server/Cargo.toml

@@ -6,7 +6,7 @@ resolver = "3"
 
 
 [workspace.dependencies]
-alloy = "2.0.0"
+alloy = "2.0.4"
 async-trait = "0.1.89"
 base64 = "0.22.1"
 chrono = { version = "0.4.44", features = ["serde"] }
@@ -16,15 +16,15 @@ kameo = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 kameo_actors = {git = "https://github.com/hdbg/kameo.git", rev = "805b417"}
 hmac = "0.13.0"
 miette = { version = "7.6.0", features = ["fancy", "serde"] }
-ml-dsa = { version = "0.1.0-rc.8", features = ["zeroize"] }
+ml-dsa = { version = "0.1.0-rc.9", features = ["zeroize"] }
 mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
-rustls = { version = "0.23.38", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
+rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
-rustls-pki-types = "1.14.0"
+rustls-pki-types = "1.14.1"
 sha2 = "0.11"
 smlang = "0.8.0"
 thiserror = "2.0.18"

server/crates/arbiter-client/Cargo.toml

@@ -21,7 +21,7 @@ tokio.workspace = true
 tokio-stream.workspace = true
 thiserror.workspace = true
 http = "1.4.0"
-rustls-webpki = { version = "0.103.12", features = ["aws-lc-rs"] }
+rustls-webpki = { version = "0.103.13", features = ["aws-lc-rs"] }
 async-trait.workspace = true
 chrono.workspace = true
 

server/crates/arbiter-server/Cargo.toml

@@ -9,8 +9,8 @@ license = "Apache-2.0"
 workspace = true
 
 [dependencies]
-diesel = { version = "2.3.7", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
+diesel = { version = "2.3.9", features = ["chrono", "returning_clauses_for_sqlite_3_35", "serde_json", "time", "uuid"] }
-diesel-async = { version = "0.8.0", features = [
+diesel-async = { version = "0.9.0", features = [
     "bb8",
     "migrations",
     "sqlite",
@@ -27,7 +27,7 @@ tokio.workspace = true
 rustls.workspace = true
 smlang.workspace = true
 thiserror.workspace = true
-diesel_migrations = { version = "2.3.1", features = ["sqlite"] }
+diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true

server/crates/arbiter-server/src/actors/vault/mod.rs

@@ -119,12 +119,11 @@ impl Vault {
         let mut conn = pool.get().await?;
 
         let nonce = conn
-            .exclusive_transaction(|conn| {
+            .exclusive_transaction(async |conn| {
-                Box::pin(async move {
                 let current_nonce: Vec<u8> = schema::root_key_history::table
                     .filter(schema::root_key_history::id.eq(root_key_id))
                     .select(schema::root_key_history::data_encryption_nonce)
-                        .first(conn)
+                    .first(&mut *conn)
                     .await?;
 
                 let mut nonce = Nonce::try_from(current_nonce.as_slice()).map_err(|()| {
@@ -139,12 +138,11 @@ impl Vault {
                 update(schema::root_key_history::table)
                     .filter(schema::root_key_history::id.eq(root_key_id))
                     .set(schema::root_key_history::data_encryption_nonce.eq(nonce.to_vec()))
-                        .execute(conn)
+                    .execute(&mut *conn)
                     .await?;
 
                 Result::<_, Error>::Ok(nonce)
             })
-            })
             .await?;
 
         Ok(nonce)
@@ -185,29 +183,27 @@ impl Vault {
 
         let data_encryption_nonce_bytes = data_encryption_nonce.to_vec();
         let root_key_history_id = conn
-            .transaction(|conn| {
+            .transaction(async |conn| {
-                Box::pin(async move {
                 let root_key_history_id: i32 = insert_into(schema::root_key_history::table)
                     .values(&models::NewRootKeyHistory {
-                            ciphertext: root_key_ciphertext,
+                        ciphertext: root_key_ciphertext.clone(),
                         tag: v1::ROOT_KEY_TAG.to_vec(),
                         root_key_encryption_nonce: root_key_nonce.to_vec(),
-                            data_encryption_nonce: data_encryption_nonce_bytes,
+                        data_encryption_nonce: data_encryption_nonce_bytes.clone(),
                         schema_version: 1,
                         salt: salt.to_vec(),
                     })
                     .returning(schema::root_key_history::id)
-                        .get_result(conn)
+                    .get_result(&mut *conn)
                     .await?;
 
                 update(schema::arbiter_settings::table)
                     .set(schema::arbiter_settings::root_key_id.eq(root_key_history_id))
-                        .execute(conn)
+                    .execute(&mut *conn)
                     .await?;
 
                 Result::<_, diesel::result::Error>::Ok(root_key_history_id)
             })
-            })
             .await?;
 
         self.state = State::Unsealed(Unsealed {

server/crates/arbiter-server/src/context/tls.rs

@@ -174,8 +174,7 @@ impl TlsManager {
 
         {
             let mut conn = db.get().await?;
-            conn.transaction(|conn| {
+            conn.transaction(async |conn| {
-                Box::pin(async {
                 let new_tls_history = NewTlsHistory {
                     cert: new_cert.cert.pem(),
                     cert_key: new_cert.cert_key.serialize_pem(),
@@ -186,17 +185,16 @@ impl TlsManager {
                 let inserted_tls_history: i32 = diesel::insert_into(tls_history::table)
                     .values(&new_tls_history)
                     .returning(tls_history::id)
-                        .get_result(conn)
+                    .get_result(&mut *conn)
                     .await?;
 
                 diesel::update(arbiter_settings::table)
                     .set(arbiter_settings::tls_id.eq(inserted_tls_history))
-                        .execute(conn)
+                    .execute(&mut *conn)
                     .await?;
 
                 Result::<_, diesel::result::Error>::Ok(())
             })
-            })
             .await?;
         }
 

server/crates/arbiter-server/src/evm/mod.rs

@@ -179,8 +179,7 @@ impl Engine {
         }
 
         if run_kind == RunKind::Execution {
-            conn.transaction(|conn| {
+            conn.transaction(async |conn| {
-                Box::pin(async move {
                 let log_id: i32 = insert_into(evm_transaction_log::table)
                     .values(&NewEvmTransactionLog {
                         grant_id: grant.common_settings_id,
@@ -190,14 +189,13 @@ impl Engine {
                         signed_at: Utc::now().into(),
                     })
                     .returning(evm_transaction_log::id)
-                        .get_result(conn)
+                    .get_result(&mut *conn)
                     .await?;
 
-                    P::record_transaction(&context, meaning, log_id, &grant, conn).await?;
+                P::record_transaction(&context, meaning, log_id, &grant, &mut *conn).await?;
 
                 QueryResult::Ok(())
             })
-            })
             .await
             .map_err(DatabaseError::from)?;
         }
@@ -222,8 +220,7 @@ impl Engine {
         let vault = self.vault.clone();
 
         let id = conn
-            .transaction(|conn| {
+            .transaction(async |conn| {
-                Box::pin(async move {
                 use schema::evm_basic_grant;
 
                 #[expect(
@@ -259,18 +256,17 @@ impl Engine {
                         revoked_at: None,
                     })
                     .returning(evm_basic_grant::all_columns)
-                        .get_result(conn)
+                    .get_result(&mut *conn)
                     .await?;
 
-                    P::create_grant(&basic_grant, &full_grant.specific, conn).await?;
+                P::create_grant(&basic_grant, &full_grant.specific, &mut *conn).await?;
 
-                    integrity::sign_entity(conn, &vault, &full_grant, basic_grant.id)
+                integrity::sign_entity(&mut *conn, &vault, &full_grant, basic_grant.id)
                     .await
                     .map_err(|_| diesel::result::Error::RollbackTransaction)?;
 
                 QueryResult::Ok(basic_grant.id)
             })
-            })
             .await?;
 
         Ok(id)

server/crates/arbiter-server/src/peers/client/auth.rs

@@ -171,10 +171,7 @@ async fn insert_client(
         Error::DatabasePoolUnavailable
     })?;
 
-    conn.exclusive_transaction(|conn| {
+    conn.exclusive_transaction(async |conn| {
-        let vault = vault.clone();
-        let pubkey = pubkey.clone();
-        Box::pin(async move {
         let metadata_id = insert_into(client_metadata::table)
             .values((
                 client_metadata::name.eq(&metadata.name),
@@ -182,7 +179,7 @@ async fn insert_client(
                 client_metadata::version.eq(&metadata.version),
             ))
             .returning(client_metadata::id)
-                .get_result::<i32>(conn)
+            .get_result::<i32>(&mut *conn)
             .await?;
 
         let client_id = insert_into(program_client::table)
@@ -192,12 +189,12 @@ async fn insert_client(
             ))
             .on_conflict_do_nothing()
             .returning(program_client::id)
-                .get_result::<i32>(conn)
+            .get_result::<i32>(&mut *conn)
             .await?;
 
         integrity::sign_entity(
-                conn,
+            &mut *conn,
-                &vault,
+            vault,
             &ClientCredentials {
                 pubkey: pubkey.clone(),
             },
@@ -211,7 +208,6 @@ async fn insert_client(
 
         Ok(client_id)
     })
-    })
     .await
 }
 
@@ -229,18 +225,15 @@ async fn sync_client_metadata(
         Error::DatabasePoolUnavailable
     })?;
 
-    conn.exclusive_transaction(|conn| {
+    conn.exclusive_transaction(async |conn| {
-        let metadata = metadata.clone();
+        let (current_metadata_id, current): (i32, ProgramClientMetadata) = program_client::table
-        Box::pin(async move {
-            let (current_metadata_id, current): (i32, ProgramClientMetadata) =
-                program_client::table
             .find(client_id)
             .inner_join(client_metadata::table)
             .select((
                 program_client::metadata_id,
                 ProgramClientMetadata::as_select(),
             ))
-                    .first(conn)
+            .first(&mut *conn)
             .await?;
 
         let unchanged = current.name == metadata.name
@@ -255,7 +248,7 @@ async fn sync_client_metadata(
                 client_metadata_history::metadata_id.eq(current_metadata_id),
                 client_metadata_history::client_id.eq(client_id),
             ))
-                .execute(conn)
+            .execute(&mut *conn)
             .await?;
 
         let metadata_id = insert_into(client_metadata::table)
@@ -265,7 +258,7 @@ async fn sync_client_metadata(
                 client_metadata::version.eq(&metadata.version),
             ))
             .returning(client_metadata::id)
-                .get_result::<i32>(conn)
+            .get_result::<i32>(&mut *conn)
             .await?;
 
         update(program_client::table.find(client_id))
@@ -273,12 +266,11 @@ async fn sync_client_metadata(
                 program_client::metadata_id.eq(metadata_id),
                 program_client::updated_at.eq(now),
             ))
-                .execute(conn)
+            .execute(&mut *conn)
             .await?;
 
         Ok::<(), diesel::result::Error>(())
     })
-    })
     .await
     .map_err(|e| {
         error!(error = ?e, "Database error");

server/crates/arbiter-server/src/peers/operator/session/handlers.rs

@@ -1,8 +1,8 @@
 use super::{Error, OperatorSession};
 use crate::{
     actors::evm::{
-        ClientSignTransaction, Generate, ListWallets, SignTransactionError as EvmSignError,
+        ClientSignTransaction, Generate, ListWallets, OperatorCreateGrant, OperatorListGrants,
-        OperatorCreateGrant, OperatorListGrants,
+        SignTransactionError as EvmSignError,
     },
     actors::flow_coordinator::client_connect_approval::ClientApprovalAnswer,
     actors::vault::VaultState,
@@ -169,21 +169,19 @@ impl OperatorSession {
         entries: Vec<NewEvmWalletAccess>,
     ) -> Result<(), Error> {
         let mut conn = self.props.db.get().await?;
-        conn.transaction(|conn| {
+        conn.transaction(async |conn| {
-            Box::pin(async move {
             use crate::db::schema::evm_wallet_access;
 
             for entry in entries {
                 diesel::insert_into(evm_wallet_access::table)
                     .values(&entry)
                     .on_conflict_do_nothing()
-                        .execute(conn)
+                    .execute(&mut *conn)
                     .await?;
             }
 
             Result::<_, Error>::Ok(())
         })
-        })
         .await?;
         Ok(())
     }
@@ -194,19 +192,17 @@ impl OperatorSession {
         entries: Vec<i32>,
     ) -> Result<(), Error> {
         let mut conn = self.props.db.get().await?;
-        conn.transaction(|conn| {
+        conn.transaction(async |conn| {
-            Box::pin(async move {
             use crate::db::schema::evm_wallet_access;
             for entry in entries {
                 diesel::delete(evm_wallet_access::table)
                     .filter(evm_wallet_access::wallet_id.eq(entry))
-                        .execute(conn)
+                    .execute(&mut *conn)
                     .await?;
             }
 
             Result::<_, Error>::Ok(())
         })
-        })
         .await?;
         Ok(())
     }