Merge remote-tracking branch 'origin/main' into staging-0.9.0

.github/workflows/build.daml_test.yml

@@ -32,7 +32,7 @@ jobs:
         id: setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 8
+          cache_version: 10
           test_name: daml_test
 
       - name: Run Daml tests

.github/workflows/build.deployment_test.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: deployment_test
           with_sbt: false
 
@@ -40,6 +40,11 @@ jobs:
           cmd_retry_count: 5 # Retry in case of dependency download errors
           cmd: make cluster/pulumi/test
           cmd_before_retry: git reset --hard # revert changes before retrying, because make cluster/pulumi/test actually "fixes" the test pulumi files in-place
+
+      - name: Check that pinned docker images are multi-arch
+        uses: ./.github/actions/nix/run_bash_command_in_nix
+        with:
+          cmd: ./scripts/check-multiarch-images.py
 
       - name: Report Failures on Slack & Github
         if: failure() && (github.event_name == 'push' || github.event_name == 'schedule')

.github/workflows/build.docs.yml

@@ -25,7 +25,7 @@ jobs:
         id: setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: docs
           save_nix_cache: true
           save_nix_cache_to_gcp: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
@@ -48,7 +48,7 @@ jobs:
       - name: Post-SBT job
         uses: ./.github/actions/sbt/post_sbt
         with:
-          cache_version: 9
+          cache_version: 10
           setup_sbt_cache_hits: ${{ steps.setup.outputs.sbt_cache_hits }}
 
       - name: Report Failures on Slack & Github

.github/workflows/build.scala_test.yml

@@ -137,7 +137,7 @@ jobs:
       - name: Run Tests
         uses: ./.github/actions/tests/scala_test
         with:
-          cache_version: 9
+          cache_version: 10
           with_canton: ${{ inputs.with_canton }}
           start_canton_options: ${{ inputs.start_canton_options }}
           test_suite_name: ${{ inputs.test_name }}

.github/workflows/build.scala_test_for_compose.yml

@@ -104,7 +104,7 @@ jobs:
       - name: Run Tests
         uses: ./.github/actions/tests/scala_test
         with:
-          cache_version: 9
+          cache_version: 10
           start_canton_options: ${{ inputs.start_canton_options }}
           test_suite_name: ${{ inputs.test_name }}
           test_names: ${{ needs.split_tests.outputs.test_names }}

.github/workflows/build.scala_test_with_cometbft.yml

@@ -120,7 +120,7 @@ jobs:
       - name: Run Tests
         uses: ./.github/actions/tests/scala_test
         with:
-          cache_version: 9
+          cache_version: 10
           start_canton_options: -F -w
           test_suite_name: ${{ inputs.test_name }}
           test_names: ${{ needs.split_tests.outputs.test_names }}

.github/workflows/build.static_tests.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Nix
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: canton_consistency
           target: 'static_tests'
 
@@ -87,7 +87,7 @@ jobs:
         id: setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: static_tests
           target: 'static_tests'
 

.github/workflows/build.ts_cli_tests.yml

@@ -41,7 +41,7 @@ jobs:
         if: steps.skip.outputs.skip != 'true'
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: ts_cli
 
       - name: Run Token Standard CLI tests

.github/workflows/build.ui_tests.yml

@@ -41,7 +41,7 @@ jobs:
         if: steps.skip.outputs.skip != 'true'
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: ui_tests
 
       - name: Run UI tests
@@ -62,7 +62,7 @@ jobs:
         if: steps.skip.outputs.skip != 'true'
         uses: ./.github/actions/sbt/post_sbt
         with:
-          cache_version: 9
+          cache_version: 10
           setup_sbt_cache_hits: ${{ steps.setup.outputs.sbt_cache_hits }}
 
       - name: Upload logs

.github/workflows/bump_gha_runner_version.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Nix (Self hosted)
         uses: ./.github/actions/nix/setup_nix
         with:
-          cache_version: 9
+          cache_version: 10
           target: default
 
       - name: Check for the latest version and create a PR to splice

.github/workflows/performance_tests.yml

@@ -34,7 +34,7 @@ jobs:
         id: setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: ingestion_performance_tests
 
       # Authenticate to GCP for read access to GCS
@@ -137,7 +137,7 @@ jobs:
         id: setup
         uses: ./.github/actions/tests/common_test_setup
         with:
-          cache_version: 9
+          cache_version: 10
           test_name: read_performance_tests
 
       # Authenticate to GCP for read access to GCS

.github/workflows/pr_check_github_scripts.yml

@@ -15,7 +15,7 @@ jobs:
     - name: Set up Nix
       uses: ./.github/actions/nix/setup_nix
       with:
-        cache_version: 9
+        cache_version: 10
     - name: Check github scripts
       uses: ./.github/actions/nix/run_bash_command_in_nix
       with:

.gitignore

@@ -82,3 +82,6 @@ docs/src/deployment/observability/metrics_reference.rst
 /.vagrant/
 /vagrant-nix-cache/
 lnav*work
+
+# VS Code
+.vscode/

Makefile

@@ -25,7 +25,7 @@ $(app-bundle): $(canton-amulet-dar) $(wallet-payments-dar)
 	sbt --client --batch bundle
 
 $(canton-amulet-dar) $(wallet-payments-dar) &:
-	sbt --batch 'splice-amulet-daml'/damlBuild 'splice-wallet-payments-daml'/damlBuild
+	sbt --client --batch 'splice-amulet-daml/damlBuild; splice-wallet-payments-daml/damlBuild'
 
 $(load-tester):
 	cd "${SPLICE_ROOT}/load-tester" && npm ci && npm run build

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/ConfigTransforms.scala

@@ -206,6 +206,9 @@ object ConfigTransforms {
         _.copy(rewardOperationRoundsCloseBufferDuration = NonNegativeFiniteDuration.ofMillis(100))
       ),
       disableDevelopmentFund(),
+      // Tests default to TrafficBasedAppRewards. Networks (which don't apply
+      // ConfigTransforms.defaults) fall back to the FeaturedAppMarkers default
+      withTrafficBasedAppRewards,
     )
   }
 
@@ -795,6 +798,9 @@ object ConfigTransforms {
     }
   }
 
+  def withNoSvOperationsSwitchOverTimes: ConfigTransform =
+    updateAllSvAppFoundDsoConfigs_(_.copy(initialSvOperationsSwitchOverTimes = None))
+
   def withValidatorFaucetCap(cap: BigDecimal): ConfigTransform =
     updateAllSvAppFoundDsoConfigs_(c => c.copy(optValidatorFaucetCap = Some(cap)))
 
@@ -809,6 +815,24 @@ object ConfigTransforms {
   ): ConfigTransform =
     updateAllSvAppFoundDsoConfigs_(c => c.copy(initialRewardConfig = Some(rewardConfig)))
 
+  // Tests mint TBAR without dry-run — the network default enables TBAR dry-run
+  // alongside FeaturedAppMarkers minting, but tests already exercise TBAR
+  // directly so a dry-run would be redundant.
+  def withTrafficBasedAppRewards: ConfigTransform =
+    updateAllSvAppFoundDsoConfigs_(c =>
+      c.copy(initialRewardConfig =
+        Some(
+          InitialRewardConfig(
+            mintingVersion = "RewardVersion_TrafficBasedAppRewards",
+            dryRunVersion = None,
+          )
+        )
+      )
+    )
+
+  def withFeaturedAppMarkers: ConfigTransform =
+    updateAllSvAppFoundDsoConfigs_(c => c.copy(initialRewardConfig = None))
+
   private def portTransform(bump: Int, c: AdminServerConfig): AdminServerConfig =
     c.copy(internalPort = c.internalPort.map(_ + bump))
 

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/config/SpliceConfig.scala

@@ -35,6 +35,7 @@ import org.lfdecentralizedtrust.splice.sv.SvAppClientConfig
 import org.lfdecentralizedtrust.splice.sv.config.SvOnboardingConfig.FoundDso
 import org.lfdecentralizedtrust.splice.util.{
   Codec,
+  IpCidrRateLimits,
   PerAttributeRateLimitConfig,
   SpliceRateLimitConfig,
 }
@@ -74,7 +75,14 @@ import com.typesafe.config.ConfigException.UnresolvedSubstitution
 import org.slf4j.{Logger, LoggerFactory}
 import pureconfig.configurable.{genericMapReader, genericMapWriter}
 import pureconfig.generic.{CoproductHint, FieldCoproductHint, ProductHint}
-import pureconfig.{ConfigCursor, ConfigReader, ConfigWriter}
+import pureconfig.{
+  CamelCase,
+  ConfigCursor,
+  ConfigFieldMapping,
+  ConfigReader,
+  ConfigWriter,
+  KebabCase,
+}
 import pureconfig.error.{CannotConvert, FailureReason}
 import pureconfig.module.cats.{nonEmptyListReader, nonEmptyListWriter}
 import io.circe.parser.*
@@ -376,6 +384,15 @@ object SpliceConfig {
 
   import pureconfig.generic.semiauto.*
 
+  private val perClientIpRateLimitHint: ProductHint[PerAttributeRateLimitConfig] =
+    ProductHint[PerAttributeRateLimitConfig](
+      ConfigFieldMapping {
+        case "attributeOverrides" => "ip-overrides"
+        case other => ConfigFieldMapping(CamelCase, KebabCase)(other)
+      },
+      allowUnknownKeys = false,
+    )
+
   private val cantonConfigReaders = new CantonConfig.ConfigReaders()(elc)
 
   class ConfigReaders(implicit
@@ -433,11 +450,22 @@ object SpliceConfig {
       deriveReader[SpliceParametersConfig]
     implicit val spliceRateLimiterSimpleConfig: ConfigReader[SpliceRateLimitConfig.Simple] =
       deriveReader[SpliceRateLimitConfig.Simple]
+    implicit val clientIpRateLimitHint: ProductHint[PerAttributeRateLimitConfig] =
+      SpliceConfig.perClientIpRateLimitHint
     implicit val clientIpRateLimitConfig: ConfigReader[PerAttributeRateLimitConfig] =
-      deriveReader[PerAttributeRateLimitConfig]
-    implicit val spliceRateLimiterWithPerClientIpConfig
-        : ConfigReader[SpliceRateLimitConfig.WithPerClientIp] =
-      deriveReader[SpliceRateLimitConfig.WithPerClientIp]
+      deriveReader[PerAttributeRateLimitConfig].emap { config =>
+        Try(IpCidrRateLimits.tryValidate(config)).toEither.left
+          .map[FailureReason](err =>
+            CannotConvert(
+              config.attributeOverrides.keys.mkString("[", ", ", "]"),
+              "ip-overrides",
+              err.getMessage,
+            )
+          )
+          .map(_ => config)
+      }
+    implicit val spliceRateLimiterWithPerClientIpConfig: ConfigReader[PerClientIpRateLimitConfig] =
+      deriveReader[PerClientIpRateLimitConfig]
     implicit val rateLimitersConfig: ConfigReader[RateLimitersConfig] =
       deriveReader[RateLimitersConfig]
     implicit val enabledFeaturesConfigReader: ConfigReader[EnabledFeaturesConfig] =
@@ -959,11 +987,12 @@ object SpliceConfig {
 
     implicit val spliceRateLimiterSimpleConfig: ConfigWriter[SpliceRateLimitConfig.Simple] =
       deriveWriter[SpliceRateLimitConfig.Simple]
+    implicit val clientIpRateLimitHint: ProductHint[PerAttributeRateLimitConfig] =
+      SpliceConfig.perClientIpRateLimitHint
     implicit val clientIpRateLimitConfig: ConfigWriter[PerAttributeRateLimitConfig] =
       deriveWriter[PerAttributeRateLimitConfig]
-    implicit val spliceRateLimiterWithPerClientIpConfig
-        : ConfigWriter[SpliceRateLimitConfig.WithPerClientIp] =
-      deriveWriter[SpliceRateLimitConfig.WithPerClientIp]
+    implicit val spliceRateLimiterWithPerClientIpConfig: ConfigWriter[PerClientIpRateLimitConfig] =
+      deriveWriter[PerClientIpRateLimitConfig]
     implicit val rateLimitersConfig: ConfigWriter[RateLimitersConfig] =
       deriveWriter[RateLimitersConfig]
 

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/ValidatorAppReference.scala

@@ -247,50 +247,6 @@ abstract class ValidatorAppReference(
     }
   }
 
-  @Help.Summary("Prepare TransferPreapproval send")
-  def prepareTransferPreapprovalSend(
-      senderPartyId: PartyId,
-      receiverPartyId: PartyId,
-      amount: BigDecimal,
-      expiresAt: CantonTimestamp,
-      nonce: Long,
-      description: Option[String],
-      verboseHashing: Boolean = false,
-  ): definitions.PrepareTransferPreapprovalSendResponse = {
-    consoleEnvironment.run {
-      httpCommand(
-        HttpValidatorAdminAppClient.PrepareTransferPreapprovalSend(
-          senderPartyId,
-          receiverPartyId,
-          amount,
-          expiresAt,
-          nonce,
-          description,
-          verboseHashing,
-        )
-      )
-    }
-  }
-
-  @Help.Summary("Submit TransferPreapproval send")
-  def submitTransferPreapprovalSend(
-      senderPartyId: PartyId,
-      transaction: String,
-      signature: String,
-      publicKey: String,
-  ): String = {
-    consoleEnvironment.run {
-      httpCommand(
-        HttpValidatorAdminAppClient.SubmitTransferPreapprovalSend(
-          senderPartyId,
-          transaction,
-          signature,
-          publicKey,
-        )
-      )
-    }
-  }
-
   def getExternalPartyBalance(partyId: PartyId): definitions.ExternalPartyBalanceResponse = {
     consoleEnvironment.run {
       httpCommand(

apps/app/src/main/scala/org/lfdecentralizedtrust/splice/console/WalletAppReference.scala

@@ -709,6 +709,7 @@ abstract class WalletAppReference(
       amount: BigDecimal,
       expiresAt: CantonTimestamp,
       reason: String,
+      mintAfter: Option[CantonTimestamp] = None,
   ): AllocateDevelopmentFundCouponResponse =
     consoleEnvironment.run {
       httpCommand(
@@ -717,6 +718,7 @@ abstract class WalletAppReference(
           amount,
           expiresAt,
           reason,
+          mintAfter,
         )
       )
     }

apps/app/src/test/resources/include/mediators.conf

@@ -19,10 +19,6 @@ _mediator_template {
   }
   topology {
     validate-initial-topology-snapshot = true
-    # enable after issue is fixed in canton
-    enable-topology-state-cache-consistency-checks = true
-    use-new-processor = true
-    use-new-client = true
   }
   parameters {
     delayed-verdict-sender {

apps/app/src/test/resources/include/participants.conf

@@ -96,9 +96,5 @@ _participant_template {
   topology {
     broadcast-batch-size = 1
     validate-initial-topology-snapshot = true
-    # enable after issue is fixed in canton
-    enable-topology-state-cache-consistency-checks = true
-    use-new-processor = true
-    use-new-client = true
   }
 }