Update Cargo.toml

Add feat zeroize to cipher
2024-12-10 15:30:52 +01:00 · 2024-12-10 15:26:40 +01:00 · 2024-12-10 15:18:14 +01:00 · 2024-12-10 13:35:29 +00:00 · 2024-12-10 11:16:16 +01:00 · 2024-12-10 10:35:19 +01:00
2640 changed files with 171929 additions and 63303 deletions
@@ -0,0 +1,7 @@
+.git
+.github
+.gitignore
+**/node_modules
+**/target
+dist
+documentation
@@ -14,3 +14,20 @@ updates:
        prefix: build
        prefix-development: chore
        include: scope
+  # Update the root workspace (only). For now we don't include
+  # the contracts workspcae.
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      time: "09:00"
+    ignore:
+      - dependency-name: "cosmwasm-*"
+      - dependency-name: "cw*"
+    groups:
+      patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+    open-pull-requests-limit: 10
@@ -0,0 +1,39 @@
+name: build-deb-meta
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: arc-ubuntu-22.04
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Build Environment
+        run: sudo apt-get update && sudo apt-get install -y make dpkg-dev
+
+      - name: Build Debian Packages
+        working-directory: ppa/packages
+        run: make
+
+      - name: Find .deb files
+        working-directory: ppa/packages
+        run: |
+          echo "file1=$(ls nym-repo-setup*.deb)" >> $GITHUB_ENV
+          echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV
+
+      - name: Upload nym-repo-setup
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file1 }}
+          path: ppa/packages/nym-repo-setup*.deb
+          retention-days: 10
+
+      - name: Upload nym-vpn
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.file2 }}
+          path: ppa/packages/nym-vpn*.deb
+          retention-days: 10
@@ -5,21 +5,28 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install rsync
      - uses: rlespinasse/github-slug-action@v3.x
-      - uses: actions/setup-node@v3
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
        with:
-          node-version: 18
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -29,33 +36,13 @@ jobs:
        with:
          command: build
          args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh

-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
-
-      - name: Post process
-        run: cd documentation && ./post_process.sh
-        continue-on-error: false
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh

      - name: Create Vercel project file
        uses: mobiledevops/secret-to-file-action@v1
@@ -99,24 +86,3 @@ jobs:
        run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
        working-directory: dist/docs
        continue-on-error: false
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: cd-docs
-          NYM_PROJECT_NAME: "Docs CD"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CD_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -13,6 +13,7 @@ on:
      - 'mixnode/**'
      - 'sdk/rust/nym-sdk/**'
      - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'
  pull_request:
    paths:
      - 'clients/**'
@@ -22,6 +23,7 @@ on:
      - 'mixnode/**'
      - 'sdk/rust/nym-sdk/**'
      - 'service-providers/**'
+      - '.github/workflows/ci-binary-config-checker.yml'

 env:
  NETWORK: mainnet
@@ -31,11 +33,11 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [custom-linux]
+        platform: [arc-ubuntu-20.04]

    runs-on: ${{ matrix.platform }}
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install jq vim libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
@@ -1,21 +1,23 @@
 name: ci-build-ts

 on:
+  workflow_dispatch:
  pull_request:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
+      - ".github/workflows/ci-build-ts.yml"

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
    - name: Install rsync
      run: sudo apt-get install rsync
      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
      with:
        node-version: 18
    - name: Setup yarn
@@ -44,23 +46,3 @@ jobs:
        REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
        TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ts-${{ env.GITHUB_REF_SLUG }}-example
        EXCLUDE: "/dist/, /node_modules/"
-    - name: Matrix - Node Install
-      run: npm install
-      working-directory: .github/workflows/support-files
-    - name: Matrix - Send Notification
-      env:
-        NYM_NOTIFICATION_KIND: ts-packages
-        NYM_PROJECT_NAME: "ts-packages"
-        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-        GIT_BRANCH: "${GITHUB_REF##*/}"
-        IS_SUCCESS: "${{ job.status == 'success' }}"
-        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-      uses: docker://keybaseio/client:stable-node
-      with:
-        args: .github/workflows/support-files/notifications/entry_point.sh
@@ -8,11 +8,6 @@ on:
        required: true
        default: false
        type: boolean
-      enable_wireguard:
-        description: "Add --features wireguard"
-        required: true
-        default: false
-        type: boolean
      enable_deb:
        description: "True to enable cargo-deb installation and .deb package building"
        required: false
@@ -20,35 +15,19 @@ on:
        type: boolean
  schedule:
    - cron: "14 0 * * *"
-  pull_request:
-    paths:
-      - "clients/**"
-      - "common/**"
-      - "explorer-api/**"
-      - "gateway/**"
-      - "integrations/**"
-      - "mixnode/**"
-      - "nym-api/**"
-      - "nym-node/**"
-      - "nym-outfox/**"
-      - "nym-validator-rewarder/**"
-      - "sdk/rust/nym-sdk/**"
-      - "service-providers/**"
-      - "tools/**"
-      - "nymvisor/**"

 jobs:
  publish-nym:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-20.04]
+        platform: [ arc-ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
      CARGO_TERM_COLOR: always
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -60,20 +39,13 @@ jobs:
          echo $OUTPUT_DIR

      - name: Install Dependencies (Linux)
-        run: sudo apt update && sudo apt install libudev-dev
+        run: sudo apt-get update && sudo apt-get -y install libudev-dev

      - name: Sets env vars for tokio if set in manual dispatch inputs
        run: |
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-        if: >
-          github.event_name == 'schedule' ||
-          (github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true)
-
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -99,7 +71,7 @@ jobs:

      - name: Upload Artifact
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: nym-binaries-artifacts
          path: |
@@ -107,6 +79,7 @@ jobs:
            target/release/nym-socks5-client
            target/release/nym-api
            target/release/nym-network-requester
+            target/release/nym-data-observatory
            target/release/nym-cli
            target/release/nymvisor
            target/release/nym-node
@@ -124,6 +97,7 @@ jobs:
          cp target/release/nym-socks5-client $OUTPUT_DIR
          cp target/release/nym-api $OUTPUT_DIR
          cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nym-data-observatory $OUTPUT_DIR
          cp target/release/nymvisor $OUTPUT_DIR
          cp target/release/nym-node $OUTPUT_DIR
          cp target/release/nym-cli $OUTPUT_DIR
@@ -0,0 +1,41 @@
+name: ci-build-vpn-api-wasm
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workflows/ci-build-vpn-api-wasm.yml'
+
+jobs:
+  wasm:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
+
+      - name: Install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+
+      - name: "Build"
+        run: make
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm
@@ -1,23 +1,6 @@
 name: ci-build

 on:
-  push:
-    paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
-      - 'Cargo.toml'
  pull_request:
    paths:
      - 'clients/**'
@@ -26,15 +9,20 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'mixnode/**'
-      - 'sdk/lib/socks5-listener/**'
-      - 'sdk/rust/nym-sdk/**'
+      - 'sdk/rust/**'
+      - 'sdk/lib/**'
      - 'service-providers/**'
+      - 'nym-network-monitor/**'
      - 'nym-api/**'
+      - 'nym-node/**'
      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/nym-nr-query/**'
-      - 'tools/ts-rs-cli/**'
+      - 'nym-data-observatory/**'
+      - 'nym-validator-rewarder/**'
+      - 'tools/**'
+      - 'wasm/**'
      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-build.yml'
  workflow_dispatch:

 jobs:
@@ -42,18 +30,19 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [custom-linux, custom-runner-mac-m1]
+        os: [ arc-ubuntu-20.04, custom-runner-mac-m1 ]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
+      IPINFO_API_TOKEN: ${{ secrets.IPINFO_API_TOKEN }}
    steps:
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
        continue-on-error: true
-        if: matrix.os == 'custom-linux'
+        if: contains(matrix.os, 'ubuntu')

      - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
@@ -69,44 +58,34 @@ jobs:
          command: fmt
          args: --all -- --check

-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          # Enable wireguard by default on linux only
-          args: --workspace --features wireguard
-
-      - name: Build all examples
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --examples --features wireguard
-
-      - name: Run all tests
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features wireguard
-
-      - name: Run expensive tests
-        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && matrix.os == 'custom-linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --features wireguard -- --ignored
-
-      - name: Annotate with clippy checks
-        if: matrix.os == 'custom-linux'
-        uses: actions-rs/clippy-check@v1
-        continue-on-error: true
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace --features wireguard
-
      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace --all-targets --features wireguard -- -D warnings
+          args: --workspace --all-targets -- -D warnings
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+
+      - name: Build all examples
+        if: contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --examples
+
+      - name: Run all tests
+        if: contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace
+
+      - name: Run expensive tests
+        if: (github.ref == 'refs/heads/develop' || github.event.pull_request.base.ref == 'develop' || github.event.pull_request.base.ref == 'master') && contains(matrix.os, 'ubuntu')
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: --workspace -- --ignored
@@ -2,10 +2,14 @@ name: ci-cargo-deny
 on:
  workflow_dispatch:
  pull_request:
+    paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/ci-cargo-deny.yml'

 jobs:
  cargo-deny:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        checks:
@@ -13,9 +17,9 @@ jobs:
          - licenses bans sources

    steps:
-    - uses: actions/checkout@v3
-    - uses: EmbarkStudios/cargo-deny-action@v1
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v2
      with:
        log-level: warn
        command: check ${{ matrix.checks }}
-        argument: --all-features
+        arguments: --all-features
@@ -2,9 +2,5 @@
  {
    "rust":"stable",
    "runOnEvent":"always"
-  },
-  {
-    "rust":"beta",
-    "runOnEvent":"pull_request"
  }
 ]
@@ -6,16 +6,17 @@ on:
    paths:
      - 'contracts/**'
      - 'common/**'
+      - '.github/workflows/ci-contracts-schema.yml'

 jobs:
  check-schema:
    name: Generate and check schema
-    runs-on: custom-linux
+    runs-on: ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
@@ -2,10 +2,6 @@ name: ci-contracts-upload-binaries

 on:
  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'common/**'
-      - 'contracts/**'

 env:
  NETWORK: mainnet
@@ -15,13 +11,13 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-20.04]
+        platform: [ arc-ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
      CARGO_TERM_COLOR: always
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -58,6 +54,7 @@ jobs:
          cp contracts/target/wasm32-unknown-unknown/release/nym_coconut_dkg.wasm $OUTPUT_DIR
          cp contracts/target/wasm32-unknown-unknown/release/cw3_flex_multisig.wasm $OUTPUT_DIR
          cp contracts/target/wasm32-unknown-unknown/release/cw4_group.wasm $OUTPUT_DIR
+          cp contracts/target/wasm32-unknown-unknown/release/nym_ecash.wasm $OUTPUT_DIR

      - name: Deploy branch to CI www
        continue-on-error: true
@@ -9,6 +9,7 @@ on:
    paths:
      - 'contracts/**'
      - 'common/**'
+      - '.github/workflows/ci-contracts.yml'

 jobs:
  matrix_prep:
@@ -17,7 +18,7 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      # creates the matrix strategy from ci-contracts-matrix-includes.json
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
      - id: set-matrix
        uses: JoshuaTheMiller/conditional-build-matrix@main
        with:
@@ -34,7 +35,7 @@ jobs:
      fail-fast: false
      matrix: ${{fromJson(needs.matrix_prep.outputs.matrix)}}
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

      - name: Setup rust
        uses: actions-rs/toolchain@v1
@@ -3,27 +3,35 @@ name: ci-docs
 on:
  workflow_dispatch:
  push:
-    branches-ignore: master
+    branches-ignore: [master]
    paths:
-      - 'documentation/docs/**'
+      - "documentation/docs/**"
+      - ".github/workflows/ci-docs.yml"

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install rsync
      - uses: rlespinasse/github-slug-action@v3.x
-      - uses: actions/setup-node@v3
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
        with:
-          node-version: 18
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -33,30 +41,13 @@ jobs:
        with:
          command: build
          args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false

-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh
-
-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh

      - name: Deploy branch to CI www
        continue-on-error: true
@@ -67,26 +58,5 @@ jobs:
          SOURCE: "dist/docs/"
          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-nextra-${{ env.GITHUB_REF_SLUG }}
          EXCLUDE: "/node_modules/"
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ci-docs
-          NYM_PROJECT_NAME: "Docs CI"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,6 +1,7 @@
 name: ci-lint-typescript

 on:
+  workflow_dispatch:
  pull_request:
    paths:
      - "ts-packages/**"
@@ -10,15 +11,16 @@ on:
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
      - "explorer/**"
+      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
      - uses: rlespinasse/github-slug-action@v3.x

-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - name: Setup yarn
@@ -38,7 +40,7 @@ jobs:
          version: '116'

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
        with:
          go-version: '1.20'

@@ -52,24 +54,3 @@ jobs:
        run: yarn lint
      - name: Typecheck with tsc
        run: yarn tsc
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "ts-packages"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -1,39 +0,0 @@
-name: ci-nym-api-tests
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - "nym-api/**"
-
-defaults:
-  run:
-    working-directory: nym-api/tests
-
-jobs:
-  test:
-    name: nym-api tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: install yarn in root
-        run: cd ../.. && yarn install
-
-      - name: Install npm
-        run: npm install
-
-      - name: Node v18
-        uses: actions/setup-node@v3
-        with:
-          node-version: 18.1.0
-
-      - name: Install yarn
-        run: yarn install
-
-      - name: Run yarn
-        run: yarn
-
-      - name: Run tests
-        run: yarn test:sandbox
-        working-directory: nym-api/tests
@@ -5,6 +5,7 @@ on:
  push:
    paths:
      - 'explorer/**'
+      - '.github/workflows/ci-nym-network-explorer.yml'

 defaults:
  run:
@@ -14,12 +15,12 @@ jobs:
  build:
    runs-on: custom-linux
    steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
    - name: Install rsync
      run: sudo apt-get install rsync
      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
      with:
        node-version: 18
    - name: Setup yarn
@@ -1,22 +1,17 @@
 name: ci-nym-wallet-rust

 on:
-  push:
-    paths:
-      - 'nym-wallet/**'
-      - 'common/**'
-      - 'contracts/vesting/**'
-      - 'nym-api/nym-api-requests/**'
  pull_request:
    paths:
      - 'nym-wallet/**'
      - 'common/**'
      - 'contracts/vesting/**'
      - 'nym-api/nym-api-requests/**'
+      - '.github/workflows/ci-nym-wallet-rust.yml'

 jobs:
  build:
-    runs-on: [ self-hosted, custom-linux ]
+    runs-on: arc-ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
@@ -25,7 +20,7 @@ jobs:
        continue-on-error: true

      - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
@@ -4,12 +4,13 @@ on:
  pull_request:
    paths:
      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-storybook.yml'

 jobs:
  build:
    runs-on: custom-linux
    steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4

    - name: Install rsync
      run: sudo apt-get install rsync
@@ -17,7 +18,7 @@ jobs:

    - uses: rlespinasse/github-slug-action@v3.x

-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
      with:
        node-version: 18

@@ -1,78 +0,0 @@
-name: ci-sdk-docs-typescript
-
-on:
-  pull_request:
-    paths:
-      - "sdk/typescript/**"
-      - "wasm/**"
-
-jobs:
-  build:
-    runs-on: custom-linux
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-      - uses: rlespinasse/github-slug-action@v3.x
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18.17
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.20'
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Install wasm-opt
-        uses: ./.github/actions/install-wasm-opt
-        with:
-          version: '116'
-
-      - name: Build branch WASM packages
-        run: make sdk-wasm-build
-
-      - name: Install
-        run: yarn
-      - name: Build
-        run: yarn docs:prod:build
-      - name: Deploy branch to CI www (docs)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "dist/ts/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "sdk-ts-docs"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}/docs/sdk/typescript"
-          NYM_CI_WWW_LOCATION: "sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -6,16 +6,17 @@ on:
      - 'wasm/**'
      - 'clients/client-core/**'
      - 'common/**'
+      - '.github/workflows/ci-sdk-wasm.yml'

 jobs:
  wasm:
-    runs-on: [custom-linux]
+    runs-on: arc-ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
        with:
          node-version: 18

@@ -28,7 +29,7 @@ jobs:
          components: rustfmt, clippy

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
        with:
          go-version: '1.20'

@@ -30,14 +30,14 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: Setup Pages
-        uses: actions/configure-pages@v3
+        uses: actions/configure-pages@v5
      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v2
+        uses: actions/upload-pages-artifact@v3
        with:
          # Upload entire repository
          path: './ppa'
      - name: Deploy to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@v4
@@ -0,0 +1,11 @@
+name: Hello world
+
+on:
+  workflow_dispatch:
+
+jobs:
+  my-job:
+    runs-on: arc-ubuntu-22.04
+    steps:
+      - name: my-step
+        run: echo "Hello World!"
@@ -18,7 +18,7 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
@@ -33,7 +33,7 @@ jobs:
          components: rustfmt, clippy

      - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
        if: matrix.os == 'macos-latest' || matrix.os == 'windows-latest'
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -98,11 +98,11 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Collect jobs status
-        uses: technote-space/workflow-conclusion-action@v2
+        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: install npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
        with:
          node-version: 18
@@ -15,7 +15,7 @@ jobs:
      output1: ${{ steps.step2.outputs.latest_release }}
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set output variable to latest release branch
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -47,7 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -18,7 +18,7 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
@@ -61,11 +61,11 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Collect jobs status
-        uses: technote-space/workflow-conclusion-action@v2
+        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: install npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
        with:
          node-version: 18
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
@@ -20,7 +20,7 @@ jobs:
          find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
            advisories -A advisory-not-detected  --hide-inclusion-graph \; &> \
            >(uniq  &> .github/workflows/support-files/notifications/deny.message )
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
        with:
          name: report
          path: .github/workflows/support-files/notifications/deny.message
@@ -29,14 +29,14 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
      - name: Download report from previous job
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
        with:
          name: report
          path: .github/workflows/support-files/notifications
      - name: install npm
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 18
      - name: Matrix - Node Install
@@ -4,7 +4,9 @@ on:
  pull_request:
    branches:
      - develop
-      - 'release/**'
+      - "release/**"
+    paths-ignore:
+      - "documentation/**"
    types:
      - labeled
      - unlabeled
@@ -40,7 +40,7 @@ jobs:
      cli_version: ${{ steps.binary-versions.outputs.cli_version }}

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install ripgrep libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
@@ -55,15 +55,16 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
+          override: true

      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --release
-
+          args: --workspace --release ${{ env.CARGO_FEATURES }}
+  
      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: my-artifact
          path: |
@@ -79,7 +80,7 @@ jobs:

      - id: create-release
        name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        if: github.event_name == 'release'
        with:
          files: |
@@ -9,38 +9,39 @@ jobs:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-contracts-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    runs-on: [self-hosted, custom-ubuntu-20.04]
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+          toolchain: 1.77
          target: wasm32-unknown-unknown
          override: true
-          components: rustfmt, clippy

      - name: Install wasm-opt
-        run: cargo install --version 0.114.0 wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '114'

      - name: Build release contracts
        run: make contracts

      - name: Upload Mixnet Contract Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: mixnet_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
          retention-days: 5

      - name: Upload Vesting Contract Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: vesting_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
          retention-days: 5

      - name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        if: github.event_name == 'release'
        with:
          files: |
@@ -25,10 +25,10 @@ jobs:
      file_hash: ${{ steps.release-info.outputs.file_hash }}

    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

      - name: Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 18
      - name: Install Rust stable
@@ -83,7 +83,7 @@ jobs:
        run: yarn && yarn build

      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet.app.tar.gz
          path: nym-wallet/target/release/bundle/macos/nym-wallet.app.tar.gz
@@ -95,7 +95,7 @@ jobs:
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
      - id: create-release
        name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        if: github.event_name == 'release'
        with:
          files: |
@@ -25,7 +25,7 @@ jobs:
      file_hash: ${{ steps.release-info.outputs.file_hash }}

    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

      - name: Tauri dependencies
        run: >
@@ -34,7 +34,7 @@ jobs:
        continue-on-error: true

      - name: Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 18

@@ -62,7 +62,7 @@ jobs:
          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet_1.0.0_amd64.AppImage.tar.gz
          path: nym-wallet/target/release/bundle/appimage/nym-wallet*.AppImage.tar.gz
@@ -70,7 +70,7 @@ jobs:

      - id: create-release
        name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        if: github.event_name == 'release'
        with:
          files: |
@@ -1,4 +1,4 @@
-name: publish-nym-wallet-win10
+name: publish-nym-wallet-win11
 on:
  workflow_dispatch:
  release:
@@ -14,7 +14,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [windows10]
+        platform: [custom-windows-11]
    runs-on: ${{ matrix.platform }}

    outputs:
@@ -33,7 +33,7 @@ jobs:
          del /s /q /A:H nym
          rmdir /s /q nym

-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Import signing certificate
        env:
@@ -47,7 +47,7 @@ jobs:
          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)

      - name: Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 18

@@ -62,6 +62,9 @@ jobs:
          fileName: '.env'
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

+      - name: Install Yarn
+        run: npm install -g yarn
+
      - name: Install project dependencies
        shell: bash
        run: cd .. && yarn --network-timeout 100000
@@ -82,7 +85,7 @@ jobs:
        run: yarn build

      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet_1.0.0_x64_en-US.msi
          path: nym-wallet/target/release/bundle/msi/nym-wallet_1.*.msi
@@ -90,7 +93,7 @@ jobs:

      - id: create-release
        name: Upload to release based on tag name
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        if: github.event_name == 'release'
        with:
          files: |
@@ -22,10 +22,10 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: Install Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "17"
@@ -49,7 +49,7 @@ jobs:
            "build-tools;$SDK_BUILDTOOLS_VERSION"

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@1.70.0
+        uses: dtolnay/rust-toolchain@1.90.0

      - name: Install rust android targets
        run: |
@@ -84,7 +84,7 @@ jobs:
            apk/nyms5-arch64-release.apk

      - name: Upload APKs
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: nyms5-apk-arch64
          path: |
@@ -97,14 +97,14 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
      - name: Download binary artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
        with:
          name: nyms5-apk-arch64
          path: apk
      - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
        with:
          files: |
            apk/nyms5-arch64-debug.apk
@@ -4,12 +4,12 @@ on:

 jobs:
  publish:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4

      - name: Install Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 18
          registry-url: "https://registry.npmjs.org"
@@ -29,12 +29,12 @@ jobs:
        run: cargo install wasm-opt

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
        with:
          go-version: "1.20"

      - name: Install TinyGo
-        uses: acifani/setup-tinygo@v1
+        uses: acifani/setup-tinygo@v2
        with:
          tinygo-version: "0.27.0"

@@ -0,0 +1,55 @@
+name: Build and upload Credential Proxy container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-credential-proxy"
+  CONTAINER_NAME: "credential-proxy"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Data observatory container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-data-observatory"
+  CONTAINER_NAME: "data-observatory"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,51 @@
+name: Build and upload Network monitor container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "."
+  CONTAINER_NAME: "network-monitor"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
+          
+      - name: Remove existing tag if exists
+        run: |
+          echo "Checking if tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} exists..."
+          if git rev-parse ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} already exists"
+            git push --delete origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+          
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,61 @@
+name: Build and upload Node Status agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      gateway_probe_git_ref:
+        type: string
+        description: Which gateway probe git ref to build the image with
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-agent"
+  CONTAINER_NAME: "node-status-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Node Status API container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-api"
+  CONTAINER_NAME: "node-status-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload nym node container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node"
+  CONTAINER_NAME: "nym-node"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,55 @@
+name: Build and upload Nyx Chain Watcher container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nyx-chain-watcher"
+  CONTAINER_NAME: "nyx-chain-watcher"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -0,0 +1,49 @@
+name: Build and upload Validator Rewarder container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-validator-rewarder"
+  CONTAINER_NAME: "validator-rewarder"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -20,8 +20,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+        uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
@@ -30,7 +30,7 @@ jobs:
        with:
          release-tag-or-name-or-id: ${{ inputs.release_tag }}

-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v4
        with:
          name: Asset Hashes
          path: hashes.json
@@ -48,4 +48,7 @@ foxyfox.env

 .next
 ppa-private-key.b64
-ppa-private-key.asc
+ppa-private-key.asc
+nym-network-monitor/topology.json
+nym-network-monitor/__pycache__
+nym-network-monitor/*.key
@@ -4,6 +4,450 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2024.13-magura-drift] (2024-11-29)
+
+- Optimised syncing bandwidth information to storage
+
+## [2024.13-magura-patched] (2024-11-22)
+
+- [experimental] allow clients to change between deterministic route selection based on packet headers and a pseudorandom distribution
+- Introduced a configurable limit on retransmission frequency of packets if ACKs are not received
+- Filtered out invalid IP addresses on nym-api
+
+## [2024.13-magura] (2024-11-18)
+
+- Limit race probability ([#5145])
+- bugifx: assign 'node_id' when converting from 'GatewayDetails' to 'TestNode' ([#5143])
+- bugfix: make sure to assign correct node_id and identity during 'gateway_details' table migration ([#5142])
+- Respond to auth messages with same version ([#5140])
+- Pain/polyfill deprecated endpoints ([#5131])
+- change: dont select mixnodes bonded with vested tokens into the rewarded set ([#5129])
+- nym-credential-proxy-requests: reqwest use rustls-tls ([#5116])
+- bugfix: preserve as much as possible of the rewarded set during migration ([#5103])
+- Feature/force refresh node ([#5101])
+- Add NYM_VPN_API to env files ([#5099])
+- bugfix: fixed historical uptimes for nodes ([#5097])
+- Remove old use of 1GB constant ([#5096])
+- Graceful agent 1.1.5 ([#5093])
+- Add more translations from v2 to v3 authenticator ([#5091])
+- Nym node - Fix claim delegator rewards ([#5090])
+- Make 250 GB/30 days for free ride mode ([#5083])
+- Don't increase bandwidth two times ([#5081])
+- Fix expiration date as today + 7 days ([#5076])
+- Fix gateway decreasing bandwidth ([#5075])
+- Allow custom http port to be reset ([#5073])
+- bugfix: additional checks inside credential proxy ([#5072])
+- chore: deprecated old nym-api client methods and replaced them when possible ([#5069])
+- NS API with directory v2 (#5058) ([#5068])
+- bugfix: credential-proxy obtain-async ([#5067])
+- Allow nym node config updates ([#5066])
+- bugfix: use corrext axum extractors for ecash route arguments ([#5065])
+- Merge2/release/2024.13 magura ([#5063])
+- bugfix/feature: added NymApiClient method to get all skimmed nodes ([#5062])
+- Merge1/release/2024.13 magura ([#5061])
+- added hacky routes to return nymnodes alongside legacy nodes ([#5051])
+- bugfix: mark migrated gateways as rewarded in the previous epoch in case theyre in the rewarded set ([#5049])
+- bugfix: adjust runtime storage migration ([#5047])
+- bugfix: supersede 'cb13be27f8f61d9ae74d924e85d2e6787895eb14' by using… ([#5046])
+- bugfix: restore default http port for nym-api ([#5045])
+- bugfix: fix ecash handlers routes ([#5043])
+- bugfix: don't assign exit gateways to standby set ([#5041])
+- bugfix: make sure nym-nodes are also tested by network monitor ([#5040])
+- bugfix: use bonded nym-nodes for determining initial network monitor … ([#5039])
+- bugfix: make gateways insert themselves into [local] topology ([#5038])
+- Pass poisson flag  ([#5037])
+- bugfix: use human readable roles for annotations ([#5036])
+- bugfix: use old name for 'epoch_role' in SkimmedNode ([#5034])
+- bugfix: make sure to use correct highest node id when assigning role ([#5032])
+- feature: use axum_client_ip for attempting to extract source ip ([#5031])
+- bugfix: fixed backwards incompatibility for /gateways/described endpoint ([#5030])
+- bugfix: verifying signed information of legacy nodes ([#5029])
+- bugfix: introduce 'LegacyPendingMixNodeChanges' that does not contain 'cost_params_change' ([#5028])
+- bugfix: missing #[serde(default)] for announce port ([#5024])
+- bugfix: directory v2.1 `get_all_avg_gateway_reliability_in_interval` query ([#5023])
+- added 'get_all_described_nodes' to NymApiClient and adjusted return t… ([#5016])
+- Reapply fixes to new branch ([#5014])
+- Consume only positive bandwidth ([#5013])
+- feature: adjusted ticket sizes to the agreed amounts ([#5009])
+- Push private ip before inserting ([#5008])
+- chore: update itertools in compact ecash ([#4994])
+- feature: make accepting t&c a hard requirement for rewarded set selection ([#4993])
+- Fix rustfmt in nym-credential-proxy ([#4992])
+- bugfix: client memory leak ([#4991])
+- Eliminate 0 bandwidth race check ([#4988])
+- [DOCs;/operators]: Release notes for v2024.12 aero ([#4984])
+- Add topup req constructor ([#4983])
+- Fix critical issues SI86 and SI87 from Cure53 ([#4982])
+- Rename nym-vpn-api to nym-credential-proxy ([#4981])
+- enable global ecash routes even if api is not a signer ([#4980])
+- resolve beta clippy issues in contracts ([#4978])
+- Re-enable vested delegation migration ([#4977])
+- feature: require reporting using nym-node binary for rewarded set selection ([#4976])
+- Top up bandwidth ([#4975])
+- [Product Data] Add session type based on ecash ticket received ([#4974])
+- Bugfix/additional directory fixes ([#4973])
+- feat: add Dockerfile for nym node ([#4972])
+- chore: remove unused rocket code ([#4968])
+- Import nym-vpn-api crates ([#4967])
+- feature: importer-cli to correctly handle mixnet/vesting import ([#4966])
+- bugfix: fix expected return type on /v1/gateways endpoint ([#4965])
+- [Product Data] First step in gateway usage data collection ([#4963])
+- Bump sqlx to 0.7.4 ([#4959])
+- Add env feature to clap and make clap parameters available as env variables ([#4957])
+- Feature/contract state tools ([#4954])
+- expose authenticator address along other address in node-details ([#4953])
+- Extract packet processing from mixnode-common ([#4949])
+- nym-api container ([#4948])
+- Ticket type storage ([#4947])
+- Add "utoipa" feature to nym-node ([#4945])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4944])
+- V2 performance monitoring feature flag ([#4943])
+- Bugfix/rewarder post pruning adjustments ([#4942])
+- Switch over the last set of jobs to arc runners ([#4938])
+- Fix broken build after merge ([#4937])
+- bugfix: correctly paginate through 'search_tx' endpoint ([#4936])
+- Add more conversions for responses of authenticator messages ([#4929])
+- Directory Sevices v2.1 ([#4903])
+- Migrate Legacy Node (Frontend)  ([#4826])
+- Fix critical issues SI84 and SI85 from Cure53 ([#4758])
+
+[#5145]: https://github.com/nymtech/nym/pull/5145
+[#5143]: https://github.com/nymtech/nym/pull/5143
+[#5142]: https://github.com/nymtech/nym/pull/5142
+[#5140]: https://github.com/nymtech/nym/pull/5140
+[#5131]: https://github.com/nymtech/nym/pull/5131
+[#5129]: https://github.com/nymtech/nym/pull/5129
+[#5116]: https://github.com/nymtech/nym/pull/5116
+[#5103]: https://github.com/nymtech/nym/pull/5103
+[#5101]: https://github.com/nymtech/nym/pull/5101
+[#5099]: https://github.com/nymtech/nym/pull/5099
+[#5097]: https://github.com/nymtech/nym/pull/5097
+[#5096]: https://github.com/nymtech/nym/pull/5096
+[#5093]: https://github.com/nymtech/nym/pull/5093
+[#5091]: https://github.com/nymtech/nym/pull/5091
+[#5090]: https://github.com/nymtech/nym/pull/5090
+[#5083]: https://github.com/nymtech/nym/pull/5083
+[#5081]: https://github.com/nymtech/nym/pull/5081
+[#5076]: https://github.com/nymtech/nym/pull/5076
+[#5075]: https://github.com/nymtech/nym/pull/5075
+[#5073]: https://github.com/nymtech/nym/pull/5073
+[#5072]: https://github.com/nymtech/nym/pull/5072
+[#5069]: https://github.com/nymtech/nym/pull/5069
+[#5068]: https://github.com/nymtech/nym/pull/5068
+[#5067]: https://github.com/nymtech/nym/pull/5067
+[#5066]: https://github.com/nymtech/nym/pull/5066
+[#5065]: https://github.com/nymtech/nym/pull/5065
+[#5063]: https://github.com/nymtech/nym/pull/5063
+[#5062]: https://github.com/nymtech/nym/pull/5062
+[#5061]: https://github.com/nymtech/nym/pull/5061
+[#5051]: https://github.com/nymtech/nym/pull/5051
+[#5049]: https://github.com/nymtech/nym/pull/5049
+[#5047]: https://github.com/nymtech/nym/pull/5047
+[#5046]: https://github.com/nymtech/nym/pull/5046
+[#5045]: https://github.com/nymtech/nym/pull/5045
+[#5043]: https://github.com/nymtech/nym/pull/5043
+[#5041]: https://github.com/nymtech/nym/pull/5041
+[#5040]: https://github.com/nymtech/nym/pull/5040
+[#5039]: https://github.com/nymtech/nym/pull/5039
+[#5038]: https://github.com/nymtech/nym/pull/5038
+[#5037]: https://github.com/nymtech/nym/pull/5037
+[#5036]: https://github.com/nymtech/nym/pull/5036
+[#5034]: https://github.com/nymtech/nym/pull/5034
+[#5032]: https://github.com/nymtech/nym/pull/5032
+[#5031]: https://github.com/nymtech/nym/pull/5031
+[#5030]: https://github.com/nymtech/nym/pull/5030
+[#5029]: https://github.com/nymtech/nym/pull/5029
+[#5028]: https://github.com/nymtech/nym/pull/5028
+[#5024]: https://github.com/nymtech/nym/pull/5024
+[#5023]: https://github.com/nymtech/nym/pull/5023
+[#5016]: https://github.com/nymtech/nym/pull/5016
+[#5014]: https://github.com/nymtech/nym/pull/5014
+[#5013]: https://github.com/nymtech/nym/pull/5013
+[#5009]: https://github.com/nymtech/nym/pull/5009
+[#5008]: https://github.com/nymtech/nym/pull/5008
+[#4994]: https://github.com/nymtech/nym/pull/4994
+[#4993]: https://github.com/nymtech/nym/pull/4993
+[#4992]: https://github.com/nymtech/nym/pull/4992
+[#4991]: https://github.com/nymtech/nym/pull/4991
+[#4988]: https://github.com/nymtech/nym/pull/4988
+[#4984]: https://github.com/nymtech/nym/pull/4984
+[#4983]: https://github.com/nymtech/nym/pull/4983
+[#4982]: https://github.com/nymtech/nym/pull/4982
+[#4981]: https://github.com/nymtech/nym/pull/4981
+[#4980]: https://github.com/nymtech/nym/pull/4980
+[#4978]: https://github.com/nymtech/nym/pull/4978
+[#4977]: https://github.com/nymtech/nym/pull/4977
+[#4976]: https://github.com/nymtech/nym/pull/4976
+[#4975]: https://github.com/nymtech/nym/pull/4975
+[#4974]: https://github.com/nymtech/nym/pull/4974
+[#4973]: https://github.com/nymtech/nym/pull/4973
+[#4972]: https://github.com/nymtech/nym/pull/4972
+[#4968]: https://github.com/nymtech/nym/pull/4968
+[#4967]: https://github.com/nymtech/nym/pull/4967
+[#4966]: https://github.com/nymtech/nym/pull/4966
+[#4965]: https://github.com/nymtech/nym/pull/4965
+[#4963]: https://github.com/nymtech/nym/pull/4963
+[#4959]: https://github.com/nymtech/nym/pull/4959
+[#4957]: https://github.com/nymtech/nym/pull/4957
+[#4954]: https://github.com/nymtech/nym/pull/4954
+[#4953]: https://github.com/nymtech/nym/pull/4953
+[#4949]: https://github.com/nymtech/nym/pull/4949
+[#4948]: https://github.com/nymtech/nym/pull/4948
+[#4947]: https://github.com/nymtech/nym/pull/4947
+[#4945]: https://github.com/nymtech/nym/pull/4945
+[#4944]: https://github.com/nymtech/nym/pull/4944
+[#4943]: https://github.com/nymtech/nym/pull/4943
+[#4942]: https://github.com/nymtech/nym/pull/4942
+[#4938]: https://github.com/nymtech/nym/pull/4938
+[#4937]: https://github.com/nymtech/nym/pull/4937
+[#4936]: https://github.com/nymtech/nym/pull/4936
+[#4929]: https://github.com/nymtech/nym/pull/4929
+[#4903]: https://github.com/nymtech/nym/pull/4903
+[#4826]: https://github.com/nymtech/nym/pull/4826
+[#4758]: https://github.com/nymtech/nym/pull/4758
+
+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
+## [2024.11-wedel] (2024-09-23)
+
+- Backport #4894 to fix ci ([#4899])
+- Bugfix/ticketbook false double spending ([#4892])
+- fix: allow updating globally stored signatures ([#4891])
+- [DOCs/operators]: Document changelog for patch/2024.10-caramello ([#4886])
+- [DOCs/operators]: Post release docs updates ([#4874])
+- Bump defguard to github latest version ([#4872])
+- chore: removed completed queued mixnet migration ([#4865])
+- Disable push trigger and add missing paths in ci-build ([#4864])
+- Fix linux conditional in ci-build.yml ([#4863])
+- Remove golang workaround in ci-sdk-wasm ([#4858])
+- Revert runner for ci-docs ([#4855])
+- Move credential verification into common crate ([#4853])
+- Fix test failure in ipr request size ([#4844])
+- Start switching over jobs to arc-ubuntu-20.04 ([#4843])
+- Use ecash credential type for bandwidth value ([#4840])
+- Create nym-repo-setup debian package and nym-vpn meta package ([#4837])
+- Remove serde_crate named import ([#4832])
+- Run cargo autoinherit following last weeks dependabot updates ([#4831])
+- revamped ticketbook serialisation and exposed additional cli methods ([#4827])
+- Expose wireguard details on self described endpoint ([#4825])
+- Remove unused wireguard flag from SDK ([#4823])
+- Add `axum` server to `nym-api` ([#4803])
+- Run cargo-autoinherit for a few new crates ([#4801])
+- Update dependabot ([#4796])
+- Fix clippy for unwrap_or_default ([#4783])
+- Enable dependabot version upgrades for root rust workspace ([#4778])
+- Persist used wireguard private IPs ([#4771])
+- Avoid race on ip and registration structures ([#4766])
+- docs/hotfix ([#4765])
+- chore: remove repetitive words ([#4763])
+- Make gateway latency check generic ([#4759])
+- Remove duplicate stat count for retransmissions ([#4756])
+- Update peer refresh value ([#4754])
+- Remove deprecated mark_as_success and use new disarm ([#4751])
+- Add get_mixnodes_described to validator_client ([#4725])
+- New Network Monitor ([#4610])
+
+[#4899]: https://github.com/nymtech/nym/pull/4899
+[#4892]: https://github.com/nymtech/nym/pull/4892
+[#4891]: https://github.com/nymtech/nym/pull/4891
+[#4886]: https://github.com/nymtech/nym/pull/4886
+[#4874]: https://github.com/nymtech/nym/pull/4874
+[#4872]: https://github.com/nymtech/nym/pull/4872
+[#4865]: https://github.com/nymtech/nym/pull/4865
+[#4864]: https://github.com/nymtech/nym/pull/4864
+[#4863]: https://github.com/nymtech/nym/pull/4863
+[#4858]: https://github.com/nymtech/nym/pull/4858
+[#4855]: https://github.com/nymtech/nym/pull/4855
+[#4853]: https://github.com/nymtech/nym/pull/4853
+[#4844]: https://github.com/nymtech/nym/pull/4844
+[#4843]: https://github.com/nymtech/nym/pull/4843
+[#4840]: https://github.com/nymtech/nym/pull/4840
+[#4837]: https://github.com/nymtech/nym/pull/4837
+[#4832]: https://github.com/nymtech/nym/pull/4832
+[#4831]: https://github.com/nymtech/nym/pull/4831
+[#4827]: https://github.com/nymtech/nym/pull/4827
+[#4825]: https://github.com/nymtech/nym/pull/4825
+[#4823]: https://github.com/nymtech/nym/pull/4823
+[#4803]: https://github.com/nymtech/nym/pull/4803
+[#4801]: https://github.com/nymtech/nym/pull/4801
+[#4796]: https://github.com/nymtech/nym/pull/4796
+[#4783]: https://github.com/nymtech/nym/pull/4783
+[#4778]: https://github.com/nymtech/nym/pull/4778
+[#4771]: https://github.com/nymtech/nym/pull/4771
+[#4766]: https://github.com/nymtech/nym/pull/4766
+[#4765]: https://github.com/nymtech/nym/pull/4765
+[#4763]: https://github.com/nymtech/nym/pull/4763
+[#4759]: https://github.com/nymtech/nym/pull/4759
+[#4756]: https://github.com/nymtech/nym/pull/4756
+[#4754]: https://github.com/nymtech/nym/pull/4754
+[#4751]: https://github.com/nymtech/nym/pull/4751
+[#4725]: https://github.com/nymtech/nym/pull/4725
+[#4610]: https://github.com/nymtech/nym/pull/4610
+
+## [2024.10-caramello] (2024-09-10)
+
+- Backport 4844 and 4845 ([#4857])
+- Bugfix/client registration vol2 ([#4856])
+- Remove wireguard feature flag and pass runtime enabled flag ([#4839])
+- Eliminate cancel unsafe sig awaiting ([#4834])
+- added explicit updateable admin to the mixnet contract ([#4822])
+- using legacy signing payload in CLI and verifying both variants in contract ([#4821])
+- adding ecash contract address ([#4819])
+- Check profit margin of node before defaulting to hardcoded value  ([#4802])
+- Sync last_seen_bandwidth immediately ([#4774])
+- Feature/additional ecash nym cli utils ([#4773])
+- Better storage error logging ([#4772])
+- bugfix: make sure DKG parses data out of events if logs are empty ([#4764])
+- Fix clippy on rustc beta toolchain ([#4746])
+- Fix clippy for beta toolchain ([#4742])
+- Disable testnet-manager on non-unix ([#4741])
+- Don't set NYM_VPN_API to default ([#4740])
+- Update publish-nym-binaries.yml ([#4739])
+- Update ci-build-upload-binaries.yml ([#4738])
+- Add NYM_VPN_API to network config ([#4736])
+- Re-export RecipientFormattingError in nym sdk ([#4735])
+- Persist wireguard peers ([#4732])
+- Fix tokio error in 1.39 ([#4730])
+- Feature/vesting purge plus ranged cost params ([#4716])
+- Fix (some) feature unification build failures ([#4681])
+- Feature Compact Ecash : The One PR ([#4623])
+
+[#4857]: https://github.com/nymtech/nym/pull/4857
+[#4856]: https://github.com/nymtech/nym/pull/4856
+[#4839]: https://github.com/nymtech/nym/pull/4839
+[#4834]: https://github.com/nymtech/nym/pull/4834
+[#4822]: https://github.com/nymtech/nym/pull/4822
+[#4821]: https://github.com/nymtech/nym/pull/4821
+[#4819]: https://github.com/nymtech/nym/pull/4819
+[#4802]: https://github.com/nymtech/nym/pull/4802
+[#4774]: https://github.com/nymtech/nym/pull/4774
+[#4773]: https://github.com/nymtech/nym/pull/4773
+[#4772]: https://github.com/nymtech/nym/pull/4772
+[#4764]: https://github.com/nymtech/nym/pull/4764
+[#4746]: https://github.com/nymtech/nym/pull/4746
+[#4742]: https://github.com/nymtech/nym/pull/4742
+[#4741]: https://github.com/nymtech/nym/pull/4741
+[#4740]: https://github.com/nymtech/nym/pull/4740
+[#4739]: https://github.com/nymtech/nym/pull/4739
+[#4738]: https://github.com/nymtech/nym/pull/4738
+[#4736]: https://github.com/nymtech/nym/pull/4736
+[#4735]: https://github.com/nymtech/nym/pull/4735
+[#4732]: https://github.com/nymtech/nym/pull/4732
+[#4730]: https://github.com/nymtech/nym/pull/4730
+[#4716]: https://github.com/nymtech/nym/pull/4716
+[#4681]: https://github.com/nymtech/nym/pull/4681
+[#4623]: https://github.com/nymtech/nym/pull/4623
+
+## [2024.9-topdeck] (2024-07-26)
+
+- chore: fix 1.80 lint issues ([#4731])
+- Handle clients with different versions in IPR ([#4723])
+- Add 1GB/day/user bandwidth cap ([#4717])
+- Feature/merge back ([#4710])
+- removed mixnode/gateway config migration code and disabled cli without explicit flag ([#4706])
+
+[#4731]: https://github.com/nymtech/nym/pull/4731
+[#4723]: https://github.com/nymtech/nym/pull/4723
+[#4717]: https://github.com/nymtech/nym/pull/4717
+[#4710]: https://github.com/nymtech/nym/pull/4710
+[#4706]: https://github.com/nymtech/nym/pull/4706
+
+## [2024.8-wispa] (2024-07-10)
+
+- add event parsing to support cosmos_sdk > 0.50 ([#4697])
+- Fix NR config compatibility ([#4690])
+- Remove UserAgent constructor since it's weakly typed ([#4689])
+- [bugfix]: Node_api_check CLI looked over roles on blacklisted nodes ([#4687])
+- Add mixnodes to self describing api cache ([#4684])
+- Move and whole bump of crates to workspace and upgrade some ([#4680])
+- Remove code that refers to removed nym-network-statistics ([#4679])
+- Remove nym-network-statistics ([#4678])
+- Create UserAgent that can be passed from the binary to the nym api client ([#4677])
+- Add authenticator ([#4667])
+
+[#4697]: https://github.com/nymtech/nym/pull/4697
+[#4690]: https://github.com/nymtech/nym/pull/4690
+[#4689]: https://github.com/nymtech/nym/pull/4689
+[#4687]: https://github.com/nymtech/nym/pull/4687
+[#4684]: https://github.com/nymtech/nym/pull/4684
+[#4680]: https://github.com/nymtech/nym/pull/4680
+[#4679]: https://github.com/nymtech/nym/pull/4679
+[#4678]: https://github.com/nymtech/nym/pull/4678
+[#4677]: https://github.com/nymtech/nym/pull/4677
+[#4667]: https://github.com/nymtech/nym/pull/4667
+
 ## [2024.7-doubledecker] (2024-07-04)

 - Add an early return in `parse_raw_str_logs` for empty raw log strings. ([#4686])
@@ -513,7 +957,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 [#3187]: https://github.com/nymtech/nym/issues/3187
 [#3203]: https://github.com/nymtech/nym/pull/3203
 [#3199]: https://github.com/nymtech/nym/pull/3199
->>>>>>> master

 ## [v1.1.13] (2023-03-15)

@@ -14,20 +14,19 @@ panic = "abort"
 opt-level = 3

 [workspace]
-
 resolver = "2"
 members = [
    "clients/native",
    "clients/native/websocket-requests",
    "clients/socks5",
-    "common/authenticator-requests",
    "common/async-file-watcher",
+    "common/authenticator-requests",
    "common/bandwidth-controller",
    "common/bin-common",
    "common/client-core",
    "common/client-core/config-types",
-    "common/client-core/surb-storage",
    "common/client-core/gateways-storage",
+    "common/client-core/surb-storage",
    "common/client-libs/gateway-client",
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
@@ -36,19 +35,26 @@ members = [
    "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/ecash-contract",
    "common/cosmwasm-smart-contracts/group-contract",
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
    "common/country-group",
    "common/credential-storage",
-    "common/credentials",
    "common/credential-utils",
+    "common/credential-verification",
+    "common/credentials",
    "common/credentials-interface",
    "common/crypto",
    "common/dkg",
+    "common/ecash-double-spending",
+    "common/ecash-time",
    "common/execute",
    "common/exit-policy",
+    "common/gateway-requests",
+    "common/gateway-storage",
+    "common/gateway-stats-storage",
    "common/http-api-client",
    "common/http-api-common",
    "common/inclusion-probability",
@@ -58,9 +64,10 @@ members = [
    "common/network-defaults",
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
-    "common/nymcoconut",
    "common/nym-id",
    "common/nym-metrics",
+    "common/nym_offline_compact_ecash",
+    "common/nymcoconut",
    "common/nymsphinx",
    "common/nymsphinx/acknowledgements",
    "common/nymsphinx/addressing",
@@ -74,11 +81,15 @@ members = [
    "common/nymsphinx/types",
    "common/nyxd-scraper",
    "common/pemstore",
+    "common/serde-helpers",
+    "common/service-provider-requests-common",
    "common/socks5-client-core",
    "common/socks5/proxy-helpers",
    "common/socks5/requests",
+    "common/statistics",
    "common/store-cipher",
    "common/task",
+    "common/ticketbooks-merkle",
    "common/topology",
    "common/tun",
    "common/types",
@@ -87,13 +98,15 @@ members = [
    "common/wasm/utils",
    "common/wireguard",
    "common/wireguard-types",
+    # "documentation/autodoc",
    "explorer-api",
    "explorer-api/explorer-api-requests",
    "explorer-api/explorer-client",
    "gateway",
-    "gateway/gateway-requests",
    "integrations/bity",
-    "mixnode",
+    "sdk/ffi/cpp",
+    "sdk/ffi/go",
+    "sdk/ffi/shared",
    "sdk/lib/socks5-listener",
    "sdk/rust/nym-sdk",
    "service-providers/authenticator",
@@ -101,15 +114,26 @@ members = [
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
    "nym-api",
-    "nym-browser-extension/storage",
    "nym-api/nym-api-requests",
+    "nym-browser-extension/storage",
+    "nym-credential-proxy/nym-credential-proxy",
+    "nym-credential-proxy/nym-credential-proxy-requests",
+    "nym-credential-proxy/vpn-api-lib-wasm",
+    "nym-data-observatory",
+    "nym-network-monitor",
    "nym-node",
-    "nym-node/nym-node-http-api",
    "nym-node/nym-node-requests",
+    "nym-node/nym-node-metrics",
+    "nym-node-status-api/nym-node-status-agent",
+    "nym-node-status-api/nym-node-status-api",
+    "nym-node-status-api/nym-node-status-client",
    "nym-outfox",
    "nym-validator-rewarder",
+    "tools/echo-server",
    "tools/internal/ssl-inject",
    # "tools/internal/sdk-version-bump",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/nym-cli",
    "tools/nym-id-cli",
    "tools/nym-nr-query",
@@ -120,27 +144,36 @@ members = [
    "wasm/mix-fetch",
    "wasm/node-tester",
    "wasm/zknym-lib",
+    "tools/echo-server",
+    "tools/internal/contract-state-importer/importer-cli",
+    "tools/internal/contract-state-importer/importer-contract",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract", "common/verloc", "tools/internal/mixnet-connectivity-check",
 ]

 default-members = [
    "clients/native",
    "clients/socks5",
-    "gateway",
-    "service-providers/network-requester",
-    "mixnode",
-    "nym-api",
-    "tools/nymvisor",
    "explorer-api",
+    "nym-api",
+    "nym-credential-proxy/nym-credential-proxy",
+    "nym-data-observatory",
+    "nym-node",
+    "nym-node-status-api/nym-node-status-agent",
+    "nym-node-status-api/nym-node-status-api",
    "nym-validator-rewarder",
-    "nym-node"
+    "service-providers/authenticator",
+    "service-providers/ip-packet-router",
+    "service-providers/network-requester",
+    "tools/nymvisor",
 ]

 exclude = [
    "explorer",
    "contracts",
    "nym-wallet",
+    "nym-vpn/ui/src-tauri",
    "cpu-cycles",
-    "sdk/ffi/cpp",
 ]

 [workspace.package]
@@ -150,24 +183,31 @@ homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
 edition = "2021"
 license = "Apache-2.0"
+rust-version = "1.80"
+readme = "README.md"

 [workspace.dependencies]
 addr = "0.15.6"
 aes = "0.8.1"
 aes-gcm = "0.10.1"
-anyhow = "1.0.71"
+aes-gcm-siv = "0.11.1"
+aead = "0.5.2"
+anyhow = "1.0.90"
 argon2 = "0.5.0"
-async-trait = "0.1.68"
+async-trait = "0.1.83"
+axum-client-ip = "0.6.1"
 axum = "0.7.5"
-axum-extra = "0.9.3"
-base64 = "0.21.4"
+axum-extra = "0.9.4"
+base64 = "0.22.1"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
+bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
-blake3 = "1.3.1"
+blake3 = "1.5.4"
+bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.5.0"
+bytes = "1.7.2"
 cargo_metadata = "0.18.1"
 celes = "2.4.0"
 cfg-if = "1.0.0"
@@ -175,36 +215,40 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.4.7"
-clap_complete = "4.0"
-clap_complete_fig = "4.0"
+clap = "4.5.20"
+clap_complete = "4.5"
+clap_complete_fig = "4.5"
 colored = "2.0"
-comfy-table = "6.0.0"
+comfy-table = "7.1.1"
+console = "0.15.8"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
-const_format = "0.2.32"
+const_format = "0.2.33"
 criterion = "0.4"
 csv = "1.3.0"
 ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.4.2"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
-dirs = "4.0"
+dirs = "5.0"
 doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
 etherparse = "0.13.0"
+envy = "0.4"
 eyre = "0.6.9"
-fastrand = "2.1.0"
-flate2 = "1.0.28"
+fastrand = "2.1.1"
+flate2 = "1.0.34"
 futures = "0.3.28"
+futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getset = "0.1.1"
+getset = "0.1.3"
 handlebars = "3.5.5"
 headers = "0.4.0"
 hex = "0.4.3"
@@ -212,76 +256,85 @@ hex-literal = "0.3.3"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
+http-body-util = "0.1"
 httpcodec = "0.2.3"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
-hyper = "1.3.1"
-indexed_db_futures = "0.3.0"
+human-repr = "1.1.0"
+hyper = "1.4.1"
+hyper-util = "0.1"
+indicatif = "0.17.8"
 inquire = "0.6.2"
 ip_network = "0.4.1"
-ipnetwork = "0.16"
+ipnetwork = "0.20"
 isocountry = "0.3.2"
+itertools = "0.13.0"
 k256 = "0.13"
-lazy_static = "1.4.0"
+lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
 maxminddb = "0.23.0"
+rs_merkle = "1.4.2"
 mime = "0.3.17"
+moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
-once_cell = "1.7.2"
+once_cell = "1.20.2"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
-parking_lot = "0.12.1"
+parking_lot = "0.12.3"
 pem = "0.8"
-pin-project = "1.0"
+petgraph = "0.6.5"
+pin-project = "1.1"
+pin-project-lite = "0.2.14"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
 rand = "0.8.5"
-rand-07 = "0.7.3"
 rand_chacha = "0.3"
-rand_chacha_02 = "0.2"
 rand_core = "0.6.3"
 rand_distr = "0.4"
 rand_pcg = "0.3.1"
 rand_seeder = "0.2.3"
 rayon = "1.5.1"
-regex = "1.8.4"
+regex = "1.10.6"
 reqwest = { version = "0.12.4", default-features = false }
 rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
-safer-ffi = "0.1.4"
-schemars = "0.8.1"
+safer-ffi = "0.1.13"
+schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.152"
-serde_bytes = "0.11.6"
+serde = "1.0.211"
+serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.91"
+serde_json = "1.0.132"
+serde_json_path = "0.7.1"
 serde_repr = "0.1"
-serde_with = "3.4.0"
+serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
-si-scale = "0.2.2"
+si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
-sqlx = "0.6.3"
-strum = "0.25"
+sqlx = "0.7.4"
+strum = "0.26"
+strum_macros = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
-sysinfo = "0.30.12"
+sysinfo = "0.30.13"
 tap = "1.0.1"
-tar = "0.4.40"
-tempfile = "3.5.0"
-thiserror = "1.0.48"
+tar = "0.4.42"
+tempfile = "3.14"
+thiserror = "1.0.64"
 time = "0.3.30"
-tokio = "1.33.0"
-tokio-stream = "0.1.14"
-tokio-test = "0.4.2"
+tokio = "1.39"
+tokio-stream = "0.1.16"
+tokio-test = "0.4.4"
+tokio-tun = "0.11.5"
 tokio-tungstenite = { version = "0.20.1" }
-tokio-util = "0.7.10"
+tokio-util = "0.7.12"
 toml = "0.8.14"
 tower = "0.4.13"
 tower-http = "0.5.2"
@@ -289,14 +342,17 @@ tracing = "0.1.37"
 tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.16"
 tracing-tree = "0.2.2"
-ts-rs = "7.0.0"
+tracing-log = "0.2"
+ts-rs = "10.0.0"
 tungstenite = { version = "0.20.1", default-features = false }
-url = "2.4"
-utoipa = "4.2.0"
-utoipa-swagger-ui = "6.0.0"
+url = "2.5"
+utoipa = "4.2"
+utoipa-swagger-ui = "7.1"
+utoipauto = "0.1"
+uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 walkdir = "2"
-wasm-bindgen-test = "0.3.36"
+wasm-bindgen-test = "0.3.43"
 x25519-dalek = "2.0.0"
 zeroize = "1.6.0"

@@ -305,12 +361,13 @@ prometheus = { version = "0.13.0" }
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false,  branch = "feature/gt-serialization-0.8.0" }
+# plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }
+subtle = "2.5.0"

 # cosmwasm-related
-cosmwasm-derive = "=1.4.3"
 cosmwasm-schema = "=1.4.3"
 cosmwasm-std = "=1.4.3"
 # use 0.5.0 as that's the version used by cosmwasm-std 1.4.3
@@ -326,30 +383,40 @@ cw4 = { version = "=1.1.2" }
 cw-controllers = { version = "=1.1.0" }

 # cosmrs-related
-bip32 = { version = "0.5.1", default-features = false }
+bip32 = { version = "0.5.2", default-features = false }

-# temporarily using a fork again (yay.) because we need staking and slashing support
-cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" }
-#cosmrs = {  git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" } # unfortuntely we need a fork by yours truly to get the staking support
-tendermint = "0.34"     # same version as used by cosmrs
-tendermint-rpc = "0.34" # same version as used by cosmrs
+# temporarily using a fork again (yay.) because we need staking and slashing support (which are already on main but not released)
+# plus response message parsing (which is, as of the time of writing this message, waiting to get merged)
+#cosmrs = { path = "../cosmos-rust-fork/cosmos-rust/cosmrs" }
+cosmrs = { git = "https://github.com/cosmos/cosmos-rust", rev = "4b1332e6d8258ac845cef71589c8d362a669675a" } # unfortuntely we need a fork by yours truly to get the staking support
+tendermint = "0.37.0"                                                                                        # same version as used by cosmrs
+tendermint-rpc = "0.37.0"                                                                                    # same version as used by cosmrs
 prost = { version = "0.12", default-features = false }

 # wasm-related dependencies
 gloo-utils = "0.2.0"
 gloo-net = "0.5.0"
-js-sys = "0.3.69"
+
+# use a separate branch due to feature unification failures
+# this is blocked until the upstream removes outdates `wasm_bindgen` feature usage
+# indexed_db_futures = "0.4.1"
+indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", branch = "update-uuid" }
+js-sys = "0.3.70"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.92"
-wasm-bindgen-futures = "0.4.39"
+wasm-bindgen = "0.2.95"
+wasm-bindgen-futures = "0.4.45"
 wasmtimer = "0.2.0"
-web-sys = "0.3.69"
-itertools = "0.12.0"
-
+web-sys = "0.3.72"

 # Profile settings for individual crates

+# Compile-time verified queries do quite a bit of work at compile time. Incremental
+#  actions like cargo check and cargo build can be significantly faster when
+# using an optimized build
+[profile.dev.package.sqlx-macros]
+opt-level = 3
+
 [profile.release.package.nym-socks5-listener]
 strip = true
 codegen-units = 1
@@ -133,7 +133,7 @@ clippy: sdk-wasm-lint
 # Build contracts ready for deploy
 # -----------------------------------------------------------------------------

-CONTRACTS=vesting_contract mixnet_contract
+CONTRACTS=vesting_contract mixnet_contract nym_ecash
 CONTRACTS_WASM=$(addsuffix .wasm, $(CONTRACTS))
 CONTRACTS_OUT_DIR=contracts/target/wasm32-unknown-unknown/release

@@ -3,37 +3,23 @@ Critical bug or security issue 💥
 If you're here because you're trying to figure out how to notify us of a security issue, send us a PGP encrypted email to:

 ```
-security@nymte.ch
+security@nym.com
 ```

 Encrypted with our public key which is available below in plain text and also on keyservers:

 ```
-pub   rsa4096 2023-10-30 [SC] [expire : 2026-10-29]
+sec   rsa4096/7C3C727F05090550 2023-10-30 [SC] [expire : 2026-10-29]
      24B2592E801A5AAA8666C8BA7C3C727F05090550
-uid          [  ultime ] Security Nym Technologies <security@nymte.ch>
-sub   rsa4096 2023-10-30 [E] [expire : 2026-10-29]
+uid                [  ultime ] Security Nym Technologies <security@nym.com>
+ssb   rsa4096/ACD0FBD79DC70ACC 2023-10-30 [E] [expire : 2026-10-29]

 ```

 The fingerprint of the key is on the second line above.

-If you need to chat __urgently__ to our team for a __critical__ security issue:
-
-go to Matrix, and alert the core engineers with a private direct message:
-
-    Jedrzej Stuczynski @jstuczyn:nymtech.chat
-    Mark Sinclair @mark:nymtech.chat
-    Raphaël Walther @raphael:nymtech.chat
-
 Please avoid opening public issues on GitHub that contain information about a potential security vulnerability as this makes it difficult to reduce the impact and harm of valid security issues.

-If you don't know what Matrix is, you can follow this documentation to create an account on this federation of instant messaging servers:
-
-[Matrix for Instant Messaging](https://matrix.org/docs/chat_basics/matrix-for-im/)
-
-
-
 ```
 -----BEGIN PGP PUBLIC KEY BLOCK-----

@@ -48,43 +34,69 @@ vMFUIzBMHOPXH16036zGyFMC1esRd2qqil4b9KtLgCOkrD1VgpjcveoA0VyMJCN6
 LmKTrVjwjjDMxby+d49BolRWGnCofXozXwvNQx+CYv8M2WPErTpyYoofYFtpqr7A
 fIufc/e0+um3zoGIbHejrhsbuH9Qf+MKsI+Ng93bdDtjeHz6MEgAlsTm0qeizYpj
 IyKZIObPmfvrAm08hFZ8JnGk+XuooF36XWbJYjCCy0bOyMw1r7ZG99TcSwARAQAB
-tC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW10ZS5jaD6J
-AlQEEwEKAD4WIQQkslkugBpaqoZmyLp8PHJ/BQkFUAUCZT9elwIbAwUJBaOagAUL
-CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRB8PHJ/BQkFUL7dD/9zO73uI5VR+SWx
-PFmJW+9QsPiQbVRvGwNZurctmQ2s2Pe0vHRELFeqD5oYvSx2Lequ3Ir+zn/C3kDM
-kNs40obSL6jCBiLPkxEY0JqzPM9jZr7EjvlibWV3f6DxooRIqEyfN57I3OBGlqZE
-0Mx7sQuCcgau8C70DF952QhKUwXC2cmpmDKHVEEoio1xGSD4dQhGapCB32RQGtna
-OGfAO9celNMvSq0Lp+aJxeACmWFY5T4/y79JPcT5vSs/yEIRmaH/fn2piwaFBsIq
-gHJJMxO3740P1hF8j7KWUoUofuFaEALHBpEpjWTOj8ej1wmFlu+5F+jSVoc781Wb
-ZZXu04cOBXnGTogzSxMpBe9TtLb28zd6WzFotC25KTI3pngMzXsQGLJLOwvoZKiS
-LFjPRjg1rwobmB3Q3J2W5GYSveia0CDsZGP+g87GVVf/oD2Djpa68xyVYwIYeA6T
-3DNdS77qHiRuGiS4kWXyVjDqOICboR4uCvt09zlkBuLDdTWqWYARUvZjtjs4w/Ol
-rdrBI3A88ti8fRldYaNpu17ME1ilpN44yKoJtqiWc3Tisk8eYLfx6c7FQF3PrRva
-mr7FZvhFsYML5CeNFHTEzN6Y3jjKN/60DvCfodWnWFK47Txkl8UAXGY2W9B0fWqQ
-wUVr8uLuMyyMiKbeoufi7rGOj6AMErkCDQRlP16XARAA8FGmD5J3tM1BOM1niJxZ
-JTdCauzEtxEoBL0RuqGBkR8U29sRM6DwuzjU7PwscFnBaGyU+eU73GwGkH3ozFfF
-tllYhQrhP/kkN+0rEO5Xi+nR+4JCFRqrf3nJXAAPfiksURMp8er1dUOY2/e1ZSoL
-tS+nzUivV8CfE+pgj/5YtGwPC+KYHLATkKkMELCrbW4UO06VWOqQsvr6kivXuJQQ
-LdEAMpBlADmXFG45DmPKQzsBWUgvTwyGy3LX0nys8cgpex9BH8hhr01QmGyP469s
-N3cNrtFuu8U6RAsiCD/8mlBuD3EQEU5SF0lc7kCICAZk+wElmXnimEi0TOYsbz6k
-90lteicX70rA9GNeyI76H+VSOYvWpkRwaJAgUdzrAM1o9SHASq+cZ6nD85OZioQk
-DWM6+Q+sf2oen0qJnnGmUr93kJIC0PIdgrXRrtiNfeRa1Z/H0LmREyyEMoFiVivn
-z1vVk85Oq6Sf3ltUwvmDzuuJOtsp2Qp6+x6Snn/yKauI4uf4Cf/wKUch4r6Bwgg5
-Dw49ky7lwlnALio4GIVoGLpLef93wWoDmp4Klyh3ZPf2nB0U91u3bHRUo7m+D7QJ
-98cyKtqLLzjg7szGf60pIWNWRsadYQT3bSncynqknAjOV3BCvx6/ivsnpj//QjYR
-HtviUAcQ1DBB6UC6q23FIs0AEQEAAYkCPAQYAQoAJhYhBCSyWS6AGlqqhmbIunw8
-cn8FCQVQBQJlP16XAhsMBQkFo5qAAAoJEHw8cn8FCQVQzukP/iLxjOxT+UpPR//c
-prDVSLkP4pF5bmw36U07jvqpS+/KTXsxiiQleffRabOpNLcd+K1ueavyt9nnIwHH
-tHS9kM9A7DBw3LnpEbXki46QDCCI6niGijlLOEeAWqnocwMNTT05wVVgCtO3DQP2
-MoSCcqHpXDChvOyr5d5xjYLVJhlctIMSomcVzGryjknPu0Yj/TkC/4c+m86ZWQUD
-HqMHQIuiEenvb62/F4c5OJIRZPEn70wdddkgJuJU3eHdHrnuhCkjCC93GQGbGj03
-Zqos6699y6hmPeD3U5IUv8ujwZYVCCuDm8gJfrp3R6WLfeZeK9WmTVBpCzsDg3fV
-hSwmOk6pp8DAq1/Dev3yRkFggCEyGK6c9b+a0CRBncl8e5Q0QQIzNiS/uExQP3h+
-ELJs3P0MLP+6FWhNUry09n3lnWkr1hY+v1M0GAxbfdv/tsCN1Pq/VQEz+CTqXqya
-ftWldOHWw6Hh+gtwxcHjG4MBOrO5oICQ3lh2hGwQ58cDgZYSK/OGgJ9BggFl1CcM
-0uGC0/TRCI1zt/4y+7efSZQMZkHo7VC/3MFbp2hcNejpW+BxVuwKTunFvWK3TLhq
-sSlQ5yyhqchooepsFHq9bosKFjLJC01uprBv1rinoNduOy43FbyS7JPRRspANN0R
-iC2pMbWdE0ZTQaFq6tPIg058pjqi
-=nqgX
+tCxTZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW0uY29tPokC
+VAQTAQoAPhYhBCSyWS6AGlqqhmbIunw8cn8FCQVQBQJnSd5VAhsDBQkFo5qABQsJ
+CAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEHw8cn8FCQVQPPIP/ipGz2zLAjE2dSE3
+VcqOvras0DfqIL9HDm26Dg6QO2D/4YRntw0RqVyuy+zFnRUm+RZCKLPLUzbQ9Wjb
+G/Og5ttQVYQMu5eKu7OMvXkrbRo3teZFU+8IL08zIW6pyf9haxO6YMhLRy6cLYwW
+0EYC6Qzn5gz3kI7VkI8fWfs2Dk4XEV3D+SVtBoF6KRxMXT6HZvpzoMSEJZBoNj8S
+jw0TF8TFUQf49jUQbIHumukMswolrHi8a5ej8DSfNwSgz+Tt8oh5lu01kyUJiHn7
+nuHaY4Y9cHUVAOSwq/hovG52+ZE1r3aiswvle/B19o9pKeWWVvacSptGxDQagBtQ
+igoNLdRvY0XN2TEyX9pOHR0AoVOxtIW11CpkKuDbQG9vPwovqJ2L6+Fh3pzHYzcI
+2GIShNm/Z2SZBiUqbljJe9H4UAT/aHgMINkEG8qzUKwO42MA5HJT7YbHTR17/QSF
+Il5dhneRzmSbNcW2rdRwx/BmzrcsFJfqCt4JG/WDF293xSOjhFqQYvU4gCO+OB7o
+KXjX907XXDjS2KEJ71OGqVfk/P7BqEfQNfrLtb02TyXJAPQXHhybv23c4E7zUs9V
+lMjNizzxYB96uwJb0LAB2ijzEwoP91uGT2tFjk6F08x2QiArmXUdgrv44b39Stia
+gJS0GYKqSzyr10xHhUuDA+GKYtcitC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVz
+IDxzZWN1cml0eUBueW10ZS5jaD6JAjYEMAEKACAWIQQkslkugBpaqoZmyLp8PHJ/
+BQkFUAUCZ0nftQIdIAAKCRB8PHJ/BQkFUFHDEACtyNuUEjKCLAT5mSfow85PjFgo
+o8kHjQr/IIQ7ZbBOHeJJcrxDuypssiLh5XUjF3x5BiBfZ6vCxSb81RRwsDMp0mA1
+qzv9G8sgW0HTQUnZ9oH6CYut2NgzAnQpmuacrunm9Zy0FJ3ejbmwUY/NqK6gJkle
+66duHKhAy7DWjj7amd0C8bPDR+PA44fI3MezDHkQNaauKZTRqd1TqH8Qk5PAl4cB
+o5gVzeZh/U7/usvtGhazAIUF5BqK6bTmDnYopg+2x8jjwrG4+08GrttZkNjBLXeA
+Y/2U064yMz12LPv01qqAFdZ+coRy/ps/gOQTz34/VeW0CFy7TMqs4t3vSBWTqU7w
+hnw/qj6cM33fdxctj6KDgJSCkZdx2fvwXgxiPqUa5+j9FlFBeD5RDAl6g6t8N1/K
+Xca+zNYuSZgc297q1D+mtSD1C7uJNPxoAl+Bv5KNKpsjfQ+m04++CIFtGyX22aCA
+h2/tHwQZIXhOiMAKOoupidDVDhgxtCJ3Ps416xL0sTZfsPfg+j1Uv/Em9pzPClEl
+fX6+1O4DdSyZUQ4VsjMu/H5W/NQdbHgmqFrxQ6WX/0s5GMwO6GMDiPe8sOrwz9wD
+WYtyjafxXOHEZ1OjYX5gr7bGaG4oKc2btTJN0B3Phg4dStnHCNjEYccxuV3507fj
+HnNotkpXF2nGLxy+PYkCVAQTAQoAPhYhBCSyWS6AGlqqhmbIunw8cn8FCQVQBQJl
+P16XAhsDBQkFo5qABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEHw8cn8FCQVQ
+vt0P/3M7ve4jlVH5JbE8WYlb71Cw+JBtVG8bA1m6ty2ZDazY97S8dEQsV6oPmhi9
+LHYt6q7civ7Of8LeQMyQ2zjShtIvqMIGIs+TERjQmrM8z2NmvsSO+WJtZXd/oPGi
+hEioTJ83nsjc4EaWpkTQzHuxC4JyBq7wLvQMX3nZCEpTBcLZyamYModUQSiKjXEZ
+IPh1CEZqkIHfZFAa2do4Z8A71x6U0y9KrQun5onF4AKZYVjlPj/Lv0k9xPm9Kz/I
+QhGZof9+famLBoUGwiqAckkzE7fvjQ/WEXyPspZShSh+4VoQAscGkSmNZM6Px6PX
+CYWW77kX6NJWhzvzVZtlle7Thw4FecZOiDNLEykF71O0tvbzN3pbMWi0LbkpMjem
+eAzNexAYsks7C+hkqJIsWM9GODWvChuYHdDcnZbkZhK96JrQIOxkY/6DzsZVV/+g
+PYOOlrrzHJVjAhh4DpPcM11LvuoeJG4aJLiRZfJWMOo4gJuhHi4K+3T3OWQG4sN1
+NapZgBFS9mO2OzjD86Wt2sEjcDzy2Lx9GV1ho2m7XswTWKWk3jjIqgm2qJZzdOKy
+Tx5gt/HpzsVAXc+tG9qavsVm+EWxgwvkJ40UdMTM3pjeOMo3/rQO8J+h1adYUrjt
+PGSXxQBcZjZb0HR9apDBRWvy4u4zLIyIpt6i5+LusY6PoAwSuQINBGU/XpcBEADw
+UaYPkne0zUE4zWeInFklN0Jq7MS3ESgEvRG6oYGRHxTb2xEzoPC7ONTs/CxwWcFo
+bJT55TvcbAaQfejMV8W2WViFCuE/+SQ37SsQ7leL6dH7gkIVGqt/eclcAA9+KSxR
+Eynx6vV1Q5jb97VlKgu1L6fNSK9XwJ8T6mCP/li0bA8L4pgcsBOQqQwQsKttbhQ7
+TpVY6pCy+vqSK9e4lBAt0QAykGUAOZcUbjkOY8pDOwFZSC9PDIbLctfSfKzxyCl7
+H0EfyGGvTVCYbI/jr2w3dw2u0W67xTpECyIIP/yaUG4PcRARTlIXSVzuQIgIBmT7
+ASWZeeKYSLRM5ixvPqT3SW16JxfvSsD0Y17Ijvof5VI5i9amRHBokCBR3OsAzWj1
+IcBKr5xnqcPzk5mKhCQNYzr5D6x/ah6fSomecaZSv3eQkgLQ8h2CtdGu2I195FrV
+n8fQuZETLIQygWJWK+fPW9WTzk6rpJ/eW1TC+YPO64k62ynZCnr7HpKef/Ipq4ji
+5/gJ//ApRyHivoHCCDkPDj2TLuXCWcAuKjgYhWgYukt5/3fBagOangqXKHdk9/ac
+HRT3W7dsdFSjub4PtAn3xzIq2osvOODuzMZ/rSkhY1ZGxp1hBPdtKdzKeqScCM5X
+cEK/Hr+K+yemP/9CNhEe2+JQBxDUMEHpQLqrbcUizQARAQABiQI8BBgBCgAmFiEE
+JLJZLoAaWqqGZsi6fDxyfwUJBVAFAmU/XpcCGwwFCQWjmoAACgkQfDxyfwUJBVDO
+6Q/+IvGM7FP5Sk9H/9ymsNVIuQ/ikXlubDfpTTuO+qlL78pNezGKJCV599Fps6k0
+tx34rW55q/K32ecjAce0dL2Qz0DsMHDcuekRteSLjpAMIIjqeIaKOUs4R4Baqehz
+Aw1NPTnBVWAK07cNA/YyhIJyoelcMKG87Kvl3nGNgtUmGVy0gxKiZxXMavKOSc+7
+RiP9OQL/hz6bzplZBQMeowdAi6IR6e9vrb8Xhzk4khFk8SfvTB112SAm4lTd4d0e
+ue6EKSMIL3cZAZsaPTdmqizrr33LqGY94PdTkhS/y6PBlhUIK4ObyAl+undHpYt9
+5l4r1aZNUGkLOwODd9WFLCY6TqmnwMCrX8N6/fJGQWCAITIYrpz1v5rQJEGdyXx7
+lDRBAjM2JL+4TFA/eH4Qsmzc/Qws/7oVaE1SvLT2feWdaSvWFj6/UzQYDFt92/+2
+wI3U+r9VATP4JOperJp+1aV04dbDoeH6C3DFweMbgwE6s7mggJDeWHaEbBDnxwOB
+lhIr84aAn0GCAWXUJwzS4YLT9NEIjXO3/jL7t59JlAxmQejtUL/cwVunaFw16Olb
+4HFW7ApO6cW9YrdMuGqxKVDnLKGpyGih6mwUer1uiwoWMskLTW6msG/WuKeg1247
+LjcVvJLsk9FGykA03RGILakxtZ0TRlNBoWrq08iDTnymOqI=
+=QPTf
 -----END PGP PUBLIC KEY BLOCK-----
+
 ```
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.37"
+version = "1.1.45"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -26,30 +26,46 @@ clap = { workspace = true, features = ["cargo", "derive"] }
 dirs = { workspace = true }
 log = { workspace = true } # self explanatory
 rand = { workspace = true }
-serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
+serde = { workspace = true, features = [
+    "derive",
+] } # for config serialization/deserialization
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 tap = { workspace = true }
 time = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "net", "signal"] } # async runtime
+tokio = { workspace = true, features = [
+    "rt-multi-thread",
+    "net",
+    "signal",
+] } # async runtime
 tokio-tungstenite = { workspace = true }
 zeroize = { workspace = true }

 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
-nym-bin-common = { path = "../../common/bin-common", features = ["output_format", "clap"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "fs-gateways-storage", "cli"] }
+nym-bin-common = { path = "../../common/bin-common", features = [
+    "output_format",
+    "clap",
+] }
+nym-client-core = { path = "../../common/client-core", features = [
+    "fs-credentials-storage",
+    "fs-surb-storage",
+    "fs-gateways-storage",
+    "cli",
+] }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credentials = { path = "../../common/credentials" }
 nym-crypto = { path = "../../common/crypto" }
-nym-gateway-requests = { path = "../../gateway/gateway-requests" }
+nym-gateway-requests = { path = "../../common/gateway-requests" }
 nym-network-defaults = { path = "../../common/network-defaults" }
 nym-sphinx = { path = "../../common/nymsphinx" }
 nym-pemstore = { path = "../../common/pemstore" }
 nym-task = { path = "../../common/task" }
 nym-topology = { path = "../../common/topology" }
-nym-validator-client = { path = "../../common/client-libs/validator-client", features = ["http-client"] }
+nym-validator-client = { path = "../../common/client-libs/validator-client", features = [
+    "http-client",
+] }
 nym-client-websocket-requests = { path = "websocket-requests" }
 nym-id = { path = "../../common/nym-id" }

@@ -102,5 +102,10 @@ average_ack_delay = '{{ debug.acknowledgements.average_ack_delay }}'
 [debug.cover_traffic]
 loop_cover_traffic_average_delay = '{{ debug.cover_traffic.loop_cover_traffic_average_delay }}'

+[debug.stats_reporting]
+enabled = {{ debug.stats_reporting.enabled }}
+provider_address = '{{ debug.stats_reporting.provider_address }}'
+reporting_interval = '{{ debug.stats_reporting.reporting_interval }}'
+

 "#;
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_coin_index_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}
@@ -4,10 +4,10 @@
 use crate::commands::CliNativeClient;
 use crate::error::ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };

-pub(crate) async fn execute(args: CommonClientImportCredentialArgs) -> Result<(), ClientError> {
+pub(crate) async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), ClientError> {
    import_credential::<CliNativeClient, _>(args).await?;
    println!("successfully imported credential!");
    Ok(())
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), ClientError> {
+    import_expiration_date_signatures::<CliNativeClient, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), ClientError> {
+    import_master_verification_key::<CliNativeClient, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}
@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}
@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_show_ticketbooks::{
+    show_ticketbooks, CommonShowTicketbooksArgs,
+};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonShowTicketbooksArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonShowTicketbooksArgs> for Args {
+    fn as_ref(&self) -> &CommonShowTicketbooksArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    let output = args.output;
+    let res = show_ticketbooks::<CliNativeClient, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}
@@ -81,6 +81,7 @@ impl From<Init> for OverrideConfig {

            nyxd_urls: init_config.common_args.nyxd_urls,
            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
+            stats_reporting_address: init_config.common_args.stats_reporting_address,
        }
    }
 }
@@ -6,13 +6,14 @@ use crate::client::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::client::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::client::config::old_config_v1_1_33::ConfigV1_1_33;
 use crate::client::config::{BaseClientConfig, Config};
+use crate::commands::ecash::Ecash;
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
+use nym_client::client::Recipient;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_config::OptionalSet;
@@ -22,7 +23,7 @@ use std::sync::OnceLock;

 mod add_gateway;
 pub(crate) mod build_info;
-pub(crate) mod import_credential;
+pub(crate) mod ecash;
 pub(crate) mod init;
 mod list_gateways;
 pub(crate) mod run;
@@ -72,8 +73,8 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),

    /// List all registered with gateways
    ListGateways(list_gateways::Args),
@@ -104,6 +105,7 @@ pub(crate) struct OverrideConfig {
    no_cover: bool,
    nyxd_urls: Option<Vec<url::Url>>,
    enabled_credentials_mode: Option<bool>,
+    stats_reporting_address: Option<Recipient>,
 }

 pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync>> {
@@ -112,7 +114,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
@@ -149,6 +151,11 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
            BaseClientConfig::with_disabled_credentials,
            args.enabled_credentials_mode.map(|b| !b),
        )
+        .with_optional_env_ext(
+            BaseClientConfig::with_enabled_stats_reporting_address,
+            args.stats_reporting_address,
+            nym_network_defaults::var_names::CLIENT_STATS_COLLECTION_PROVIDER,
+        )
 }

 async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {
@@ -43,6 +43,7 @@ impl From<Run> for OverrideConfig {
            no_cover: run_config.common_args.no_cover,
            nyxd_urls: run_config.common_args.nyxd_urls,
            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
+            stats_reporting_address: run_config.common_args.stats_reporting_address,
        }
    }
 }
@@ -422,7 +422,7 @@ impl Handler {
    ) {
        // We don't want a crash in the connection handler to trigger a shutdown of the whole
        // process.
-        task_client.mark_as_success();
+        task_client.disarm();

        let ws_stream = match accept_async(socket).await {
            Ok(ws_stream) => ws_stream,
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.37"
+version = "1.1.45"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -11,7 +11,9 @@ license.workspace = true
 bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
 log = { workspace = true }
-serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
+serde = { workspace = true, features = [
+    "derive",
+] } # for config serialization/deserialization
 serde_json = { workspace = true }
 tap = { workspace = true }
 thiserror = { workspace = true }
@@ -22,13 +24,21 @@ url = { workspace = true }
 zeroize = { workspace = true }

 # internal
-nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "fs-gateways-storage", "cli"] }
+nym-bin-common = { path = "../../common/bin-common", features = [
+    "output_format",
+    "clap",
+] }
+nym-client-core = { path = "../../common/client-core", features = [
+    "fs-credentials-storage",
+    "fs-surb-storage",
+    "fs-gateways-storage",
+    "cli",
+] }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credentials = { path = "../../common/credentials" }
 nym-crypto = { path = "../../common/crypto" }
-nym-gateway-requests = { path = "../../gateway/gateway-requests" }
+nym-gateway-requests = { path = "../../common/gateway-requests" }
 nym-id = { path = "../../common/nym-id" }
 nym-network-defaults = { path = "../../common/network-defaults" }
 nym-ordered-buffer = { path = "../../common/socks5/ordered-buffer" }
@@ -36,7 +46,9 @@ nym-pemstore = { path = "../../common/pemstore" }
 nym-socks5-client-core = { path = "../../common/socks5-client-core" }
 nym-sphinx = { path = "../../common/nymsphinx" }
 nym-topology = { path = "../../common/topology" }
-nym-validator-client = { path = "../../common/client-libs/validator-client", features = ["http-client"] }
+nym-validator-client = { path = "../../common/client-libs/validator-client", features = [
+    "http-client",
+] }

 [features]
 default = []
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::{
+    import_coin_index_signatures, CommonClientImportCoinIndexSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCoinIndexSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_coin_index_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported coin index signatures!");
+    Ok(())
+}
@@ -4,12 +4,10 @@
 use crate::commands::CliSocks5Client;
 use crate::error::Socks5ClientError;
 use nym_client_core::cli_helpers::client_import_credential::{
-    import_credential, CommonClientImportCredentialArgs,
+    import_credential, CommonClientImportTicketBookArgs,
 };

-pub(crate) async fn execute(
-    args: CommonClientImportCredentialArgs,
-) -> Result<(), Socks5ClientError> {
+pub async fn execute(args: CommonClientImportTicketBookArgs) -> Result<(), Socks5ClientError> {
    import_credential::<CliSocks5Client, _>(args).await?;
    println!("successfully imported credential!");
    Ok(())
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::{
+    import_expiration_date_signatures, CommonClientImportExpirationDateSignaturesArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportExpirationDateSignaturesArgs,
+) -> Result<(), Socks5ClientError> {
+    import_expiration_date_signatures::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported expiration date signatures!");
+    Ok(())
+}
@@ -0,0 +1,16 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_master_verification_key::{
+    import_master_verification_key, CommonClientImportMasterVerificationKeyArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportMasterVerificationKeyArgs,
+) -> Result<(), Socks5ClientError> {
+    import_master_verification_key::<CliSocks5Client, _>(args).await?;
+    println!("successfully imported master verification key!");
+    Ok(())
+}
@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+use nym_client_core::cli_helpers::client_import_coin_index_signatures::CommonClientImportCoinIndexSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportTicketBookArgs;
+use nym_client_core::cli_helpers::client_import_expiration_date_signatures::CommonClientImportExpirationDateSignaturesArgs;
+use nym_client_core::cli_helpers::client_import_master_verification_key::CommonClientImportMasterVerificationKeyArgs;
+use std::error::Error;
+
+pub(crate) mod import_coin_index_signatures;
+pub(crate) mod import_credential;
+pub(crate) mod import_expiration_date_signatures;
+pub(crate) mod import_master_verification_key;
+pub(crate) mod show_ticketbooks;
+
+#[derive(Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct Ecash {
+    #[clap(subcommand)]
+    pub command: EcashCommands,
+}
+
+impl Ecash {
+    pub async fn execute(self) -> Result<(), Box<dyn Error + Send + Sync>> {
+        match self.command {
+            EcashCommands::ShowTicketBooks(args) => show_ticketbooks::execute(args).await?,
+            EcashCommands::ImportTicketBook(args) => import_credential::execute(args).await?,
+            EcashCommands::ImportCoinIndexSignatures(args) => {
+                import_coin_index_signatures::execute(args).await?
+            }
+            EcashCommands::ImportExpirationDateSignatures(args) => {
+                import_expiration_date_signatures::execute(args).await?
+            }
+            EcashCommands::ImportMasterVerificationKey(args) => {
+                import_master_verification_key::execute(args).await?
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(Subcommand)]
+pub enum EcashCommands {
+    /// Display information associated with the imported ticketbooks,
+    ShowTicketBooks(show_ticketbooks::Args),
+
+    /// Import a pre-generated ticketbook
+    ImportTicketBook(CommonClientImportTicketBookArgs),
+
+    /// Import coin index signatures needed for ticketbooks
+    ImportCoinIndexSignatures(CommonClientImportCoinIndexSignaturesArgs),
+
+    /// Import expiration date signatures needed for ticketbooks
+    ImportExpirationDateSignatures(CommonClientImportExpirationDateSignaturesArgs),
+
+    /// Import master verification key needed for ticketbooks
+    ImportMasterVerificationKey(CommonClientImportMasterVerificationKeyArgs),
+}
@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_show_ticketbooks::{
+    show_ticketbooks, CommonShowTicketbooksArgs,
+};
+
+#[derive(clap::Args)]
+pub struct Args {
+    #[command(flatten)]
+    common_args: CommonShowTicketbooksArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonShowTicketbooksArgs> for Args {
+    fn as_ref(&self) -> &CommonShowTicketbooksArgs {
+        &self.common_args
+    }
+}
+
+pub async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    let output = args.output;
+    let res = show_ticketbooks::<CliSocks5Client, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}
@@ -92,6 +92,7 @@ impl From<Init> for OverrideConfig {
            nyxd_urls: init_config.common_args.nyxd_urls,
            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
            outfox: false,
+            stats_reporting_address: init_config.common_args.stats_reporting_address,
        }
    }
 }
@@ -1,6 +1,7 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::commands::ecash::Ecash;
 use crate::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
@@ -13,12 +14,12 @@ use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
 use nym_client_core::config::{GroupBy, TopologyStructure};
 use nym_config::OptionalSet;
+use nym_sphinx::addressing::Recipient;
 use nym_sphinx::params::{PacketSize, PacketType};
 use std::error::Error;
 use std::net::IpAddr;
@@ -26,7 +27,7 @@ use std::sync::OnceLock;

 mod add_gateway;
 pub(crate) mod build_info;
-mod import_credential;
+pub mod ecash;
 pub mod init;
 mod list_gateways;
 pub(crate) mod run;
@@ -76,8 +77,8 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(CommonClientImportCredentialArgs),
+    /// Ecash-related functionalities
+    Ecash(Ecash),

    /// List all registered with gateways
    ListGateways(list_gateways::Args),
@@ -111,6 +112,7 @@ pub(crate) struct OverrideConfig {
    nyxd_urls: Option<Vec<url::Url>>,
    enabled_credentials_mode: Option<bool>,
    outfox: bool,
+    stats_reporting_address: Option<Recipient>,
 }

 pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync>> {
@@ -119,7 +121,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::Ecash(ecash) => ecash.execute().await?,
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
@@ -196,6 +198,11 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
            BaseClientConfig::with_disabled_credentials,
            args.enabled_credentials_mode.map(|b| !b),
        )
+        .with_optional_base_env(
+            BaseClientConfig::with_enabled_stats_reporting_address,
+            args.stats_reporting_address,
+            nym_network_defaults::var_names::CLIENT_STATS_COLLECTION_PROVIDER,
+        )
 }

 async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError> {
@@ -70,6 +70,7 @@ impl From<Run> for OverrideConfig {
            nyxd_urls: run_config.common_args.nyxd_urls,
            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
            outfox: run_config.outfox,
+            stats_reporting_address: run_config.common_args.stats_reporting_address,
        }
    }
 }
@@ -108,4 +108,9 @@ average_ack_delay = '{{ core.debug.acknowledgements.average_ack_delay }}'
 [core.debug.cover_traffic]
 loop_cover_traffic_average_delay = '{{ core.debug.cover_traffic.loop_cover_traffic_average_delay }}'

+[core.debug.stats_reporting]
+enabled = {{ core.debug.stats_reporting.enabled }}
+provider_address = '{{ core.debug.stats_reporting.provider_address }}'
+reporting_interval = '{{ core.debug.stats_reporting.reporting_interval }}'
+
 "#;
@@ -9,9 +9,25 @@ edition.workspace = true
 license.workspace = true

 [dependencies]
+base64 = { workspace = true }
 bincode = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }

+nym-credentials-interface = { path = "../credentials-interface" }
+nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-network-defaults = { path = "../network-defaults" }
+nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-wireguard-types = { path = "../wireguard-types" }
+
+## verify:
+hmac = { workspace = true, optional = true }
+sha2 = { workspace = true, optional = true }
+x25519-dalek = { workspace = true, features = ["static_secrets"] }
+
+[features]
+default = ["verify"]
+# this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
+verify = ["hmac", "sha2"]
@@ -0,0 +1,28 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("the provided base64-encoded client MAC ('{mac}') was malformed: {source}")]
+    MalformedClientMac {
+        mac: String,
+        #[source]
+        source: base64::DecodeError,
+    },
+
+    #[cfg(feature = "verify")]
+    #[error("failed to verify mac provided by '{client}': {source}")]
+    FailedClientMacVerification {
+        client: String,
+        #[source]
+        source: hmac::digest::MacError,
+    },
+
+    #[error("conversion: {0}")]
+    Conversion(String),
+
+    #[error("failed to serialize response packet: {source}")]
+    FailedToSerializeResponsePacket { source: Box<bincode::ErrorKind> },
+}
@@ -1,9 +1,18 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+pub mod traits;
 pub mod v1;
+pub mod v2;
+pub mod v3;
+pub mod v4;

-pub const CURRENT_VERSION: u8 = 1;
+mod error;
+
+pub use error::Error;
+pub use v4 as latest;
+
+pub const CURRENT_VERSION: u8 = 4;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -0,0 +1,343 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_crypto::asymmetric::x25519::PrivateKey;
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+
+use crate::{
+    v1, v2, v3,
+    v4::{self, registration::IpPair},
+    Error,
+};
+
+#[derive(Copy, Clone, Debug)]
+pub enum AuthenticatorVersion {
+    V1,
+    V2,
+    V3,
+    V4,
+    UNKNOWN,
+}
+
+impl From<Protocol> for AuthenticatorVersion {
+    fn from(value: Protocol) -> Self {
+        if value.service_provider_type != ServiceProviderType::Authenticator {
+            AuthenticatorVersion::UNKNOWN
+        } else if value.version == v1::VERSION {
+            AuthenticatorVersion::V1
+        } else if value.version == v2::VERSION {
+            AuthenticatorVersion::V2
+        } else if value.version == v3::VERSION {
+            AuthenticatorVersion::V3
+        } else if value.version == v4::VERSION {
+            AuthenticatorVersion::V4
+        } else {
+            AuthenticatorVersion::UNKNOWN
+        }
+    }
+}
+
+pub trait InitMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+}
+
+impl InitMessage for v1::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v2::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v3::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v4::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+pub trait FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
+    fn private_ips(&self) -> IpPair;
+    fn credential(&self) -> Option<CredentialSpendingData>;
+}
+
+impl FinalMessage for v1::GatewayClient {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        None
+    }
+}
+
+impl FinalMessage for v2::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+impl FinalMessage for v3::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+impl FinalMessage for v4::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ips
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+pub trait QueryBandwidthMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+}
+
+impl QueryBandwidthMessage for PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
+        *self
+    }
+}
+
+pub trait TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+    fn credential(&self) -> CredentialSpendingData;
+}
+
+impl TopUpMessage for v3::topup::TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn credential(&self) -> CredentialSpendingData {
+        self.credential.clone()
+    }
+}
+
+impl TopUpMessage for v4::topup::TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn credential(&self) -> CredentialSpendingData {
+        self.credential.clone()
+    }
+}
+
+pub enum AuthenticatorRequest {
+    Initial {
+        msg: Box<dyn InitMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    Final {
+        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    QueryBandwidth {
+        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    TopUpBandwidth {
+        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+}
+
+impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v1::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v1::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
+                msg: Box::new(gateway_client),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: Protocol {
+                        version: value.version,
+                        service_provider_type: ServiceProviderType::Authenticator,
+                    },
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v2::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v3::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v4::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
@@ -1,7 +1,13 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+pub mod registration;
 pub mod request;
 pub mod response;

-const VERSION: u8 = 1;
+pub use registration::{ClientMac, GatewayClient, InitMessage, Nonce};
+
+#[cfg(feature = "verify")]
+pub use registration::HmacSha256;
+
+pub const VERSION: u8 = 1;
@@ -0,0 +1,218 @@
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: i64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: u64,
+    pub suspended: bool,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -1,8 +1,9 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use super::registration::{GatewayClient, InitMessage};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::{GatewayClient, InitMessage, PeerPublicKey};
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};

 use crate::make_bincode_serializer;
@@ -82,3 +83,24 @@ pub enum AuthenticatorRequestData {
    Final(GatewayClient),
    QueryBandwidth(PeerPublicKey),
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_byte_version() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            version,
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = data.to_bytes().unwrap();
+        assert_eq!(*bytes.first().unwrap(), version);
+    }
+}
@@ -1,8 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use serde::{Deserialize, Serialize};

 use crate::make_bincode_serializer;
@@ -0,0 +1,174 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v1, v2};
+
+impl From<v1::request::AuthenticatorRequest> for v2::request::AuthenticatorRequest {
+    fn from(authenticator_request: v1::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v1::request::AuthenticatorRequestData> for v2::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v1::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v1::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v2::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v1::request::AuthenticatorRequestData::Final(gw_client) => {
+                v2::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v1::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v1::registration::InitMessage> for v2::registration::InitMessage {
+    fn from(init_msg: v1::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<v1::registration::GatewayClient> for Box<v2::registration::FinalMessage> {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Box::new(v2::registration::FinalMessage {
+            gateway_client: gw_client.into(),
+            credential: None,
+        })
+    }
+}
+
+impl From<v1::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v1::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v1::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v1::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::registration::ClientMac> for v1::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::response::AuthenticatorResponse> for v1::response::AuthenticatorResponse {
+    fn from(authenticator_response: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            version: authenticator_response.protocol.version,
+            data: authenticator_response.data.into(),
+            reply_to: authenticator_response.reply_to,
+        }
+    }
+}
+
+impl From<v2::response::AuthenticatorResponseData> for v1::response::AuthenticatorResponseData {
+    fn from(authenticator_response_data: v2::response::AuthenticatorResponseData) -> Self {
+        match authenticator_response_data {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => v1::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response.into(),
+            ),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                v1::response::AuthenticatorResponseData::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => v1::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            ),
+        }
+    }
+}
+
+impl From<v2::response::PendingRegistrationResponse> for v1::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RegisteredResponse> for v1::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RemainingBandwidthResponse> for v1::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v2::registration::RegistrationData> for v1::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RemainingBandwidthData> for v1::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth as u64,
+            suspended: false,
+        }
+    }
+}
@@ -0,0 +1,9 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+
+pub const VERSION: u8 = 2;
@@ -1,11 +1,12 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::Error;
-use crate::PeerPublicKey;
 use base64::{engine::general_purpose, Engine};
-use dashmap::DashMap;
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
 use std::net::IpAddr;
 use std::time::SystemTime;
 use std::{fmt, ops::Deref, str::FromStr};
@@ -17,9 +18,8 @@ use nym_crypto::asymmetric::encryption::PrivateKey;
 #[cfg(feature = "verify")]
 use sha2::Sha256;

-pub type GatewayClientRegistry = DashMap<PeerPublicKey, GatewayClient>;
-pub type PendingRegistrations = DashMap<PeerPublicKey, RegistrationData>;
-pub type PrivateIPs = DashMap<IpAddr, Taken>;
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;

 #[cfg(feature = "verify")]
 pub type HmacSha256 = Hmac<Sha256>;
@@ -30,32 +30,26 @@ pub type Taken = Option<SystemTime>;
 pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB

 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
-pub enum ClientMessage {
-    Initial(InitMessage),
-    Final(GatewayClient),
-    Query(PeerPublicKey),
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct InitMessage {
    /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub pub_key: PeerPublicKey,
 }

 impl InitMessage {
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
    pub fn new(pub_key: PeerPublicKey) -> Self {
        InitMessage { pub_key }
    }
 }

+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RegistrationData {
    pub nonce: u64,
@@ -72,24 +66,20 @@ pub struct RegistredData {

 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RemainingBandwidthData {
-    pub available_bandwidth: u64,
-    pub suspended: bool,
+    pub available_bandwidth: i64,
 }

 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct GatewayClient {
    /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub pub_key: PeerPublicKey,

    /// Assigned private IP
    pub private_ip: IpAddr,

    /// Sha256 hmac on the data (alongside the prior nonce)
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub mac: ClientMac,
 }

@@ -0,0 +1,116 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{FinalMessage, InitMessage};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,129 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
@@ -0,0 +1,272 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3};
+
+impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    fn from(authenticator_request: v2::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v2::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v2::request::AuthenticatorRequestData::Final(gw_client) => {
+                v3::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v2::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
+    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
+        Box::new(v3::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v3::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl From<v2::response::AuthenticatorResponse> for v3::response::AuthenticatorResponse {
+    fn from(value: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            protocol: value.protocol,
+            data: value.data.into(),
+            reply_to: value.reply_to,
+        }
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v2::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v2::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v2 request couldn't produce a v3 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v2::response::AuthenticatorResponseData> for v3::response::AuthenticatorResponseData {
+    fn from(value: v2::response::AuthenticatorResponseData) -> Self {
+        match value {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Self::PendingRegistration(pending_registration_response.into()),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                Self::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Self::RemainingBandwidth(remaining_bandwidth_response.into()),
+        }
+    }
+}
+
+impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
+    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::PendingRegistrationResponse> for v3::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RegisteredResponse> for v3::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v2::response::RemainingBandwidthResponse> for v3::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
+    fn from(value: v3::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistrationData> for v3::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
+
+impl From<v2::registration::RemainingBandwidthData> for v3::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 3;
@@ -0,0 +1,227 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 250 * 1024 * 1024 * 1024; // 250 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -0,0 +1,136 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}
@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}
@@ -0,0 +1,232 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3, v4};
+
+impl From<v3::request::AuthenticatorRequest> for v4::request::AuthenticatorRequest {
+    fn from(authenticator_request: v3::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v3::request::AuthenticatorRequestData> for v4::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v3::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v3::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v4::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v3::request::AuthenticatorRequestData::Final(gw_client) => {
+                v4::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into())
+            }
+        }
+    }
+}
+
+impl From<v3::registration::InitMessage> for v4::registration::InitMessage {
+    fn from(init_msg: v3::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v3::registration::FinalMessage>> for Box<v4::registration::FinalMessage> {
+    fn from(gw_client: Box<v3::registration::FinalMessage>) -> Self {
+        Box::new(v4::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<Box<v3::topup::TopUpMessage>> for Box<v4::topup::TopUpMessage> {
+    fn from(top_up_message: Box<v3::topup::TopUpMessage>) -> Self {
+        Box::new(v4::topup::TopUpMessage {
+            pub_key: top_up_message.pub_key,
+            credential: top_up_message.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v4::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ips: gw_client.private_ip.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v4::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ips: gw_client.private_ip.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v4::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v4::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ips.ipv4.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v4::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v4::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ips.ipv4.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v4::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v4::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v4::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v4::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v4::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v4::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v4::response::AuthenticatorResponse> for v3::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v4::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v4::response::AuthenticatorResponseData> for v3::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v4::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v4::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v3::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v4::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v3::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v4::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v4::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v3 request couldn't produce a v4 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v4::response::PendingRegistrationResponse> for v3::response::PendingRegistrationResponse {
+    fn from(value: v4::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::RegisteredResponse> for v3::response::RegisteredResponse {
+    fn from(value: v4::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::RemainingBandwidthResponse> for v3::response::RemainingBandwidthResponse {
+    fn from(value: v4::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v4::registration::RegistrationData> for v3::registration::RegistrationData {
+    fn from(value: v4::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ips.ipv4.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::registration::RemainingBandwidthData> for v3::registration::RemainingBandwidthData {
+    fn from(value: v4::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 4;
@@ -0,0 +1,287 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpPair, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct IpPair {
+    pub ipv4: Ipv4Addr,
+    pub ipv6: Ipv6Addr,
+}
+
+impl IpPair {
+    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
+    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl fmt::Display for IpPair {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "({}, {})", self.ipv4, self.ipv6)
+    }
+}
+
+impl From<IpAddr> for IpPair {
+    fn from(value: IpAddr) -> Self {
+        let (before_last_byte, last_byte) = match value {
+            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
+            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
+        };
+        let last_bytes = (before_last_byte as u16) << 8 | last_byte as u16;
+        let ipv4 = Ipv4Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
+            before_last_byte,
+            last_byte,
+        );
+        let ipv6 = Ipv6Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
+            last_bytes,
+        );
+        IpPair::new(ipv4, ipv6)
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ips: IpPair,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IPs (v4 and v6)
+    pub private_ips: IpPair,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ips: IpPair,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ips,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    fn create_ip_pair() {
+        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
+        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
+
+        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
+    }
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}
@@ -0,0 +1,136 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 4;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}
@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}
@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}
@@ -14,12 +14,14 @@ thiserror = { workspace = true }
 url = { workspace = true }
 zeroize = { workspace = true }

-nym-coconut = { path = "../nymcoconut" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
+nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
+nym-ecash-time = { path = "../ecash-time" }
 nym-network-defaults = { path = "../network-defaults" }
+nym-task = { path = "../task" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
--- a/Show More
+++ b/Show More