRANCH: "${GITHUB_REF##*/}"
-#        KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-#        KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-#        KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-#        KEYBASE_NYM_CHANNEL: "ci-nym-connect"
-#        IS_SUCCESS: "${{ job.status == 'success' }}"
-#      uses: docker://keybaseio/client:stable-node
-#      with:
-#        args: .github/workflows/support-files/notifications/entry_point.sh
+    - name: Matrix - Send Notification
+      env:
+        NYM_NOTIFICATION_KIND: nym-connect
+        NYM_PROJECT_NAME: "nym-connect"
+        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
+        NYM_CI_WWW_LOCATION: "nym-connect-${{ env.GITHUB_REF_SLUG }}"
+        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+        GIT_BRANCH: "${GITHUB_REF##*/}"
+        IS_SUCCESS: "${{ job.status == 'success' }}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+      uses: docker://keybaseio/client:stable-node
+      with:
+        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -0,0 +1,75 @@
+name: Nym Connect - desktop (Rust)
+
+on:
+  push:
+    paths:
+      - "nym-connect/desktop/src-tauri/**"
+      - "nym-connect/desktop/src-tauri/Cargo.toml"
+      - "clients/client-core/**"
+      - "clients/socks5/**"
+      - "common/**"
+      - "gateway/gateway-requests/**"
+      - "contracts/vesting/**"
+      - "nym-api/nym-api-requests/**"
+  pull_request:
+    paths:
+      - "nym-connect/desktop/src-tauri/**"
+      - "nym-connect/desktop/src-tauri/Cargo.toml"
+      - "clients/client-core/**"
+      - "clients/socks5/**"
+      - "common/**"
+      - "gateway/gateway-requests/**"
+      - "contracts/vesting/**"
+      - "nym-api/nym-api-requests/**"
+
+jobs:
+  build:
+    runs-on: [self-hosted, custom-linux]
+    env:
+      RUSTC_WRAPPER: /home/ubuntu/.cargo/bin/sccache
+    steps:
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libayatana-appindicator3-dev
+        continue-on-error: true
+
+      - name: Check out repository code
+        uses: actions/checkout@v2
+
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+          components: rustfmt, clippy
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --manifest-path nym-connect/desktop/Cargo.toml --workspace
+
+      - name: Run all tests
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --manifest-path nym-connect/desktop/Cargo.toml --workspace
+
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --manifest-path nym-connect/desktop/Cargo.toml --all -- --check
+
+      - uses: actions-rs/clippy-check@v1
+        name: Clippy checks
+        continue-on-error: true
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          args: --manifest-path nym-connect/desktop/Cargo.toml --workspace --all-features
+
+      - name: Run clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --manifest-path nym-connect/desktop/Cargo.toml --workspace --all-features -- -D warnings
@@ -0,0 +1,72 @@
+name: Nym Connect - mobile (Rust)
+
+on:
+  push:
+    paths:
+      - "nym-connect/mobile/src-tauri/**"
+      - "nym-connect/mobile/src-tauri/Cargo.toml"
+      - "!nym-connect/mobile/src-tauri/gen/**"
+      - "clients/client-core/**"
+      - "clients/socks5/**"
+      - "common/**"
+      - "gateway/gateway-requests/**"
+      - "contracts/vesting/**"
+      - "nym-api/nym-api-requests/**"
+  pull_request:
+    paths:
+      - "nym-connect/mobile/src-tauri/**"
+      - "nym-connect/mobile/src-tauri/Cargo.toml"
+      - "!nym-connect/mobile/src-tauri/gen/**"
+      - "clients/client-core/**"
+      - "clients/socks5/**"
+      - "common/**"
+      - "gateway/gateway-requests/**"
+      - "contracts/vesting/**"
+      - "nym-api/nym-api-requests/**"
+
+jobs:
+  build:
+    #runs-on: [self-hosted, custom-linux]
+    runs-on: ubuntu-22.04
+    #env:
+      #RUSTC_WRAPPER: /home/ubuntu/.cargo/bin/sccache
+    #defaults:
+      #run:
+        #working-directory: nym-connect/mobile/src-tauri/
+    steps:
+      - name: Install Dependencies (Linux)
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install \
+          libwebkit2gtk-4.1-dev \
+          build-essential \
+          curl \
+          wget \
+          libssl-dev \
+          libgtk-3-dev \
+          squashfs-tools \
+          libayatana-appindicator3-dev \
+          librsvg2-dev \
+          libsoup-3.0-dev \
+          libjavascriptcoregtk-4.1-dev
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          components: clippy, rustfmt
+
+      - name: Check formatting
+        run: cargo fmt --manifest-path nym-connect/mobile/src-tauri/Cargo.toml -- --check
+
+      - name: Build all binaries
+        run: cargo build --manifest-path nym-connect/mobile/src-tauri/Cargo.toml
+
+      - name: Run all tests
+        run: cargo test  --manifest-path nym-connect/mobile/src-tauri/Cargo.toml
+
+      - name: Clippy
+        run: cargo clippy --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-targets -- -D warnings
@@ -1,56 +0,0 @@
-name: Nym Connect (rust)
-
-on:
-  push:
-    paths-ignore:
-      - 'explorer/**'
-
-jobs:
-  build:
-    runs-on: [ self-hosted, custom-linux ]
-    env:
-      RUSTC_WRAPPER: /home/ubuntu/.cargo/bin/sccache
-    steps:
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libayatana-appindicator3-dev
-
-      - name: Check out repository code
-        uses: actions/checkout@v2
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
-
-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path nym-connect/Cargo.toml --workspace
-
-      - name: Run all tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path nym-connect/Cargo.toml --workspace
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path nym-connect/Cargo.toml --all -- --check
-
-      - uses: actions-rs/clippy-check@v1
-        name: Clippy checks
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --manifest-path nym-connect/Cargo.toml --workspace --all-features
-
-      - name: Run clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --manifest-path nym-connect/Cargo.toml --workspace --all-features -- -D warnings
@@ -1,17 +1,16 @@
 name: Build release of Nym smart contracts
 on:
  workflow_dispatch:
-
-defaults:
-  run:
-    working-directory: contracts
+  release:
+    types: [created]

 jobs:
  build:
-    runs-on: ubuntu-latest
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-contracts-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
+    runs-on: [self-hosted, custom-runner-linux]
    steps:
      - uses: actions/checkout@v2
-
+      
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -20,8 +19,11 @@ jobs:
          override: true
          components: rustfmt, clippy

+      - name: Install wasm-opt
+        run: cargo install wasm-opt
+
      - name: Build release contracts
-        run: RUSTFLAGS='-C link-arg=-s' cargo build --release --target wasm32-unknown-unknown
+        run: make wasm

      - name: Upload Mixnet Contract Artifact
        uses: actions/upload-artifact@v3
@@ -36,3 +38,11 @@ jobs:
          name: vesting_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
          retention-days: 5
+
+      - name: Upload to release based on tag name
+        uses: softprops/action-gh-release@v1
+        if: github.event_name == 'release'
+        with:
+          files: |
+            contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
+            contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
@@ -2,15 +2,17 @@ name: Contracts

 on:
  push:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'contracts/**'
+      - 'common/**'
  pull_request:
    paths-ignore:
-      - 'explorer/**'
+      - 'contracts/**'
+      - 'common/**'

 jobs:
  matrix_prep:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
@@ -24,7 +26,7 @@ jobs:
  contracts:
    # since it's going to be compiled into wasm, there's absolutely
    # no point in running CI on different OS-es
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    continue-on-error: ${{ matrix.rust == 'nightly' }}
    needs: matrix_prep
    strategy:
@@ -17,6 +17,7 @@ jobs:
    - uses: actions/checkout@v2
    - name: Install rsync
      run: sudo apt-get install rsync
+      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
    - uses: actions/setup-node@v3
      with:
@@ -56,10 +57,10 @@ jobs:
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ne-sb-${{ env.GITHUB_REF_SLUG }}
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Keybase - Node Install
+    - name: Matrix - Node Install
      run: npm install
      working-directory: .github/workflows/support-files
-    - name: Keybase - Send Notification
+    - name: Matrix - Send Notification
      env:
        NYM_NOTIFICATION_KIND: network-explorer
        NYM_PROJECT_NAME: "Network Explorer"
@@ -68,11 +69,12 @@ jobs:
        NYM_CI_WWW_LOCATION_STORYBOOK: "ne-sb-${{ env.GITHUB_REF_SLUG }}"
        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
        GIT_BRANCH: "${GITHUB_REF##*/}"
-        KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-        KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-        KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-        KEYBASE_NYM_CHANNEL: "ci-network-explorer"
        IS_SUCCESS: "${{ job.status == 'success' }}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
      uses: docker://keybaseio/client:stable-node
      with:
        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -5,12 +5,12 @@ on:
    - cron: '14 1 * * *'
 jobs:
  matrix_prep:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      # creates the matrix strategy from nightly_build_matrix_includes.json
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - id: set-matrix
        uses: JoshuaTheMiller/conditional-build-matrix@main
        with:
@@ -24,11 +24,12 @@ jobs:
    continue-on-error: ${{ matrix.rust == 'nightly' || matrix.rust == 'beta' || matrix.rust == 'stable' }}
    steps:
      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
-        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+        if: matrix.os == 'ubuntu-20.04'

      - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
@@ -38,21 +39,45 @@ jobs:
          override: true
          components: rustfmt, clippy

+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --workspace

+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      - name: Build all examples
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
      - name: Run all tests
        uses: actions-rs/cargo@v1
        with:
          command: test
          args: --workspace

-      - name: Reclaim some disk space (because Windows is being annoying)
+      - name: Reclaim some disk space
        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' }}
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
        with:
          command: clean

@@ -61,25 +86,20 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: test
-          args: --workspace --all-features -- --ignored
+          args: --workspace -- --ignored

-      - name: Check formatting
+      - name: Reclaim some disk space
        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
-
-      - name: Reclaim some disk space (because Windows is being annoying)
-        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' }}
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
        with:
          command: clean

      - uses: actions-rs/clippy-check@v1
        name: Clippy checks
+        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features
+          args: --workspace

      - name: Run clippy
        uses: actions-rs/cargo@v1
@@ -90,36 +110,10 @@ jobs:

      - name: Reclaim some disk space
        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-latest' }}
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
        with:
          command: clean

-      # COCONUT stuff
-      - name: Build all binaries with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --features=coconut
-
-      - name: Run all tests with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features=coconut
-
-      - name: Reclaim some disk space (because Windows is being annoying)
-        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' }}
-        with:
-          command: clean
-
-      - name: Run clippy with coconut enabled
-        uses: actions-rs/cargo@v1
-        if: ${{ matrix.rust != 'nightly' }}
-        with:
-          command: clippy
-          args: --workspace --all-targets --features=coconut -- -D warnings
-
      # nym-wallet (the rust part)
      - name: Build nym-wallet rust code
        uses: actions-rs/cargo@v1
@@ -148,17 +142,22 @@ jobs:

  notification:
    needs: build
-    runs-on: ubuntu-latest
+    runs-on: custom-runner-linux
    steps:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v2
      - name: Check out repository code
-        uses: actions/checkout@v2
-      - name: Keybase - Node Install
+        uses: actions/checkout@v3
+      - name: install npm
+        uses: actions/setup-node@v3
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 16
+      - name: Matrix - Node Install
        if: env.WORKFLOW_CONCLUSION == 'failure'
        run: npm install
        working-directory: .github/workflows/support-files
-      - name: Keybase - Send Notification
+      - name: Matrix - Send Notification
        if: env.WORKFLOW_CONCLUSION == 'failure'
        env:
          NYM_NOTIFICATION_KIND: nightly
@@ -166,11 +165,12 @@ jobs:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
          GIT_BRANCH: "${GITHUB_REF##*/}"
-          KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-          KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-          KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-          KEYBASE_NYM_CHANNEL: "ci-nightly"
          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,6 +1,6 @@
 [
  {
-    "os":"ubuntu-latest",
+    "os":"ubuntu-20.04",
    "rust":"stable",
    "runOnEvent":"schedule"
  },
@@ -17,7 +17,7 @@
  },

  {
-    "os":"ubuntu-latest",
+    "os":"ubuntu-20.04",
    "rust":"beta",
    "runOnEvent":"schedule"
  },
@@ -33,7 +33,7 @@
  },

  {
-    "os":"ubuntu-latest",
+    "os":"ubuntu-20.04",
    "rust":"nightly",
    "runOnEvent":"schedule"
  },
@@ -1,50 +0,0 @@
-[
-  {
-    "os":"ubuntu-latest",
-    "rust":"stable",
-    "runOnEvent":"workflow_dispatch"
-  },
-
-  {
-    "os":"windows-latest",
-    "rust":"stable",
-    "runOnEvent":"workflow_dispatch"
-  },
-  {
-    "os":"macos-latest",
-    "rust":"stable",
-    "runOnEvent":"workflow_dispatch"
-  },
-
-  {
-    "os":"ubuntu-latest",
-    "rust":"beta",
-    "runOnEvent":"workflow_dispatch"
-  },
-  {
-    "os":"windows-latest",
-    "rust":"beta",
-    "runOnEvent":"workflow_dispatch"
-  },
-  {
-    "os":"macos-latest",
-    "rust":"beta",
-    "runOnEvent":"workflow_dispatch"
-  },
-
-  {
-    "os":"ubuntu-latest",
-    "rust":"nightly",
-    "runOnEvent":"workflow_dispatch"
-  },
-  {
-    "os":"windows-latest",
-    "rust":"nightly",
-    "runOnEvent":"workflow_dispatch"
-  },
-  {
-    "os":"macos-latest",
-    "rust":"nightly",
-    "runOnEvent":"workflow_dispatch"
-  }
-]
@@ -0,0 +1,191 @@
+name: Nightly builds on latest release
+
+on:
+  schedule:
+    - cron: '14 2 * * *'
+jobs:
+  matrix_prep:
+    runs-on: ubuntu-20.04
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      # creates the matrix strategy from nightly_build_matrix_includes.json
+      - uses: actions/checkout@v3
+      - id: set-matrix
+        uses: JoshuaTheMiller/conditional-build-matrix@main
+        with:
+          inputFile: '.github/workflows/nightly_build_matrix_includes.json'
+          filter: '[?runOnEvent==`${{ github.event_name }}` || runOnEvent==`always`]'
+  get_release:
+    runs-on: ubuntu-20.04
+    needs: matrix_prep
+    outputs:
+      output1: ${{ steps.step2.outputs.latest_release }}
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: Fetch all branches
+        run: git fetch --all
+      - name: Set output variable to latest release branch
+        id: step2
+        run: echo "latest_release=$(git branch -r | grep -E 'release/v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1 | sed 's/  origin\///')" >> $GITHUB_OUTPUT
+  build:
+    needs: [get_release,matrix_prep]
+    strategy:
+      matrix: ${{fromJson(needs.matrix_prep.outputs.matrix)}}
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.rust == 'nightly' || matrix.rust == 'beta' || matrix.rust == 'stable' }}
+    steps:
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+        if: matrix.os == 'ubuntu-20.04'
+
+      - name: Check out latest release branch
+        uses: actions/checkout@v3
+        with:
+          ref: ${{needs.get_release.outputs.output1}}
+
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: ${{ matrix.rust }}
+          override: true
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      - name: Build all examples
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      - name: Run all tests
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      - name: Run expensive tests
+        if: github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master'
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace -- --ignored
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      - uses: actions-rs/clippy-check@v1
+        name: Clippy checks
+        continue-on-error: true
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          args: --workspace
+
+      - name: Run clippy
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.rust != 'nightly' }}
+        with:
+          command: clippy
+          args: --workspace --all-targets -- -D warnings
+
+      - name: Reclaim some disk space
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
+        with:
+          command: clean
+
+      # nym-wallet (the rust part)
+      - name: Build nym-wallet rust code
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --manifest-path nym-wallet/Cargo.toml --workspace
+
+      - name: Run nym-wallet tests
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --manifest-path nym-wallet/Cargo.toml --workspace
+
+      - name: Check nym-wallet formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --manifest-path nym-wallet/Cargo.toml --all -- --check
+
+      - name: Run clippy for nym-wallet
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.rust != 'nightly' }}
+        with:
+          command: clippy
+          args: --manifest-path nym-wallet/Cargo.toml --workspace --all-targets -- -D warnings
+
+  notification:
+    needs: [build,get_release]
+    runs-on: custom-runner-linux
+    steps:
+      - name: Collect jobs status
+        uses: technote-space/workflow-conclusion-action@v2
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: install npm
+        uses: actions/setup-node@v3
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 16
+      - name: Matrix - Node Install
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        run: npm install
+        working-directory: .github/workflows/support-files
+      - name: Matrix - Send Notification
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        env:
+          NYM_NOTIFICATION_KIND: nightly
+          NYM_PROJECT_NAME: "Nym nightly build on latest release"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+          GIT_BRANCH_NAME: "${{needs.get_release.outputs.output1}}"
+          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,32 +1,50 @@
-name: Nightly builds on dispatch
+name: Nightly builds on second latest release

-on: workflow_dispatch
+on:
+  schedule:
+    - cron: '24 2 * * *'
 jobs:
  matrix_prep:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      # creates the matrix strategy from nightly_build_matrix_includes.json
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
      - id: set-matrix
        uses: JoshuaTheMiller/conditional-build-matrix@main
        with:
-          inputFile: '.github/workflows/nightly_build_matrix_on_dispatch.json'
+          inputFile: '.github/workflows/nightly_build_matrix_includes.json'
          filter: '[?runOnEvent==`${{ github.event_name }}` || runOnEvent==`always`]'
-  build:
+  get_release:
+    runs-on: ubuntu-20.04
    needs: matrix_prep
+    outputs:
+      output1: ${{ steps.step2.outputs.latest_release }}
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: Fetch all branches
+        run: git fetch --all
+      - name: Set output variable to latest release branch
+        id: step2
+        run: echo "latest_release=$(git branch -r | grep -E 'release/v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 2 | head -n 1 | sed 's/  origin\///')" >> $GITHUB_OUTPUT
+  build:
+    needs: [get_release,matrix_prep]
    strategy:
      matrix: ${{fromJson(needs.matrix_prep.outputs.matrix)}}
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.rust == 'nightly' || matrix.rust == 'beta' || matrix.rust == 'stable' }}
    steps:
      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
-        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+        if: matrix.os == 'ubuntu-20.04'

-      - name: Check out repository code
-        uses: actions/checkout@v2
+      - name: Check out latest release branch
+        uses: actions/checkout@v3
+        with:
+          ref: ${{needs.get_release.outputs.output1}}

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
@@ -36,12 +54,36 @@ jobs:
          override: true
          components: rustfmt, clippy

+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --workspace

+      - name: Reclaim some disk space (because Windows is being annoying)
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' }}
+        with:
+          command: clean
+
+      - name: Build all examples
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Reclaim some disk space (because Windows is being annoying)
+        uses: actions-rs/cargo@v1
+        if: ${{ matrix.os == 'windows-latest' }}
+        with:
+          command: clean
+
      - name: Run all tests
        uses: actions-rs/cargo@v1
        with:
@@ -50,7 +92,7 @@ jobs:

      - name: Reclaim some disk space (because Windows is being annoying)
        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' }}
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
        with:
          command: clean

@@ -59,13 +101,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: test
-          args: --workspace --all-features -- --ignored
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
+          args: --workspace -- --ignored

      - name: Reclaim some disk space (because Windows is being annoying)
        uses: actions-rs/cargo@v1
@@ -75,9 +111,10 @@ jobs:

      - uses: actions-rs/clippy-check@v1
        name: Clippy checks
+        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features
+          args: --workspace

      - name: Run clippy
        uses: actions-rs/cargo@v1
@@ -88,36 +125,10 @@ jobs:

      - name: Reclaim some disk space
        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-latest' }}
+        if: ${{ matrix.os == 'windows-latest' || matrix.os == 'ubuntu-20.04' }}
        with:
          command: clean

-      # COCONUT stuff
-      - name: Build all binaries with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --features=coconut
-
-      - name: Run all tests with coconut enabled
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features=coconut
-
-      - name: Reclaim some disk space (because Windows is being annoying)
-        uses: actions-rs/cargo@v1
-        if: ${{ matrix.os == 'windows-latest' }}
-        with:
-          command: clean
-
-      - name: Run clippy with coconut enabled
-        uses: actions-rs/cargo@v1
-        if: ${{ matrix.rust != 'nightly' }}
-        with:
-          command: clippy
-          args: --workspace --all-targets --features=coconut -- -D warnings
-
      # nym-wallet (the rust part)
      - name: Build nym-wallet rust code
        uses: actions-rs/cargo@v1
@@ -145,30 +156,36 @@ jobs:
          args: --manifest-path nym-wallet/Cargo.toml --workspace --all-targets -- -D warnings

  notification:
-    needs: build
-    runs-on: ubuntu-latest
+    needs: [build,get_release]
+    runs-on: custom-runner-linux
    steps:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v2
      - name: Check out repository code
-        uses: actions/checkout@v2
-      - name: Keybase - Node Install
+        uses: actions/checkout@v3
+      - name: install npm
+        uses: actions/setup-node@v3
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 16
+      - name: Matrix - Node Install
        if: env.WORKFLOW_CONCLUSION == 'failure'
        run: npm install
        working-directory: .github/workflows/support-files
-      - name: Keybase - Send Notification
+      - name: Matrix - Send Notification
        if: env.WORKFLOW_CONCLUSION == 'failure'
        env:
          NYM_NOTIFICATION_KIND: nightly
-          NYM_PROJECT_NAME: "Nym nightly build"
+          NYM_PROJECT_NAME: "Nym nightly build on latest release"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-          KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-          KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMTECH_TEAM }}"
-          KEYBASE_NYM_CHANNEL: "test"
+          GIT_BRANCH_NAME: "${{needs.get_release.outputs.output1}}"
          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,50 +0,0 @@
-name: Publish Nym CLI binaries
-
-on:
-  workflow_dispatch:
-  release:
-    types: [created]
-    
-env:
-  NETWORK: mainnet
-
-jobs:
-  publish-nym-cli:
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [ubuntu-latest, windows-latest, macos-latest]
-
-    runs-on: ${{ matrix.platform }}
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Check the release tag starts with `nym-cli-`
-        if: startsWith(github.ref, 'refs/tags/nym-cli-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-cli-...')
-
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-
-      - name: Build binary
-        run: make build-nym-cli
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: nym-cli-${{ matrix.platform }}
-          path: |
-            target/release/nym-cli*
-          retention-days: 30
-
-      - name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
-        if: github.event_name == 'release'
-        with:
-          files: |
-            target/release/nym-cli
@@ -1,4 +1,4 @@
-name: Publish Nym Connect (MacOS)
+name: Publish Nym Connect - desktop (MacOS)
 on:
  workflow_dispatch:
  release:
@@ -6,10 +6,11 @@ on:

 defaults:
  run:
-    working-directory: nym-connect
+    working-directory: nym-connect/desktop

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-connect-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
@@ -19,13 +20,6 @@ jobs:
    steps:
      - uses: actions/checkout@v2

-      - name: Check the release tag starts with `nym-connect-`
-        if: startsWith(github.ref, 'refs/tags/nym-connect-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-connect-...')
-
      - name: Node v16
        uses: actions/setup-node@v3
        with:
@@ -79,7 +73,7 @@ jobs:
        uses: actions/upload-artifact@v3
        with:
          name: nym-connect_1.0.0_x64.dmg
-          path: nym-connect/target/release/bundle/dmg/nym-connect_1.0.0_x64.dmg
+          path: nym-connect/desktop/target/release/bundle/dmg/nym-connect_1.0.0_x64.dmg
          retention-days: 30

      - name: Clean up keychain
@@ -92,5 +86,5 @@ jobs:
        if: github.event_name == 'release'
        with:
          files: |
-            nym-connect/target/release/bundle/dmg/*.dmg
-            nym-connect/target/release/bundle/macos/*.app.tar.gz*
+            nym-connect/desktop/target/release/bundle/dmg/*.dmg
+            nym-connect/desktop/target/release/bundle/macos/*.app.tar.gz*
@@ -1,4 +1,4 @@
-name: Publish Nym Connect (Ubuntu)
+name: Publish Nym Connect - desktop (Ubuntu)
 on:
  workflow_dispatch:
  release:
@@ -6,14 +6,15 @@ on:

 defaults:
  run:
-    working-directory: nym-connect
+    working-directory: nym-connect/desktop

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-connect-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-latest]
+        platform: [custom-runner-linux]

    runs-on: ${{ matrix.platform }}
    steps:
@@ -23,17 +24,13 @@ jobs:
        run: >
          sudo apt-get update &&
          sudo apt-get install -y webkit2gtk-4.0 libayatana-appindicator3-dev
-      - name: Check the release tag starts with `nym-connect-`
-        if: startsWith(github.ref, 'refs/tags/nym-connect-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-connect-...')
+        continue-on-error: true

      - name: Node v16
        uses: actions/setup-node@v3
        with:
          node-version: 16
+
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -56,7 +53,7 @@ jobs:
        uses: actions/upload-artifact@v3
        with:
          name: nym-connect.AppImage.tar.gz
-          path: nym-connect/target/release/bundle/appimage/nym-connect_1.0.0_amd64.AppImage
+          path: nym-connect/desktop/target/release/bundle/appimage/nym-connect_1.0.0_amd64.AppImage
          retention-days: 30

      - name: Upload to release based on tag name
@@ -64,5 +61,5 @@ jobs:
        if: github.event_name == 'release'
        with:
          files: |
-            nym-connect/target/release/bundle/appimage/*.AppImage
-            nym-connect/target/release/bundle/appimage/*.AppImage.tar.gz*
+            nym-connect/desktop/target/release/bundle/appimage/*.AppImage
+            nym-connect/desktop/target/release/bundle/appimage/*.AppImage.tar.gz*
@@ -1,4 +1,4 @@
-name: Publish Nym Connect (Windows 10)
+name: Publish Nym Connect - desktop (Windows 10)
 on:
  workflow_dispatch:
  release:
@@ -6,10 +6,11 @@ on:

 defaults:
  run:
-    working-directory: nym-connect
+    working-directory: nym-connect/desktop

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-connect-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
@@ -27,13 +28,6 @@ jobs:

      - uses: actions/checkout@v3

-      - name: Check the release tag starts with `nym-connect-`
-        if: startsWith(github.ref, 'refs/tags/nym-connect-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-connect-...')
-
      - name: Import signing certificate
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
@@ -62,7 +56,7 @@ jobs:
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

      - name: Install app dependencies
-        run: yarn
+        run: yarn --network-timeout 100000

      - name: Build and sign it
        env:
@@ -78,7 +72,7 @@ jobs:
        uses: actions/upload-artifact@v3
        with:
          name: nym-connect_1.0.0_x64_en-US.msi
-          path: nym-connect/target/release/bundle/msi/nym-connect_1.0.0_x64_en-US.msi
+          path: nym-connect/desktop/target/release/bundle/msi/nym-connect_1.0.0_x64_en-US.msi
          retention-days: 30

      - name: Upload to release based on tag name
@@ -86,5 +80,5 @@ jobs:
        if: github.event_name == 'release'
        with:
          files: |
-            nym-connect/target/release/bundle/msi/*.msi
-            nym-connect/target/release/bundle/msi/*.msi.zip*
+            nym-connect/desktop/target/release/bundle/msi/*.msi
+            nym-connect/desktop/target/release/bundle/msi/*.msi.zip*
@@ -2,6 +2,12 @@ name: Publish Nym binaries

 on:
  workflow_dispatch:
+    inputs:  
+      add_tokio_unstable:
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
+        default: false
+        type: boolean 
  release:
    types: [created]
    
@@ -10,21 +16,24 @@ env:

 jobs:
  publish-nym:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-latest]
+        platform: [custom-runner-linux]

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v3

-      - name: Check the release tag starts with `nym-binaries-`
-        if: startsWith(github.ref, 'refs/tags/nym-binaries-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-binaries-...')
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+            
+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        run: |
+          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
@@ -42,11 +51,12 @@ jobs:
        with:
          name: my-artifact
          path: |
+            target/release/explorer-api
            target/release/nym-client
            target/release/nym-gateway
            target/release/nym-mixnode
            target/release/nym-socks5-client
-            target/release/nym-validator-api
+            target/release/nym-api
            target/release/nym-network-requester
            target/release/nym-network-statistics
            target/release/nym-cli
@@ -57,11 +67,12 @@ jobs:
        if: github.event_name == 'release'
        with:
          files: |
+            target/release/explorer-api
            target/release/nym-client
            target/release/nym-gateway
            target/release/nym-mixnode
            target/release/nym-socks5-client
-            target/release/nym-validator-api
+            target/release/nym-api
            target/release/nym-network-requester
            target/release/nym-network-statistics
            target/release/nym-cli
@@ -10,6 +10,7 @@ defaults:

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
@@ -19,13 +20,6 @@ jobs:
    steps:
      - uses: actions/checkout@v2

-      - name: Check the release tag starts with `nym-wallet-`
-        if: startsWith(github.ref, 'refs/tags/nym-wallet-') == false && github.event_name != 'workflow_dispatch'
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-wallet-...')
-
      - name: Node v16
        uses: actions/setup-node@v3
        with:
@@ -9,10 +9,11 @@ defaults:

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-latest]
+        platform: [custom-runner-linux]

    runs-on: ${{ matrix.platform }}
    steps:
@@ -22,17 +23,13 @@ jobs:
        run: >
          sudo apt-get update &&
          sudo apt-get install -y webkit2gtk-4.0
-      - name: Check the release tag starts with `nym-wallet-`
-        if: startsWith(github.ref, 'refs/tags/nym-wallet-') == false
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-wallet-...')
+        continue-on-error: true

      - name: Node v16
        uses: actions/setup-node@v3
        with:
          node-version: 16
+
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -1,5 +1,6 @@
 name: Publish Nym Wallet (Windows 10)
 on:
+  workflow_dispatch:
  release:
    types: [created]

@@ -9,6 +10,7 @@ defaults:

 jobs:
  publish-tauri:
+    if: ${{ (startsWith(github.ref, 'refs/tags/nym-wallet-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    strategy:
      fail-fast: false
      matrix:
@@ -26,13 +28,6 @@ jobs:

      - uses: actions/checkout@v3

-      - name: Check the release tag starts with `nym-wallet-`
-        if: startsWith(github.ref, 'refs/tags/nym-wallet-') == false
-        uses: actions/github-script@v3
-        with:
-          script: |
-            core.setFailed('Release tag did not start with nym-wallet-...')
-
      - name: Import signing certificate
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
@@ -61,7 +56,7 @@ jobs:
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

      - name: Install app dependencies
-        run: yarn
+        run: yarn --network-timeout 100000

      - name: Build and sign it
        env:
@@ -73,8 +68,16 @@ jobs:
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
        run: yarn build

+      - name: Upload Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: nym-wallet_1.0.0_x64_en-US.msi
+          path: nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi
+          retention-days: 30
+
      - name: Upload to release based on tag name
        uses: softprops/action-gh-release@v1
+        if: github.event_name == 'release'
        with:
          files: |
            nym-wallet/target/release/bundle/msi/*.msi
@@ -12,7 +12,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-latest]
+        platform: [ubuntu-20.04]
    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v2
@@ -12,6 +12,7 @@ jobs:
    - uses: actions/checkout@v2
    - name: Install rsync
      run: sudo apt-get install rsync
+      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
    - uses: actions/setup-node@v3
      with:
@@ -34,10 +35,10 @@ jobs:
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Keybase - Node Install
+    - name: Matrix - Node Install
      run: npm install
      working-directory: .github/workflows/support-files
-    - name: Keybase - Send Notification
+    - name: Matrix - Send Notification
      env:
        NYM_NOTIFICATION_KIND: nym-wallet
        NYM_PROJECT_NAME: "nym-wallet"
@@ -45,11 +46,12 @@ jobs:
        NYM_CI_WWW_LOCATION: "wallet-${{ env.GITHUB_REF_SLUG }}"
        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
        GIT_BRANCH: "${GITHUB_REF##*/}"
-        KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-        KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-        KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-        KEYBASE_NYM_CHANNEL: "ci-nym-wallet"
        IS_SUCCESS: "${{ job.status == 'success' }}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
      uses: docker://keybaseio/client:stable-node
      with:
        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -12,7 +12,7 @@ defaults:
 jobs:
  test:
    name: wallet tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2

@@ -26,6 +26,7 @@ jobs:
          libappindicator3-dev
          webkit2gtk-driver
          xvfb
+        continue-on-error: true

      - name: Install minimal stable
        uses: actions-rs/toolchain@v1
@@ -0,0 +1,36 @@
+name: CI for Nym API Tests
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - "nym-api/**"
+
+defaults:
+  run:
+    working-directory: nym-api/tests
+
+jobs:
+  test:
+    name: nym-api tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      
+      - name: Install npm
+        run: npm install
+        
+      - name: Node v18
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.1.0
+
+      - name: Install yarn
+        run: yarn install
+
+      - name: Run yarn
+        run: yarn
+
+      - name: Run tests
+        run: yarn test:qa
+        working-directory: nym-api/tests
@@ -1,6 +1,9 @@
-KEYBASE_NYM_CHANNEL=
-KEYBASE_NYMBOT_USERNAME=
-KEYBASE_NYMBOT_PAPERKEY=
+MATRIX_SERVER=
+MATRIX_ROOM=
+MATRIX_ROOM_OF_SHAME=
+MATRIX_USER_ID=
+MATRIX_TOKEN=
+MATRIX_DEVICE_ID=

 NYM_NOTIFICATION_KIND=nightly
 NYM_PROJECT_NAME=Nightly Build
@@ -32,4 +35,4 @@ NYM_CI_WWW_BASE=example.com
 # Nightly builds
 WORKFLOW_CONCLUSION=success

-SHOW_DEBUG=true
+SHOW_DEBUG=true
@@ -2,4 +2,6 @@ node_modules
 .idea

 # don't commit the lock file to avoid cross-platform issues
-package-lock.json
+package-lock.json
+
+scratch
@@ -4,7 +4,7 @@ This is a collection of scripts and files to support GitHub Actions.

 ## Sending Notifications

-These scripts send CI notifications to Keybase by creating messages from templates and env vars passed from GitHub Actions.
+These scripts send CI notifications to Matrix by creating messages from templates and env vars passed from GitHub Actions.

 ### Adding notifications to a GitHub Action

@@ -19,10 +19,11 @@ jobs:
      env:
        NYM_NOTIFICATION_KIND: "my-component"
        GIT_BRANCH: "${GITHUB_REF##*/}"
-        KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
-        KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
-        KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
-        KEYBASE_NYM_CHANNEL: "ci-network-explorer"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        IS_SUCCESS: "${{ job.status == 'success' }}"
      uses: docker://keybaseio/client:stable-node
      with:
@@ -34,8 +35,8 @@ Notifications are run by adding the snippet above to a GitHub Action, and:
 1. Installing node packages needed at run time
 2. Set the env vars as required:
    - `NYM_NOTIFICATION_KIND` matches the directory in `.github/workflows/support-files/${NYM_NOTIFICATION_KIND}` to provide the templates and extra scripting in `index.js`
-    - Keybase credentials, channel and other env vars for the status of the build and repo
-3. Replacing the default entry point shell script on the `keybaseio/client:stable-node` docker image to run `.github/workflows/support-files/notifications/entry_point.sh` 
+    - Matrix credentials, room and other env vars for the status of the build and repo
+3. Replacing the default entry point shell script on the `keybaseio/client:stable-node` docker image to run `.github/workflows/support-files/notifications/entry_point.sh`

 ### Running locally

@@ -43,7 +44,7 @@ You will need:
 - Node 16 LTS
 - npm

-Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Keybase credentials.
+Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Matrix credentials.

 Then run `npm install` to get dependencies.

@@ -55,4 +56,4 @@ npm install
 cp .env.example .env
 vi .env
 npm run dev
-```
+```
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+#
+# Basic usage:
+#   ./git-merge-check origin/develop origin/release/v1.1.9
+#
+
+set -x
+
+set -o nounset
+set -o pipefail
+
+# Start from branch ...
+branch1=$1
+
+# ... and try to merge in
+branch2=$2
+
+echo "Checking if $branch2 merges without conflicts into $branch1..."
+
+git checkout -q $branch1 || exit 1
+
+# There are two options here as far as I see on what we should check for. Either
+#
+#  (A) check for CONFLICT in any file except whitelist (such as .lock files)
+#  (B) check for "Automatic merge failed"
+#
+# Both of these options have drawbacks.
+#
+# The first (A) has the problem in that maybe we don't want to fail if the
+# changes can be automatically merged (duh), but at least we are not pestered
+# about constant lock file changes.
+# The second (B) has the problem that it's difficult to filter out automatic
+# merge fails for files we don't care about (.lock files).
+#
+# The ideal solution would be to check for automatic merge fails for files
+# except those on a whitelist (e.g. lock files).
+
+# For now I choose to use (B) here, because I hope it might be less noisy
+
+# Alternative A
+#output=$(git merge --no-commit --no-ff $branch2 | grep -v .lock)
+#merge_failed=$(echo $output | grep -v "CONFLICT")
+#return_code=$?
+
+# Alternative B
+output=$(git merge --no-commit --no-ff $branch2)
+merge_failed=$(echo $output | grep -v "Automatic merge failed")
+return_code=$?
+
+# Restore
+
+git merge --abort
+git checkout -q -
+
+if [ $return_code -eq 0 ]; then
+    echo "Merge check success"
+else
+    echo "Merge check failed"
+fi
+
+exit $return_code
@@ -1,9 +1,14 @@
 🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > 🔴 **FAILURE** :cry:
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message:
 ```
@@ -1,10 +1,16 @@
 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩
 > :rocket: {{ env.NYM_PROJECT_NAME }}  ➡️➡️➡️➡️➡️ **View output:** https://{{ env.NYM_CI_WWW_LOCATION }}.{{ env.NYM_CI_WWW_BASE }}/
+>
 > `storybook`: https://{{ env.NYM_CI_WWW_LOCATION_STORYBOOK }}.{{ env.NYM_CI_WWW_BASE }}
+>
 > ✅ **SUCCESS**
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message by `{{ env.GITHUB_ACTOR }}` at {{ timestamp }}:
 ```
@@ -85,7 +85,7 @@ async function getMessageBody(context) {
            ...
          ],
          check_run_url: 'https://api.github.com/repos/nymtech/nym/check-runs/5182940024',
-          labels: [ 'ubuntu-latest' ],
+          labels: [ 'ubuntu-20.04' ],
          runner_id: 1,
          runner_name: 'Hosted Agent',
          runner_group_id: 2,
@@ -151,7 +151,7 @@ async function getMessageBody(context) {
      return `${icon} ${job.conclusion}: ${job.name} - ${job.html_url}`;
    })
    // and join with newlines for display in the template
-    .join('\n');
+    .join('\n\n');

  return template({ ...context, jobResults });
 }
@@ -1,9 +1,15 @@
 🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > 🔴 **FAILURE** :cry:
+>
 > `when` {{ timestamp }}
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 {{ jobResults }}
@@ -1,9 +1,15 @@
 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > ✅ **SUCCESS**
+>
 > `when` {{ timestamp }}
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

-{{ jobResults }}
+{{ jobResults }}
@@ -1,9 +1,9 @@
 require('dotenv').config();

-const Bot = require('keybase-bot');
+const { sendMatrixMessage } = require('./send_message_to_matrix');

 let context = {
-  kinds: ['nym-wallet', 'ts-packages', 'network-explorer', 'nightly', 'nym-connect'],
+  kinds: ['nym-wallet', 'ts-packages', 'network-explorer', 'nightly', 'nym-connect','security'],
 };

 /**
@@ -23,20 +23,27 @@ function validateContext() {
      'Please set env var NYM_PROJECT_NAME with the project name for displaying in notification messages',
    );
  }
-  if (!context.env.KEYBASE_NYM_CHANNEL) {
-    throw new Error(
-      'Please set env var KEYBASE_NYM_CHANNEL with the channel name for the notification message',
-    );
-  }
-  if (!context.env.KEYBASE_NYMBOT_USERNAME) {
-    throw new Error(
-      'Username is not defined. Please set env var KEYBASE_NYMBOT_USERNAME',
-    );
-  }
-  if (!context.env.KEYBASE_NYMBOT_PAPERKEY) {
-    throw new Error(
-      'Paperkey is not defined. Please set env var KEYBASE_NYMBOT_PAPERKEY',
-    );
+  if (context.env.MATRIX_ROOM) {
+    if (!context.env.MATRIX_SERVER) {
+      throw new Error(
+        'Matrix server is not defined. Please set env var MATRIX_SERVER',
+      );
+    }
+    if (!context.env.MATRIX_USER_ID) {
+      throw new Error(
+        'Matrix user id is not defined. Please set env var MATRIX_USER_ID',
+      );
+    }
+    if (!context.env.MATRIX_TOKEN) {
+      throw new Error(
+        'Matrix token is not defined. Please set env var MATRIX_TOKEN',
+      );
+    }
+    if (!context.env.MATRIX_DEVICE_ID) {
+      throw new Error(
+        'Matrix device id is not defined. Please set env var MATRIX_DEVICE_ID',
+      );
+    }
  }
 }

@@ -61,12 +68,6 @@ function createTemplateContext() {

  context.kind = context.env.NYM_NOTIFICATION_KIND;

-  context.keybase = {
-    channel: context.env.KEYBASE_NYM_CHANNEL,
-    username: context.env.KEYBASE_NYMBOT_USERNAME,
-    paperkey: context.env.KEYBASE_NYMBOT_PAPERKEY,
-  };
-
  if (!context.env.GIT_BRANCH_NAME) {
    context.env.GIT_BRANCH_NAME = context.env.GITHUB_REF.split('/')
      .slice(2)
@@ -76,40 +77,6 @@ function createTemplateContext() {
  context.status = process.env.IS_SUCCESS === 'true' ? 'success' : 'failure';
 }

-async function sendKeybaseMessage(messageBody) {
-  const bot = new Bot();
-  try {
-    console.log(
-      `Initialising keybase with user "${
-        context.keybase.username
-      }" and key: "${'*'.repeat(context.keybase.paperkey.length)}"...`,
-    );
-    await bot.init(context.keybase.username, context.keybase.paperkey, {
-      verbose: false,
-    });
-
-    const channel = {
-      name: 'nymtech_bot',
-      membersType: 'team',
-      topicName: context.keybase.channel,
-      topic_type: 'CHAT',
-    };
-    const message = {
-      body: messageBody,
-    };
-
-    console.log(`Sending to ${channel.name}#${channel.topicName}...`);
-    await bot.chat.send(channel, message);
-
-    console.log('Message sent!');
-  } catch (error) {
-    console.error(error);
-    process.exitCode = -1;
-  } finally {
-    await bot.deinit();
-  }
-}
-
 /**
 * Uses the `kind` set in the context to process the context and generate a notification message
 * @returns {Promise<string>} A string notification message body
@@ -146,7 +113,13 @@ async function main() {
    console.log(messageBody);
    console.log('-----------------------------------------');
  }
-  await sendKeybaseMessage(messageBody);
+  if(context.env.MATRIX_ROOM) {
+    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM)
+  }
+  if(context.env.MATRIX_ROOM_OF_SHAME && context.env.IS_SUCCESS !== 'true') {
+    // when a job fails
+    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM_OF_SHAME)
+  }
 }

 // call main function and let NodeJS handle the promise
@@ -0,0 +1,67 @@
+const sdk = require('matrix-js-sdk');
+global.Olm = require('olm');
+const { LocalStorage } = require('node-localstorage');
+const localStorage = new LocalStorage('./scratch');
+const {
+  LocalStorageCryptoStore,
+} = require('matrix-js-sdk/lib/crypto/store/localStorage-crypto-store');
+var showdown  = require('showdown');
+
+// hide all matrix client output
+console.error = (error) => console.log('❌ error: ', error);
+process.stderr.write = () => {};
+process.stdout.write = () => {};
+
+
+function createClient(context, room, message) {
+  const server = context.env.MATRIX_SERVER;
+  const token = context.env.MATRIX_TOKEN;
+  const deviceId = context.env.MATRIX_DEVICE_ID;
+  const userId = context.env.MATRIX_USER_ID;
+
+  const client = sdk.createClient({
+    baseUrl: server,
+    accessToken: token,
+    userId,
+    deviceId,
+    sessionStore: new sdk.WebStorageSessionStore(localStorage),
+    cryptoStore: new LocalStorageCryptoStore(localStorage),
+  });
+
+  client.on('sync', async function(state, prevState, res) {
+    if (state !== 'PREPARED') return;
+    client.setGlobalErrorOnUnknownDevices(false);
+    try {
+      await client.joinRoom(room);
+      await client.sendEvent(
+        room,
+        'm.room.message',
+        {
+          msgtype: 'm.text',
+          format: 'org.matrix.custom.html',
+          body: message,
+          formatted_body: message,
+        },
+        '',
+      );
+    } catch (error) {
+      console.error('Job failed: ' + error.message);
+    }
+    client.stopClient();
+    process.exit(0);
+  });
+
+  return client;
+}
+
+async function sendMatrixMessage(contextArg, messageAsMarkdown, roomId) {
+  const converter = new showdown.Converter();
+  const messageAsHtml = converter.makeHtml(messageAsMarkdown);
+  const client = createClient(contextArg, roomId, messageAsHtml);
+  await client.initCrypto();
+  await client.startClient({ initialSyncLimit: 1 });
+}
+
+module.exports = {
+  sendMatrixMessage,
+};
@@ -1,9 +1,14 @@
 🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > 🔴 **FAILURE** :cry:
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message:
 ```
@@ -1,9 +1,14 @@
 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩
 > :rocket: {{ env.NYM_PROJECT_NAME }}  ➡️➡️➡️➡️➡️ **View storybook:** https://{{ env.NYM_CI_WWW_LOCATION }}.{{ env.NYM_CI_WWW_BASE }}/
+>
 > ✅ **SUCCESS**
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message by `{{ env.GITHUB_ACTOR }}` at {{ timestamp }}:
 ```
@@ -1,9 +1,14 @@
 🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > 🔴 **FAILURE** :cry:
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message:
 ```
@@ -1,13 +1,18 @@
 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > ✅ **SUCCESS**
-
+>
 > ➡️➡️➡️➡️➡️ **View output:**
+>
 > `storybook`: https://{{ env.NYM_CI_WWW_LOCATION }}.{{ env.NYM_CI_WWW_BASE }}
-
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message by `{{ env.GITHUB_ACTOR }}` at {{ timestamp }}:
 ```
@@ -1,6 +1,6 @@
 {
-  "name": "send-keybase-message",
-  "description": "Sends a notification message with the keybase package that fails when piped into the keybase CLI",
+  "name": "send-matrix-message",
+  "description": "Sends a notification message with the matrix sdk",
  "version": "1.0.0",
  "private": true,
  "scripts": {
@@ -10,8 +10,16 @@
  "dependencies": {
    "dotenv": "^16.0.0",
    "handlebars": "^4.7.7",
-    "keybase-bot": "^3.6.1",
-    "octokit": "^1.7.1"
+    "matrix-js-sdk": "^9.3.0",
+    "node-localstorage": "^2.1.6",
+    "octokit": "^1.7.1",
+    "olm": "https://packages.matrix.org/npm/olm/olm-3.2.1.tgz",
+    "remark-emoji": "^2.2.0",
+    "remark-html": "^13.0.2",
+    "remark-parse": "^9.0.0",
+    "showdown": "^2.1.0",
+    "to-vfile": "^6.1.0",
+    "unified": "^9.2.2"
  },
  "devDependencies": {
    "prettier": "2.3.2"
@@ -0,0 +1,24 @@
+const Handlebars = require('handlebars');
+const fs = require('fs');
+const path = require('path');
+const { Octokit, App } = require('octokit');
+
+async function addToContextAndValidate(context) {
+  return
+}
+
+async function getMessageBody(context) {
+  try {
+    const source = fs
+    .readFileSync("deny.message").toString();
+    return source;
+} catch (error) {
+    console.error(error);
+}
+
+}
+
+module.exports = {
+  addToContextAndValidate,
+  getMessageBody,
+};
@@ -1,9 +1,14 @@
 🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > 🔴 **FAILURE** :cry:
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message:
 ```
@@ -1,14 +1,20 @@
 🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩
 > :rocket: {{ env.NYM_PROJECT_NAME }}
+>
 > ✅ **SUCCESS**
-
+>
 > ➡️➡️➡️➡️➡️ **View output:**
+>
 > `storybook`: https://{{ env.NYM_CI_WWW_LOCATION }}.{{ env.NYM_CI_WWW_BASE }}
+>
 > `example`: https://{{ env.NYM_CI_WWW_LOCATION }}-example.{{ env.NYM_CI_WWW_BASE }}
-
+>
 > `branch` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/tree/{{ env.GIT_BRANCH_NAME }}
+>
 > `commit` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/commit/{{ env.GITHUB_SHA }}
+>
 > `build ` {{ env.GITHUB_SERVER_URL }}/{{ env.GITHUB_REPOSITORY }}/actions/runs/{{ env.GITHUB_RUN_ID }}
+>

 Commit message by `{{ env.GITHUB_ACTOR }}` at {{ timestamp }}:
 ```
@@ -0,0 +1,46 @@
+name: tag-and-release
+
+on:
+  workflow_dispatch:
+    inputs:  
+      nym_binaries_version:
+        description: 'Version of the nym-binaries tag'
+        required: false
+        type: string 
+      nym_wallet_version:
+        description: 'Version of the nym-wallet tag'
+        required: false
+        type: string 
+      nym_connect_version:
+        description: 'Version of the nym-connect tag'
+        required: false
+        type: string 
+
+jobs:
+  tag-components:
+    uses: nymtech/reusable-workflows/.github/workflows/tag-components.yml@master
+    with:
+      nym_binaries_version: ${{ input.nym_binaries_version }}
+      nym_wallet_version: ${{ input.nym_wallet_version }}
+      nym_connect_version: ${{ input.nym_connect_version }}
+
+  create-nym-binaries-release:
+    if: ${{ input.nym_binaries_version }}
+    uses: nymtech/reusable-workflows/.github/workflows/create-binaries-release.yml@master
+    with:
+      version: ${{ input.nym_binaries_version }}
+    needs: ["tag-components"]
+
+  create-nym-wallet-release:
+    if: ${{ input.nym_wallet_version }}
+    uses: nymtech/reusable-workflows/.github/workflows/create-wallet-release.yml@master
+    with:
+      version: ${{ input.nym_wallet_version }}
+    needs: ["tag-components"]
+
+  create-nym-connect-release:
+    if: ${{ input.nym_connect_version }}
+    uses: nymtech/reusable-workflows/.github/workflows/create-connect-release.yml@master
+    with:
+      version: ${{ input.nym_connect_version }}
+    needs: ["tag-components"]
@@ -0,0 +1,64 @@
+name: CI for linting Typescript
+
+on:
+  push:
+    paths:
+      - 'ts-packages/**'
+      - 'sdk/typescript/**'
+      - 'nym-connect/desktop/src/**'
+      - 'nym-connect/desktop/package.json'
+      - 'nym-connect/mobile/src/**'
+      - 'nym-connect/mobile/package.json'
+      - 'nym-wallet/src/**'
+      - 'nym-wallet/package.json'
+  pull_request:
+    paths:
+      - 'ts-packages/**'
+      - 'sdk/typescript/**'
+      - 'nym-connect/desktop/src/**'
+      - 'nym-connect/desktop/package.json'
+      - 'nym-connect/mobile/src/**'
+      - 'nym-connect/mobile/package.json'
+      - 'nym-wallet/src/**'
+      - 'nym-wallet/package.json'
+
+jobs:
+  build:
+    runs-on: custom-runner-linux
+    steps:
+    - uses: actions/checkout@v2
+    - name: Install rsync
+      run: sudo apt-get install rsync
+      continue-on-error: true
+    - uses: rlespinasse/github-slug-action@v3.x
+    - uses: actions/setup-node@v3
+      with:
+        node-version: 16
+    - name: Setup yarn
+      run: npm install -g yarn
+    - name: Install
+      run: yarn
+    - name: Build packages
+      run: yarn build
+    - name: Lint
+      run: yarn lint && yarn tsc
+    - name: Matrix - Node Install
+      run: npm install
+      working-directory: .github/workflows/support-files
+    - name: Matrix - Send Notification
+      env:
+        NYM_NOTIFICATION_KIND: ts-packages
+        NYM_PROJECT_NAME: "ts-packages"
+        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
+        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
+        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+        GIT_BRANCH: "${GITHUB_REF##*/}"
+        IS_SUCCESS: "${{ job.status == 'success' }}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+      uses: docker://keybaseio/client:stable-node
+      with:
+        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -0,0 +1,95 @@
+name: update-versions-and-changelog
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: "Release version, usually the milestone title"
+        required: true
+        type: string
+      milestone_id:
+        description: "Milestone ID, check the URL when you're on the specific milestone page"
+        required: true
+        type: string
+
+env:
+  CI_BOT_AUTHOR: "Nym bot"
+  CI_BOT_EMAIL: "nym-bot@users.noreply.github.com"
+
+jobs:
+  update-versions:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: checkout-source
+        uses: actions/checkout@v3
+        with:
+          ref: "release/${{ inputs.release_version }}"
+          path: "nym"
+
+      - name: checkout-ci-tools-repo
+        uses: actions/checkout@v3
+        with: 
+          repository: "nymtech/ci-tools"
+          ref: "master"
+          path: "ci-tools"
+          token: "${{ secrets.ACCESS_TOKEN_PRIVATE_REPOS }}"
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: install-version-bumper
+        run: "cargo install --path ."
+        working-directory: "ci-tools/version-bumper"
+
+      - name: run-version-bumper
+        run: "version-bumper bump binaries --nym-repo-directory nym"
+
+      - name: push-changes-to-branch
+        run: |
+          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
+          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
+          git checkout -b release/${{ inputs.release_version }}-preparation
+          git commit -am "chore: version bump in preparation for release"
+          git push -u origin release/${{ inputs.release_version }}-preparation
+        working-directory: "nym"
+
+  update-changelog:
+    runs-on: ubuntu-22.04
+    needs: [update-versions]
+    steps:
+      - name: checkout-source
+        uses: actions/checkout@v3
+        with:
+          ref: "release/${{ inputs.release_version }}"
+          path: "nym"
+
+      - name: checkout-ci-tools-repo
+        uses: actions/checkout@v3
+        with: 
+          repository: "nymtech/ci-tools"
+          ref: "master"
+          path: "ci-tools"
+          token: "${{ secrets.ACCESS_TOKEN_PRIVATE_REPOS }}"
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: install-changelog-updater
+        run: "cargo install --path ."
+        working-directory: "ci-tools/changelog-updater"
+
+      - name: run-changelog-updater
+        run: "changelog-updater mix ${{ inputs.milestone_id }} release/${{ inputs.release_version }}"
+
+      - name: push-changes-to-branch
+        run: |
+          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
+          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
+          git checkout release/${{ inputs.release_version }}-preparation
+          git commit -am "chore: update changelog preparation for release"
+          git push
+        working-directory: "nym"
@@ -2,11 +2,17 @@ name: Nym Wallet (rust)

 on:
  push:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'nym-wallet/**'
+      - 'common/**'
+      - 'contracts/vesting/**'
+      - 'nym-api/nym-api-requests/**'
  pull_request:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'nym-wallet/**'
+      - 'common/**'
+      - 'contracts/vesting/**'
+      - 'nym-api/nym-api-requests/**'

 jobs:
  build:
@@ -16,6 +22,7 @@ jobs:
    steps:
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        continue-on-error: true

      - name: Check out repository code
        uses: actions/checkout@v2
@@ -48,6 +55,7 @@ jobs:

      - uses: actions-rs/clippy-check@v1
        name: Clippy checks
+        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features
@@ -2,12 +2,17 @@ name: Wasm Client

 on:
  pull_request:
-    paths-ignore:
-      - 'explorer/**'
+    paths:
+      - 'clients/webassembly/**'
+      - 'clients/client-core/**'
+      - 'common/**'
+      - 'contracts/**'
+      - 'gateway/gateway-requests/**'
+      - 'nym-api/nym-api-requests/**'

 jobs:
  wasm:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v2

@@ -24,16 +29,6 @@ jobs:
          command: build
          args: --manifest-path clients/webassembly/Cargo.toml --target wasm32-unknown-unknown

-      - uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path clients/webassembly/Cargo.toml --target wasm32-unknown-unknown --features=coconut
-
-      - uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --manifest-path clients/webassembly/Cargo.toml
-
      - uses: actions-rs/cargo@v1
        with:
          command: fmt
@@ -37,4 +37,10 @@ validator-config
 *.patch
 validator-api-config.toml
 dist
-storybook-static
+storybook-static
+envs/qwerty.env
+Cargo.lock
+nym-connect/Cargo.lock
+.parcel-cache
+**/.DS_Store
+cpu-cycles/libcpucycles/build
@@ -1,6 +1,8 @@
 {
-  "mainnet":[{
-    "nymd_url":"https://rpc.nyx.nodes.guru/",
-    "api_url":"https://api.nyx.nodes.guru/"
-  }]
-}
+  "mainnet": [
+    {
+      "nyxd_url": "https://rpc.nyx.nodes.guru/",
+      "api_url": "https://api.nyx.nodes.guru/"
+    }
+  ]
+}
@@ -2,21 +2,313 @@

 Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

-## Unreleased
+## [Unreleased]
+
+## [v1.1.12] (2023-03-07)
+
+- Fix generated docs for mixnet and vesting contract on docs.rs ([#3093])
+- Introduce a way of injecting topology into the client ([#3044])
+- Update mixnet TypeScript client methods #1 ([#2783])
+- Update tooltips for routing and average score ([#3133])
+- update selected service provider description style ([#3128])
+
+[#3093]: https://github.com/nymtech/nym/issues/3093
+[#3044]: https://github.com/nymtech/nym/issues/3044
+[#2783]: https://github.com/nymtech/nym/issues/2783
+[#3133]: https://github.com/nymtech/nym/pull/3133
+[#3128]: https://github.com/nymtech/nym/pull/3128
+
+## [v1.1.11] (2023-02-28)
+
+- Fix empty dealer set loop ([#3105])
+- The nym-api db.sqlite is broken when trying to run against it it in `enabled-credentials-mode true` there is an ordering issue with migrations when using the credential binary to purchase bandwidth ([#3100])
+- Feature/latency based gateway selection ([#3081])
+- Fix the credential binary to handle transactions to sleep when in non-inProgress epochs ([#3057])
+- Publish mixnet contract to crates.io ([#1919])
+- Publish vesting contract to crates.io ([#1920])
+- Feature/update checker to use master ([#3097])
+- Feature/improve binary checks ([#3094])
+
+[#3105]: https://github.com/nymtech/nym/issues/3105
+[#3100]: https://github.com/nymtech/nym/issues/3100
+[#3081]: https://github.com/nymtech/nym/pull/3081
+[#3057]: https://github.com/nymtech/nym/issues/3057
+[#1919]: https://github.com/nymtech/nym/issues/1919
+[#1920]: https://github.com/nymtech/nym/issues/1920
+[#3097]: https://github.com/nymtech/nym/pull/3097
+[#3094]: https://github.com/nymtech/nym/pull/3094
+
+## [v1.1.10] (2023-02-21)
+
+- Verloc listener causing mixnode unexpected shutdown ([#3038])
+- rust-sdk - update API following implementation experience with the network-requester ([#3001])
+- Prevent coconut deposits in incompatible states ([#2991])
+- Support unavailable signer within threshold ([#2987])
+- Implement DKG re-sharing ([#2935])
+- contracts: add nym prefix to mixnet and vesting contract packages ([#2855])
+- Introduce common interface for all service providers to allow obtaining information such as whether they're online, what binary version they're running, etc. ([#2758])
+- Add client functionality to nym-network-requester ([#1900])
+- nym-api: uptime rework ([#3053])
+- ci: update typescript-lint.yml ([#3035])
+- contracts: add nym prefix to mixnet and vesting contract packages ([#2855])
+
+[#3038]: https://github.com/nymtech/nym/issues/3038
+[#3001]: https://github.com/nymtech/nym/issues/3001
+[#2991]: https://github.com/nymtech/nym/issues/2991
+[#2987]: https://github.com/nymtech/nym/issues/2987
+[#2935]: https://github.com/nymtech/nym/issues/2935
+[#2855]: https://github.com/nymtech/nym/pull/2855
+[#2758]: https://github.com/nymtech/nym/issues/2758
+[#1900]: https://github.com/nymtech/nym/issues/1900
+[#3053]: https://github.com/nymtech/nym/pull/3053
+[#3035]: https://github.com/nymtech/nym/pull/3035
+[#2855]: https://github.com/nymtech/nym/pull/2855
+
+## [v1.1.9] (2023-02-07)

 ### Added

- nym-cli: added CLI tool for interacting with the Nyx blockchain and Nym mixnet smart contracts ([#1577])
- validator-client: added `query_contract_smart` and `query_contract_raw` on `NymdClient` ([#1558])
+- Remove Coconut feature flag ([#2793])
+- Separate `nym-api` endpoints with values of "total-supply" and "circulating-supply" in `nym` ([#2964])

 ### Changed

- validator-client: made `fee` argument optional for `execute` and `execute_multiple` ([#1541])
+- native-client: is now capable of listening for requests on sockets different than `127.0.0.1` ([#2912]). This can be specified via `--host` flag during `init` or `run`. Alternatively a custom `host` can be set in `config.toml` file under `socket` section.
+- mixnode, gateway: fix unexpected shutdown on corrupted connection ([#2963])

+[#2793]: https://github.com/nymtech/nym/issues/2793
+[#2912]: https://github.com/nymtech/nym/issues/2912
+[#2964]: https://github.com/nymtech/nym/issues/2964
+[#2963]: https://github.com/nymtech/nym/issues/3017
+
+## [v1.1.8] (2023-01-31)
+
+### Added
+
+- Rust SDK - Support SURBS (anonymous send + storage) ([#2754])
+- dkg rerun from scratch and dkg-specific epochs ([#2810])
+- Rename `'initial_supply'` field to `'total_supply'` in the circulating supply endpoint ([#2931])
+- Circulating supply api endpoint (read the note inside before testing/deploying) ([#1902])
+
+### Changed
+
+- nym-api: an `--id` flag is now always explicitly required ([#2873])
+
+[#2754]: https://github.com/nymtech/nym/issues/2754
+[#2810]: https://github.com/nymtech/nym/issues/2810
+[#2931]: https://github.com/nymtech/nym/issues/2931
+[#1902]: https://github.com/nymtech/nym/issues/1902
+[#2873]: https://github.com/nymtech/nym/issues/2873
+
+
+## [v1.1.7] (2023-01-24)
+
+### Added
+
+- Gateways now shut down gracefully ([#2019]).
+- Rust SDK - Initial version for nym-client ([#2669]).
+- Introduce vesting contract query for addresses of all vesting accounts (required for the circulating supply calculation) ([#2778]).
+- Add threshold value to the contract storage ([#1893])
+
+### Changed
+
+- Refactor vesting account storage (and in particular, ACCOUNTS saving) ([#2795]).
+- Move from manual advancing DKG state to an automatic process ([#2670]).
+
+### Fixed
+
+- Gateways now shut down gracefully ([#2019]).
+
+[#2019]: https://github.com/nymtech/nym/issues/2019
+[#2669]: https://github.com/nymtech/nym/issues/2669
+[#2795]: https://github.com/nymtech/nym/issues/2795
+[#2778]: https://github.com/nymtech/nym/issues/2778
+[#2670]: https://github.com/nymtech/nym/issues/2670
+[#1893]: https://github.com/nymtech/nym/issues/1893
+
+## [v1.1.6] (2023-01-17)
+
+### Added
+
+- nym-sdk: added initial version of a Rust client sdk
+- nym-api: added `/circulating-supply` endpoint ([#2814])
+- nym-api: add endpoint listing detailed gateway info by @octol in https://github.com/nymtech/nym/pull/2833
+
+### Changed
+
+- streamline override_config functions -> there's a lot of duplicate if statements everywhere ([#2774])
+- clean-up nym-api startup arguments/flags to use clap 3 and its macro-derived arguments ([#2772])
+- renamed all references to validator_api to nym_api
+- renamed all references to nymd to nyxd ([#2696])
+- all-binaries: standarised argument names (note: old names should still be accepted) ([#2762]
+
+### Fixed
+
+- nym-api: should now correctly use `rewarding.enabled` config flag ([#2753])
+
+[#2696]: https://github.com/nymtech/nym/pull/2696
+[#2753]: https://github.com/nymtech/nym/pull/2753
+[#2762]: https://github.com/nymtech/nym/pull/2762
+[#2814]: https://github.com/nymtech/nym/pull/2814
+[#2772]: https://github.com/nymtech/nym/pull/2772
+[#2774]: https://github.com/nymtech/nym/pull/2774
+
+## [v1.1.5] (2023-01-10)
+
+### Added
+
+- socks5: send status message for service ready, and network-requester error response in https://github.com/nymtech/nym/pull/2715
+
+### Changed
+
+- all-binaries: improved error logging in https://github.com/nymtech/nym/pull/2686
+- native client: bring shutdown logic up to the same level as socks5-client in https://github.com/nymtech/nym/pull/2695
+- nym-api, coconut-dkg contract: automatic, time-based dkg epoch state advancement in https://github.com/nymtech/nym/pull/2670
+- DKG resharing unit test by @neacsu in https://github.com/nymtech/nym/pull/2668
+- Renaming validator-api to nym-api by @futurechimp in https://github.com/nymtech/nym/pull/1863
+- Modify wasm specific make targets by @neacsu in https://github.com/nymtech/nym/pull/2693
+- client: create websocket handler builder by @octol in https://github.com/nymtech/nym/pull/2700
+- Outfox and Lion by @durch in https://github.com/nymtech/nym/pull/2730
+- Feature/multi surb transmission lanes by @jstuczyn in https://github.com/nymtech/nym/pull/2723
+
+## [v1.1.4] (2022-12-20)
+
+This release adds multiple Single Use Reply Blocks (SURBs) to allow arbitrarily-sized anonymized replies.
+At the moment this is turned off by default, but available for use by application developers.
+We will need to wait for network-requesters to upgrade to this new release, after which multi-SURB anonymization will become the default setting for the SOCKS proxy clients.
+
+The release also include some additional work for distributed key generation in the Coconut signing authority nodes.
+
+### Changed
+
+- Feature/dkg contract threshold by @neacsu in https://github.com/nymtech/nym/pull/1885
+- Multi-surbs by @jstuczyn in https://github.com/nymtech/nym/pull/2667
+- Fix multi-surb backwards compatibility in pre 1.1.4 client config files by @jstuczyn in https://github.com/nymtech/nym/pull/2703
+- fix: ignore corrupted surb storage and instead create fresh one by @jstuczyn in https://github.com/nymtech/nym/pull/2711
+- socks5: rework waiting in inbound.rs by @octol in https://github.com/nymtech/nym/pull/1880
+
+## [v1.1.3] (2022-12-13)
+
+### Changed
+
+- validator-api: can recover from shutdown during DKG process ([#1872])
+- clients: deduplicate gateway initialization, part of work towards a rust-sdk
+- clients: keep all transmission lanes going at all times by making priority probabilistic
+- clients: ability to use multi-reply SURBs to send arbitrarily long messages fully anonymously whilst requesting additional reply blocks whenever they're about to run out ([#1796], [#1801], [#1804], [#1835], [#1858], [#1883]))
+
+### Fixed
+
+- network-requester: fix bug where websocket connection disconnect resulted in success error code
+- clients: fix a few panics handling the gateway-client
+- mixnode, gateway, validator-api: Use mainnet values as defaults for URLs and mixnet contract ([#1884])
+- socks5: fixed bug where connections sometimes where closed too early
+- clients: improve message logging when received message fails to get reconstructed ([#1803])
+
+[#1796]: https://github.com/nymtech/nym/pull/1796
+[#1801]: https://github.com/nymtech/nym/pull/1801
+[#1803]: https://github.com/nymtech/nym/pull/1803
+[#1804]: https://github.com/nymtech/nym/pull/1804
+[#1835]: https://github.com/nymtech/nym/pull/1835
+[#1858]: https://github.com/nymtech/nym/pull/1858
+[#1872]: https://github.com/nymtech/nym/pull/1872
+[#1883]: https://github.com/nymtech/nym/pull/1883
+[#1884]: https://github.com/nymtech/nym/pull/1884
+
+## [v1.1.2]
+
+### Changed
+
+- gateway: Renamed flag from `enabled/disabled_credentials_mode` to `only-coconut-credentials`
+- "Family" feature for node families + layers
+- Initial coconut functionality including credentials and distributed key generation
+
+## [v1.1.1](https://github.com/nymtech/nym/tree/v1.1.1) (2022-11-29)
+
+### Added
+
+- binaries: add `-c` shortform for `--config-env-file`
+- websocket-requests: add server response signalling current packet queue length in the client
+- contracts: DKG contract that handles coconut key generation ([#1678][#1708][#1747])
+- validator-api: generate coconut keys interactively, using DKG and multisig contracts ([#1678][#1708][#1747])
+
+### Changed
+
+- clients: add concept of transmission lanes to better handle multiple data streams ([#1720])
+- clients,validator-api: take coconut signers from the chain instead of specifying them via CLI ([#1747])
+- multisig contract: add DKG contract to the list of addresses that can create proposals ([#1747])
+- socks5-client: wait closing inbound connection until data is sent, and throttle incoming data in general ([#1783])
+- nym-cli: improve error reporting/handling and changed `vesting-schedule` queries to use query client instead of signing client
+
+### Fixed
+
+- gateway-client: fix decrypting stored messages on reconnect ([#1786])
+
+### Fixed
+
+- gateway-client: fix decrypting stored messages on reconnect ([#1786])
+- socks5-client: fix shutting down all tasks if anyone of them panics or errors out ([#1805])
+
+[#1678]: https://github.com/nymtech/nym/pull/1678
+[#1708]: https://github.com/nymtech/nym/pull/1708
+[#1720]: https://github.com/nymtech/nym/pull/1720
+[#1747]: https://github.com/nymtech/nym/pull/1747
+[#1783]: https://github.com/nymtech/nym/pull/1783
+[#1786]: https://github.com/nymtech/nym/pull/1786
+[#1805]: https://github.com/nymtech/nym/pull/1805
+
+## [v1.1.0](https://github.com/nymtech/nym/tree/v1.1.0) (2022-11-09)
+
+### Added
+
+- clients: add testing-only support for two more extended packet sizes (8kb and 16kb).
+- common/ledger: new library for communicating with a Ledger device ([#1640])
+- native-client/socks5-client/wasm-client: `disable_loop_cover_traffic_stream` Debug config option to disable the separate loop cover traffic stream ([#1666])
+- native-client/socks5-client/wasm-client: `disable_main_poisson_packet_distribution` Debug config option to make the client ignore poisson distribution in the main packet stream and ONLY send real message (and as fast as they come) ([#1664])
+- native-client/socks5-client/wasm-client: `use_extended_packet_size` Debug config option to make the client use 'ExtendedPacketSize' for its traffic (32kB as opposed to 2kB in 1.0.2) ([#1671])
+- network-requester: added additional Blockstream Green wallet endpoint to `example.allowed.list` ([#1611])
+- validator-api: add `interval_operating_cost` and `profit_margin_percent` to compute reward estimation endpoint
+- validator-client: added `query_contract_smart` and `query_contract_raw` on `NyxdClient` ([#1558])
+- wasm-client: uses updated wasm-compatible `client-core` so that it's now capable of packet retransmission, cover traffic and poisson delay (among other things!) ([#1673])
+
+### Fixed
+
+- socks5-client: fix bug where in some cases packet reordering could trigger a connection being closed too early ([#1702],[#1724])
+- validator-api: mixnode, gateway should now prefer values in config.toml over mainnet defaults ([#1645])
+- validator-api: should now correctly update historical uptimes for all mixnodes and gateways every 24h ([#1721])
+
+### Changed
+
+- clients: bound the sphinx packet channel and reduce sending rate if gateway can't keep up ([#1703],[#1725])
+- gateway-client: will attempt to read now as many as 8 websocket messages at once, assuming they're already available on the socket ([#1669])
+- moved `Percent` struct to `contracts-common`, change affects explorer-api
+- socks5 client: graceful shutdown should fix error on disconnect in nym-connect ([#1591])
+- validator-api: changed error serialization on `inclusion_probability`, `stake-saturation` and `reward-estimation` endpoints to provide more accurate information ([#1681])
+- validator-client: made `fee` argument optional for `execute` and `execute_multiple` ([#1541])
+- wasm-client: fixed build errors on MacOS and changed example JS code to use mainnet ([#1585])
+- validator-api: changes to internal SQL schema due to the mixnet contract revamp ([#1472])
+- validator-api: changes to internal data structures due to the mixnet contract revamp ([#1472])
+- validator-api: split epoch-operations into multiple separate transactions ([#1472])
+
+[#1472]: https://github.com/nymtech/nym/pull/1472
 [#1541]: https://github.com/nymtech/nym/pull/1541
 [#1558]: https://github.com/nymtech/nym/pull/1558
 [#1577]: https://github.com/nymtech/nym/pull/1577
-
+[#1585]: https://github.com/nymtech/nym/pull/1585
+[#1591]: https://github.com/nymtech/nym/pull/1591
+[#1640]: https://github.com/nymtech/nym/pull/1640
+[#1645]: https://github.com/nymtech/nym/pull/1645
+[#1611]: https://github.com/nymtech/nym/pull/1611
+[#1664]: https://github.com/nymtech/nym/pull/1664
+[#1666]: https://github.com/nymtech/nym/pull/1645
+[#1669]: https://github.com/nymtech/nym/pull/1669
+[#1671]: https://github.com/nymtech/nym/pull/1671
+[#1673]: https://github.com/nymtech/nym/pull/1673
+[#1681]: https://github.com/nymtech/nym/pull/1681
+[#1702]: https://github.com/nymtech/nym/pull/1702
+[#1703]: https://github.com/nymtech/nym/pull/1703
+[#1721]: https://github.com/nymtech/nym/pull/1721
+[#1724]: https://github.com/nymtech/nym/pull/1724
+[#1725]: https://github.com/nymtech/nym/pull/1725

 ## [nym-binaries-1.0.2](https://github.com/nymtech/nym/tree/nym-binaries-1.0.2)

@@ -70,9 +362,8 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - All binaries and cosmwasm blobs are configured at runtime now; binaries are configured using environment variables or .env files and contracts keep the configuration parameters in storage ([#1463])
 - gateway, network-statistics: include gateway id in the sent statistical data ([#1478])
 - network explorer: tweak how active set probability is shown ([#1503])
- validator-api: rewarder set update fails without panicking on possible nymd queries ([#1520])
- network-requester, socks5 client (nym-connect): send and receive respectively a message error to be displayed about filter check failure ([#1576]) 
-
+- validator-api: rewarder set update fails without panicking on possible nyxd queries ([#1520])
+- network-requester, socks5 client (nym-connect): send and receive respectively a message error to be displayed about filter check failure ([#1576])

 [#1249]: https://github.com/nymtech/nym/pull/1249
 [#1256]: https://github.com/nymtech/nym/pull/1256
@@ -166,9 +457,9 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Bump minimist from 1.2.5 to 1.2.6 in /clients/tauri-client [\#1163](https://github.com/nymtech/nym/pull/1163) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump minimist from 1.2.5 to 1.2.6 in /clients/webassembly/js-example [\#1162](https://github.com/nymtech/nym/pull/1162) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Bump minimist from 1.2.5 to 1.2.6 in /clients/native/examples/js-examples/websocket [\#1160](https://github.com/nymtech/nym/pull/1160) ([dependabot[bot]](https://github.com/apps/dependabot))
- Bump minimist from 1.2.5 to 1.2.6 in /docker/typescript\_client/upload\_contract [\#1159](https://github.com/nymtech/nym/pull/1159) ([dependabot[bot]](https://github.com/apps/dependabot))
+- Bump minimist from 1.2.5 to 1.2.6 in /docker/typescript_client/upload_contract [\#1159](https://github.com/nymtech/nym/pull/1159) ([dependabot[bot]](https://github.com/apps/dependabot))
 - Feature/vesting full [\#1158](https://github.com/nymtech/nym/pull/1158) ([fmtabbara](https://github.com/fmtabbara))
- get\_current\_epoch tauri [\#1156](https://github.com/nymtech/nym/pull/1156) ([durch](https://github.com/durch))
+- get_current_epoch tauri [\#1156](https://github.com/nymtech/nym/pull/1156) ([durch](https://github.com/durch))
 - Cleanup [\#1155](https://github.com/nymtech/nym/pull/1155) ([durch](https://github.com/durch))
 - Feature flag reward payments [\#1154](https://github.com/nymtech/nym/pull/1154) ([durch](https://github.com/durch))
 - Add Query endpoints for calculating rewards [\#1152](https://github.com/nymtech/nym/pull/1152) ([durch](https://github.com/durch))
@@ -177,7 +468,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - wallet: use Urls rather than Strings for validator urls [\#1148](https://github.com/nymtech/nym/pull/1148) ([octol](https://github.com/octol))
 - Change accumulated reward to Option, migrate delegations [\#1147](https://github.com/nymtech/nym/pull/1147) ([durch](https://github.com/durch))
 - wallet: fetch validators url remotely if available [\#1146](https://github.com/nymtech/nym/pull/1146) ([octol](https://github.com/octol))
- Fix delegated\_free calculation [\#1145](https://github.com/nymtech/nym/pull/1145) ([durch](https://github.com/durch))
+- Fix delegated_free calculation [\#1145](https://github.com/nymtech/nym/pull/1145) ([durch](https://github.com/durch))
 - Update Nym wallet dependencies to use `ts-packages` [\#1144](https://github.com/nymtech/nym/pull/1144) ([mmsinclair](https://github.com/mmsinclair))
 - wallet: try validators one by one if available [\#1143](https://github.com/nymtech/nym/pull/1143) ([octol](https://github.com/octol))
 - Update Network Explorer Packages and add mix node identity key copy [\#1142](https://github.com/nymtech/nym/pull/1142) ([mmsinclair](https://github.com/mmsinclair))
@@ -217,14 +508,13 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - feature/pedersen-commitments [\#1048](https://github.com/nymtech/nym/pull/1048) ([danielementary](https://github.com/danielementary))
 - Feature/reuse init owner [\#970](https://github.com/nymtech/nym/pull/970) ([neacsu](https://github.com/neacsu))

-
 ## [v0.12.1](https://github.com/nymtech/nym/tree/v0.12.1) (2021-12-23)

 [Full Changelog](https://github.com/nymtech/nym/compare/v0.12.0...v0.12.1)

 **Implemented enhancements:**

- Add version check to  binaries [\#967](https://github.com/nymtech/nym/issues/967)
+- Add version check to binaries [\#967](https://github.com/nymtech/nym/issues/967)

 **Fixed bugs:**

@@ -254,7 +544,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Bugfix/remove mixnode bonding overwrite [\#917](https://github.com/nymtech/nym/pull/917) ([jstuczyn](https://github.com/jstuczyn))
 - Fixes crash condition in validator API when calculating last day uptime [\#909](https://github.com/nymtech/nym/pull/909) ([jstuczyn](https://github.com/jstuczyn))
 - Bugfix/monitor initial values wait [\#907](https://github.com/nymtech/nym/pull/907) ([jstuczyn](https://github.com/jstuczyn))
- Bug fix: Network Explorer: Add freegeoip API key and split out tasks for country distributions  [\#806](https://github.com/nymtech/nym/pull/806) ([mmsinclair](https://github.com/mmsinclair))
+- Bug fix: Network Explorer: Add freegeoip API key and split out tasks for country distributions [\#806](https://github.com/nymtech/nym/pull/806) ([mmsinclair](https://github.com/mmsinclair))
 - Explorer API: port test now split out address resolution and add units tests [\#755](https://github.com/nymtech/nym/pull/755) ([mmsinclair](https://github.com/mmsinclair))

 **Closed issues:**
@@ -269,7 +559,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - help!!! [\#712](https://github.com/nymtech/nym/issues/712)
 - UX feature request: show all delegated nodes in wallet [\#711](https://github.com/nymtech/nym/issues/711)
 - UX feature request: add current balance on wallet pages [\#710](https://github.com/nymtech/nym/issues/710)
- got sign issue from bot  [\#709](https://github.com/nymtech/nym/issues/709)
+- got sign issue from bot [\#709](https://github.com/nymtech/nym/issues/709)
 - As a wallet user, I would like to be able to log out of the wallet [\#706](https://github.com/nymtech/nym/issues/706)
 - As a wallet user, I would like to have a "receive" page where I can see my own wallet address [\#705](https://github.com/nymtech/nym/issues/705)
 - Update native client/socks client/mixnode/gateway `upgrade` command [\#689](https://github.com/nymtech/nym/issues/689)
@@ -279,7 +569,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - nym-socks5-client crash after opening Keybase team "Browse all channels" [\#494](https://github.com/nymtech/nym/issues/494)
 - Mixed Content problem [\#400](https://github.com/nymtech/nym/issues/400)
 - Gateway disk quota [\#137](https://github.com/nymtech/nym/issues/137)
- Simplify message encapsulation with regards to topology  [\#127](https://github.com/nymtech/nym/issues/127)
+- Simplify message encapsulation with regards to topology [\#127](https://github.com/nymtech/nym/issues/127)
 - Create constants for cli argument names [\#115](https://github.com/nymtech/nym/issues/115)
 - Using Blake3 as a hash function [\#103](https://github.com/nymtech/nym/issues/103)
 - Validator should decide which layer a node is in [\#86](https://github.com/nymtech/nym/issues/86)
@@ -335,10 +625,10 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Feature/pre cosmrs updates [\#935](https://github.com/nymtech/nym/pull/935) ([jstuczyn](https://github.com/jstuczyn))
 - Feature/client on behalf [\#934](https://github.com/nymtech/nym/pull/934) ([neacsu](https://github.com/neacsu))
 - Webpack wallet prod configuration [\#933](https://github.com/nymtech/nym/pull/933) ([tommyv1987](https://github.com/tommyv1987))
- Adding tx\_hash to wallet response [\#932](https://github.com/nymtech/nym/pull/932) ([futurechimp](https://github.com/futurechimp))
+- Adding tx_hash to wallet response [\#932](https://github.com/nymtech/nym/pull/932) ([futurechimp](https://github.com/futurechimp))
 - Release/1.0.0 pre1 [\#931](https://github.com/nymtech/nym/pull/931) ([durch](https://github.com/durch))
 - Feature/identity verification [\#930](https://github.com/nymtech/nym/pull/930) ([jstuczyn](https://github.com/jstuczyn))
- Move cleaned up smart contracts to main code repo  [\#929](https://github.com/nymtech/nym/pull/929) ([mfahampshire](https://github.com/mfahampshire))
+- Move cleaned up smart contracts to main code repo [\#929](https://github.com/nymtech/nym/pull/929) ([mfahampshire](https://github.com/mfahampshire))
 - Feature/mixnet contract further adjustments [\#928](https://github.com/nymtech/nym/pull/928) ([jstuczyn](https://github.com/jstuczyn))
 - typo copy change for nodemap [\#926](https://github.com/nymtech/nym/pull/926) ([Aid19801](https://github.com/Aid19801))
 - Feature/UI enhancements for Desktop Wallet [\#925](https://github.com/nymtech/nym/pull/925) ([fmtabbara](https://github.com/fmtabbara))
@@ -351,7 +641,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Feature/faucet page react [\#911](https://github.com/nymtech/nym/pull/911) ([fmtabbara](https://github.com/fmtabbara))
 - Feature/mixnet contract refactor [\#910](https://github.com/nymtech/nym/pull/910) ([futurechimp](https://github.com/futurechimp))
 - Update README.md [\#905](https://github.com/nymtech/nym/pull/905) ([tommyv1987](https://github.com/tommyv1987))
- BUG: Bond cell denom  [\#904](https://github.com/nymtech/nym/pull/904) ([Aid19801](https://github.com/Aid19801))
+- BUG: Bond cell denom [\#904](https://github.com/nymtech/nym/pull/904) ([Aid19801](https://github.com/Aid19801))
 - Explorer UI tests missing data-testid [\#903](https://github.com/nymtech/nym/pull/903) ([tommyv1987](https://github.com/tommyv1987))
 - Fix up Nym-Wallet README.md [\#899](https://github.com/nymtech/nym/pull/899) ([tommyv1987](https://github.com/tommyv1987))
 - Feature/batch delegator rewarding [\#898](https://github.com/nymtech/nym/pull/898) ([jstuczyn](https://github.com/jstuczyn))
@@ -369,7 +659,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Reverted gateway registration handshake to its 0.11.0 version [\#882](https://github.com/nymtech/nym/pull/882) ([jstuczyn](https://github.com/jstuczyn))
 - Network Explorer [\#881](https://github.com/nymtech/nym/pull/881) ([mmsinclair](https://github.com/mmsinclair))
 - Feature/rewarding interval updates [\#880](https://github.com/nymtech/nym/pull/880) ([jstuczyn](https://github.com/jstuczyn))
- Put client\_address and id in the correct order [\#875](https://github.com/nymtech/nym/pull/875) ([neacsu](https://github.com/neacsu))
+- Put client_address and id in the correct order [\#875](https://github.com/nymtech/nym/pull/875) ([neacsu](https://github.com/neacsu))
 - remove gateway selection on delegation and undelegation pages [\#873](https://github.com/nymtech/nym/pull/873) ([fmtabbara](https://github.com/fmtabbara))
 - Set MSRV on all binaries to 1.56 [\#872](https://github.com/nymtech/nym/pull/872) ([jstuczyn](https://github.com/jstuczyn))
 - add native window items \(copy/paste\) via tauri [\#871](https://github.com/nymtech/nym/pull/871) ([fmtabbara](https://github.com/fmtabbara))
@@ -385,7 +675,7 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Overflow checks in release [\#846](https://github.com/nymtech/nym/pull/846) ([jstuczyn](https://github.com/jstuczyn))
 - fix delegate success overflow [\#842](https://github.com/nymtech/nym/pull/842) ([fmtabbara](https://github.com/fmtabbara))
 - Feature NYM wallet webdriverio test [\#841](https://github.com/nymtech/nym/pull/841) ([tommyv1987](https://github.com/tommyv1987))
- Update nym\_wallet.yml [\#840](https://github.com/nymtech/nym/pull/840) ([tommyv1987](https://github.com/tommyv1987))
+- Update nym_wallet.yml [\#840](https://github.com/nymtech/nym/pull/840) ([tommyv1987](https://github.com/tommyv1987))
 - Feature/vouchers [\#837](https://github.com/nymtech/nym/pull/837) ([aniampio](https://github.com/aniampio))
 - Apply readable ids to elements on Nym Wallet [\#836](https://github.com/nymtech/nym/pull/836) ([tommyv1987](https://github.com/tommyv1987))
 - Feature/removal of monitor good nodes [\#833](https://github.com/nymtech/nym/pull/833) ([jstuczyn](https://github.com/jstuczyn))
@@ -409,8 +699,8 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Created getters for AccountData [\#787](https://github.com/nymtech/nym/pull/787) ([jstuczyn](https://github.com/jstuczyn))
 - Feature/migrate hidden delegations [\#786](https://github.com/nymtech/nym/pull/786) ([neacsu](https://github.com/neacsu))
 - Feature/persistent gateway storage [\#784](https://github.com/nymtech/nym/pull/784) ([jstuczyn](https://github.com/jstuczyn))
- Replaced unwrap\_or\_else with unwrap\_or\_default [\#780](https://github.com/nymtech/nym/pull/780) ([jstuczyn](https://github.com/jstuczyn))
- Add block\_height method to Delegation [\#778](https://github.com/nymtech/nym/pull/778) ([durch](https://github.com/durch))
+- Replaced unwrap_or_else with unwrap_or_default [\#780](https://github.com/nymtech/nym/pull/780) ([jstuczyn](https://github.com/jstuczyn))
+- Add block_height method to Delegation [\#778](https://github.com/nymtech/nym/pull/778) ([durch](https://github.com/durch))
 - Make fee helpers public [\#777](https://github.com/nymtech/nym/pull/777) ([durch](https://github.com/durch))
 - re-enable bonding [\#776](https://github.com/nymtech/nym/pull/776) ([fmtabbara](https://github.com/fmtabbara))
 - Explorer-api: add API resource to show the delegations for each mix node [\#774](https://github.com/nymtech/nym/pull/774) ([mmsinclair](https://github.com/mmsinclair))
@@ -419,14 +709,14 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Adding deps for building the Tauri wallet under Ubuntu [\#770](https://github.com/nymtech/nym/pull/770) ([futurechimp](https://github.com/futurechimp))
 - remove alert [\#767](https://github.com/nymtech/nym/pull/767) ([fmtabbara](https://github.com/fmtabbara))
 - Feature/consumable bandwidth [\#766](https://github.com/nymtech/nym/pull/766) ([neacsu](https://github.com/neacsu))
- Update coconut-rs and use hash\_to\_scalar from there [\#765](https://github.com/nymtech/nym/pull/765) ([neacsu](https://github.com/neacsu))
+- Update coconut-rs and use hash_to_scalar from there [\#765](https://github.com/nymtech/nym/pull/765) ([neacsu](https://github.com/neacsu))
 - Feature/active sets [\#764](https://github.com/nymtech/nym/pull/764) ([jstuczyn](https://github.com/jstuczyn))
 - add app alert banner [\#762](https://github.com/nymtech/nym/pull/762) ([fmtabbara](https://github.com/fmtabbara))
 - Updated cosmos-sdk [\#761](https://github.com/nymtech/nym/pull/761) ([jstuczyn](https://github.com/jstuczyn))
 - Feature/bond blockstamp [\#760](https://github.com/nymtech/nym/pull/760) ([neacsu](https://github.com/neacsu))
 - Feature/revert migration code [\#759](https://github.com/nymtech/nym/pull/759) ([neacsu](https://github.com/neacsu))
 - Bump next from 11.1.0 to 11.1.1 in /wallet-web [\#758](https://github.com/nymtech/nym/pull/758) ([dependabot[bot]](https://github.com/apps/dependabot))
- Add block\_height in the Delegation structure as well [\#757](https://github.com/nymtech/nym/pull/757) ([neacsu](https://github.com/neacsu))
+- Add block_height in the Delegation structure as well [\#757](https://github.com/nymtech/nym/pull/757) ([neacsu](https://github.com/neacsu))
 - Feature/add blockstamp [\#756](https://github.com/nymtech/nym/pull/756) ([neacsu](https://github.com/neacsu))
 - NetworkMonitorBuilder - starting the monitor after rocket has launched [\#754](https://github.com/nymtech/nym/pull/754) ([jstuczyn](https://github.com/jstuczyn))
 - Enabled validators api argument [\#753](https://github.com/nymtech/nym/pull/753) ([jstuczyn](https://github.com/jstuczyn))
@@ -438,21 +728,21 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Feature/more reliable uptime calculation [\#747](https://github.com/nymtech/nym/pull/747) ([jstuczyn](https://github.com/jstuczyn))
 - Update template toml key [\#746](https://github.com/nymtech/nym/pull/746) ([neacsu](https://github.com/neacsu))
 - Feature/cred after handshake [\#745](https://github.com/nymtech/nym/pull/745) ([neacsu](https://github.com/neacsu))
- Reinstate the POST method blind\_sign [\#744](https://github.com/nymtech/nym/pull/744) ([neacsu](https://github.com/neacsu))
+- Reinstate the POST method blind_sign [\#744](https://github.com/nymtech/nym/pull/744) ([neacsu](https://github.com/neacsu))
 - explorer-api: add pending field to port check response [\#742](https://github.com/nymtech/nym/pull/742) ([mmsinclair](https://github.com/mmsinclair))
 - Feature/use delegation rates [\#741](https://github.com/nymtech/nym/pull/741) ([neacsu](https://github.com/neacsu))
 - Feature/copy to clipboard [\#740](https://github.com/nymtech/nym/pull/740) ([fmtabbara](https://github.com/fmtabbara))
 - Feature/update wallet with stake rates [\#739](https://github.com/nymtech/nym/pull/739) ([neacsu](https://github.com/neacsu))
 - Add stake reward rates and bump version of client [\#738](https://github.com/nymtech/nym/pull/738) ([neacsu](https://github.com/neacsu))
 - Bump next from 10.1.3 to 11.1.0 in /wallet-web [\#737](https://github.com/nymtech/nym/pull/737) ([dependabot[bot]](https://github.com/apps/dependabot))
- Feature/nymd client integration [\#736](https://github.com/nymtech/nym/pull/736) ([jstuczyn](https://github.com/jstuczyn))
+- Feature/nyxd client integration [\#736](https://github.com/nymtech/nym/pull/736) ([jstuczyn](https://github.com/jstuczyn))
 - Bug/fix parking lot on wasm [\#735](https://github.com/nymtech/nym/pull/735) ([neacsu](https://github.com/neacsu))
 - Explorer API: add new HTTP resource to decorate mix nodes with geoip locations [\#734](https://github.com/nymtech/nym/pull/734) ([mmsinclair](https://github.com/mmsinclair))
- Feature/completing nymd client api [\#732](https://github.com/nymtech/nym/pull/732) ([jstuczyn](https://github.com/jstuczyn))
+- Feature/completing nyxd client api [\#732](https://github.com/nymtech/nym/pull/732) ([jstuczyn](https://github.com/jstuczyn))
 - Explorer API - add port check and node description/stats proxy [\#731](https://github.com/nymtech/nym/pull/731) ([mmsinclair](https://github.com/mmsinclair))
- Feature/nymd client fee handling [\#730](https://github.com/nymtech/nym/pull/730) ([jstuczyn](https://github.com/jstuczyn))
+- Feature/nyxd client fee handling [\#730](https://github.com/nymtech/nym/pull/730) ([jstuczyn](https://github.com/jstuczyn))
 - Update DelegationCheck.tsx [\#725](https://github.com/nymtech/nym/pull/725) ([jessgess](https://github.com/jessgess))
- Rust nymd/cosmwasm client [\#724](https://github.com/nymtech/nym/pull/724) ([jstuczyn](https://github.com/jstuczyn))
+- Rust nyxd/cosmwasm client [\#724](https://github.com/nymtech/nym/pull/724) ([jstuczyn](https://github.com/jstuczyn))
 - Removed wasm feature bypassing cyclic dependencies [\#723](https://github.com/nymtech/nym/pull/723) ([jstuczyn](https://github.com/jstuczyn))
 - Updated used sphinx dependency to the most recent revision [\#722](https://github.com/nymtech/nym/pull/722) ([jstuczyn](https://github.com/jstuczyn))
 - update state management and validation [\#721](https://github.com/nymtech/nym/pull/721) ([fmtabbara](https://github.com/fmtabbara))
@@ -471,10 +761,8 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 - Bond and delegation alerts [\#698](https://github.com/nymtech/nym/pull/698) ([fmtabbara](https://github.com/fmtabbara))
 - Bugfix/network monitor version check [\#697](https://github.com/nymtech/nym/pull/697) ([jstuczyn](https://github.com/jstuczyn))
 - Feature/other containers [\#692](https://github.com/nymtech/nym/pull/692) ([neacsu](https://github.com/neacsu))
- Using validator API instead of nymd [\#690](https://github.com/nymtech/nym/pull/690) ([futurechimp](https://github.com/futurechimp))
+- Using validator API instead of nyxd [\#690](https://github.com/nymtech/nym/pull/690) ([futurechimp](https://github.com/futurechimp))
 - Hang coconut issuance off the validator-api [\#679](https://github.com/nymtech/nym/pull/679) ([durch](https://github.com/durch))
 - Update hmac and blake3 [\#673](https://github.com/nymtech/nym/pull/673) ([durch](https://github.com/durch))

-
-
-\* *This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)*
+\* _This Changelog was automatically generated by [github_changelog_generator](https://github.com/github-changelog-generator/github-changelog-generator)_
@@ -22,7 +22,7 @@ members = [
    "clients/native",
    "clients/native/websocket-requests",
    "clients/socks5",
-    "common/bandwidth-claim-contract",
+    "common/bin-common",
    "common/client-libs/gateway-client",
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
@@ -30,16 +30,20 @@ members = [
    "common/commands",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
+    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/group-contract",
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
+    "common/mobile-storage",
    "common/credential-storage",
    "common/credentials",
    "common/crypto",
-    "common/crypto/dkg",
+    "common/dkg",
    "common/execute",
    "common/inclusion-probability",
+    "common/ledger",
    "common/mixnode-common",
    "common/network-defaults",
    "common/nonexhaustive-delayqueue",
@@ -65,11 +69,15 @@ members = [
    "explorer-api",
    "gateway",
    "gateway/gateway-requests",
+    "integrations/bity",
    "mixnode",
+    "sdk/rust/nym-sdk",
+    "service-providers/common",
    "service-providers/network-requester",
    "service-providers/network-statistics",
-    "validator-api",
-    "validator-api/validator-api-requests",
+    "nym-api",
+    "nym-api/nym-api-requests",
+    "nym-outfox",
    "tools/nym-cli",
    "tools/ts-rs-cli"
 ]
@@ -81,8 +89,31 @@ default-members = [
    "service-providers/network-requester",
    "service-providers/network-statistics",
    "mixnode",
-    "validator-api",
+    "nym-api",
    "explorer-api",
 ]

-exclude = ["explorer", "contracts", "tokenomics-py", "clients/webassembly", "nym-wallet", "nym-connect"]
+exclude = ["explorer", "contracts", "clients/webassembly", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop"]
+
+[workspace.package]
+authors = ["Nym Technologies SA"]
+repository = "https://github.com/nymtech/nym"
+homepage = "https://nymtech.net"
+documentation = "https://nymtech.net"
+edition = "2021"
+license = "Apache-2.0"
+
+[workspace.dependencies]
+async-trait = "0.1.64"
+cfg-if = "1.0.0"
+dotenvy = "0.15.6"
+lazy_static = "1.4.0"
+log = "0.4"
+once_cell = "1.7.2"
+rand = "0.8.5"
+serde = "1.0.152"
+serde_json = "1.0.91"
+tap = "1.0.1"
+thiserror = "1.0.38"
+tokio = "1.24.1"
+url = "2.2"
@@ -1,13 +1,22 @@
 test: clippy-all cargo-test wasm fmt
+test-no-mobile: clippy-all-no-mobile cargo-test-no-mobile wasm fmt-no-mobile
 test-all: test cargo-test-expensive
+test-all-no-mobile: test-no-mobile cargo-test-expensive
 no-clippy: build cargo-test wasm fmt
+no-clippy-no-mobile: build-no-mobile cargo-test-no-mobile wasm fmt-no-mobile
 happy: fmt clippy-happy test
-clippy-all: clippy-all-main clippy-all-contracts clippy-all-wallet clippy-all-connect
-clippy-happy: clippy-happy-main clippy-happy-contracts clippy-happy-wallet clippy-happy-connect
-cargo-test: test-main test-contracts test-wallet test-connect
+happy-no-mobile: fmt-no-mobile clippy-happy-no-mobile test-no-mobile
+clippy-all: clippy-all-no-mobile clippy-all-connect-mobile
+clippy-all-no-mobile: clippy-main clippy-main-examples clippy-all-contracts clippy-all-wallet clippy-all-connect clippy-all-wasm-client
+clippy-happy: clippy-happy-no-mobile clippy-happy-connect-mobile
+clippy-happy-no-mobile: clippy-happy-main clippy-happy-contracts clippy-happy-wallet clippy-happy-connect
+cargo-test: cargo-test-no-mobile test-connect-mobile
+cargo-test-no-mobile: test-main test-contracts test-wallet test-connect 
 cargo-test-expensive: test-main-expensive test-contracts-expensive test-wallet-expensive test-connect-expensive
-build: build-contracts build-wallet build-main build-connect
-fmt: fmt-main fmt-contracts fmt-wallet fmt-connect
+build: build-no-mobile build-connect-mobile 
+build-no-mobile: build-contracts build-wallet build-main build-main-examples build-connect build-wasm-client 
+fmt: fmt-no-mobile fmt-connect-mobile
+fmt-no-mobile: fmt-main fmt-contracts fmt-wallet fmt-connect fmt-wasm-client

 clippy-happy-main:
 	cargo clippy
@@ -19,10 +28,20 @@ clippy-happy-wallet:
 	cargo clippy --manifest-path nym-wallet/Cargo.toml

 clippy-happy-connect:
-	cargo clippy --manifest-path nym-connect/Cargo.toml
+	cargo clippy --manifest-path nym-connect/desktop/Cargo.toml
+
+clippy-happy-connect-mobile:
+	cargo clippy --manifest-path nym-connect/mobile/src-tauri/Cargo.toml
+
+clippy-main:
+	cargo clippy --workspace -- -D warnings
+
+clippy-main-examples:
+	cargo clippy --workspace --examples -- -D warnings
+
+clippy-wasm:
+	cargo clippy --manifest-path clients/webassembly/Cargo.toml --target wasm32-unknown-unknown --workspace -- -D warnings

-clippy-all-main:
-	cargo clippy --workspace --all-features -- -D warnings

 clippy-all-contracts:
 	cargo clippy --workspace --manifest-path contracts/Cargo.toml --all-features --target wasm32-unknown-unknown -- -D warnings
@@ -31,13 +50,19 @@ clippy-all-wallet:
 	cargo clippy --workspace --manifest-path nym-wallet/Cargo.toml --all-features -- -D warnings

 clippy-all-connect:
-	cargo clippy --workspace --manifest-path nym-connect/Cargo.toml --all-features -- -D warnings
+	cargo clippy --workspace --manifest-path nym-connect/desktop/Cargo.toml --all-features -- -D warnings
+
+clippy-all-connect-mobile:
+	cargo clippy --workspace --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features -- -D warnings
+
+clippy-all-wasm-client:
+	cargo clippy --workspace --manifest-path clients/webassembly/Cargo.toml --all-features --target wasm32-unknown-unknown -- -D warnings

 test-main:
-	cargo test --all-features --workspace
+	cargo test --workspace

 test-main-expensive:
-	cargo test --all-features --workspace -- --ignored
+	cargo test --workspace -- --ignored

 test-contracts:
 	cargo test --manifest-path contracts/Cargo.toml --all-features
@@ -52,14 +77,23 @@ test-wallet-expensive:
 	cargo test --manifest-path nym-wallet/Cargo.toml --all-features -- --ignored

 test-connect:
-	cargo test --manifest-path nym-connect/Cargo.toml --all-features
+	cargo test --manifest-path nym-connect/desktop/Cargo.toml --all-features

 test-connect-expensive:
-	cargo test --manifest-path nym-connect/Cargo.toml --all-features -- --ignored
+	cargo test --manifest-path nym-connect/desktop/Cargo.toml --all-features -- --ignored
+
+test-connect-mobile:
+	cargo test --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features
+
+test-connect-mobile-expensive:
+	cargo test --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features -- --ignored

 build-main:
 	cargo build --workspace

+build-main-examples:
+	cargo build --workspace --examples
+
 build-contracts:
 	cargo build --manifest-path contracts/Cargo.toml --workspace

@@ -67,7 +101,16 @@ build-wallet:
 	cargo build --manifest-path nym-wallet/Cargo.toml --workspace

 build-connect:
-	cargo build --manifest-path nym-connect/Cargo.toml --workspace
+	cargo build --manifest-path nym-connect/desktop/Cargo.toml --workspace
+
+build-connect-mobile:
+	cargo build --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --workspace
+
+build-explorer-api:
+	cargo build --manifest-path explorer-api/Cargo.toml --workspace
+
+build-wasm-client:
+	cargo build --manifest-path clients/webassembly/Cargo.toml --workspace --target wasm32-unknown-unknown

 build-nym-cli:
 	cargo build --release --manifest-path tools/nym-cli/Cargo.toml
@@ -82,11 +125,25 @@ fmt-wallet:
 	cargo fmt --manifest-path nym-wallet/Cargo.toml --all

 fmt-connect:
-	cargo fmt --manifest-path nym-connect/Cargo.toml --all
+	cargo fmt --manifest-path nym-connect/desktop/Cargo.toml --all
+
+fmt-connect-mobile:
+	cargo fmt --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all
+
+fmt-wasm-client:
+	cargo fmt --manifest-path clients/webassembly/Cargo.toml --all

 wasm:
 	RUSTFLAGS='-C link-arg=-s' cargo build --manifest-path contracts/Cargo.toml --release --target wasm32-unknown-unknown
+	wasm-opt -Os contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
+	wasm-opt -Os contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
+
+mixnet-opt: wasm
+	cd contracts/mixnet && make opt

 generate-typescript:
 	cd tools/ts-rs-cli && cargo run && cd ../..
 	yarn types:lint:fix
+
+run-api-tests:
+	cd nym-api/tests/functional_test && yarn test:qa
@@ -16,7 +16,7 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * nym-wallet - a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework. 

 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
-[![Build Status](https://img.shields.io/github/workflow/status/nymtech/nym/Continuous%20integration/develop?style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
+[![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)


 ### Building
@@ -1,35 +1,93 @@
 [package]
 name = "client-core"
-version = "1.0.1"
+version = "1.1.12"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
+rust-version = "1.66"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
+async-trait = { workspace = true }
 dirs = "4.0"
+dashmap = "5.4.0"
 futures = "0.3"
 humantime-serde = "1.0"
-log = "0.4"
+log = { workspace = true }
 rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 serde = { version = "1.0", features = ["derive"] }
-sled = "0.34"
-tokio = { version = "1.19.1", features = ["macros"] }
+serde_json = "1.0.89"
+tap = "1.0.1"
+thiserror = "1.0.34"
 url = { version ="2.2", features = ["serde"] }
+tungstenite = { version = "0.13.0", default-features = false }
+tokio = { version = "1.24.1", features = ["macros"]}
+time = "0.3.17"

 # internal
-config = { path = "../../common/config" }
-crypto = { path = "../../common/crypto" }
+nym-config = { path = "../../common/config" }
+nym-crypto = { path = "../../common/crypto" }
 gateway-client = { path = "../../common/client-libs/gateway-client" }
+#gateway-client = { path = "../../common/client-libs/gateway-client", default-features = false, features = ["wasm", "coconut"] }
 gateway-requests = { path = "../../gateway/gateway-requests" }
-nonexhaustive-delayqueue = { path = "../../common/nonexhaustive-delayqueue" }
-nymsphinx = { path = "../../common/nymsphinx" }
-pemstore = { path = "../../common/pemstore" }
-topology = { path = "../../common/topology" }
-validator-client = { path = "../../common/client-libs/validator-client" }
+nym-nonexhaustive-delayqueue = { path = "../../common/nonexhaustive-delayqueue" }
+nym-sphinx = { path = "../../common/nymsphinx" }
+nym-pemstore = { path = "../../common/pemstore" }
+nym-topology = { path = "../../common/topology" }
+validator-client = { path = "../../common/client-libs/validator-client", default-features = false }
+nym-task = { path = "../../common/task" }
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.validator-client]
+path = "../../common/client-libs/validator-client"
+features = ["nyxd-client"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
+version = "0.1.11"
+features = ["time"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio]
+version = "1.24.1"
+features = ["time"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
+version = "0.14"
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
+version = "0.6.2"
+features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"]
+optional = true
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen-futures]
+version = "0.4"
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]
+version = "0.2.83"
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.wasm-timer]
+git = "https://github.com/mmsinclair/wasm-timer"
+rev = "b9d1a54ad514c2f230a026afe0dde341e98cd7b6"
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.gloo-timers]
+version = "0.2.4"
+features = ["futures"]
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]
+path = "../../common/wasm-utils"
+features = ["websocket"]
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.time]
+version = "0.3.17"
+features = ["wasm-bindgen"]

 [dev-dependencies]
 tempfile = "3.1.0"

+[build-dependencies]
+tokio = { version = "1.24.1", features = ["rt-multi-thread", "macros"] }
+sqlx = { version = "0.6.2", features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
+
 [features]
-coconut = ["gateway-client/coconut", "gateway-requests/coconut"]
+default = []
+fs-surb-storage = ["sqlx"]
+wasm = ["gateway-client/wasm"]
+
@@ -0,0 +1,31 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#[tokio::main]
+async fn main() {
+    #[cfg(feature = "fs-surb-storage")]
+    {
+        use sqlx::{Connection, SqliteConnection};
+        use std::env;
+
+        let out_dir = env::var("OUT_DIR").unwrap();
+        let database_path = format!("{out_dir}/fs-surbs-example.sqlite");
+
+        let mut conn = SqliteConnection::connect(&format!("sqlite://{database_path}?mode=rwc"))
+            .await
+            .expect("Failed to create SQLx database connection");
+
+        sqlx::migrate!("./fs_surbs_migrations")
+            .run(&mut conn)
+            .await
+            .expect("Failed to perform SQLx migrations");
+
+        #[cfg(target_family = "unix")]
+        println!("cargo:rustc-env=DATABASE_URL=sqlite://{}", &database_path);
+
+        #[cfg(target_family = "windows")]
+        // for some strange reason we need to add a leading `/` to the windows path even though it's
+        // not a valid windows path... but hey, it works...
+        println!("cargo:rustc-env=DATABASE_URL=sqlite:///{}", &database_path);
+    }
+}
@@ -0,0 +1,40 @@
+CREATE TABLE status
+(
+    flush_in_progress        INTEGER NOT NULL,
+    previous_flush_timestamp INTEGER NOT NULL,
+    client_in_use            INTEGER NOT NULL
+);
+
+CREATE TABLE reply_surb_storage_metadata
+(
+    min_reply_surb_threshold INTEGER NOT NULL,
+    max_reply_surb_threshold INTEGER NOT NULL
+);
+
+CREATE TABLE sender_tag
+(
+    recipient BLOB NOT NULL UNIQUE,
+    tag       BLOB NOT NULL UNIQUE
+);
+
+CREATE TABLE reply_key
+(
+    key_digest        BLOB    NOT NULL UNIQUE,
+    reply_key         BLOB    NOT NULL UNIQUE,
+    sent_at_timestamp INTEGER NOT NULL
+);
+
+CREATE TABLE reply_surb_sender
+(
+    id                  INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    last_sent_timestamp INTEGER NOT NULL,
+    tag                 BLOB    NOT NULL UNIQUE
+);
+
+CREATE TABLE reply_surb
+(
+    reply_surb_sender_id INTEGER NOT NULL,
+    reply_surb           BLOB    NOT NULL,
+
+    FOREIGN KEY (reply_surb_sender_id) REFERENCES reply_surb_sender (id)
+);
@@ -0,0 +1,11 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+//
+use crate::{client::replies::reply_storage, config::DebugConfig};
+
+pub fn setup_empty_reply_surb_backend(debug_config: &DebugConfig) -> reply_storage::Empty {
+    reply_storage::Empty {
+        min_surb_threshold: debug_config.minimum_reply_surb_storage_threshold,
+        max_surb_threshold: debug_config.maximum_reply_surb_storage_threshold,
+    }
+}
@@ -0,0 +1,599 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
+use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
+use crate::client::key_manager::KeyManager;
+use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
+use crate::client::real_messages_control;
+use crate::client::real_messages_control::RealMessagesController;
+use crate::client::received_buffer::{
+    ReceivedBufferRequestReceiver, ReceivedBufferRequestSender, ReceivedMessagesBufferController,
+};
+use crate::client::replies::reply_controller;
+use crate::client::replies::reply_controller::{ReplyControllerReceiver, ReplyControllerSender};
+use crate::client::replies::reply_storage::{
+    CombinedReplyStorage, PersistentReplyStorage, ReplyStorageBackend, SentReplyKeys,
+};
+use crate::client::topology_control::nym_api_provider::NymApiTopologyProvider;
+use crate::client::topology_control::{
+    TopologyAccessor, TopologyRefresher, TopologyRefresherConfig,
+};
+use crate::config::{Config, DebugConfig, GatewayEndpointConfig};
+use crate::error::ClientCoreError;
+use crate::spawn_future;
+use futures::channel::mpsc;
+use gateway_client::bandwidth::BandwidthController;
+#[cfg(target_arch = "wasm32")]
+use gateway_client::wasm_mockups::CosmWasmClient;
+use gateway_client::{
+    AcknowledgementReceiver, AcknowledgementSender, GatewayClient, MixnetMessageReceiver,
+    MixnetMessageSender,
+};
+use log::{debug, info};
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_sphinx::acknowledgements::AckKey;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::addressing::nodes::NodeIdentity;
+use nym_sphinx::receiver::ReconstructedMessage;
+use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
+use nym_task::{TaskClient, TaskManager};
+use nym_topology::provider_trait::TopologyProvider;
+use std::sync::Arc;
+use std::time::Duration;
+use tap::TapFallible;
+use url::Url;
+
+#[cfg(not(target_arch = "wasm32"))]
+use validator_client::nyxd::CosmWasmClient;
+
+use super::received_buffer::ReceivedBufferMessage;
+
+#[cfg(all(not(target_arch = "wasm32"), feature = "fs-surb-storage"))]
+pub mod non_wasm_helpers;
+
+pub mod helpers;
+
+#[derive(Clone)]
+pub struct ClientInput {
+    pub connection_command_sender: ConnectionCommandSender,
+    pub input_sender: InputMessageSender,
+}
+
+impl ClientInput {
+    pub async fn send(
+        &self,
+        message: InputMessage,
+    ) -> Result<(), tokio::sync::mpsc::error::SendError<InputMessage>> {
+        self.input_sender.send(message).await
+    }
+}
+
+#[derive(Clone)]
+pub struct ClientOutput {
+    pub received_buffer_request_sender: ReceivedBufferRequestSender,
+}
+
+impl ClientOutput {
+    pub fn register_receiver(
+        &mut self,
+    ) -> Result<mpsc::UnboundedReceiver<Vec<ReconstructedMessage>>, ClientCoreError> {
+        let (reconstructed_sender, reconstructed_receiver) = mpsc::unbounded();
+
+        self.received_buffer_request_sender
+            .unbounded_send(ReceivedBufferMessage::ReceiverAnnounce(
+                reconstructed_sender,
+            ))
+            .map_err(|_| ClientCoreError::FailedToRegisterReceiver)?;
+
+        Ok(reconstructed_receiver)
+    }
+}
+
+pub struct ClientState {
+    pub shared_lane_queue_lengths: LaneQueueLengths,
+    pub reply_controller_sender: ReplyControllerSender,
+    pub topology_accessor: TopologyAccessor,
+}
+
+pub enum ClientInputStatus {
+    AwaitingProducer { client_input: ClientInput },
+    Connected,
+}
+
+impl ClientInputStatus {
+    pub fn register_producer(&mut self) -> ClientInput {
+        match std::mem::replace(self, ClientInputStatus::Connected) {
+            ClientInputStatus::AwaitingProducer { client_input } => client_input,
+            ClientInputStatus::Connected => panic!("producer was already registered before"),
+        }
+    }
+}
+
+pub enum ClientOutputStatus {
+    AwaitingConsumer { client_output: ClientOutput },
+    Connected,
+}
+
+impl ClientOutputStatus {
+    pub fn register_consumer(&mut self) -> ClientOutput {
+        match std::mem::replace(self, ClientOutputStatus::Connected) {
+            ClientOutputStatus::AwaitingConsumer { client_output } => client_output,
+            ClientOutputStatus::Connected => panic!("consumer was already registered before"),
+        }
+    }
+}
+
+#[derive(Copy, Clone, PartialEq, Eq)]
+pub enum CredentialsToggle {
+    Enabled,
+    Disabled,
+}
+
+impl CredentialsToggle {
+    pub fn is_enabled(&self) -> bool {
+        self == &CredentialsToggle::Enabled
+    }
+
+    pub fn is_disabled(&self) -> bool {
+        self == &CredentialsToggle::Disabled
+    }
+}
+
+impl From<bool> for CredentialsToggle {
+    fn from(value: bool) -> Self {
+        if value {
+            CredentialsToggle::Enabled
+        } else {
+            CredentialsToggle::Disabled
+        }
+    }
+}
+
+pub struct BaseClientBuilder<'a, B, C: Clone> {
+    // due to wasm limitations I had to split it like this : (
+    gateway_config: &'a GatewayEndpointConfig,
+    debug_config: &'a DebugConfig,
+    disabled_credentials: bool,
+    nym_api_endpoints: Vec<Url>,
+    reply_storage_backend: B,
+
+    custom_topology_provider: Option<Box<dyn TopologyProvider>>,
+    bandwidth_controller: Option<BandwidthController<C>>,
+    key_manager: KeyManager,
+}
+
+impl<'a, B, C> BaseClientBuilder<'a, B, C>
+where
+    B: ReplyStorageBackend + Send + Sync + 'static,
+    C: CosmWasmClient + Sync + Send + Clone + 'static,
+{
+    pub fn new_from_base_config<T>(
+        base_config: &'a Config<T>,
+        key_manager: KeyManager,
+        bandwidth_controller: Option<BandwidthController<C>>,
+        reply_storage_backend: B,
+    ) -> BaseClientBuilder<'a, B, C> {
+        BaseClientBuilder {
+            gateway_config: base_config.get_gateway_endpoint_config(),
+            debug_config: base_config.get_debug_config(),
+            disabled_credentials: base_config.get_disabled_credentials_mode(),
+            nym_api_endpoints: base_config.get_nym_api_endpoints(),
+            bandwidth_controller,
+            reply_storage_backend,
+            key_manager,
+            custom_topology_provider: None,
+        }
+    }
+
+    pub fn new(
+        gateway_config: &'a GatewayEndpointConfig,
+        debug_config: &'a DebugConfig,
+        key_manager: KeyManager,
+        bandwidth_controller: Option<BandwidthController<C>>,
+        reply_storage_backend: B,
+        credentials_toggle: CredentialsToggle,
+        nym_api_endpoints: Vec<Url>,
+    ) -> BaseClientBuilder<'a, B, C> {
+        BaseClientBuilder {
+            gateway_config,
+            debug_config,
+            disabled_credentials: credentials_toggle.is_disabled(),
+            nym_api_endpoints,
+            reply_storage_backend,
+            custom_topology_provider: None,
+            bandwidth_controller,
+            key_manager,
+        }
+    }
+
+    pub fn with_topology_provider(mut self, provider: Box<dyn TopologyProvider>) -> Self {
+        self.custom_topology_provider = Some(provider);
+        self
+    }
+
+    pub fn as_mix_recipient(&self) -> Recipient {
+        Recipient::new(
+            *self.key_manager.identity_keypair().public_key(),
+            *self.key_manager.encryption_keypair().public_key(),
+            // TODO: below only works under assumption that gateway address == gateway id
+            // (which currently is true)
+            NodeIdentity::from_base58_string(&self.gateway_config.gateway_id).unwrap(),
+        )
+    }
+
+    // future constantly pumping loop cover traffic at some specified average rate
+    // the pumped traffic goes to the MixTrafficController
+    fn start_cover_traffic_stream(
+        debug_config: &DebugConfig,
+        ack_key: Arc<AckKey>,
+        self_address: Recipient,
+        topology_accessor: TopologyAccessor,
+        mix_tx: BatchMixMessageSender,
+        shutdown: TaskClient,
+    ) {
+        info!("Starting loop cover traffic stream...");
+
+        let mut stream = LoopCoverTrafficStream::new(
+            ack_key,
+            debug_config.average_ack_delay,
+            debug_config.average_packet_delay,
+            debug_config.loop_cover_traffic_average_delay,
+            mix_tx,
+            self_address,
+            topology_accessor,
+        );
+
+        if let Some(size) = debug_config.use_extended_packet_size {
+            log::debug!("Setting extended packet size: {:?}", size);
+            stream.set_custom_packet_size(size.into());
+        }
+
+        stream.start_with_shutdown(shutdown);
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn start_real_traffic_controller(
+        controller_config: real_messages_control::Config,
+        topology_accessor: TopologyAccessor,
+        ack_receiver: AcknowledgementReceiver,
+        input_receiver: InputMessageReceiver,
+        mix_sender: BatchMixMessageSender,
+        reply_storage: CombinedReplyStorage,
+        reply_controller_sender: ReplyControllerSender,
+        reply_controller_receiver: ReplyControllerReceiver,
+        lane_queue_lengths: LaneQueueLengths,
+        client_connection_rx: ConnectionCommandReceiver,
+        shutdown: TaskClient,
+    ) {
+        info!("Starting real traffic stream...");
+
+        RealMessagesController::new(
+            controller_config,
+            ack_receiver,
+            input_receiver,
+            mix_sender,
+            topology_accessor,
+            reply_storage,
+            reply_controller_sender,
+            reply_controller_receiver,
+            lane_queue_lengths,
+            client_connection_rx,
+        )
+        .start_with_shutdown(shutdown);
+    }
+
+    // buffer controlling all messages fetched from provider
+    // required so that other components would be able to use them (say the websocket)
+    fn start_received_messages_buffer_controller(
+        local_encryption_keypair: Arc<encryption::KeyPair>,
+        query_receiver: ReceivedBufferRequestReceiver,
+        mixnet_receiver: MixnetMessageReceiver,
+        reply_key_storage: SentReplyKeys,
+        reply_controller_sender: ReplyControllerSender,
+        shutdown: TaskClient,
+    ) {
+        info!("Starting received messages buffer controller...");
+        ReceivedMessagesBufferController::new(
+            local_encryption_keypair,
+            query_receiver,
+            mixnet_receiver,
+            reply_key_storage,
+            reply_controller_sender,
+        )
+        .start_with_shutdown(shutdown)
+    }
+
+    async fn start_gateway_client(
+        &mut self,
+        mixnet_message_sender: MixnetMessageSender,
+        ack_sender: AcknowledgementSender,
+        shutdown: TaskClient,
+    ) -> Result<GatewayClient<C>, ClientCoreError> {
+        let gateway_id = self.gateway_config.gateway_id.clone();
+        if gateway_id.is_empty() {
+            return Err(ClientCoreError::GatewayIdUnknown);
+        }
+        let gateway_address = self.gateway_config.gateway_listener.clone();
+        if gateway_address.is_empty() {
+            return Err(ClientCoreError::GatewayAddressUnknown);
+        }
+
+        let gateway_identity = identity::PublicKey::from_base58_string(gateway_id)
+            .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;
+
+        // disgusting wasm workaround since there's no key persistence there (nor `client init`)
+        let shared_key = if self.key_manager.is_gateway_key_set() {
+            Some(self.key_manager.gateway_shared_key())
+        } else {
+            log::info!("Gateway key not set! Will proceed anyway.");
+            None
+        };
+
+        let mut gateway_client = GatewayClient::new(
+            gateway_address,
+            self.key_manager.identity_keypair(),
+            gateway_identity,
+            shared_key,
+            mixnet_message_sender,
+            ack_sender,
+            self.debug_config.gateway_response_timeout,
+            self.bandwidth_controller.take(),
+            shutdown,
+        );
+
+        gateway_client.set_disabled_credentials_mode(self.disabled_credentials);
+
+        gateway_client
+            .authenticate_and_start()
+            .await
+            .tap_err(|err| {
+                log::error!("Could not authenticate and start up the gateway connection - {err}")
+            })?;
+        Ok(gateway_client)
+    }
+
+    fn setup_topology_provider(
+        custom_provider: Option<Box<dyn TopologyProvider>>,
+        nym_api_urls: Vec<Url>,
+    ) -> Box<dyn TopologyProvider> {
+        // if no custom provider was ... provided ..., create one using nym-api
+        custom_provider.unwrap_or_else(|| {
+            Box::new(NymApiTopologyProvider::new(
+                nym_api_urls,
+                env!("CARGO_PKG_VERSION").to_string(),
+            ))
+        })
+    }
+
+    // future responsible for periodically polling directory server and updating
+    // the current global view of topology
+    async fn start_topology_refresher(
+        topology_provider: Box<dyn TopologyProvider>,
+        refresh_rate: Duration,
+        topology_accessor: TopologyAccessor,
+        shutdown: TaskClient,
+    ) -> Result<(), ClientCoreError> {
+        let topology_refresher_config = TopologyRefresherConfig::new(refresh_rate);
+
+        let mut topology_refresher = TopologyRefresher::new(
+            topology_refresher_config,
+            topology_accessor,
+            topology_provider,
+        );
+        // before returning, block entire runtime to refresh the current network view so that any
+        // components depending on topology would see a non-empty view
+        info!("Obtaining initial network topology");
+        topology_refresher.try_refresh().await;
+
+        if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
+            log::error!(
+                "The current network topology seem to be insufficient to route any packets through \
+                - check if enough nodes and a gateway are online - source: {err}"
+            );
+            return Err(ClientCoreError::InsufficientNetworkTopology(err));
+        }
+
+        info!("Starting topology refresher...");
+        topology_refresher.start_with_shutdown(shutdown);
+        Ok(())
+    }
+
+    // controller for sending sphinx packets to mixnet (either real traffic or cover traffic)
+    // TODO: if we want to send control messages to gateway_client, this CAN'T take the ownership
+    // over it. Perhaps GatewayClient needs to be thread-shareable or have some channel for
+    // requests?
+    fn start_mix_traffic_controller(
+        gateway_client: GatewayClient<C>,
+        shutdown: TaskClient,
+    ) -> BatchMixMessageSender {
+        info!("Starting mix traffic controller...");
+        let (mix_traffic_controller, mix_tx) = MixTrafficController::new(gateway_client);
+        mix_traffic_controller.start_with_shutdown(shutdown);
+        mix_tx
+    }
+
+    async fn setup_persistent_reply_storage(
+        backend: B,
+        shutdown: TaskClient,
+    ) -> Result<CombinedReplyStorage, ClientCoreError>
+    where
+        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+    {
+        if backend.is_active() {
+            log::trace!("Setup persistent reply storage");
+            let persistent_storage = PersistentReplyStorage::new(backend);
+            let mem_store = persistent_storage
+                .load_state_from_backend()
+                .await
+                .map_err(|err| ClientCoreError::SurbStorageError {
+                    source: Box::new(err),
+                })?;
+
+            let store_clone = mem_store.clone();
+            spawn_future(async move {
+                persistent_storage
+                    .flush_on_shutdown(store_clone, shutdown)
+                    .await
+            });
+
+            Ok(mem_store)
+        } else {
+            log::trace!("Setup inactive reply storage");
+            Ok(backend
+                .get_inactive_storage()
+                .map_err(|err| ClientCoreError::SurbStorageError {
+                    source: Box::new(err),
+                })?)
+        }
+    }
+
+    pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
+    where
+        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+    {
+        info!("Starting nym client");
+        // channels for inter-component communication
+        // TODO: make the channels be internally created by the relevant components
+        // rather than creating them here, so say for example the buffer controller would create the request channels
+        // and would allow anyone to clone the sender channel
+
+        // unwrapped_sphinx_sender is the transmitter of mixnet messages received from the gateway
+        // unwrapped_sphinx_receiver is the receiver for said messages - used by ReceivedMessagesBuffer
+        let (mixnet_messages_sender, mixnet_messages_receiver) = mpsc::unbounded();
+
+        // used for announcing connection or disconnection of a channel for pushing re-assembled messages to
+        let (received_buffer_request_sender, received_buffer_request_receiver) = mpsc::unbounded();
+
+        // channels responsible for controlling real messages
+        let (input_sender, input_receiver) = tokio::sync::mpsc::channel::<InputMessage>(1);
+
+        // channels responsible for controlling ack messages
+        let (ack_sender, ack_receiver) = mpsc::unbounded();
+        let shared_topology_accessor = TopologyAccessor::new();
+
+        // Shutdown notifier for signalling tasks to stop
+        let task_manager = TaskManager::default();
+
+        // channels responsible for dealing with reply-related fun
+        let (reply_controller_sender, reply_controller_receiver) =
+            reply_controller::requests::new_control_channels();
+
+        let self_address = self.as_mix_recipient();
+
+        // the components are started in very specific order. Unless you know what you are doing,
+        // do not change that.
+        let gateway_client = self
+            .start_gateway_client(mixnet_messages_sender, ack_sender, task_manager.subscribe())
+            .await?;
+
+        let reply_storage = Self::setup_persistent_reply_storage(
+            self.reply_storage_backend,
+            task_manager.subscribe(),
+        )
+        .await?;
+
+        let topology_provider = Self::setup_topology_provider(
+            self.custom_topology_provider.take(),
+            self.nym_api_endpoints,
+        );
+        Self::start_topology_refresher(
+            topology_provider,
+            self.debug_config.topology_refresh_rate,
+            shared_topology_accessor.clone(),
+            task_manager.subscribe(),
+        )
+        .await?;
+
+        Self::start_received_messages_buffer_controller(
+            self.key_manager.encryption_keypair(),
+            received_buffer_request_receiver,
+            mixnet_messages_receiver,
+            reply_storage.key_storage(),
+            reply_controller_sender.clone(),
+            task_manager.subscribe(),
+        );
+
+        // The sphinx_message_sender is the transmitter for any component generating sphinx packets
+        // that are to be sent to the mixnet. They are used by cover traffic stream and real
+        // traffic stream.
+        // The MixTrafficController then sends the actual traffic
+        let sphinx_message_sender =
+            Self::start_mix_traffic_controller(gateway_client, task_manager.subscribe());
+
+        // Channels that the websocket listener can use to signal downstream to the real traffic
+        // controller that connections are closed.
+        let (client_connection_tx, client_connection_rx) = mpsc::unbounded();
+
+        // Shared queue length data. Published by the `OutQueueController` in the client, and used
+        // primarily to throttle incoming connections (e.g socks5 for attached network-requesters)
+        let shared_lane_queue_lengths = LaneQueueLengths::new();
+
+        let mut controller_config = real_messages_control::Config::new(
+            self.debug_config,
+            self.key_manager.ack_key(),
+            self_address,
+        );
+
+        if let Some(size) = self.debug_config.use_extended_packet_size {
+            log::debug!("Setting extended packet size: {:?}", size);
+            controller_config.set_custom_packet_size(size.into());
+        }
+
+        Self::start_real_traffic_controller(
+            controller_config,
+            shared_topology_accessor.clone(),
+            ack_receiver,
+            input_receiver,
+            sphinx_message_sender.clone(),
+            reply_storage,
+            reply_controller_sender.clone(),
+            reply_controller_receiver,
+            shared_lane_queue_lengths.clone(),
+            client_connection_rx,
+            task_manager.subscribe(),
+        );
+
+        if !self.debug_config.disable_loop_cover_traffic_stream {
+            Self::start_cover_traffic_stream(
+                self.debug_config,
+                self.key_manager.ack_key(),
+                self_address,
+                shared_topology_accessor.clone(),
+                sphinx_message_sender,
+                task_manager.subscribe(),
+            );
+        }
+
+        debug!("Core client startup finished!");
+        debug!("The address of this client is: {self_address}");
+
+        Ok(BaseClient {
+            client_input: ClientInputStatus::AwaitingProducer {
+                client_input: ClientInput {
+                    connection_command_sender: client_connection_tx,
+                    input_sender,
+                },
+            },
+            client_output: ClientOutputStatus::AwaitingConsumer {
+                client_output: ClientOutput {
+                    received_buffer_request_sender,
+                },
+            },
+            client_state: ClientState {
+                shared_lane_queue_lengths,
+                reply_controller_sender,
+                topology_accessor: shared_topology_accessor,
+            },
+            task_manager,
+        })
+    }
+}
+
+pub struct BaseClient {
+    pub client_input: ClientInputStatus,
+    pub client_output: ClientOutputStatus,
+    pub client_state: ClientState,
+
+    pub task_manager: TaskManager,
+}
@@ -0,0 +1,100 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::replies::reply_storage::{
+    fs_backend, CombinedReplyStorage, ReplyStorageBackend,
+};
+use crate::config::DebugConfig;
+use crate::error::ClientCoreError;
+use log::{error, info};
+use std::path::Path;
+use std::{fs, io};
+use time::OffsetDateTime;
+
+async fn setup_fresh_backend<P: AsRef<Path>>(
+    db_path: P,
+    debug_config: &DebugConfig,
+) -> Result<fs_backend::Backend, ClientCoreError> {
+    info!("creating fresh surb database");
+    let mut storage_backend = match fs_backend::Backend::init(db_path).await {
+        Ok(backend) => backend,
+        Err(err) => {
+            error!("failed to setup persistent storage backend for our reply needs: {err}");
+            return Err(ClientCoreError::SurbStorageError {
+                source: Box::new(err),
+            });
+        }
+    };
+
+    // while I kinda hate that we're going to be creating `CombinedReplyStorage` twice,
+    // it will only be happening on the very first run and in practice won't incur huge
+    // costs since the storage is going to be empty
+    let mem_store = CombinedReplyStorage::new(
+        debug_config.minimum_reply_surb_storage_threshold,
+        debug_config.maximum_reply_surb_storage_threshold,
+    );
+    storage_backend
+        .init_fresh(&mem_store)
+        .await
+        .map_err(|err| ClientCoreError::SurbStorageError {
+            source: Box::new(err),
+        })?;
+
+    Ok(storage_backend)
+}
+
+fn setup_inactive_backend(debug_config: &DebugConfig) -> fs_backend::Backend {
+    info!("creating inactive surb database");
+    fs_backend::Backend::new_inactive(
+        debug_config.minimum_reply_surb_storage_threshold,
+        debug_config.maximum_reply_surb_storage_threshold,
+    )
+}
+
+fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
+    let db_path = db_path.as_ref();
+    debug_assert!(db_path.exists());
+
+    let now = OffsetDateTime::now_utc().unix_timestamp();
+
+    let suffix = format!("_{now}.corrupted");
+
+    let new_extension =
+        if let Some(existing_extension) = db_path.extension().and_then(|ext| ext.to_str()) {
+            format!("{existing_extension}.{suffix}")
+        } else {
+            suffix
+        };
+
+    let mut renamed = db_path.to_owned();
+    renamed.set_extension(new_extension);
+
+    fs::rename(db_path, renamed)
+}
+
+pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
+    db_path: Option<P>,
+    debug_config: &DebugConfig,
+) -> Result<fs_backend::Backend, ClientCoreError> {
+    if let Some(db_path) = db_path {
+        // if the database file doesnt exist, initialise fresh storage, otherwise attempt to load
+        // the existing one
+        let db_path = db_path.as_ref();
+        if db_path.exists() {
+            info!("loading existing surb database");
+            match fs_backend::Backend::try_load(db_path).await {
+                Ok(backend) => Ok(backend),
+                Err(err) => {
+                    error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
+
+                    archive_corrupted_database(db_path)?;
+                    setup_fresh_backend(db_path, debug_config).await
+                }
+            }
+        } else {
+            setup_fresh_backend(db_path, debug_config).await
+        }
+    } else {
+        Ok(setup_inactive_backend(debug_config))
+    }
+}
@@ -3,19 +3,27 @@

 use crate::client::mix_traffic::BatchMixMessageSender;
 use crate::client::topology_control::TopologyAccessor;
+use crate::spawn_future;
 use futures::task::{Context, Poll};
 use futures::{Future, Stream, StreamExt};
 use log::*;
-use nymsphinx::acknowledgements::AckKey;
-use nymsphinx::addressing::clients::Recipient;
-use nymsphinx::cover::generate_loop_cover_packet;
-use nymsphinx::utils::sample_poisson_duration;
+use nym_sphinx::acknowledgements::AckKey;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::cover::generate_loop_cover_packet;
+use nym_sphinx::params::PacketSize;
+use nym_sphinx::utils::sample_poisson_duration;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::pin::Pin;
 use std::sync::Arc;
-use tokio::task::JoinHandle;
+use std::time::Duration;
+use tokio::sync::mpsc::error::TrySendError;
+
+#[cfg(not(target_arch = "wasm32"))]
 use tokio::time;

+#[cfg(target_arch = "wasm32")]
+use wasm_timer;
+
 pub struct LoopCoverTrafficStream<R>
 where
    R: CryptoRng + Rng,
@@ -24,18 +32,22 @@ where
    ack_key: Arc<AckKey>,

    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
-    average_ack_delay: time::Duration,
+    average_ack_delay: Duration,

    /// Average delay a data packet is going to get delay at a single mixnode.
-    average_packet_delay: time::Duration,
+    average_packet_delay: Duration,

    /// Average delay between sending subsequent cover packets.
-    average_cover_message_sending_delay: time::Duration,
+    average_cover_message_sending_delay: Duration,

    /// Internal state, determined by `average_message_sending_delay`,
    /// used to keep track of when a next packet should be sent out.
+    #[cfg(not(target_arch = "wasm32"))]
    next_delay: Pin<Box<time::Sleep>>,

+    #[cfg(target_arch = "wasm32")]
+    next_delay: Pin<Box<wasm_timer::Delay>>,
+
    /// Channel used for sending prepared sphinx packets to `MixTrafficController` that sends them
    /// out to the network without any further delays.
    mix_tx: BatchMixMessageSender,
@@ -48,6 +60,9 @@ where

    /// Accessor to the common instance of network topology.
    topology_access: TopologyAccessor,
+
+    /// Predefined packet size used for the loop cover messages.
+    packet_size: PacketSize,
 }

 impl<R> Stream for LoopCoverTrafficStream<R>
@@ -69,13 +84,21 @@ where
        // we know it's time to send a message, so let's prepare delay for the next one
        // Get the `now` by looking at the current `delay` deadline
        let avg_delay = self.average_cover_message_sending_delay;
-        let now = self.next_delay.deadline();
        let next_poisson_delay = sample_poisson_duration(&mut self.rng, avg_delay);

        // The next interval value is `next_poisson_delay` after the one that just
        // yielded.
-        let next = now + next_poisson_delay;
-        self.next_delay.as_mut().reset(next);
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let now = self.next_delay.deadline();
+            let next = now + next_poisson_delay;
+            self.next_delay.as_mut().reset(next);
+        }
+
+        #[cfg(target_arch = "wasm32")]
+        {
+            self.next_delay.as_mut().reset(next_poisson_delay);
+        }

        Poll::Ready(Some(()))
    }
@@ -84,30 +107,52 @@ where
 // obviously when we finally make shared rng that is on 'higher' level, this should become
 // generic `R`
 impl LoopCoverTrafficStream<OsRng> {
+    #[allow(clippy::too_many_arguments)]
    pub fn new(
        ack_key: Arc<AckKey>,
-        average_ack_delay: time::Duration,
-        average_packet_delay: time::Duration,
-        average_cover_message_sending_delay: time::Duration,
+        average_ack_delay: Duration,
+        average_packet_delay: Duration,
+        average_cover_message_sending_delay: Duration,
        mix_tx: BatchMixMessageSender,
        our_full_destination: Recipient,
        topology_access: TopologyAccessor,
    ) -> Self {
        let rng = OsRng;

+        #[cfg(not(target_arch = "wasm32"))]
+        let next_delay = Box::pin(time::sleep(Default::default()));
+
+        #[cfg(target_arch = "wasm32")]
+        let next_delay = Box::pin(wasm_timer::Delay::new(Default::default()));
+
        LoopCoverTrafficStream {
            ack_key,
            average_ack_delay,
            average_packet_delay,
            average_cover_message_sending_delay,
-            next_delay: Box::pin(time::sleep(Default::default())),
+            next_delay,
            mix_tx,
            our_full_destination,
            rng,
            topology_access,
+            packet_size: Default::default(),
        }
    }

+    pub fn set_custom_packet_size(&mut self, packet_size: PacketSize) {
+        self.packet_size = packet_size;
+    }
+
+    fn set_next_delay(&mut self, amount: Duration) {
+        #[cfg(not(target_arch = "wasm32"))]
+        let next_delay = Box::pin(time::sleep(amount));
+
+        #[cfg(target_arch = "wasm32")]
+        let next_delay = Box::pin(wasm_timer::Delay::new(amount));
+
+        self.next_delay = next_delay;
+    }
+
    async fn on_new_message(&mut self) {
        trace!("next cover message!");

@@ -116,31 +161,44 @@ impl LoopCoverTrafficStream<OsRng> {
        // poisson delay, but is it really a problem?
        let topology_permit = self.topology_access.get_read_permit().await;
        // the ack is sent back to ourselves (and then ignored)
-        let topology_ref_option = topology_permit.try_get_valid_topology_ref(
+        let topology_ref = match topology_permit.try_get_valid_topology_ref(
            &self.our_full_destination,
            Some(&self.our_full_destination),
-        );
-        if topology_ref_option.is_none() {
-            warn!("No valid topology detected - won't send any loop cover message this time");
-            return;
-        }
-        let topology_ref = topology_ref_option.unwrap();
+        ) {
+            Ok(topology) => topology,
+            Err(err) => {
+                warn!("We're not going to send any loop cover message this time, as the current topology seem to be invalid - {err}");
+                return;
+            }
+        };

        let cover_message = generate_loop_cover_packet(
            &mut self.rng,
            topology_ref,
-            &*self.ack_key,
+            &self.ack_key,
            &self.our_full_destination,
            self.average_ack_delay,
            self.average_packet_delay,
+            self.packet_size,
        )
        .expect("Somehow failed to generate a loop cover message with a valid topology");

-        // if this one fails, there's no retrying because it means that either:
-        // - we run out of memory
-        // - the receiver channel is closed
-        // in either case there's no recovery and we can only panic
-        self.mix_tx.unbounded_send(vec![cover_message]).unwrap();
+        if let Err(err) = self.mix_tx.try_send(vec![cover_message]) {
+            match err {
+                TrySendError::Full(_) => {
+                    // This isn't a problem, if the channel is full means we're already sending the
+                    // max amount of messages downstream can handle.
+                    log::debug!("Failed to send cover message - channel full");
+                    // However it's still useful to alert the user that the gateway or the link to
+                    // the gateway can't keep up. Either due to insufficient bandwidth on the
+                    // client side, or that the gateway is overloaded.
+                    log::warn!("Failed to send sphinx packet - gateway or connection to gateway can't keep up");
+                }
+                TrySendError::Closed(_) => {
+                    log::warn!("Failed to send cover message - channel closed");
+                }
+            }
+        }

        // TODO: I'm not entirely sure whether this is really required, because I'm not 100%
        // sure how `yield_now()` works - whether it just notifies the scheduler or whether it
@@ -149,24 +207,39 @@ impl LoopCoverTrafficStream<OsRng> {

        // JS: due to identical logical structure to OutQueueControl::on_message(), this is also
        // presumably required to prevent bugs in the future. Exact reason is still unknown to me.
+
+        // TODO: temporary and BAD workaround for wasm (we should find a way to yield here in wasm)
+        #[cfg(not(target_arch = "wasm32"))]
        tokio::task::yield_now().await;
    }

-    async fn run(&mut self) {
+    pub fn start_with_shutdown(mut self, mut shutdown: nym_task::TaskClient) {
        // we should set initial delay only when we actually start the stream
-        self.next_delay = Box::pin(time::sleep(sample_poisson_duration(
-            &mut self.rng,
-            self.average_cover_message_sending_delay,
-        )));
+        let sampled =
+            sample_poisson_duration(&mut self.rng, self.average_cover_message_sending_delay);
+        self.set_next_delay(sampled);

-        while self.next().await.is_some() {
-            self.on_new_message().await;
-        }
-    }
+        spawn_future(async move {
+            debug!("Started LoopCoverTrafficStream with graceful shutdown support");

-    pub fn start(mut self) -> JoinHandle<()> {
-        tokio::spawn(async move {
-            self.run().await;
+            while !shutdown.is_shutdown() {
+                tokio::select! {
+                    biased;
+                    _ = shutdown.recv() => {
+                        log::trace!("LoopCoverTrafficStream: Received shutdown");
+                    }
+                    next = self.next() => {
+                        if next.is_some() {
+                            self.on_new_message().await;
+                        } else {
+                            log::trace!("LoopCoverTrafficStream: Stopping since channel closed");
+                            break;
+                        }
+                    }
+                }
+            }
+            shutdown.recv_timeout().await;
+            log::debug!("LoopCoverTrafficStream: Exiting");
        })
    }
 }
@@ -0,0 +1,14 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#[cfg(not(target_arch = "wasm32"))]
+mod non_wasm;
+
+#[cfg(target_arch = "wasm32")]
+mod wasm;
+
+#[cfg(not(target_arch = "wasm32"))]
+pub use non_wasm::*;
+
+#[cfg(target_arch = "wasm32")]
+pub use wasm::*;
@@ -0,0 +1,13 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub use tokio::time::*;
+pub type IntervalStream = tokio_stream::wrappers::IntervalStream;
+
+pub(crate) fn get_time_now() -> Instant {
+    Instant::now()
+}
+
+pub(crate) fn new_interval_stream(polling_rate: Duration) -> IntervalStream {
+    tokio_stream::wrappers::IntervalStream::new(tokio::time::interval(polling_rate))
+}
@@ -0,0 +1,16 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::time::Duration;
+use wasm_timer;
+
+pub use wasm_timer::*;
+pub type IntervalStream = gloo_timers::future::IntervalStream;
+
+pub(crate) fn get_time_now() -> Instant {
+    wasm_timer::Instant::now()
+}
+
+pub(crate) fn new_interval_stream(polling_rate: Duration) -> IntervalStream {
+    gloo_timers::future::IntervalStream::new(polling_rate.as_millis() as u32)
+}
@@ -1,33 +1,88 @@
-use futures::channel::mpsc;
-use nymsphinx::addressing::clients::Recipient;
-use nymsphinx::anonymous_replies::ReplySurb;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_task::connections::TransmissionLane;

-pub type InputMessageSender = mpsc::UnboundedSender<InputMessage>;
-pub type InputMessageReceiver = mpsc::UnboundedReceiver<InputMessage>;
+pub type InputMessageSender = tokio::sync::mpsc::Sender<InputMessage>;
+pub type InputMessageReceiver = tokio::sync::mpsc::Receiver<InputMessage>;

 #[derive(Debug)]
 pub enum InputMessage {
-    Fresh {
+    /// The simplest message variant where no additional information is attached.
+    /// You're simply sending your `data` to specified `recipient` without any tagging.
+    ///
+    /// Ends up with `NymMessage::Plain` variant
+    Regular {
        recipient: Recipient,
        data: Vec<u8>,
-        with_reply_surb: bool,
+        lane: TransmissionLane,
    },
-    Reply {
-        reply_surb: ReplySurb,
+
+    /// Creates a message used for a duplex anonymous communication where the recipient
+    /// will never learn of our true identity. This is achieved by carefully sending `reply_surbs`.
+    ///
+    /// Note that if reply_surbs is set to zero then
+    /// this variant requires the client having sent some reply_surbs in the past
+    /// (and thus the recipient also knowing our sender tag).
+    ///
+    /// Ends up with `NymMessage::Repliable` variant
+    Anonymous {
+        recipient: Recipient,
        data: Vec<u8>,
+        reply_surbs: u32,
+        lane: TransmissionLane,
+    },
+
+    /// Attempt to use our internally received and stored `ReplySurb` to send the message back
+    /// to specified recipient whilst not knowing its full identity (or even gateway).
+    ///
+    /// Ends up with `NymMessage::Reply` variant
+    Reply {
+        recipient_tag: AnonymousSenderTag,
+        data: Vec<u8>,
+        lane: TransmissionLane,
    },
 }

 impl InputMessage {
-    pub fn new_fresh(recipient: Recipient, data: Vec<u8>, with_reply_surb: bool) -> Self {
-        InputMessage::Fresh {
+    pub fn new_regular(recipient: Recipient, data: Vec<u8>, lane: TransmissionLane) -> Self {
+        InputMessage::Regular {
            recipient,
            data,
-            with_reply_surb,
+            lane,
        }
    }

-    pub fn new_reply(reply_surb: ReplySurb, data: Vec<u8>) -> Self {
-        InputMessage::Reply { reply_surb, data }
+    pub fn new_anonymous(
+        recipient: Recipient,
+        data: Vec<u8>,
+        reply_surbs: u32,
+        lane: TransmissionLane,
+    ) -> Self {
+        InputMessage::Anonymous {
+            recipient,
+            data,
+            reply_surbs,
+            lane,
+        }
+    }
+
+    pub fn new_reply(
+        recipient_tag: AnonymousSenderTag,
+        data: Vec<u8>,
+        lane: TransmissionLane,
+    ) -> Self {
+        InputMessage::Reply {
+            recipient_tag,
+            data,
+            lane,
+        }
+    }
+
+    pub fn lane(&self) -> &TransmissionLane {
+        match self {
+            InputMessage::Regular { lane, .. }
+            | InputMessage::Anonymous { lane, .. }
+            | InputMessage::Reply { lane, .. } => lane,
+        }
    }
 }
@@ -2,10 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::config::persistence::key_pathfinder::ClientKeyPathfinder;
-use crypto::asymmetric::{encryption, identity};
 use gateway_requests::registration::handshake::SharedKeys;
 use log::*;
-use nymsphinx::acknowledgements::AckKey;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_sphinx::acknowledgements::AckKey;
 use rand::{CryptoRng, RngCore};
 use std::io;
 use std::sync::Arc;
@@ -17,6 +17,7 @@ use std::sync::Arc;
 // use the old key after new one was issued.

 // Remember that Arc<T> has Deref implementation for T
+#[derive(Clone)]
 pub struct KeyManager {
    /// identity key associated with the client instance.
    identity_keypair: Arc<identity::KeyPair>,
@@ -41,9 +42,6 @@ pub struct KeyManager {
 */

 impl KeyManager {
-    // this is actually **NOT** dead code
-    // I have absolutely no idea why the compiler insists it's unused. The call happens during client::init::execute
-    #[allow(dead_code)]
    /// Creates new instance of a [`KeyManager`]
    pub fn new<R>(rng: &mut R) -> Self
    where
@@ -57,87 +55,161 @@ impl KeyManager {
        }
    }

-    // this is actually **NOT** dead code
-    // I have absolutely no idea why the compiler insists it's unused. The call happens during client::init::execute
-    #[allow(dead_code)]
-    /// After shared key with the gateway is derived, puts its ownership to this instance of a [`KeyManager`].
-    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: Arc<SharedKeys>) {
-        self.gateway_shared_key = Some(gateway_shared_key)
+    pub fn from_keys(
+        id_keypair: identity::KeyPair,
+        enc_keypair: encryption::KeyPair,
+        gateway_shared_key: SharedKeys,
+        ack_key: AckKey,
+    ) -> Self {
+        Self {
+            identity_keypair: Arc::new(id_keypair),
+            encryption_keypair: Arc::new(enc_keypair),
+            gateway_shared_key: Some(Arc::new(gateway_shared_key)),
+            ack_key: Arc::new(ack_key),
+        }
    }

-    /// Loads previously stored keys from the disk.
-    pub fn load_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
+    /// Loads previously stored client keys from the disk.
+    fn load_client_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
        let identity_keypair: identity::KeyPair =
-            pemstore::load_keypair(&pemstore::KeyPairPath::new(
+            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
                client_pathfinder.private_identity_key().to_owned(),
                client_pathfinder.public_identity_key().to_owned(),
            ))?;
        let encryption_keypair: encryption::KeyPair =
-            pemstore::load_keypair(&pemstore::KeyPairPath::new(
+            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
                client_pathfinder.private_encryption_key().to_owned(),
                client_pathfinder.public_encryption_key().to_owned(),
            ))?;

-        let gateway_shared_key: SharedKeys =
-            pemstore::load_key(client_pathfinder.gateway_shared_key())?;
+        let ack_key: AckKey = nym_pemstore::load_key(client_pathfinder.ack_key())?;

-        let ack_key: AckKey = pemstore::load_key(client_pathfinder.ack_key())?;
-
-        // TODO: ack key is never stored so it is generated now. But perhaps it should be stored
-        // after all for consistency sake?
        Ok(KeyManager {
            identity_keypair: Arc::new(identity_keypair),
            encryption_keypair: Arc::new(encryption_keypair),
-            gateway_shared_key: Some(Arc::new(gateway_shared_key)),
+            gateway_shared_key: None,
            ack_key: Arc::new(ack_key),
        })
    }

-    // this is actually **NOT** dead code
-    // I have absolutely no idea why the compiler insists it's unused. The call happens during client::init::execute
-    #[allow(dead_code)]
+    /// Loads previously stored keys from the disk. Fails if not all, including the shared gateway
+    /// key, is available.
+    pub fn load_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
+        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
+
+        let gateway_shared_key: SharedKeys =
+            nym_pemstore::load_key(client_pathfinder.gateway_shared_key())?;
+
+        key_manager.gateway_shared_key = Some(Arc::new(gateway_shared_key));
+
+        Ok(key_manager)
+    }
+
+    /// Loads previously stored keys from the disk. Fails if client keys are not availabe, but the
+    /// shared gateway key is optional.
+    pub fn load_keys_but_gateway_is_optional(
+        client_pathfinder: &ClientKeyPathfinder,
+    ) -> io::Result<Self> {
+        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
+
+        let gateway_shared_key: Result<SharedKeys, io::Error> =
+            nym_pemstore::load_key(client_pathfinder.gateway_shared_key());
+
+        // It's ok if the gateway key was not found
+        let gateway_shared_key = match gateway_shared_key {
+            Err(err) if err.kind() == io::ErrorKind::NotFound => Ok(None),
+            Err(err) => Err(err),
+            Ok(key) => Ok(Some(key)),
+        }?;
+
+        key_manager.gateway_shared_key = gateway_shared_key.map(Arc::new);
+
+        Ok(key_manager)
+    }
+
    /// Stores all available keys on the disk.
    // While perhaps there is no much point in storing the `AckKey` on the disk,
    // it is done so for the consistency sake so that you wouldn't require an rng instance
    // during `load_keys` to generate the said key.
    pub fn store_keys(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
-        pemstore::store_keypair(
+        nym_pemstore::store_keypair(
            self.identity_keypair.as_ref(),
-            &pemstore::KeyPairPath::new(
+            &nym_pemstore::KeyPairPath::new(
                client_pathfinder.private_identity_key().to_owned(),
                client_pathfinder.public_identity_key().to_owned(),
            ),
        )?;
-        pemstore::store_keypair(
+        nym_pemstore::store_keypair(
            self.encryption_keypair.as_ref(),
-            &pemstore::KeyPairPath::new(
+            &nym_pemstore::KeyPairPath::new(
                client_pathfinder.private_encryption_key().to_owned(),
                client_pathfinder.public_encryption_key().to_owned(),
            ),
        )?;

-        pemstore::store_key(self.ack_key.as_ref(), client_pathfinder.ack_key())?;
+        nym_pemstore::store_key(self.ack_key.as_ref(), client_pathfinder.ack_key())?;

        match self.gateway_shared_key.as_ref() {
-            None => warn!("No gateway shared key available to store!"),
+            None => debug!("No gateway shared key available to store!"),
            Some(gate_key) => {
-                pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
+                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
            }
        }

        Ok(())
    }

+    pub fn store_gateway_key(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
+        match self.gateway_shared_key.as_ref() {
+            None => {
+                return Err(io::Error::new(
+                    io::ErrorKind::Other,
+                    "trying to store a non-existing key",
+                ))
+            }
+            Some(gate_key) => {
+                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Overwrite the existing identity keypair
+    pub fn set_identity_keypair(&mut self, id_keypair: identity::KeyPair) {
+        self.identity_keypair = Arc::new(id_keypair);
+    }
+
    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
        Arc::clone(&self.identity_keypair)
    }

+    /// Overwrite the existing encryption keypair
+    pub fn set_encryption_keypair(&mut self, enc_keypair: encryption::KeyPair) {
+        self.encryption_keypair = Arc::new(enc_keypair);
+    }
+
    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
        Arc::clone(&self.encryption_keypair)
    }

+    /// Overwrite the existing ack key
+    pub fn set_ack_key(&mut self, ack_key: AckKey) {
+        self.ack_key = Arc::new(ack_key);
+    }
+
+    /// Gets an atomically reference counted pointer to [`AckKey`].
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        Arc::clone(&self.ack_key)
+    }
+
+    /// After shared key with the gateway is derived, puts its ownership to this instance of a [`KeyManager`].
+    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: Arc<SharedKeys>) {
+        self.gateway_shared_key = Some(gateway_shared_key)
+    }
+
    /// Gets an atomically reference counted pointer to [`SharedKey`].
    // since this function is not fully public, it is not expected to be used externally and
    // hence it's up to us to ensure it's called in correct context
@@ -149,8 +221,7 @@ impl KeyManager {
        )
    }

-    /// Gets an atomically reference counted pointer to [`AckKey`].
-    pub fn ack_key(&self) -> Arc<AckKey> {
-        Arc::clone(&self.ack_key)
+    pub fn is_gateway_key_set(&self) -> bool {
+        self.gateway_shared_key.is_some()
    }
 }
@@ -1,22 +1,26 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use futures::channel::mpsc;
-use futures::StreamExt;
+use crate::spawn_future;
+#[cfg(target_arch = "wasm32")]
+use gateway_client::wasm_mockups::CosmWasmClient;
 use gateway_client::GatewayClient;
 use log::*;
-use nymsphinx::forwarding::packet::MixPacket;
-use tokio::task::JoinHandle;
+use nym_sphinx::forwarding::packet::MixPacket;
+#[cfg(not(target_arch = "wasm32"))]
+use validator_client::nyxd::CosmWasmClient;

-pub type BatchMixMessageSender = mpsc::UnboundedSender<Vec<MixPacket>>;
-pub type BatchMixMessageReceiver = mpsc::UnboundedReceiver<Vec<MixPacket>>;
+pub type BatchMixMessageSender = tokio::sync::mpsc::Sender<Vec<MixPacket>>;
+pub type BatchMixMessageReceiver = tokio::sync::mpsc::Receiver<Vec<MixPacket>>;

+// We remind ourselves that 32 x 32kb = 1024kb, a reasonable size for a network buffer.
+pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 32;
 const MAX_FAILURE_COUNT: usize = 100;

-pub struct MixTrafficController {
+pub struct MixTrafficController<C: Clone> {
    // TODO: most likely to be replaced by some higher level construct as
    // later on gateway_client will need to be accessible by other entities
-    gateway_client: GatewayClient,
+    gateway_client: GatewayClient<C>,
    mix_rx: BatchMixMessageReceiver,

    // TODO: this is temporary work-around.
@@ -24,16 +28,23 @@ pub struct MixTrafficController {
    consecutive_gateway_failure_count: usize,
 }

-impl MixTrafficController {
+impl<C> MixTrafficController<C>
+where
+    C: CosmWasmClient + Sync + Send + Clone + 'static,
+{
    pub fn new(
-        mix_rx: BatchMixMessageReceiver,
-        gateway_client: GatewayClient,
-    ) -> MixTrafficController {
-        MixTrafficController {
-            gateway_client,
-            mix_rx,
-            consecutive_gateway_failure_count: 0,
-        }
+        gateway_client: GatewayClient<C>,
+    ) -> (MixTrafficController<C>, BatchMixMessageSender) {
+        let (sphinx_message_sender, sphinx_message_receiver) =
+            tokio::sync::mpsc::channel(MIX_MESSAGE_RECEIVER_BUFFER_SIZE);
+        (
+            MixTrafficController {
+                gateway_client,
+                mix_rx: sphinx_message_receiver,
+                consecutive_gateway_failure_count: 0,
+            },
+            sphinx_message_sender,
+        )
    }

    async fn on_messages(&mut self, mut mix_packets: Vec<MixPacket>) {
@@ -49,13 +60,13 @@ impl MixTrafficController {
        };

        match result {
-            Err(e) => {
-                error!("Failed to send sphinx packet(s) to the gateway! - {:?}", e);
+            Err(err) => {
+                error!("Failed to send sphinx packet(s) to the gateway! - {err}");
                self.consecutive_gateway_failure_count += 1;
                if self.consecutive_gateway_failure_count == MAX_FAILURE_COUNT {
                    // todo: in the future this should initiate a 'graceful' shutdown or try
                    // to reconnect?
-                    panic!("failed to send sphinx packet to the gateway {} times in a row - assuming the gateway is dead. Can't do anything about it yet :(", MAX_FAILURE_COUNT)
+                    panic!("failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead. Can't do anything about it yet :(")
                }
            }
            Ok(_) => {
@@ -65,15 +76,29 @@ impl MixTrafficController {
        }
    }

-    pub async fn run(&mut self) {
-        while let Some(mix_packets) = self.mix_rx.next().await {
-            self.on_messages(mix_packets).await;
-        }
-    }
+    pub fn start_with_shutdown(mut self, mut shutdown: nym_task::TaskClient) {
+        spawn_future(async move {
+            debug!("Started MixTrafficController with graceful shutdown support");

-    pub fn start(mut self) -> JoinHandle<()> {
-        tokio::spawn(async move {
-            self.run().await;
+            loop {
+                tokio::select! {
+                    mix_packets = self.mix_rx.recv() => match mix_packets {
+                        Some(mix_packets) => {
+                            self.on_messages(mix_packets).await;
+                        },
+                        None => {
+                            log::trace!("MixTrafficController: Stopping since channel closed");
+                            break;
+                        }
+                    },
+                    _ = shutdown.recv_with_delay() => {
+                        log::trace!("MixTrafficController: Received shutdown");
+                        break;
+                    }
+                }
+            }
+            shutdown.recv_timeout().await;
+            log::debug!("MixTrafficController: Exiting");
        })
    }
 }
@@ -1,8 +1,14 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod base_client;
 pub mod cover_traffic_stream;
+pub(crate) mod helpers;
 pub mod inbound_messages;
 pub mod key_manager;
 pub mod mix_traffic;
 pub mod real_messages_control;
 pub mod received_buffer;
-pub mod reply_key_storage;
+pub mod replies;
 pub mod topology_control;
+pub(crate) mod transmission_buffer;
@@ -1,11 +1,11 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::action_controller::{Action, ActionSender};
+use super::action_controller::{AckActionSender, Action};
 use futures::StreamExt;
 use gateway_client::AcknowledgementReceiver;
 use log::*;
-use nymsphinx::{
+use nym_sphinx::{
    acknowledgements::{identifier::recover_identifier, AckKey},
    chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID},
 };
@@ -16,14 +16,14 @@ use std::sync::Arc;
 pub(super) struct AcknowledgementListener {
    ack_key: Arc<AckKey>,
    ack_receiver: AcknowledgementReceiver,
-    action_sender: ActionSender,
+    action_sender: AckActionSender,
 }

 impl AcknowledgementListener {
    pub(super) fn new(
        ack_key: Arc<AckKey>,
        ack_receiver: AcknowledgementReceiver,
-        action_sender: ActionSender,
+        action_sender: AckActionSender,
    ) -> Self {
        AcknowledgementListener {
            ack_key,
@@ -33,7 +33,7 @@ impl AcknowledgementListener {
    }

    async fn on_ack(&mut self, ack_content: Vec<u8>) {
-        debug!("Received an ack");
+        trace!("Received an ack");
        let frag_id = match recover_identifier(&self.ack_key, &ack_content)
            .map(FragmentIdentifier::try_from_bytes)
        {
@@ -49,11 +49,6 @@ impl AcknowledgementListener {
        if frag_id == COVER_FRAG_ID {
            trace!("Received an ack for a cover message - no need to do anything");
            return;
-        } else if frag_id.is_reply() {
-            info!("Received an ack for a reply message - no need to do anything! (don't know what to do!)");
-            // TODO: probably there will need to be some extra procedure here, something to notify
-            // user that his reply reached the recipient (since we got an ack)
-            return;
        }

        trace!("Received {} from the mix network", frag_id);
@@ -63,14 +58,31 @@ impl AcknowledgementListener {
            .unwrap();
    }

-    pub(super) async fn run(&mut self) {
-        debug!("Started AcknowledgementListener");
-        while let Some(acks) = self.ack_receiver.next().await {
-            // realistically we would only be getting one ack at the time
-            for ack in acks {
-                self.on_ack(ack).await;
+    async fn handle_ack_receiver_item(&mut self, item: Vec<Vec<u8>>) {
+        // realistically we would only be getting one ack at the time
+        for ack in item {
+            self.on_ack(ack).await;
+        }
+    }
+
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started AcknowledgementListener with graceful shutdown support");
+
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                acks = self.ack_receiver.next() => match acks {
+                    Some(acks) => self.handle_ack_receiver_item(acks).await,
+                    None => {
+                        log::trace!("AcknowledgementListener: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("AcknowledgementListener: Received shutdown");
+                }
            }
        }
-        error!("TODO: error msg. Or maybe panic?")
+        shutdown.recv_timeout().await;
+        log::debug!("AcknowledgementListener: Exiting");
    }
 }
@@ -3,17 +3,18 @@

 use super::PendingAcknowledgement;
 use crate::client::real_messages_control::acknowledgement_control::RetransmissionRequestSender;
-use futures::channel::mpsc::{self, UnboundedReceiver, UnboundedSender};
+use futures::channel::mpsc;
 use futures::StreamExt;
 use log::*;
-use nonexhaustive_delayqueue::{Expired, NonExhaustiveDelayQueue, QueueKey};
-use nymsphinx::chunking::fragment::FragmentIdentifier;
-use nymsphinx::Delay as SphinxDelay;
+use nym_nonexhaustive_delayqueue::{Expired, NonExhaustiveDelayQueue, QueueKey};
+use nym_sphinx::chunking::fragment::FragmentIdentifier;
+use nym_sphinx::Delay as SphinxDelay;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;

-pub(crate) type ActionSender = UnboundedSender<Action>;
+pub(crate) type AckActionSender = mpsc::UnboundedSender<Action>;
+pub(crate) type AckActionReceiver = mpsc::UnboundedReceiver<Action>;

 // The actual data being sent off as well as potential key to the delay queue
 type PendingAckEntry = (Arc<PendingAcknowledgement>, Option<QueueKey>);
@@ -95,7 +96,7 @@ pub(super) struct ActionController {
    pending_acks_timers: NonExhaustiveDelayQueue<FragmentIdentifier>,

    /// Channel for receiving `Action`s from other modules.
-    incoming_actions: UnboundedReceiver<Action>,
+    incoming_actions: AckActionReceiver,

    /// Channel for notifying `RetransmissionRequestListener` about expired acknowledgements.
    retransmission_sender: RetransmissionRequestSender,
@@ -105,18 +106,15 @@ impl ActionController {
    pub(super) fn new(
        config: Config,
        retransmission_sender: RetransmissionRequestSender,
-    ) -> (Self, ActionSender) {
-        let (sender, receiver) = mpsc::unbounded();
-        (
-            ActionController {
-                config,
-                pending_acks_data: HashMap::new(),
-                pending_acks_timers: NonExhaustiveDelayQueue::new(),
-                incoming_actions: receiver,
-                retransmission_sender,
-            },
-            sender,
-        )
+        incoming_actions: AckActionReceiver,
+    ) -> Self {
+        ActionController {
+            config,
+            pending_acks_data: HashMap::new(),
+            pending_acks_timers: NonExhaustiveDelayQueue::new(),
+            incoming_actions,
+            retransmission_sender,
+        }
    }

    fn handle_insert(&mut self, pending_acks: Vec<PendingAcknowledgement>) {
@@ -138,13 +136,18 @@ impl ActionController {
        trace!("{} is starting its timer", frag_id);

        if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.get_mut(&frag_id) {
-            if queue_key.is_some() {
-                // this branch should be IMPOSSIBLE under ANY condition. It would imply starting
-                // timer TWICE for the SAME PendingAcknowledgement
-                panic!("Tried to start an already started ack timer!")
-            }
-            let timeout = (pending_ack_data.delay.clone() * self.config.ack_wait_multiplier)
-                .to_duration()
+            // the fact that this branch is now POSSIBLE is a sign of a need to refactor this whole
+            // retransmission procedure
+            //
+            // (it can happen as timer is started when ack expires to make sure it's not stuck in memory
+            // and the second instance can be fired when we finally get reply surbs for data we failed to retransmit)
+
+            // if queue_key.is_some() {
+            //     // this branch should be IMPOSSIBLE under ANY condition. It would imply starting
+            //     // timer TWICE for the SAME PendingAcknowledgement
+            //     panic!("Tried to start an already started ack timer!")
+            // }
+            let timeout = (pending_ack_data.delay * self.config.ack_wait_multiplier).to_duration()
                + self.config.ack_wait_addition;

            let new_queue_key = self.pending_acks_timers.insert(frag_id, timeout);
@@ -192,7 +195,8 @@ impl ActionController {
        trace!("{} is updating its delay", frag_id);
        // TODO: is it possible to solve this without either locking or temporarily removing the value?
        if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.remove(&frag_id) {
-            // this Action is triggered by `RetransmissionRequestListener` which held the other potential
+            // this Action is triggered by `RetransmissionRequestListener` (for 'normal' packets)
+            // or `ReplyController` (for 'reply' packets) which held the other potential
            // reference to this Arc. HOWEVER, before the Action was pushed onto the queue, the reference
            // was dropped hence this unwrap is safe.
            let mut inner_data = Arc::try_unwrap(pending_ack_data).unwrap();
@@ -209,7 +213,11 @@ impl ActionController {
    }

    // note: when the entry expires it's automatically removed from pending_acks_timers
-    fn handle_expired_ack_timer(&mut self, expired_ack: Expired<FragmentIdentifier>) {
+    fn handle_expired_ack_timer(
+        &mut self,
+        expired_ack: Expired<FragmentIdentifier>,
+        task_client: &mut nym_task::TaskClient,
+    ) {
        // I'm honestly not sure how to handle it, because getting it means other things in our
        // system are already misbehaving. If we ever see this panic, then I guess we should worry
        // about it. Perhaps just reschedule it at later point?
@@ -227,9 +235,16 @@ impl ActionController {
            // downgrading an arc and then upgrading vs cloning is difference of 30ns vs 15ns
            // so it's literally a NO difference while it might prevent us from unnecessarily
            // resending data (in maybe 1 in 1 million cases, but it's something)
-            self.retransmission_sender
+            if self
+                .retransmission_sender
                .unbounded_send(Arc::downgrade(pending_ack_data))
-                .unwrap()
+                .is_err()
+            {
+                assert!(
+                    task_client.is_shutdown_poll(),
+                    "Failed to send pending ack for retransmission"
+                );
+            }
        } else {
            // this shouldn't cause any issues but shouldn't have happened to begin with!
            error!("An already removed pending ack has expired")
@@ -245,15 +260,33 @@ impl ActionController {
        }
    }

-    pub(super) async fn run(&mut self) {
-        loop {
-            // at some point there will be a global shutdown signal here as the third option
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started ActionController with graceful shutdown support");
+
+        while !shutdown.is_shutdown() {
            tokio::select! {
-                // we NEVER expect for ANY sender to get dropped so unwrap here is fine
-                action = self.incoming_actions.next() => self.process_action(action.unwrap()),
-                // pending ack queue Stream CANNOT return a `None` so unwrap here is fine
-                expired_ack = self.pending_acks_timers.next() => self.handle_expired_ack_timer(expired_ack.unwrap())
+                action = self.incoming_actions.next() => match action {
+                    Some(action) => self.process_action(action),
+                    None => {
+                        log::trace!(
+                            "ActionController: Stopping since incoming actions channel closed"
+                        );
+                        break;
+                    }
+                },
+                expired_ack = self.pending_acks_timers.next() => match expired_ack {
+                    Some(expired_ack) => self.handle_expired_ack_timer(expired_ack, &mut shutdown),
+                    None => {
+                        log::trace!("ActionController: Stopping since ack channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("ActionController: Received shutdown");
+                }
            }
        }
+        shutdown.recv_timeout().await;
+        log::debug!("ActionController: Exiting");
    }
 }
@@ -1,21 +1,14 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::action_controller::{Action, ActionSender};
-use super::PendingAcknowledgement;
-use crate::client::reply_key_storage::ReplyKeyStorage;
-use crate::client::{
-    inbound_messages::{InputMessage, InputMessageReceiver},
-    real_messages_control::real_traffic_stream::{BatchRealMessageSender, RealMessage},
-    topology_control::TopologyAccessor,
-};
-use futures::StreamExt;
+use crate::client::inbound_messages::{InputMessage, InputMessageReceiver};
+use crate::client::real_messages_control::message_handler::MessageHandler;
+use crate::client::replies::reply_controller::ReplyControllerSender;
 use log::*;
-use nymsphinx::anonymous_replies::ReplySurb;
-use nymsphinx::preparer::MessagePreparer;
-use nymsphinx::{acknowledgements::AckKey, addressing::clients::Recipient};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_task::connections::TransmissionLane;
 use rand::{CryptoRng, Rng};
-use std::sync::Arc;

 /// Module responsible for dealing with the received messages: splitting them, creating acknowledgements,
 /// putting everything into sphinx packets, etc.
@@ -24,14 +17,9 @@ pub(super) struct InputMessageListener<R>
 where
    R: CryptoRng + Rng,
 {
-    ack_key: Arc<AckKey>,
-    ack_recipient: Recipient,
    input_receiver: InputMessageReceiver,
-    message_preparer: MessagePreparer<R>,
-    action_sender: ActionSender,
-    real_message_sender: BatchRealMessageSender,
-    topology_access: TopologyAccessor,
-    reply_key_storage: ReplyKeyStorage,
+    message_handler: MessageHandler<R>,
+    reply_controller_sender: ReplyControllerSender,
 }

 impl<R> InputMessageListener<R>
@@ -42,149 +30,105 @@ where
    // some considerable refactoring
    #[allow(clippy::too_many_arguments)]
    pub(super) fn new(
-        ack_key: Arc<AckKey>,
-        ack_recipient: Recipient,
        input_receiver: InputMessageReceiver,
-        message_preparer: MessagePreparer<R>,
-        action_sender: ActionSender,
-        real_message_sender: BatchRealMessageSender,
-        topology_access: TopologyAccessor,
-        reply_key_storage: ReplyKeyStorage,
+        message_handler: MessageHandler<R>,
+        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
        InputMessageListener {
-            ack_key,
-            ack_recipient,
            input_receiver,
-            message_preparer,
-            action_sender,
-            real_message_sender,
-            topology_access,
-            reply_key_storage,
+            message_handler,
+            reply_controller_sender,
        }
    }

-    // we require topology for replies to generate surb_acks
-    async fn handle_reply(&mut self, reply_surb: ReplySurb, data: Vec<u8>) -> Option<RealMessage> {
-        let topology_permit = self.topology_access.get_read_permit().await;
-        let topology = match topology_permit.try_get_valid_topology_ref(&self.ack_recipient, None) {
-            Some(topology_ref) => topology_ref,
-            None => {
-                warn!("Could not process the message - the network topology is invalid");
-                return None;
-            }
-        };
-
-        match self
-            .message_preparer
-            .prepare_reply_for_use(data, reply_surb, topology, &self.ack_key)
-            .await
-        {
-            Ok((mix_packet, reply_id)) => {
-                // TODO: later probably write pending ack here
-                // and deal with them....
-                // ... somehow
-                Some(RealMessage::new(mix_packet, reply_id))
-            }
-            Err(err) => {
-                // TODO: should we have some mechanism to indicate to the user that the `reply_surb`
-                // could be reused since technically it wasn't used up here?
-                warn!("failed to deal with received reply surb - {:?}", err);
-                None
-            }
-        }
+    async fn handle_reply(
+        &mut self,
+        recipient_tag: AnonymousSenderTag,
+        data: Vec<u8>,
+        lane: TransmissionLane,
+    ) {
+        // offload reply handling to the dedicated task
+        self.reply_controller_sender
+            .send_reply(recipient_tag, data, lane)
    }

-    async fn handle_fresh_message(
+    async fn handle_plain_message(
        &mut self,
        recipient: Recipient,
        content: Vec<u8>,
-        with_reply_surb: bool,
-    ) -> Option<Vec<RealMessage>> {
-        let topology_permit = self.topology_access.get_read_permit().await;
-        let topology = match topology_permit
-            .try_get_valid_topology_ref(&self.ack_recipient, Some(&recipient))
+        lane: TransmissionLane,
+    ) {
+        if let Err(err) = self
+            .message_handler
+            .try_send_plain_message(recipient, content, lane)
+            .await
        {
-            Some(topology_ref) => topology_ref,
-            None => {
-                warn!("Could not process the message - the network topology is invalid");
-                return None;
-            }
-        };
-
-        // split the message, attach optional reply surb
-        let (split_message, reply_key) = self
-            .message_preparer
-            .prepare_and_split_message(content, with_reply_surb, topology)
-            .expect("somehow the topology was invalid after all!");
-
-        if let Some(reply_key) = reply_key {
-            self.reply_key_storage
-                .insert_encryption_key(reply_key)
-                .expect("Failed to insert surb reply key to the store!")
+            warn!("failed to send a plain message - {err}")
        }
+    }

-        // encrypt chunks, put them inside sphinx packets and generate acks
-        let mut pending_acks = Vec::with_capacity(split_message.len());
-        let mut real_messages = Vec::with_capacity(split_message.len());
-        for message_chunk in split_message {
-            // we need to clone it because we need to keep it in memory in case we had to retransmit
-            // it. And then we'd need to recreate entire ACK again.
-            let chunk_clone = message_chunk.clone();
-            let prepared_fragment = self
-                .message_preparer
-                .prepare_chunk_for_sending(chunk_clone, topology, &self.ack_key, &recipient)
-                .unwrap();
-
-            real_messages.push(RealMessage::new(
-                prepared_fragment.mix_packet,
-                message_chunk.fragment_identifier(),
-            ));
-
-            pending_acks.push(PendingAcknowledgement::new(
-                message_chunk,
-                prepared_fragment.total_delay,
-                recipient,
-            ));
+    async fn handle_repliable_message(
+        &mut self,
+        recipient: Recipient,
+        content: Vec<u8>,
+        reply_surbs: u32,
+        lane: TransmissionLane,
+    ) {
+        if let Err(err) = self
+            .message_handler
+            .try_send_message_with_reply_surbs(recipient, content, reply_surbs, lane)
+            .await
+        {
+            warn!("failed to send a repliable message - {err}")
        }
-
-        // tells the controller to put this into the hashmap
-        self.action_sender
-            .unbounded_send(Action::new_insert(pending_acks))
-            .unwrap();
-
-        Some(real_messages)
    }

    async fn on_input_message(&mut self, msg: InputMessage) {
-        let real_messages = match msg {
-            InputMessage::Fresh {
+        match msg {
+            InputMessage::Regular {
                recipient,
                data,
-                with_reply_surb,
+                lane,
+            } => self.handle_plain_message(recipient, data, lane).await,
+            InputMessage::Anonymous {
+                recipient,
+                data,
+                reply_surbs,
+                lane,
            } => {
-                self.handle_fresh_message(recipient, data, with_reply_surb)
+                self.handle_repliable_message(recipient, data, reply_surbs, lane)
                    .await
            }
-            InputMessage::Reply { reply_surb, data } => self
-                .handle_reply(reply_surb, data)
-                .await
-                .map(|message| vec![message]),
+            InputMessage::Reply {
+                recipient_tag,
+                data,
+                lane,
+            } => {
+                self.handle_reply(recipient_tag, data, lane).await;
+            }
        };
-
-        // there's no point in trying to send nothing
-        if let Some(real_messages) = real_messages {
-            // tells real message sender (with the poisson timer) to send this to the mix network
-            self.real_message_sender
-                .unbounded_send(real_messages)
-                .unwrap();
-        }
    }

-    pub(super) async fn run(&mut self) {
-        debug!("Started InputMessageListener");
-        while let Some(input_msg) = self.input_receiver.next().await {
-            self.on_input_message(input_msg).await;
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started InputMessageListener with graceful shutdown support");
+
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                input_msg = self.input_receiver.recv() => match input_msg {
+                    Some(input_msg) => {
+                        self.on_input_message(input_msg).await;
+                    },
+                    None => {
+                        log::trace!("InputMessageListener: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("InputMessageListener: Received shutdown");
+                }
+            }
        }
-        error!("TODO: error msg. Or maybe panic?")
+        shutdown.recv_timeout().await;
+        log::debug!("InputMessageListener: Exiting");
    }
 }
@@ -7,17 +7,20 @@ use self::{
    retransmission_request_listener::RetransmissionRequestListener,
    sent_notification_listener::SentNotificationListener,
 };
-use super::real_traffic_stream::BatchRealMessageSender;
-use crate::client::reply_key_storage::ReplyKeyStorage;
-use crate::client::{inbound_messages::InputMessageReceiver, topology_control::TopologyAccessor};
+use crate::client::inbound_messages::InputMessageReceiver;
+use crate::client::real_messages_control::message_handler::MessageHandler;
+use crate::client::replies::reply_controller::ReplyControllerSender;
+use crate::spawn_future;
+use action_controller::AckActionReceiver;
 use futures::channel::mpsc;
 use gateway_client::AcknowledgementReceiver;
 use log::*;
-use nymsphinx::{
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::params::PacketSize;
+use nym_sphinx::{
    acknowledgements::AckKey,
    addressing::clients::Recipient,
    chunking::fragment::{Fragment, FragmentIdentifier},
-    preparer::MessagePreparer,
    Delay as SphinxDelay,
 };
 use rand::{CryptoRng, Rng};
@@ -25,7 +28,8 @@ use std::{
    sync::{Arc, Weak},
    time::Duration,
 };
-use tokio::task::JoinHandle;
+
+pub(crate) use action_controller::{AckActionSender, Action};

 mod acknowledgement_listener;
 mod action_controller;
@@ -47,24 +51,64 @@ pub(super) type SentPacketNotificationSender = mpsc::UnboundedSender<FragmentIde
 /// that it is about to be sent to the mix network and its timeout timer should be started.
 type SentPacketNotificationReceiver = mpsc::UnboundedReceiver<FragmentIdentifier>;

+#[derive(Debug)]
+pub(crate) enum PacketDestination {
+    Anonymous {
+        recipient_tag: AnonymousSenderTag,
+        // special flag to indicate whether this was an ack for requesting additional surbs,
+        // in that case we have to do everything we can to get it through, even if it means going
+        // below our stored reply surb threshold
+        extra_surb_request: bool,
+    },
+    KnownRecipient(Box<Recipient>),
+}
+
 /// Structure representing a data `Fragment` that is on-route to the specified `Recipient`
 #[derive(Debug)]
 pub(crate) struct PendingAcknowledgement {
    message_chunk: Fragment,
    delay: SphinxDelay,
-    recipient: Recipient,
+    destination: PacketDestination,
 }

 impl PendingAcknowledgement {
    /// Creates new instance of `PendingAcknowledgement` using the provided data.
-    fn new(message_chunk: Fragment, delay: SphinxDelay, recipient: Recipient) -> Self {
+    pub(crate) fn new_known(
+        message_chunk: Fragment,
+        delay: SphinxDelay,
+        recipient: Recipient,
+    ) -> Self {
        PendingAcknowledgement {
            message_chunk,
            delay,
-            recipient,
+            destination: PacketDestination::KnownRecipient(recipient.into()),
        }
    }

+    pub(crate) fn new_anonymous(
+        message_chunk: Fragment,
+        delay: SphinxDelay,
+        recipient_tag: AnonymousSenderTag,
+        extra_surb_request: bool,
+    ) -> Self {
+        PendingAcknowledgement {
+            message_chunk,
+            delay,
+            destination: PacketDestination::Anonymous {
+                recipient_tag,
+                extra_surb_request,
+            },
+        }
+    }
+
+    pub(crate) fn inner_fragment_identifier(&self) -> FragmentIdentifier {
+        self.message_chunk.fragment_identifier()
+    }
+
+    pub(crate) fn fragment_data(&self) -> Fragment {
+        self.message_chunk.clone()
+    }
+
    fn update_delay(&mut self, new_delay: SphinxDelay) {
        self.delay = new_delay;
    }
@@ -73,10 +117,6 @@ impl PendingAcknowledgement {
 /// AcknowledgementControllerConnectors represents set of channels for communication with
 /// other parts of the system in order to support acknowledgements and retransmission.
 pub(super) struct AcknowledgementControllerConnectors {
-    /// Channel used for forwarding prepared sphinx messages into the poisson sender
-    /// to be sent to the mix network.
-    real_message_sender: BatchRealMessageSender,
-
    /// Channel used for receiving raw messages from a client. The messages need to be put
    /// into sphinx packets first.
    input_receiver: InputMessageReceiver,
@@ -88,20 +128,28 @@ pub(super) struct AcknowledgementControllerConnectors {

    /// Channel used for receiving acknowledgements from the mix network.
    ack_receiver: AcknowledgementReceiver,
+
+    /// Channel used for sending request to `ActionController` to deal with anything ack-related,
+    ack_action_sender: AckActionSender,
+
+    /// Channel used for receiving request by `ActionController` to deal with anything ack-related,
+    ack_action_receiver: AckActionReceiver,
 }

 impl AcknowledgementControllerConnectors {
    pub(super) fn new(
-        real_message_sender: BatchRealMessageSender,
        input_receiver: InputMessageReceiver,
        sent_notifier: SentPacketNotificationReceiver,
        ack_receiver: AcknowledgementReceiver,
+        ack_action_sender: AckActionSender,
+        ack_action_receiver: AckActionReceiver,
    ) -> Self {
        AcknowledgementControllerConnectors {
-            real_message_sender,
            input_receiver,
            sent_notifier,
            ack_receiver,
+            ack_action_sender,
+            ack_action_receiver,
        }
    }
 }
@@ -114,163 +162,135 @@ pub(super) struct Config {
    /// Given ack timeout in the form a * BASE_DELAY + b, it specifies the multiplier `a`
    ack_wait_multiplier: f64,

-    /// Average delay an acknowledgement packet is going to get delayed at a single mixnode.
-    average_ack_delay: Duration,
-
-    /// Average delay a data packet is going to get delayed at a single mixnode.
-    average_packet_delay: Duration,
+    /// Predefined packet size used for the encapsulated messages.
+    packet_size: PacketSize,
 }

 impl Config {
-    pub(super) fn new(
-        ack_wait_addition: Duration,
-        ack_wait_multiplier: f64,
-        average_ack_delay: Duration,
-        average_packet_delay: Duration,
-    ) -> Self {
+    pub(super) fn new(ack_wait_addition: Duration, ack_wait_multiplier: f64) -> Self {
        Config {
            ack_wait_addition,
            ack_wait_multiplier,
-            average_ack_delay,
-            average_packet_delay,
+            packet_size: Default::default(),
        }
    }
+
+    pub fn with_custom_packet_size(mut self, packet_size: PacketSize) -> Self {
+        self.packet_size = packet_size;
+        self
+    }
 }

 pub(super) struct AcknowledgementController<R>
 where
    R: CryptoRng + Rng,
 {
-    acknowledgement_listener: Option<AcknowledgementListener>,
-    input_message_listener: Option<InputMessageListener<R>>,
-    retransmission_request_listener: Option<RetransmissionRequestListener<R>>,
-    sent_notification_listener: Option<SentNotificationListener>,
-    action_controller: Option<ActionController>,
+    acknowledgement_listener: AcknowledgementListener,
+    input_message_listener: InputMessageListener<R>,
+    retransmission_request_listener: RetransmissionRequestListener<R>,
+    sent_notification_listener: SentNotificationListener,
+    action_controller: ActionController,
 }

 impl<R> AcknowledgementController<R>
 where
-    R: 'static + CryptoRng + Rng + Clone + Send,
+    R: 'static + CryptoRng + Rng + Clone + Send + Sync,
 {
    pub(super) fn new(
        config: Config,
-        rng: R,
-        topology_access: TopologyAccessor,
        ack_key: Arc<AckKey>,
-        ack_recipient: Recipient,
-        reply_key_storage: ReplyKeyStorage,
        connectors: AcknowledgementControllerConnectors,
+        message_handler: MessageHandler<R>,
+        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
        let (retransmission_tx, retransmission_rx) = mpsc::unbounded();

        let action_config =
            action_controller::Config::new(config.ack_wait_addition, config.ack_wait_multiplier);
-        let (action_controller, action_sender) =
-            ActionController::new(action_config, retransmission_tx);
-
-        let message_preparer = MessagePreparer::new(
-            rng,
-            ack_recipient,
-            config.average_packet_delay,
-            config.average_ack_delay,
+        let action_controller = ActionController::new(
+            action_config,
+            retransmission_tx,
+            connectors.ack_action_receiver,
        );

        // will listen for any acks coming from the network
        let acknowledgement_listener = AcknowledgementListener::new(
            Arc::clone(&ack_key),
            connectors.ack_receiver,
-            action_sender.clone(),
+            connectors.ack_action_sender.clone(),
        );

        // will listen for any new messages from the client
        let input_message_listener = InputMessageListener::new(
-            Arc::clone(&ack_key),
-            ack_recipient,
            connectors.input_receiver,
-            message_preparer.clone(),
-            action_sender.clone(),
-            connectors.real_message_sender.clone(),
-            topology_access.clone(),
-            reply_key_storage,
+            message_handler.clone(),
+            reply_controller_sender.clone(),
        );

        // will listen for any ack timeouts and trigger retransmission
        let retransmission_request_listener = RetransmissionRequestListener::new(
-            Arc::clone(&ack_key),
-            ack_recipient,
-            message_preparer,
-            action_sender.clone(),
-            connectors.real_message_sender,
+            connectors.ack_action_sender.clone(),
+            message_handler,
            retransmission_rx,
-            topology_access,
+            reply_controller_sender,
        );

        // will listen for events indicating the packet was sent through the network so that
        // the retransmission timer should be started.
        let sent_notification_listener =
-            SentNotificationListener::new(connectors.sent_notifier, action_sender);
+            SentNotificationListener::new(connectors.sent_notifier, connectors.ack_action_sender);

        AcknowledgementController {
-            acknowledgement_listener: Some(acknowledgement_listener),
-            input_message_listener: Some(input_message_listener),
-            retransmission_request_listener: Some(retransmission_request_listener),
-            sent_notification_listener: Some(sent_notification_listener),
-            action_controller: Some(action_controller),
+            acknowledgement_listener,
+            input_message_listener,
+            retransmission_request_listener,
+            sent_notification_listener,
+            action_controller,
        }
    }

-    pub(super) async fn run(&mut self) {
-        let mut acknowledgement_listener = self.acknowledgement_listener.take().unwrap();
-        let mut input_message_listener = self.input_message_listener.take().unwrap();
-        let mut retransmission_request_listener =
-            self.retransmission_request_listener.take().unwrap();
-        let mut sent_notification_listener = self.sent_notification_listener.take().unwrap();
-        let mut action_controller = self.action_controller.take().unwrap();
+    pub(super) fn start_with_shutdown(self, shutdown: nym_task::TaskClient) {
+        let mut acknowledgement_listener = self.acknowledgement_listener;
+        let mut input_message_listener = self.input_message_listener;
+        let mut retransmission_request_listener = self.retransmission_request_listener;
+        let mut sent_notification_listener = self.sent_notification_listener;
+        let mut action_controller = self.action_controller;

-        // the below are log messages are errors as at the current stage we do not expect any of
-        // the task to ever finish. This will of course change once we introduce
-        // graceful shutdowns.
-        let ack_listener_fut = tokio::spawn(async move {
-            acknowledgement_listener.run().await;
-            error!("The acknowledgement listener has finished execution!");
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
            acknowledgement_listener
+                .run_with_shutdown(shutdown_handle)
+                .await;
+            debug!("The acknowledgement listener has finished execution!");
        });
-        let input_listener_fut = tokio::spawn(async move {
-            input_message_listener.run().await;
-            error!("The input listener has finished execution!");
+
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
            input_message_listener
+                .run_with_shutdown(shutdown_handle)
+                .await;
+            debug!("The input listener has finished execution!");
        });
-        let retransmission_req_fut = tokio::spawn(async move {
-            retransmission_request_listener.run().await;
-            error!("The retransmission request listener has finished execution!");
+
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
            retransmission_request_listener
+                .run_with_shutdown(shutdown_handle)
+                .await;
+            debug!("The retransmission request listener has finished execution!");
        });
-        let sent_notification_fut = tokio::spawn(async move {
-            sent_notification_listener.run().await;
-            error!("The sent notification listener has finished execution!");
+
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
            sent_notification_listener
-        });
-        let action_controller_fut = tokio::spawn(async move {
-            action_controller.run().await;
-            error!("The controller has finished execution!");
-            action_controller
+                .run_with_shutdown(shutdown_handle)
+                .await;
+            debug!("The sent notification listener has finished execution!");
        });

-        // technically we don't have to bring `AcknowledgementController` back to a valid state
-        // but we can do it, so why not? Perhaps it might be useful if we wanted to allow
-        // for restarts of certain modules without killing the entire process.
-        self.acknowledgement_listener = Some(ack_listener_fut.await.unwrap());
-        self.input_message_listener = Some(input_listener_fut.await.unwrap());
-        self.retransmission_request_listener = Some(retransmission_req_fut.await.unwrap());
-        self.sent_notification_listener = Some(sent_notification_fut.await.unwrap());
-        self.action_controller = Some(action_controller_fut.await.unwrap());
-    }
-
-    #[allow(dead_code)]
-    pub(super) fn start(mut self) -> JoinHandle<Self> {
-        tokio::spawn(async move {
-            self.run().await;
-            self
-        })
+        spawn_future(async move {
+            action_controller.run_with_shutdown(shutdown).await;
+            debug!("The controller has finished execution!");
+        });
    }
 }
@@ -1,32 +1,29 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::action_controller::{Action, ActionSender};
-use super::PendingAcknowledgement;
-use super::RetransmissionRequestReceiver;
-use crate::client::{
-    real_messages_control::real_traffic_stream::{BatchRealMessageSender, RealMessage},
-    topology_control::TopologyAccessor,
+use super::{
+    action_controller::{AckActionSender, Action},
+    PendingAcknowledgement, RetransmissionRequestReceiver,
 };
+use crate::client::real_messages_control::acknowledgement_control::PacketDestination;
+use crate::client::real_messages_control::message_handler::{MessageHandler, PreparationError};
+use crate::client::real_messages_control::real_traffic_stream::RealMessage;
+use crate::client::replies::reply_controller::ReplyControllerSender;
 use futures::StreamExt;
 use log::*;
-use nymsphinx::preparer::MessagePreparer;
-use nymsphinx::{acknowledgements::AckKey, addressing::clients::Recipient};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::chunking::fragment::Fragment;
+use nym_sphinx::preparer::PreparedFragment;
+use nym_task::connections::TransmissionLane;
 use rand::{CryptoRng, Rng};
 use std::sync::{Arc, Weak};

 // responsible for packet retransmission upon fired timer
-pub(super) struct RetransmissionRequestListener<R>
-where
-    R: CryptoRng + Rng,
-{
-    ack_key: Arc<AckKey>,
-    ack_recipient: Recipient,
-    message_preparer: MessagePreparer<R>,
-    action_sender: ActionSender,
-    real_message_sender: BatchRealMessageSender,
+pub(super) struct RetransmissionRequestListener<R> {
+    action_sender: AckActionSender,
+    message_handler: MessageHandler<R>,
    request_receiver: RetransmissionRequestReceiver,
-    topology_access: TopologyAccessor,
+    reply_controller_sender: ReplyControllerSender,
 }

 impl<R> RetransmissionRequestListener<R>
@@ -34,44 +31,71 @@ where
    R: CryptoRng + Rng,
 {
    pub(super) fn new(
-        ack_key: Arc<AckKey>,
-        ack_recipient: Recipient,
-        message_preparer: MessagePreparer<R>,
-        action_sender: ActionSender,
-        real_message_sender: BatchRealMessageSender,
+        action_sender: AckActionSender,
+        message_handler: MessageHandler<R>,
        request_receiver: RetransmissionRequestReceiver,
-        topology_access: TopologyAccessor,
+        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
        RetransmissionRequestListener {
-            ack_key,
-            ack_recipient,
-            message_preparer,
            action_sender,
-            real_message_sender,
+            message_handler,
            request_receiver,
-            topology_access,
+            reply_controller_sender,
        }
    }

-    async fn on_retransmission_request(&mut self, timed_out_ack: Weak<PendingAcknowledgement>) {
-        let timed_out_ack = match timed_out_ack.upgrade() {
+    async fn prepare_normal_retransmission_chunk(
+        &mut self,
+        packet_recipient: Recipient,
+        chunk_data: Fragment,
+    ) -> Result<PreparedFragment, PreparationError> {
+        debug!("retransmitting normal packet...");
+
+        self.message_handler
+            .try_prepare_single_chunk_for_sending(packet_recipient, chunk_data)
+            .await
+    }
+
+    async fn on_retransmission_request(
+        &mut self,
+        weak_timed_out_ack: Weak<PendingAcknowledgement>,
+    ) {
+        let timed_out_ack = match weak_timed_out_ack.upgrade() {
            Some(timed_out_ack) => timed_out_ack,
            None => {
                debug!("We received an ack JUST as we were about to retransmit [1]");
                return;
            }
        };
-        let packet_recipient = &timed_out_ack.recipient;
-        let chunk_clone = timed_out_ack.message_chunk.clone();
-        let frag_id = chunk_clone.fragment_identifier();

-        let topology_permit = self.topology_access.get_read_permit().await;
-        let topology_ref = match topology_permit
-            .try_get_valid_topology_ref(&self.ack_recipient, Some(packet_recipient))
-        {
-            Some(topology_ref) => topology_ref,
-            None => {
-                warn!("Could not retransmit the packet - the network topology is invalid");
+        let maybe_prepared_fragment = match &timed_out_ack.destination {
+            PacketDestination::Anonymous {
+                recipient_tag,
+                extra_surb_request,
+            } => {
+                // if this is retransmission for reply, offload it to the dedicated task
+                // that deals with all the surbs
+                return self.reply_controller_sender.send_retransmission_data(
+                    *recipient_tag,
+                    weak_timed_out_ack,
+                    *extra_surb_request,
+                );
+            }
+            PacketDestination::KnownRecipient(recipient) => {
+                self.prepare_normal_retransmission_chunk(
+                    **recipient,
+                    timed_out_ack.message_chunk.clone(),
+                )
+                .await
+            }
+        };
+
+        let frag_id = timed_out_ack.message_chunk.fragment_identifier();
+
+        let prepared_fragment = match maybe_prepared_fragment {
+            Ok(prepared_fragment) => prepared_fragment,
+            Err(err) => {
+                warn!("Could not retransmit the packet - {err}");
                // we NEED to start timer here otherwise we will have this guy permanently stuck in memory
                self.action_sender
                    .unbounded_send(Action::new_start_timer(frag_id))
@@ -80,11 +104,6 @@ where
            }
        };

-        let prepared_fragment = self
-            .message_preparer
-            .prepare_chunk_for_sending(chunk_clone, topology_ref, &self.ack_key, packet_recipient)
-            .unwrap();
-
        // if we have the ONLY strong reference to the ack data, it means it was removed from the
        // pending acks
        if Arc::strong_count(&timed_out_ack) == 1 {
@@ -96,7 +115,6 @@ where
        // we no longer need the reference - let's drop it so that if somehow `UpdateTimer` action
        // reached the controller before this function terminated, the controller would not panic.
        drop(timed_out_ack);
-
        let new_delay = prepared_fragment.total_delay;

        // We know this update will be reflected by the `StartTimer` Action performed when this
@@ -111,19 +129,32 @@ where
            .unwrap();

        // send to `OutQueueControl` to eventually send to the mix network
-        self.real_message_sender
-            .unbounded_send(vec![RealMessage::new(
-                prepared_fragment.mix_packet,
-                frag_id,
-            )])
-            .unwrap();
+        self.message_handler
+            .forward_messages(
+                vec![RealMessage::new(prepared_fragment.mix_packet, frag_id)],
+                TransmissionLane::Retransmission,
+            )
+            .await
    }

-    pub(super) async fn run(&mut self) {
-        debug!("Started RetransmissionRequestListener");
-        while let Some(timed_out_ack) = self.request_receiver.next().await {
-            self.on_retransmission_request(timed_out_ack).await;
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started RetransmissionRequestListener with graceful shutdown support");
+
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                timed_out_ack = self.request_receiver.next() => match timed_out_ack {
+                    Some(timed_out_ack) => self.on_retransmission_request(timed_out_ack).await,
+                    None => {
+                        log::trace!("RetransmissionRequestListener: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv() => {
+                    log::trace!("RetransmissionRequestListener: Received shutdown");
+                }
+            }
        }
-        error!("TODO: error msg. Or maybe panic?")
+        shutdown.recv_timeout().await;
+        log::debug!("RetransmissionRequestListener: Exiting");
    }
 }
@@ -1,11 +1,11 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::action_controller::{Action, ActionSender};
+use super::action_controller::{AckActionSender, Action};
 use super::SentPacketNotificationReceiver;
 use futures::StreamExt;
 use log::*;
-use nymsphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};
+use nym_sphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};

 /// Module responsible for starting up retransmission timers.
 /// It is required because when we send our packet to the `real traffic stream` controlled
@@ -13,13 +13,13 @@ use nymsphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};
 /// accidentally fire retransmission way quicker than we should have.
 pub(super) struct SentNotificationListener {
    sent_notifier: SentPacketNotificationReceiver,
-    action_sender: ActionSender,
+    action_sender: AckActionSender,
 }

 impl SentNotificationListener {
    pub(super) fn new(
        sent_notifier: SentPacketNotificationReceiver,
-        action_sender: ActionSender,
+        action_sender: AckActionSender,
    ) -> Self {
        SentNotificationListener {
            sent_notifier,
@@ -31,22 +31,32 @@ impl SentNotificationListener {
        if frag_id == COVER_FRAG_ID {
            trace!("sent off a cover message - no need to start retransmission timer!");
            return;
-        } else if frag_id.is_reply() {
-            debug!("sent off a reply message - no need to start retransmission timer!");
-            // TODO: probably there will need to be some extra procedure here, like it would
-            // be nice to know that our reply actually reached the recipient (i.e. we got the ack)
-            return;
        }
        self.action_sender
            .unbounded_send(Action::new_start_timer(frag_id))
            .unwrap();
    }

-    pub(super) async fn run(&mut self) {
-        debug!("Started SentNotificationListener");
-        while let Some(frag_id) = self.sent_notifier.next().await {
-            self.on_sent_message(frag_id).await;
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started SentNotificationListener with graceful shutdown support");
+
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                frag_id = self.sent_notifier.next() => match frag_id {
+                    Some(frag_id) => {
+                        self.on_sent_message(frag_id).await;
+                    }
+                    None => {
+                        log::trace!("SentNotificationListener: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("SentNotificationListener: Received shutdown");
+                }
+            }
        }
-        error!("TODO: error msg. Or maybe panic?")
+        assert!(shutdown.is_shutdown_poll());
+        log::debug!("SentNotificationListener: Exiting");
    }
 }
@@ -0,0 +1,566 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::real_messages_control::acknowledgement_control::PendingAcknowledgement;
+use crate::client::real_messages_control::real_traffic_stream::{
+    BatchRealMessageSender, RealMessage,
+};
+use crate::client::real_messages_control::{AckActionSender, Action};
+use crate::client::replies::reply_storage::{ReceivedReplySurbsMap, SentReplyKeys, UsedSenderTags};
+use crate::client::topology_control::{TopologyAccessor, TopologyReadPermit};
+use log::{debug, error, info, trace, warn};
+use nym_sphinx::acknowledgements::AckKey;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, RepliableMessage, ReplyMessage};
+use nym_sphinx::anonymous_replies::{ReplySurb, SurbEncryptionKey};
+use nym_sphinx::chunking::fragment::{Fragment, FragmentIdentifier};
+use nym_sphinx::message::NymMessage;
+use nym_sphinx::params::{PacketSize, DEFAULT_NUM_MIX_HOPS};
+use nym_sphinx::preparer::{MessagePreparer, PreparedFragment};
+use nym_sphinx::Delay;
+use nym_task::connections::TransmissionLane;
+use nym_topology::{NymTopology, NymTopologyError};
+use rand::{CryptoRng, Rng};
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+use thiserror::Error;
+
+// TODO: move that error elsewhere since it seems to be contaminating different files
+#[derive(Debug, Clone, Error)]
+pub enum PreparationError {
+    #[error(transparent)]
+    NymTopologyError(#[from] NymTopologyError),
+
+    #[error("The received message cannot be sent using a single reply surb. It ended up getting split into {fragments} fragments.")]
+    MessageTooLongForSingleSurb { fragments: usize },
+
+    #[error("Not enough reply SURBs to send the message. We have {available} available and require at least {required}.")]
+    NotEnoughSurbs { available: usize, required: usize },
+}
+
+impl PreparationError {
+    fn return_surbs(self, returned_surbs: Vec<ReplySurb>) -> SurbWrappedPreparationError {
+        SurbWrappedPreparationError {
+            source: self,
+            returned_surbs: Some(returned_surbs),
+        }
+    }
+}
+
+#[derive(Debug, Error)]
+#[error("Failed to prepare packets - {source}. {} reply surbs will be returned", .returned_surbs.as_ref().map(|s| s.len()).unwrap_or_default())]
+pub struct SurbWrappedPreparationError {
+    #[source]
+    source: PreparationError,
+
+    returned_surbs: Option<Vec<ReplySurb>>,
+}
+
+impl<T> From<T> for SurbWrappedPreparationError
+where
+    T: Into<PreparationError>,
+{
+    fn from(err: T) -> Self {
+        SurbWrappedPreparationError {
+            source: err.into(),
+            returned_surbs: None,
+        }
+    }
+}
+
+impl SurbWrappedPreparationError {
+    pub(crate) fn return_unused_surbs(
+        self,
+        surb_storage: &ReceivedReplySurbsMap,
+        target: &AnonymousSenderTag,
+    ) -> PreparationError {
+        if let Some(reply_surbs) = self.returned_surbs {
+            surb_storage.insert_surbs(target, reply_surbs)
+        }
+        self.source
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct Config {
+    /// Key used to decrypt contents of received SURBAcks
+    ack_key: Arc<AckKey>,
+
+    /// Address of this client which also represent an address to which all acknowledgements
+    /// and surb-based are going to be sent.
+    sender_address: Recipient,
+
+    /// Average delay a data packet is going to get delay at a single mixnode.
+    average_packet_delay: Duration,
+
+    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
+    average_ack_delay: Duration,
+
+    /// Number of mix hops each packet ('real' message, ack, reply) is expected to take.
+    /// Note that it does not include gateway hops.
+    num_mix_hops: u8,
+
+    /// Predefined packet size used for the encapsulated messages.
+    packet_size: PacketSize,
+}
+
+impl Config {
+    pub fn new(
+        ack_key: Arc<AckKey>,
+        sender_address: Recipient,
+        average_packet_delay: Duration,
+        average_ack_delay: Duration,
+    ) -> Self {
+        Config {
+            ack_key,
+            sender_address,
+            average_packet_delay,
+            average_ack_delay,
+            num_mix_hops: DEFAULT_NUM_MIX_HOPS,
+            packet_size: PacketSize::default(),
+        }
+    }
+
+    /// Allows setting non-default number of expected mix hops in the network.
+    #[allow(dead_code)]
+    pub fn with_mix_hops(mut self, hops: u8) -> Self {
+        self.num_mix_hops = hops;
+        self
+    }
+
+    /// Allows setting non-default size of the sphinx packets sent out.
+    pub fn with_custom_packet_size(mut self, packet_size: PacketSize) -> Self {
+        self.packet_size = packet_size;
+        self
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct MessageHandler<R> {
+    config: Config,
+    rng: R,
+    message_preparer: MessagePreparer<R>,
+    action_sender: AckActionSender,
+    real_message_sender: BatchRealMessageSender,
+    topology_access: TopologyAccessor,
+    reply_key_storage: SentReplyKeys,
+    tag_storage: UsedSenderTags,
+}
+
+impl<R> MessageHandler<R>
+where
+    R: CryptoRng + Rng,
+{
+    pub(crate) fn new(
+        config: Config,
+        rng: R,
+        action_sender: AckActionSender,
+        real_message_sender: BatchRealMessageSender,
+        topology_access: TopologyAccessor,
+        reply_key_storage: SentReplyKeys,
+        tag_storage: UsedSenderTags,
+    ) -> Self
+    where
+        R: Copy,
+    {
+        let message_preparer = MessagePreparer::new(
+            rng,
+            config.sender_address,
+            config.average_packet_delay,
+            config.average_ack_delay,
+        )
+        .with_custom_real_message_packet_size(config.packet_size)
+        .with_mix_hops(config.num_mix_hops);
+
+        MessageHandler {
+            config,
+            rng,
+            message_preparer,
+            action_sender,
+            real_message_sender,
+            topology_access,
+            reply_key_storage,
+            tag_storage,
+        }
+    }
+
+    fn get_or_create_sender_tag(&mut self, recipient: &Recipient) -> AnonymousSenderTag {
+        if let Some(existing) = self.tag_storage.try_get_existing(recipient) {
+            trace!("we already had sender tag for {recipient}");
+            existing
+        } else {
+            info!("creating new sender tag for {recipient}");
+            let new_tag = AnonymousSenderTag::new_random(&mut self.rng);
+            self.tag_storage.insert_new(recipient, new_tag);
+            info!("we'll be using {new_tag} for all anonymous messages sent to {recipient}");
+            new_tag
+        }
+    }
+
+    fn get_topology<'a>(
+        &self,
+        permit: &'a TopologyReadPermit<'a>,
+    ) -> Result<&'a NymTopology, PreparationError> {
+        match permit.try_get_valid_topology_ref(&self.config.sender_address, None) {
+            Ok(topology_ref) => Ok(topology_ref),
+            Err(err) => {
+                warn!("Could not process the packet - the network topology is invalid - {err}");
+                Err(err.into())
+            }
+        }
+    }
+
+    async fn generate_reply_surbs_with_keys(
+        &mut self,
+        amount: usize,
+    ) -> Result<(Vec<ReplySurb>, Vec<SurbEncryptionKey>), PreparationError> {
+        let topology_permit = self.topology_access.get_read_permit().await;
+        let topology = self.get_topology(&topology_permit)?;
+
+        let reply_surbs = self
+            .message_preparer
+            .generate_reply_surbs(amount, topology)?;
+
+        let reply_keys = reply_surbs
+            .iter()
+            .map(|s| *s.encryption_key())
+            .collect::<Vec<_>>();
+
+        Ok((reply_surbs, reply_keys))
+    }
+
+    pub(crate) async fn try_send_single_surb_message(
+        &mut self,
+        target: AnonymousSenderTag,
+        message: ReplyMessage,
+        reply_surb: ReplySurb,
+        is_extra_surb_request: bool,
+    ) -> Result<(), SurbWrappedPreparationError> {
+        let mut fragment = self
+            .message_preparer
+            .pad_and_split_message(NymMessage::new_reply(message));
+        if fragment.len() > 1 {
+            // well, it's not a single surb message
+            return Err(SurbWrappedPreparationError {
+                source: PreparationError::MessageTooLongForSingleSurb {
+                    fragments: fragment.len(),
+                },
+                returned_surbs: Some(vec![reply_surb]),
+            });
+        }
+
+        let chunk = fragment.pop().unwrap();
+        let chunk_clone = chunk.clone();
+        let prepared_fragment = self
+            .try_prepare_single_reply_chunk_for_sending(reply_surb, chunk_clone)
+            .await?;
+
+        let real_messages =
+            RealMessage::new(prepared_fragment.mix_packet, chunk.fragment_identifier());
+        let delay = prepared_fragment.total_delay;
+        let pending_ack =
+            PendingAcknowledgement::new_anonymous(chunk, delay, target, is_extra_surb_request);
+
+        let lane = if is_extra_surb_request {
+            TransmissionLane::ReplySurbRequest
+        } else {
+            TransmissionLane::General
+        };
+
+        self.forward_messages(vec![real_messages], lane).await;
+        self.insert_pending_acks(vec![pending_ack]);
+        Ok(())
+    }
+
+    pub(crate) async fn try_request_additional_reply_surbs(
+        &mut self,
+        from: AnonymousSenderTag,
+        reply_surb: ReplySurb,
+        amount: u32,
+    ) -> Result<(), SurbWrappedPreparationError> {
+        debug!("requesting {amount} reply SURBs from {from}");
+
+        let surbs_request =
+            ReplyMessage::new_surb_request_message(self.config.sender_address, amount);
+        self.try_send_single_surb_message(from, surbs_request, reply_surb, true)
+            .await
+    }
+
+    // // TODO: this will require additional argument to make it use different variant of `ReplyMessage`
+    pub(crate) fn split_reply_message(&mut self, message: Vec<u8>) -> Vec<Fragment> {
+        self.message_preparer
+            .pad_and_split_message(NymMessage::new_reply(ReplyMessage::new_data_message(
+                message,
+            )))
+    }
+
+    pub(crate) async fn send_retransmission_reply_chunks(
+        &mut self,
+        prepared_fragments: Vec<PreparedFragment>,
+        lane: TransmissionLane,
+    ) {
+        let mut real_messages = Vec::with_capacity(prepared_fragments.len());
+
+        for prepared in prepared_fragments {
+            self.update_ack_delay(prepared.fragment_identifier, prepared.total_delay);
+            real_messages.push(prepared.into())
+        }
+
+        self.forward_messages(real_messages, lane).await;
+    }
+
+    pub(crate) async fn try_send_reply_chunks_on_lane(
+        &mut self,
+        target: AnonymousSenderTag,
+        fragments: Vec<Fragment>,
+        reply_surbs: Vec<ReplySurb>,
+        lane: TransmissionLane,
+    ) -> Result<(), SurbWrappedPreparationError> {
+        // TODO: technically this is performing an unnecessary cloning, but in the grand scheme of things
+        // is it really that bad?
+        self.try_send_reply_chunks(
+            target,
+            fragments.into_iter().map(|f| (lane, f)).collect(),
+            reply_surbs,
+        )
+        .await
+    }
+
+    pub(crate) async fn try_send_reply_chunks(
+        &mut self,
+        target: AnonymousSenderTag,
+        fragments: Vec<(TransmissionLane, Fragment)>,
+        reply_surbs: Vec<ReplySurb>,
+    ) -> Result<(), SurbWrappedPreparationError> {
+        let prepared_fragments = self
+            .prepare_reply_chunks_for_sending(
+                fragments.iter().map(|(_, f)| f.clone()).collect(),
+                reply_surbs,
+            )
+            .await?;
+
+        let mut pending_acks = Vec::with_capacity(fragments.len());
+        let mut to_forward: HashMap<_, Vec<_>> = HashMap::new();
+
+        for (raw, prepared) in fragments.into_iter().zip(prepared_fragments.into_iter()) {
+            let lane = raw.0;
+            let fragment = raw.1;
+
+            let real_message = RealMessage::new(prepared.mix_packet, prepared.fragment_identifier);
+            let delay = prepared.total_delay;
+            let pending_ack = PendingAcknowledgement::new_anonymous(fragment, delay, target, false);
+
+            let entry = to_forward.entry(lane).or_default();
+            entry.push(real_message);
+            pending_acks.push(pending_ack);
+        }
+
+        for (lane, real_messages) in to_forward {
+            self.forward_messages(real_messages, lane).await;
+        }
+
+        self.insert_pending_acks(pending_acks);
+        Ok(())
+    }
+
+    pub(crate) async fn try_send_plain_message(
+        &mut self,
+        recipient: Recipient,
+        message: Vec<u8>,
+        lane: TransmissionLane,
+    ) -> Result<(), PreparationError> {
+        let message = NymMessage::new_plain(message);
+        self.try_split_and_send_non_reply_message(message, recipient, lane)
+            .await
+    }
+
+    pub(crate) async fn try_split_and_send_non_reply_message(
+        &mut self,
+        message: NymMessage,
+        recipient: Recipient,
+        lane: TransmissionLane,
+    ) -> Result<(), PreparationError> {
+        // TODO: I really dislike existence of this assertion, it implies code has to be re-organised
+        debug_assert!(!matches!(message, NymMessage::Reply(_)));
+
+        // TODO2: it's really annoying we have to get topology permit again here due to borrow-checker
+        let topology_permit = self.topology_access.get_read_permit().await;
+        let topology = self.get_topology(&topology_permit)?;
+
+        let fragments = self.message_preparer.pad_and_split_message(message);
+
+        let mut pending_acks = Vec::with_capacity(fragments.len());
+        let mut real_messages = Vec::with_capacity(fragments.len());
+        for fragment in fragments {
+            // we need to clone it because we need to keep it in memory in case we had to retransmit
+            // it. And then we'd need to recreate entire ACK again.
+            let chunk_clone = fragment.clone();
+            let prepared_fragment = self.message_preparer.prepare_chunk_for_sending(
+                chunk_clone,
+                topology,
+                &self.config.ack_key,
+                &recipient,
+            )?;
+
+            let real_message =
+                RealMessage::new(prepared_fragment.mix_packet, fragment.fragment_identifier());
+            let delay = prepared_fragment.total_delay;
+            let pending_ack = PendingAcknowledgement::new_known(fragment, delay, recipient);
+
+            real_messages.push(real_message);
+            pending_acks.push(pending_ack);
+        }
+
+        self.insert_pending_acks(pending_acks);
+        self.forward_messages(real_messages, lane).await;
+
+        Ok(())
+    }
+
+    pub(crate) async fn try_send_additional_reply_surbs(
+        &mut self,
+        recipient: Recipient,
+        amount: u32,
+    ) -> Result<(), PreparationError> {
+        let sender_tag = self.get_or_create_sender_tag(&recipient);
+        let (reply_surbs, reply_keys) =
+            self.generate_reply_surbs_with_keys(amount as usize).await?;
+
+        let message = NymMessage::new_repliable(RepliableMessage::new_additional_surbs(
+            sender_tag,
+            reply_surbs,
+        ));
+
+        self.try_split_and_send_non_reply_message(
+            message,
+            recipient,
+            TransmissionLane::AdditionalReplySurbs,
+        )
+        .await?;
+
+        log::trace!("storing {} reply keys", reply_keys.len());
+        self.reply_key_storage.insert_multiple(reply_keys);
+
+        Ok(())
+    }
+
+    pub(crate) async fn try_send_message_with_reply_surbs(
+        &mut self,
+        recipient: Recipient,
+        message: Vec<u8>,
+        num_reply_surbs: u32,
+        lane: TransmissionLane,
+    ) -> Result<(), SurbWrappedPreparationError> {
+        let sender_tag = self.get_or_create_sender_tag(&recipient);
+        let (reply_surbs, reply_keys) = self
+            .generate_reply_surbs_with_keys(num_reply_surbs as usize)
+            .await?;
+
+        let message =
+            NymMessage::new_repliable(RepliableMessage::new_data(message, sender_tag, reply_surbs));
+
+        self.try_split_and_send_non_reply_message(message, recipient, lane)
+            .await?;
+
+        log::trace!("storing {} reply keys", reply_keys.len());
+        self.reply_key_storage.insert_multiple(reply_keys);
+
+        Ok(())
+    }
+
+    pub(crate) async fn try_prepare_single_chunk_for_sending(
+        &mut self,
+        recipient: Recipient,
+        chunk: Fragment,
+    ) -> Result<PreparedFragment, PreparationError> {
+        let topology_permit = self.topology_access.get_read_permit().await;
+        let topology = self.get_topology(&topology_permit)?;
+
+        let prepared_fragment = self
+            .message_preparer
+            .prepare_chunk_for_sending(chunk, topology, &self.config.ack_key, &recipient)
+            .unwrap();
+
+        Ok(prepared_fragment)
+    }
+
+    pub(crate) async fn prepare_reply_chunks_for_sending(
+        &mut self,
+        fragments: Vec<Fragment>,
+        reply_surbs: Vec<ReplySurb>,
+    ) -> Result<Vec<PreparedFragment>, SurbWrappedPreparationError> {
+        debug_assert_ne!(
+            fragments.len(),
+            reply_surbs.len(),
+            "attempted to send {} fragments with {} reply surbs",
+            fragments.len(),
+            reply_surbs.len()
+        );
+
+        let topology_permit = self.topology_access.get_read_permit().await;
+        let topology = match self.get_topology(&topology_permit) {
+            Ok(topology) => topology,
+            Err(err) => return Err(err.return_surbs(reply_surbs)),
+        };
+
+        Ok(fragments
+            .into_iter()
+            .zip(reply_surbs.into_iter())
+            .map(|(fragment, reply_surb)| {
+                // unwrap here is fine as we know we have a valid topology
+                self.message_preparer
+                    .prepare_reply_chunk_for_sending(
+                        fragment,
+                        topology,
+                        &self.config.ack_key,
+                        reply_surb,
+                    )
+                    .unwrap()
+            })
+            .collect())
+    }
+
+    pub(crate) async fn try_prepare_single_reply_chunk_for_sending(
+        &mut self,
+        reply_surb: ReplySurb,
+        chunk: Fragment,
+    ) -> Result<PreparedFragment, SurbWrappedPreparationError> {
+        let topology_permit = self.topology_access.get_read_permit().await;
+        let topology = match self.get_topology(&topology_permit) {
+            Ok(topology) => topology,
+            Err(err) => return Err(err.return_surbs(vec![reply_surb])),
+        };
+
+        let prepared_fragment = self
+            .message_preparer
+            .prepare_reply_chunk_for_sending(chunk, topology, &self.config.ack_key, reply_surb)
+            .unwrap();
+
+        Ok(prepared_fragment)
+    }
+
+    pub(crate) fn update_ack_delay(&self, id: FragmentIdentifier, new_delay: Delay) {
+        self.action_sender
+            .unbounded_send(Action::UpdateDelay(id, new_delay))
+            .expect("action control task has died")
+    }
+
+    pub(crate) fn insert_pending_acks(&self, pending_acks: Vec<PendingAcknowledgement>) {
+        self.action_sender
+            .unbounded_send(Action::new_insert(pending_acks))
+            .expect("action control task has died")
+    }
+
+    // tells real message sender (with the poisson timer) to send this to the mix network
+    pub(crate) async fn forward_messages(
+        &self,
+        messages: Vec<RealMessage>,
+        transmission_lane: TransmissionLane,
+    ) {
+        self.real_message_sender
+            .send((messages, transmission_lane))
+            .await
+            .expect("real message receiver task (OutQueueControl) has died");
+    }
+}
@@ -8,24 +8,37 @@
 use self::{
    acknowledgement_control::AcknowledgementController, real_traffic_stream::OutQueueControl,
 };
-use crate::client::real_messages_control::acknowledgement_control::AcknowledgementControllerConnectors;
-use crate::client::reply_key_storage::ReplyKeyStorage;
-use crate::client::{
-    inbound_messages::InputMessageReceiver, mix_traffic::BatchMixMessageSender,
-    topology_control::TopologyAccessor,
+use crate::client::real_messages_control::message_handler::MessageHandler;
+use crate::client::replies::reply_controller::{
+    ReplyController, ReplyControllerReceiver, ReplyControllerSender,
+};
+use crate::client::replies::reply_storage::CombinedReplyStorage;
+use crate::{
+    client::{
+        inbound_messages::InputMessageReceiver, mix_traffic::BatchMixMessageSender,
+        real_messages_control::acknowledgement_control::AcknowledgementControllerConnectors,
+        topology_control::TopologyAccessor,
+    },
+    spawn_future,
 };
 use futures::channel::mpsc;
 use gateway_client::AcknowledgementReceiver;
 use log::*;
-use nymsphinx::acknowledgements::AckKey;
-use nymsphinx::addressing::clients::Recipient;
+use nym_sphinx::acknowledgements::AckKey;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::params::PacketSize;
+use nym_task::connections::{ConnectionCommandReceiver, LaneQueueLengths};
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::sync::Arc;
 use std::time::Duration;
-use tokio::task::JoinHandle;

-mod acknowledgement_control;
-mod real_traffic_stream;
+use crate::client::replies::reply_controller;
+use crate::config;
+pub(crate) use acknowledgement_control::{AckActionSender, Action};
+
+pub(crate) mod acknowledgement_control;
+pub(crate) mod message_handler;
+pub(crate) mod real_traffic_stream;

 // TODO: ack_key and self_recipient shouldn't really be part of this config
 pub struct Config {
@@ -49,130 +62,230 @@ pub struct Config {

    /// Average delay an acknowledgement packet is going to get delayed at a single mixnode.
    average_ack_delay_duration: Duration,
+
+    /// Controls whether the main packet stream constantly produces packets according to the predefined
+    /// poisson distribution.
+    disable_main_poisson_packet_distribution: bool,
+
+    /// Predefined packet size used for the encapsulated messages.
+    packet_size: PacketSize,
+
+    /// Defines the minimum number of reply surbs the client would request.
+    minimum_reply_surb_request_size: u32,
+
+    /// Defines the maximum number of reply surbs the client would request.
+    maximum_reply_surb_request_size: u32,
+
+    /// Defines the maximum number of reply surbs a remote party is allowed to request from this client at once.
+    maximum_allowed_reply_surb_request_size: u32,
+
+    /// Defines maximum amount of time the client is going to wait for reply surbs before explicitly asking
+    /// for more even though in theory they wouldn't need to.
+    maximum_reply_surb_rerequest_waiting_period: Duration,
+
+    /// Defines maximum amount of time the client is going to wait for reply surbs before
+    /// deciding it's never going to get them and would drop all pending messages
+    maximum_reply_surb_drop_waiting_period: Duration,
+
+    /// Defines maximum amount of time given reply surb is going to be valid for.
+    /// This is going to be superseded by key rotation once implemented.
+    maximum_reply_surb_age: Duration,
+
+    /// Defines maximum amount of time given reply key is going to be valid for.
+    /// This is going to be superseded by key rotation once implemented.
+    maximum_reply_key_age: Duration,
+}
+
+impl<'a> From<&'a Config> for acknowledgement_control::Config {
+    fn from(cfg: &'a Config) -> Self {
+        acknowledgement_control::Config::new(cfg.ack_wait_addition, cfg.ack_wait_multiplier)
+            .with_custom_packet_size(cfg.packet_size)
+    }
+}
+
+impl<'a> From<&'a Config> for real_traffic_stream::Config {
+    fn from(cfg: &'a Config) -> Self {
+        real_traffic_stream::Config::new(
+            Arc::clone(&cfg.ack_key),
+            cfg.self_recipient,
+            cfg.average_ack_delay_duration,
+            cfg.average_packet_delay_duration,
+            cfg.average_message_sending_delay,
+            cfg.disable_main_poisson_packet_distribution,
+        )
+        .with_custom_cover_packet_size(cfg.packet_size)
+    }
+}
+
+impl<'a> From<&'a Config> for reply_controller::Config {
+    fn from(cfg: &'a Config) -> Self {
+        reply_controller::Config::new(
+            cfg.minimum_reply_surb_request_size,
+            cfg.maximum_reply_surb_request_size,
+            cfg.maximum_allowed_reply_surb_request_size,
+            cfg.maximum_reply_surb_rerequest_waiting_period,
+            cfg.maximum_reply_surb_drop_waiting_period,
+            cfg.maximum_reply_surb_age,
+            cfg.maximum_reply_key_age,
+        )
+    }
+}
+
+impl<'a> From<&'a Config> for message_handler::Config {
+    fn from(cfg: &'a Config) -> Self {
+        message_handler::Config::new(
+            Arc::clone(&cfg.ack_key),
+            cfg.self_recipient,
+            cfg.average_packet_delay_duration,
+            cfg.average_ack_delay_duration,
+        )
+        .with_custom_packet_size(cfg.packet_size)
+    }
 }

 impl Config {
    pub fn new(
+        base_client_debug_config: &config::DebugConfig,
        ack_key: Arc<AckKey>,
-        ack_wait_multiplier: f64,
-        ack_wait_addition: Duration,
-        average_ack_delay_duration: Duration,
-        average_message_sending_delay: Duration,
-        average_packet_delay_duration: Duration,
        self_recipient: Recipient,
    ) -> Self {
        Config {
            ack_key,
-            ack_wait_addition,
-            ack_wait_multiplier,
            self_recipient,
-            average_message_sending_delay,
-            average_packet_delay_duration,
-            average_ack_delay_duration,
+            packet_size: Default::default(),
+            ack_wait_addition: base_client_debug_config.ack_wait_addition,
+            ack_wait_multiplier: base_client_debug_config.ack_wait_multiplier,
+            average_message_sending_delay: base_client_debug_config.message_sending_average_delay,
+            average_packet_delay_duration: base_client_debug_config.average_packet_delay,
+            average_ack_delay_duration: base_client_debug_config.average_ack_delay,
+            disable_main_poisson_packet_distribution: base_client_debug_config
+                .disable_main_poisson_packet_distribution,
+            minimum_reply_surb_request_size: base_client_debug_config
+                .minimum_reply_surb_request_size,
+            maximum_reply_surb_request_size: base_client_debug_config
+                .maximum_reply_surb_request_size,
+            maximum_allowed_reply_surb_request_size: base_client_debug_config
+                .maximum_allowed_reply_surb_request_size,
+            maximum_reply_surb_rerequest_waiting_period: base_client_debug_config
+                .maximum_reply_surb_rerequest_waiting_period,
+            maximum_reply_surb_drop_waiting_period: base_client_debug_config
+                .maximum_reply_surb_drop_waiting_period,
+            maximum_reply_surb_age: base_client_debug_config.maximum_reply_surb_age,
+            maximum_reply_key_age: base_client_debug_config.maximum_reply_key_age,
        }
    }
+
+    pub fn set_custom_packet_size(&mut self, packet_size: PacketSize) {
+        self.packet_size = packet_size;
+    }
 }

-pub struct RealMessagesController<R>
+pub(crate) struct RealMessagesController<R>
 where
    R: CryptoRng + Rng,
 {
-    out_queue_control: Option<OutQueueControl<R>>,
-    ack_control: Option<AcknowledgementController<R>>,
+    out_queue_control: OutQueueControl<R>,
+    ack_control: AcknowledgementController<R>,
+    reply_control: ReplyController<R>,
 }

 // obviously when we finally make shared rng that is on 'higher' level, this should become
 // generic `R`
 impl RealMessagesController<OsRng> {
-    pub fn new(
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) fn new(
        config: Config,
        ack_receiver: AcknowledgementReceiver,
        input_receiver: InputMessageReceiver,
        mix_sender: BatchMixMessageSender,
        topology_access: TopologyAccessor,
-        reply_key_storage: ReplyKeyStorage,
+        reply_storage: CombinedReplyStorage,
+        // so much refactoring needed, but this is temporary just to test things out
+        reply_controller_sender: ReplyControllerSender,
+        reply_controller_receiver: ReplyControllerReceiver,
+        lane_queue_lengths: LaneQueueLengths,
+        client_connection_rx: ConnectionCommandReceiver,
    ) -> Self {
        let rng = OsRng;

-        let (real_message_sender, real_message_receiver) = mpsc::unbounded();
+        // create channels for inter-task communication
+        let (real_message_sender, real_message_receiver) = tokio::sync::mpsc::channel(1);
        let (sent_notifier_tx, sent_notifier_rx) = mpsc::unbounded();
-
+        let (ack_action_tx, ack_action_rx) = mpsc::unbounded();
        let ack_controller_connectors = AcknowledgementControllerConnectors::new(
-            real_message_sender,
            input_receiver,
            sent_notifier_rx,
            ack_receiver,
+            ack_action_tx.clone(),
+            ack_action_rx,
        );

-        let ack_control_config = acknowledgement_control::Config::new(
-            config.ack_wait_addition,
-            config.ack_wait_multiplier,
-            config.average_ack_delay_duration,
-            config.average_packet_delay_duration,
+        // create all configs for the components
+        let ack_control_config = (&config).into();
+        let out_queue_config = (&config).into();
+        let reply_controller_config = (&config).into();
+        let message_handler_config = (&config).into();
+
+        // create the actual components
+        let message_handler = MessageHandler::new(
+            message_handler_config,
+            rng,
+            ack_action_tx,
+            real_message_sender,
+            topology_access.clone(),
+            reply_storage.key_storage(),
+            reply_storage.tags_storage(),
        );

        let ack_control = AcknowledgementController::new(
            ack_control_config,
-            rng,
-            topology_access.clone(),
            Arc::clone(&config.ack_key),
-            config.self_recipient,
-            reply_key_storage,
            ack_controller_connectors,
+            message_handler.clone(),
+            reply_controller_sender,
        );

-        let out_queue_config = real_traffic_stream::Config::new(
-            config.average_ack_delay_duration,
-            config.average_packet_delay_duration,
-            config.average_message_sending_delay,
+        let reply_control = ReplyController::new(
+            reply_controller_config,
+            message_handler,
+            reply_storage,
+            reply_controller_receiver,
        );

        let out_queue_control = OutQueueControl::new(
            out_queue_config,
-            Arc::clone(&config.ack_key),
+            rng,
            sent_notifier_tx,
            mix_sender,
            real_message_receiver,
-            rng,
-            config.self_recipient,
            topology_access,
+            lane_queue_lengths,
+            client_connection_rx,
        );

        RealMessagesController {
-            out_queue_control: Some(out_queue_control),
-            ack_control: Some(ack_control),
+            out_queue_control,
+            ack_control,
+            reply_control,
        }
    }

-    pub(super) async fn run(&mut self) {
-        let mut out_queue_control = self.out_queue_control.take().unwrap();
-        let mut ack_control = self.ack_control.take().unwrap();
+    pub fn start_with_shutdown(self, shutdown: nym_task::TaskClient) {
+        let mut out_queue_control = self.out_queue_control;
+        let ack_control = self.ack_control;
+        let mut reply_control = self.reply_control;

-        // the below are log messages are errors as at the current stage we do not expect any of
-        // the task to ever finish. This will of course change once we introduce
-        // graceful shutdowns.
-        let out_queue_control_fut = tokio::spawn(async move {
-            out_queue_control.run_out_queue_control().await;
-            error!("The out queue controller has finished execution!");
-            out_queue_control
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
+            out_queue_control.run_with_shutdown(shutdown_handle).await;
+            debug!("The out queue controller has finished execution!");
        });
-        let ack_control_fut = tokio::spawn(async move {
-            ack_control.run().await;
-            error!("The acknowledgement controller has finished execution!");
-            ack_control
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
+            reply_control.run_with_shutdown(shutdown_handle).await;
+            debug!("The reply controller has finished execution!");
        });

-        // technically we don't have to bring `RealMessagesController` back to a valid state
-        // but we can do it, so why not? Perhaps it might be useful if we wanted to allow
-        // for restarts of certain modules without killing the entire process.
-        self.out_queue_control = Some(out_queue_control_fut.await.unwrap());
-        self.ack_control = Some(ack_control_fut.await.unwrap());
-    }
-
-    pub fn start(mut self) -> JoinHandle<Self> {
-        tokio::spawn(async move {
-            self.run().await;
-            self
-        })
+        ack_control.start_with_shutdown(shutdown);
    }
 }
@@ -1,28 +1,46 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use self::sending_delay_controller::SendingDelayController;
 use crate::client::mix_traffic::BatchMixMessageSender;
 use crate::client::real_messages_control::acknowledgement_control::SentPacketNotificationSender;
 use crate::client::topology_control::TopologyAccessor;
-use futures::channel::mpsc;
+use crate::client::transmission_buffer::TransmissionBuffer;
 use futures::task::{Context, Poll};
 use futures::{Future, Stream, StreamExt};
 use log::*;
-use nymsphinx::acknowledgements::AckKey;
-use nymsphinx::addressing::clients::Recipient;
-use nymsphinx::chunking::fragment::FragmentIdentifier;
-use nymsphinx::cover::generate_loop_cover_packet;
-use nymsphinx::forwarding::packet::MixPacket;
-use nymsphinx::utils::sample_poisson_duration;
+use nym_sphinx::acknowledgements::AckKey;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::chunking::fragment::FragmentIdentifier;
+use nym_sphinx::cover::generate_loop_cover_packet;
+use nym_sphinx::forwarding::packet::MixPacket;
+use nym_sphinx::params::PacketSize;
+use nym_sphinx::preparer::PreparedFragment;
+use nym_sphinx::utils::sample_poisson_duration;
+use nym_task::connections::{
+    ConnectionCommand, ConnectionCommandReceiver, ConnectionId, LaneQueueLengths, TransmissionLane,
+};
 use rand::{CryptoRng, Rng};
-use std::collections::VecDeque;
 use std::pin::Pin;
 use std::sync::Arc;
 use std::time::Duration;
+
+#[cfg(not(target_arch = "wasm32"))]
 use tokio::time;

+#[cfg(target_arch = "wasm32")]
+use wasm_timer;
+
+mod sending_delay_controller;
+
 /// Configurable parameters of the `OutQueueControl`
 pub(crate) struct Config {
+    /// Key used to encrypt and decrypt content of an ACK packet.
+    ack_key: Arc<AckKey>,
+
+    /// Represents full address of this client.
+    our_full_destination: Recipient,
+
    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
    average_ack_delay: Duration,

@@ -31,20 +49,39 @@ pub(crate) struct Config {

    /// Average delay between sending subsequent packets.
    average_message_sending_delay: Duration,
+
+    /// Controls whether the stream constantly produces packets according to the predefined
+    /// poisson distribution.
+    disable_poisson_packet_distribution: bool,
+
+    /// Predefined packet size used for the loop cover messages.
+    cover_packet_size: PacketSize,
 }

 impl Config {
    pub(crate) fn new(
+        ack_key: Arc<AckKey>,
+        our_full_destination: Recipient,
        average_ack_delay: Duration,
        average_packet_delay: Duration,
        average_message_sending_delay: Duration,
+        disable_poisson_packet_distribution: bool,
    ) -> Self {
        Config {
+            ack_key,
+            our_full_destination,
            average_ack_delay,
            average_packet_delay,
            average_message_sending_delay,
+            disable_poisson_packet_distribution,
+            cover_packet_size: Default::default(),
        }
    }
+
+    pub fn with_custom_cover_packet_size(mut self, packet_size: PacketSize) -> Self {
+        self.cover_packet_size = packet_size;
+        self
+    }
 }

 pub(crate) struct OutQueueControl<R>
@@ -54,15 +91,20 @@ where
    /// Configurable parameters of the `ActionController`
    config: Config,

-    /// Key used to encrypt and decrypt content of an ACK packet.
-    ack_key: Arc<AckKey>,
-
    /// Channel used for notifying of a real packet being sent out. Used to start up retransmission timer.
    sent_notifier: SentPacketNotificationSender,

    /// Internal state, determined by `average_message_sending_delay`,
    /// used to keep track of when a next packet should be sent out.
-    next_delay: Pin<Box<time::Sleep>>,
+    #[cfg(not(target_arch = "wasm32"))]
+    next_delay: Option<Pin<Box<time::Sleep>>>,
+
+    #[cfg(target_arch = "wasm32")]
+    next_delay: Option<Pin<Box<wasm_timer::Delay>>>,
+
+    // To make sure we don't overload the mix_tx channel, we limit the rate we are pushing
+    // messages.
+    sending_delay_controller: SendingDelayController,

    /// Channel used for sending prepared sphinx packets to `MixTrafficController` that sends them
    /// out to the network without any further delays.
@@ -72,25 +114,45 @@ where
    /// before being sent out into the network.
    real_receiver: BatchRealMessageReceiver,

-    /// Represents full address of this client.
-    our_full_destination: Recipient,
-
    /// Instance of a cryptographically secure random number generator.
    rng: R,

    /// Accessor to the common instance of network topology.
    topology_access: TopologyAccessor,

-    /// Buffer containing all real messages received. It is first exhausted before more are pulled.
-    received_buffer: VecDeque<RealMessage>,
+    /// Buffer containing all incoming real messages keyed by transmission lane, that we will send
+    /// out to the mixnet.
+    transmission_buffer: TransmissionBuffer<RealMessage>,
+
+    /// Incoming channel for being notified of closed connections, so that we can close lanes
+    /// corresponding to connections. To avoid sending traffic unnecessary
+    client_connection_rx: ConnectionCommandReceiver,
+
+    /// Report queue lengths so that upstream can backoff sending data, and keep connections open.
+    lane_queue_lengths: LaneQueueLengths,
 }

+#[derive(Debug)]
 pub(crate) struct RealMessage {
    mix_packet: MixPacket,
    fragment_id: FragmentIdentifier,
+    // TODO: add info about it being constructed with reply-surb
+}
+
+impl From<PreparedFragment> for RealMessage {
+    fn from(fragment: PreparedFragment) -> Self {
+        RealMessage {
+            mix_packet: fragment.mix_packet,
+            fragment_id: fragment.fragment_identifier,
+        }
+    }
 }

 impl RealMessage {
+    pub(crate) fn packet_size(&self) -> usize {
+        self.mix_packet.sphinx_packet().len()
+    }
+
    pub(crate) fn new(mix_packet: MixPacket, fragment_id: FragmentIdentifier) -> Self {
        RealMessage {
            mix_packet,
@@ -101,63 +163,15 @@ impl RealMessage {

 // messages are already prepared, etc. the real point of it is to forward it to mix_traffic
 // after sufficient delay
-pub(crate) type BatchRealMessageSender = mpsc::UnboundedSender<Vec<RealMessage>>;
-type BatchRealMessageReceiver = mpsc::UnboundedReceiver<Vec<RealMessage>>;
+pub(crate) type BatchRealMessageSender =
+    tokio::sync::mpsc::Sender<(Vec<RealMessage>, TransmissionLane)>;
+type BatchRealMessageReceiver = tokio::sync::mpsc::Receiver<(Vec<RealMessage>, TransmissionLane)>;

 pub(crate) enum StreamMessage {
    Cover,
    Real(Box<RealMessage>),
 }

-impl<R> Stream for OutQueueControl<R>
-where
-    R: CryptoRng + Rng + Unpin,
-{
-    type Item = StreamMessage;
-
-    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
-        // it is not yet time to return a message
-        if self.next_delay.as_mut().poll(cx).is_pending() {
-            return Poll::Pending;
-        };
-
-        // we know it's time to send a message, so let's prepare delay for the next one
-        // Get the `now` by looking at the current `delay` deadline
-        let avg_delay = self.config.average_message_sending_delay;
-        let now = self.next_delay.deadline();
-        let next_poisson_delay = sample_poisson_duration(&mut self.rng, avg_delay);
-
-        // The next interval value is `next_poisson_delay` after the one that just
-        // yielded.
-        let next = now + next_poisson_delay;
-        self.next_delay.as_mut().reset(next);
-
-        // check if we have anything immediately available
-        if let Some(real_available) = self.received_buffer.pop_front() {
-            return Poll::Ready(Some(StreamMessage::Real(Box::new(real_available))));
-        }
-
-        // decide what kind of message to send
-        match Pin::new(&mut self.real_receiver).poll_next(cx) {
-            // in the case our real message channel stream was closed, we should also indicate we are closed
-            // (and whoever is using the stream should panic)
-            Poll::Ready(None) => Poll::Ready(None),
-
-            // if there are more messages available, return first one and store the rest
-            Poll::Ready(Some(real_messages)) => {
-                self.received_buffer = real_messages.into();
-                // we MUST HAVE received at least ONE message
-                Poll::Ready(Some(StreamMessage::Real(Box::new(
-                    self.received_buffer.pop_front().unwrap(),
-                ))))
-            }
-
-            // otherwise construct a dummy one
-            Poll::Pending => Poll::Ready(Some(StreamMessage::Cover)),
-        }
-    }
-}
-
 impl<R> OutQueueControl<R>
 where
    R: CryptoRng + Rng + Unpin,
@@ -167,25 +181,26 @@ where
    #[allow(clippy::too_many_arguments)]
    pub(crate) fn new(
        config: Config,
-        ack_key: Arc<AckKey>,
+        rng: R,
        sent_notifier: SentPacketNotificationSender,
        mix_tx: BatchMixMessageSender,
        real_receiver: BatchRealMessageReceiver,
-        rng: R,
-        our_full_destination: Recipient,
        topology_access: TopologyAccessor,
+        lane_queue_lengths: LaneQueueLengths,
+        client_connection_rx: ConnectionCommandReceiver,
    ) -> Self {
        OutQueueControl {
            config,
-            ack_key,
            sent_notifier,
-            next_delay: Box::pin(time::sleep(Default::default())),
+            next_delay: None,
+            sending_delay_controller: Default::default(),
            mix_tx,
            real_receiver,
-            our_full_destination,
            rng,
            topology_access,
-            received_buffer: VecDeque::with_capacity(0), // we won't be putting any data into this guy directly
+            transmission_buffer: TransmissionBuffer::new(),
+            client_connection_rx,
+            lane_queue_lengths,
        }
    }

@@ -200,70 +215,351 @@ where
    async fn on_message(&mut self, next_message: StreamMessage) {
        trace!("created new message");

-        let next_message = match next_message {
+        let (next_message, fragment_id) = match next_message {
            StreamMessage::Cover => {
                // TODO for way down the line: in very rare cases (during topology update) we might have
                // to wait a really tiny bit before actually obtaining the permit hence messing with our
                // poisson delay, but is it really a problem?
                let topology_permit = self.topology_access.get_read_permit().await;
                // the ack is sent back to ourselves (and then ignored)
-                let topology_ref_option = topology_permit.try_get_valid_topology_ref(
-                    &self.our_full_destination,
-                    Some(&self.our_full_destination),
-                );
-                if topology_ref_option.is_none() {
-                    warn!(
-                        "No valid topology detected - won't send any loop cover message this time"
-                    );
-                    return;
-                }
-                let topology_ref = topology_ref_option.unwrap();
+                let topology_ref = match topology_permit.try_get_valid_topology_ref(
+                    &self.config.our_full_destination,
+                    Some(&self.config.our_full_destination),
+                ) {
+                    Ok(topology) => topology,
+                    Err(err) => {
+                        warn!("We're not going to send any loop cover message this time, as the current topology seem to be invalid - {err}");
+                        return;
+                    }
+                };

-                generate_loop_cover_packet(
-                    &mut self.rng,
-                    topology_ref,
-                    &*self.ack_key,
-                    &self.our_full_destination,
-                    self.config.average_ack_delay,
-                    self.config.average_packet_delay,
+                (
+                    generate_loop_cover_packet(
+                        &mut self.rng,
+                        topology_ref,
+                        &self.config.ack_key,
+                        &self.config.our_full_destination,
+                        self.config.average_ack_delay,
+                        self.config.average_packet_delay,
+                        self.config.cover_packet_size,
+                    )
+                    .expect(
+                        "Somehow failed to generate a loop cover message with a valid topology",
+                    ),
+                    None,
                )
-                .expect("Somehow failed to generate a loop cover message with a valid topology")
            }
            StreamMessage::Real(real_message) => {
-                self.sent_notify(real_message.fragment_id);
-                real_message.mix_packet
+                (real_message.mix_packet, Some(real_message.fragment_id))
            }
        };

-        // if this one fails, there's no retrying because it means that either:
-        // - we run out of memory
-        // - the receiver channel is closed
-        // in either case there's no recovery and we can only panic
-        self.mix_tx.unbounded_send(vec![next_message]).unwrap();
+        if let Err(err) = self.mix_tx.send(vec![next_message]).await {
+            log::error!("Failed to send: {err}");
+        }
+
+        // notify ack controller about sending our message only after we actually managed to push it
+        // through the channel
+        if let Some(fragment_id) = fragment_id {
+            self.sent_notify(fragment_id);
+        }
+
+        // In addition to closing connections on receiving messages throught client_connection_rx,
+        // also close connections when sufficiently stale.
+        self.transmission_buffer.prune_stale_connections();

        // JS: Not entirely sure why or how it fixes stuff, but without the yield call,
        // the UnboundedReceiver [of mix_rx] will not get a chance to read anything
        // JS2: Basically it was the case that with high enough rate, the stream had already a next value
        // ready and hence was immediately re-scheduled causing other tasks to be starved;
        // yield makes it go back the scheduling queue regardless of its value availability
+
+        // TODO: temporary and BAD workaround for wasm (we should find a way to yield here in wasm)
+        #[cfg(not(target_arch = "wasm32"))]
        tokio::task::yield_now().await;
    }

-    // Send messages at certain rate and if no real traffic is available, send cover message.
-    async fn run_normal_out_queue(&mut self) {
-        // we should set initial delay only when we actually start the stream
-        self.next_delay = Box::pin(time::sleep(sample_poisson_duration(
-            &mut self.rng,
-            self.config.average_message_sending_delay,
-        )));
+    fn on_close_connection(&mut self, connection_id: ConnectionId) {
+        log::debug!("Removing lane for connection: {connection_id}");
+        self.transmission_buffer
+            .remove(&TransmissionLane::ConnectionId(connection_id));
+    }

-        while let Some(next_message) = self.next().await {
-            self.on_message(next_message).await;
+    fn current_average_message_sending_delay(&self) -> Duration {
+        self.config.average_message_sending_delay
+            * self.sending_delay_controller.current_multiplier()
+    }
+
+    fn adjust_current_average_message_sending_delay(&mut self) {
+        let used_slots = self.mix_tx.max_capacity() - self.mix_tx.capacity();
+        log::trace!(
+            "used_slots: {used_slots}, current_multiplier: {}",
+            self.sending_delay_controller.current_multiplier()
+        );
+
+        // Even just a single used slot is enough to signal backpressure
+        if used_slots > 0 {
+            log::trace!("Backpressure detected");
+            self.sending_delay_controller.record_backpressure_detected();
+        }
+
+        // If the buffer is running out, slow down the sending rate
+        if self.mix_tx.capacity() == 0
+            && self.sending_delay_controller.not_increased_delay_recently()
+        {
+            self.sending_delay_controller.increase_delay_multiplier();
+        }
+
+        // Very carefully step up the sending rate in case it seems like we can solidly handle the
+        // current rate.
+        if self.sending_delay_controller.is_sending_reliable() {
+            self.sending_delay_controller.decrease_delay_multiplier();
        }
    }

-    pub(crate) async fn run_out_queue_control(&mut self) {
-        debug!("Starting out queue controller...");
-        self.run_normal_out_queue().await
+    fn pop_next_message(&mut self) -> Option<RealMessage> {
+        // Pop the next message from the transmission buffer
+        let (lane, real_next) = self
+            .transmission_buffer
+            .pop_next_message_at_random(&mut self.rng)?;
+
+        // Update the published queue length
+        let lane_length = self.transmission_buffer.lane_length(&lane);
+        self.lane_queue_lengths.set(&lane, lane_length);
+
+        Some(real_next)
+    }
+
+    fn poll_poisson(&mut self, cx: &mut Context<'_>) -> Poll<Option<StreamMessage>> {
+        // The average delay could change depending on if backpressure in the downstream channel
+        // (mix_tx) was detected.
+        self.adjust_current_average_message_sending_delay();
+        let avg_delay = self.current_average_message_sending_delay();
+
+        // Start by checking if we have any incoming messages about closed connections
+        // NOTE: this feels a bit iffy, the `OutQueueControl` is getting ripe for a rewrite to
+        // something simpler.
+        if let Poll::Ready(Some(id)) = Pin::new(&mut self.client_connection_rx).poll_next(cx) {
+            match id {
+                ConnectionCommand::Close(id) => self.on_close_connection(id),
+            }
+        }
+
+        if let Some(ref mut next_delay) = &mut self.next_delay {
+            // it is not yet time to return a message
+            if next_delay.as_mut().poll(cx).is_pending() {
+                return Poll::Pending;
+            };
+
+            // we know it's time to send a message, so let's prepare delay for the next one
+            // Get the `now` by looking at the current `delay` deadline
+            let next_poisson_delay = sample_poisson_duration(&mut self.rng, avg_delay);
+
+            // The next interval value is `next_poisson_delay` after the one that just
+            // yielded.
+            #[cfg(not(target_arch = "wasm32"))]
+            {
+                let now = next_delay.deadline();
+                let next = now + next_poisson_delay;
+                next_delay.as_mut().reset(next);
+            }
+
+            #[cfg(target_arch = "wasm32")]
+            {
+                next_delay.as_mut().reset(next_poisson_delay);
+            }
+
+            // On every iteration we get new messages from upstream. Given that these come bunched
+            // in `Vec`, this ensures that on average we will fetch messages faster than we can
+            // send, which is a condition for being able to multiplex sphinx packets from multiple
+            // data streams.
+            match Pin::new(&mut self.real_receiver).poll_recv(cx) {
+                // in the case our real message channel stream was closed, we should also indicate we are closed
+                // (and whoever is using the stream should panic)
+                Poll::Ready(None) => Poll::Ready(None),
+
+                Poll::Ready(Some((real_messages, conn_id))) => {
+                    log::trace!("handling real_messages: size: {}", real_messages.len());
+
+                    self.transmission_buffer.store(&conn_id, real_messages);
+                    let real_next = self.pop_next_message().expect("Just stored one");
+
+                    Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
+                }
+
+                Poll::Pending => {
+                    if let Some(real_next) = self.pop_next_message() {
+                        Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
+                    } else {
+                        // otherwise construct a dummy one
+                        Poll::Ready(Some(StreamMessage::Cover))
+                    }
+                }
+            }
+        } else {
+            // we never set an initial delay - let's do it now
+            cx.waker().wake_by_ref();
+
+            let sampled =
+                sample_poisson_duration(&mut self.rng, self.config.average_message_sending_delay);
+
+            #[cfg(not(target_arch = "wasm32"))]
+            let next_delay = Box::pin(time::sleep(sampled));
+
+            #[cfg(target_arch = "wasm32")]
+            let next_delay = Box::pin(wasm_timer::Delay::new(sampled));
+
+            self.next_delay = Some(next_delay);
+
+            Poll::Pending
+        }
+    }
+
+    fn poll_immediate(&mut self, cx: &mut Context<'_>) -> Poll<Option<StreamMessage>> {
+        // Start by checking if we have any incoming messages about closed connections
+        if let Poll::Ready(Some(id)) = Pin::new(&mut self.client_connection_rx).poll_next(cx) {
+            match id {
+                ConnectionCommand::Close(id) => self.on_close_connection(id),
+            }
+        }
+
+        match Pin::new(&mut self.real_receiver).poll_recv(cx) {
+            // in the case our real message channel stream was closed, we should also indicate we are closed
+            // (and whoever is using the stream should panic)
+            Poll::Ready(None) => Poll::Ready(None),
+
+            Poll::Ready(Some((real_messages, conn_id))) => {
+                log::trace!("handling real_messages: size: {}", real_messages.len());
+
+                // First store what we got for the given connection id
+                self.transmission_buffer.store(&conn_id, real_messages);
+                let real_next = self.pop_next_message().expect("we just added one");
+
+                Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
+            }
+
+            Poll::Pending => {
+                if let Some(real_next) = self.pop_next_message() {
+                    Poll::Ready(Some(StreamMessage::Real(Box::new(real_next))))
+                } else {
+                    Poll::Pending
+                }
+            }
+        }
+    }
+
+    fn poll_next_message(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<StreamMessage>> {
+        if self.config.disable_poisson_packet_distribution {
+            self.poll_immediate(cx)
+        } else {
+            self.poll_poisson(cx)
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn log_status(&self, shutdown: &mut nym_task::TaskClient) {
+        use crate::error::ClientCoreStatusMessage;
+
+        let packets = self.transmission_buffer.total_size();
+        let backlog = self.transmission_buffer.total_size_in_bytes() as f64 / 1024.0;
+        let lanes = self.transmission_buffer.num_lanes();
+        let mult = self.sending_delay_controller.current_multiplier();
+        let delay = self.current_average_message_sending_delay().as_millis();
+        let status_str = if self.config.disable_poisson_packet_distribution {
+            format!("Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), no delay")
+        } else {
+            format!(
+                "Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), avg delay: {delay}ms ({mult})"
+            )
+        };
+        if packets > 1000 {
+            log::warn!("{status_str}");
+        } else if packets > 0 {
+            log::info!("{status_str}");
+        } else {
+            log::debug!("{status_str}");
+        }
+
+        // Send status message to whoever is listening (possibly UI)
+        if mult == self.sending_delay_controller.max_multiplier() {
+            shutdown.send_status_msg(Box::new(ClientCoreStatusMessage::GatewayIsVerySlow));
+        } else if mult > self.sending_delay_controller.min_multiplier() {
+            shutdown.send_status_msg(Box::new(ClientCoreStatusMessage::GatewayIsSlow));
+        }
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn log_status_infrequent(&self) {
+        if self.sending_delay_controller.current_multiplier() > 1 {
+            log::warn!(
+                "Unable to send packets at the default rate - rate reduced by setting the delay multiplier set to: {}",
+                self.sending_delay_controller.current_multiplier()
+            );
+        }
+    }
+
+    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started OutQueueControl with graceful shutdown support");
+
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let mut status_timer = tokio::time::interval(Duration::from_secs(5));
+            let mut infrequent_status_timer = tokio::time::interval(Duration::from_secs(60));
+
+            while !shutdown.is_shutdown() {
+                tokio::select! {
+                    biased;
+                    _ = shutdown.recv_with_delay() => {
+                        log::trace!("OutQueueControl: Received shutdown");
+                    }
+                    _ = status_timer.tick() => {
+                        self.log_status(&mut shutdown);
+                    }
+                    _ = infrequent_status_timer.tick() => {
+                        self.log_status_infrequent();
+                    }
+                    next_message = self.next() => if let Some(next_message) = next_message {
+                        self.on_message(next_message).await;
+                    } else {
+                        log::trace!("OutQueueControl: Stopping since channel closed");
+                        break;
+                    }
+                }
+            }
+            shutdown.recv_timeout().await;
+        }
+
+        #[cfg(target_arch = "wasm32")]
+        {
+            while !shutdown.is_shutdown() {
+                tokio::select! {
+                    biased;
+                    _ = shutdown.recv() => {
+                        log::trace!("OutQueueControl: Received shutdown");
+                    }
+                    next_message = self.next() => if let Some(next_message) = next_message {
+                        self.on_message(next_message).await;
+                    } else {
+                        log::trace!("OutQueueControl: Stopping since channel closed");
+                        break;
+                    }
+                }
+            }
+        }
+        log::debug!("OutQueueControl: Exiting");
+    }
+}
+
+impl<R> Stream for OutQueueControl<R>
+where
+    R: CryptoRng + Rng + Unpin,
+{
+    type Item = StreamMessage;
+
+    fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        self.poll_next_message(cx)
    }
 }
@@ -0,0 +1,121 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::helpers::{get_time_now, Instant};
+use std::time::Duration;
+
+// The minimum time between increasing the average delay between packets. If we hit the ceiling in
+// the available buffer space we want to take somewhat swift action, but we still need to give a
+// short time to give the channel a chance reduce pressure.
+const INCREASE_DELAY_MIN_CHANGE_INTERVAL_SECS: u64 = 1;
+// The minimum time between decreasing the average delay between packets. We don't want to change
+// to quickly to keep things somewhat stable. Also there are buffers downstreams meaning we need to
+// wait a little to see the effect before we decrease further.
+const DECREASE_DELAY_MIN_CHANGE_INTERVAL_SECS: u64 = 30;
+// If we enough time passes without any sign of backpressure in the channel, we can consider
+// lowering the average delay. The goal is to keep somewhat stable, rather than maxing out
+// bandwidth at all times.
+const ACCEPTABLE_TIME_WITHOUT_BACKPRESSURE_SECS: u64 = 30;
+// The maximum multiplier we apply to the base average Poisson delay.
+const MAX_DELAY_MULTIPLIER: u32 = 6;
+// The minium multiplier we apply to the base average Poisson delay.
+const MIN_DELAY_MULTIPLIER: u32 = 1;
+
+pub(crate) struct SendingDelayController {
+    /// Multiply the average sending delay.
+    /// This is normally set to unity, but if we detect backpressure we increase this
+    /// multiplier. We use discrete steps.
+    current_multiplier: u32,
+
+    /// Maximum delay multiplier
+    upper_bound: u32,
+
+    /// Minimum delay multiplier
+    lower_bound: u32,
+
+    /// To make sure we don't change the multiplier to fast, we limit a change to some duration
+    time_when_changed: Instant,
+
+    /// If we have a long enough time without any backpressure detected we try reducing the sending
+    /// delay multiplier
+    time_when_backpressure_detected: Instant,
+}
+
+impl Default for SendingDelayController {
+    fn default() -> Self {
+        SendingDelayController::new(MIN_DELAY_MULTIPLIER, MAX_DELAY_MULTIPLIER)
+    }
+}
+
+impl SendingDelayController {
+    pub(crate) fn new(lower_bound: u32, upper_bound: u32) -> Self {
+        assert!(lower_bound <= upper_bound);
+        let now = get_time_now();
+        SendingDelayController {
+            current_multiplier: MIN_DELAY_MULTIPLIER,
+            upper_bound,
+            lower_bound,
+            time_when_changed: now,
+            time_when_backpressure_detected: now,
+        }
+    }
+
+    pub(crate) fn current_multiplier(&self) -> u32 {
+        self.current_multiplier
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn min_multiplier(&self) -> u32 {
+        self.lower_bound
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn max_multiplier(&self) -> u32 {
+        self.upper_bound
+    }
+
+    pub(crate) fn increase_delay_multiplier(&mut self) {
+        if self.current_multiplier < self.upper_bound {
+            self.current_multiplier =
+                (self.current_multiplier + 1).clamp(self.lower_bound, self.upper_bound);
+            self.time_when_changed = get_time_now();
+            log::warn!(
+                "Increasing sending delay multiplier to: {}",
+                self.current_multiplier
+            );
+        } else {
+            log::warn!("Trying to increase delay multipler higher than allowed");
+        }
+    }
+
+    pub(crate) fn decrease_delay_multiplier(&mut self) {
+        if self.current_multiplier > self.lower_bound {
+            self.current_multiplier =
+                (self.current_multiplier - 1).clamp(self.lower_bound, self.upper_bound);
+            self.time_when_changed = get_time_now();
+            log::debug!(
+                "Decreasing sending delay multiplier to: {}",
+                self.current_multiplier
+            );
+        }
+    }
+
+    pub(crate) fn record_backpressure_detected(&mut self) {
+        self.time_when_backpressure_detected = get_time_now();
+    }
+
+    pub(crate) fn not_increased_delay_recently(&self) -> bool {
+        get_time_now()
+            > self.time_when_changed + Duration::from_secs(INCREASE_DELAY_MIN_CHANGE_INTERVAL_SECS)
+    }
+
+    pub(crate) fn is_sending_reliable(&self) -> bool {
+        let now = get_time_now();
+        let delay_change_interval = Duration::from_secs(DECREASE_DELAY_MIN_CHANGE_INTERVAL_SECS);
+        let acceptable_time_without_backpressure =
+            Duration::from_secs(ACCEPTABLE_TIME_WITHOUT_BACKPRESSURE_SECS);
+
+        now > self.time_when_backpressure_detected + acceptable_time_without_backpressure
+            && now > self.time_when_changed + delay_change_interval
+    }
+}
@@ -1,21 +1,25 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::client::reply_key_storage::ReplyKeyStorage;
-use crypto::asymmetric::encryption;
-use crypto::symmetric::stream_cipher;
-use crypto::Digest;
+use crate::client::replies::reply_controller::ReplyControllerSender;
+use crate::client::replies::reply_storage::SentReplyKeys;
+use crate::spawn_future;
 use futures::channel::mpsc;
 use futures::lock::Mutex;
 use futures::StreamExt;
 use gateway_client::MixnetMessageReceiver;
 use log::*;
-use nymsphinx::anonymous_replies::{encryption_key::EncryptionKeyDigest, SurbEncryptionKey};
-use nymsphinx::params::{ReplySurbEncryptionAlgorithm, ReplySurbKeyDigestAlgorithm};
-use nymsphinx::receiver::{MessageReceiver, MessageRecoveryError, ReconstructedMessage};
+use nym_crypto::asymmetric::encryption;
+use nym_crypto::Digest;
+use nym_sphinx::anonymous_replies::requests::{
+    RepliableMessage, RepliableMessageContent, ReplyMessage, ReplyMessageContent,
+};
+use nym_sphinx::anonymous_replies::{encryption_key::EncryptionKeyDigest, SurbEncryptionKey};
+use nym_sphinx::message::{NymMessage, PlainMessage};
+use nym_sphinx::params::ReplySurbKeyDigestAlgorithm;
+use nym_sphinx::receiver::{MessageReceiver, MessageRecoveryError, ReconstructedMessage};
 use std::collections::HashSet;
 use std::sync::Arc;
-use tokio::task::JoinHandle;

 // Buffer Requests to say "hey, send any reconstructed messages to this channel"
 // or to say "hey, I'm going offline, don't send anything more to me. Just buffer them instead"
@@ -42,26 +46,15 @@ struct ReceivedMessagesBufferInner {
 }

 impl ReceivedMessagesBufferInner {
-    fn process_received_fragment(&mut self, raw_fragment: Vec<u8>) -> Option<ReconstructedMessage> {
-        let fragment_data = match self
-            .message_receiver
-            .recover_plaintext(self.local_encryption_keypair.private_key(), raw_fragment)
-        {
-            Err(e) => {
-                warn!("failed to recover fragment data: {:?}. The whole underlying message might be corrupted and unrecoverable!", e);
-                return None;
-            }
-            Ok(frag_data) => frag_data,
-        };
-
-        if nymsphinx::cover::is_cover(&fragment_data) {
+    fn recover_from_fragment(&mut self, fragment_data: &[u8]) -> Option<NymMessage> {
+        if nym_sphinx::cover::is_cover(fragment_data) {
            trace!("The message was a loop cover message! Skipping it");
            return None;
        }

-        let fragment = match self.message_receiver.recover_fragment(&fragment_data) {
-            Err(e) => {
-                warn!("failed to recover fragment from raw data: {:?}. The whole underlying message might be corrupted and unrecoverable!", e);
+        let fragment = match self.message_receiver.recover_fragment(fragment_data) {
+            Err(err) => {
+                warn!("failed to recover fragment from raw data: {err}. The whole underlying message might be corrupted and unrecoverable!");
                return None;
            }
            Ok(frag) => frag,
@@ -75,9 +68,10 @@ impl ReceivedMessagesBufferInner {
        // if we returned an error the underlying message is malformed in some way
        match self.message_receiver.insert_new_fragment(fragment) {
            Err(err) => match err {
-                MessageRecoveryError::MalformedReconstructedMessage(message_sets) => {
+                MessageRecoveryError::MalformedReconstructedMessage { source, used_sets } => {
+                    error!("message reconstruction failed - {source}. Attempting to re-use the message sets...");
                    // TODO: should we really insert reconstructed sets? could this be abused for some attack?
-                    for set_id in message_sets {
+                    for set_id in used_sets {
                        if !self.recently_reconstructed.insert(set_id) {
                            // or perhaps we should even panic at this point?
                            error!("Reconstructed another message containing already used set id!")
@@ -103,6 +97,34 @@ impl ReceivedMessagesBufferInner {
            },
        }
    }
+
+    fn process_received_reply(
+        &mut self,
+        reply_ciphertext: &mut [u8],
+        reply_key: SurbEncryptionKey,
+    ) -> Option<NymMessage> {
+        // note: this performs decryption IN PLACE without extra allocation
+        self.message_receiver
+            .recover_plaintext_from_reply(reply_ciphertext, reply_key);
+        let fragment_data = reply_ciphertext;
+
+        self.recover_from_fragment(fragment_data)
+    }
+
+    fn process_received_regular_packet(&mut self, mut raw_fragment: Vec<u8>) -> Option<NymMessage> {
+        let fragment_data = match self.message_receiver.recover_plaintext_from_regular_packet(
+            self.local_encryption_keypair.private_key(),
+            &mut raw_fragment,
+        ) {
+            Err(err) => {
+                warn!("failed to recover fragment data: {err}. The whole underlying message might be corrupted and unrecoverable!");
+                return None;
+            }
+            Ok(frag_data) => frag_data,
+        };
+
+        self.recover_from_fragment(fragment_data)
+    }
 }

 #[derive(Debug, Clone)]
@@ -110,16 +132,15 @@ impl ReceivedMessagesBufferInner {
 // You should always use .clone() to create additional instances
 struct ReceivedMessagesBuffer {
    inner: Arc<Mutex<ReceivedMessagesBufferInner>>,
-
-    /// Storage containing keys to all [`ReplySURB`]s ever sent out that we did not receive back.
-    // There's no need to put it behind a Mutex since it's already properly concurrent
-    reply_key_storage: ReplyKeyStorage,
+    reply_key_storage: SentReplyKeys,
+    reply_controller_sender: ReplyControllerSender,
 }

 impl ReceivedMessagesBuffer {
    fn new(
        local_encryption_keypair: Arc<encryption::KeyPair>,
-        reply_key_storage: ReplyKeyStorage,
+        reply_key_storage: SentReplyKeys,
+        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
        ReceivedMessagesBuffer {
            inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
@@ -130,6 +151,7 @@ impl ReceivedMessagesBuffer {
                recently_reconstructed: HashSet::new(),
            })),
            reply_key_storage,
+            reply_controller_sender,
        }
    }

@@ -171,37 +193,143 @@ impl ReceivedMessagesBuffer {
        guard.message_sender = Some(sender);
    }

-    async fn add_reconstructed_messages(&mut self, msgs: Vec<ReconstructedMessage>) {
-        debug!("Adding {:?} new messages to the buffer!", msgs.len());
-        trace!("Adding new messages to the buffer! {:?}", msgs);
-        self.inner.lock().await.messages.extend(msgs)
+    fn handle_reconstructed_plain_messages(
+        &mut self,
+        msgs: Vec<PlainMessage>,
+    ) -> Vec<ReconstructedMessage> {
+        msgs.into_iter().map(Into::into).collect()
    }

-    fn process_received_reply(
-        reply_ciphertext: &[u8],
-        reply_key: SurbEncryptionKey,
-    ) -> Option<ReconstructedMessage> {
-        let zero_iv = stream_cipher::zero_iv::<ReplySurbEncryptionAlgorithm>();
+    fn handle_reconstructed_repliable_messages(
+        &mut self,
+        msgs: Vec<RepliableMessage>,
+    ) -> Vec<ReconstructedMessage> {
+        let mut reconstructed = Vec::new();
+        for msg in msgs {
+            let (reply_surbs, from_surb_request) = match msg.content {
+                RepliableMessageContent::Data {
+                    message,
+                    reply_surbs,
+                } => {
+                    trace!(
+                        "received message that also contained additional {} reply surbs from {:?}!",
+                        reply_surbs.len(),
+                        msg.sender_tag
+                    );

-        let mut reply_msg = stream_cipher::decrypt::<ReplySurbEncryptionAlgorithm>(
-            reply_key.inner(),
-            &zero_iv,
-            reply_ciphertext,
+                    reconstructed.push(ReconstructedMessage::new(message, msg.sender_tag));
+
+                    (reply_surbs, false)
+                }
+                RepliableMessageContent::AdditionalSurbs { reply_surbs } => {
+                    trace!(
+                        "received additional {} reply surbs from {:?}!",
+                        reply_surbs.len(),
+                        msg.sender_tag
+                    );
+                    (reply_surbs, true)
+                }
+                RepliableMessageContent::Heartbeat {
+                    additional_reply_surbs,
+                } => {
+                    error!("received a repliable heartbeat message - we don't know how to handle it yet (and we won't know until future PRs)");
+                    (additional_reply_surbs, false)
+                }
+            };
+
+            self.reply_controller_sender.send_additional_surbs(
+                msg.sender_tag,
+                reply_surbs,
+                from_surb_request,
+            )
+        }
+        reconstructed
+    }
+
+    fn handle_reconstructed_reply_messages(
+        &mut self,
+        msgs: Vec<ReplyMessage>,
+    ) -> Vec<ReconstructedMessage> {
+        let mut reconstructed = Vec::new();
+        for msg in msgs {
+            match msg.content {
+                ReplyMessageContent::Data { message } => reconstructed.push(message.into()),
+                ReplyMessageContent::SurbRequest { recipient, amount } => {
+                    debug!("received request for {amount} additional reply SURBs from {recipient}");
+                    self.reply_controller_sender
+                        .send_additional_surbs_request(*recipient, amount);
+                }
+            }
+        }
+        reconstructed
+    }
+
+    async fn handle_reconstructed_messages(&mut self, msgs: Vec<NymMessage>) {
+        if msgs.is_empty() {
+            return;
+        }
+
+        let mut plain_messages = Vec::new();
+        let mut repliable_messages = Vec::new();
+        let mut reply_messages = Vec::new();
+
+        for msg in msgs {
+            match msg {
+                NymMessage::Plain(plain) => plain_messages.push(plain),
+                NymMessage::Repliable(repliable) => repliable_messages.push(repliable),
+                NymMessage::Reply(reply) => reply_messages.push(reply),
+            }
+        }
+
+        let mut reconstructed_messages = self.handle_reconstructed_plain_messages(plain_messages);
+        reconstructed_messages
+            .append(&mut self.handle_reconstructed_repliable_messages(repliable_messages));
+        reconstructed_messages
+            .append(&mut self.handle_reconstructed_reply_messages(reply_messages));
+
+        let mut inner_guard = self.inner.lock().await;
+        debug!(
+            "Adding {:?} new messages to the buffer!",
+            reconstructed_messages.len()
        );
-        if let Err(err) = MessageReceiver::remove_padding(&mut reply_msg) {
-            warn!("Received reply had malformed padding! - {:?}", err);
-            None
+
+        if let Some(sender) = &inner_guard.message_sender {
+            trace!("Sending reconstructed messages to announced sender");
+            if let Err(err) = sender.unbounded_send(reconstructed_messages) {
+                warn!("The reconstructed message receiver went offline without explicit notification (relevant error: - {err})");
+                inner_guard.message_sender = None;
+                inner_guard.messages.extend(err.into_inner());
+            }
        } else {
-            // TODO: perhaps having to say it doesn't have a surb an indication the type should be changed?
-            Some(ReconstructedMessage {
-                message: reply_msg,
-                reply_surb: None,
-            })
+            trace!("No sender available - buffering reconstructed messages");
+            inner_guard.messages.extend(reconstructed_messages)
        }
    }

+    // this function doesn't really belong here...
+    fn get_reply_key<'a>(
+        &self,
+        raw_message: &'a mut [u8],
+    ) -> Option<(SurbEncryptionKey, &'a mut [u8])> {
+        let reply_surb_digest_size = ReplySurbKeyDigestAlgorithm::output_size();
+        if raw_message.len() < reply_surb_digest_size {
+            return None;
+        }
+
+        let possible_key_digest =
+            EncryptionKeyDigest::clone_from_slice(&raw_message[..reply_surb_digest_size]);
+        self.reply_key_storage
+            .try_pop(possible_key_digest)
+            .map(|reply_encryption_key| {
+                (
+                    *reply_encryption_key,
+                    &mut raw_message[reply_surb_digest_size..],
+                )
+            })
+    }
+
    async fn handle_new_received(&mut self, msgs: Vec<Vec<u8>>) {
-        debug!(
+        trace!(
            "Processing {:?} new message that might get added to the buffer!",
            msgs.len()
        );
@@ -209,58 +337,28 @@ impl ReceivedMessagesBuffer {
        let mut completed_messages = Vec::new();
        let mut inner_guard = self.inner.lock().await;

-        let reply_surb_digest_size = ReplySurbKeyDigestAlgorithm::output_size();
-
        // first check if this is a reply or a chunked message
-        // TODO: verify with @AP if this way of doing it is safe or whether it could
-        // cause some attacks due to, I don't know, stupid edge case collisions?
-        // Update: this DOES introduce a possible leakage: https://github.com/nymtech/nym/issues/296
-        for msg in msgs {
-            let possible_key_digest =
-                EncryptionKeyDigest::clone_from_slice(&msg[..reply_surb_digest_size]);
-
+        // note: there's a possible information leakage associated with this check https://github.com/nymtech/nym/issues/296
+        for mut msg in msgs {
            // check first `HasherOutputSize` bytes if they correspond to known encryption key
            // if yes - this is a reply message
+            let completed_message =
+                if let Some((reply_key, reply_message)) = self.get_reply_key(&mut msg) {
+                    inner_guard.process_received_reply(reply_message, reply_key)
+                } else {
+                    inner_guard.process_received_regular_packet(msg)
+                };

-            // TODO: this might be a bottleneck - since the keys are stored on disk we, presumably,
-            // are doing a disk operation every single received fragment
-            if let Some(reply_encryption_key) = self
-                .reply_key_storage
-                .get_and_remove_encryption_key(possible_key_digest)
-                .expect("storage operation failed!")
-            {
-                if let Some(completed_message) = Self::process_received_reply(
-                    &msg[reply_surb_digest_size..],
-                    reply_encryption_key,
-                ) {
-                    completed_messages.push(completed_message)
-                }
-            } else {
-                // otherwise - it's a 'normal' message
-                if let Some(completed_message) = inner_guard.process_received_fragment(msg) {
-                    completed_messages.push(completed_message)
-                }
+            if let Some(completed) = completed_message {
+                info!("received {completed}");
+                completed_messages.push(completed)
            }
        }

+        drop(inner_guard);
+
        if !completed_messages.is_empty() {
-            if let Some(sender) = &inner_guard.message_sender {
-                trace!("Sending reconstructed messages to announced sender");
-                if let Err(err) = sender.unbounded_send(completed_messages) {
-                    warn!("The reconstructed message receiver went offline without explicit notification (relevant error: - {:?})", err);
-                    // make sure to drop the lock to not deadlock
-                    // (it is required by `add_reconstructed_messages`)
-                    inner_guard.message_sender = None;
-                    drop(inner_guard);
-                    self.add_reconstructed_messages(err.into_inner()).await;
-                }
-            } else {
-                // make sure to drop the lock to not deadlock
-                // (it is required by `add_reconstructed_messages`)
-                drop(inner_guard);
-                trace!("No sender available - buffering reconstructed messages");
-                self.add_reconstructed_messages(completed_messages).await;
-            }
+            self.handle_reconstructed_messages(completed_messages).await
        }
    }
 }
@@ -290,19 +388,37 @@ impl RequestReceiver {
        }
    }

-    fn start(mut self) -> JoinHandle<()> {
-        tokio::spawn(async move {
-            while let Some(request) = self.query_receiver.next().await {
-                match request {
-                    ReceivedBufferMessage::ReceiverAnnounce(sender) => {
-                        self.received_buffer.connect_sender(sender).await;
-                    }
-                    ReceivedBufferMessage::ReceiverDisconnect => {
-                        self.received_buffer.disconnect_sender().await
-                    }
-                }
+    async fn handle_message(&mut self, message: ReceivedBufferMessage) {
+        match message {
+            ReceivedBufferMessage::ReceiverAnnounce(sender) => {
+                self.received_buffer.connect_sender(sender).await;
            }
-        })
+            ReceivedBufferMessage::ReceiverDisconnect => {
+                self.received_buffer.disconnect_sender().await
+            }
+        }
+    }
+
+    async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started RequestReceiver with graceful shutdown support");
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                biased;
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("RequestReceiver: Received shutdown");
+                }
+                request = self.query_receiver.next() => {
+                    if let Some(message) = request {
+                        self.handle_message(message).await
+                    } else {
+                        log::trace!("RequestReceiver: Stopping since channel closed");
+                        break;
+                    }
+                },
+            }
+        }
+        shutdown.recv_timeout().await;
+        log::debug!("RequestReceiver: Exiting");
    }
 }

@@ -321,29 +437,47 @@ impl FragmentedMessageReceiver {
            mixnet_packet_receiver,
        }
    }
-    fn start(mut self) -> JoinHandle<()> {
-        tokio::spawn(async move {
-            while let Some(new_messages) = self.mixnet_packet_receiver.next().await {
-                self.received_buffer.handle_new_received(new_messages).await;
+
+    async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started FragmentedMessageReceiver with graceful shutdown support");
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                new_messages = self.mixnet_packet_receiver.next() => {
+                    if let Some(new_messages) = new_messages {
+                        self.received_buffer.handle_new_received(new_messages).await;
+                    } else {
+                        log::trace!("FragmentedMessageReceiver: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("FragmentedMessageReceiver: Received shutdown");
+                }
            }
-        })
+        }
+        shutdown.recv_timeout().await;
+        log::debug!("FragmentedMessageReceiver: Exiting");
    }
 }

-pub struct ReceivedMessagesBufferController {
+pub(crate) struct ReceivedMessagesBufferController {
    fragmented_message_receiver: FragmentedMessageReceiver,
    request_receiver: RequestReceiver,
 }

 impl ReceivedMessagesBufferController {
-    pub fn new(
+    pub(crate) fn new(
        local_encryption_keypair: Arc<encryption::KeyPair>,
        query_receiver: ReceivedBufferRequestReceiver,
        mixnet_packet_receiver: MixnetMessageReceiver,
-        reply_key_storage: ReplyKeyStorage,
+        reply_key_storage: SentReplyKeys,
+        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
-        let received_buffer =
-            ReceivedMessagesBuffer::new(local_encryption_keypair, reply_key_storage);
+        let received_buffer = ReceivedMessagesBuffer::new(
+            local_encryption_keypair,
+            reply_key_storage,
+            reply_controller_sender,
+        );

        ReceivedMessagesBufferController {
            fragmented_message_receiver: FragmentedMessageReceiver::new(
@@ -354,9 +488,18 @@ impl ReceivedMessagesBufferController {
        }
    }

-    pub fn start(self) {
-        // TODO: should we do anything with JoinHandle(s) returned by start methods?
-        self.fragmented_message_receiver.start();
-        self.request_receiver.start();
+    pub fn start_with_shutdown(self, shutdown: nym_task::TaskClient) {
+        let mut fragmented_message_receiver = self.fragmented_message_receiver;
+        let mut request_receiver = self.request_receiver;
+
+        let shutdown_handle = shutdown.clone();
+        spawn_future(async move {
+            fragmented_message_receiver
+                .run_with_shutdown(shutdown_handle)
+                .await;
+        });
+        spawn_future(async move {
+            request_receiver.run_with_shutdown(shutdown).await;
+        });
    }
 }
@@ -1,6 +1,5 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-#[cfg(feature = "coconut")]
-pub mod coconut;
-pub mod models;
+pub mod reply_controller;
+pub mod reply_storage;
@@ -0,0 +1,872 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::real_messages_control::acknowledgement_control::PendingAcknowledgement;
+use crate::client::real_messages_control::message_handler::{MessageHandler, PreparationError};
+use crate::client::replies::reply_storage::CombinedReplyStorage;
+use futures::channel::oneshot;
+use futures::StreamExt;
+use log::{debug, error, info, trace, warn};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::anonymous_replies::ReplySurb;
+use nym_sphinx::chunking::fragment::{Fragment, FragmentIdentifier};
+use nym_task::connections::{ConnectionId, TransmissionLane};
+use rand::{CryptoRng, Rng};
+use std::cmp::{max, min};
+use std::collections::btree_map::Entry;
+use std::collections::{BTreeMap, HashMap};
+use std::sync::{Arc, Weak};
+use std::time::Duration;
+use time::OffsetDateTime;
+
+use crate::client::helpers::new_interval_stream;
+use crate::client::transmission_buffer::TransmissionBuffer;
+pub(crate) use requests::{ReplyControllerMessage, ReplyControllerReceiver, ReplyControllerSender};
+
+pub mod requests;
+
+pub struct Config {
+    min_surb_request_size: u32,
+    max_surb_request_size: u32,
+    maximum_allowed_reply_surb_request_size: u32,
+    max_surb_rerequest_waiting_period: Duration,
+    max_surb_drop_waiting_period: Duration,
+    max_reply_surb_age: Duration,
+    max_reply_key_age: Duration,
+}
+
+impl Config {
+    pub(crate) fn new(
+        min_surb_request_size: u32,
+        max_surb_request_size: u32,
+        maximum_allowed_reply_surb_request_size: u32,
+        max_surb_rerequest_waiting_period: Duration,
+        max_surb_drop_waiting_period: Duration,
+        max_reply_surb_age: Duration,
+        max_reply_key_age: Duration,
+    ) -> Self {
+        Self {
+            min_surb_request_size,
+            max_surb_request_size,
+            maximum_allowed_reply_surb_request_size,
+            max_surb_rerequest_waiting_period,
+            max_surb_drop_waiting_period,
+            max_reply_surb_age,
+            max_reply_key_age,
+        }
+    }
+}
+
+// the purpose of this task:
+// - buffers split messages from input message listener if there were insufficient surbs to send them
+// - upon getting extra surbs, resends them
+// - so I guess it will handle all 'RepliableMessage' and requests from 'ReplyMessage'
+// - replies to "give additional surbs" requests
+// - will reply to future heartbeats
+
+// TODO: this should be split into ingress and egress controllers
+// because currently its trying to perform two distinct jobs
+pub struct ReplyController<R> {
+    config: Config,
+
+    // TODO: incorporate that field at some point
+    // and use binomial distribution to determine the expected required number
+    // of surbs required to send the message through
+    // expected_reliability: f32,
+    request_receiver: ReplyControllerReceiver,
+    pending_replies: HashMap<AnonymousSenderTag, TransmissionBuffer<Fragment>>,
+
+    /// Retransmission packets that have already timed out and are waiting for additional reply SURBs
+    /// so that they could be sent back to the network. Once we receive more SURBs, we should send them ASAP.
+    // TODO: when purging stale entries, we must take extra care to also purge all pending ACK data!!
+    pending_retransmissions:
+        HashMap<AnonymousSenderTag, BTreeMap<FragmentIdentifier, Weak<PendingAcknowledgement>>>,
+
+    message_handler: MessageHandler<R>,
+    full_reply_storage: CombinedReplyStorage,
+}
+
+impl<R> ReplyController<R>
+where
+    R: CryptoRng + Rng,
+{
+    pub(crate) fn new(
+        config: Config,
+        message_handler: MessageHandler<R>,
+        full_reply_storage: CombinedReplyStorage,
+        request_receiver: ReplyControllerReceiver,
+    ) -> Self {
+        ReplyController {
+            config,
+            request_receiver,
+            pending_replies: HashMap::new(),
+            pending_retransmissions: HashMap::new(),
+            message_handler,
+            full_reply_storage,
+        }
+    }
+
+    fn insert_pending_replies<I: IntoIterator<Item = Fragment>>(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        fragments: I,
+        lane: TransmissionLane,
+    ) {
+        self.pending_replies
+            .entry(*recipient)
+            .or_insert_with(TransmissionBuffer::new)
+            .store(&lane, fragments)
+    }
+
+    fn re_insert_pending_replies(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        fragments: Vec<(TransmissionLane, Fragment)>,
+    ) {
+        // the buffer should ALWAYS exist at this point, if it doesn't, it's a bug...
+        self.pending_replies
+            .entry(*recipient)
+            .or_insert_with(TransmissionBuffer::new)
+            .store_multiple(fragments)
+    }
+
+    fn re_insert_pending_retransmission(
+        &mut self,
+        recipient: &AnonymousSenderTag,
+        data: Vec<Arc<PendingAcknowledgement>>,
+    ) {
+        // the underlying entry MUST exist as we've just got data from there
+        let map_entry = self
+            .pending_retransmissions
+            .get_mut(recipient)
+            .expect("our pending retransmission entry is somehow gone!");
+
+        for pending in data {
+            // if it's 0, we don't need to do anything - we just got that ack!
+            if Arc::strong_count(&pending) > 1 {
+                let id = pending.inner_fragment_identifier();
+                let downgraded = Arc::downgrade(&pending);
+                map_entry.insert(id, downgraded);
+            }
+        }
+    }
+
+    fn should_request_more_surbs(&self, target: &AnonymousSenderTag) -> bool {
+        trace!("checking if we should request more surbs from {:?}", target);
+
+        let pending_queue_size = self
+            .pending_replies
+            .get(target)
+            .map(|pending_queue| pending_queue.total_size())
+            .unwrap_or_default();
+
+        let retransmission_queue = self
+            .pending_retransmissions
+            .get(target)
+            .map(|pending_queue| pending_queue.len())
+            .unwrap_or_default();
+
+        let total_queue = pending_queue_size + retransmission_queue;
+
+        // simple as that - there's absolutely nothing to retransmit
+        if total_queue == 0 {
+            return false;
+        }
+
+        let available_surbs = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .available_surbs(target);
+        let pending_surbs = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .pending_reception(target) as usize;
+        let min_surbs_threshold = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .min_surb_threshold();
+        let max_surbs_threshold = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .max_surb_threshold();
+
+        debug!("total queue size: {total_queue} = pending data {pending_queue_size} + pending retransmission {retransmission_queue}, available surbs: {available_surbs} pending surbs: {pending_surbs} threshold range: {min_surbs_threshold}..{max_surbs_threshold}");
+
+        (pending_surbs + available_surbs) < max_surbs_threshold
+            && (pending_surbs + available_surbs) < (total_queue + min_surbs_threshold)
+    }
+
+    async fn handle_send_reply(
+        &mut self,
+        recipient_tag: AnonymousSenderTag,
+        data: Vec<u8>,
+        lane: TransmissionLane,
+    ) {
+        if !self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .contains_surbs_for(&recipient_tag)
+        {
+            warn!("received reply request for {:?} but we don't have any surbs stored for that recipient!", recipient_tag);
+            return;
+        }
+
+        trace!("handling reply to {:?}", recipient_tag);
+        let mut fragments = self.message_handler.split_reply_message(data);
+        let total_size = fragments.len();
+        trace!("This reply requires {:?} SURBs", total_size);
+
+        let available_surbs = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .available_surbs(&recipient_tag);
+        let min_surbs_threshold = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .min_surb_threshold();
+
+        let max_to_send = if available_surbs > min_surbs_threshold {
+            min(fragments.len(), available_surbs - min_surbs_threshold)
+        } else {
+            0
+        };
+
+        if max_to_send > 0 {
+            let (surbs, _surbs_left) = self
+                .full_reply_storage
+                .surbs_storage_ref()
+                .get_reply_surbs(&recipient_tag, max_to_send);
+
+            if let Some(reply_surbs) = surbs {
+                let to_send = fragments.drain(..max_to_send).collect::<Vec<_>>();
+                if let Err(err) = self
+                    .message_handler
+                    .try_send_reply_chunks_on_lane(
+                        recipient_tag,
+                        to_send.clone(),
+                        reply_surbs,
+                        lane,
+                    )
+                    .await
+                {
+                    let err = err.return_unused_surbs(
+                        self.full_reply_storage.surbs_storage_ref(),
+                        &recipient_tag,
+                    );
+                    warn!("failed to send reply to {recipient_tag}: {err}");
+                    self.insert_pending_replies(&recipient_tag, to_send, lane);
+                }
+            }
+        }
+
+        // if there's leftover data we didn't send because we didn't have enough (or any) surbs - buffer it
+        if !fragments.is_empty() {
+            self.insert_pending_replies(&recipient_tag, fragments, lane);
+        }
+
+        if self.should_request_more_surbs(&recipient_tag) {
+            self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                .await;
+        }
+    }
+
+    async fn request_additional_reply_surbs(
+        &mut self,
+        target: AnonymousSenderTag,
+        amount: u32,
+    ) -> Result<(), PreparationError> {
+        let reply_surb = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .get_reply_surb_ignoring_threshold(&target)
+            .and_then(|(reply_surb, _)| reply_surb)
+            .ok_or(PreparationError::NotEnoughSurbs {
+                available: 0,
+                required: 1,
+            })?;
+
+        if let Err(err) = self
+            .message_handler
+            .try_request_additional_reply_surbs(target, reply_surb, amount)
+            .await
+        {
+            let err = err.return_unused_surbs(self.full_reply_storage.surbs_storage_ref(), &target);
+            warn!(
+                "failed to request additional surbs from {:?} - {err}",
+                target
+            );
+            return Err(err);
+        } else {
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .increment_pending_reception(&target, amount);
+        }
+
+        Ok(())
+    }
+
+    async fn try_clear_pending_retransmission(&mut self, target: AnonymousSenderTag) {
+        trace!("trying to clear pending retransmission queue");
+        let available_surbs = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .available_surbs(&target);
+        let min_surbs_threshold = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .min_surb_threshold();
+
+        let max_to_clear = if available_surbs > min_surbs_threshold {
+            available_surbs - min_surbs_threshold
+        } else {
+            trace!("we don't have enough surbs for retransmission queue clearing...");
+            return;
+        };
+        trace!("we can clear up to {max_to_clear} entries");
+
+        let Some(pending) = self.pending_retransmissions.get_mut(&target) else {
+            trace!("there are no pending retransmissions for {target}!");
+            return;
+        };
+
+        let mut to_take = Vec::new();
+
+        while to_take.len() < max_to_clear {
+            if let Some((_, data)) = pending.pop_first() {
+                // no need to do anything if we failed to upgrade the reference,
+                // it means we got the ack while the data was waiting in the queue
+                if let Some(upgraded) = data.upgrade() {
+                    to_take.push(upgraded)
+                }
+            } else {
+                // our map is empty!
+                break;
+            }
+        }
+
+        if to_take.is_empty() {
+            // no need to do anything
+            return;
+        }
+
+        let (surbs_for_reply, _) = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .get_reply_surbs(&target, to_take.len());
+
+        let Some(surbs_for_reply) = surbs_for_reply else {
+            error!("somehow different task has stolen our reply surbs! - this should have been impossible");
+            self.re_insert_pending_retransmission(&target, to_take);
+            return;
+        };
+
+        let to_send_vec = to_take.iter().map(|ack| ack.fragment_data()).collect();
+
+        let prepared_fragments = match self
+            .message_handler
+            .prepare_reply_chunks_for_sending(to_send_vec, surbs_for_reply)
+            .await
+        {
+            Ok(prepared) => prepared,
+            Err(err) => {
+                let err =
+                    err.return_unused_surbs(self.full_reply_storage.surbs_storage_ref(), &target);
+                self.re_insert_pending_retransmission(&target, to_take);
+
+                warn!(
+                    "failed to clear pending retransmission queue for {:?} - {err}",
+                    target
+                );
+                return;
+            }
+        };
+
+        // we can't fail at this point, so drop all references to acks so that timer updates wouldn't blow up
+        drop(to_take);
+
+        self.message_handler
+            .send_retransmission_reply_chunks(prepared_fragments, TransmissionLane::Retransmission)
+            .await;
+    }
+
+    fn pop_at_most_pending_replies(
+        &mut self,
+        from: &AnonymousSenderTag,
+        amount: usize,
+    ) -> Option<Vec<(TransmissionLane, Fragment)>> {
+        // if possible, pop all pending replies, if not, pop only entries for which we'd have a reply surb
+        let total = self.pending_replies.get(from)?.total_size();
+        trace!("pending queue has {total} elements");
+        if total == 0 {
+            return None;
+        }
+        self.pending_replies
+            .get_mut(from)?
+            .pop_at_most_n_next_messages_at_random(amount)
+    }
+
+    async fn try_clear_pending_queue(&mut self, target: AnonymousSenderTag) {
+        trace!("trying to clear pending queue");
+        let available_surbs = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .available_surbs(&target);
+        let min_surbs_threshold = self
+            .full_reply_storage
+            .surbs_storage_ref()
+            .min_surb_threshold();
+
+        let max_to_clear = if available_surbs > min_surbs_threshold {
+            available_surbs - min_surbs_threshold
+        } else {
+            trace!("we don't have enough surbs for queue clearing...");
+            return;
+        };
+        trace!("we can clear up to {max_to_clear} entries");
+
+        // we're guaranteed to not get more entries than we have reply surbs for
+        if let Some(to_send) = self.pop_at_most_pending_replies(&target, max_to_clear) {
+            let to_send_clone = to_send.clone();
+
+            if to_send_clone.is_empty() {
+                panic!(
+                    "please let the devs know if you ever see this message (reply_controller.rs)"
+                );
+            }
+
+            let (surbs_for_reply, _) = self
+                .full_reply_storage
+                .surbs_storage_ref()
+                .get_reply_surbs(&target, to_send_clone.len());
+
+            let Some(surbs_for_reply) = surbs_for_reply else {
+                error!("somehow different task has stolen our reply surbs! - this should have been impossible");
+                self.re_insert_pending_replies(&target, to_send);
+                return;
+            };
+
+            if let Err(err) = self
+                .message_handler
+                .try_send_reply_chunks(target, to_send_clone, surbs_for_reply)
+                .await
+            {
+                let err =
+                    err.return_unused_surbs(self.full_reply_storage.surbs_storage_ref(), &target);
+                self.re_insert_pending_replies(&target, to_send);
+                warn!("failed to clear pending queue for {:?} - {err}", target);
+            }
+        } else {
+            trace!("the pending queue is empty");
+        }
+    }
+
+    async fn handle_received_surbs(
+        &mut self,
+        from: AnonymousSenderTag,
+        reply_surbs: Vec<ReplySurb>,
+        from_surb_request: bool,
+    ) {
+        trace!("handling received surbs");
+
+        // clear the requesting flag since we should have been asking for surbs
+        self.full_reply_storage
+            .surbs_storage_ref()
+            .reset_surbs_last_received_at(&from);
+        if from_surb_request {
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .decrement_pending_reception(&from, reply_surbs.len() as u32);
+        }
+
+        // store received surbs
+        self.full_reply_storage
+            .surbs_storage_ref()
+            .insert_surbs(&from, reply_surbs);
+
+        // use as many as we can for clearing pending retransmission queue
+        self.try_clear_pending_retransmission(from).await;
+
+        // use as many as we can for clearing pending 'normal' queue
+        self.try_clear_pending_queue(from).await;
+
+        // if we have to, request more
+        if self.should_request_more_surbs(&from) {
+            self.request_reply_surbs_for_queue_clearing(from).await;
+        }
+    }
+
+    async fn handle_surb_request(&mut self, recipient: Recipient, mut amount: u32) {
+        // 1. check whether we sent any surbs in the past to this recipient, otherwise
+        // they have no business in asking for more
+        if !self
+            .full_reply_storage
+            .tags_storage_ref()
+            .exists(&recipient)
+        {
+            warn!("{recipient} asked us for reply SURBs even though we never sent them any anonymous messages before!");
+            return;
+        }
+
+        // 2. check whether the requested amount is within sane range
+        if amount > self.config.maximum_allowed_reply_surb_request_size {
+            warn!("The requested reply surb amount is larger than our maximum allowed ({amount} > {}). Lowering it to a more sane value...", self.config.maximum_allowed_reply_surb_request_size);
+            amount = self.config.maximum_allowed_reply_surb_request_size;
+        }
+
+        // 3. construct and send the surbs away
+        // (send them in smaller batches to make the experience a bit smoother
+        let mut remaining = amount;
+        while remaining > 0 {
+            let to_send = min(remaining, 100);
+            if let Err(err) = self
+                .message_handler
+                .try_send_additional_reply_surbs(recipient, to_send)
+                .await
+            {
+                warn!("failed to send additional surbs to {recipient} - {err}");
+            } else {
+                trace!("sent {to_send} reply SURBs to {recipient}");
+            }
+
+            remaining -= to_send;
+        }
+    }
+
+    fn buffer_pending_ack(
+        &mut self,
+        recipient: AnonymousSenderTag,
+        ack_ref: Arc<PendingAcknowledgement>,
+        weak_ack_ref: Weak<PendingAcknowledgement>,
+    ) {
+        let frag_id = ack_ref.inner_fragment_identifier();
+        if let Some(existing) = self.pending_retransmissions.get_mut(&recipient) {
+            if let Entry::Vacant(e) = existing.entry(frag_id) {
+                e.insert(weak_ack_ref);
+            } else {
+                warn!("we're already trying to retransmit {frag_id}. We must be really behind in surbs!");
+            }
+        } else {
+            let mut inner = BTreeMap::new();
+            inner.insert(frag_id, weak_ack_ref);
+            self.pending_retransmissions.insert(recipient, inner);
+        }
+    }
+
+    async fn handle_reply_retransmission(
+        &mut self,
+        recipient_tag: AnonymousSenderTag,
+        timed_out_ack: Weak<PendingAcknowledgement>,
+        extra_surbs_request: bool,
+    ) {
+        // seems we got the ack in the end
+        let ack_ref = match timed_out_ack.upgrade() {
+            Some(ack) => ack,
+            None => {
+                debug!("we received the ack for one of the reply packets as we were putting it in the retransmission queue");
+                return;
+            }
+        };
+
+        // if this is retransmission for obtaining additional reply surbs,
+        // we can dip below the storage threshold
+        let (maybe_reply_surb, _) = if extra_surbs_request {
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .get_reply_surb_ignoring_threshold(&recipient_tag)
+        } else {
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .get_reply_surb(&recipient_tag)
+        }
+        .expect("attempted to retransmit a packet to an unknown recipient - we shouldn't have sent the original packet in the first place!");
+
+        if let Some(reply_surb) = maybe_reply_surb {
+            match self
+                .message_handler
+                .try_prepare_single_reply_chunk_for_sending(reply_surb, ack_ref.fragment_data())
+                .await
+            {
+                Ok(prepared) => {
+                    // drop the ack ref so that controller would not panic on `UpdateTimer` if that task
+                    // got to handle the action before this function terminated (which is very much
+                    // possible if `forward_messages` takes a while)
+                    drop(ack_ref);
+
+                    self.message_handler
+                        .update_ack_delay(prepared.fragment_identifier, prepared.total_delay);
+                    self.message_handler
+                        .forward_messages(vec![prepared.into()], TransmissionLane::Retransmission)
+                        .await;
+                }
+                Err(err) => {
+                    let err = err.return_unused_surbs(
+                        self.full_reply_storage.surbs_storage_ref(),
+                        &recipient_tag,
+                    );
+                    warn!("failed to prepare message for retransmission - {err}");
+                    // we buffer that packet and to try another day
+                    self.buffer_pending_ack(recipient_tag, ack_ref, timed_out_ack);
+
+                    if self.should_request_more_surbs(&recipient_tag) {
+                        self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                            .await;
+                    }
+                }
+            };
+        } else {
+            self.buffer_pending_ack(recipient_tag, ack_ref, timed_out_ack);
+
+            if self.should_request_more_surbs(&recipient_tag) {
+                self.request_reply_surbs_for_queue_clearing(recipient_tag)
+                    .await;
+            }
+        }
+    }
+
+    // to be honest this doesn't make a lot of sense in the context of `connection_id`,
+    // it should really be asked per tag
+    fn handle_lane_queue_length(
+        &self,
+        connection_id: ConnectionId,
+        response_channel: oneshot::Sender<usize>,
+    ) {
+        // TODO: if we ever have duplicate ids for different senders, it means our rng is super weak
+        // thus I don't think we have to worry about it?
+        let lane = TransmissionLane::ConnectionId(connection_id);
+        for buf in self.pending_replies.values() {
+            if let Some(length) = buf.lane_length(&lane) {
+                if response_channel.send(length).is_err() {
+                    error!("the requester for lane queue length has dropped the response channel!")
+                }
+                return;
+            }
+        }
+        // make sure that if we didn't find that lane, we reply with 0
+        if response_channel.send(0).is_err() {
+            error!("the requester for lane queue length has dropped the response channel!")
+        }
+    }
+
+    async fn handle_request(&mut self, request: ReplyControllerMessage) {
+        match request {
+            ReplyControllerMessage::RetransmitReply {
+                recipient,
+                timed_out_ack,
+                extra_surb_request,
+            } => {
+                self.handle_reply_retransmission(recipient, timed_out_ack, extra_surb_request)
+                    .await
+            }
+            ReplyControllerMessage::SendReply {
+                recipient,
+                message,
+                lane,
+            } => self.handle_send_reply(recipient, message, lane).await,
+            ReplyControllerMessage::AdditionalSurbs {
+                sender_tag,
+                reply_surbs,
+                from_surb_request,
+            } => {
+                self.handle_received_surbs(sender_tag, reply_surbs, from_surb_request)
+                    .await
+            }
+            ReplyControllerMessage::LaneQueueLength {
+                connection_id,
+                response_channel,
+            } => self.handle_lane_queue_length(connection_id, response_channel),
+            ReplyControllerMessage::AdditionalSurbsRequest { recipient, amount } => {
+                self.handle_surb_request(*recipient, amount).await
+            }
+        }
+    }
+
+    // TODO: modify this method to more accurately determine the amount of surbs it needs to request
+    // it should take into consideration the average latency, sending rate and queue size.
+    // it should request as many surbs as it takes to saturate its sending rate before next batch arrives
+    async fn request_reply_surbs_for_queue_clearing(&mut self, target: AnonymousSenderTag) {
+        trace!("requesting surbs for queues clearing");
+
+        let pending_queue_size = self
+            .pending_replies
+            .get(&target)
+            .map(|pending_queue| pending_queue.total_size())
+            .unwrap_or_default();
+
+        let retransmission_queue = self
+            .pending_retransmissions
+            .get(&target)
+            .map(|pending_queue| pending_queue.len())
+            .unwrap_or_default();
+
+        let total_queue = (pending_queue_size + retransmission_queue) as u32;
+
+        if total_queue == 0 {
+            trace!("the pending queues for {:?} are already empty", target);
+            return;
+        }
+
+        let request_size = min(
+            self.config.max_surb_request_size,
+            max(total_queue, self.config.min_surb_request_size),
+        );
+
+        if let Err(err) = self
+            .request_additional_reply_surbs(target, request_size)
+            .await
+        {
+            warn!("failed to request additional surbs... - {err}")
+        }
+    }
+
+    async fn inspect_stale_entries(&mut self) {
+        let mut to_request = Vec::new();
+        let mut to_remove = Vec::new();
+
+        let now = OffsetDateTime::now_utc();
+        for (pending_reply_target, vals) in &self.pending_replies {
+            if vals.is_empty() {
+                continue;
+            }
+
+            let Some(last_received) = self.full_reply_storage.surbs_storage_ref().surbs_last_received_at(pending_reply_target) else {
+                error!("we have {} pending replies for {pending_reply_target}, but we somehow never received any reply surbs from them!", vals.total_size());
+                to_remove.push(*pending_reply_target);
+                continue;
+            };
+
+            // this should never ever happen (famous last words, eh?), but in case it DOES happen eventually
+            // purge that malformed data
+            let Ok(last_received_time) = OffsetDateTime::from_unix_timestamp(last_received) else {
+                error!("somehow our stored timestamp ({last_received}) for surbs from {pending_reply_target} is corrupted!. Going to remove all the associated entries");
+                to_remove.push(*pending_reply_target);
+                continue;
+            };
+
+            let diff = now - last_received_time;
+
+            if diff > self.config.max_surb_rerequest_waiting_period {
+                if diff > self.config.max_surb_drop_waiting_period {
+                    to_remove.push(*pending_reply_target)
+                } else {
+                    debug!("We haven't received any surbs in {:?} from {pending_reply_target}. Going to explicitly ask for more", diff);
+                    to_request.push(*pending_reply_target);
+                }
+            }
+        }
+
+        for pending_reply_target in to_request {
+            self.request_reply_surbs_for_queue_clearing(pending_reply_target)
+                .await;
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .reset_pending_reception(&pending_reply_target)
+        }
+        for to_remove in to_remove {
+            self.pending_replies.remove(&to_remove);
+        }
+    }
+
+    async fn invalidate_old_data(&self) {
+        let now = OffsetDateTime::now_utc();
+
+        let mut to_remove_surbs = Vec::new();
+        let mut to_remove_keys = Vec::new();
+        for map_ref in self.full_reply_storage.surbs_storage_ref().as_raw_iter() {
+            let (sender, received) = map_ref.pair();
+            // TODO: handle the following edge case:
+            // there's a malicious client sending us exactly one reply surb just before we should have invalidated
+            // the data thus making us keep everything in memory
+            // possible solution: keep timestamp PER reply surb (but that seems like an overkill)
+            // but I doubt this is ever going to be a problem...
+            // ...
+            // However, if you're reading this message, it probably became a legit problem,
+            // so I guess add timestamp per surb then? chop-chop.
+
+            let last_received = received.surbs_last_received_at();
+            // this should never ever happen (famous last words, eh?), but in case it DOES happen eventually
+            // purge that malformed data
+            let Ok(last_received_time) = OffsetDateTime::from_unix_timestamp(last_received) else {
+                error!("somehow our stored timestamp ({last_received}) for surbs from {sender} is corrupted!. Going to remove all the associated entries");
+                to_remove_surbs.push(*sender);
+                continue;
+            };
+            let diff = now - last_received_time;
+
+            if diff > self.config.max_reply_surb_age {
+                info!("it's been {diff:?} since we last received any reply surb from {sender}. Going to remove all stored entries...");
+
+                to_remove_surbs.push(*sender);
+            }
+        }
+
+        for map_ref in self.full_reply_storage.key_storage_ref().as_raw_iter() {
+            let (digest, reply_key) = map_ref.pair();
+
+            // this should never ever happen (famous last words, eh?), but in case it DOES happen eventually
+            // purge that malformed data
+            let Ok(sent_at) = OffsetDateTime::from_unix_timestamp(reply_key.sent_at_timestamp) else {
+                error!("somehow our stored timestamp ({}) for one of our reply key is corrupted!. Going to remove all the entry", reply_key.sent_at_timestamp);
+                to_remove_keys.push(*digest);
+                continue;
+            };
+
+            let diff = now - sent_at;
+
+            if diff > self.config.max_reply_key_age {
+                debug!("it's been {diff:?} since we created this reply key. it's probably never going to get used, so we're going to purge it...");
+                to_remove_keys.push(*digest);
+            }
+        }
+
+        for to_remove in to_remove_surbs {
+            self.full_reply_storage
+                .surbs_storage_ref()
+                .remove(&to_remove);
+        }
+
+        for to_remove in to_remove_keys {
+            self.full_reply_storage.key_storage().remove(to_remove)
+        }
+    }
+
+    // #[cfg(not(target_arch = "wasm32"))]
+    // async fn log_status(&self) {
+    //     todo!()
+    // }
+
+    pub(crate) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        debug!("Started ReplyController with graceful shutdown support");
+
+        let polling_rate = Duration::from_secs(5);
+        let mut stale_inspection = new_interval_stream(polling_rate);
+
+        // this is in the order of hours/days so we don't have to poll it that often
+        let polling_rate = Duration::from_secs(self.config.max_reply_surb_age.as_secs() / 10);
+        let mut invalidation_inspection = new_interval_stream(polling_rate);
+
+        while !shutdown.is_shutdown() {
+            tokio::select! {
+                biased;
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("ReplyController: Received shutdown");
+                },
+                req = self.request_receiver.next() => match req {
+                    Some(req) => self.handle_request(req).await,
+                    None => {
+                        log::trace!("ReplyController: Stopping since channel closed");
+                        break;
+                    }
+                },
+                _ = stale_inspection.next() => {
+                    self.inspect_stale_entries().await
+                },
+                _ = invalidation_inspection.next() => {
+                    self.invalidate_old_data().await
+                }
+            }
+        }
+        assert!(shutdown.is_shutdown_poll());
+        log::debug!("ReplyController: Exiting");
+    }
+}
@@ -0,0 +1,154 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::real_messages_control::acknowledgement_control::PendingAcknowledgement;
+use futures::channel::{mpsc, oneshot};
+use log::error;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::anonymous_replies::ReplySurb;
+use nym_task::connections::{ConnectionId, TransmissionLane};
+use std::sync::Weak;
+
+pub(crate) fn new_control_channels() -> (ReplyControllerSender, ReplyControllerReceiver) {
+    let (tx, rx) = mpsc::unbounded();
+    (tx.into(), rx)
+}
+
+#[derive(Debug, Clone)]
+pub struct ReplyControllerSender(mpsc::UnboundedSender<ReplyControllerMessage>);
+
+impl From<mpsc::UnboundedSender<ReplyControllerMessage>> for ReplyControllerSender {
+    fn from(inner: mpsc::UnboundedSender<ReplyControllerMessage>) -> Self {
+        ReplyControllerSender(inner)
+    }
+}
+
+impl ReplyControllerSender {
+    pub(crate) fn send_retransmission_data(
+        &self,
+        recipient: AnonymousSenderTag,
+        timed_out_ack: Weak<PendingAcknowledgement>,
+        extra_surb_request: bool,
+    ) {
+        self.0
+            .unbounded_send(ReplyControllerMessage::RetransmitReply {
+                recipient,
+                timed_out_ack,
+                extra_surb_request,
+            })
+            .expect("ReplyControllerReceiver has died!")
+    }
+
+    pub(crate) fn send_reply(
+        &self,
+        recipient: AnonymousSenderTag,
+        message: Vec<u8>,
+        lane: TransmissionLane,
+    ) {
+        self.0
+            .unbounded_send(ReplyControllerMessage::SendReply {
+                recipient,
+                message,
+                lane,
+            })
+            .expect("ReplyControllerReceiver has died!")
+    }
+
+    pub(crate) fn send_additional_surbs(
+        &self,
+        sender_tag: AnonymousSenderTag,
+        reply_surbs: Vec<ReplySurb>,
+        from_surb_request: bool,
+    ) {
+        self.0
+            .unbounded_send(ReplyControllerMessage::AdditionalSurbs {
+                sender_tag,
+                reply_surbs,
+                from_surb_request,
+            })
+            .expect("ReplyControllerReceiver has died!")
+    }
+
+    pub(crate) fn send_additional_surbs_request(&self, recipient: Recipient, amount: u32) {
+        self.0
+            .unbounded_send(ReplyControllerMessage::AdditionalSurbsRequest {
+                recipient: Box::new(recipient),
+                amount,
+            })
+            .expect("ReplyControllerReceiver has died!")
+    }
+
+    pub async fn get_lane_queue_length(&self, connection_id: ConnectionId) -> usize {
+        let (response_tx, response_rx) = oneshot::channel();
+        self.0
+            .unbounded_send(ReplyControllerMessage::LaneQueueLength {
+                connection_id,
+                response_channel: response_tx,
+            })
+            .expect("ReplyControllerReceiver has died!");
+
+        match response_rx.await {
+            Ok(length) => length,
+            Err(_) => {
+                error!("The reply controller has dropped our response channel!");
+                // TODO: should we panic here instead? this message implies something weird and unrecoverable has happened
+                0
+            }
+        }
+    }
+}
+
+pub struct ReplyQueueLengths {
+    reply_controller_sender: ReplyControllerSender,
+}
+
+impl ReplyQueueLengths {
+    pub fn new(reply_controller_sender: ReplyControllerSender) -> Self {
+        Self {
+            reply_controller_sender,
+        }
+    }
+
+    pub async fn get_lane_queue_length(&self, connection_id: ConnectionId) -> usize {
+        self.reply_controller_sender
+            .get_lane_queue_length(connection_id)
+            .await
+    }
+}
+
+pub(crate) type ReplyControllerReceiver = mpsc::UnboundedReceiver<ReplyControllerMessage>;
+
+#[derive(Debug)]
+pub(crate) enum ReplyControllerMessage {
+    RetransmitReply {
+        recipient: AnonymousSenderTag,
+        timed_out_ack: Weak<PendingAcknowledgement>,
+        extra_surb_request: bool,
+    },
+
+    SendReply {
+        recipient: AnonymousSenderTag,
+        message: Vec<u8>,
+        lane: TransmissionLane,
+    },
+
+    AdditionalSurbs {
+        sender_tag: AnonymousSenderTag,
+        reply_surbs: Vec<ReplySurb>,
+        from_surb_request: bool,
+    },
+
+    // this one doesn't belong here either...
+    LaneQueueLength {
+        connection_id: ConnectionId,
+        response_channel: oneshot::Sender<usize>,
+    },
+
+    // Should this also be handled in here? it's technically a completely different side of the pipe
+    // let's see how it works when combined, might split it before creating PR
+    AdditionalSurbsRequest {
+        recipient: Box<Recipient>,
+        amount: u32,
+    },
+}
@@ -0,0 +1,62 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::replies::reply_storage::backend::Empty;
+use crate::client::replies::reply_storage::{CombinedReplyStorage, ReplyStorageBackend};
+use async_trait::async_trait;
+
+use std::path::PathBuf;
+
+// well, right now we don't have the browser storage : (
+// so we keep everything in memory
+#[derive(Debug)]
+pub struct Backend {
+    empty: Empty,
+}
+
+impl Backend {
+    pub fn new(min_surb_threshold: usize, max_surb_threshold: usize) -> Self {
+        Backend {
+            empty: Empty {
+                min_surb_threshold,
+                max_surb_threshold,
+            },
+        }
+    }
+}
+
+#[async_trait]
+impl ReplyStorageBackend for Backend {
+    type StorageError = <Empty as ReplyStorageBackend>::StorageError;
+
+    async fn new(
+        debug_config: &crate::config::DebugConfig,
+        _db_path: Option<PathBuf>,
+    ) -> Result<Self, Self::StorageError> {
+        Ok(Backend {
+            empty: Empty {
+                min_surb_threshold: debug_config.minimum_reply_surb_storage_threshold,
+                max_surb_threshold: debug_config.maximum_reply_surb_storage_threshold,
+            },
+        })
+    }
+
+    async fn flush_surb_storage(
+        &mut self,
+        storage: &CombinedReplyStorage,
+    ) -> Result<(), Self::StorageError> {
+        self.empty.flush_surb_storage(storage).await
+    }
+
+    async fn init_fresh(&mut self, fresh: &CombinedReplyStorage) -> Result<(), Self::StorageError> {
+        self.empty.init_fresh(fresh).await
+    }
+
+    async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
+        self.empty.load_surb_storage().await
+    }
+
+    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
+        self.empty.get_inactive_storage()
+    }
+}
@@ -0,0 +1,64 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::io;
+use std::path::PathBuf;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum StorageError {
+    #[error("the provided database path doesn't have a filename defined")]
+    DatabasePathWithoutFilename { provided_path: PathBuf },
+
+    #[error("unable to create the directory for the database")]
+    DatabasePathUnableToCreateParentDirectory {
+        provided_path: PathBuf,
+        source: io::Error,
+    },
+
+    #[error("failed to rename our databse file - {source}")]
+    DatabaseRenameError {
+        #[source]
+        source: io::Error,
+    },
+
+    #[error("failed to rename our old databse file - {source}")]
+    DatabaseOldFileRemoveError {
+        #[source]
+        source: io::Error,
+    },
+
+    #[error("failed to perform sqlx migration: {source}")]
+    MigrationError {
+        #[source]
+        #[from]
+        source: sqlx::migrate::MigrateError,
+    },
+
+    #[error("failed to connect to the underlying connection pool: {source}")]
+    DatabaseConnectionError {
+        #[source]
+        source: sqlx::error::Error,
+    },
+
+    #[error("failed to run the SQL query: {source}")]
+    QueryError {
+        #[source]
+        #[from]
+        source: sqlx::error::Error,
+    },
+
+    #[error("The loaded data is inconsistent - it seems that on the last shutdown the client hasn't finished the data flush. You may have to remove the entire storage manually")]
+    IncompleteDataFlush,
+
+    #[error("data retrieved from the underlying storage is corrupted: {details}")]
+    CorruptedData {
+        details: String,
+        // err: Option<Box<dyn std::error::Error>>
+    },
+
+    #[error("failed to create storage")]
+    FailedToCreateStorage {
+        source: Box<dyn std::error::Error + Send + Sync>,
+    },
+}
@@ -0,0 +1,267 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::replies::reply_storage::backend::fs_backend::error::StorageError;
+use crate::client::replies::reply_storage::backend::fs_backend::models::{
+    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
+};
+use log::{error, info};
+use sqlx::ConnectOptions;
+use std::path::Path;
+
+#[derive(Debug, Clone)]
+pub(crate) struct StorageManager {
+    pub(crate) connection_pool: sqlx::SqlitePool,
+}
+
+// all SQL goes here
+impl StorageManager {
+    pub(crate) async fn init<P: AsRef<Path>>(
+        database_path: P,
+        fresh: bool,
+    ) -> Result<Self, StorageError> {
+        // ensure the whole directory structure exists
+        if let Some(parent_dir) = database_path.as_ref().parent() {
+            std::fs::create_dir_all(parent_dir).map_err(|source| {
+                StorageError::DatabasePathUnableToCreateParentDirectory {
+                    provided_path: database_path.as_ref().to_path_buf(),
+                    source,
+                }
+            })?;
+        }
+
+        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .filename(database_path)
+            .create_if_missing(fresh);
+
+        opts.disable_statement_logging();
+
+        let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
+            Ok(pool) => pool,
+            Err(err) => {
+                error!("Failed to connect to SQLx database: {err}");
+                return Err(StorageError::DatabaseConnectionError { source: err });
+            }
+        };
+
+        if let Err(err) = sqlx::migrate!("./fs_surbs_migrations")
+            .run(&connection_pool)
+            .await
+        {
+            error!("Failed to initialize SQLx database: {err}");
+            return Err(err.into());
+        }
+
+        info!("Database migration finished!");
+        Ok(StorageManager { connection_pool })
+    }
+
+    #[allow(dead_code)]
+    pub(crate) async fn status_table_exists(&self) -> Result<bool, sqlx::Error> {
+        sqlx::query!("SELECT name FROM sqlite_master WHERE type='table' AND name='status'")
+            .fetch_optional(&self.connection_pool)
+            .await
+            .map(|r| r.is_some())
+    }
+
+    pub(crate) async fn create_status_table(&self) -> Result<(), sqlx::Error> {
+        sqlx::query!("INSERT INTO status(flush_in_progress, previous_flush_timestamp, client_in_use) VALUES (0, 0, 1)")
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_flush_status(&self) -> Result<bool, sqlx::Error> {
+        sqlx::query!("SELECT flush_in_progress FROM status;")
+            .fetch_one(&self.connection_pool)
+            .await
+            .map(|r| r.flush_in_progress > 0)
+    }
+
+    pub(crate) async fn set_previous_flush_timestamp(
+        &self,
+        timestamp: i64,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!("UPDATE status SET previous_flush_timestamp = ?", timestamp)
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_previous_flush_timestamp(&self) -> Result<i64, sqlx::Error> {
+        sqlx::query!("SELECT previous_flush_timestamp FROM status;")
+            .fetch_one(&self.connection_pool)
+            .await
+            .map(|r| r.previous_flush_timestamp)
+    }
+
+    pub(crate) async fn set_flush_status(&self, in_progress: bool) -> Result<(), sqlx::Error> {
+        let in_progress_int = i64::from(in_progress);
+        sqlx::query!("UPDATE status SET flush_in_progress = ?", in_progress_int)
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_client_in_use_status(&self) -> Result<bool, sqlx::Error> {
+        sqlx::query!("SELECT client_in_use FROM status;")
+            .fetch_one(&self.connection_pool)
+            .await
+            .map(|r| r.client_in_use > 0)
+    }
+
+    pub(crate) async fn set_client_in_use_status(&self, in_use: bool) -> Result<(), sqlx::Error> {
+        let in_use_int = i64::from(in_use);
+        sqlx::query!("UPDATE status SET client_in_use = ?", in_use_int)
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn delete_all_tags(&self) -> Result<(), sqlx::Error> {
+        sqlx::query!("DELETE FROM sender_tag;")
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_tags(&self) -> Result<Vec<StoredSenderTag>, sqlx::Error> {
+        sqlx::query_as!(StoredSenderTag, "SELECT * FROM sender_tag;",)
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn insert_tag(&self, stored_tag: StoredSenderTag) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO sender_tag(recipient, tag) VALUES (?, ?);
+            "#,
+            stored_tag.recipient,
+            stored_tag.tag
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn delete_all_reply_keys(&self) -> Result<(), sqlx::Error> {
+        sqlx::query!("DELETE FROM reply_key;")
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_reply_keys(&self) -> Result<Vec<StoredReplyKey>, sqlx::Error> {
+        sqlx::query_as!(StoredReplyKey, "SELECT * FROM reply_key;",)
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn insert_reply_key(
+        &self,
+        stored_reply_key: StoredReplyKey,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO reply_key(key_digest, reply_key, sent_at_timestamp) VALUES (?, ?, ?);
+            "#,
+            stored_reply_key.key_digest,
+            stored_reply_key.reply_key,
+            stored_reply_key.sent_at_timestamp
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_surb_senders(&self) -> Result<Vec<StoredSurbSender>, sqlx::Error> {
+        sqlx::query_as!(StoredSurbSender, "SELECT * FROM reply_surb_sender;",)
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn insert_surb_sender(
+        &self,
+        stored_surb_sender: StoredSurbSender,
+    ) -> Result<i64, sqlx::Error> {
+        let id = sqlx::query!(
+            r#"
+                INSERT INTO reply_surb_sender(tag, last_sent_timestamp) VALUES (?, ?);
+            "#,
+            stored_surb_sender.tag,
+            stored_surb_sender.last_sent_timestamp
+        )
+        .execute(&self.connection_pool)
+        .await?
+        .last_insert_rowid();
+        Ok(id)
+    }
+
+    pub(crate) async fn get_reply_surbs(
+        &self,
+        sender_id: i64,
+    ) -> Result<Vec<StoredReplySurb>, sqlx::Error> {
+        sqlx::query_as!(
+            StoredReplySurb,
+            "SELECT * FROM reply_surb WHERE reply_surb_sender_id = ?",
+            sender_id
+        )
+        .fetch_all(&self.connection_pool)
+        .await
+    }
+
+    pub(crate) async fn delete_all_reply_surb_data(&self) -> Result<(), sqlx::Error> {
+        sqlx::query!("DELETE FROM reply_surb;")
+            .execute(&self.connection_pool)
+            .await?;
+
+        sqlx::query!("DELETE FROM reply_surb_sender;")
+            .execute(&self.connection_pool)
+            .await?;
+
+        Ok(())
+    }
+
+    pub(crate) async fn insert_reply_surb(
+        &self,
+        stored_reply_surb: StoredReplySurb,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO reply_surb(reply_surb_sender_id, reply_surb) VALUES (?, ?);
+            "#,
+            stored_reply_surb.reply_surb_sender_id,
+            stored_reply_surb.reply_surb
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_reply_surb_storage_metadata(
+        &self,
+    ) -> Result<ReplySurbStorageMetadata, sqlx::Error> {
+        sqlx::query_as!(
+            ReplySurbStorageMetadata,
+             r#"
+                SELECT min_reply_surb_threshold as "min_reply_surb_threshold: u32", max_reply_surb_threshold as "max_reply_surb_threshold: u32" FROM reply_surb_storage_metadata;
+             "#,
+        )
+            .fetch_one(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn insert_reply_surb_storage_metadata(
+        &self,
+        metadata: ReplySurbStorageMetadata,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(r#"
+            INSERT INTO reply_surb_storage_metadata(min_reply_surb_threshold, max_reply_surb_threshold)
+            VALUES (?, ?);
+        "#,
+            metadata.min_reply_surb_threshold,
+            metadata.max_reply_surb_threshold,
+        ).execute(&self.connection_pool).await?;
+        Ok(())
+    }
+}
@@ -0,0 +1,444 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::base_client::non_wasm_helpers;
+use crate::client::replies::reply_storage::backend::fs_backend::manager::StorageManager;
+use crate::client::replies::reply_storage::backend::fs_backend::models::{
+    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
+};
+use crate::client::replies::reply_storage::surb_storage::ReceivedReplySurbs;
+use crate::client::replies::reply_storage::{
+    CombinedReplyStorage, ReceivedReplySurbsMap, ReplyStorageBackend, SentReplyKeys, UsedSenderTags,
+};
+use async_trait::async_trait;
+use log::{error, info, warn};
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use std::fs;
+use std::path::{Path, PathBuf};
+use time::OffsetDateTime;
+
+pub use self::error::StorageError;
+
+mod error;
+mod manager;
+mod models;
+
+#[derive(Debug)]
+enum StorageManagerState {
+    Storage(StorageManager),
+    Inactive(InactiveMetadata),
+}
+
+// When the storage backaed is initialized as inactive, it will still contain metadata parameters
+// that will be needed when the in-mem storage is fetched for use.
+#[derive(Debug)]
+struct InactiveMetadata {
+    pub minimum_reply_surb_storage_threshold: usize,
+    pub maximum_reply_surb_storage_threshold: usize,
+}
+
+impl StorageManagerState {
+    fn get(&self) -> &StorageManager {
+        match self {
+            StorageManagerState::Storage(manager) => manager,
+            StorageManagerState::Inactive(_) => {
+                panic!("tried to get storage of an inactive backend")
+            }
+        }
+    }
+
+    fn get_mut(&mut self) -> &mut StorageManager {
+        match self {
+            StorageManagerState::Storage(manager) => manager,
+            StorageManagerState::Inactive(_) => {
+                panic!("tried to get storage of an inactive backend")
+            }
+        }
+    }
+
+    fn is_active(&self) -> bool {
+        matches!(self, StorageManagerState::Storage(_))
+    }
+}
+
+#[derive(Debug)]
+pub struct Backend {
+    temporary_old_path: Option<PathBuf>,
+    database_path: PathBuf,
+    manager: StorageManagerState,
+}
+
+impl Backend {
+    const OLD_EXTENSION: &'static str = "old";
+
+    pub async fn init<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+        let owned_path: PathBuf = database_path.as_ref().into();
+        if owned_path.file_name().is_none() {
+            return Err(StorageError::DatabasePathWithoutFilename {
+                provided_path: owned_path,
+            });
+        }
+
+        let manager = StorageManager::init(database_path, true).await?;
+        manager.create_status_table().await?;
+
+        let backend = Backend {
+            temporary_old_path: None,
+            database_path: owned_path,
+            manager: StorageManagerState::Storage(manager),
+        };
+
+        Ok(backend)
+    }
+
+    pub fn new_inactive(
+        minimum_reply_surb_storage_threshold: usize,
+        maximum_reply_surb_storage_threshold: usize,
+    ) -> Self {
+        Backend {
+            temporary_old_path: None,
+            database_path: PathBuf::new(),
+            manager: StorageManagerState::Inactive(InactiveMetadata {
+                minimum_reply_surb_storage_threshold,
+                maximum_reply_surb_storage_threshold,
+            }),
+        }
+    }
+
+    pub async fn try_load<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+        let owned_path: PathBuf = database_path.as_ref().into();
+        if owned_path.file_name().is_none() {
+            return Err(StorageError::DatabasePathWithoutFilename {
+                provided_path: owned_path,
+            });
+        }
+
+        let manager = StorageManager::init(database_path, false).await?;
+
+        // the database flush wasn't fully finished and thus the data is in inconsistent state
+        // (we don't really know what's properly saved or what's not)
+        if manager.get_flush_status().await? {
+            return Err(StorageError::IncompleteDataFlush);
+        }
+
+        let last_flush_timestamp = manager.get_previous_flush_timestamp().await?;
+        if last_flush_timestamp == 0 {
+            // either this client has been running since 1970 or the flush failed
+            return Err(StorageError::IncompleteDataFlush);
+        }
+
+        // the process has gone down without full graceful shutdown,
+        // meaning the database doesn't contain valid data anymore
+        // so we have to purge it
+        if manager.get_client_in_use_status().await? {
+            error!("the client hasn't undergone through graceful shutdown the last time it's gone down - we can't trust its reply surbs or stored encryption keys. They shall get purged");
+            manager.delete_all_reply_surb_data().await?;
+            manager.delete_all_reply_keys().await?;
+        }
+
+        if let Err(err) = manager.get_reply_surb_storage_metadata().await {
+            // we can't recover here, we HAVE TO initialise fresh (because we don't know correct starting metadata)
+            error!("it seems the client has been shutdown gracefully - we're missing valid surb data dump. the existing database cannot be used");
+            return Err(err.into());
+        }
+
+        let last_flush = match OffsetDateTime::from_unix_timestamp(last_flush_timestamp) {
+            Ok(last_flush) => last_flush,
+            Err(err) => {
+                return Err(StorageError::CorruptedData {
+                    details: format!("failed to parse stored timestamp - {err}"),
+                });
+            }
+        };
+
+        // in theory clients can use our reply surbs whenever they want, even a year in the future
+        // (assuming no key rotation has happened)
+        // but the way it's currently coded, everyone will purge old data
+        let since_last_flush = OffsetDateTime::now_utc() - last_flush;
+        let days = since_last_flush.whole_days();
+        let hours = since_last_flush.whole_hours() % 24;
+
+        if days > 0 {
+            info!("it's been over {days} days and {hours} hours since we last used our data store. our reply surbs are already outdated - we're going to purge them now.");
+            manager.delete_all_reply_surb_data().await?;
+        }
+
+        if days > 1 {
+            info!("it's been over {days} days and {hours} hours since we last used our data store. our reply keys are already outdated - we're going to purge them now.");
+            manager.delete_all_reply_keys().await?;
+        }
+
+        if days > 2 {
+            info!("it's been over {days} days and {hours} hours since we last used our data store. our used sender tags are already outdated - we're going to purge them now.");
+            manager.delete_all_tags().await?;
+        }
+
+        Ok(Backend {
+            temporary_old_path: None,
+            database_path: owned_path,
+            manager: StorageManagerState::Storage(manager),
+        })
+    }
+
+    async fn close_pool(&mut self) {
+        self.manager.get_mut().connection_pool.close().await;
+    }
+
+    async fn rotate(&mut self) -> Result<(), StorageError> {
+        self.close_pool().await;
+
+        let new_extension = if let Some(existing_extension) =
+            self.database_path.extension().and_then(|ext| ext.to_str())
+        {
+            format!("{existing_extension}.{}", Self::OLD_EXTENSION)
+        } else {
+            Self::OLD_EXTENSION.to_string()
+        };
+
+        let mut temp_old = self.database_path.clone();
+        temp_old.set_extension(new_extension);
+
+        fs::rename(&self.database_path, &temp_old)
+            .map_err(|err| StorageError::DatabaseRenameError { source: err })?;
+        self.manager =
+            StorageManagerState::Storage(StorageManager::init(&self.database_path, true).await?);
+        self.manager.get_mut().create_status_table().await?;
+
+        self.temporary_old_path = Some(temp_old);
+        Ok(())
+    }
+
+    fn remove_old(&mut self) -> Result<(), StorageError> {
+        if let Some(old_path) = self.temporary_old_path.take() {
+            fs::remove_file(old_path)
+                .map_err(|err| StorageError::DatabaseOldFileRemoveError { source: err })
+        } else {
+            warn!("the old database file doesn't seem to exist!");
+            Ok(())
+        }
+    }
+
+    async fn start_storage_flush(&self) -> Result<(), StorageError> {
+        Ok(self.manager.get().set_flush_status(true).await?)
+    }
+
+    async fn end_storage_flush(&self) -> Result<(), StorageError> {
+        self.manager
+            .get()
+            .set_previous_flush_timestamp(OffsetDateTime::now_utc().unix_timestamp())
+            .await?;
+        Ok(self.manager.get().set_flush_status(false).await?)
+    }
+
+    async fn start_client_use(&self) -> Result<(), StorageError> {
+        Ok(self.manager.get().set_client_in_use_status(true).await?)
+    }
+
+    async fn stop_client_use(&self) -> Result<(), StorageError> {
+        Ok(self.manager.get().set_client_in_use_status(false).await?)
+    }
+
+    async fn get_stored_tags(&self) -> Result<UsedSenderTags, StorageError> {
+        let stored = self.manager.get().get_tags().await?;
+
+        // stop at the first instance of corruption. if even a single entry is malformed,
+        // something weird has happened and we can't trust the rest of the data
+        let raw = stored
+            .into_iter()
+            .map(TryInto::try_into)
+            .collect::<Result<_, _>>()?;
+
+        Ok(UsedSenderTags::from_raw(raw))
+    }
+
+    async fn dump_sender_tags(&self, tags: &UsedSenderTags) -> Result<(), StorageError> {
+        for map_ref in tags.as_raw_iter() {
+            let (recipient, tag) = map_ref.pair();
+            self.manager
+                .get()
+                .insert_tag(StoredSenderTag::new(*recipient, *tag))
+                .await?;
+        }
+        Ok(())
+    }
+
+    async fn get_stored_reply_keys(&self) -> Result<SentReplyKeys, StorageError> {
+        let stored = self.manager.get().get_reply_keys().await?;
+
+        // stop at the first instance of corruption. if even a single entry is malformed,
+        // something weird has happened and we can't trust the rest of the data
+        let raw = stored
+            .into_iter()
+            .map(TryInto::try_into)
+            .collect::<Result<_, _>>()?;
+
+        Ok(SentReplyKeys::from_raw(raw))
+    }
+
+    async fn dump_sender_reply_keys(&self, reply_keys: &SentReplyKeys) -> Result<(), StorageError> {
+        for map_ref in reply_keys.as_raw_iter() {
+            let (digest, key) = map_ref.pair();
+            self.manager
+                .get()
+                .insert_reply_key(StoredReplyKey::new(*digest, *key))
+                .await?;
+        }
+        Ok(())
+    }
+
+    async fn get_stored_reply_surbs(&self) -> Result<ReceivedReplySurbsMap, StorageError> {
+        let surb_senders = self.manager.get().get_surb_senders().await?;
+
+        let metadata = self.get_reply_surb_storage_metadata().await?;
+        let mut received_surbs = Vec::with_capacity(surb_senders.len());
+        for sender in surb_senders {
+            let sender_id = sender.id;
+            let (sender_tag, surbs_last_received_at_timestamp): (AnonymousSenderTag, i64) =
+                sender.try_into()?;
+            let stored_surbs = self
+                .manager
+                .get()
+                .get_reply_surbs(sender_id)
+                .await?
+                .into_iter()
+                .map(|raw| raw.try_into())
+                .collect::<Result<_, _>>()?;
+
+            received_surbs.push((
+                sender_tag,
+                ReceivedReplySurbs::new_retrieved(stored_surbs, surbs_last_received_at_timestamp),
+            ))
+        }
+
+        Ok(ReceivedReplySurbsMap::from_raw(
+            metadata.min_reply_surb_threshold as usize,
+            metadata.max_reply_surb_threshold as usize,
+            received_surbs,
+        ))
+    }
+
+    async fn dump_reply_surbs(
+        &self,
+        reply_surbs: &ReceivedReplySurbsMap,
+    ) -> Result<(), StorageError> {
+        for map_ref in reply_surbs.as_raw_iter() {
+            let (tag, received_surbs) = map_ref.pair();
+            let sender_id = self
+                .manager
+                .get()
+                .insert_surb_sender(StoredSurbSender::new(
+                    *tag,
+                    received_surbs.surbs_last_received_at(),
+                ))
+                .await?;
+
+            for reply_surb in received_surbs.surbs_ref() {
+                self.manager
+                    .get()
+                    .insert_reply_surb(StoredReplySurb::new(sender_id, reply_surb))
+                    .await?
+            }
+        }
+        Ok(())
+    }
+
+    async fn get_reply_surb_storage_metadata(
+        &self,
+    ) -> Result<ReplySurbStorageMetadata, StorageError> {
+        self.manager
+            .get()
+            .get_reply_surb_storage_metadata()
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn dump_reply_surb_storage_metadata(
+        &self,
+        reply_surbs: &ReceivedReplySurbsMap,
+    ) -> Result<(), StorageError> {
+        self.manager
+            .get()
+            .insert_reply_surb_storage_metadata(ReplySurbStorageMetadata::new(
+                reply_surbs.min_surb_threshold(),
+                reply_surbs.max_surb_threshold(),
+            ))
+            .await
+            .map_err(Into::into)
+    }
+}
+
+#[async_trait]
+impl ReplyStorageBackend for Backend {
+    type StorageError = error::StorageError;
+
+    async fn new(
+        debug_config: &crate::config::DebugConfig,
+        db_path: Option<PathBuf>,
+    ) -> Result<Self, Self::StorageError> {
+        non_wasm_helpers::setup_fs_reply_surb_backend(db_path, debug_config)
+            .await
+            .map_err(|err| {
+                log::error!("Failed to create storage: {err}");
+                Self::StorageError::FailedToCreateStorage {
+                    source: Box::new(err),
+                }
+            })
+    }
+
+    fn is_active(&self) -> bool {
+        self.manager.is_active()
+    }
+
+    async fn start_storage_session(&self) -> Result<(), Self::StorageError> {
+        self.start_client_use().await
+    }
+
+    async fn flush_surb_storage(
+        &mut self,
+        storage: &CombinedReplyStorage,
+    ) -> Result<(), Self::StorageError> {
+        // close all connections (there should be none! and rename the file to contain .old extension)
+        self.rotate().await?;
+        self.start_storage_flush().await?;
+
+        self.dump_sender_tags(storage.tags_storage_ref()).await?;
+        self.dump_sender_reply_keys(storage.key_storage_ref())
+            .await?;
+        let surbs_ref = storage.surbs_storage_ref();
+        self.dump_reply_surb_storage_metadata(surbs_ref).await?;
+        self.dump_reply_surbs(surbs_ref).await?;
+
+        self.remove_old()?;
+        self.end_storage_flush().await
+    }
+
+    async fn init_fresh(&mut self, fresh: &CombinedReplyStorage) -> Result<(), Self::StorageError> {
+        // for now nothing more to do apart from dumping the metadata
+        self.dump_reply_surb_storage_metadata(fresh.surbs_storage_ref())
+            .await
+    }
+
+    async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
+        let reply_keys = self.get_stored_reply_keys().await?;
+        let tags = self.get_stored_tags().await?;
+        let reply_surbs = self.get_stored_reply_surbs().await?;
+
+        Ok(CombinedReplyStorage::load(reply_keys, reply_surbs, tags))
+    }
+
+    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
+        match self.manager {
+            StorageManagerState::Storage(_) => {
+                panic!("tried to get inactive storage from an active storage backend")
+            }
+            StorageManagerState::Inactive(ref state) => Ok(CombinedReplyStorage::new(
+                state.minimum_reply_surb_storage_threshold,
+                state.maximum_reply_surb_storage_threshold,
+            )),
+        }
+    }
+
+    async fn stop_storage_session(self) -> Result<(), Self::StorageError> {
+        self.stop_client_use().await
+    }
+}
@@ -0,0 +1,183 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::replies::reply_storage::backend::fs_backend::error::StorageError;
+use crate::client::replies::reply_storage::key_storage::UsedReplyKey;
+use nym_crypto::generic_array::typenum::Unsigned;
+use nym_crypto::Digest;
+use nym_sphinx::addressing::clients::{Recipient, RecipientBytes};
+use nym_sphinx::anonymous_replies::encryption_key::EncryptionKeyDigest;
+use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, SENDER_TAG_SIZE};
+use nym_sphinx::anonymous_replies::{ReplySurb, SurbEncryptionKey, SurbEncryptionKeySize};
+use nym_sphinx::params::ReplySurbKeyDigestAlgorithm;
+
+#[derive(Debug, Clone)]
+pub(crate) struct StoredSenderTag {
+    pub(crate) recipient: Vec<u8>,
+    pub(crate) tag: Vec<u8>,
+}
+
+impl StoredSenderTag {
+    pub(crate) fn new(recipient: RecipientBytes, tag: AnonymousSenderTag) -> StoredSenderTag {
+        StoredSenderTag {
+            recipient: recipient.to_vec(),
+            tag: tag.to_bytes().to_vec(),
+        }
+    }
+}
+
+impl TryFrom<StoredSenderTag> for (RecipientBytes, AnonymousSenderTag) {
+    type Error = StorageError;
+
+    fn try_from(value: StoredSenderTag) -> Result<Self, Self::Error> {
+        let recipient_len = value.recipient.len();
+        let Ok(recipient_bytes) = value.recipient.try_into() else {
+            return Err(StorageError::CorruptedData {
+                details: format!(
+                    "the retrieved recipient has length of {recipient_len} while {} was expected",
+                    Recipient::LEN
+                ),
+            });
+        };
+
+        let tag_len = value.tag.len();
+        let Ok(sender_tag_bytes) = value.tag.try_into() else {
+            return Err(StorageError::CorruptedData {
+                details: format!(
+                    "the retrieved sender tag has length of {tag_len} while {SENDER_TAG_SIZE} was expected",
+                ),
+            });
+        };
+
+        Ok((
+            recipient_bytes,
+            AnonymousSenderTag::from_bytes(sender_tag_bytes),
+        ))
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct StoredReplyKey {
+    pub(crate) key_digest: Vec<u8>,
+    pub(crate) reply_key: Vec<u8>,
+    pub(crate) sent_at_timestamp: i64,
+}
+
+impl StoredReplyKey {
+    pub(crate) fn new(key_digest: EncryptionKeyDigest, reply_key: UsedReplyKey) -> StoredReplyKey {
+        StoredReplyKey {
+            key_digest: key_digest.to_vec(),
+            reply_key: (*reply_key).to_bytes(),
+            sent_at_timestamp: reply_key.sent_at_timestamp,
+        }
+    }
+}
+
+impl TryFrom<StoredReplyKey> for (EncryptionKeyDigest, UsedReplyKey) {
+    type Error = StorageError;
+
+    fn try_from(value: StoredReplyKey) -> Result<Self, Self::Error> {
+        let expected_reply_key_digest_size = ReplySurbKeyDigestAlgorithm::output_size();
+        let reply_key_digest_size = value.key_digest.len();
+
+        let Some(digest) = EncryptionKeyDigest::from_exact_iter(value.key_digest) else {
+            return Err(StorageError::CorruptedData {
+                details: format!(
+                    "the reply surb digest has length of {reply_key_digest_size} while {expected_reply_key_digest_size} was expected",
+                ),
+            });
+        };
+
+        let reply_key_len = value.reply_key.len();
+        let Ok(reply_key) = SurbEncryptionKey::try_from_bytes(&value.reply_key) else {
+            return Err(StorageError::CorruptedData {
+                details: format!(
+                    "the reply key has length of {reply_key_len} while {} was expected",
+                    SurbEncryptionKeySize::USIZE
+                ),
+            });
+        };
+
+        Ok((
+            digest,
+            UsedReplyKey::new(reply_key, value.sent_at_timestamp),
+        ))
+    }
+}
+
+pub(crate) struct StoredSurbSender {
+    pub(crate) id: i64,
+    pub(crate) tag: Vec<u8>,
+    pub(crate) last_sent_timestamp: i64,
+}
+
+impl StoredSurbSender {
+    pub(crate) fn new(tag: AnonymousSenderTag, last_sent_timestamp: i64) -> Self {
+        StoredSurbSender {
+            // for the purposes of STORING data,
+            // we ignore that field anyway
+            id: 0,
+            tag: tag.to_bytes().to_vec(),
+            last_sent_timestamp,
+        }
+    }
+}
+
+impl TryFrom<StoredSurbSender> for (AnonymousSenderTag, i64) {
+    type Error = StorageError;
+
+    fn try_from(value: StoredSurbSender) -> Result<Self, Self::Error> {
+        let tag_len = value.tag.len();
+        let Ok(sender_tag_bytes) = value.tag.try_into() else {
+            return Err(StorageError::CorruptedData {
+                details: format!(
+                    "the retrieved sender tag has length of {tag_len} while {SENDER_TAG_SIZE} was expected",
+                ),
+            });
+        };
+
+        Ok((
+            AnonymousSenderTag::from_bytes(sender_tag_bytes),
+            value.last_sent_timestamp,
+        ))
+    }
+}
+
+pub(crate) struct StoredReplySurb {
+    pub(crate) reply_surb_sender_id: i64,
+    pub(crate) reply_surb: Vec<u8>,
+}
+
+impl StoredReplySurb {
+    pub(crate) fn new(reply_surb_sender_id: i64, reply_surb: &ReplySurb) -> Self {
+        StoredReplySurb {
+            reply_surb_sender_id,
+            reply_surb: reply_surb.to_bytes(),
+        }
+    }
+}
+
+impl TryFrom<StoredReplySurb> for ReplySurb {
+    type Error = StorageError;
+
+    fn try_from(value: StoredReplySurb) -> Result<Self, Self::Error> {
+        ReplySurb::from_bytes(&value.reply_surb).map_err(|err| StorageError::CorruptedData {
+            details: format!("failed to recover the reply surb: {err}"),
+        })
+    }
+}
+
+#[derive(Copy, Clone)]
+pub(crate) struct ReplySurbStorageMetadata {
+    pub(crate) min_reply_surb_threshold: u32,
+    pub(crate) max_reply_surb_threshold: u32,
+}
+
+impl ReplySurbStorageMetadata {
+    pub(crate) fn new(min_reply_surb_threshold: usize, max_reply_surb_threshold: usize) -> Self {
+        Self {
+            min_reply_surb_threshold: min_reply_surb_threshold as u32,
+            max_reply_surb_threshold: max_reply_surb_threshold as u32,
+        }
+    }
+}
--- a/Show More
+++ b/Show More