fix review comments

clippy
nyxd-scraper: add config to make pre-commit storage optional
2024-11-06 14:16:13 +05:30 · 2024-11-05 16:01:18 +05:30 · 2024-11-05 15:49:30 +05:30 · 2024-10-29 10:52:33 +01:00 · 2024-10-29 10:39:58 +01:00 · 2024-10-29 00:43:33 +01:00
1315 changed files with 72719 additions and 24130 deletions
@@ -5,5 +5,35 @@ on:

 jobs:
  build:
+    runs-on: arc-ubuntu-22.04
+
    steps:
-      run: "echo hello"
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Build Environment
+        run: sudo apt-get update && sudo apt-get install -y make dpkg-dev
+
+      - name: Build Debian Packages
+        working-directory: ppa/packages
+        run: make
+
+      - name: Find .deb files
+        working-directory: ppa/packages
+        run: |
+          echo "file1=$(ls nym-repo-setup*.deb)" >> $GITHUB_ENV
+          echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV
+
+      - name: Upload nym-repo-setup
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file1 }}
+          path: ppa/packages/nym-repo-setup*.deb
+          retention-days: 10
+
+      - name: Upload nym-vpn
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file2 }}
+          path: ppa/packages/nym-vpn*.deb
+          retention-days: 10
@@ -5,7 +5,7 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
@@ -99,24 +99,3 @@ jobs:
        run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
        continue-on-error: false
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: cd-docs
-          NYM_PROJECT_NAME: "Docs CD"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CD_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -13,6 +13,7 @@ on:
      - 'mixnode/**'
      - 'sdk/rust/nym-sdk/**'
      - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'
  pull_request:
    paths:
      - 'clients/**'
@@ -22,6 +23,7 @@ on:
      - 'mixnode/**'
      - 'sdk/rust/nym-sdk/**'
      - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'

 env:
  NETWORK: mainnet
@@ -31,7 +33,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [custom-linux]
+        platform: [arc-ubuntu-20.04]

    runs-on: ${{ matrix.platform }}
    steps:
@@ -1,14 +1,16 @@
 name: ci-build-ts

 on:
+  workflow_dispatch:
  pull_request:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
+      - ".github/workflows/ci-build-ts.yml"

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
    - uses: actions/checkout@v4
    - name: Install rsync
@@ -44,23 +46,3 @@ jobs:
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ts-${{ env.GITHUB_REF_SLUG }}-example
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Matrix - Node Install
-      run: npm install
-      working-directory: .github/workflows/support-files
-    - name: Matrix - Send Notification
-      env:
-        NYM_NOTIFICATION_KIND: ts-packages
-        NYM_PROJECT_NAME: "ts-packages"
-        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-        GIT_BRANCH: "${GITHUB_REF##*/}"
-        IS_SUCCESS: "${{ job.status == 'success' }}"
-        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-      uses: docker://keybaseio/client:stable-node
-      with:
-        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -26,18 +26,20 @@ on:
      - "nym-api/**"
      - "nym-node/**"
      - "nym-outfox/**"
+      - 'nym-data-observatory/**'
      - "nym-validator-rewarder/**"
      - "sdk/rust/nym-sdk/**"
      - "service-providers/**"
      - "tools/**"
      - "nymvisor/**"
+      - ".github/workflows/ci-build-upload-binaries.yml"

 jobs:
  publish-nym:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ ubuntu-20.04 ]
+        platform: [ arc-ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
@@ -55,17 +57,13 @@ jobs:
          echo $OUTPUT_DIR

      - name: Install Dependencies (Linux)
-        run: sudo apt update && sudo apt install libudev-dev
+        run: sudo apt-get update && sudo apt-get -y install libudev-dev

      - name: Sets env vars for tokio if set in manual dispatch inputs
        run: |
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -99,6 +97,7 @@ jobs:
            target/release/nym-socks5-client
            target/release/nym-api
            target/release/nym-network-requester
+            target/release/nym-data-observatory
            target/release/nym-cli
            target/release/nymvisor
            target/release/nym-node
@@ -116,6 +115,7 @@ jobs:
          cp target/release/nym-socks5-client $OUTPUT_DIR
          cp target/release/nym-api $OUTPUT_DIR
          cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nym-data-observatory $OUTPUT_DIR
          cp target/release/nymvisor $OUTPUT_DIR
          cp target/release/nym-node $OUTPUT_DIR
          cp target/release/nym-cli $OUTPUT_DIR
@@ -0,0 +1,41 @@
+name: ci-build-vpn-api-wasm
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workflows/ci-build-vpn-api-wasm.yml'
+
+jobs:
+  wasm:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
+
+      - name: Install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+
+      - name: "Build"
+        run: make
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm
@@ -1,23 +1,6 @@
 name: ci-build

 on:
-  push:
-    paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
-      - 'Cargo.toml'
  pull_request:
    paths:
      - 'clients/**'
@@ -26,15 +9,20 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
+      - 'sdk/rust/**'
+      - 'sdk/lib/**'
      - 'service-providers/**'
+      - 'nym-network-monitor/**'
      - 'nym-api/**'
+      - 'nym-node/**'
      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
+      - 'nym-data-observatory/**'
+      - 'nym-validator-rewarder/**'
+      - 'tools/**'
+      - 'wasm/**'
      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-build.yml'
  workflow_dispatch:

 jobs:
@@ -42,7 +30,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [custom-linux, custom-runner-mac-m1]
+        os: [ arc-ubuntu-20.04, custom-runner-mac-m1 ]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
@@ -50,7 +38,7 @@ jobs:
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
        continue-on-error: true
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')

      - name: Check out repository code
        uses: actions/checkout@v4
@@ -69,52 +57,34 @@ jobs:
          command: fmt
          args: --all -- --check

-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          # Enable wireguard by default on linux only
-          args: --workspace --features wireguard
-
-      # while disabled by default, this build ensures nothing is broken within
-      # `axum` feature
-      - name: Build with `axum` feature
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --features axum
-
-      - name: Build all examples
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --examples --features wireguard
-
-      - name: Run all tests
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features wireguard
-
-      - name: Run expensive tests
-        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features wireguard -- --ignored
-
-      - name: Annotate with clippy checks
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/clippy-check@v1
-        continue-on-error: true
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace --features wireguard
-
      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace --all-targets --features wireguard,axum -- -D warnings
+          args: --workspace --all-targets -- -D warnings
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+
+      - name: Build all examples
+        if: contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Run all tests
+        if: contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace
+
+      - name: Run expensive tests
+        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace -- --ignored
@@ -2,10 +2,14 @@ name: ci-cargo-deny
 on:
  workflow_dispatch:
  pull_request:
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-cargo-deny.yml'

 jobs:
  cargo-deny:
-    runs-on: ubuntu-22.04
+    runs-on: arc-ubuntu-22.04-dind
    strategy:
      matrix:
        checks:
@@ -14,8 +18,8 @@ jobs:

    steps:
    - uses: actions/checkout@v4
-    - uses: EmbarkStudios/cargo-deny-action@v1
+    - uses: EmbarkStudios/cargo-deny-action@v2
      with:
        log-level: warn
        command: check ${{ matrix.checks }}
-        argument: --all-features
+        arguments: --all-features
@@ -6,11 +6,12 @@ on:
    paths:
      - 'contracts/**'
      - 'common/**'
+      - '.github/workflows/ci-contracts-schema.yml'

 jobs:
  check-schema:
    name: Generate and check schema
-    runs-on: custom-linux
+    runs-on: arc-ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
@@ -6,6 +6,7 @@ on:
    paths:
      - 'common/**'
      - 'contracts/**'
+      - '.github/workflows/ci-contracts-upload-binaries.yml'

 env:
  NETWORK: mainnet
@@ -15,7 +16,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ ubuntu-20.04 ]
+        platform: [ arc-ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
@@ -9,10 +9,11 @@ on:
    paths:
      - 'contracts/**'
      - 'common/**'
+      - '.github/workflows/ci-contracts.yml'

 jobs:
  matrix_prep:
-    runs-on: ubuntu-20.04
+    runs-on: arc-ubuntu-20.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
@@ -6,10 +6,11 @@ on:
    branches-ignore: master
    paths:
      - 'documentation/docs/**'
+      - '.github/workflows/ci-docs.yml'

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
@@ -69,24 +70,3 @@ jobs:
          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
          EXCLUDE: "/node_modules/"
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ci-docs
-          NYM_PROJECT_NAME: "Docs CI"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,6 +1,7 @@
 name: ci-lint-typescript

 on:
+  workflow_dispatch:
  pull_request:
    paths:
      - "ts-packages/**"
@@ -10,10 +11,11 @@ on:
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
      - "explorer/**"
+      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - uses: rlespinasse/github-slug-action@v3.x
@@ -52,24 +54,3 @@ jobs:
        run: yarn lint
      - name: Typecheck with tsc
        run: yarn tsc
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "ts-packages"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -0,0 +1,45 @@
+name: ci-nym-credential-proxy
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workspace/ci-nym-credential-proxy.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+      MANIFEST_PATH: "--manifest-path nym-credential-proxy/Cargo.toml"
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: ${{ env.MANIFEST_PATH }} --all -- --check
+
+      - name: Build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets
+
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
@@ -5,6 +5,7 @@ on:
  push:
    paths:
      - 'explorer/**'
+      - '.github/workflows/ci-nym-network-explorer.yml'

 defaults:
  run:
@@ -1,22 +1,17 @@
 name: ci-nym-wallet-rust

 on:
-  push:
-    paths:
-      - 'nym-wallet/**'
-      - 'common/**'
-      - 'contracts/vesting/**'
-      - 'nym-api/nym-api-requests/**'
  pull_request:
    paths:
      - 'nym-wallet/**'
      - 'common/**'
      - 'contracts/vesting/**'
      - 'nym-api/nym-api-requests/**'
+      - '.github/workflows/ci-nym-wallet-rust.yml'

 jobs:
  build:
-    runs-on: [ self-hosted, custom-linux ]
+    runs-on: arc-ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
@@ -4,6 +4,7 @@ on:
  pull_request:
    paths:
      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-storybook.yml'

 jobs:
  build:
@@ -5,6 +5,7 @@ on:
    paths:
      - "sdk/typescript/**"
      - "wasm/**"
+      - '.github/workflows/ci-sdk-docs-typescript.yml'

 jobs:
  build:
@@ -6,10 +6,11 @@ on:
      - 'wasm/**'
      - 'clients/client-core/**'
      - 'common/**'
+      - '.github/workflows/ci-sdk-wasm.yml'

 jobs:
  wasm:
-    runs-on: [custom-linux]
+    runs-on: arc-ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
@@ -0,0 +1,11 @@
+name: Hello world
+
+on:
+  workflow_dispatch:
+
+jobs:
+  my-job:
+    runs-on: arc-ubuntu-22.04
+    steps:
+      - name: my-step
+        run: echo "Hello World!"
@@ -51,10 +51,6 @@ jobs:
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -1,4 +1,4 @@
-name: publish-nym-wallet-win10
+name: publish-nym-wallet-win11
 on:
  workflow_dispatch:
  release:
@@ -14,7 +14,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [windows10]
+        platform: [custom-windows-11]
    runs-on: ${{ matrix.platform }}

    outputs:
@@ -62,6 +62,9 @@ jobs:
          fileName: '.env'
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

+      - name: Install Yarn
+        run: npm install -g yarn
+
      - name: Install project dependencies
        shell: bash
        run: cd .. && yarn --network-timeout 100000
@@ -4,7 +4,7 @@ on:

 jobs:
  publish:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
      - uses: actions/checkout@v4

@@ -0,0 +1,55 @@
+name: Build and upload Credential Proxy container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-credential-proxy"
+  CONTAINER_NAME: "credential-proxy"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Data observatory container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-data-observatory"
+  CONTAINER_NAME: "data-observatory"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Network monitor container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "."
+  CONTAINER_NAME: "network-monitor"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from package.json
+        uses: sergeysova/jq-action@v2
+        id: get_version
+        with:
+          cmd: jq -r '.version' ${{ env.WORKING_DIRECTORY }}/package.json
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            git push --delete origin ${{ steps.get_version.outputs.value }}
+            git tag -d ${{ steps.get_version.outputs.value }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ steps.get_version.outputs.value }} -m "Version ${{ steps.get_version.outputs.value }}"
+          git push origin ${{ steps.get_version.outputs.value }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.value }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,56 @@
+name: Build and upload Node Status agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-agent"
+  CONTAINER_NAME: "node-status-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Node Status API container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-api"
+  CONTAINER_NAME: "node-status-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,6 +4,210 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
+## [2024.11-wedel] (2024-09-23)
+
+- Backport #4894 to fix ci ([#4899])
+- Bugfix/ticketbook false double spending ([#4892])
+- fix: allow updating globally stored signatures ([#4891])
+- [DOCs/operators]: Document changelog for patch/2024.10-caramello ([#4886])
+- [DOCs/operators]: Post release docs updates ([#4874])
+- Bump defguard to github latest version ([#4872])
+- chore: removed completed queued mixnet migration ([#4865])
+- Disable push trigger and add missing paths in ci-build ([#4864])
+- Fix linux conditional in ci-build.yml ([#4863])
+- Remove golang workaround in ci-sdk-wasm ([#4858])
+- Revert runner for ci-docs ([#4855])
+- Move credential verification into common crate ([#4853])
+- Fix test failure in ipr request size ([#4844])
+- Start switching over jobs to arc-ubuntu-20.04 ([#4843])
+- Use ecash credential type for bandwidth value ([#4840])
+- Create nym-repo-setup debian package and nym-vpn meta package ([#4837])
+- Remove serde_crate named import ([#4832])
+- Run cargo autoinherit following last weeks dependabot updates ([#4831])
+- revamped ticketbook serialisation and exposed additional cli methods ([#4827])
+- Expose wireguard details on self described endpoint ([#4825])
+- Remove unused wireguard flag from SDK ([#4823])
+- Add `axum` server to `nym-api` ([#4803])
+- Run cargo-autoinherit for a few new crates ([#4801])
+- Update dependabot ([#4796])
+- Fix clippy for unwrap_or_default ([#4783])
+- Enable dependabot version upgrades for root rust workspace ([#4778])
+- Persist used wireguard private IPs ([#4771])
+- Avoid race on ip and registration structures ([#4766])
+- docs/hotfix ([#4765])
+- chore: remove repetitive words ([#4763])
+- Make gateway latency check generic ([#4759])
+- Remove duplicate stat count for retransmissions ([#4756])
+- Update peer refresh value ([#4754])
+- Remove deprecated mark_as_success and use new disarm ([#4751])
+- Add get_mixnodes_described to validator_client ([#4725])
+- New Network Monitor ([#4610])
+
+[#4899]: https://github.com/nymtech/nym/pull/4899
+[#4892]: https://github.com/nymtech/nym/pull/4892
+[#4891]: https://github.com/nymtech/nym/pull/4891
+[#4886]: https://github.com/nymtech/nym/pull/4886
+[#4874]: https://github.com/nymtech/nym/pull/4874
+[#4872]: https://github.com/nymtech/nym/pull/4872
+[#4865]: https://github.com/nymtech/nym/pull/4865
+[#4864]: https://github.com/nymtech/nym/pull/4864
+[#4863]: https://github.com/nymtech/nym/pull/4863
+[#4858]: https://github.com/nymtech/nym/pull/4858
+[#4855]: https://github.com/nymtech/nym/pull/4855
+[#4853]: https://github.com/nymtech/nym/pull/4853
+[#4844]: https://github.com/nymtech/nym/pull/4844
+[#4843]: https://github.com/nymtech/nym/pull/4843
+[#4840]: https://github.com/nymtech/nym/pull/4840
+[#4837]: https://github.com/nymtech/nym/pull/4837
+[#4832]: https://github.com/nymtech/nym/pull/4832
+[#4831]: https://github.com/nymtech/nym/pull/4831
+[#4827]: https://github.com/nymtech/nym/pull/4827
+[#4825]: https://github.com/nymtech/nym/pull/4825
+[#4823]: https://github.com/nymtech/nym/pull/4823
+[#4803]: https://github.com/nymtech/nym/pull/4803
+[#4801]: https://github.com/nymtech/nym/pull/4801
+[#4796]: https://github.com/nymtech/nym/pull/4796
+[#4783]: https://github.com/nymtech/nym/pull/4783
+[#4778]: https://github.com/nymtech/nym/pull/4778
+[#4771]: https://github.com/nymtech/nym/pull/4771
+[#4766]: https://github.com/nymtech/nym/pull/4766
+[#4765]: https://github.com/nymtech/nym/pull/4765
+[#4763]: https://github.com/nymtech/nym/pull/4763
+[#4759]: https://github.com/nymtech/nym/pull/4759
+[#4756]: https://github.com/nymtech/nym/pull/4756
+[#4754]: https://github.com/nymtech/nym/pull/4754
+[#4751]: https://github.com/nymtech/nym/pull/4751
+[#4725]: https://github.com/nymtech/nym/pull/4725
+[#4610]: https://github.com/nymtech/nym/pull/4610
+
+## [2024.10-caramello] (2024-09-10)
+
+- Backport 4844 and 4845 ([#4857])
+- Bugfix/client registration vol2 ([#4856])
+- Remove wireguard feature flag and pass runtime enabled flag ([#4839])
+- Eliminate cancel unsafe sig awaiting ([#4834])
+- added explicit updateable admin to the mixnet contract ([#4822])
+- using legacy signing payload in CLI and verifying both variants in contract ([#4821])
+- adding ecash contract address ([#4819])
+- Check profit margin of node before defaulting to hardcoded value  ([#4802])
+- Sync last_seen_bandwidth immediately ([#4774])
+- Feature/additional ecash nym cli utils ([#4773])
+- Better storage error logging ([#4772])
+- bugfix: make sure DKG parses data out of events if logs are empty ([#4764])
+- Fix clippy on rustc beta toolchain ([#4746])
+- Fix clippy for beta toolchain ([#4742])
+- Disable testnet-manager on non-unix ([#4741])
+- Don't set NYM_VPN_API to default ([#4740])
+- Update publish-nym-binaries.yml ([#4739])
+- Update ci-build-upload-binaries.yml ([#4738])
+- Add NYM_VPN_API to network config ([#4736])
+- Re-export RecipientFormattingError in nym sdk ([#4735])
+- Persist wireguard peers ([#4732])
+- Fix tokio error in 1.39 ([#4730])
+- Feature/vesting purge plus ranged cost params ([#4716])
+- Fix (some) feature unification build failures ([#4681])
+- Feature Compact Ecash : The One PR ([#4623])
+
+[#4857]: https://github.com/nymtech/nym/pull/4857
+[#4856]: https://github.com/nymtech/nym/pull/4856
+[#4839]: https://github.com/nymtech/nym/pull/4839
+[#4834]: https://github.com/nymtech/nym/pull/4834
+[#4822]: https://github.com/nymtech/nym/pull/4822
+[#4821]: https://github.com/nymtech/nym/pull/4821
+[#4819]: https://github.com/nymtech/nym/pull/4819
+[#4802]: https://github.com/nymtech/nym/pull/4802
+[#4774]: https://github.com/nymtech/nym/pull/4774
+[#4773]: https://github.com/nymtech/nym/pull/4773
+[#4772]: https://github.com/nymtech/nym/pull/4772
+[#4764]: https://github.com/nymtech/nym/pull/4764
+[#4746]: https://github.com/nymtech/nym/pull/4746
+[#4742]: https://github.com/nymtech/nym/pull/4742
+[#4741]: https://github.com/nymtech/nym/pull/4741
+[#4740]: https://github.com/nymtech/nym/pull/4740
+[#4739]: https://github.com/nymtech/nym/pull/4739
+[#4738]: https://github.com/nymtech/nym/pull/4738
+[#4736]: https://github.com/nymtech/nym/pull/4736
+[#4735]: https://github.com/nymtech/nym/pull/4735
+[#4732]: https://github.com/nymtech/nym/pull/4732
+[#4730]: https://github.com/nymtech/nym/pull/4730
+[#4716]: https://github.com/nymtech/nym/pull/4716
+[#4681]: https://github.com/nymtech/nym/pull/4681
+[#4623]: https://github.com/nymtech/nym/pull/4623
+
 ## [2024.9-topdeck] (2024-07-26)

 - chore: fix 1.80 lint issues ([#4731])
@@ -45,6 +45,7 @@ members = [
    "common/credentials",
    "common/credential-utils",
    "common/credentials-interface",
+    "common/credential-verification",
    "common/crypto",
    "common/dkg",
    "common/ecash-double-spending",
@@ -53,12 +54,14 @@ members = [
    "common/exit-policy",
    "common/gateway-requests",
    "common/gateway-storage",
+    "common/gateway-stats-storage",
    "common/http-api-client",
    "common/http-api-common",
    "common/inclusion-probability",
    "common/ip-packet-requests",
    "common/ledger",
    "common/mixnode-common",
+    "common/models",
    "common/network-defaults",
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
@@ -80,9 +83,11 @@ members = [
    "common/nyxd-scraper",
    "common/pemstore",
    "common/serde-helpers",
+    "common/service-provider-requests-common",
    "common/socks5-client-core",
    "common/socks5/proxy-helpers",
    "common/socks5/requests",
+    "common/statistics",
    "common/store-cipher",
    "common/task",
    "common/topology",
@@ -101,6 +106,9 @@ members = [
    "mixnode",
    "sdk/lib/socks5-listener",
    "sdk/rust/nym-sdk",
+    "sdk/ffi/shared",
+    "sdk/ffi/go",
+    "sdk/ffi/cpp",
    "service-providers/authenticator",
    "service-providers/common",
    "service-providers/ip-packet-router",
@@ -109,13 +117,19 @@ members = [
    "nym-api",
    "nym-browser-extension/storage",
    "nym-api/nym-api-requests",
+    "nym-data-observatory",
    "nym-node",
    "nym-node/nym-node-http-api",
    "nym-node/nym-node-requests",
+    "nym-node-status-api",
+    "nym-node-status-agent",
    "nym-outfox",
    "nym-validator-rewarder",
+    "tools/echo-server",
    "tools/internal/ssl-inject",
    # "tools/internal/sdk-version-bump",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/nym-cli",
    "tools/nym-id-cli",
    "tools/nym-nr-query",
@@ -128,19 +142,28 @@ members = [
    "wasm/zknym-lib",
    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
+    "tools/echo-server",
+    "tools/internal/contract-state-importer/importer-cli",
+    "tools/internal/contract-state-importer/importer-contract",
 ]

 default-members = [
    "clients/native",
    "clients/socks5",
+    "common/models",
+    "explorer-api",
    "gateway",
-    "service-providers/network-requester",
    "mixnode",
    "nym-api",
-    "tools/nymvisor",
-    "explorer-api",
-    "nym-validator-rewarder",
+    "nym-data-observatory",
    "nym-node",
+    "nym-node-status-api",
+    "nym-validator-rewarder",
+    "nym-node-status-api",
+    "service-providers/authenticator",
+    "service-providers/ip-packet-router",
+    "service-providers/network-requester",
+    "tools/nymvisor",
 ]

 exclude = [
@@ -149,7 +172,6 @@ exclude = [
    "nym-wallet",
    "nym-vpn/ui/src-tauri",
    "cpu-cycles",
-    "sdk/ffi/cpp",
 ]

 [workspace.package]
@@ -166,11 +188,13 @@ readme = "README.md"
 addr = "0.15.6"
 aes = "0.8.1"
 aes-gcm = "0.10.1"
-anyhow = "1.0.71"
+aes-gcm-siv = "0.11.1"
+aead = "0.5.2"
+anyhow = "1.0.90"
 argon2 = "0.5.0"
-async-trait = "0.1.81"
+async-trait = "0.1.83"
 axum = "0.7.5"
-axum-extra = "0.9.3"
+axum-extra = "0.9.4"
 base64 = "0.22.1"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
@@ -183,7 +207,7 @@ blake3 = "1.5.4"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.7.1"
+bytes = "1.7.2"
 cargo_metadata = "0.18.1"
 celes = "2.4.0"
 cfg-if = "1.0.0"
@@ -191,37 +215,40 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.5.16"
+clap = "4.5.20"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
-comfy-table = "6.0.0"
+comfy-table = "7.1.1"
 console = "0.15.8"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
-const_format = "0.2.32"
+const_format = "0.2.33"
 criterion = "0.4"
 csv = "1.3.0"
 ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.4.2"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
-dirs = "4.0"
+dirs = "5.0"
 doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
 etherparse = "0.13.0"
+envy = "0.4"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.0.33"
+flate2 = "1.0.34"
 futures = "0.3.28"
+futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getset = "0.1.1"
+getset = "0.1.3"
 handlebars = "3.5.5"
 headers = "0.4.0"
 hex = "0.4.3"
@@ -229,10 +256,12 @@ hex-literal = "0.3.3"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
+http-body-util = "0.1"
 httpcodec = "0.2.3"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
-hyper = "1.3.1"
+hyper = "1.4.1"
+hyper-util = "0.1"
 indicatif = "0.17.8"
 inquire = "0.6.2"
 ip_network = "0.4.1"
@@ -246,23 +275,23 @@ ledger-transport-hid = "0.10.0"
 log = "0.4"
 maxminddb = "0.23.0"
 mime = "0.3.17"
+moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
 once_cell = "1.7.2"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
-parking_lot = "0.12.1"
+parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
-pin-project = "1.0"
+pin-project = "1.1"
+pin-project-lite = "0.2.14"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
 rand = "0.8.5"
-rand-07 = "0.7.3"
 rand_chacha = "0.3"
-rand_chacha_02 = "0.2"
 rand_core = "0.6.3"
 rand_distr = "0.4"
 rand_pcg = "0.3.1"
@@ -273,34 +302,37 @@ reqwest = { version = "0.12.4", default-features = false }
 rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
-safer-ffi = "0.1.12"
-schemars = "0.8.1"
+safer-ffi = "0.1.13"
+schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.209"
+serde = "1.0.211"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.127"
+serde_json = "1.0.132"
+serde_json_path = "0.6.7"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
-sqlx = "0.6.3"
-strum = "0.25"
+sqlx = "0.7.4"
+strum = "0.26"
+strum_macros = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
-sysinfo = "0.30.12"
+sysinfo = "0.30.13"
 tap = "1.0.1"
-tar = "0.4.40"
+tar = "0.4.42"
 tempfile = "3.5.0"
-thiserror = "1.0.63"
+thiserror = "1.0.64"
 time = "0.3.30"
 tokio = "1.39"
-tokio-stream = "0.1.15"
+tokio-stream = "0.1.16"
 tokio-test = "0.4.4"
+tokio-tun = "0.11.5"
 tokio-tungstenite = { version = "0.20.1" }
-tokio-util = "0.7.11"
+tokio-util = "0.7.12"
 toml = "0.8.14"
 tower = "0.4.13"
 tower-http = "0.5.2"
@@ -308,17 +340,17 @@ tracing = "0.1.37"
 tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.16"
 tracing-tree = "0.2.2"
-ts-rs = "7.0.0"
+tracing-log = "0.2"
+ts-rs = "10.0.0"
 tungstenite = { version = "0.20.1", default-features = false }
 url = "2.5"
 utoipa = "4.2"
-utoipa-rapidoc = "4.0"
 utoipa-swagger-ui = "7.1"
 utoipauto = "0.1"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 walkdir = "2"
-wasm-bindgen-test = "0.3.36"
+wasm-bindgen-test = "0.3.43"
 x25519-dalek = "2.0.0"
 zeroize = "1.6.0"

@@ -331,9 +363,9 @@ prometheus = { version = "0.13.0" }
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }
+subtle = "2.5.0"

 # cosmwasm-related
-cosmwasm-derive = "=1.4.3"
 cosmwasm-schema = "=1.4.3"
 cosmwasm-std = "=1.4.3"
 # use 0.5.0 as that's the version used by cosmwasm-std 1.4.3
@@ -370,14 +402,20 @@ indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", bra
 js-sys = "0.3.70"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.93"
-wasm-bindgen-futures = "0.4.43"
+wasm-bindgen = "0.2.95"
+wasm-bindgen-futures = "0.4.45"
 wasmtimer = "0.2.0"
-web-sys = "0.3.70"
+web-sys = "0.3.72"


 # Profile settings for individual crates

+# Compile-time verified queries do quite a bit of work at compile time. Incremental
+#  actions like cargo check and cargo build can be significantly faster when
+# using an optimized build
+[profile.dev.package.sqlx-macros]
+opt-level = 3
+
 [profile.release.package.nym-socks5-listener]
 strip = true
 codegen-units = 1
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.39"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_coin_index_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}
@@ -4,10 +4,10 @@
 use crate::commands::CliNativeClient;
 use crate::error::ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };

-pub(crate) async fn execute(args: CommonClientImportCredentialArgs) -> Result<(), ClientError> {
+pub(crate) async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), ClientError> {
    import_credential::<CliNativeClient, _>(args).await?;
    println!("successfully imported credential!");
    Ok(())
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_expiration_date_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), ClientError> {
+    import_master_verification_key::<CliNativeClient, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}
@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}
@@ -6,13 +6,13 @@ use crate::client::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::client::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::client::config::old_config_v1_1_33::ConfigV1_1_33;
 use crate::client::config::{BaseClientConfig, Config};
+use crate::commands::ecash::Ecash;
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_config::OptionalSet;
@@ -22,11 +22,10 @@ use std::sync::OnceLock;

 mod add_gateway;
 pub(crate) mod build_info;
-pub(crate) mod import_credential;
+pub(crate) mod ecash;
 pub(crate) mod init;
 mod list_gateways;
 pub(crate) mod run;
-mod show_ticketbooks;
 mod switch_gateway;

 pub(crate) struct CliNativeClient;
@@ -73,8 +72,8 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),

    /// List all registered with gateways
    ListGateways(list_gateways::Args),
@@ -85,9 +84,6 @@ pub(crate) enum Commands {
    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
    SwitchGateway(switch_gateway::Args),

-    /// Display information associated with the imported ticketbooks,
-    ShowTicketbooks(show_ticketbooks::Args),
-
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -116,11 +112,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
-        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.39"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_coin_index_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}
@@ -4,12 +4,10 @@
 use crate::commands::CliSocks5Client;
 use crate::error::Socks5ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };

-pub(crate) async fn execute(
-    args: CommonClientImportCredentialArgs,
-) -> Result<(), Socks5ClientError> {
+pub async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), Socks5ClientError> {
    import_credential::<CliSocks5Client, _>(args).await?;
    println!("successfully imported credential!");
    Ok(())
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_expiration_date_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), Socks5ClientError> {
+    import_master_verification_key::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}
@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}
@@ -9,7 +9,7 @@ use nym_client_core::cli_helpers::client_show_ticketbooks::{
 };

 #[derive(clap::Args)]
-pub(crate) struct Args {
+pub struct Args {
    #[command(flatten)]
    common_args: CommonShowTicketbooksArgs,

@@ -23,7 +23,7 @@ impl AsRef<CommonShowTicketbooksArgs> for Args {
    }
 }

-pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+pub async fn execute(args: Args) -> Result<(), Socks5ClientError> {
    let output = args.output;
    let res = show_ticketbooks::<CliSocks5Client, _>(args).await?;

@@ -1,6 +1,7 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::commands::ecash::Ecash;
 use crate::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
@@ -13,7 +14,6 @@ use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
@@ -26,11 +26,10 @@ use std::sync::OnceLock;

 mod add_gateway;
 pub(crate) mod build_info;
-mod import_credential;
+pub mod ecash;
 pub mod init;
 mod list_gateways;
 pub(crate) mod run;
-mod show_ticketbooks;
 mod switch_gateway;

 pub(crate) struct CliSocks5Client;
@@ -77,8 +76,8 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),

    /// List all registered with gateways
    ListGateways(list_gateways::Args),
@@ -89,9 +88,6 @@ pub(crate) enum Commands {
    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
    SwitchGateway(switch_gateway::Args),

-    /// Display information associated with the imported ticketbooks,
-    ShowTicketbooks(show_ticketbooks::Args),
-
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -123,11 +119,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
-        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -9,9 +9,24 @@ edition.workspace = true
 license.workspace = true

 [dependencies]
+base64 = { workspace = true }
 bincode = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }

+nym-credentials-interface = { path = "../credentials-interface" }
+nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-wireguard-types = { path = "../wireguard-types" }
+
+## verify:
+hmac = { workspace = true, optional = true }
+sha2 = { workspace = true, optional = true }
+x25519-dalek = { workspace = true, features = ["static_secrets"] }
+
+[features]
+default = ["verify"]
+# this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
+verify = ["hmac", "sha2"]
@@ -0,0 +1,25 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("the provided base64-encoded client MAC ('{mac}') was malformed: {source}")]
+    MalformedClientMac {
+        mac: String,
+        #[source]
+        source: base64::DecodeError,
+    },
+
+    #[cfg(feature = "verify")]
+    #[error("failed to verify mac provided by '{client}': {source}")]
+    FailedClientMacVerification {
+        client: String,
+        #[source]
+        source: hmac::digest::MacError,
+    },
+
+    #[error("conversion: {0}")]
+    Conversion(String),
+}
@@ -2,8 +2,15 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod v1;
+pub mod v2;
+pub mod v3;

-pub const CURRENT_VERSION: u8 = 1;
+mod error;
+
+pub use error::Error;
+pub use v3 as latest;
+
+pub const CURRENT_VERSION: u8 = 3;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -1,7 +1,13 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+pub mod registration;
 pub mod request;
 pub mod response;

-const VERSION: u8 = 1;
+pub use registration::{ClientMac, GatewayClient, InitMessage, Nonce};
+
+#[cfg(feature = "verify")]
+pub use registration::HmacSha256;
+
+pub const VERSION: u8 = 1;
@@ -0,0 +1,218 @@
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: i64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: u64,
+    pub suspended: bool,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -1,8 +1,9 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use super::registration::{GatewayClient, InitMessage};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::{GatewayClient, InitMessage, PeerPublicKey};
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};

 use crate::make_bincode_serializer;
@@ -82,3 +83,24 @@ pub enum AuthenticatorRequestData {
    Final(GatewayClient),
    QueryBandwidth(PeerPublicKey),
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_byte_version() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            version,
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = data.to_bytes().unwrap();
+        assert_eq!(*bytes.first().unwrap(), version);
+    }
+}
@@ -1,8 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use serde::{Deserialize, Serialize};

 use crate::make_bincode_serializer;
@@ -0,0 +1,174 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v1, v2};
+
+impl From<v1::request::AuthenticatorRequest> for v2::request::AuthenticatorRequest {
+    fn from(authenticator_request: v1::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v1::request::AuthenticatorRequestData> for v2::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v1::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v1::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v2::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v1::request::AuthenticatorRequestData::Final(gw_client) => {
+                v2::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v1::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v1::registration::InitMessage> for v2::registration::InitMessage {
+    fn from(init_msg: v1::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<v1::registration::GatewayClient> for Box<v2::registration::FinalMessage> {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Box::new(v2::registration::FinalMessage {
+            gateway_client: gw_client.into(),
+            credential: None,
+        })
+    }
+}
+
+impl From<v1::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v1::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v1::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v1::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::registration::ClientMac> for v1::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::response::AuthenticatorResponse> for v1::response::AuthenticatorResponse {
+    fn from(authenticator_response: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            version: authenticator_response.protocol.version,
+            data: authenticator_response.data.into(),
+            reply_to: authenticator_response.reply_to,
+        }
+    }
+}
+
+impl From<v2::response::AuthenticatorResponseData> for v1::response::AuthenticatorResponseData {
+    fn from(authenticator_response_data: v2::response::AuthenticatorResponseData) -> Self {
+        match authenticator_response_data {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => v1::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response.into(),
+            ),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                v1::response::AuthenticatorResponseData::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => v1::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            ),
+        }
+    }
+}
+
+impl From<v2::response::PendingRegistrationResponse> for v1::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RegisteredResponse> for v1::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RemainingBandwidthResponse> for v1::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v2::registration::RegistrationData> for v1::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RemainingBandwidthData> for v1::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth as u64,
+            suspended: false,
+        }
+    }
+}
@@ -0,0 +1,9 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+
+pub const VERSION: u8 = 2;
@@ -1,9 +1,10 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use crate::PeerPublicKey;
 use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::net::IpAddr;
@@ -29,32 +30,26 @@ pub type Taken = Option<SystemTime>;
 pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB

 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
-pub enum ClientMessage {
-    Initial(InitMessage),
-    Final(GatewayClient),
-    Query(PeerPublicKey),
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct InitMessage {
    /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub pub_key: PeerPublicKey,
 }

 impl InitMessage {
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
    pub fn new(pub_key: PeerPublicKey) -> Self {
        InitMessage { pub_key }
    }
 }

+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RegistrationData {
    pub nonce: u64,
@@ -71,24 +66,20 @@ pub struct RegistredData {

 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RemainingBandwidthData {
-    pub available_bandwidth: u64,
-    pub suspended: bool,
+    pub available_bandwidth: i64,
 }

 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct GatewayClient {
    /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub pub_key: PeerPublicKey,

    /// Assigned private IP
    pub private_ip: IpAddr,

    /// Sha256 hmac on the data (alongside the prior nonce)
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub mac: ClientMac,
 }

@@ -0,0 +1,116 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{FinalMessage, InitMessage};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,129 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
@@ -0,0 +1,188 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3};
+
+impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    fn from(authenticator_request: v2::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v2::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v2::request::AuthenticatorRequestData::Final(gw_client) => {
+                v3::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v2::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
+    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
+        Box::new(v3::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v3::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v2::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v2::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v2 request couldn't produce a v3 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
+    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
+    fn from(value: v3::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 3;
@@ -0,0 +1,227 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -0,0 +1,136 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}
@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}
@@ -18,7 +18,7 @@ nym-ecash-time = { path = "../ecash-time" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
+nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
 nym-network-defaults = { path = "../network-defaults" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::BandwidthControllerError;
-use crate::utils::{get_coin_index_signatures, get_expiration_date_signatures};
+use crate::utils::{
+    get_aggregate_verification_key, get_coin_index_signatures, get_expiration_date_signatures,
+};
 use log::info;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::IssuanceTicketBook;
@@ -55,7 +57,7 @@ where
    ))
 }

-pub async fn query_and_persist_required_global_signatures<S>(
+pub async fn query_and_persist_required_global_data<S>(
    storage: &S,
    epoch_id: EpochId,
    expiration_date: Date,
@@ -65,6 +67,10 @@ where
    S: Storage,
    <S as Storage>::StorageError: Send + Sync + 'static,
 {
+    log::info!("Getting master verification key");
+    // this will also persist the key in the storage if was not there already
+    get_aggregate_verification_key(storage, epoch_id, apis.clone()).await?;
+
    log::info!("Getting expiration date signatures");
    // this will also persist the signatures in the storage if they were not there already
    get_expiration_date_signatures(storage, epoch_id, expiration_date, apis.clone()).await?;
@@ -16,7 +16,7 @@ use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
-    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, NymPayInfo, VerificationKeyAuth,
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, TicketType, VerificationKeyAuth,
 };
 use nym_ecash_time::Date;
 use nym_validator_client::nym_api::EpochId;
@@ -64,9 +64,10 @@ impl<C, St: Storage> BandwidthController<C, St> {
        BandwidthController { storage, client }
    }

-    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
+    /// Tries to retrieve one of the stored, unused credentials for the given type that hasn't yet expired.
    pub async fn get_next_usable_ticketbook(
        &self,
+        ticketbook_type: TicketType,
        tickets: u32,
    ) -> Result<RetrievedTicketbook, BandwidthControllerError>
    where
@@ -74,7 +75,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
    {
        let Some(ticketbook) = self
            .storage
-            .get_next_unspent_usable_ticketbook(tickets)
+            .get_next_unspent_usable_ticketbook(ticketbook_type.to_string(), tickets)
            .await
            .map_err(BandwidthControllerError::credential_storage_error)?
        else {
@@ -165,7 +166,9 @@ impl<C, St: Storage> BandwidthController<C, St> {
            .get_coin_index_signatures(epoch_id, &mut api_clients)
            .await?;

-        let pay_info = NymPayInfo::generate(provider_pk);
+        let pay_info = retrieved_ticketbook
+            .ticketbook
+            .generate_pay_info(provider_pk);

        let spend_request = retrieved_ticketbook.ticketbook.prepare_for_spending(
            &verification_key,
@@ -179,6 +182,7 @@ impl<C, St: Storage> BandwidthController<C, St> {

    pub async fn prepare_ecash_ticket(
        &self,
+        ticketbook_type: TicketType,
        provider_pk: [u8; 32],
        tickets_to_spend: u32,
    ) -> Result<PreparedCredential, BandwidthControllerError>
@@ -186,7 +190,9 @@ impl<C, St: Storage> BandwidthController<C, St> {
        C: DkgQueryClient + Sync + Send,
        <St as Storage>::StorageError: Send + Sync + 'static,
    {
-        let retrieved_ticketbook = self.get_next_usable_ticketbook(tickets_to_spend).await?;
+        let retrieved_ticketbook = self
+            .get_next_usable_ticketbook(ticketbook_type, tickets_to_spend)
+            .await?;

        let ticketbook_id = retrieved_ticketbook.ticketbook_id;
        let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();
@@ -4,6 +4,10 @@
 use crate::error::BandwidthControllerError;
 use log::warn;
 use nym_credential_storage::storage::Storage;
+use nym_credentials::ecash::bandwidth::serialiser::keys::EpochVerificationKey;
+use nym_credentials::ecash::bandwidth::serialiser::signatures::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures,
+};
 use nym_credentials_interface::{
    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
 };
@@ -94,13 +98,18 @@ where
    .await?
    .key;

+    let full = EpochVerificationKey {
+        epoch_id,
+        key: master_vk,
+    };
+
    // store the retrieved key
    storage
-        .insert_master_verification_key(epoch_id, &master_vk)
+        .insert_master_verification_key(&full)
        .await
        .map_err(BandwidthControllerError::credential_storage_error)?;

-    Ok(master_vk)
+    Ok(full.key)
 }

 pub(crate) async fn get_coin_index_signatures<St>(
@@ -132,13 +141,18 @@ where
    .await?
    .signatures;

+    let aggregated = AggregatedCoinIndicesSignatures {
+        epoch_id,
+        signatures: index_sigs,
+    };
+
    // store the retrieved key
    storage
-        .insert_coin_index_signatures(epoch_id, &index_sigs)
+        .insert_coin_index_signatures(&aggregated)
        .await
        .map_err(BandwidthControllerError::credential_storage_error)?;

-    Ok(index_sigs)
+    Ok(aggregated.signatures)
 }

 pub(crate) async fn get_expiration_date_signatures<St>(
@@ -171,11 +185,17 @@ where
    .await?
    .signatures;

+    let aggregated = AggregatedExpirationDateSignatures {
+        epoch_id,
+        expiration_date,
+        signatures: expiration_sigs,
+    };
+
    // store the retrieved key
    storage
-        .insert_expiration_date_signatures(epoch_id, expiration_date, &expiration_sigs)
+        .insert_expiration_date_signatures(&aggregated)
        .await
        .map_err(BandwidthControllerError::credential_storage_error)?;

-    Ok(expiration_sigs)
+    Ok(aggregated.signatures)
 }
@@ -8,14 +8,14 @@ license = { workspace = true }
 repository = { workspace = true }

 [dependencies]
-const-str = { workspace = true }
 clap = { workspace = true, features = ["derive"], optional = true }
 clap_complete = { workspace = true, optional = true }
 clap_complete_fig = { workspace = true, optional = true }
+const-str = { workspace = true }
 log = { workspace = true }
 pretty_env_logger = { workspace = true }
-semver = "0.11"
 schemars = { workspace = true, features = ["preserve_order"], optional = true }
+semver.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }

@@ -45,3 +45,4 @@ tracing = [
    "opentelemetry",
 ]
 clap = [ "dep:clap", "dep:clap_complete", "dep:clap_complete_fig" ]
+models = []
@@ -1,9 +1,10 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use semver::SemVerError;
 pub use semver::Version;

+/// Checks if the version is minor version compatible.
+///
 /// Checks whether given `version` is compatible with a given semantic version requirement `req`
 /// according to major-minor semver rules. The semantic version requirement can be passed as a full,
 /// concrete version number, because that's what we'll have in our Cargo.toml files (e.g. 0.3.2).
@@ -22,7 +23,7 @@ pub fn is_minor_version_compatible(version: &str, req: &str) -> bool {
    expected_version.major == req_version.major && expected_version.minor == req_version.minor
 }

-pub fn parse_version(raw_version: &str) -> Result<Version, SemVerError> {
+pub fn parse_version(raw_version: &str) -> Result<Version, semver::Error> {
    Version::parse(raw_version)
 }

@@ -14,7 +14,7 @@ base64 = { workspace = true }
 bs58 = { workspace = true }
 cfg-if = { workspace = true }
 clap = { workspace = true, optional = true }
-comfy-table = { version = "7.1.1", optional = true }
+comfy-table = { workspace = true, optional = true }
 futures = { workspace = true }
 humantime-serde = { workspace = true }
 log = { workspace = true }
@@ -59,19 +59,19 @@ nym-ecash-time = { path = "../ecash-time" }

 ### For serving prometheus metrics
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
-version = "1"
+workspace = true
 features = ["server", "http1"]

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.http-body-util]
-version = "0.1"
+workspace = true

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
-version = "0.1"
+workspace = true
 features = ["tokio"]
 ###

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
-version = "0.1.11"
+workspace = true
 features = ["time"]

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio]
@@ -102,7 +102,7 @@ workspace = true
 features = ["tokio"]

 [target."cfg(target_arch = \"wasm32\")".dependencies.gloo-timers]
-version = "0.2.4"
+version = "0.3.0"
 features = ["futures"]

 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]
@@ -110,7 +110,7 @@ path = "../wasm/utils"
 features = ["websocket"]

 [target."cfg(target_arch = \"wasm32\")".dependencies.time]
-version = "0.3.17"
+workspace = true
 features = ["wasm-bindgen"]

 [dev-dependencies]
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'",
+  "describe": {
+    "columns": [
+      {
+        "name": "exists",
+        "ordinal": 0,
+        "type_info": "Int"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"
+}
@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d"
+}
@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "data",
+        "ordinal": 1,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT gateway_id_bs58 FROM registered_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE active_gateway SET active_gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
+}
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT active_gateway_id_bs58 FROM active_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "active_gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM registered_gateway WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93"
+}
@@ -0,0 +1,13 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+-- make aes128 key column nullable and add aes256 column
+ALTER TABLE remote_gateway_details RENAME COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58 TO derived_aes128_ctr_blake3_hmac_keys_bs58_old;
+ALTER TABLE remote_gateway_details ADD COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58 TEXT;
+ALTER TABLE remote_gateway_details ADD COLUMN derived_aes256_gcm_siv_key BLOB;
+
+UPDATE remote_gateway_details SET derived_aes128_ctr_blake3_hmac_keys_bs58 = derived_aes128_ctr_blake3_hmac_keys_bs58_old;
+
+ALTER TABLE remote_gateway_details DROP COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58_old;
@@ -29,11 +29,10 @@ impl StorageManager {
            })?;
        }

-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
            .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
+            .create_if_missing(true)
+            .disable_statement_logging();

        let connection_pool = sqlx::SqlitePool::connect_with(opts)
            .await
@@ -82,7 +81,7 @@ impl StorageManager {
        sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
            .fetch_one(&self.connection_pool)
            .await
-            .map(|result| result.exists == 1)
+            .map(|result| result.exists == Some(1))
    }

    pub(crate) async fn maybe_get_registered_gateway(
@@ -155,11 +154,12 @@ impl StorageManager {
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, gateway_owner_address, gateway_listener) 
-                VALUES (?, ?, ?, ?)
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)
+                VALUES (?, ?, ?, ?, ?)
            "#,
            remote.gateway_id_bs58,
            remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            remote.derived_aes256_gcm_siv_key,
            remote.gateway_owner_address,
            remote.gateway_listener,
        )
@@ -168,6 +168,30 @@ impl StorageManager {
        Ok(())
    }

+    pub(crate) async fn update_remote_gateway_key(
+        &self,
+        gateway_id_bs58: &str,
+        derived_aes128_ctr_blake3_hmac_keys_bs58: Option<&str>,
+        derived_aes256_gcm_siv_key: Option<&[u8]>,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                UPDATE remote_gateway_details
+                SET
+                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,
+                    derived_aes256_gcm_siv_key = ?
+                WHERE gateway_id_bs58 = ?
+            "#,
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
+            gateway_id_bs58
+        )
+        .execute(&self.connection_pool)
+        .await?;
+
+        Ok(())
+    }
+
    pub(crate) async fn remove_remote_gateway_details(
        &self,
        gateway_id: &str,
@@ -7,7 +7,8 @@ use crate::{
 };
 use async_trait::async_trait;
 use manager::StorageManager;
-use nym_crypto::asymmetric::identity::PublicKey;
+use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::path::Path;

 pub mod error;
@@ -67,7 +68,7 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
        Ok(registered)
    }

-    async fn all_gateways_identities(&self) -> Result<Vec<PublicKey>, Self::StorageError> {
+    async fn all_gateways_identities(&self) -> Result<Vec<ed25519::PublicKey>, Self::StorageError> {
        Ok(self
            .manager
            .registered_gateways()
@@ -132,6 +133,21 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
        Ok(())
    }

+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError> {
+        self.manager
+            .update_remote_gateway_key(
+                &gateway_id.to_base58_string(),
+                None,
+                Some(updated_key.as_bytes()),
+            )
+            .await?;
+        Ok(())
+    }
+
    // ideally all of those should be run under a storage tx to ensure storage consistency,
    // but at that point it's fine
    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
@@ -2,8 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::types::{ActiveGateway, GatewayRegistration};
-use crate::{BadGateway, GatewaysDetailsStore};
+use crate::{BadGateway, GatewayDetails, GatewaysDetailsStore};
 use async_trait::async_trait;
+use nym_crypto::asymmetric::ed25519::PublicKey;
+use nym_gateway_requests::{SharedGatewayKey, SharedSymmetricKey};
 use std::collections::HashMap;
 use std::sync::Arc;
 use thiserror::Error;
@@ -34,10 +36,6 @@ struct InMemStorageInner {
 impl GatewaysDetailsStore for InMemGatewaysDetails {
    type StorageError = InMemStorageError;

-    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
-        Ok(self.inner.read().await.gateways.contains_key(gateway_id))
-    }
-
    async fn active_gateway(&self) -> Result<ActiveGateway, Self::StorageError> {
        let guard = self.inner.read().await;

@@ -68,6 +66,10 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
        Ok(self.inner.read().await.gateways.values().cloned().collect())
    }

+    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
+        Ok(self.inner.read().await.gateways.contains_key(gateway_id))
+    }
+
    async fn load_gateway_details(
        &self,
        gateway_id: &str,
@@ -94,6 +96,29 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
        Ok(())
    }

+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError> {
+        let mut guard = self.inner.write().await;
+
+        #[allow(clippy::unwrap_used)]
+        if let Some(target) = guard.gateways.get_mut(&gateway_id.to_string()) {
+            let GatewayDetails::Remote(details) = &mut target.details else {
+                return Ok(());
+            };
+            assert_eq!(Arc::strong_count(&details.shared_key), 1);
+
+            // eh. that's nasty, but it's only ever used for ephemeral clients so should be fine for now...
+            details.shared_key = Arc::new(SharedGatewayKey::Current(
+                SharedSymmetricKey::try_from_bytes(updated_key.as_bytes()).unwrap(),
+            ))
+        }
+
+        Ok(())
+    }
+
    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
        let mut guard = self.inner.write().await;
        if let Some(active) = guard.active_gateway.as_ref() {
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
-use nym_gateway_requests::registration::handshake::shared_key::SharedKeyConversionError;
+use nym_gateway_requests::shared_key::SharedKeyConversionError;
 use thiserror::Error;

 #[derive(Debug, Error)]
@@ -36,6 +36,9 @@ pub enum BadGateway {
        source: SharedKeyConversionError,
    },

+    #[error("could not find any valid shared keys for gateway {gateway_id}")]
+    MissingSharedKey { gateway_id: String },
+
    #[error(
        "the listening address of gateway {gateway_id} ({raw_listener}) is malformed: {source}"
    )]
@@ -5,6 +5,8 @@
 #![warn(clippy::unwrap_used)]

 use async_trait::async_trait;
+use nym_crypto::asymmetric::identity;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;

 pub mod backend;
@@ -18,7 +20,6 @@ pub use error::BadGateway;

 #[cfg(all(not(target_arch = "wasm32"), feature = "fs-gateways-storage"))]
 pub use backend::fs_backend::{error::StorageError, OnDiskGatewaysDetails};
-use nym_crypto::asymmetric::identity;

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -61,6 +62,12 @@ pub trait GatewaysDetailsStore {
        details: &GatewayRegistration,
    ) -> Result<(), Self::StorageError>;

+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: identity::PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError>;
+
    /// Remove given gateway details from the underlying store.
    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError>;
 }
@@ -4,9 +4,10 @@
 use crate::BadGateway;
 use cosmrs::AccountId;
 use nym_crypto::asymmetric::identity;
-use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
+use std::ops::Deref;
 use std::str::FromStr;
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -64,13 +65,13 @@ impl From<GatewayDetails> for GatewayRegistration {
 impl GatewayDetails {
    pub fn new_remote(
        gateway_id: identity::PublicKey,
-        derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+        shared_key: Arc<SharedGatewayKey>,
        gateway_owner_address: Option<AccountId>,
        gateway_listener: Url,
    ) -> Self {
        GatewayDetails::Remote(RemoteGatewayDetails {
            gateway_id,
-            derived_aes128_ctr_blake3_hmac_keys,
+            shared_key,
            gateway_owner_address,
            gateway_listener,
        })
@@ -87,9 +88,9 @@ impl GatewayDetails {
        }
    }

-    pub fn shared_key(&self) -> Option<&SharedKeys> {
+    pub fn shared_key(&self) -> Option<&SharedGatewayKey> {
        match self {
-            GatewayDetails::Remote(details) => Some(&details.derived_aes128_ctr_blake3_hmac_keys),
+            GatewayDetails::Remote(details) => Some(&details.shared_key),
            GatewayDetails::Custom(_) => None,
        }
    }
@@ -167,7 +168,8 @@ pub struct RegisteredGateway {
 #[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
 pub struct RawRemoteGatewayDetails {
    pub gateway_id_bs58: String,
-    pub derived_aes128_ctr_blake3_hmac_keys_bs58: String,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
+    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
    pub gateway_owner_address: Option<String>,
    pub gateway_listener: String,
 }
@@ -184,13 +186,35 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
                }
            })?;

-        let derived_aes128_ctr_blake3_hmac_keys = Arc::new(
-            SharedKeys::try_from_base58_string(&value.derived_aes128_ctr_blake3_hmac_keys_bs58)
-                .map_err(|source| BadGateway::MalformedSharedKeys {
-                    gateway_id: value.gateway_id_bs58.clone(),
-                    source,
-                })?,
-        );
+        let shared_key =
+            match (
+                &value.derived_aes256_gcm_siv_key,
+                &value.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            ) {
+                (None, None) => {
+                    return Err(BadGateway::MissingSharedKey {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                    })
+                }
+                (Some(aes256gcm_siv), _) => {
+                    let current_key =
+                        SharedSymmetricKey::try_from_bytes(aes256gcm_siv).map_err(|source| {
+                            BadGateway::MalformedSharedKeys {
+                                gateway_id: value.gateway_id_bs58.clone(),
+                                source,
+                            }
+                        })?;
+                    SharedGatewayKey::Current(current_key)
+                }
+                (None, Some(aes128ctr_hmac)) => {
+                    let legacy_key = LegacySharedKeys::try_from_base58_string(aes128ctr_hmac)
+                        .map_err(|source| BadGateway::MalformedSharedKeys {
+                            gateway_id: value.gateway_id_bs58.clone(),
+                            source,
+                        })?;
+                    SharedGatewayKey::Legacy(legacy_key)
+                }
+            };

        let gateway_owner_address = value
            .gateway_owner_address
@@ -216,7 +240,7 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {

        Ok(RemoteGatewayDetails {
            gateway_id,
-            derived_aes128_ctr_blake3_hmac_keys,
+            shared_key: Arc::new(shared_key),
            gateway_owner_address,
            gateway_listener,
        })
@@ -225,11 +249,16 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {

 impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
    fn from(value: &'a RemoteGatewayDetails) -> Self {
+        let (derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key) =
+            match value.shared_key.deref() {
+                SharedGatewayKey::Current(key) => (None, Some(key.to_bytes())),
+                SharedGatewayKey::Legacy(key) => (Some(key.to_base58_string()), None),
+            };
+
        RawRemoteGatewayDetails {
            gateway_id_bs58: value.gateway_id.to_base58_string(),
-            derived_aes128_ctr_blake3_hmac_keys_bs58: value
-                .derived_aes128_ctr_blake3_hmac_keys
-                .to_base58_string(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
            gateway_owner_address: value.gateway_owner_address.as_ref().map(|o| o.to_string()),
            gateway_listener: value.gateway_listener.to_string(),
        }
@@ -240,9 +269,7 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
 pub struct RemoteGatewayDetails {
    pub gateway_id: identity::PublicKey,

-    // note: `SharedKeys` implement ZeroizeOnDrop, meaning when `RemoteGatewayDetails` is dropped,
-    // the keys will be zeroized
-    pub derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+    pub shared_key: Arc<SharedGatewayKey>,

    pub gateway_owner_address: Option<AccountId>,

@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("sig_data").required(true)),
+    ))
+]
+pub struct CommonClientImportCoinIndexSignaturesArgs {
+    /// Id of client that is going to import the signatures
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the signatures.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data))]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data"))]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_coin_index_signatures<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportCoinIndexSignaturesArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.signatures_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.signatures_path.unwrap())?
+        }
+    };
+
+    nym_id::import_coin_index_signatures(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}
@@ -11,9 +11,14 @@ fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
 }

 #[cfg_attr(feature = "cli", derive(clap::Args))]
-#[cfg_attr(feature = "cli", clap(group(clap::ArgGroup::new("cred_data").required(true))))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("cred_data").required(true)),
+        group(clap::ArgGroup::new("type").required(true)),
+    ))
+]
 #[derive(Debug, Clone)]
-pub struct CommonClientImportCredentialArgs {
+pub struct CommonClientImportTicketBookArgs {
    /// Id of client that is going to import the credential
    #[cfg_attr(feature = "cli", clap(long))]
    pub id: String,
@@ -26,6 +31,15 @@ pub struct CommonClientImportCredentialArgs {
    #[cfg_attr(feature = "cli", clap(long, group = "cred_data"))]
    pub(crate) credential_path: Option<PathBuf>,

+    /// Specifies whether we're attempting to import a standalone ticketbook (i.e. serialised `IssuedTicketBook`)
+    #[cfg_attr(feature = "cli", clap(long, group = "type"))]
+    pub(crate) standalone: bool,
+
+    /// Specifies whether we're attempting to import full ticketboot
+    /// (i.e. one that **might** contain required global signatures; that is serialised `ImportableTicketBook`)
+    #[cfg_attr(feature = "cli", clap(long, group = "type"))]
+    pub(crate) full: bool,
+
    // currently hidden as there exists only a single serialization standard
    #[cfg_attr(feature = "cli", clap(long, hide = true))]
    pub(crate) version: Option<u8>,
@@ -33,7 +47,7 @@ pub struct CommonClientImportCredentialArgs {

 pub async fn import_credential<C, A>(args: A) -> Result<(), C::Error>
 where
-    A: Into<CommonClientImportCredentialArgs>,
+    A: Into<CommonClientImportTicketBookArgs>,
    C: CliClient,
    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
 {
@@ -54,6 +68,19 @@ where
        }
    };

-    nym_id::import_credential(credentials_store, raw_credential, common_args.version).await?;
+    if common_args.standalone {
+        nym_id::import_standalone_ticketbook(
+            credentials_store,
+            raw_credential,
+            common_args.version,
+        )
+        .await?;
+    } else {
+        // sanity check; clap should have ensured it
+        assert!(common_args.full);
+        nym_id::import_full_ticketbook(credentials_store, raw_credential, common_args.version)
+            .await?;
+    }
+
    Ok(())
 }
@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_signatures_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("sig_data").required(true)),
+    ))
+]
+pub struct CommonClientImportExpirationDateSignaturesArgs {
+    /// Id of client that is going to import the signatures
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the signatures.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded signatures data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data", value_parser = parse_encoded_signatures_data))]
+    pub(crate) signatures_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary signatures data
+    #[cfg_attr(feature = "cli", clap(long, group = "sig_data"))]
+    pub(crate) signatures_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_expiration_date_signatures<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportExpirationDateSignaturesArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.signatures_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.signatures_path.unwrap())?
+        }
+    };
+
+    nym_id::import_expiration_date_signatures(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}
@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_key_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli",
+    clap(
+        group(clap::ArgGroup::new("key_data_group").required(true)),
+    ))
+]
+pub struct CommonClientImportMasterVerificationKeyArgs {
+    /// Id of client that is going to import the key
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Config file of the client that is supposed to use the key.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded key data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "key_data_group", value_parser = parse_encoded_key_data))]
+    pub(crate) key_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary key data
+    #[cfg_attr(feature = "cli", clap(long, group = "key_data_group"))]
+    pub(crate) key_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_master_verification_key<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportMasterVerificationKeyArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let version = common_args.version;
+    let raw_key = match common_args.key_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.key_path.unwrap())?
+        }
+    };
+
+    nym_id::import_master_verification_key(credentials_store, raw_key, version).await?;
+
+    Ok(())
+}
@@ -2,7 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod client_add_gateway;
+pub mod client_import_coin_index_signatures;
 pub mod client_import_credential;
+pub mod client_import_expiration_date_signatures;
+pub mod client_import_master_verification_key;
 pub mod client_init;
 pub mod client_list_gateways;
 pub mod client_run;
@@ -354,12 +354,14 @@ where
        config: &Config,
        initialisation_result: InitialisationResult,
        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        shutdown: TaskClient,
    ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
    where
        <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
    {
        let managed_keys = initialisation_result.client_keys;
        let GatewayDetails::Remote(details) = initialisation_result.gateway_registration.details
@@ -387,23 +389,57 @@ where
                        ),
                    cfg,
                    managed_keys.identity_keypair(),
-                    Some(details.derived_aes128_ctr_blake3_hmac_keys),
+                    Some(details.shared_key),
                    packet_router,
                    bandwidth_controller,
                    shutdown,
                )
            };

-        gateway_client
-            .authenticate_and_start()
+        let gateway_failure = |err| {
+            log::error!("Could not authenticate and start up the gateway connection - {err}");
+            ClientCoreError::GatewayClientError {
+                gateway_id: details.gateway_id.to_base58_string(),
+                source: err,
+            }
+        };
+
+        // the gateway client startup procedure is slightly more complicated now
+        // we need to:
+        // - perform handshake (reg or auth)
+        // - check for key upgrade
+        // - maybe perform another upgrade handshake
+        // - check for bandwidth
+        // - start background tasks
+        let auth_res = gateway_client
+            .perform_initial_authentication()
            .await
-            .map_err(|err| {
-                log::error!("Could not authenticate and start up the gateway connection - {err}");
-                ClientCoreError::GatewayClientError {
-                    gateway_id: details.gateway_id.to_base58_string(),
-                    source: err,
-                }
-            })?;
+            .map_err(gateway_failure)?;
+
+        if auth_res.requires_key_upgrade {
+            // drop the shared_key arc because we don't need it and we can't hold it for the purposes of upgrade
+            drop(auth_res);
+
+            let updated_key = gateway_client
+                .upgrade_key_authenticated()
+                .await
+                .map_err(gateway_failure)?;
+
+            details_store
+                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
+                .await.map_err(|err| {
+                    error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                    ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+            })?
+        }
+
+        gateway_client
+            .claim_initial_bandwidth()
+            .await
+            .map_err(gateway_failure)?;
+        gateway_client
+            .start_listening_for_mixnet_messages()
+            .map_err(gateway_failure)?;

        Ok(gateway_client)
    }
@@ -413,12 +449,14 @@ where
        config: &Config,
        initialisation_result: InitialisationResult,
        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        mut shutdown: TaskClient,
    ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
    where
        <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
    {
        // if we have setup custom gateway sender and persisted details agree with it, return it
        if let Some(mut custom_gateway_transceiver) = custom_gateway_transceiver {
@@ -429,7 +467,7 @@ where
            {
                Err(ClientCoreError::CustomGatewaySelectionExpected)
            } else {
-                // and make sure to invalidate the task client so we wouldn't cause premature shutdown
+                // and make sure to invalidate the task client, so we wouldn't cause premature shutdown
                shutdown.disarm();
                custom_gateway_transceiver.set_packet_router(packet_router)?;
                Ok(custom_gateway_transceiver)
@@ -441,6 +479,7 @@ where
            config,
            initialisation_result,
            bandwidth_controller,
+            details_store,
            packet_router,
            shutdown,
        )
@@ -630,7 +669,8 @@ where
        )
        .await?;

-        let (reply_storage_backend, credential_store) = self.client_store.into_runtime_stores();
+        let (reply_storage_backend, credential_store, details_store) =
+            self.client_store.into_runtime_stores();

        // channels for inter-component communication
        // TODO: make the channels be internally created by the relevant components
@@ -705,6 +745,7 @@ where
            self.config,
            init_res,
            bandwidth_controller,
+            &details_store,
            gateway_packet_router,
            shutdown.fork("gateway_transceiver"),
        )
@@ -13,7 +13,7 @@ pub mod v1_1_33 {
    use nym_client_core_gateways_storage::{
        CustomGatewayDetails, GatewayDetails, GatewayRegistration, RemoteGatewayDetails,
    };
-    use nym_gateway_requests::registration::handshake::SharedKeys;
+    use nym_gateway_requests::shared_key::LegacySharedKeys;
    use serde::{Deserialize, Serialize};
    use sha2::{digest::Digest, Sha256};
    use std::ops::Deref;
@@ -58,7 +58,7 @@ pub mod v1_1_33 {
    }

    impl PersistedGatewayConfig {
-        fn verify(&self, shared_key: &SharedKeys) -> bool {
+        fn verify(&self, shared_key: &LegacySharedKeys) -> bool {
            let key_bytes = Zeroizing::new(shared_key.to_bytes());

            let mut key_hasher = Sha256::new();
@@ -74,7 +74,7 @@ pub mod v1_1_33 {
        gateway_id: String,
    }

-    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<SharedKeys, ClientCoreError> {
+    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<LegacySharedKeys, ClientCoreError> {
        // the shared key was a simple pem file
        Ok(nym_pemstore::load_key(path)?)
    }
@@ -83,7 +83,7 @@ pub mod v1_1_33 {
        gateway_id: String,
        gateway_owner: String,
        gateway_listener: String,
-        gateway_shared_key: SharedKeys,
+        gateway_shared_key: LegacySharedKeys,
    ) -> Result<GatewayDetails, ClientCoreError> {
        Ok(GatewayDetails::Remote(RemoteGatewayDetails {
            gateway_id: gateway_id
@@ -91,7 +91,7 @@ pub mod v1_1_33 {
                .map_err(|err| ClientCoreError::UpgradeFailure {
                    message: format!("the stored gateway id was malformed: {err}"),
                })?,
-            derived_aes128_ctr_blake3_hmac_keys: Arc::new(gateway_shared_key),
+            shared_key: Arc::new(gateway_shared_key.into()),
            gateway_owner_address: Some(gateway_owner.parse().map_err(|err| {
                ClientCoreError::UpgradeFailure {
                    message: format!("the stored gateway owner address was malformed: {err}"),
@@ -49,7 +49,13 @@ pub trait MixnetClientStorage {
    type CredentialStore: CredentialStorage;
    type GatewaysDetailsStore: GatewaysDetailsStore;

-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore);
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    );

    fn key_store(&self) -> &Self::KeyStore;
    fn reply_store(&self) -> &Self::ReplyStore;
@@ -77,8 +83,18 @@ impl MixnetClientStorage for Ephemeral {
    type CredentialStore = EphemeralCredentialStorage;
    type GatewaysDetailsStore = InMemGatewaysDetails;

-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore) {
-        (self.reply_store, self.credential_store)
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    ) {
+        (
+            self.reply_store,
+            self.credential_store,
+            self.gateway_details_store,
+        )
    }

    fn key_store(&self) -> &Self::KeyStore {
@@ -168,8 +184,18 @@ impl MixnetClientStorage for OnDiskPersistent {
    type CredentialStore = PersistentCredentialStorage;
    type GatewaysDetailsStore = OnDiskGatewaysDetails;

-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore) {
-        (self.reply_store, self.credential_store)
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    ) {
+        (
+            self.reply_store,
+            self.credential_store,
+            self.gateway_details_store,
+        )
    }

    fn key_store(&self) -> &Self::KeyStore {
--- a/Show More
+++ b/Show More