Revert "Merge pull request #4370 from nymtech/jon/reply-on-ipr-version-incompat"

This reverts commit a8dc703399, reversing changes made to e09986e505.
2024-02-08 21:01:10 +02:00
478 changed files with 19682 additions and 63842 deletions
@@ -14,20 +14,12 @@ inputs:
    description: 'The tag/release to process. Uses the release id when trigger from a release.'
    required: false
    default: ''
-  repo:
-    description: 'The repo to use. Defaults to "nym".'
-    required: false
-    default: 'nym'
-  owner:
-    description: 'The repo owner to use. Defaults to "nymtech".'
-    required: false
-    default: 'nymtech'
 outputs:
  hashes:
    description: 'A string containing JSON with the release asset hashes and signatures'
 runs:
-  using: 'node20'
-  main: 'dist/index.js'
+  using: 'node16'
+  main: 'index.js'
 branding:
  icon: 'hash'
  color: 'green'
@@ -11,14 +11,10 @@ function getBinInfo(path) {
        let mode = fs.statSync(path).mode
        fs.chmodSync(path, mode | 0o111)

-        const cmd = `${path} build-info --output=json`;
-        console.log(`🚚 Running ${cmd}... (for max of 3 seconds, then SIGTERM)`);
-        const raw = execSync(cmd, { stdio: 'pipe', encoding: "utf8", timeout: 3000 });
+        const raw = execSync(`${path} build-info --output=json`, { stdio: 'pipe', encoding: "utf8" });
        const parsed = JSON.parse(raw)
-        console.log(`    ✅ ok`);
        return parsed
    } catch (_) {
-        console.log(`    ❌ failed`);
        return undefined
    }
 }
@@ -28,11 +24,8 @@ async function run(assets, algorithm, filename, cache) {
        console.warn("cache is set to 'false', but we we no longer support it")
    }

-    const directory = path.join(process.env.RUNNER_TEMP || '.tmp', process.env.GITHUB_RUN_ID || '');
-    console.log('Temporary directory: ', directory);
-
    try {
-        fs.mkdirSync(directory, { recursive: true });
+        fs.mkdirSync('.tmp');
    } catch(e) {
        // ignore
    }
@@ -47,13 +40,13 @@ async function run(assets, algorithm, filename, cache) {
            let sig = null;

            // cache in `${WORKING_DIR}/.tmp/`
-            const cacheFilename = path.join(directory, `${asset.name}`);
+            const cacheFilename = path.resolve(`.tmp/${asset.name}`);
            if(!fs.existsSync(cacheFilename)) {
-                console.log(`⬇️ Downloading ${asset.browser_download_url}... to ${cacheFilename} [${numAwaiting} of ${assets.length}]`);
+                console.log(`Downloading ${asset.browser_download_url}... to ${cacheFilename}`);
                buffer = Buffer.from(await fetch(asset.browser_download_url).then(res => res.arrayBuffer()));
                fs.writeFileSync(cacheFilename, buffer);
            } else {
-                console.log(`💾 Loading from ${cacheFilename}`);
+                console.log(`Loading from ${cacheFilename}`);
                buffer = Buffer.from(fs.readFileSync(cacheFilename));

                // console.log('Reading signature from content');
@@ -138,7 +131,6 @@ async function run(assets, algorithm, filename, cache) {
            }
        }
    }
-    console.log(`Completed hashing ${assets.length} files`);
    return hashes;
 }

@@ -150,7 +142,7 @@ export async function createHashes({ assets, algorithm, filename, cache }) {
    return output;
 }

-export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true, owner = 'nymtech', repo = 'nym' }) {
+export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true }) {
    console.log("🚀🚀🚀 Getting releases");

    let auth;
@@ -165,6 +157,8 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
        auth: process.env.GITHUB_TOKEN,
        request: { fetch }
    });
+    const owner = "nymtech";
+    const repo = "nym";

    let releases;
    if(cache) {
@@ -218,14 +212,7 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI

    releasesToProcess.forEach(release => {
        const {tag_name, name} = release;
-        const matches = tag_name.match(/(\S+)-v([0-9]+\.[0-9]+(\.\S+)?)/);
-
-        if(!matches || matches.length < 2) {
-            console.warn('Could not match version structure in tag name = ', tag_name);
-            return;
-        }
-
-        const tagComponents = matches.slice(1);
+        const tagComponents = tag_name.split('-v');
        const componentName = tagComponents[0];
        const componentVersion = 'v' + tagComponents[1];

@@ -1,450 +0,0 @@
-export const id = 37;
-export const ids = [37];
-export const modules = {
-
-/***/ 4037:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-__webpack_require__.r(__webpack_exports__);
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   "toFormData": () => (/* binding */ toFormData)
-/* harmony export */ });
-/* harmony import */ var fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2777);
-/* harmony import */ var formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8010);
-
-
-
-let s = 0;
-const S = {
-	START_BOUNDARY: s++,
-	HEADER_FIELD_START: s++,
-	HEADER_FIELD: s++,
-	HEADER_VALUE_START: s++,
-	HEADER_VALUE: s++,
-	HEADER_VALUE_ALMOST_DONE: s++,
-	HEADERS_ALMOST_DONE: s++,
-	PART_DATA_START: s++,
-	PART_DATA: s++,
-	END: s++
-};
-
-let f = 1;
-const F = {
-	PART_BOUNDARY: f,
-	LAST_BOUNDARY: f *= 2
-};
-
-const LF = 10;
-const CR = 13;
-const SPACE = 32;
-const HYPHEN = 45;
-const COLON = 58;
-const A = 97;
-const Z = 122;
-
-const lower = c => c | 0x20;
-
-const noop = () => {};
-
-class MultipartParser {
-	/**
-	 * @param {string} boundary
-	 */
-	constructor(boundary) {
-		this.index = 0;
-		this.flags = 0;
-
-		this.onHeaderEnd = noop;
-		this.onHeaderField = noop;
-		this.onHeadersEnd = noop;
-		this.onHeaderValue = noop;
-		this.onPartBegin = noop;
-		this.onPartData = noop;
-		this.onPartEnd = noop;
-
-		this.boundaryChars = {};
-
-		boundary = '\r\n--' + boundary;
-		const ui8a = new Uint8Array(boundary.length);
-		for (let i = 0; i < boundary.length; i++) {
-			ui8a[i] = boundary.charCodeAt(i);
-			this.boundaryChars[ui8a[i]] = true;
-		}
-
-		this.boundary = ui8a;
-		this.lookbehind = new Uint8Array(this.boundary.length + 8);
-		this.state = S.START_BOUNDARY;
-	}
-
-	/**
-	 * @param {Uint8Array} data
-	 */
-	write(data) {
-		let i = 0;
-		const length_ = data.length;
-		let previousIndex = this.index;
-		let {lookbehind, boundary, boundaryChars, index, state, flags} = this;
-		const boundaryLength = this.boundary.length;
-		const boundaryEnd = boundaryLength - 1;
-		const bufferLength = data.length;
-		let c;
-		let cl;
-
-		const mark = name => {
-			this[name + 'Mark'] = i;
-		};
-
-		const clear = name => {
-			delete this[name + 'Mark'];
-		};
-
-		const callback = (callbackSymbol, start, end, ui8a) => {
-			if (start === undefined || start !== end) {
-				this[callbackSymbol](ui8a && ui8a.subarray(start, end));
-			}
-		};
-
-		const dataCallback = (name, clear) => {
-			const markSymbol = name + 'Mark';
-			if (!(markSymbol in this)) {
-				return;
-			}
-
-			if (clear) {
-				callback(name, this[markSymbol], i, data);
-				delete this[markSymbol];
-			} else {
-				callback(name, this[markSymbol], data.length, data);
-				this[markSymbol] = 0;
-			}
-		};
-
-		for (i = 0; i < length_; i++) {
-			c = data[i];
-
-			switch (state) {
-				case S.START_BOUNDARY:
-					if (index === boundary.length - 2) {
-						if (c === HYPHEN) {
-							flags |= F.LAST_BOUNDARY;
-						} else if (c !== CR) {
-							return;
-						}
-
-						index++;
-						break;
-					} else if (index - 1 === boundary.length - 2) {
-						if (flags & F.LAST_BOUNDARY && c === HYPHEN) {
-							state = S.END;
-							flags = 0;
-						} else if (!(flags & F.LAST_BOUNDARY) && c === LF) {
-							index = 0;
-							callback('onPartBegin');
-							state = S.HEADER_FIELD_START;
-						} else {
-							return;
-						}
-
-						break;
-					}
-
-					if (c !== boundary[index + 2]) {
-						index = -2;
-					}
-
-					if (c === boundary[index + 2]) {
-						index++;
-					}
-
-					break;
-				case S.HEADER_FIELD_START:
-					state = S.HEADER_FIELD;
-					mark('onHeaderField');
-					index = 0;
-					// falls through
-				case S.HEADER_FIELD:
-					if (c === CR) {
-						clear('onHeaderField');
-						state = S.HEADERS_ALMOST_DONE;
-						break;
-					}
-
-					index++;
-					if (c === HYPHEN) {
-						break;
-					}
-
-					if (c === COLON) {
-						if (index === 1) {
-							// empty header field
-							return;
-						}
-
-						dataCallback('onHeaderField', true);
-						state = S.HEADER_VALUE_START;
-						break;
-					}
-
-					cl = lower(c);
-					if (cl < A || cl > Z) {
-						return;
-					}
-
-					break;
-				case S.HEADER_VALUE_START:
-					if (c === SPACE) {
-						break;
-					}
-
-					mark('onHeaderValue');
-					state = S.HEADER_VALUE;
-					// falls through
-				case S.HEADER_VALUE:
-					if (c === CR) {
-						dataCallback('onHeaderValue', true);
-						callback('onHeaderEnd');
-						state = S.HEADER_VALUE_ALMOST_DONE;
-					}
-
-					break;
-				case S.HEADER_VALUE_ALMOST_DONE:
-					if (c !== LF) {
-						return;
-					}
-
-					state = S.HEADER_FIELD_START;
-					break;
-				case S.HEADERS_ALMOST_DONE:
-					if (c !== LF) {
-						return;
-					}
-
-					callback('onHeadersEnd');
-					state = S.PART_DATA_START;
-					break;
-				case S.PART_DATA_START:
-					state = S.PART_DATA;
-					mark('onPartData');
-					// falls through
-				case S.PART_DATA:
-					previousIndex = index;
-
-					if (index === 0) {
-						// boyer-moore derrived algorithm to safely skip non-boundary data
-						i += boundaryEnd;
-						while (i < bufferLength && !(data[i] in boundaryChars)) {
-							i += boundaryLength;
-						}
-
-						i -= boundaryEnd;
-						c = data[i];
-					}
-
-					if (index < boundary.length) {
-						if (boundary[index] === c) {
-							if (index === 0) {
-								dataCallback('onPartData', true);
-							}
-
-							index++;
-						} else {
-							index = 0;
-						}
-					} else if (index === boundary.length) {
-						index++;
-						if (c === CR) {
-							// CR = part boundary
-							flags |= F.PART_BOUNDARY;
-						} else if (c === HYPHEN) {
-							// HYPHEN = end boundary
-							flags |= F.LAST_BOUNDARY;
-						} else {
-							index = 0;
-						}
-					} else if (index - 1 === boundary.length) {
-						if (flags & F.PART_BOUNDARY) {
-							index = 0;
-							if (c === LF) {
-								// unset the PART_BOUNDARY flag
-								flags &= ~F.PART_BOUNDARY;
-								callback('onPartEnd');
-								callback('onPartBegin');
-								state = S.HEADER_FIELD_START;
-								break;
-							}
-						} else if (flags & F.LAST_BOUNDARY) {
-							if (c === HYPHEN) {
-								callback('onPartEnd');
-								state = S.END;
-								flags = 0;
-							} else {
-								index = 0;
-							}
-						} else {
-							index = 0;
-						}
-					}
-
-					if (index > 0) {
-						// when matching a possible boundary, keep a lookbehind reference
-						// in case it turns out to be a false lead
-						lookbehind[index - 1] = c;
-					} else if (previousIndex > 0) {
-						// if our boundary turned out to be rubbish, the captured lookbehind
-						// belongs to partData
-						const _lookbehind = new Uint8Array(lookbehind.buffer, lookbehind.byteOffset, lookbehind.byteLength);
-						callback('onPartData', 0, previousIndex, _lookbehind);
-						previousIndex = 0;
-						mark('onPartData');
-
-						// reconsider the current character even so it interrupted the sequence
-						// it could be the beginning of a new sequence
-						i--;
-					}
-
-					break;
-				case S.END:
-					break;
-				default:
-					throw new Error(`Unexpected state entered: ${state}`);
-			}
-		}
-
-		dataCallback('onHeaderField');
-		dataCallback('onHeaderValue');
-		dataCallback('onPartData');
-
-		// Update properties for the next call
-		this.index = index;
-		this.state = state;
-		this.flags = flags;
-	}
-
-	end() {
-		if ((this.state === S.HEADER_FIELD_START && this.index === 0) ||
-			(this.state === S.PART_DATA && this.index === this.boundary.length)) {
-			this.onPartEnd();
-		} else if (this.state !== S.END) {
-			throw new Error('MultipartParser.end(): stream ended unexpectedly');
-		}
-	}
-}
-
-function _fileName(headerValue) {
-	// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
-	const m = headerValue.match(/\bfilename=("(.*?)"|([^()<>@,;:\\"/[\]?={}\s\t]+))($|;\s)/i);
-	if (!m) {
-		return;
-	}
-
-	const match = m[2] || m[3] || '';
-	let filename = match.slice(match.lastIndexOf('\\') + 1);
-	filename = filename.replace(/%22/g, '"');
-	filename = filename.replace(/&#(\d{4});/g, (m, code) => {
-		return String.fromCharCode(code);
-	});
-	return filename;
-}
-
-async function toFormData(Body, ct) {
-	if (!/multipart/i.test(ct)) {
-		throw new TypeError('Failed to fetch');
-	}
-
-	const m = ct.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
-
-	if (!m) {
-		throw new TypeError('no or bad content-type header, no multipart boundary');
-	}
-
-	const parser = new MultipartParser(m[1] || m[2]);
-
-	let headerField;
-	let headerValue;
-	let entryValue;
-	let entryName;
-	let contentType;
-	let filename;
-	const entryChunks = [];
-	const formData = new formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__/* .FormData */ .Ct();
-
-	const onPartData = ui8a => {
-		entryValue += decoder.decode(ui8a, {stream: true});
-	};
-
-	const appendToFile = ui8a => {
-		entryChunks.push(ui8a);
-	};
-
-	const appendFileToFormData = () => {
-		const file = new fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__/* .File */ .$B(entryChunks, filename, {type: contentType});
-		formData.append(entryName, file);
-	};
-
-	const appendEntryToFormData = () => {
-		formData.append(entryName, entryValue);
-	};
-
-	const decoder = new TextDecoder('utf-8');
-	decoder.decode();
-
-	parser.onPartBegin = function () {
-		parser.onPartData = onPartData;
-		parser.onPartEnd = appendEntryToFormData;
-
-		headerField = '';
-		headerValue = '';
-		entryValue = '';
-		entryName = '';
-		contentType = '';
-		filename = null;
-		entryChunks.length = 0;
-	};
-
-	parser.onHeaderField = function (ui8a) {
-		headerField += decoder.decode(ui8a, {stream: true});
-	};
-
-	parser.onHeaderValue = function (ui8a) {
-		headerValue += decoder.decode(ui8a, {stream: true});
-	};
-
-	parser.onHeaderEnd = function () {
-		headerValue += decoder.decode();
-		headerField = headerField.toLowerCase();
-
-		if (headerField === 'content-disposition') {
-			// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
-			const m = headerValue.match(/\bname=("([^"]*)"|([^()<>@,;:\\"/[\]?={}\s\t]+))/i);
-
-			if (m) {
-				entryName = m[2] || m[3] || '';
-			}
-
-			filename = _fileName(headerValue);
-
-			if (filename) {
-				parser.onPartData = appendToFile;
-				parser.onPartEnd = appendFileToFormData;
-			}
-		} else if (headerField === 'content-type') {
-			contentType = headerValue;
-		}
-
-		headerValue = '';
-		headerField = '';
-	};
-
-	for await (const chunk of Body) {
-		parser.write(chunk);
-	}
-
-	parser.end();
-
-	return formData;
-}
-
-
-/***/ })
-
-};
@@ -1,57 +0,0 @@
-'use strict';
-const fs = require('fs');
-const crypto = require('crypto');
-const {parentPort} = require('worker_threads');
-
-const handlers = {
-	hashFile: (algorithm, filePath) => new Promise((resolve, reject) => {
-		const hasher = crypto.createHash(algorithm);
-		fs.createReadStream(filePath)
-			// TODO: Use `Stream.pipeline` when targeting Node.js 12.
-			.on('error', reject)
-			.pipe(hasher)
-			.on('error', reject)
-			.on('finish', () => {
-				const {buffer} = new Uint8Array(hasher.read());
-				resolve({value: buffer, transferList: [buffer]});
-			});
-	}),
-	hash: async (algorithm, input) => {
-		const hasher = crypto.createHash(algorithm);
-
-		if (Array.isArray(input)) {
-			for (const part of input) {
-				hasher.update(part);
-			}
-		} else {
-			hasher.update(input);
-		}
-
-		const {buffer} = new Uint8Array(hasher.digest());
-		return {value: buffer, transferList: [buffer]};
-	}
-};
-
-parentPort.on('message', async message => {
-	try {
-		const {method, args} = message;
-		const handler = handlers[method];
-
-		if (handler === undefined) {
-			throw new Error(`Unknown method '${method}'`);
-		}
-
-		const {value, transferList} = await handler(...args);
-		parentPort.postMessage({id: message.id, value}, transferList);
-	} catch (error) {
-		const newError = {message: error.message, stack: error.stack};
-
-		for (const [key, value] of Object.entries(error)) {
-			if (typeof value !== 'object') {
-				newError[key] = value;
-			}
-		}
-
-		parentPort.postMessage({id: message.id, error: newError});
-	}
-});
@@ -0,0 +1,15 @@
+import core from "@actions/core";
+import github from "@actions/github";
+import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
+
+const algorithm = core.getInput('hash-type');
+const filename = core.getInput("file-name");
+
+// use the release id from the payload if it is set
+const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
+
+try {
+    await createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm, filename  })
+} catch (error) {
+    core.setFailed(error.message);
+}
@@ -1,28 +1,26 @@
 {
-  "name": "nym-hash-release",
+  "name": "ghaction-generate-release-hashes",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
-      "name": "nym-hash-release",
+      "name": "ghaction-generate-release-hashes",
      "version": "1.0.0",
+      "license": "MIT",
      "dependencies": {
-        "@actions/core": "^1.10.1",
+        "@actions/core": "^1.10.0",
        "@actions/github": "^5.1.1",
-        "@octokit/auth-action": "^4.0.1",
-        "@octokit/rest": "^20.0.2",
+        "@octokit/auth-action": "^4.0.0",
+        "@octokit/rest": "^20.0.1",
        "hasha": "^5.2.0",
        "node-fetch": "^3.2.10"
-      },
-      "devDependencies": {
-        "@vercel/ncc": "^0.38.1"
      }
    },
    "node_modules/@actions/core": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
-      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
      "dependencies": {
        "@actions/http-client": "^2.0.1",
        "uuid": "^8.3.2"
@@ -48,12 +46,12 @@
      }
    },
    "node_modules/@octokit/auth-action": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.1.tgz",
-      "integrity": "sha512-mJLOcFFafIivLZ7BEkGDCTFoHPJv7BeL5Zwy7j5qMDU0b/DKshhi6GCU9tw3vmKhOxTNquYfvwqsEfPpemaaxg==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.0.tgz",
+      "integrity": "sha512-sMm9lWZdiX6e89YFaLrgE9EFs94k58BwIkvjOtozNWUqyTmsrnWFr/M5LolaRzZ7Kmb5FbhF9hi7FEeE274SoQ==",
      "dependencies": {
        "@octokit/auth-token": "^4.0.0",
-        "@octokit/types": "^12.0.0"
+        "@octokit/types": "^11.0.0"
      },
      "engines": {
        "node": ">= 18"
@@ -68,16 +66,16 @@
      }
    },
    "node_modules/@octokit/auth-action/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+      "version": "18.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
+      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
    },
    "node_modules/@octokit/auth-action/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
+      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/openapi-types": "^18.0.0"
      }
    },
    "node_modules/@octokit/auth-token": {
@@ -193,14 +191,14 @@
      }
    },
    "node_modules/@octokit/rest": {
-      "version": "20.0.2",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.2.tgz",
-      "integrity": "sha512-Ux8NDgEraQ/DMAU1PlAohyfBBXDwhnX2j33Z1nJNziqAfHi70PuxkFYIcIt8aIAxtRE7KVuKp8lSR8pA0J5iOQ==",
+      "version": "20.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.1.tgz",
+      "integrity": "sha512-wROV21RwHQIMNb2Dgd4+pY+dVy1Dwmp85pBrgr6YRRDYRBu9Gb+D73f4Bl2EukZSj5hInq2Tui9o7gAQpc2k2Q==",
      "dependencies": {
        "@octokit/core": "^5.0.0",
-        "@octokit/plugin-paginate-rest": "^9.0.0",
+        "@octokit/plugin-paginate-rest": "^8.0.0",
        "@octokit/plugin-request-log": "^4.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
+        "@octokit/plugin-rest-endpoint-methods": "^9.0.0"
      },
      "engines": {
        "node": ">= 18"
@@ -263,30 +261,17 @@
      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
    },
    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.1.tgz",
-      "integrity": "sha512-wfGhE/TAkXZRLjksFXuDZdmGnJQHvtU/joFQdweXUgzo1XwvBCD4o4+75NtFfjfLK5IwLf9vHTfSiU3sLRYpRw==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-8.0.0.tgz",
+      "integrity": "sha512-2xZ+baZWUg+qudVXnnvXz7qfrTmDeYPCzangBVq/1gXxii/OiS//4shJp9dnCCvj1x+JAm9ji1Egwm1BA47lPQ==",
      "dependencies": {
-        "@octokit/types": "^12.6.0"
+        "@octokit/types": "^11.0.0"
      },
      "engines": {
        "node": ">= 18"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
-    },
-    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/core": ">=5"
      }
    },
    "node_modules/@octokit/rest/node_modules/@octokit/plugin-request-log": {
@@ -301,30 +286,17 @@
      }
    },
    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
-      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-9.0.0.tgz",
+      "integrity": "sha512-KquMF/VB1IkKNiVnzJKspY5mFgGyLd7HzdJfVEGTJFzqu9BRFNWt+nwTCMuUiWc72gLQhRWYubTwOkQj+w/1PA==",
      "dependencies": {
-        "@octokit/types": "^12.6.0"
+        "@octokit/types": "^11.0.0"
      },
      "engines": {
        "node": ">= 18"
      },
      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
-    },
-    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "@octokit/core": ">=5"
      }
    },
    "node_modules/@octokit/rest/node_modules/@octokit/request": {
@@ -371,15 +343,6 @@
        "@octokit/openapi-types": "^12.11.0"
      }
    },
-    "node_modules/@vercel/ncc": {
-      "version": "0.38.1",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.1.tgz",
-      "integrity": "sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==",
-      "dev": true,
-      "bin": {
-        "ncc": "dist/ncc/cli.js"
-      }
-    },
    "node_modules/before-after-hook": {
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
@@ -2,6 +2,17 @@
  "name": "nym-hash-release",
  "version": "1.0.0",
  "description": "Generate hashes and signatures for assets in Nym releases",
-  "main": "dist/index.js",
-  "type": "module"
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "local": "node run-local.mjs"
+  },
+  "dependencies": {
+    "@actions/core": "^1.10.0",
+    "@actions/github": "^5.1.1",
+    "@octokit/auth-action": "^4.0.0",
+    "@octokit/rest": "^20.0.1",
+    "hasha": "^5.2.0",
+    "node-fetch": "^3.2.10"
+  }
 }
@@ -0,0 +1,6 @@
+import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
+
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});
@@ -1,14 +0,0 @@
-# nym-hash-release
-
-This is the source code for the custom GitHub Action to calculate hashes.
-
-It is in a subdirectory to avoid issues with `package.json`.
-
-## Build
-
-The following will bundle all code and dependencies into the `dist` folder, and copy it into place for GitHub Actions.
-
-```
-npm run build
-npm run dist:copy
-```
@@ -1,21 +0,0 @@
-import core from "@actions/core";
-import github from "@actions/github";
-import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
-
-const algorithm = core.getInput('hash-type');
-const filename = core.getInput("file-name");
-const owner = core.getInput("owner");
-const repo = core.getInput("repo");
-
-async function main() {
-// use the release id from the payload if it is set
-    const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
-
-    try {
-        await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId, algorithm, filename, owner, repo})
-    } catch (error) {
-        core.setFailed(error.message);
-    }
-}
-
-main().catch(error => core.setFailed(error.message));
@@ -1,23 +0,0 @@
-{
-  "name": "nym-hash-release",
-  "version": "1.0.0",
-  "description": "Generate hashes and signatures for assets in Nym releases",
-  "main": "index.js",
-  "type": "module",
-  "scripts": {
-    "local": "node run-local.mjs",
-    "build": "ncc build index.js -o dist",
-    "dist:copy": "mkdir -p ../dist && cp dist/*.js ../dist"
-  },
-  "dependencies": {
-    "@actions/core": "^1.10.1",
-    "@actions/github": "^5.1.1",
-    "@octokit/auth-action": "^4.0.1",
-    "@octokit/rest": "^20.0.2",
-    "hasha": "^5.2.0",
-    "node-fetch": "^3.2.10"
-  },
-  "devDependencies": {
-    "@vercel/ncc": "^0.38.1"
-  }
-}
@@ -1,11 +0,0 @@
-import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
-
-const cache = true;
-
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-binaries-v2024.1-marabou', cache, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-vpn-desktop-v0.0.8', cache, upload: false, repo: 'nym-vpn-client'});
-
-// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
-// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
-// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
-// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});
@@ -0,0 +1,61 @@
+name: build-upload-binaries
+
+on:
+  workflow_dispatch:
+    inputs:
+      add_tokio_unstable:
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  NETWORK: mainnet
+
+jobs:
+  publish-nym:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-20.04]
+
+    runs-on: ${{ matrix.platform }}
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
+        continue-on-error: true
+
+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        run: |
+          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Build all binaries
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --release
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: nym-binaries-artifacts
+          path: |
+            target/release/nym-client
+            target/release/nym-gateway
+            target/release/nym-mixnode
+            target/release/nym-socks5-client
+            target/release/nym-api
+            target/release/nym-network-requester
+            target/release/nym-network-statistics
+            target/release/nym-cli
+          retention-days: 30
@@ -2,24 +2,6 @@ name: ci-build-upload-binaries

 on:
  workflow_dispatch:
-    inputs:
-      add_tokio_unstable:
-        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
-        required: true
-        default: false
-        type: boolean
-      enable_wireguard:
-        description: "Add --features wireguard"
-        required: true
-        default: false
-        type: boolean
-      enable_deb:
-        description: "True to enable cargo-deb installation and .deb package building"
-        required: false
-        default: false
-        type: boolean
-  schedule:
-    - cron: "14 0 * * *"
  pull_request:
    paths:
      - "clients/**"
@@ -28,14 +10,12 @@ on:
      - "gateway/**"
      - "integrations/**"
      - "mixnode/**"
-      - "nym-api/**"
-      - "nym-node/**"
-      - "nym-outfox/**"
-      - "nym-validator-rewarder/**"
      - "sdk/rust/nym-sdk/**"
      - "service-providers/**"
-      - "tools/**"
-      - "nymvisor/**"
+      - "nym-api/**"
+      - "nym-outfox/**"
+      - "tools/nym-cli/**"
+      - "tools/ts-rs-cli/**"

 jobs:
  publish-nym:
@@ -62,18 +42,6 @@ jobs:
      - name: Install Dependencies (Linux)
        run: sudo apt update && sudo apt install libudev-dev

-      - name: Sets env vars for tokio if set in manual dispatch inputs
-        run: |
-          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
-        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
-
-      - name: Set CARGO_FEATURES
-        run: |
-          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-        if: >
-          github.event_name == 'schedule' ||
-          (github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true)
-
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -83,41 +51,19 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --release ${{ env.CARGO_FEATURES }}
+          args: --workspace --release

      - name: Install cargo-deb
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: cargo-deb
-        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true

      - name: Build deb packages
        shell: bash
        run: make deb
-        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
-
-      - name: Upload Artifact
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v3
-        with:
-          name: nym-binaries-artifacts
-          path: |
-            target/release/nym-client
-            target/release/nym-gateway
-            target/release/nym-mixnode
-            target/release/nym-socks5-client
-            target/release/nym-api
-            target/release/nym-network-requester
-            target/release/nym-network-statistics
-            target/release/nym-cli
-            target/release/nymvisor
-          retention-days: 30
-
-      # If this was a pull_request or nightly, upload to build server

      - name: Prepare build output
-        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
        shell: bash
        env:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
@@ -129,12 +75,9 @@ jobs:
          cp target/release/nym-api $OUTPUT_DIR
          cp target/release/nym-network-requester $OUTPUT_DIR
          cp target/release/nym-network-statistics $OUTPUT_DIR
-          cp target/release/nymvisor $OUTPUT_DIR
          cp target/release/nym-cli $OUTPUT_DIR
          cp target/release/explorer-api $OUTPUT_DIR
-          if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
-            cp target/debian/*.deb $OUTPUT_DIR
-          fi
+          cp target/debian/*.deb $OUTPUT_DIR

      - name: Deploy branch to CI www
        continue-on-error: true
@@ -1,4 +1,4 @@
-name: publish-nym-binaries
+name: Publish Nym binaries

 on:
  workflow_dispatch:
@@ -29,7 +29,6 @@ jobs:
      client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
      mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
      gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
-      nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
      socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
      netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
      cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -37,7 +36,6 @@ jobs:
      client_version: ${{ steps.binary-versions.outputs.client_version }}
      mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
      gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
-      nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
      socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
      netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
      cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -80,7 +78,6 @@ jobs:
            target/release/nym-network-requester
            target/release/nym-network-statistics
            target/release/nym-cli
-            target/release/nymvisor
          retention-days: 30

      - id: create-release
@@ -98,7 +95,6 @@ jobs:
            target/release/nym-network-requester
            target/release/nym-network-statistics
            target/release/nym-cli
-            target/release/nymvisor

  push-release-data-client:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
@@ -1,4 +1,4 @@
-name: publish-nym-connect-macos
+name: Publish Nym Connect - desktop (MacOS)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-connect-ubuntu
+name: Publish Nym Connect - desktop (Ubuntu)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-connect-win10
+name: Publish Nym Connect - desktop (Windows 10)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-contracts
+name: Build release of Nym smart contracts
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-wallet-macos
+name: Publish Nym Wallet (MacOS)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-wallet-ubuntu
+name: Publish Nym Wallet (Ubuntu)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-nym-wallet-win10
+name: Publish Nym Wallet (Windows 10)
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: publish-sdk-npm
+name: Publish Typescript SDK
 on:
  workflow_dispatch:

@@ -1,4 +1,4 @@
-name: release-calculate-hash
+name: Releases - calculate file hashes

 on:
  workflow_call:
@@ -8,8 +8,8 @@ on:
        required: true
        type: string
  workflow_dispatch:
-    inputs:
-      release_tag:
+    release_tag:
+      tag:
        description: 'Release tag'
        required: true
        type: string
@@ -24,7 +24,10 @@ jobs:
      - uses: actions/setup-node@v3
        with:
          node-version: 18
-      - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
+      - name: Install packages
+        run: cd ./.github/actions/nym-hash-releases && npm i
+
+      - uses: ./.github/actions/nym-hash-releases
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
@@ -4,23 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2024.1-marabou] (2024-02-15)
-
-**New Features:**
- Introduced nymvisor support for nym-api, gateway, and mixnode binaries ([#4158])
- Revamped nym-api execution with the addition of init and run commands ([#4225])
-
-**Enhancements:**
- Implemented internal improvements for gateways to optimize internal packet routing
- Improved routing score calculation
-
-**Bug Fixes:**
- Resolved various bugs to enhance overall stability
-
-[#4158]: https://github.com/nymtech/nym/pull/4158
-[#4225]: https://github.com/nymtech/nym/pull/4225
-
-
 ## [2023.5-rolo] (2023-11-28)

 - Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])
@@ -27,12 +27,13 @@ members = [
    "common/client-libs/gateway-client",
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
+    "common/coconut-interface",
    "common/commands",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
-    #    "common/cosmwasm-smart-contracts/ephemera",
+    "common/cosmwasm-smart-contracts/ephemera",
    "common/cosmwasm-smart-contracts/group-contract",
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
@@ -42,7 +43,6 @@ members = [
    "common/credential-storage",
    "common/credentials",
    "common/credential-utils",
-    "common/credentials-interface",
    "common/crypto",
    "common/dkg",
    "common/execute",
@@ -56,8 +56,6 @@ members = [
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
    "common/nymcoconut",
-    "common/nym-id",
-    "common/nym-metrics",
    "common/nymsphinx",
    "common/nymsphinx/acknowledgements",
    "common/nymsphinx/addressing",
@@ -106,17 +104,15 @@ members = [
    "nym-outfox",
    "nym-validator-rewarder",
    "tools/internal/ssl-inject",
-    # "tools/internal/sdk-version-bump",
+    "tools/internal/sdk-version-bump",
    "tools/nym-cli",
-    "tools/nym-id-cli",
    "tools/nym-nr-query",
    "tools/nymvisor",
    "tools/ts-rs-cli",
    "wasm/client",
-    #    "wasm/full-nym-wasm",
+#    "wasm/full-nym-wasm",
    "wasm/mix-fetch",
    "wasm/node-tester",
-    "common/nym-metrics",
 ]

 default-members = [
@@ -132,16 +128,7 @@ default-members = [
    "nym-validator-rewarder",
 ]

-exclude = [
-    "explorer",
-    "contracts",
-    "nym-wallet",
-    "nym-connect/mobile/src-tauri",
-    "nym-connect/desktop",
-    "nym-vpn/ui/src-tauri",
-    "cpu-cycles",
-    "sdk/ffi/cpp",
-]
+exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles", "sdk/ffi/cpp"]

 [workspace.package]
 authors = ["Nym Technologies SA"]
@@ -156,7 +143,6 @@ anyhow = "1.0.71"
 async-trait = "0.1.68"
 axum = "0.6.20"
 base64 = "0.21.4"
-bs58 = "0.5.0"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 clap = "4.4.7"
 cfg-if = "1.0.0"
@@ -172,7 +158,7 @@ log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = { version = "0.11.22", default-features = false }
+reqwest = "0.11.22"
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -182,7 +168,7 @@ time = "0.3.30"
 thiserror = "1.0.48"
 tokio = "1.33.0"
 tokio-util = "0.7.10"
-tokio-tungstenite = { version = "0.20.1" }
+tokio-tungstenite = "0.20.1"
 tracing = "0.1.37"
 tungstenite = { version = "0.20.1", default-features = false }
 ts-rs = "7.0.0"
@@ -191,12 +177,10 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"

-prometheus = { version = "0.13.0" }
-
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch = "feature/gt-serialization-0.8.0" }
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch ="feature/gt-serialization-0.8.0" }
 group = "0.13.0"
 ff = "0.13.0"

@@ -221,9 +205,9 @@ cw-controllers = { version = "=1.1.0" }
 bip32 = "0.5.1"

 # temporarily using a fork again (yay.) because we need staking and slashing support
-cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" }
+cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch ="nym-temp/all-validator-features" }
 #cosmrs = {  git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" } # unfortuntely we need a fork by yours truly to get the staking support
-tendermint = "0.34"     # same version as used by cosmrs
+tendermint = "0.34" # same version as used by cosmrs
 tendermint-rpc = "0.34" # same version as used by cosmrs
 prost = "0.12"

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.33"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -21,24 +21,24 @@ futures = { workspace = true } # bunch of futures stuff, however, now that I thi
 # and the single instance of abortable we have should really be refactored anyway
 url = { workspace = true }

-bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
 dirs = "4.0"
+lazy_static = "1.4.0"
 log = { workspace = true } # self explanatory
+pretty_env_logger = "0.4" # for formatting log messages
 rand = { version = "0.7.3", features = ["wasm-bindgen"] } # rng-related traits + some rng implementation to use
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 tap = "1.0.1"
-time = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "net", "signal"] } # async runtime
 tokio-tungstenite = { workspace = true }
-zeroize = { workspace = true }

 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
 nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
+nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credentials = { path = "../../common/credentials" }
@@ -51,6 +51,5 @@ nym-task = { path = "../../common/task" }
 nym-topology = { path = "../../common/topology" }
 nym-validator-client = { path = "../../common/client-libs/validator-client", features = ["http-client"] }
 nym-client-websocket-requests = { path = "websocket-requests" }
-nym-id = { path = "../../common/nym-id" }

 [dev-dependencies]
@@ -1667,9 +1667,9 @@
      }
    },
    "node_modules/follow-redirects": {
-      "version": "1.15.6",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
-      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
+      "version": "1.15.4",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
+      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
      "dev": true,
      "funding": [
        {
@@ -1705,9 +1705,9 @@
      }
    },
    "node_modules/fs-monkey": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
-      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
+      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
      "dev": true
    },
    "node_modules/fs.realpath": {
@@ -2160,9 +2160,9 @@
      }
    },
    "node_modules/ip": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
-      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
+      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
      "dev": true
    },
    "node_modules/ipaddr.js": {
@@ -2430,12 +2430,12 @@
      }
    },
    "node_modules/memfs": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
-      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
+      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
      "dev": true,
      "dependencies": {
-        "fs-monkey": "^1.0.4"
+        "fs-monkey": "1.0.3"
      },
      "engines": {
        "node": ">= 4.0.0"
@@ -4047,13 +4047,13 @@
      }
    },
    "node_modules/webpack-dev-middleware": {
-      "version": "5.3.4",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
-      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
+      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
      "dev": true,
      "dependencies": {
        "colorette": "^2.0.10",
-        "memfs": "^3.4.3",
+        "memfs": "^3.4.1",
        "mime-types": "^2.1.31",
        "range-parser": "^1.2.1",
        "schema-utils": "^4.0.0"
@@ -5800,9 +5800,9 @@
      }
    },
    "follow-redirects": {
-      "version": "1.15.6",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
-      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
+      "version": "1.15.4",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
+      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
      "dev": true
    },
    "forwarded": {
@@ -5818,9 +5818,9 @@
      "dev": true
    },
    "fs-monkey": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
-      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
+      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
      "dev": true
    },
    "fs.realpath": {
@@ -6157,9 +6157,9 @@
      "dev": true
    },
    "ip": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
-      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
+      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
      "dev": true
    },
    "ipaddr.js": {
@@ -6346,12 +6346,12 @@
      "dev": true
    },
    "memfs": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
-      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
+      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
      "dev": true,
      "requires": {
-        "fs-monkey": "^1.0.4"
+        "fs-monkey": "1.0.3"
      }
    },
    "merge-descriptors": {
@@ -7547,13 +7547,13 @@
      }
    },
    "webpack-dev-middleware": {
-      "version": "5.3.4",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
-      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
+      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
      "dev": true,
      "requires": {
        "colorette": "^2.0.10",
-        "memfs": "^3.4.3",
+        "memfs": "^3.4.1",
        "mime-types": "^2.1.31",
        "range-parser": "^1.2.1",
        "schema-utils": "^4.0.0"
@@ -1,54 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::commands::try_load_current_config;
-use crate::error::ClientError;
-use clap::ArgGroup;
-
-use nym_id::import_credential;
-use std::fs;
-use std::path::PathBuf;
-
-fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
-    bs58::decode(raw).into_vec()
-}
-
-#[derive(clap::Args)]
-#[clap(group(ArgGroup::new("cred_data").required(true)))]
-pub(crate) struct Args {
-    /// Id of client that is going to import the credential
-    #[clap(long)]
-    pub id: String,
-
-    /// Explicitly provide the encoded credential data (as base58)
-    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
-    pub(crate) credential_data: Option<Vec<u8>>,
-
-    /// Specifies the path to file containing binary credential data
-    #[clap(long, group = "cred_data")]
-    pub(crate) credential_path: Option<PathBuf>,
-
-    // currently hidden as there exists only a single serialization standard
-    #[clap(long, hide = true)]
-    pub(crate) version: Option<u8>,
-}
-
-pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
-    let config = try_load_current_config(&args.id)?;
-
-    let credentials_store = nym_credential_storage::initialise_persistent_storage(
-        &config.storage_paths.common_paths.credentials_database,
-    )
-    .await;
-
-    let raw_credential = match args.credential_data {
-        Some(data) => data,
-        None => {
-            // SAFETY: one of those arguments must have been set
-            fs::read(args.credential_path.unwrap())?
-        }
-    };
-
-    import_credential(credentials_store, raw_credential, args.version).await?;
-    Ok(())
-}
@@ -8,6 +8,7 @@ use crate::client::config::{BaseClientConfig, Config};
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
+use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
@@ -20,16 +21,18 @@ use nym_client_core::error::ClientCoreError;
 use nym_config::OptionalSet;
 use std::error::Error;
 use std::net::IpAddr;
-use std::sync::OnceLock;

 pub(crate) mod build_info;
-pub(crate) mod import_credential;
 pub(crate) mod init;
 pub(crate) mod run;

+lazy_static! {
+    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
+}
+
+// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
-    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
+    &PRETTY_BUILD_INFORMATION
 }

 #[derive(Parser)]
@@ -55,9 +58,6 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(import_credential::Args),
-
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -86,7 +86,6 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -1,13 +1,11 @@
 use nym_client_core::error::ClientCoreError;

-use nym_id::NymIdError;
-
 #[derive(thiserror::Error, Debug)]
 pub enum ClientError {
    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

-    #[error(transparent)]
+    #[error("client-core error: {0}")]
    ClientCoreError(#[from] ClientCoreError),

    #[error("Failed to load config for: {0}")]
@@ -22,7 +20,4 @@ pub enum ClientError {

    #[error("Attempted to start the client in invalid socket mode")]
    InvalidSocketMode,
-
-    #[error(transparent)]
-    NymIdError(#[from] NymIdError),
 }
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.33"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -8,22 +8,22 @@ rust-version = "1.56"
 license.workspace = true

 [dependencies]
-bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
+lazy_static = "1.4.0"
 log = { workspace = true }
+pretty_env_logger = "0.4"
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 tap = "1.0.1"
 thiserror = { workspace = true }
 tokio = { version = "1.24.1", features = ["rt-multi-thread", "net", "signal"] }
 rand = "0.7.3"
-time = { workspace = true }
 url = { workspace = true }
-zeroize = { workspace = true }

 # internal
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
 nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
+nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credentials = { path = "../../common/credentials" }
 nym-crypto = { path = "../../common/crypto" }
@@ -35,7 +35,6 @@ nym-ordered-buffer = { path = "../../common/socks5/ordered-buffer" }
 nym-pemstore = { path = "../../common/pemstore" }
 nym-topology = { path = "../../common/topology" }
 nym-socks5-client-core = { path = "../../common/socks5-client-core" }
-nym-id = { path = "../../common/nym-id" }

 [features]
 default = []
@@ -1,54 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::commands::try_load_current_config;
-use crate::error::Socks5ClientError;
-use clap::ArgGroup;
-
-use nym_id::import_credential;
-use std::fs;
-use std::path::PathBuf;
-
-fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
-    bs58::decode(raw).into_vec()
-}
-
-#[derive(clap::Args)]
-#[clap(group(ArgGroup::new("cred_data").required(true)))]
-pub(crate) struct Args {
-    /// Id of client that is going to import the credential
-    #[clap(long)]
-    pub id: String,
-
-    /// Explicitly provide the encoded credential data (as base58)
-    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
-    pub(crate) credential_data: Option<Vec<u8>>,
-
-    /// Specifies the path to file containing binary credential data
-    #[clap(long, group = "cred_data")]
-    pub(crate) credential_path: Option<PathBuf>,
-
-    // currently hidden as there exists only a single serialization standard
-    #[clap(long, hide = true)]
-    pub(crate) version: Option<u8>,
-}
-
-pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
-    let config = try_load_current_config(&args.id)?;
-
-    let credentials_store = nym_credential_storage::initialise_persistent_storage(
-        &config.storage_paths.common_paths.credentials_database,
-    )
-    .await;
-
-    let raw_credential = match args.credential_data {
-        Some(data) => data,
-        None => {
-            // SAFETY: one of those arguments must have been set
-            fs::read(args.credential_path.unwrap())?
-        }
-    };
-
-    import_credential(credentials_store, raw_credential, args.version).await?;
-    Ok(())
-}
@@ -9,6 +9,7 @@ use crate::config::{BaseClientConfig, Config, SocksClientPaths};
 use crate::error::Socks5ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
+use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
@@ -23,16 +24,18 @@ use nym_config::OptionalSet;
 use nym_sphinx::params::{PacketSize, PacketType};
 use std::error::Error;
 use std::net::IpAddr;
-use std::sync::OnceLock;

 pub(crate) mod build_info;
-mod import_credential;
 pub mod init;
 pub(crate) mod run;

+lazy_static! {
+    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
+}
+
+// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
-    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
+    &PRETTY_BUILD_INFORMATION
 }

 #[derive(Parser)]
@@ -58,9 +61,6 @@ pub(crate) enum Commands {
    /// Run the Nym client with provided configuration client optionally overriding set parameters
    Run(run::Run),

-    /// Import a pre-generated credential
-    ImportCredential(import_credential::Args),
-
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -92,7 +92,6 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
    match args.command {
        Commands::Init(m) => init::execute(m).await?,
        Commands::Run(m) => run::execute(m).await?,
-        Commands::ImportCredential(m) => import_credential::execute(m).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -1,7 +1,5 @@
 use nym_client_core::error::ClientCoreError;

-use nym_id::NymIdError;
-
 #[derive(thiserror::Error, Debug)]
 pub enum Socks5ClientError {
    #[error("I/O error: {0}")]
@@ -20,9 +18,6 @@ pub enum Socks5ClientError {
    #[error("Fail to bind address")]
    FailToBindAddress,

-    #[error(transparent)]
+    #[error("client-core error: {0}")]
    ClientCoreError(#[from] ClientCoreError),
-
-    #[error(transparent)]
-    NymIdError(#[from] NymIdError),
 }
@@ -8,16 +8,14 @@ license.workspace = true

 [dependencies]
 bip39 = { workspace = true }
-log = { workspace = true }
 rand = "0.7.3"
 thiserror = { workspace = true }
 url = { workspace = true }
 zeroize = { workspace = true }

-nym-coconut = { path = "../nymcoconut" }
+nym-coconut-interface = { path = "../coconut-interface" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
-nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
 nym-network-defaults = { path = "../network-defaults" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
@@ -2,18 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::BandwidthControllerError;
-use nym_credential_storage::models::StorableIssuedCredential;
+use nym_coconut_interface::Base58;
 use nym_credential_storage::storage::Storage;
-use nym_credentials::coconut::bandwidth::{CredentialType, IssuanceBandwidthCredential};
+use nym_credentials::coconut::bandwidth::BandwidthVoucher;
 use nym_credentials::coconut::utils::obtain_aggregate_signature;
 use nym_crypto::asymmetric::{encryption, identity};
+use nym_network_defaults::VOUCHER_INFO;
 use nym_validator_client::coconut::all_coconut_api_clients;
 use nym_validator_client::nyxd::contract_traits::CoconutBandwidthSigningClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use nym_validator_client::nyxd::Coin;
 use rand::rngs::OsRng;
 use state::State;
-use zeroize::Zeroizing;

 pub mod state;

@@ -24,11 +24,13 @@ where
    let mut rng = OsRng;
    let signing_key = identity::PrivateKey::new(&mut rng);
    let encryption_key = encryption::PrivateKey::new(&mut rng);
+    let params = BandwidthVoucher::default_parameters();
+    let voucher_value = amount.amount.to_string();

    let tx_hash = client
        .deposit(
-            amount.clone(),
-            CredentialType::Voucher.to_string(),
+            amount,
+            String::from(VOUCHER_INFO),
            signing_key.public_key().to_base58_string(),
            encryption_key.public_key().to_base58_string(),
            None,
@@ -36,15 +38,21 @@ where
        .await?
        .transaction_hash;

-    let voucher =
-        IssuanceBandwidthCredential::new_voucher(amount, tx_hash, signing_key, encryption_key);
+    let voucher = BandwidthVoucher::new(
+        &params,
+        voucher_value,
+        VOUCHER_INFO.to_string(),
+        tx_hash,
+        signing_key,
+        encryption_key,
+    );

-    let state = State { voucher };
+    let state = State { voucher, params };

    Ok(state)
 }

-pub async fn get_bandwidth_voucher<C, St>(
+pub async fn get_credential<C, St>(
    state: &State,
    client: &C,
    storage: &St,
@@ -54,9 +62,6 @@ where
    St: Storage,
    <St as Storage>::StorageError: Send + Sync + 'static,
 {
-    // temporary
-    assert!(state.voucher.typ().is_voucher());
-
    let epoch_id = client.get_current_epoch().await?.epoch_id;
    let threshold = client
        .get_current_epoch_threshold()
@@ -65,23 +70,22 @@ where

    let coconut_api_clients = all_coconut_api_clients(client, epoch_id).await?;

-    let signature =
-        obtain_aggregate_signature(&state.voucher, &coconut_api_clients, threshold).await?;
-    let issued = state.voucher.to_issued_credential(signature, epoch_id);
-
-    // make sure the data gets zeroized after persisting it
-    let credential_data = Zeroizing::new(issued.pack_v1());
-    let storable = StorableIssuedCredential {
-        serialization_revision: issued.current_serialization_revision(),
-        credential_data: credential_data.as_ref(),
-        credential_type: issued.typ().to_string(),
-        epoch_id: epoch_id
-            .try_into()
-            .expect("our epoch is has run over u32::MAX!"),
-    };
-
+    let signature = obtain_aggregate_signature(
+        &state.params,
+        &state.voucher,
+        &coconut_api_clients,
+        threshold,
+    )
+    .await?;
    storage
-        .insert_issued_credential(storable)
+        .insert_coconut_credential(
+            state.voucher.get_voucher_value(),
+            VOUCHER_INFO.to_string(),
+            state.voucher.get_private_attributes()[0].to_bs58(),
+            state.voucher.get_private_attributes()[1].to_bs58(),
+            signature.to_bs58(),
+            epoch_id.to_string(),
+        )
        .await
        .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
 }
@@ -1,14 +1,19 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_credentials::coconut::bandwidth::IssuanceBandwidthCredential;
+use nym_coconut_interface::Parameters;
+use nym_credentials::coconut::bandwidth::BandwidthVoucher;

 pub struct State {
-    pub voucher: IssuanceBandwidthCredential,
+    pub voucher: BandwidthVoucher,
+    pub params: Parameters,
 }

 impl State {
-    pub fn new(voucher: IssuanceBandwidthCredential) -> Self {
-        State { voucher }
+    pub fn new(voucher: BandwidthVoucher) -> Self {
+        State {
+            voucher,
+            params: BandwidthVoucher::default_parameters(),
+        }
    }
 }
@@ -1,7 +1,7 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_coconut::CoconutError;
+use nym_coconut_interface::CoconutError;
 use nym_credential_storage::error::StorageError;
 use nym_credentials::error::Error as CredentialsError;
 use nym_crypto::asymmetric::encryption::KeyRecoveryError;
@@ -21,9 +21,6 @@ pub enum BandwidthControllerError {
    #[error("There was a credential storage error - {0}")]
    CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),

-    #[error("the credential storage does not contain any usable credentials")]
-    NoCredentialsAvailable,
-
    // this should really be fully incorporated into the above, but messing with coconut is the last thing I want to do now
    #[error(transparent)]
    StorageError(#[from] StorageError),
@@ -48,7 +45,4 @@ pub enum BandwidthControllerError {

    #[error("Threshold not set yet")]
    NoThreshold,
-
-    #[error("can't handle recovering storage with revision {stored}. {expected} was expected")]
-    UnsupportedCredentialStorageRevision { stored: u8, expected: u8 },
 }
@@ -1,140 +1,80 @@
-// Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::BandwidthControllerError;
-use crate::utils::stored_credential_to_issued_bandwidth;
-use log::{debug, error, warn};
+use nym_credential_storage::error::StorageError;
 use nym_credential_storage::storage::Storage;
-use nym_credentials::coconut::bandwidth::issued::BandwidthCredentialIssuedDataVariant;
-use nym_credentials::coconut::bandwidth::CredentialSpendingData;
-use nym_credentials::coconut::utils::obtain_aggregate_verification_key;
-use nym_credentials::IssuedBandwidthCredential;
-use nym_credentials_interface::VerificationKey;
 use nym_validator_client::coconut::all_coconut_api_clients;
-use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
+use std::str::FromStr;
+use zeroize::Zeroizing;
+use {
+    nym_coconut_interface::Base58,
+    nym_credentials::coconut::{
+        bandwidth::prepare_for_spending, utils::obtain_aggregate_verification_key,
+    },
+};

 pub mod acquire;
 pub mod error;
-mod utils;

 pub struct BandwidthController<C, St> {
    storage: St,
    client: C,
 }

-pub struct PreparedCredential {
-    /// The cryptographic material required for spending the underlying credential.
-    pub data: CredentialSpendingData,
-
-    /// The (DKG) epoch id under which the credential has been issued so that the verifier
-    /// could use correct verification key for validation.
-    pub epoch_id: EpochId,
-
-    /// The database id of the stored credential.
-    pub credential_id: i64,
-}
-
-pub struct RetrievedCredential {
-    pub credential: IssuedBandwidthCredential,
-    pub credential_id: i64,
-}
-
 impl<C, St: Storage> BandwidthController<C, St> {
    pub fn new(storage: St, client: C) -> Self {
        BandwidthController { storage, client }
    }

-    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
-    /// It marks any retrieved intermediate credentials as expired.
-    pub async fn get_next_usable_credential(
-        &self,
-    ) -> Result<RetrievedCredential, BandwidthControllerError>
-    where
-        <St as Storage>::StorageError: Send + Sync + 'static,
-    {
-        loop {
-            let Some(maybe_next) = self
-                .storage
-                .get_next_unspent_credential()
-                .await
-                .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?
-            else {
-                return Err(BandwidthControllerError::NoCredentialsAvailable);
-            };
-            let id = maybe_next.id;
-
-            // try to deserialize it
-            let valid_credential = match stored_credential_to_issued_bandwidth(maybe_next) {
-                // check if it has already expired
-                Ok(credential) => match credential.variant_data() {
-                    BandwidthCredentialIssuedDataVariant::Voucher(_) => {
-                        debug!("credential {id} is a bandwidth voucher");
-                        credential
-                    }
-                    BandwidthCredentialIssuedDataVariant::FreePass(freepass_info) => {
-                        debug!("credential {id} is a free pass");
-                        if freepass_info.expired() {
-                            warn!("the free pass (id: {id}) has already expired! The expiration was set to {}", freepass_info.expiry_date());
-                            self.storage.mark_expired(id).await.map_err(|err| {
-                                BandwidthControllerError::CredentialStorageError(Box::new(err))
-                            })?;
-                            continue;
-                        }
-                        credential
-                    }
-                },
-                Err(err) => {
-                    error!("failed to deserialize credential with id {id}: {err}. it may need to be manually removed from the storage");
-                    return Err(err);
-                }
-            };
-            return Ok(RetrievedCredential {
-                credential: valid_credential,
-                credential_id: id,
-            });
-        }
-    }
-
    pub fn storage(&self) -> &St {
        &self.storage
    }

-    async fn get_aggregate_verification_key(
+    pub async fn prepare_coconut_credential(
        &self,
-        epoch_id: EpochId,
-    ) -> Result<VerificationKey, BandwidthControllerError>
+    ) -> Result<(nym_coconut_interface::Credential, i64), BandwidthControllerError>
    where
        C: DkgQueryClient + Sync + Send,
        <St as Storage>::StorageError: Send + Sync + 'static,
    {
+        let bandwidth_credential = self
+            .storage
+            .get_next_coconut_credential()
+            .await
+            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
+        let voucher_value = u64::from_str(&bandwidth_credential.voucher_value)
+            .map_err(|_| StorageError::InconsistentData)?;
+        let voucher_info = bandwidth_credential.voucher_info.clone();
+        let serial_number = Zeroizing::new(nym_coconut_interface::Attribute::try_from_bs58(
+            bandwidth_credential.serial_number,
+        )?);
+        let binding_number = Zeroizing::new(nym_coconut_interface::Attribute::try_from_bs58(
+            bandwidth_credential.binding_number,
+        )?);
+        let signature =
+            nym_coconut_interface::Signature::try_from_bs58(bandwidth_credential.signature)?;
+        let epoch_id = u64::from_str(&bandwidth_credential.epoch_id)
+            .map_err(|_| StorageError::InconsistentData)?;
+
        let coconut_api_clients = all_coconut_api_clients(&self.client, epoch_id).await?;
-        Ok(obtain_aggregate_verification_key(&coconut_api_clients)?)
-    }

-    pub async fn prepare_bandwidth_credential(
-        &self,
-    ) -> Result<PreparedCredential, BandwidthControllerError>
-    where
-        C: DkgQueryClient + Sync + Send,
-        <St as Storage>::StorageError: Send + Sync + 'static,
-    {
-        let retrieved_credential = self.get_next_usable_credential().await?;
+        let verification_key = obtain_aggregate_verification_key(&coconut_api_clients).await?;

-        let epoch_id = retrieved_credential.credential.epoch_id();
-        let credential_id = retrieved_credential.credential_id;
-
-        let verification_key = self.get_aggregate_verification_key(epoch_id).await?;
-
-        let spend_request = retrieved_credential
-            .credential
-            .prepare_for_spending(&verification_key)?;
-
-        Ok(PreparedCredential {
-            data: spend_request,
-            epoch_id,
-            credential_id,
-        })
+        // the below would only be executed once we know where we want to spend it (i.e. which gateway and stuff)
+        Ok((
+            prepare_for_spending(
+                voucher_value,
+                voucher_info,
+                &serial_number,
+                &binding_number,
+                epoch_id,
+                &signature,
+                &verification_key,
+            )?,
+            bandwidth_credential.id,
+        ))
    }

    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError>
@@ -153,7 +93,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
 impl<C, St> Clone for BandwidthController<C, St>
 where
    C: Clone,
-    St: Clone,
+    St: Storage + Clone,
 {
    fn clone(&self) -> Self {
        BandwidthController {
@@ -1,22 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::error::BandwidthControllerError;
-use nym_credential_storage::models::StoredIssuedCredential;
-use nym_credentials::coconut::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
-use nym_credentials::coconut::bandwidth::IssuedBandwidthCredential;
-
-pub fn stored_credential_to_issued_bandwidth(
-    cred: StoredIssuedCredential,
-) -> Result<IssuedBandwidthCredential, BandwidthControllerError> {
-    if cred.serialization_revision != CURRENT_SERIALIZATION_REVISION {
-        return Err(
-            BandwidthControllerError::UnsupportedCredentialStorageRevision {
-                stored: cred.serialization_revision,
-                expected: CURRENT_SERIALIZATION_REVISION,
-            },
-        );
-    }
-
-    Ok(IssuedBandwidthCredential::unpack_v1(&cred.credential_data)?)
-}
@@ -69,35 +69,6 @@ impl BinaryBuildInformation {
        }
    }

-    // Varient where we want to use the metadata generated by vergen in the consuming crate.
-    pub const fn new_with_local_vergen(
-        binary_name: &'static str,
-        build_timestamp: &'static str,
-        build_version: &'static str,
-        commit_sha: &'static str,
-        commit_timestamp: &'static str,
-        commit_branch: &'static str,
-    ) -> Self {
-        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
-        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
-            "debug"
-        } else {
-            "release"
-        };
-
-        BinaryBuildInformation {
-            binary_name,
-            build_timestamp,
-            build_version,
-            commit_sha,
-            commit_timestamp,
-            commit_branch,
-            rustc_version: env!("VERGEN_RUSTC_SEMVER"),
-            rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
-            cargo_profile,
-        }
-    }
-
    pub fn to_owned(&self) -> BinaryBuildInformationOwned {
        BinaryBuildInformationOwned {
            binary_name: self.binary_name.to_owned(),
@@ -216,33 +187,3 @@ macro_rules! bin_info_owned {
        .to_owned()
    };
 }
-
-// variant that picks up the vergen build information generated by the build.rs in the consumer
-// crate.
-#[macro_export]
-macro_rules! bin_info_local_vergen {
-    () => {
-        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
-            env!("CARGO_PKG_NAME"),
-            env!("VERGEN_BUILD_TIMESTAMP"),
-            env!("CARGO_PKG_VERSION"),
-            env!("VERGEN_GIT_SHA"),
-            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
-            env!("VERGEN_GIT_BRANCH"),
-        )
-    };
-}
-
-#[macro_export]
-macro_rules! bin_info_local_vergen_owned {
-    () => {
-        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
-            env!("CARGO_PKG_NAME"),
-            env!("VERGEN_BUILD_TIMESTAMP"),
-            env!("CARGO_PKG_VERSION"),
-            env!("VERGEN_GIT_SHA"),
-            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
-            env!("VERGEN_GIT_BRANCH"),
-        )
-    };
-}
@@ -27,7 +27,7 @@ tap = "1.0.1"
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tungstenite = { workspace = true, default-features = false }
-tokio = { workspace = true, features = ["macros"] }
+tokio = { workspace = true, features = ["macros"]}
 time = "0.3.17"
 zeroize = { workspace = true }

@@ -38,7 +38,6 @@ nym-crypto = { path = "../crypto" }
 nym-explorer-client = { path = "../../explorer-api/explorer-client" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../../gateway/gateway-requests" }
-nym-metrics = { path = "../nym-metrics" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-pemstore = { path = "../pemstore" }
@@ -49,19 +48,6 @@ nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
 si-scale = "0.2.2"

-### For serving prometheus metrics
-[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
-version = "1"
-features = ["server", "http1"]
-
-[target."cfg(not(target_arch = \"wasm32\"))".dependencies.http-body-util]
-version = "0.1"
-
-[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
-version = "0.1"
-features = ["tokio"]
-###
-
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 version = "0.1.11"
 features = ["time"]
@@ -72,7 +58,6 @@ features = ["time"]

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
 version = "0.20.1"
-features = ["rustls-tls-native-roots"]

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
@@ -106,15 +91,11 @@ tempfile = "3.1.0"

 [build-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-sqlx = { workspace = true, features = [
-    "runtime-tokio-rustls",
-    "sqlite",
-    "macros",
-    "migrate",
-] }
+sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }

 [features]
 default = []
 cli = ["clap"]
 fs-surb-storage = ["sqlx"]
 wasm = ["nym-gateway-client/wasm"]
+
@@ -52,7 +52,6 @@ use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
-use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
 use url::Url;
@@ -104,12 +103,6 @@ pub struct ClientState {
    pub shared_lane_queue_lengths: LaneQueueLengths,
    pub reply_controller_sender: ReplyControllerSender,
    pub topology_accessor: TopologyAccessor,
-    pub gateway_connection: GatewayConnection,
-}
-
-#[derive(Clone, Copy, Debug)]
-pub struct GatewayConnection {
-    pub gateway_ws_fd: Option<RawFd>,
 }

 pub enum ClientInputStatus {
@@ -673,7 +666,6 @@ where
            shutdown.fork("gateway_transceiver"),
        )
        .await?;
-        let gateway_ws_fd = gateway_transceiver.ws_fd();

        let reply_storage = Self::setup_persistent_reply_storage(
            reply_storage_backend,
@@ -767,7 +759,6 @@ where
                shared_lane_queue_lengths,
                reply_controller_sender,
                topology_accessor: shared_topology_accessor,
-                gateway_connection: GatewayConnection { gateway_ws_fd },
            },
            task_handle: shutdown,
        })
@@ -300,7 +300,7 @@ impl KeyManager {

    /// Gets an atomically reference counted pointer to [`SharedKey`].
    pub fn gateway_shared_key(&self) -> Option<Arc<SharedKeys>> {
-        self.gateway_shared_key.clone()
+        self.gateway_shared_key.as_ref().map(Arc::clone)
    }

    pub fn remove_gateway_key(self) -> KeyManagerBuilder {
@@ -8,7 +8,6 @@ use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
 use nym_sphinx::forwarding::packet::MixPacket;
 use std::fmt::Debug;
-use std::os::raw::c_int as RawFd;
 use thiserror::Error;

 #[cfg(not(target_arch = "wasm32"))]
@@ -26,7 +25,6 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
 /// This combines combines the functionalities of being able to send and receive mix packets.
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
    fn gateway_identity(&self) -> identity::PublicKey;
-    fn ws_fd(&self) -> Option<RawFd>;
 }

 /// This trait defines the functionality of sending `MixPacket` into the mixnet,
@@ -68,9 +66,6 @@ impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
    fn gateway_identity(&self) -> identity::PublicKey {
        (**self).gateway_identity()
    }
-    fn ws_fd(&self) -> Option<RawFd> {
-        (**self).ws_fd()
-    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -117,9 +112,6 @@ where
    fn gateway_identity(&self) -> identity::PublicKey {
        self.gateway_client.gateway_identity()
    }
-    fn ws_fd(&self) -> Option<RawFd> {
-        self.gateway_client.ws_fd()
-    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -195,9 +187,6 @@ mod nonwasm_sealed {
        fn gateway_identity(&self) -> identity::PublicKey {
            self.local_identity
        }
-        fn ws_fd(&self) -> Option<RawFd> {
-            None
-        }
    }

    #[async_trait]
@@ -270,7 +259,4 @@ impl GatewayTransceiver for MockGateway {
    fn gateway_identity(&self) -> identity::PublicKey {
        self.dummy_identity
    }
-    fn ws_fd(&self) -> Option<RawFd> {
-        None
-    }
 }
@@ -3,30 +3,8 @@ use std::{
    time::{Duration, Instant},
 };

-use log::{info, warn};
-use nym_metrics::{inc, inc_by, metrics};
 use si_scale::helpers::bibytes2;

-// Metrics server
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use http_body_util::Full;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use hyper::body::Bytes;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use hyper::server::conn::http1;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use hyper::service::service_fn;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use hyper::{Request, Response};
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use hyper_util::rt::TokioIo;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use std::convert::Infallible;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use std::net::SocketAddr;
-#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
-use tokio::net::TcpListener;
-
 use crate::spawn_future;

 // Time interval between reporting packet statistics
@@ -75,60 +53,42 @@ impl PacketStatistics {
            PacketStatisticsEvent::RealPacketSent(packet_size) => {
                self.real_packets_sent += 1;
                self.real_packets_sent_size += packet_size;
-                inc!("real_packets_sent");
-                inc_by!("real_packets_sent_size", packet_size);
            }
            PacketStatisticsEvent::CoverPacketSent(packet_size) => {
                self.cover_packets_sent += 1;
                self.cover_packets_sent_size += packet_size;
-                inc!("cover_packets_sent");
-                inc_by!("cover_packets_sent_size", packet_size);
            }
            PacketStatisticsEvent::RealPacketReceived(packet_size) => {
                self.real_packets_received += 1;
                self.real_packets_received_size += packet_size;
-                inc!("real_packets_received");
-                inc_by!("real_packets_received_size", packet_size);
            }
            PacketStatisticsEvent::CoverPacketReceived(packet_size) => {
                self.cover_packets_received += 1;
                self.cover_packets_received_size += packet_size;
-                inc!("cover_packets_received");
-                inc_by!("cover_packets_received_size", packet_size);
            }
            PacketStatisticsEvent::AckReceived(packet_size) => {
                self.total_acks_received += 1;
                self.total_acks_received_size += packet_size;
-                inc!("total_acks_received");
-                inc_by!("total_acks_received_size", packet_size);
            }
            PacketStatisticsEvent::RealAckReceived(packet_size) => {
                self.real_acks_received += 1;
                self.real_acks_received_size += packet_size;
-                inc!("real_acks_received");
-                inc_by!("real_acks_received_size", packet_size);
            }
            PacketStatisticsEvent::CoverAckReceived(packet_size) => {
                self.cover_acks_received += 1;
                self.cover_acks_received_size += packet_size;
-                inc!("cover_acks_received");
-                inc_by!("cover_acks_received_size", packet_size);
            }
            PacketStatisticsEvent::RealPacketQueued => {
                self.real_packets_queued += 1;
-                inc!("real_packets_queued");
            }
            PacketStatisticsEvent::RetransmissionQueued => {
                self.retransmissions_queued += 1;
-                inc!("retransmissions_queued");
            }
            PacketStatisticsEvent::ReplySurbRequestQueued => {
                self.reply_surbs_queued += 1;
-                inc!("reply_surbs_queued");
            }
            PacketStatisticsEvent::AdditionalReplySurbRequestQueued => {
                self.additional_reply_surbs_queued += 1;
-                inc!("additional_reply_surbs_queued");
            }
        }
    }
@@ -306,11 +266,11 @@ impl std::ops::Div<f64> for PacketRates {
 impl PacketRates {
    fn summary(&self) -> String {
        format!(
-            "down: {}/s, up: {}/s (cover down: {}/s, cover up: {}/s)",
+            "rx: {}/s (real: {}/s), tx: {}/s (real: {}/s)",
+            bibytes2(self.real_packets_received_size + self.cover_packets_received_size),
            bibytes2(self.real_packets_received_size),
+            bibytes2(self.real_packets_sent_size + self.cover_packets_sent_size),
            bibytes2(self.real_packets_sent_size),
-            bibytes2(self.cover_packets_received_size),
-            bibytes2(self.cover_packets_sent_size),
        )
    }

@@ -328,7 +288,6 @@ impl PacketRates {
    }
 }

-#[derive(Debug)]
 pub(crate) enum PacketStatisticsEvent {
    // The real packets sent. Recall that acks are sent by the gateway, so it's not included here.
    RealPacketSent(usize),
@@ -484,11 +443,7 @@ impl PacketStatisticsControl {
            // Check what the number of retransmissions was during the recording window
            if let Some((_, start_stats)) = self.history.front() {
                let delta = self.stats.clone() - start_stats.clone();
-                log::info!(
-                    "mix packet retransmissions/real mix packets: {}/{}",
-                    delta.retransmissions_queued,
-                    delta.real_packets_queued,
-                );
+                log::info!("retransmissions: {}", delta.retransmissions_queued,);
            } else {
                log::warn!("Unable to check retransmissions during recording window");
            }
@@ -505,33 +460,6 @@ impl PacketStatisticsControl {
        let snapshot_interval = Duration::from_millis(SNAPSHOT_INTERVAL_MS);
        let mut snapshot_interval = tokio::time::interval(snapshot_interval);

-        cfg_if::cfg_if! {
-            if #[cfg(all(target_arch = "wasm32", target_os = "unknown"))] {
-                log::warn!("Metrics server is not supported on wasm32-unknown-unknown");
-                let listener = None;
-            } else {
-                let mut metrics_port = 18000;
-                let listener: Option<TcpListener>;
-                loop {
-                    let addr = SocketAddr::from(([0, 0, 0, 0], metrics_port));
-                    match TcpListener::bind(addr).await {
-                        Ok(l) => {
-                            info!("###############################");
-                            info!("Metrics endpoint is at: {:?}", l.local_addr());
-                            info!("###############################");
-                            listener = Some(l);
-                            break;
-                        },
-                        Err(err) => {
-                            log::warn!("Failed to bind metrics server: {:?}", err);
-                            metrics_port += 1;
-                        }
-                    };
-                }
-
-            }
-        }
-
        loop {
            tokio::select! {
                stats_event = self.stats_rx.recv() => match stats_event {
@@ -544,27 +472,6 @@ impl PacketStatisticsControl {
                        break;
                    }
                },
-                // conditional will disable the branch if we're in wasm32-unknown-unknown
-                result = listener.as_ref().unwrap().accept(), if listener.is_some() => {
-                    cfg_if::cfg_if! {
-                        if #[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))] {
-                            if let Ok((stream, _)) = result {
-                                let io = TokioIo::new(stream);
-
-                                tokio::task::spawn(async move {
-                                    if let Err(err) = http1::Builder::new()
-                                        .serve_connection(io, service_fn(serve_metrics))
-                                        .await
-                                    {
-                                        warn!("Error serving connection: {:?}", err);
-                                    }
-                                });
-                            } else {
-                                warn!("Error accepting connection");
-                            }
-                        }
-                    }
-                }
                _ = snapshot_interval.tick() => {
                    self.update_history();
                    self.update_rates();
@@ -589,9 +496,3 @@ impl PacketStatisticsControl {
        })
    }
 }
-
-async fn serve_metrics(
-    _: Request<hyper::body::Incoming>,
-) -> Result<Response<Full<Bytes>>, Infallible> {
-    Ok(Response::new(Full::new(Bytes::from(metrics!()))))
-}
@@ -19,7 +19,7 @@ tokio = { version = "1.24.1", features = ["macros"] }

 # internal
 nym-bandwidth-controller = { path = "../../bandwidth-controller" }
-nym-credentials = { path = "../../credentials" }
+nym-coconut-interface = { path = "../../coconut-interface" }
 nym-credential-storage = { path = "../../credential-storage" }
 nym-crypto = { path = "../../crypto" }
 nym-gateway-requests = { path = "../../../gateway/gateway-requests" }
@@ -48,8 +48,7 @@ features = ["net", "sync", "time"]
 workspace = true
 # the choice of this particular tls feature was arbitrary;
 # if you reckon a different one would be more appropriate, feel free to change it
-# features = ["native-tls"]
-features = ["rustls-tls-native-roots"]
+features = ["native-tls"]

 # wasm-only dependencies
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]
@@ -1,4 +1,4 @@
-// Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::GatewayClientError;
@@ -6,23 +6,20 @@ use crate::packet_router::PacketRouter;
 pub use crate::packet_router::{
    AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
 };
-use crate::socket_state::{ws_fd, PartiallyDelegated, SocketState};
+use crate::socket_state::{PartiallyDelegated, SocketState};
 use crate::traits::GatewayPacketRouter;
 use crate::{cleanup_socket_message, try_decrypt_binary_message};
 use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_bandwidth_controller::BandwidthController;
+use nym_coconut_interface::Credential;
 use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_credentials::CredentialSpendingData;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_requests::authentication::encrypted_address::EncryptedAddressBytes;
 use nym_gateway_requests::iv::IV;
 use nym_gateway_requests::registration::handshake::{client_handshake, SharedKeys};
-use nym_gateway_requests::{
-    BinaryRequest, ClientControlRequest, ServerResponse, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION,
-    CURRENT_PROTOCOL_VERSION,
-};
+use nym_gateway_requests::{BinaryRequest, ClientControlRequest, ServerResponse, PROTOCOL_VERSION};
 use nym_network_defaults::{REMAINING_BANDWIDTH_THRESHOLD, TOKENS_TO_BURN};
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::TaskClient;
@@ -33,15 +30,11 @@ use std::sync::Arc;
 use std::time::Duration;
 use tungstenite::protocol::Message;

-#[cfg(unix)]
-use std::os::fd::RawFd;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::sleep;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::connect_async;

-#[cfg(not(unix))]
-use std::os::raw::c_int as RawFd;
 #[cfg(target_arch = "wasm32")]
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
@@ -86,9 +79,6 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
    /// Delay between each subsequent reconnection attempt.
    reconnection_backoff: Duration,

-    // currently unused (but populated)
-    negotiated_protocol: Option<u8>,
-
    /// Listen to shutdown messages.
    shutdown: TaskClient,
 }
@@ -118,7 +108,6 @@ impl<C, St> GatewayClient<C, St> {
            should_reconnect_on_failure: true,
            reconnection_attempts: DEFAULT_RECONNECTION_ATTEMPTS,
            reconnection_backoff: DEFAULT_RECONNECTION_BACKOFF,
-            negotiated_protocol: None,
            shutdown,
        }
    }
@@ -157,14 +146,6 @@ impl<C, St> GatewayClient<C, St> {
        self.gateway_identity
    }

-    pub fn ws_fd(&self) -> Option<RawFd> {
-        match &self.connection {
-            SocketState::Available(conn) => ws_fd(conn.as_ref()),
-            SocketState::PartiallyDelegated(conn) => conn.ws_fd(),
-            _ => None,
-        }
-    }
-
    pub fn remaining_bandwidth(&self) -> i64 {
        self.bandwidth_remaining
    }
@@ -395,8 +376,6 @@ impl<C, St> GatewayClient<C, St> {
        &self,
        gateway_protocol: Option<u8>,
    ) -> Result<(), GatewayClientError> {
-        debug!("gateway protocol: {gateway_protocol:?}, ours: {CURRENT_PROTOCOL_VERSION}");
-
        // right now there are no failure cases here, but this might change in the future
        match gateway_protocol {
            None => {
@@ -404,17 +383,17 @@ impl<C, St> GatewayClient<C, St> {
                // note: in +1.2.0 we will have to return a hard error here
                Ok(())
            }
-            Some(v) if v > CURRENT_PROTOCOL_VERSION => {
+            Some(v) if v != PROTOCOL_VERSION => {
                let err = GatewayClientError::IncompatibleProtocol {
                    gateway: Some(v),
-                    current: CURRENT_PROTOCOL_VERSION,
+                    current: PROTOCOL_VERSION,
                };
                error!("{err}");
                Err(err)
            }

            Some(_) => {
-                info!("the gateway is using exactly the same (or older) protocol version as we are. We're good to continue!");
+                info!("the gateway is using exactly the same protocol version as we are. We're good to continue!");
                Ok(())
            }
        }
@@ -438,7 +417,6 @@ impl<C, St> GatewayClient<C, St> {
                ws_stream,
                self.local_identity.as_ref(),
                self.gateway_identity,
-                !self.disabled_credentials_mode,
            )
            .await
            .map_err(GatewayClientError::RegistrationFailure),
@@ -461,10 +439,6 @@ impl<C, St> GatewayClient<C, St> {
        if self.authenticated {
            self.shared_key = Some(Arc::new(shared_key));
        }
-
-        // populate the negotiated protocol for future uses
-        self.negotiated_protocol = gateway_protocol;
-
        Ok(())
    }

@@ -495,13 +469,8 @@ impl<C, St> GatewayClient<C, St> {
            .derive_destination_address();
        let encrypted_address = EncryptedAddressBytes::new(&self_address, shared_key, &iv);

-        let msg = ClientControlRequest::new_authenticate(
-            self_address,
-            encrypted_address,
-            iv,
-            !self.disabled_credentials_mode,
-        )
-        .into();
+        let msg =
+            ClientControlRequest::new_authenticate(self_address, encrypted_address, iv).into();

        match self.send_websocket_message(msg).await? {
            ServerResponse::Authenticate {
@@ -512,7 +481,6 @@ impl<C, St> GatewayClient<C, St> {
                self.check_gateway_protocol(protocol_version)?;
                self.authenticated = status;
                self.bandwidth_remaining = bandwidth_remaining;
-                self.negotiated_protocol = protocol_version;
                Ok(())
            }
            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -547,13 +515,13 @@ impl<C, St> GatewayClient<C, St> {

    async fn claim_coconut_bandwidth(
        &mut self,
-        credential: CredentialSpendingData,
+        credential: Credential,
    ) -> Result<(), GatewayClientError> {
        let mut rng = OsRng;
        let iv = IV::new_random(&mut rng);

-        let msg = ClientControlRequest::new_enc_coconut_bandwidth_credential_v2(
-            credential,
+        let msg = ClientControlRequest::new_enc_coconut_bandwidth_credential(
+            &credential,
            self.shared_key.as_ref().unwrap(),
            iv,
        )
@@ -599,31 +567,18 @@ impl<C, St> GatewayClient<C, St> {
            return self.try_claim_testnet_bandwidth().await;
        }

-        let Some(gateway_protocol) = self.negotiated_protocol else {
-            return Err(GatewayClientError::OutdatedGatewayCredentialVersion {
-                negotiated_protocol: None,
-            });
-        };
-
-        if gateway_protocol < CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION {
-            return Err(GatewayClientError::OutdatedGatewayCredentialVersion {
-                negotiated_protocol: Some(gateway_protocol),
-            });
-        }
-
-        let prepared_credential = self
+        let (credential, credential_id) = self
            .bandwidth_controller
            .as_ref()
            .unwrap()
-            .prepare_bandwidth_credential()
+            .prepare_coconut_credential()
            .await?;

-        self.claim_coconut_bandwidth(prepared_credential.data)
-            .await?;
+        self.claim_coconut_bandwidth(credential).await?;
        self.bandwidth_controller
            .as_ref()
            .unwrap()
-            .consume_credential(prepared_credential.credential_id)
+            .consume_credential(credential_id)
            .await?;

        Ok(())
@@ -862,7 +817,6 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            should_reconnect_on_failure: false,
            reconnection_attempts: DEFAULT_RECONNECTION_ATTEMPTS,
            reconnection_backoff: DEFAULT_RECONNECTION_BACKOFF,
-            negotiated_protocol: None,
            shutdown,
        }
    }
@@ -894,7 +848,6 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            should_reconnect_on_failure: self.should_reconnect_on_failure,
            reconnection_attempts: self.reconnection_attempts,
            reconnection_backoff: self.reconnection_backoff,
-            negotiated_protocol: self.negotiated_protocol,
            shutdown,
        }
    }
@@ -47,9 +47,6 @@ pub enum GatewayClientError {
    #[error("Credential could not be serialized")]
    SerializeCredential,

-    #[error("can not spend bandwidth credential with the gateway as it's using outdated protocol (version: {negotiated_protocol:?})")]
-    OutdatedGatewayCredentialVersion { negotiated_protocol: Option<u8> },
-
    #[error("Client is not authenticated")]
    NotAuthenticated,

@@ -69,10 +69,6 @@ impl PacketRouter {
        }
        Ok(())
    }
-
-    pub fn mark_as_success(&mut self) {
-        self.shutdown.mark_as_success();
-    }
 }

 impl GatewayPacketRouter for PacketRouter {
@@ -11,12 +11,9 @@ use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_gateway_requests::registration::handshake::SharedKeys;
 use nym_task::TaskClient;
-use std::os::raw::c_int as RawFd;
 use std::sync::Arc;
 use tungstenite::Message;

-#[cfg(unix)]
-use std::os::fd::AsRawFd;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::net::TcpStream;
 #[cfg(not(target_arch = "wasm32"))]
@@ -40,20 +37,9 @@ type WsConn = JSWebsocket;

 type SplitStreamReceiver = oneshot::Receiver<Result<SplitStream<WsConn>, GatewayClientError>>;

-pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
-    #[cfg(unix)]
-    match _conn.get_ref() {
-        MaybeTlsStream::Plain(stream) => Some(stream.as_raw_fd()),
-        &_ => None,
-    }
-    #[cfg(not(unix))]
-    None
-}
-
 pub(crate) struct PartiallyDelegated {
    sink_half: SplitSink<WsConn, Message>,
    delegated_stream: (SplitStreamReceiver, oneshot::Sender<()>),
-    ws_fd: Option<RawFd>,
 }

 impl PartiallyDelegated {
@@ -97,7 +83,7 @@ impl PartiallyDelegated {

    pub(crate) fn split_and_listen_for_mixnet_messages(
        conn: WsConn,
-        mut packet_router: PacketRouter,
+        packet_router: PacketRouter,
        shared_key: Arc<SharedKeys>,
        mut shutdown: TaskClient,
    ) -> Self {
@@ -106,8 +92,6 @@ impl PartiallyDelegated {
        let (notify_sender, notify_receiver) = oneshot::channel();
        let (stream_sender, stream_receiver) = oneshot::channel();

-        let ws_fd = ws_fd(&conn);
-
        let (sink, mut stream) = conn.split();

        let mixnet_receiver_future = async move {
@@ -140,7 +124,6 @@ impl PartiallyDelegated {
            if match ret_err {
                Err(err) => stream_sender.send(Err(err)),
                Ok(_) => {
-                    packet_router.mark_as_success();
                    shutdown.mark_as_success();
                    stream_sender.send(Ok(stream))
                }
@@ -158,16 +141,11 @@ impl PartiallyDelegated {
        tokio::spawn(mixnet_receiver_future);

        PartiallyDelegated {
-            ws_fd,
            sink_half: sink,
            delegated_stream: (stream_receiver, notify_sender),
        }
    }

-    pub(crate) fn ws_fd(&self) -> Option<RawFd> {
-        self.ws_fd
-    }
-
    // if we want to send a message and don't care about response, we can don't need to reunite the split,
    // the sink itself is enough
    pub(crate) async fn send_without_response(
@@ -31,8 +31,9 @@ log = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
 futures = { workspace = true }
+openssl = { version = "^0.10.55", features = ["vendored"], optional = true }

-nym-coconut = { path = "../../nymcoconut" }
+nym-coconut-interface = { path = "../../coconut-interface" }
 nym-network-defaults = { path = "../../network-defaults" }
 nym-api-requests = { path = "../../../nym-api/nym-api-requests" }

@@ -89,7 +90,7 @@ required-features = ["http-client"]

 [features]
 default = ["http-client"]
-http-client = ["cosmrs/rpc"]
+http-client = ["cosmrs/rpc", "openssl"]
 generate-ts = []
 contract-testing = ["nym-mixnet-contract-common/contract-testing"]

@@ -8,10 +8,8 @@ use crate::{
    nym_api, DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient,
    ReqwestRpcClient, ValidatorClientError,
 };
-use nym_api_requests::coconut::models::FreePassNonceResponse;
 use nym_api_requests::coconut::{
-    BlindSignRequestBody, BlindedSignatureResponse, FreePassRequest, VerifyCredentialBody,
-    VerifyCredentialResponse,
+    BlindSignRequestBody, BlindedSignatureResponse, VerifyCredentialBody, VerifyCredentialResponse,
 };
 use nym_api_requests::models::{DescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::models::{
@@ -350,15 +348,4 @@ impl NymApiClient {
            .verify_bandwidth_credential(request_body)
            .await?)
    }
-
-    pub async fn free_pass_nonce(&self) -> Result<FreePassNonceResponse, ValidatorClientError> {
-        Ok(self.nym_api.free_pass_nonce().await?)
-    }
-
-    pub async fn issue_free_pass_credential(
-        &self,
-        request: &FreePassRequest,
-    ) -> Result<BlindedSignatureResponse, ValidatorClientError> {
-        Ok(self.nym_api.free_pass(request).await?)
-    }
 }
@@ -4,9 +4,9 @@
 use crate::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
 use crate::nyxd::error::NyxdError;
 use crate::NymApiClient;
-use nym_coconut::{Base58, CoconutError, VerificationKey};
 use nym_coconut_dkg_common::types::{EpochId, NodeIndex};
 use nym_coconut_dkg_common::verification_key::ContractVKShare;
+use nym_coconut_interface::{Base58, CoconutError, VerificationKey};
 use thiserror::Error;
 use url::Url;

@@ -32,8 +32,6 @@ pub mod error;
 pub mod routes;

 pub use http_api_client::Client;
-use nym_api_requests::coconut::models::FreePassNonceResponse;
-use nym_api_requests::coconut::FreePassRequest;

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -375,36 +373,6 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn free_pass_nonce(&self) -> Result<FreePassNonceResponse, NymAPIError> {
-        self.get_json(
-            &[
-                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_FREE_PASS_NONCE,
-            ],
-            NO_PARAMS,
-        )
-        .await
-    }
-
-    async fn free_pass(
-        &self,
-        request: &FreePassRequest,
-    ) -> Result<BlindedSignatureResponse, NymAPIError> {
-        self.post_json(
-            &[
-                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_FREE_PASS,
-            ],
-            NO_PARAMS,
-            request,
-        )
-        .await
-    }
-
    async fn blind_sign(
        &self,
        request_body: &BlindSignRequestBody,
@@ -15,8 +15,6 @@ pub const REWARDED: &str = "rewarded";
 pub const COCONUT_ROUTES: &str = "coconut";
 pub const BANDWIDTH: &str = "bandwidth";

-pub const COCONUT_FREE_PASS: &str = "free-pass";
-pub const COCONUT_FREE_PASS_NONCE: &str = "free-pass-nonce";
 pub const COCONUT_BLIND_SIGN: &str = "blind-sign";
 pub const COCONUT_VERIFY_BANDWIDTH_CREDENTIAL: &str = "verify-bandwidth-credential";
 pub const COCONUT_EPOCH_CREDENTIALS: &str = "epoch-credentials";
@@ -1,4 +1,4 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::collect_paged;
@@ -7,22 +7,13 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use cosmwasm_std::Addr;
-use log::trace;
-use nym_coconut_dkg_common::types::{ChunkIndex, NodeIndex, StateAdvanceResponse};
-use serde::Deserialize;
-
-use nym_coconut_dkg_common::dealer::RegisteredDealerDetails;
-pub use nym_coconut_dkg_common::{
-    dealer::{DealerDetailsResponse, PagedDealerIndexResponse, PagedDealerResponse},
-    dealing::{
-        DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
-        DealingMetadataResponse, DealingStatusResponse,
-    },
+use nym_coconut_dkg_common::{
+    dealer::{ContractDealing, DealerDetailsResponse, PagedDealerResponse, PagedDealingsResponse},
    msg::QueryMsg as DkgQueryMsg,
-    types::{DealerDetails, DealingIndex, Epoch, EpochId, EpochState, State},
-    verification_key::{ContractVKShare, PagedVKSharesResponse, VkShareResponse},
+    types::{DealerDetails, Epoch, EpochId, InitialReplacementData},
+    verification_key::{ContractVKShare, PagedVKSharesResponse},
 };
+use serde::Deserialize;

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -31,35 +22,17 @@ pub trait DkgQueryClient {
    where
        for<'a> T: Deserialize<'a>;

-    async fn get_state(&self) -> Result<State, NyxdError> {
-        let request = DkgQueryMsg::GetState {};
-        self.query_dkg_contract(request).await
-    }
-
    async fn get_current_epoch(&self) -> Result<Epoch, NyxdError> {
        let request = DkgQueryMsg::GetCurrentEpochState {};
        self.query_dkg_contract(request).await
    }
-
-    async fn can_advance_state(&self) -> Result<StateAdvanceResponse, NyxdError> {
-        let request = DkgQueryMsg::CanAdvanceState {};
-        self.query_dkg_contract(request).await
-    }
-
    async fn get_current_epoch_threshold(&self) -> Result<Option<u64>, NyxdError> {
        let request = DkgQueryMsg::GetCurrentEpochThreshold {};
        self.query_dkg_contract(request).await
    }

-    async fn get_registered_dealer_details(
-        &self,
-        address: &AccountId,
-        epoch_id: Option<EpochId>,
-    ) -> Result<RegisteredDealerDetails, NyxdError> {
-        let request = DkgQueryMsg::GetRegisteredDealer {
-            dealer_address: address.to_string(),
-            epoch_id,
-        };
+    async fn get_initial_dealers(&self) -> Result<Option<InitialReplacementData>, NyxdError> {
+        let request = DkgQueryMsg::GetInitialDealers {};
        self.query_dkg_contract(request).await
    }

@@ -82,95 +55,26 @@ pub trait DkgQueryClient {
        self.query_dkg_contract(request).await
    }

-    async fn get_dealer_indices_paged(
+    async fn get_past_dealers_paged(
        &self,
        start_after: Option<String>,
        limit: Option<u32>,
-    ) -> Result<PagedDealerIndexResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealerIndices { start_after, limit };
+    ) -> Result<PagedDealerResponse, NyxdError> {
+        let request = DkgQueryMsg::GetPastDealers { start_after, limit };
        self.query_dkg_contract(request).await
    }

-    async fn get_dealings_metadata(
+    async fn get_dealings_paged(
        &self,
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-    ) -> Result<DealingMetadataResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealingsMetadata {
-            epoch_id,
-            dealer,
-            dealing_index,
+        idx: u64,
+        start_after: Option<String>,
+        limit: Option<u32>,
+    ) -> Result<PagedDealingsResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealing {
+            idx,
+            limit,
+            start_after,
        };
-
-        self.query_dkg_contract(request).await
-    }
-
-    async fn get_dealer_dealings_status(
-        &self,
-        epoch_id: EpochId,
-        dealer: String,
-    ) -> Result<DealerDealingsStatusResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealerDealingsStatus { epoch_id, dealer };
-
-        self.query_dkg_contract(request).await
-    }
-
-    async fn get_dealing_status(
-        &self,
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-    ) -> Result<DealingStatusResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealingStatus {
-            epoch_id,
-            dealer,
-            dealing_index,
-        };
-
-        self.query_dkg_contract(request).await
-    }
-
-    async fn get_dealing_chunk_status(
-        &self,
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-        chunk_index: ChunkIndex,
-    ) -> Result<DealingChunkStatusResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealingChunkStatus {
-            epoch_id,
-            dealer,
-            dealing_index,
-            chunk_index,
-        };
-
-        self.query_dkg_contract(request).await
-    }
-
-    async fn get_dealing_chunk(
-        &self,
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-        chunk_index: ChunkIndex,
-    ) -> Result<DealingChunkResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealingChunk {
-            epoch_id,
-            dealer,
-            dealing_index,
-            chunk_index,
-        };
-
-        self.query_dkg_contract(request).await
-    }
-
-    async fn get_vk_share(
-        &self,
-        epoch_id: EpochId,
-        owner: String,
-    ) -> Result<VkShareResponse, NyxdError> {
-        let request = DkgQueryMsg::GetVerificationKey { epoch_id, owner };
        self.query_dkg_contract(request).await
    }

@@ -187,11 +91,6 @@ pub trait DkgQueryClient {
        };
        self.query_dkg_contract(request).await
    }
-
-    async fn get_contract_cw2_version(&self) -> Result<cw2::ContractVersion, NyxdError> {
-        self.query_dkg_contract(DkgQueryMsg::GetCW2ContractVersion {})
-            .await
-    }
 }

 // extension trait to the query client to deal with the paged queries
@@ -203,8 +102,12 @@ pub trait PagedDkgQueryClient: DkgQueryClient {
        collect_paged!(self, get_current_dealers_paged, dealers)
    }

-    async fn get_all_dealer_indices(&self) -> Result<Vec<(Addr, NodeIndex)>, NyxdError> {
-        collect_paged!(self, get_dealer_indices_paged, indices)
+    async fn get_all_past_dealers(&self) -> Result<Vec<DealerDetails>, NyxdError> {
+        collect_paged!(self, get_past_dealers_paged, dealers)
+    }
+
+    async fn get_all_epoch_dealings(&self, idx: u64) -> Result<Vec<ContractDealing>, NyxdError> {
+        collect_paged!(self, get_dealings_paged, dealings, idx)
    }

    async fn get_all_verification_key_shares(
@@ -231,7 +134,6 @@ where
        let dkg_contract_address = &self
            .dkg_contract_address()
            .ok_or_else(|| NyxdError::unavailable_contract_address("dkg contract"))?;
-        trace!("using the following dkg contract: {dkg_contract_address}");
        self.query_contract_smart(dkg_contract_address, &query)
            .await
    }
@@ -241,7 +143,6 @@ where
 mod tests {
    use super::*;
    use crate::nyxd::contract_traits::tests::IgnoreValue;
-    use nym_coconut_dkg_common::msg::QueryMsg;

    // it's enough that this compiles and clippy is happy about it
    #[allow(dead_code)]
@@ -250,63 +151,25 @@ mod tests {
        msg: DkgQueryMsg,
    ) {
        match msg {
-            DkgQueryMsg::GetState {} => client.get_state().ignore(),
            DkgQueryMsg::GetCurrentEpochState {} => client.get_current_epoch().ignore(),
-            DkgQueryMsg::CanAdvanceState {} => client.can_advance_state().ignore(),
            DkgQueryMsg::GetCurrentEpochThreshold {} => {
                client.get_current_epoch_threshold().ignore()
            }
-            DkgQueryMsg::GetRegisteredDealer {
-                dealer_address,
-                epoch_id,
-            } => client
-                .get_registered_dealer_details(&dealer_address.parse().unwrap(), epoch_id)
-                .ignore(),
+            DkgQueryMsg::GetInitialDealers {} => client.get_initial_dealers().ignore(),
            DkgQueryMsg::GetDealerDetails { dealer_address } => client
                .get_dealer_details(&dealer_address.parse().unwrap())
                .ignore(),
            DkgQueryMsg::GetCurrentDealers { limit, start_after } => client
                .get_current_dealers_paged(start_after, limit)
                .ignore(),
-            DkgQueryMsg::GetDealerIndices { limit, start_after } => {
-                client.get_dealer_indices_paged(start_after, limit).ignore()
-            }
-            DkgQueryMsg::GetDealingStatus {
-                epoch_id,
-                dealer,
-                dealing_index,
-            } => client
-                .get_dealing_status(epoch_id, dealer, dealing_index)
-                .ignore(),
-            DkgQueryMsg::GetDealingsMetadata {
-                epoch_id,
-                dealer,
-                dealing_index,
-            } => client
-                .get_dealings_metadata(epoch_id, dealer, dealing_index)
-                .ignore(),
-            QueryMsg::GetDealerDealingsStatus { epoch_id, dealer } => {
-                client.get_dealer_dealings_status(epoch_id, dealer).ignore()
-            }
-            DkgQueryMsg::GetDealingChunkStatus {
-                epoch_id,
-                dealer,
-                dealing_index,
-                chunk_index,
-            } => client
-                .get_dealing_chunk_status(epoch_id, dealer, dealing_index, chunk_index)
-                .ignore(),
-            DkgQueryMsg::GetDealingChunk {
-                epoch_id,
-                dealer,
-                dealing_index,
-                chunk_index,
-            } => client
-                .get_dealing_chunk(epoch_id, dealer, dealing_index, chunk_index)
-                .ignore(),
-            DkgQueryMsg::GetVerificationKey { epoch_id, owner } => {
-                client.get_vk_share(epoch_id, owner).ignore()
+            DkgQueryMsg::GetPastDealers { limit, start_after } => {
+                client.get_past_dealers_paged(start_after, limit).ignore()
            }
+            DkgQueryMsg::GetDealing {
+                idx,
+                limit,
+                start_after,
+            } => client.get_dealings_paged(idx, start_after, limit).ignore(),
            DkgQueryMsg::GetVerificationKeys {
                epoch_id,
                limit,
@@ -314,7 +177,6 @@ mod tests {
            } => client
                .get_vk_shares_paged(epoch_id, start_after, limit)
                .ignore(),
-            DkgQueryMsg::GetCW2ContractVersion {} => client.get_contract_cw2_version().ignore(),
        };
    }
 }
@@ -8,11 +8,11 @@ use crate::nyxd::{Coin, Fee, SigningCosmWasmClient};
 use crate::signing::signer::OfflineSigner;
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use nym_coconut_dkg_common::dealing::{DealingChunkInfo, PartialContractDealing};
+use cosmwasm_std::Addr;
 use nym_coconut_dkg_common::msg::ExecuteMsg as DkgExecuteMsg;
-use nym_coconut_dkg_common::types::{DealingIndex, EncodedBTEPublicKeyWithProof};
+use nym_coconut_dkg_common::types::EncodedBTEPublicKeyWithProof;
 use nym_coconut_dkg_common::verification_key::VerificationKeyShare;
-use nym_contracts_common::IdentityKey;
+use nym_contracts_common::dealings::ContractSafeBytes;

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -25,13 +25,6 @@ pub trait DkgSigningClient {
        funds: Vec<Coin>,
    ) -> Result<ExecuteResult, NyxdError>;

-    async fn initiate_dkg(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::InitiateDkg {};
-
-        self.execute_dkg_contract(fee, req, "initiating the DKG".to_string(), vec![])
-            .await
-    }
-
    async fn advance_dkg_epoch_state(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
        let req = DkgExecuteMsg::AdvanceEpochState {};

@@ -39,17 +32,22 @@ pub trait DkgSigningClient {
            .await
    }

+    async fn surpass_threshold(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        let req = DkgExecuteMsg::SurpassedThreshold {};
+
+        self.execute_dkg_contract(fee, req, "surpass DKG threshold".to_string(), vec![])
+            .await
+    }
+
    async fn register_dealer(
        &self,
        bte_key: EncodedBTEPublicKeyWithProof,
-        identity_key: IdentityKey,
        announce_address: String,
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
        let req = DkgExecuteMsg::RegisterDealer {
            bte_key_with_proof: bte_key,
-            identity_key,
            announce_address,
            resharing,
        };
@@ -58,31 +56,18 @@ pub trait DkgSigningClient {
            .await
    }

-    async fn submit_dealing_metadata(
+    async fn submit_dealing_bytes(
        &self,
-        dealing_index: DealingIndex,
-        chunks: Vec<DealingChunkInfo>,
+        dealing_bytes: ContractSafeBytes,
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::CommitDealingsMetadata {
-            dealing_index,
-            chunks,
+        let req = DkgExecuteMsg::CommitDealing {
+            dealing_bytes,
            resharing,
        };

-        self.execute_dkg_contract(fee, req, "dealing metadata commitment".to_string(), vec![])
-            .await
-    }
-
-    async fn submit_dealing_chunk(
-        &self,
-        chunk: PartialContractDealing,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::CommitDealingsChunk { chunk };
-
-        self.execute_dkg_contract(fee, req, "dealing chunk commitment".to_string(), vec![])
+        self.execute_dkg_contract(fee, req, "dealing commitment".to_string(), vec![])
            .await
    }

@@ -109,10 +94,9 @@ pub trait DkgSigningClient {
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::VerifyVerificationKeyShare {
-            owner: owner.to_string(),
-            resharing,
-        };
+        // the call to unchecked is fine as we're converting from pre-validated `AccountId`
+        let owner = Addr::unchecked(owner.to_string());
+        let req = DkgExecuteMsg::VerifyVerificationKeyShare { owner, resharing };

        self.execute_dkg_contract(
            fee,
@@ -122,20 +106,6 @@ pub trait DkgSigningClient {
        )
        .await
    }
-
-    async fn trigger_dkg_reset(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::TriggerReset {};
-
-        self.execute_dkg_contract(fee, req, "trigger DKG reset".to_string(), vec![])
-            .await
-    }
-
-    async fn trigger_dkg_resharing(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::TriggerResharing {};
-
-        self.execute_dkg_contract(fee, req, "trigger DKG resharing".to_string(), vec![])
-            .await
-    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -176,40 +146,31 @@ mod tests {
        msg: DkgExecuteMsg,
    ) {
        match msg {
-            DkgExecuteMsg::InitiateDkg {} => client.initiate_dkg(None).ignore(),
            DkgExecuteMsg::RegisterDealer {
                bte_key_with_proof,
-                identity_key,
                announce_address,
                resharing,
            } => client
-                .register_dealer(
-                    bte_key_with_proof,
-                    identity_key,
-                    announce_address,
-                    resharing,
-                    None,
-                )
+                .register_dealer(bte_key_with_proof, announce_address, resharing, None)
                .ignore(),
-            DkgExecuteMsg::CommitDealingsMetadata {
-                dealing_index,
-                chunks,
+            DkgExecuteMsg::CommitDealing {
+                dealing_bytes,
                resharing,
            } => client
-                .submit_dealing_metadata(dealing_index, chunks, resharing, None)
+                .submit_dealing_bytes(dealing_bytes, resharing, None)
                .ignore(),
-            DkgExecuteMsg::CommitDealingsChunk { chunk } => {
-                client.submit_dealing_chunk(chunk, None).ignore()
-            }
            DkgExecuteMsg::CommitVerificationKeyShare { share, resharing } => client
                .submit_verification_key_share(share, resharing, None)
                .ignore(),
            DkgExecuteMsg::VerifyVerificationKeyShare { owner, resharing } => client
-                .verify_verification_key_share(&owner.parse().unwrap(), resharing, None)
+                .verify_verification_key_share(
+                    &owner.into_string().parse().unwrap(),
+                    resharing,
+                    None,
+                )
                .ignore(),
+            DkgExecuteMsg::SurpassedThreshold {} => client.surpass_threshold(None).ignore(),
            DkgExecuteMsg::AdvanceEpochState {} => client.advance_dkg_epoch_state(None).ignore(),
-            DkgExecuteMsg::TriggerReset {} => client.trigger_dkg_reset(None).ignore(),
-            DkgExecuteMsg::TriggerResharing {} => client.trigger_dkg_resharing(None).ignore(),
        };
    }
 }
@@ -8,26 +8,26 @@ use std::str::FromStr;
 // TODO: all of those could/should be derived via a macro

 // query clients
-pub mod coconut_bandwidth_query_client;
-pub mod dkg_query_client;
-pub mod ephemera_query_client;
-pub mod group_query_client;
-pub mod mixnet_query_client;
-pub mod multisig_query_client;
-pub mod name_service_query_client;
-pub mod sp_directory_query_client;
-pub mod vesting_query_client;
+mod coconut_bandwidth_query_client;
+mod dkg_query_client;
+mod ephemera_query_client;
+mod group_query_client;
+mod mixnet_query_client;
+mod multisig_query_client;
+mod name_service_query_client;
+mod sp_directory_query_client;
+mod vesting_query_client;

 // signing clients
-pub mod coconut_bandwidth_signing_client;
-pub mod dkg_signing_client;
-pub mod ephemera_signing_client;
-pub mod group_signing_client;
-pub mod mixnet_signing_client;
-pub mod multisig_signing_client;
-pub mod name_service_signing_client;
-pub mod sp_directory_signing_client;
-pub mod vesting_signing_client;
+mod coconut_bandwidth_signing_client;
+mod dkg_signing_client;
+mod ephemera_signing_client;
+mod group_signing_client;
+mod mixnet_signing_client;
+mod multisig_signing_client;
+mod name_service_signing_client;
+mod sp_directory_signing_client;
+mod vesting_signing_client;

 // re-export query traits
 pub use coconut_bandwidth_query_client::{
@@ -140,6 +140,9 @@ pub enum NyxdError {
    #[error("Cosmwasm std error: {0}")]
    CosmwasmStdError(#[from] cosmwasm_std::StdError),

+    #[error("Coconut interface error: {0}")]
+    CoconutInterfaceError(#[from] nym_coconut_interface::error::CoconutInterfaceError),
+
    #[error("Account had an unexpected bech32 prefix. Expected: {expected}, got: {got}")]
    UnexpectedBech32Prefix { got: String, expected: String },
 }
@@ -16,6 +16,7 @@ use crate::signing::tx_signer::TxSigner;
 use crate::signing::AccountData;
 use crate::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient, ReqwestRpcClient};
 use async_trait::async_trait;
+use cosmrs::cosmwasm;
 use cosmrs::tendermint::{abci, evidence::Evidence, Genesis};
 use cosmrs::tx::{Raw, SignDoc};
 use cosmwasm_std::Addr;
@@ -39,7 +40,7 @@ pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::{
    bank::MsgSend,
-    bip32, cosmwasm,
+    bip32,
    crypto::PublicKey,
    query::{PageRequest, PageResponse},
    tendermint::{
@@ -358,10 +359,6 @@ where
    S: OfflineSigner + Send + Sync,
    NyxdError: From<<S as OfflineSigner>::Error>,
 {
-    pub fn signing_account(&self) -> Result<AccountData, NyxdError> {
-        Ok(self.find_account(&self.address())?)
-    }
-
    pub fn address(&self) -> AccountId {
        match self.client.signer_addresses() {
            Ok(addresses) => addresses[0].clone(),
@@ -0,0 +1,14 @@
+[package]
+name = "nym-coconut-interface"
+version = "0.1.0"
+edition = "2021"
+description = "Crutch library until there is proper SerDe support for coconut structs"
+license.workspace = true
+
+[dependencies]
+bs58 = "0.4.0"
+getset = "0.1.1"
+serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
+
+nym-coconut = {path = "../nymcoconut" }
@@ -0,0 +1,17 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_coconut::CoconutError;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum CoconutInterfaceError {
+    #[error("not enough bytes: {0} received, minimum {1} required")]
+    InvalidByteLength(usize, usize),
+
+    #[error("Could not decode base 58 string - {0}")]
+    MalformedString(#[from] bs58::decode::Error),
+
+    #[error("Coconut error - {0}")]
+    CoconutError(#[from] CoconutError),
+}
@@ -0,0 +1,196 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod error;
+
+use getset::{CopyGetters, Getters};
+use serde::{Deserialize, Serialize};
+
+use error::CoconutInterfaceError;
+
+// We list these explicity instead of glob export due to shadowing warnings with the pub tests
+// module.
+pub use nym_coconut::{
+    aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar,
+    prepare_blind_sign, prove_bandwidth_credential, Attribute, Base58, BlindSignRequest,
+    BlindedSignature, Bytable, CoconutError, KeyPair, Parameters, PrivateAttribute,
+    PublicAttribute, Signature, SignatureShare, Theta, VerificationKey,
+};
+
+#[derive(Debug, Serialize, Deserialize, Getters, CopyGetters, Clone, PartialEq, Eq)]
+pub struct Credential {
+    #[getset(get = "pub")]
+    n_params: u32,
+
+    #[getset(get = "pub")]
+    theta: Theta,
+
+    voucher_value: u64,
+
+    voucher_info: String,
+
+    #[getset(get = "pub")]
+    epoch_id: u64,
+}
+impl Credential {
+    pub fn new(
+        n_params: u32,
+        theta: Theta,
+        voucher_value: u64,
+        voucher_info: String,
+        epoch_id: u64,
+    ) -> Credential {
+        Credential {
+            n_params,
+            theta,
+            voucher_value,
+            voucher_info,
+            epoch_id,
+        }
+    }
+
+    pub fn blinded_serial_number(&self) -> String {
+        self.theta.blinded_serial_number_bs58()
+    }
+
+    pub fn has_blinded_serial_number(
+        &self,
+        blinded_serial_number_bs58: &str,
+    ) -> Result<bool, CoconutInterfaceError> {
+        Ok(self
+            .theta
+            .has_blinded_serial_number(blinded_serial_number_bs58)?)
+    }
+
+    pub fn voucher_value(&self) -> u64 {
+        self.voucher_value
+    }
+
+    pub fn verify(&self, verification_key: &VerificationKey) -> bool {
+        let params = Parameters::new(self.n_params).unwrap();
+
+        let hashed_value = hash_to_scalar(self.voucher_value.to_string());
+        let hashed_info = hash_to_scalar(&self.voucher_info);
+        let public_attributes = &[&hashed_value, &hashed_info];
+
+        nym_coconut::verify_credential(&params, verification_key, &self.theta, public_attributes)
+    }
+
+    pub fn as_bytes(&self) -> Vec<u8> {
+        let n_params_bytes = self.n_params.to_be_bytes();
+        let theta_bytes = self.theta.to_bytes();
+        let theta_bytes_len = theta_bytes.len();
+        let voucher_value_bytes = self.voucher_value.to_be_bytes();
+        let epoch_id_bytes = self.epoch_id.to_be_bytes();
+        let voucher_info_bytes = self.voucher_info.as_bytes();
+        let voucher_info_len = voucher_info_bytes.len();
+
+        let mut bytes = Vec::with_capacity(28 + theta_bytes_len + voucher_info_len);
+        bytes.extend_from_slice(&n_params_bytes);
+        bytes.extend_from_slice(&(theta_bytes_len as u64).to_be_bytes());
+        bytes.extend_from_slice(&theta_bytes);
+        bytes.extend_from_slice(&voucher_value_bytes);
+        bytes.extend_from_slice(&epoch_id_bytes);
+        bytes.extend_from_slice(voucher_info_bytes);
+
+        bytes
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, CoconutError> {
+        if bytes.len() < 28 {
+            return Err(CoconutError::Deserialization(String::from(
+                "To few bytes in credential",
+            )));
+        }
+        let mut four_byte = [0u8; 4];
+        let mut eight_byte = [0u8; 8];
+
+        four_byte.copy_from_slice(&bytes[..4]);
+        let n_params = u32::from_be_bytes(four_byte);
+        eight_byte.copy_from_slice(&bytes[4..12]);
+        let theta_len = u64::from_be_bytes(eight_byte);
+        if bytes.len() < 28 + theta_len as usize {
+            return Err(CoconutError::Deserialization(String::from(
+                "To few bytes in credential",
+            )));
+        }
+        let theta = Theta::from_bytes(&bytes[12..12 + theta_len as usize])
+            .map_err(|e| CoconutError::Deserialization(e.to_string()))?;
+        eight_byte.copy_from_slice(&bytes[12 + theta_len as usize..20 + theta_len as usize]);
+        let voucher_value = u64::from_be_bytes(eight_byte);
+        eight_byte.copy_from_slice(&bytes[20 + theta_len as usize..28 + theta_len as usize]);
+        let epoch_id = u64::from_be_bytes(eight_byte);
+        let voucher_info = String::from_utf8(bytes[28 + theta_len as usize..].to_vec())
+            .map_err(|e| CoconutError::Deserialization(e.to_string()))?;
+
+        Ok(Credential {
+            n_params,
+            theta,
+            voucher_value,
+            voucher_info,
+            epoch_id,
+        })
+    }
+}
+
+impl Bytable for Credential {
+    fn to_byte_vec(&self) -> Vec<u8> {
+        self.as_bytes()
+    }
+
+    fn try_from_byte_slice(slice: &[u8]) -> Result<Self, CoconutError> {
+        Credential::from_bytes(slice)
+    }
+}
+
+impl Base58 for Credential {}
+
+#[cfg(test)]
+mod tests {
+    use nym_coconut::{prove_bandwidth_credential, Signature};
+
+    use super::*;
+
+    #[test]
+    fn serde_coconut_credential() {
+        let voucher_value = 1000000u64;
+        let voucher_info = String::from("BandwidthVoucher");
+        let serial_number =
+            Attribute::try_from_bs58("7Rp3imcuNX3w9se9wm5th8gSvc2czsnMrGsdt5HsrycA").unwrap();
+        let binding_number =
+            Attribute::try_from_bs58("Auf8yVEgyEAWNHaXUZmimS4n9g5YiYnNYqp6F9BtBe9E").unwrap();
+        let signature = Signature::try_from_bs58(
+            "ta3pM9ffj5T6YGbwjSBp2W118rcwyP9PXStc\
+        7ssb91g5GQYMQHhuTNajbdZcjxUFBFL5rhED8EHpRzE8r432ss3qbPBfpNev4CdkfMkQ3wepyM7hy7q1W6Rn9WmFoZL\
+        ZR9j",
+        )
+        .unwrap();
+        let params = Parameters::new(4).unwrap();
+        let verification_key = VerificationKey::try_from_bs58("8CFtVVXdwLy4WHMQPE4\
+        woe89q3DRHoNxBSchftrEjSBPWA4r4xZv4Y9qSvS5x5bMmFtp7BX6ikECAnuXr5EjXWSsgjirZJmpS5XDUynVfht1cD\
+        FWGDvy2XFrRCuoCMotNXi3PoF6wYqdTR9Rqcfoj3i2H5Nid422WBaLtVoC9QNobvpvaqq6vX5PbsSyPayvU8HCXFxM6\
+        JjScYpbRTxQtdwefWLrk3LmXyJQBWi7c2VAhSxu9msp7VTBycqdwQNgxHETStZuwXsozxaGQ2KssVUCaaoYPR4g2RqK\
+        UAvtWwA7pMiAQNcbkXcbsjCgVjWaCpMWC37XA31cLcFf3zbjHD9e5tXjAcqa4M89fbFhuvvSXxowSAZ5NoWrN32kd5d\
+        wxJm1JW3Tt2h6yDDBe84oMy71462dZn7N78DVk2mFNGwBCibrZWA7oUzRBMfYxiQrksoFcou7QfLLd58zoNYmPQPt84\
+        1VpQopEBfdQ7Nf9zoXxBt3zMy7g5NsFGvzh7KTbDUyeeXrdkKJPQBs6dqaizr9sS8CPPmR4uk96vDTRh8CJ5FbSsmb8\
+        nP71dRvvwRZJHGzwYirMo6SXS3ZYxFuiA3mkxYuqDHCwkTWDuRCcAaztrDYRZg7VCMo4Q446AaEso5eqpeWpHZQt53E\
+        ZRpqmNYKASGwMhTeEHPSLgSmtoAAUcaRWpGRzYfd6kzEma8tdGLwyP4rLXgvSvtDLP37dU7YgF3LEXbGAz57U9ATy46\
+        6sroLpHPdaCWB8RF11wvB6Tu196JnJd2KyQBP1iUWP3rtZs3GhAF1QVcxquh8BqDZzAcpQ6wCS1P9c5GxKgww77FVF5\
+        Kp83XtoxSrw3GaYVyKTGxNh3vcKPR31txCjTxPaN2fg7TaPLhoQJX4YaAroFSXqrqbbRsisuHhhCeUP2YwDjHedes9y")
+            .unwrap();
+        let theta = prove_bandwidth_credential(
+            &params,
+            &verification_key,
+            &signature,
+            &serial_number,
+            &binding_number,
+        )
+        .unwrap();
+        let credential = Credential::new(4, theta, voucher_value, voucher_info, 42);
+
+        let serialized_credential = credential.as_bytes();
+        let deserialized_credential = Credential::from_bytes(&serialized_credential).unwrap();
+
+        assert_eq!(credential, deserialized_credential);
+    }
+}
@@ -9,16 +9,13 @@ license.workspace = true
 anyhow = { workspace = true }
 base64 = "0.13.0"
 bip39 = { workspace = true }
-bs58 = { workspace = true }
+bs58 = "0.4"
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
 clap = { workspace = true, features = ["derive"] }
-csv = "1.3.0"
 cw-utils = { workspace = true }
-futures = { workspace = true }
 handlebars = "3.0.1"
 humantime-serde = "1.0"
-inquire = "0.6.2"
 k256 = { workspace = true, features = ["ecdsa", "sha256"] }
 log = { workspace = true }
 rand = {version = "0.6", features = ["std"] }
@@ -26,11 +23,9 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 time = { workspace = true, features = ["parsing", "formatting"] }
-tokio = { workspace = true, features = ["sync"]}
 toml = "0.5.6"
 url = { workspace = true }
 tap = "1"
-zeroize = { workspace = true }

 cosmrs = { workspace = true }
 cosmwasm-std = { workspace = true }
@@ -52,10 +47,8 @@ nym-sphinx = { path = "../../common/nymsphinx" }
 nym-client-core = { path = "../../common/client-core" }
 nym-config = { path = "../../common/config" }
 nym-credentials = { path = "../../common/credentials" }
-nym-credentials-interface = { path = "../../common/credentials-interface" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credential-utils = { path = "../../common/credential-utils" }
-nym-id = { path = "../nym-id" }

 nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }
 nym-types = { path = "../../common/types" }
@@ -1,4 +0,0 @@
-n1q85lscptz860j3dx92f8phaeaw08j2l5dt7adq,50,nym
-n136ckky0n39eskewg04xhvahq9yp9f7sgtnxytt,50,unym
-n1xh7ru0zp67czxhvx0r5e8ur7rvg6n3ymmje0ju,50,nyx
-n13mpm4aj03alffnvz2x9ynjy4u3cxemxn2xw34w,50,unyx
@@ -1,190 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::context::SigningClient;
-use anyhow::{anyhow, bail};
-use clap::ArgGroup;
-use clap::Parser;
-use futures::StreamExt;
-use log::{error, info};
-use nym_coconut_dkg_common::types::EpochId;
-use nym_credential_utils::utils::block_until_coconut_is_available;
-use nym_credentials::coconut::bandwidth::freepass::MAX_FREE_PASS_VALIDITY;
-use nym_credentials::{
-    obtain_aggregate_verification_key, IssuanceBandwidthCredential, IssuedBandwidthCredential,
-};
-use nym_credentials_interface::VerificationKey;
-use nym_validator_client::coconut::all_coconut_api_clients;
-use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, NymContractsProvider};
-use nym_validator_client::nyxd::CosmWasmClient;
-use nym_validator_client::signing::AccountData;
-use nym_validator_client::CoconutApiClient;
-use std::fs::File;
-use std::io::Write;
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use zeroize::Zeroizing;
-
-fn parse_rfc3339_expiration_date(raw: &str) -> Result<OffsetDateTime, time::error::Parse> {
-    OffsetDateTime::parse(raw, &Rfc3339)
-}
-
-#[derive(Debug, Parser)]
-#[clap(group(ArgGroup::new("expiration").required(true)))]
-pub struct Args {
-    /// Specifies the expiration date of the free pass(es)
-    /// Can't be set to more than a week into the future.
-    #[clap(long, group = "expiration", value_parser = parse_rfc3339_expiration_date)]
-    pub(crate) expiration_date: Option<OffsetDateTime>,
-
-    /// The expiration of the free pass(es) expresses as unix timestamp.
-    /// Can't be set to more than a week into the future.
-    #[clap(long, group = "expiration")]
-    pub(crate) expiration_timestamp: Option<i64>,
-
-    /// The number of free passes to issue
-    #[clap(long, default_value = "1")]
-    pub(crate) amount: u64,
-
-    /// Path to the output directory for generated free passes.
-    #[clap(long)]
-    pub(crate) output_dir: PathBuf,
-}
-
-async fn get_freepass(
-    api_clients: Vec<CoconutApiClient>,
-    aggregate_vk: &VerificationKey,
-    threshold: u64,
-    epoch_id: EpochId,
-    signing_account: &AccountData,
-    expiration_date: OffsetDateTime,
-) -> anyhow::Result<IssuedBandwidthCredential> {
-    let issuance_pass = IssuanceBandwidthCredential::new_freepass(Some(expiration_date));
-    let signing_data = issuance_pass.prepare_for_signing();
-
-    let credential_shares = Arc::new(tokio::sync::Mutex::new(Vec::new()));
-
-    futures::stream::iter(api_clients)
-        .for_each_concurrent(None, |client| async {
-            // move the client into the block
-            let client = client;
-            let api_url = client.api_client.api_url();
-
-            info!("contacting {api_url} for blinded free pass");
-
-            match issuance_pass
-                .obtain_partial_freepass_credential(
-                    &client.api_client,
-                    signing_account,
-                    &client.verification_key,
-                    signing_data.clone(),
-                )
-                .await
-            {
-                Ok(partial_credential) => {
-                    credential_shares
-                        .lock()
-                        .await
-                        .push((partial_credential, client.node_id).into());
-                }
-                Err(err) => {
-                    error!("failed to obtain partial free pass from {api_url}: {err}")
-                }
-            }
-        })
-        .await;
-
-    // SAFETY: the futures have completed, so we MUST have the only arc reference
-    #[allow(clippy::unwrap_used)]
-    let credential_shares = Arc::into_inner(credential_shares).unwrap().into_inner();
-
-    if credential_shares.len() < threshold as usize {
-        bail!("we managed to obtain only {} partial credentials while the minimum threshold is {threshold}", credential_shares.len());
-    }
-
-    let signature = issuance_pass.aggregate_signature_shares(aggregate_vk, &credential_shares)?;
-    Ok(issuance_pass.into_issued_credential(signature, epoch_id))
-}
-
-pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
-    let address = client.address();
-
-    if !args.output_dir.is_dir() {
-        bail!("the provided output directory is not a directory!");
-    }
-
-    if args.output_dir.read_dir()?.next().is_some() {
-        bail!("the provided output directory is not empty!");
-    }
-
-    let Some(bandwidth_contract) = client.coconut_bandwidth_contract_address() else {
-        bail!("the bandwidth contract address is not set")
-    };
-
-    let Some(bandwidth_admin) = client
-        .get_contract(bandwidth_contract)
-        .await
-        .map(|c| c.contract_info.admin)?
-    else {
-        bail!("the bandwidth contract doesn't have any admin set")
-    };
-
-    // sanity checks since nym-apis will reject invalid requests anyway
-    if address != bandwidth_admin {
-        bail!("the provided mnemonic does not correspond to the current admin of the bandwidth contract")
-    }
-
-    let expiration_date = match args.expiration_date {
-        Some(date) => date,
-        // SAFETY: one of those arguments must have been set
-        None => OffsetDateTime::from_unix_timestamp(args.expiration_timestamp.unwrap())?,
-    };
-
-    let now = OffsetDateTime::now_utc();
-
-    if expiration_date > now + MAX_FREE_PASS_VALIDITY {
-        bail!("the provided free pass request has too long expiry (expiry is set to on {expiration_date})")
-    }
-
-    // issuance start
-    block_until_coconut_is_available(&client).await?;
-
-    let signing_account = client.signing_account()?;
-
-    let epoch_id = client.get_current_epoch().await?.epoch_id;
-    let threshold = client
-        .get_current_epoch_threshold()
-        .await?
-        .ok_or(anyhow!("no threshold available"))?;
-    let api_clients = all_coconut_api_clients(&client, epoch_id).await?;
-
-    if api_clients.len() < threshold as usize {
-        bail!(
-            "we have only {} api clients available while the minimum threshold is {threshold}",
-            api_clients.len()
-        )
-    }
-    let aggregate_vk = obtain_aggregate_verification_key(&api_clients)?;
-
-    for i in 0..args.amount {
-        let human_index = i + 1;
-        info!("trying to obtain free pass {human_index}/{}", args.amount);
-        let free_pass = get_freepass(
-            api_clients.clone(),
-            &aggregate_vk,
-            threshold,
-            epoch_id,
-            &signing_account,
-            expiration_date,
-        )
-        .await?;
-        let credential_data = Zeroizing::new(free_pass.pack_v1());
-        let output = args.output_dir.join(format!("freepass_{i}.nym"));
-        info!("saving the freepass to '{}'", output.display());
-        File::create(output)?.write_all(&credential_data)?;
-    }
-
-    Ok(())
-}
@@ -1,64 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::utils::CommonConfigsWrapper;
-use anyhow::bail;
-use clap::ArgGroup;
-use clap::Parser;
-use nym_credential_storage::initialise_persistent_storage;
-use nym_id::import_credential;
-use std::fs;
-use std::path::PathBuf;
-
-fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
-    bs58::decode(raw).into_vec()
-}
-
-#[derive(Debug, Parser)]
-#[clap(group(ArgGroup::new("cred_data").required(true)))]
-pub struct Args {
-    /// Config file of the client that is supposed to use the credential.
-    #[clap(long)]
-    pub(crate) client_config: PathBuf,
-
-    /// Explicitly provide the encoded credential data (as base58)
-    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
-    pub(crate) credential_data: Option<Vec<u8>>,
-
-    /// Specifies the path to file containing binary credential data
-    #[clap(long, group = "cred_data")]
-    pub(crate) credential_path: Option<PathBuf>,
-
-    // currently hidden as there exists only a single serialization standard
-    #[clap(long, hide = true)]
-    pub(crate) version: Option<u8>,
-}
-
-pub async fn execute(args: Args) -> anyhow::Result<()> {
-    let loaded = CommonConfigsWrapper::try_load(args.client_config)?;
-
-    if let Ok(id) = loaded.try_get_id() {
-        println!("loaded config file for client '{id}'");
-    }
-
-    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
-        bail!("the loaded config does not have a credentials store information")
-    };
-
-    println!(
-        "using credentials store at '{}'",
-        credentials_store.display()
-    );
-    let credentials_store = initialise_persistent_storage(credentials_store).await;
-
-    let raw_credential = match args.credential_data {
-        Some(data) => data,
-        None => {
-            // SAFETY: one of those arguments must have been set
-            fs::read(args.credential_path.unwrap())?
-        }
-    };
-
-    import_credential(credentials_store, raw_credential, args.version).await?;
-    Ok(())
-}
@@ -3,8 +3,6 @@

 use clap::{Args, Subcommand};

-pub mod generate_freepass;
-pub mod import_credential;
 pub mod issue_credentials;
 pub mod recover_credentials;

@@ -17,8 +15,6 @@ pub struct Coconut {

 #[derive(Debug, Subcommand)]
 pub enum CoconutCommands {
-    GenerateFreepass(generate_freepass::Args),
    IssueCredentials(issue_credentials::Args),
    RecoverCredentials(recover_credentials::Args),
-    ImportCredential(import_credential::Args),
 }
@@ -1,4 +1,4 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use clap::{Args, Subcommand};
@@ -7,7 +7,6 @@ pub mod balance;
 pub mod create;
 pub mod pubkey;
 pub mod send;
-pub mod send_multiple;

 #[derive(Debug, Args)]
 #[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
@@ -26,6 +25,4 @@ pub enum AccountCommands {
    PubKey(crate::validator::account::pubkey::Args),
    /// Sends tokens to another account
    Send(crate::validator::account::send::Args),
-    /// Batch multiple token sends
-    SendMultiple(crate::validator::account::send_multiple::Args),
 }
@@ -1,216 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::context::SigningClient;
-use crate::utils::pretty_coin;
-use clap::Parser;
-use comfy_table::Table;
-use cosmrs::rpc::endpoint::tx::Response;
-use log::{error, info};
-use nym_validator_client::nyxd::{AccountId, Coin};
-use serde_json::json;
-use std::str::FromStr;
-use std::{fs, io::Write};
-
-#[derive(Debug, Parser)]
-pub struct Args {
-    #[clap(long)]
-    pub memo: Option<String>,
-
-    #[clap(
-        long,
-        help = "Input file path (CSV format) with account/amount pairs to send"
-    )]
-    pub input: String,
-
-    #[clap(
-        long,
-        help = "An output file path (CSV format) to create or append a log of results to"
-    )]
-    pub output: Option<String>,
-}
-
-pub async fn send_multiple(args: Args, client: &SigningClient) {
-    let memo = args
-        .memo
-        .unwrap_or_else(|| "Sending tokens with nym-cli".to_owned());
-
-    let rows = InputFileReader::new(&args.input);
-    if let Err(e) = rows {
-        error!("Failed to read input file: {}", e);
-        return;
-    }
-    let rows = rows.unwrap();
-
-    let mut table = Table::new();
-
-    if rows.rows.is_empty() {
-        error!("No transactions to send");
-        return;
-    }
-
-    println!(
-        "The following transfer will be made from account {} to:",
-        client.address()
-    );
-    table.set_header(vec!["Address", "Amount"]);
-
-    for row in rows.rows.iter() {
-        table.add_row(vec![row.address.to_string(), pretty_coin(&row.amount)]);
-    }
-
-    println!("{table}");
-
-    let ans = inquire::Confirm::new("Do you want to continue with the transfers?")
-        .with_default(false)
-        .with_help_message("You must confirm before the transaction will be sent")
-        .prompt();
-
-    if let Err(e) = ans {
-        info!("Aborting, {}...", e);
-        return;
-    }
-    if let Ok(false) = ans {
-        info!("Aborting!");
-        return;
-    }
-
-    info!("Transferring from {}...", client.address());
-
-    let multiple_sends: Vec<(AccountId, Vec<Coin>)> = rows
-        .rows
-        .iter()
-        .map(|row| (row.address.clone(), vec![row.amount.clone()]))
-        .collect();
-
-    let res = client
-        .send_multiple(multiple_sends, memo, None)
-        .await
-        .expect("failed to send tokens!");
-
-    info!("Sending result: {}", json!(res));
-
-    println!();
-    println!(
-        "Nodesguru: https://nym.explorers.guru/transaction/{}",
-        &res.hash
-    );
-    println!("Mintscan: https://www.mintscan.io/nyx/txs/{}", &res.hash);
-    println!("Transaction result code: {}", &res.tx_result.code.value());
-    println!("Transaction hash: {}", &res.hash);
-
-    if let Some(output_filename) = args.output {
-        println!("\nWriting output log to {}", output_filename);
-
-        if let Err(e) = write_output_file(rows, res, &output_filename) {
-            error!(
-                "Failed to write output file {} with error {}",
-                output_filename, e
-            );
-        }
-    }
-}
-
-fn write_output_file(
-    rows: InputFileReader,
-    res: Response,
-    output_filename: &String,
-) -> Result<(), anyhow::Error> {
-    let mut file = fs::OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(output_filename)?;
-
-    let now = time::OffsetDateTime::now_utc();
-    let now = now.format(&time::format_description::well_known::Rfc3339)?;
-
-    let data = rows
-        .rows
-        .iter()
-        .map(|row| {
-            format!(
-                "{},{},{},{},{}",
-                row.address, row.amount.amount, row.amount.denom, now, res.hash
-            )
-        })
-        .collect::<Vec<String>>()
-        .join("\n");
-
-    Ok(file.write_all(format!("{}\n", data).as_bytes())?)
-}
-
-#[derive(Debug)]
-pub struct InputFileRow {
-    pub address: AccountId,
-    pub amount: Coin,
-}
-
-pub struct InputFileReader {
-    pub rows: Vec<InputFileRow>,
-}
-
-impl InputFileReader {
-    pub fn new(path: &str) -> Result<InputFileReader, anyhow::Error> {
-        let mut rows: Vec<InputFileRow> = vec![];
-        let file_contents = fs::read_to_string(path)?;
-
-        let lines: Vec<String> = file_contents.lines().map(String::from).collect();
-        for line in lines {
-            let tokens: Vec<_> = line.split(',').collect();
-            if tokens.len() < 3 {
-                return Err(anyhow::anyhow!(
-                    "'{}' does not have enough columns, expecting <address>,<amount>,<denom>",
-                    line
-                ));
-            }
-            // try parse amount to u128
-            let amount = u128::from_str(tokens[1])
-                .map_err(|_| anyhow::anyhow!("'{}' has an invalid amount", line))?;
-
-            let denom: String = tokens[2].into();
-
-            // multiply when a whole token amount, e.g. 50nym (50.123456nym is not allowed, that must be input as 50123456unym)
-            let (amount, denom) = if !denom.starts_with('u') {
-                (amount * 1_000_000u128, format!("u{}", denom))
-            } else {
-                (amount, denom)
-            };
-
-            let address = AccountId::from_str(tokens[0])
-                .map_err(|e| anyhow::anyhow!("'{}' has an invalid address: {}", line, e))?;
-
-            let amount = Coin { amount, denom };
-
-            rows.push(InputFileRow { address, amount })
-        }
-
-        Ok(InputFileReader { rows })
-    }
-}
-
-#[cfg(test)]
-mod test_multiple_send_input_csv {
-    use super::*;
-    use nym_validator_client::nyxd::AccountId;
-    use std::str::FromStr;
-    #[test]
-    fn works_on_happy_path() {
-        let input_csv = InputFileReader::new("fixtures/test_send_multiple.csv").unwrap();
-        assert_eq!(
-            AccountId::from_str("n1q85lscptz860j3dx92f8phaeaw08j2l5dt7adq").unwrap(),
-            input_csv.rows[0].address
-        );
-
-        println!("{:?}", input_csv.rows);
-
-        assert_eq!(50_000_000u128, input_csv.rows[0].amount.amount);
-        assert_eq!(50u128, input_csv.rows[1].amount.amount);
-        assert_eq!(50_000_000u128, input_csv.rows[2].amount.amount);
-        assert_eq!(50u128, input_csv.rows[3].amount.amount);
-
-        assert_eq!("unym", input_csv.rows[0].amount.denom);
-        assert_eq!("unym", input_csv.rows[1].amount.denom);
-        assert_eq!("unyx", input_csv.rows[2].amount.denom);
-        assert_eq!("unyx", input_csv.rows[3].amount.denom);
-    }
-}
@@ -3,7 +3,6 @@

 use clap::Parser;
 use log::{debug, info};
-use nym_coconut_dkg_common::dealing::DEFAULT_DEALINGS;
 use std::str::FromStr;

 use nym_coconut_dkg_common::msg::InstantiateMsg;
@@ -94,7 +93,6 @@ pub async fn generate(args: Args) {
        multisig_addr: multisig_addr.to_string(),
        time_configuration: Some(time_configuration),
        mix_denom,
-        key_size: DEFAULT_DEALINGS as u32,
    };

    debug!("instantiate_msg: {:?}", instantiate_msg);
@@ -10,8 +10,6 @@ license.workspace = true
 cosmwasm-schema = { workspace = true }
 cosmwasm-std = { workspace = true }
 cw-utils = { workspace = true }
-cw2 = { workspace = true }
-cw4 = { workspace = true }

 contracts-common = { path = "../contracts-common", package = "nym-contracts-common" }
 nym-multisig-contract-common = { path = "../multisig-contract" }
@@ -1,7 +1,7 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::types::{EncodedBTEPublicKeyWithProof, NodeIndex};
+use crate::types::{ContractSafeBytes, EncodedBTEPublicKeyWithProof, NodeIndex};
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Addr;

@@ -9,37 +9,24 @@ use cosmwasm_std::Addr;
 pub struct DealerDetails {
    pub address: Addr,
    pub bte_public_key_with_proof: EncodedBTEPublicKeyWithProof,
-    pub ed25519_identity: String,
    pub announce_address: String,
    pub assigned_index: NodeIndex,
 }

-#[cw_serde]
-pub struct DealerRegistrationDetails {
-    pub bte_public_key_with_proof: EncodedBTEPublicKeyWithProof,
-    pub ed25519_identity: String,
-    pub announce_address: String,
-}
-
 #[cw_serde]
 #[derive(Copy)]
 pub enum DealerType {
-    Current { assigned_index: NodeIndex },
-    Past { assigned_index: NodeIndex },
+    Current,
+    Past,
    Unknown,
 }

 impl DealerType {
    pub fn is_current(&self) -> bool {
-        matches!(&self, DealerType::Current { .. })
+        matches!(&self, DealerType::Current)
    }
 }

-#[cw_serde]
-pub struct RegisteredDealerDetails {
-    pub details: Option<DealerRegistrationDetails>,
-}
-
 #[cw_serde]
 pub struct DealerDetailsResponse {
    pub details: Option<DealerDetails>,
@@ -79,17 +66,35 @@ impl PagedDealerResponse {
 }

 #[cw_serde]
-pub struct PagedDealerIndexResponse {
-    pub indices: Vec<(Addr, NodeIndex)>,
+pub struct ContractDealing {
+    pub dealing: ContractSafeBytes,
+    pub dealer: Addr,
+}
+
+impl ContractDealing {
+    pub fn new(dealing: ContractSafeBytes, dealer: Addr) -> Self {
+        ContractDealing { dealing, dealer }
+    }
+}
+
+#[cw_serde]
+pub struct PagedDealingsResponse {
+    pub dealings: Vec<ContractDealing>,
+    pub per_page: usize,

    /// Field indicating paging information for the following queries if the caller wishes to get further entries.
    pub start_next_after: Option<Addr>,
 }

-impl PagedDealerIndexResponse {
-    pub fn new(indices: Vec<(Addr, NodeIndex)>, start_next_after: Option<Addr>) -> Self {
-        PagedDealerIndexResponse {
-            indices,
+impl PagedDealingsResponse {
+    pub fn new(
+        dealings: Vec<ContractDealing>,
+        per_page: usize,
+        start_next_after: Option<Addr>,
+    ) -> Self {
+        PagedDealingsResponse {
+            dealings,
+            per_page,
            start_next_after,
        }
    }
@@ -1,290 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::types::{ChunkIndex, DealingIndex, EpochId, PartialContractDealingData};
-use contracts_common::dealings::ContractSafeBytes;
-use cosmwasm_schema::cw_serde;
-use cosmwasm_std::Addr;
-use std::collections::{BTreeMap, HashMap};
-
-/// Defines the maximum size of a dealing chunk. Currently set to 2kB
-pub const MAX_DEALING_CHUNK_SIZE: usize = 2048;
-
-/// Defines the maximum size of a full dealing.
-/// Currently set to 100kB (which is enough for a dealing created for 100 parties)
-pub const MAX_DEALING_SIZE: usize = 102400;
-
-pub const MAX_DEALING_CHUNKS: usize = MAX_DEALING_SIZE / MAX_DEALING_CHUNK_SIZE;
-
-// 2 public attributes, 2 private attributes, 1 fixed for coconut credential
-pub const DEFAULT_DEALINGS: usize = 2 + 2 + 1;
-
-pub fn chunk_dealing(
-    dealing_index: DealingIndex,
-    dealing_bytes: Vec<u8>,
-    chunk_size: usize,
-) -> HashMap<ChunkIndex, PartialContractDealing> {
-    let mut chunks = HashMap::new();
-    for (chunk_index, chunk) in dealing_bytes.chunks(chunk_size).enumerate() {
-        let chunk = PartialContractDealing {
-            dealing_index,
-            chunk_index: chunk_index as ChunkIndex,
-            data: ContractSafeBytes(chunk.to_vec()),
-        };
-        chunks.insert(chunk_index as ChunkIndex, chunk);
-    }
-
-    chunks
-}
-
-#[cw_serde]
-#[derive(Copy)]
-pub struct DealingChunkInfo {
-    pub size: u64,
-}
-
-impl DealingChunkInfo {
-    pub fn new(size: usize) -> Self {
-        DealingChunkInfo { size: size as u64 }
-    }
-
-    pub fn construct(dealing_len: usize, chunk_size: usize) -> Vec<Self> {
-        let (full_chunks, overflow) = (dealing_len / chunk_size, dealing_len % chunk_size);
-
-        let mut chunks = Vec::new();
-        for _ in 0..full_chunks {
-            chunks.push(DealingChunkInfo::new(chunk_size));
-        }
-
-        if overflow != 0 {
-            chunks.push(DealingChunkInfo::new(overflow));
-        }
-
-        chunks
-    }
-}
-
-#[cw_serde]
-#[derive(Copy)]
-pub struct SubmittedChunk {
-    pub info: DealingChunkInfo,
-
-    pub status: ChunkSubmissionStatus,
-}
-
-#[cw_serde]
-#[derive(Default, Copy)]
-pub struct ChunkSubmissionStatus {
-    // this field is updated by the contract itself to indicate when this particular chunk has been received
-    pub submission_height: Option<u64>,
-}
-
-impl ChunkSubmissionStatus {
-    pub fn submitted(&self) -> bool {
-        self.submission_height.is_some()
-    }
-}
-
-impl From<DealingChunkInfo> for SubmittedChunk {
-    fn from(value: DealingChunkInfo) -> Self {
-        SubmittedChunk::new(value)
-    }
-}
-
-impl SubmittedChunk {
-    pub fn new(info: DealingChunkInfo) -> Self {
-        SubmittedChunk {
-            info,
-            status: Default::default(),
-        }
-    }
-
-    pub fn submitted(&self) -> bool {
-        self.status.submitted()
-    }
-}
-
-#[cw_serde]
-pub struct DealingMetadata {
-    pub dealing_index: DealingIndex,
-
-    pub submitted_chunks: BTreeMap<ChunkIndex, SubmittedChunk>,
-}
-
-impl DealingMetadata {
-    pub fn new(dealing_index: DealingIndex, chunks: Vec<DealingChunkInfo>) -> Self {
-        DealingMetadata {
-            dealing_index,
-            submitted_chunks: chunks
-                .into_iter()
-                .enumerate()
-                .map(|(id, chunk)| (id as ChunkIndex, chunk.into()))
-                .collect(),
-        }
-    }
-
-    pub fn is_complete(&self) -> bool {
-        self.submitted_chunks.values().all(|c| c.submitted())
-    }
-
-    pub fn total_size(&self) -> usize {
-        self.submitted_chunks
-            .values()
-            .map(|c| c.info.size as usize)
-            .sum()
-    }
-
-    pub fn submission_statuses(&self) -> BTreeMap<ChunkIndex, ChunkSubmissionStatus> {
-        self.submitted_chunks
-            .iter()
-            .map(|(id, c)| (*id, c.status))
-            .collect()
-    }
-}
-
-#[cw_serde]
-pub struct PartialContractDealing {
-    pub dealing_index: DealingIndex,
-    pub chunk_index: ChunkIndex,
-    pub data: PartialContractDealingData,
-}
-
-impl PartialContractDealing {
-    pub fn new(
-        dealing_index: DealingIndex,
-        chunk_index: ChunkIndex,
-        data: PartialContractDealingData,
-    ) -> Self {
-        PartialContractDealing {
-            dealing_index,
-            chunk_index,
-            data,
-        }
-    }
-}
-
-#[cw_serde]
-pub struct DealingMetadataResponse {
-    pub epoch_id: EpochId,
-
-    pub dealer: Addr,
-
-    pub dealing_index: DealingIndex,
-
-    pub metadata: Option<DealingMetadata>,
-}
-
-#[cw_serde]
-pub struct DealingChunkResponse {
-    pub epoch_id: EpochId,
-
-    pub dealer: Addr,
-
-    pub dealing_index: DealingIndex,
-
-    pub chunk_index: ChunkIndex,
-
-    pub chunk: Option<PartialContractDealingData>,
-}
-
-#[cw_serde]
-pub struct DealingChunkStatusResponse {
-    pub epoch_id: EpochId,
-
-    pub dealer: Addr,
-
-    pub dealing_index: DealingIndex,
-
-    pub chunk_index: ChunkIndex,
-
-    pub status: ChunkSubmissionStatus,
-}
-
-#[cw_serde]
-pub struct DealingStatusResponse {
-    pub epoch_id: EpochId,
-
-    pub dealer: Addr,
-
-    pub dealing_index: DealingIndex,
-
-    pub status: DealingStatus,
-}
-
-#[cw_serde]
-pub struct DealingStatus {
-    pub has_metadata: bool,
-
-    pub fully_submitted: bool,
-
-    pub chunk_submission_status: BTreeMap<ChunkIndex, ChunkSubmissionStatus>,
-}
-
-impl From<Option<DealingMetadata>> for DealingStatus {
-    fn from(metadata: Option<DealingMetadata>) -> Self {
-        DealingStatus {
-            has_metadata: metadata.is_some(),
-            fully_submitted: metadata
-                .as_ref()
-                .map(|m| m.is_complete())
-                .unwrap_or_default(),
-            chunk_submission_status: metadata
-                .map(|m| m.submission_statuses())
-                .unwrap_or_default(),
-        }
-    }
-}
-
-#[cw_serde]
-pub struct DealerDealingsStatusResponse {
-    pub epoch_id: EpochId,
-
-    pub dealer: Addr,
-
-    pub all_dealings_fully_submitted: bool,
-
-    pub dealing_submission_status: BTreeMap<DealingIndex, DealingStatus>,
-}
-
-impl DealerDealingsStatusResponse {
-    pub fn full_dealings(&self) -> usize {
-        self.dealing_submission_status
-            .values()
-            .filter(|s| s.fully_submitted)
-            .count()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn chunking_dealings() {
-        const CHUNK_SIZE: usize = 512;
-
-        let test_cases = [
-            (CHUNK_SIZE - 10, CHUNK_SIZE, 1),
-            (CHUNK_SIZE, CHUNK_SIZE, 1),
-            (CHUNK_SIZE + 10, CHUNK_SIZE, 2),
-            (CHUNK_SIZE * 2, CHUNK_SIZE, 2),
-            (CHUNK_SIZE * 2 + 1, CHUNK_SIZE, 3),
-            (CHUNK_SIZE * 10 + 42, CHUNK_SIZE, 11),
-        ];
-
-        for (dealing_len, chunk_size, expected_chunks) in test_cases {
-            let chunks = DealingChunkInfo::construct(dealing_len, chunk_size);
-            assert_eq!(expected_chunks, chunks.len());
-            assert_eq!(
-                dealing_len as u64,
-                chunks.iter().map(|c| c.size).sum::<u64>()
-            );
-
-            let mut expected_last = dealing_len % chunk_size;
-            if expected_last == 0 {
-                expected_last = chunk_size;
-            }
-            assert_eq!(chunks.last().unwrap().size, expected_last as u64);
-        }
-    }
-}
@@ -1,8 +1,4 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
 pub mod dealer;
-pub mod dealing;
 pub mod event_attributes;
 pub mod msg;
 pub mod types;
@@ -1,26 +1,16 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::dealing::{DealingChunkInfo, PartialContractDealing};
-use crate::types::{
-    ChunkIndex, DealingIndex, EncodedBTEPublicKeyWithProof, EpochId, TimeConfiguration,
-};
+use crate::types::{ContractSafeBytes, EncodedBTEPublicKeyWithProof, EpochId, TimeConfiguration};
 use crate::verification_key::VerificationKeyShare;
-use contracts_common::IdentityKey;
 use cosmwasm_schema::cw_serde;
+use cosmwasm_std::Addr;

 #[cfg(feature = "schema")]
 use crate::{
-    dealer::{
-        DealerDetailsResponse, PagedDealerIndexResponse, PagedDealerResponse,
-        RegisteredDealerDetails,
-    },
-    dealing::{
-        DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
-        DealingMetadataResponse, DealingStatusResponse,
-    },
-    types::{Epoch, State, StateAdvanceResponse},
-    verification_key::{PagedVKSharesResponse, VkShareResponse},
+    dealer::{DealerDetailsResponse, PagedDealerResponse, PagedDealingsResponse},
+    types::{Epoch, InitialReplacementData},
+    verification_key::PagedVKSharesResponse,
 };
 #[cfg(feature = "schema")]
 use cosmwasm_schema::QueryResponses;
@@ -31,70 +21,48 @@ pub struct InstantiateMsg {
    pub multisig_addr: String,
    pub time_configuration: Option<TimeConfiguration>,
    pub mix_denom: String,
-
-    /// Specifies the number of elements in the derived keys
-    pub key_size: u32,
 }

 #[cw_serde]
 pub enum ExecuteMsg {
-    // we could have just re-used AdvanceEpochState, but imo an explicit message is better
-    InitiateDkg {},
-
    RegisterDealer {
        bte_key_with_proof: EncodedBTEPublicKeyWithProof,
-        identity_key: IdentityKey,
        announce_address: String,
        resharing: bool,
    },

-    CommitDealingsMetadata {
-        dealing_index: DealingIndex,
-        chunks: Vec<DealingChunkInfo>,
+    CommitDealing {
+        dealing_bytes: ContractSafeBytes,
        resharing: bool,
    },

-    CommitDealingsChunk {
-        chunk: PartialContractDealing,
-    },
-
    CommitVerificationKeyShare {
        share: VerificationKeyShare,
        resharing: bool,
    },

    VerifyVerificationKeyShare {
-        owner: String,
+        // TODO: this should be using a String...
+        owner: Addr,
        resharing: bool,
    },

+    SurpassedThreshold {},
+
    AdvanceEpochState {},
-
-    TriggerReset {},
-
-    TriggerResharing {},
 }

 #[cw_serde]
 #[cfg_attr(feature = "schema", derive(QueryResponses))]
 pub enum QueryMsg {
-    #[cfg_attr(feature = "schema", returns(State))]
-    GetState {},
-
    #[cfg_attr(feature = "schema", returns(Epoch))]
    GetCurrentEpochState {},

    #[cfg_attr(feature = "schema", returns(u64))]
    GetCurrentEpochThreshold {},

-    #[cfg_attr(feature = "schema", returns(StateAdvanceResponse))]
-    CanAdvanceState {},
-
-    #[cfg_attr(feature = "schema", returns(RegisteredDealerDetails))]
-    GetRegisteredDealer {
-        dealer_address: String,
-        epoch_id: Option<EpochId>,
-    },
+    #[cfg_attr(feature = "schema", returns(Option<InitialReplacementData>))]
+    GetInitialDealers {},

    #[cfg_attr(feature = "schema", returns(DealerDetailsResponse))]
    GetDealerDetails { dealer_address: String },
@@ -105,59 +73,25 @@ pub enum QueryMsg {
        start_after: Option<String>,
    },

-    #[cfg_attr(feature = "schema", returns(PagedDealerIndexResponse))]
-    GetDealerIndices {
+    #[cfg_attr(feature = "schema", returns(PagedDealerResponse))]
+    GetPastDealers {
        limit: Option<u32>,
        start_after: Option<String>,
    },

-    #[cfg_attr(feature = "schema", returns(DealingMetadataResponse))]
-    GetDealingsMetadata {
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
+    #[cfg_attr(feature = "schema", returns(PagedDealingsResponse))]
+    GetDealing {
+        idx: u64,
+        limit: Option<u32>,
+        start_after: Option<String>,
    },

-    #[cfg_attr(feature = "schema", returns(DealerDealingsStatusResponse))]
-    GetDealerDealingsStatus { epoch_id: EpochId, dealer: String },
-
-    #[cfg_attr(feature = "schema", returns(DealingStatusResponse))]
-    GetDealingStatus {
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-    },
-
-    #[cfg_attr(feature = "schema", returns(DealingChunkStatusResponse))]
-    GetDealingChunkStatus {
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-        chunk_index: ChunkIndex,
-    },
-
-    #[cfg_attr(feature = "schema", returns(DealingChunkResponse))]
-    GetDealingChunk {
-        epoch_id: EpochId,
-        dealer: String,
-        dealing_index: DealingIndex,
-        chunk_index: ChunkIndex,
-    },
-
-    #[cfg_attr(feature = "schema", returns(VkShareResponse))]
-    GetVerificationKey { epoch_id: EpochId, owner: String },
-
    #[cfg_attr(feature = "schema", returns(PagedVKSharesResponse))]
    GetVerificationKeys {
        epoch_id: EpochId,
        limit: Option<u32>,
        start_after: Option<String>,
    },
-
-    /// Gets the stored contract version information that's required by the CW2 spec interface for migrations.
-    #[serde(rename = "get_cw2_contract_version")]
-    #[cfg_attr(feature = "schema", returns(cw2::ContractVersion))]
-    GetCW2ContractVersion {},
 }

 #[cw_serde]
@@ -5,36 +5,22 @@ use cosmwasm_schema::cw_serde;
 use std::fmt::{Display, Formatter};
 use std::str::FromStr;

-pub use crate::dealer::{DealerDetails, DealerRegistrationDetails, PagedDealerResponse};
+pub use crate::dealer::{DealerDetails, PagedDealerResponse};
 pub use contracts_common::dealings::ContractSafeBytes;
 pub use cosmwasm_std::{Addr, Coin, Timestamp};
-pub use cw4::Cw4Contract;

 pub type EncodedBTEPublicKeyWithProof = String;
 pub type EncodedBTEPublicKeyWithProofRef<'a> = &'a str;
 pub type NodeIndex = u64;
 pub type EpochId = u64;
-pub type DealingIndex = u32;
-// we really don't need to hold more data than that (even u8 would have been enough),
-// but explicitly make it different type than `DealingIndex` so type system would detect any
-// accidental misuses
-pub type ChunkIndex = u16;
-pub type PartialContractDealingData = ContractSafeBytes;
+
+// 2 public attributes, 2 private attributes, 1 fixed for coconut credential
+pub const TOTAL_DEALINGS: usize = 2 + 2 + 1;

 #[cw_serde]
-#[derive(Copy, Default)]
-pub struct StateAdvanceResponse {
-    pub current_state: EpochState,
-    pub progress: StateProgress,
-    pub deadline: Option<Timestamp>,
-    pub reached_deadline: bool,
-    pub is_complete: bool,
-}
-
-impl StateAdvanceResponse {
-    pub fn can_advance(&self) -> bool {
-        self.reached_deadline || self.is_complete
-    }
+pub struct InitialReplacementData {
+    pub initial_dealers: Vec<Addr>,
+    pub initial_height: u64,
 }

 #[cw_serde]
@@ -50,26 +36,6 @@ pub struct TimeConfiguration {
    pub in_progress_time_secs: u64,
 }

-impl TimeConfiguration {
-    pub fn state_duration(&self, state: EpochState) -> Option<u64> {
-        match state {
-            EpochState::WaitingInitialisation => None,
-            EpochState::PublicKeySubmission { .. } => Some(self.public_key_submission_time_secs),
-            EpochState::DealingExchange { .. } => Some(self.dealing_exchange_time_secs),
-            EpochState::VerificationKeySubmission { .. } => {
-                Some(self.verification_key_submission_time_secs)
-            }
-            EpochState::VerificationKeyValidation { .. } => {
-                Some(self.verification_key_validation_time_secs)
-            }
-            EpochState::VerificationKeyFinalization { .. } => {
-                Some(self.verification_key_finalization_time_secs)
-            }
-            EpochState::InProgress => Some(self.in_progress_time_secs),
-        }
-    }
-}
-
 impl FromStr for TimeConfiguration {
    type Err = String;

@@ -107,51 +73,13 @@ impl Default for TimeConfiguration {
    }
 }

-#[cw_serde]
-pub struct State {
-    pub mix_denom: String,
-    pub multisig_addr: Addr,
-    pub group_addr: Cw4Contract,
-
-    /// Specifies the number of elements in the derived keys
-    pub key_size: u32,
-}
-
-#[cw_serde]
-#[derive(Copy, Default)]
-pub struct StateProgress {
-    /// Counts the number of dealers that have registered in this epoch.
-    // ideally we want to have here all group members
-    pub registered_dealers: u32,
-
-    /// Counts the number of resharing dealers that have registered in this epoch.
-    /// This field is only populated during a resharing exchange.
-    /// It is always <= registered_dealers.
-    pub registered_resharing_dealers: u32,
-
-    /// Counts the number of fully received dealings (i.e. full chunks) from all the allowed dealers.
-    // we expect registered_dealers * state.key_size number of dealings here (each dealer has to submit key_size number of dealings)
-    pub submitted_dealings: u32,
-
-    /// Counts the number of submitted verification key shared from the dealers.
-    // we expect registered_dealers number of keys here
-    pub submitted_key_shares: u32,
-
-    /// Counts the number of verified key shares.
-    // we expect submitted_key_shares number of verified keys here
-    pub verified_keys: u32,
-}
-
 #[cw_serde]
 #[derive(Copy, Default)]
 pub struct Epoch {
    pub state: EpochState,
    pub epoch_id: EpochId,
-    pub state_progress: StateProgress,
    pub time_configuration: TimeConfiguration,
-
-    #[serde(alias = "finish_timestamp")]
-    pub deadline: Option<Timestamp>,
+    pub finish_timestamp: Timestamp,
 }

 impl Epoch {
@@ -161,51 +89,37 @@ impl Epoch {
        time_configuration: TimeConfiguration,
        current_timestamp: Timestamp,
    ) -> Self {
-        let duration = time_configuration.state_duration(state);
-
+        let duration = match state {
+            EpochState::PublicKeySubmission { .. } => {
+                time_configuration.public_key_submission_time_secs
+            }
+            EpochState::DealingExchange { .. } => time_configuration.dealing_exchange_time_secs,
+            EpochState::VerificationKeySubmission { .. } => {
+                time_configuration.verification_key_submission_time_secs
+            }
+            EpochState::VerificationKeyValidation { .. } => {
+                time_configuration.verification_key_validation_time_secs
+            }
+            EpochState::VerificationKeyFinalization { .. } => {
+                time_configuration.verification_key_finalization_time_secs
+            }
+            EpochState::InProgress => time_configuration.in_progress_time_secs,
+        };
        Epoch {
            state,
            epoch_id,
-            state_progress: Default::default(),
            time_configuration,
-            deadline: duration.map(|d| current_timestamp.plus_seconds(d)),
+            finish_timestamp: current_timestamp.plus_seconds(duration),
        }
    }

-    pub fn update(mut self, next_state: EpochState, current_timestamp: Timestamp) -> Self {
-        self.state = next_state;
-        let duration = self.time_configuration.state_duration(next_state);
-        self.deadline = duration.map(|d| current_timestamp.plus_seconds(d));
-
-        self
-    }
-
-    pub fn next_reset(self, current_timestamp: Timestamp) -> Self {
-        Epoch::new(
-            EpochState::PublicKeySubmission { resharing: false },
-            self.epoch_id + 1,
-            self.time_configuration,
-            current_timestamp,
-        )
-    }
-
-    pub fn next_resharing(self, current_timestamp: Timestamp) -> Self {
-        Epoch::new(
-            EpochState::PublicKeySubmission { resharing: true },
-            self.epoch_id + 1,
-            self.time_configuration,
-            current_timestamp,
-        )
-    }
-
-    pub fn final_timestamp_secs(&self) -> Option<u64> {
-        let mut finish = self.deadline?.seconds();
+    pub fn final_timestamp_secs(&self) -> u64 {
+        let mut finish = self.finish_timestamp.seconds();
        let time_configuration = self.time_configuration;
        let mut curr_epoch_state = self.state;
        while let Some(state) = curr_epoch_state.next() {
            curr_epoch_state = state;
            let adding = match curr_epoch_state {
-                EpochState::WaitingInitialisation => return None,
                EpochState::PublicKeySubmission { .. } => {
                    time_configuration.public_key_submission_time_secs
                }
@@ -223,13 +137,12 @@ impl Epoch {
            };
            finish += adding;
        }
-        Some(finish)
+        finish
    }
 }

 // currently (it is still extremely likely to change, we might be able to get rid of verification key-related complaints),
 // the epoch can be in the following states (in order):
-// 0. WaitingInitialisation -> the contract has been instantiated, but awaits for the admin to kick off the process (group members might still be getting added)
 // 1. PublicKeySubmission -> potential dealers are submitting their BTE and ed25519 public keys to participate in dealing exchange
 // 2. DealingExchange -> the actual (off-chain) dealing exchange is happening
 // 3. ComplaintSubmission -> receivers submitting evidence of other dealers sending malformed data
@@ -243,7 +156,6 @@ impl Epoch {
 #[cw_serde]
 #[derive(Copy)]
 pub enum EpochState {
-    WaitingInitialisation,
    PublicKeySubmission { resharing: bool },
    DealingExchange { resharing: bool },
    VerificationKeySubmission { resharing: bool },
@@ -254,14 +166,13 @@ pub enum EpochState {

 impl Default for EpochState {
    fn default() -> Self {
-        Self::WaitingInitialisation
+        Self::PublicKeySubmission { resharing: false }
    }
 }

 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
-            EpochState::WaitingInitialisation => write!(f, "Waiting for initialisation"),
            EpochState::PublicKeySubmission { resharing } => {
                write!(f, "PublicKeySubmission (resharing: {resharing})")
            }
@@ -283,13 +194,8 @@ impl Display for EpochState {
 }

 impl EpochState {
-    pub fn first() -> Self {
-        EpochState::PublicKeySubmission { resharing: false }
-    }
-
    pub fn next(self) -> Option<Self> {
        match self {
-            EpochState::WaitingInitialisation => None,
            EpochState::PublicKeySubmission { resharing } => {
                Some(EpochState::DealingExchange { resharing })
            }
@@ -324,8 +230,4 @@ impl EpochState {
    pub fn is_in_progress(&self) -> bool {
        matches!(self, EpochState::InProgress)
    }
-
-    pub fn is_dealing_exchange(&self) -> bool {
-        matches!(self, EpochState::DealingExchange { .. })
-    }
 }
@@ -20,13 +20,6 @@ pub struct ContractVKShare {
    pub verified: bool,
 }

-#[cw_serde]
-pub struct VkShareResponse {
-    pub owner: Addr,
-    pub epoch_id: EpochId,
-    pub share: Option<ContractVKShare>,
-}
-
 #[cw_serde]
 pub struct PagedVKSharesResponse {
    pub shares: Vec<ContractVKShare>,
@@ -43,10 +36,7 @@ pub fn to_cosmos_msg(
    multisig_addr: String,
    expiration_time: Timestamp,
 ) -> StdResult<CosmosMsg> {
-    let verify_vk_share_req = ExecuteMsg::VerifyVerificationKeyShare {
-        owner: owner.to_string(),
-        resharing,
-    };
+    let verify_vk_share_req = ExecuteMsg::VerifyVerificationKeyShare { owner, resharing };
    let verify_vk_share_msg = CosmosMsg::Wasm(WasmMsg::Execute {
        contract_addr: coconut_dkg_addr,
        msg: to_binary(&verify_vk_share_req)?,
@@ -67,14 +57,7 @@ pub fn to_cosmos_msg(
    Ok(msg)
 }

-// DKG SAFETY:
-// each legit verification proposal will only contain a single execute msg,
-// if they have more than one, we can safely ignore it
-pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<String> {
-    if msgs.len() != 1 {
-        return None;
-    }
-
+pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<Addr> {
    if let Some(CosmosMsg::Wasm(WasmMsg::Execute {
        contract_addr: _,
        msg,
@@ -8,7 +8,7 @@ license = { workspace = true }
 repository = { workspace = true }

 [dependencies]
-bs58 = { workspace = true }
+bs58 = "0.4.0"
 cosmwasm-std = { workspace = true }
 cosmwasm-schema = { workspace = true }
 schemars = "0.8"
@@ -1,17 +1,17 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use schemars::JsonSchema;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use std::fmt::{Display, Formatter};
-use std::ops::{Deref, DerefMut};
+use std::ops::Deref;

 // some sane upper-bound size on byte sizes
 // currently set to 128 bytes
 pub const MAX_DISPLAY_SIZE: usize = 128;

-// helps to transfer bytes between contract boundary to decrease amount of data sent accross
-// after it's put to `Binary`
+// TODO: if we are to use this for different types, it might make sense to introduce something like
+// CommitmentTypeId field on the below for distinguishing different ones. it would somehow become part of the trait
 #[derive(Debug, Clone, Ord, PartialOrd, Eq, PartialEq, Hash, JsonSchema)]
 pub struct ContractSafeBytes(pub Vec<u8>);

@@ -23,24 +23,6 @@ impl Deref for ContractSafeBytes {
    }
 }

-impl DerefMut for ContractSafeBytes {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.0
-    }
-}
-
-impl From<Vec<u8>> for ContractSafeBytes {
-    fn from(value: Vec<u8>) -> Self {
-        ContractSafeBytes(value)
-    }
-}
-
-impl<'a> From<&'a [u8]> for ContractSafeBytes {
-    fn from(value: &'a [u8]) -> Self {
-        value.to_vec().into()
-    }
-}
-
 impl Display for ContractSafeBytes {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        if !self.0.is_empty() {
@@ -11,9 +11,7 @@ async-trait = { workspace = true }

 log = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["sync"]}
-zeroize = { workspace = true, features = ["zeroize_derive"] }
-
+tokio = { version = "1.24.1", features = ["sync"]}

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
@@ -1,18 +0,0 @@
-/*
- * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
- * SPDX-License-Identifier: Apache-2.0
- */
-
-DROP TABLE coconut_credentials;
-CREATE TABLE coconut_credentials
-(
-    id                     INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
-
--     introduce a way for us to introduce breaking changes in serialization
-    serialization_revision INTEGER NOT NULL,
-    credential_type        TEXT    NOT NULL,
-    credential_data        BLOB    NOT NULL,
-    epoch_id               INTEGER NOT NULL,
-    consumed               BOOLEAN NOT NULL,
-    expired                BOOLEAN NOT NULL
-);
@@ -1,65 +1,59 @@
-// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::StoredIssuedCredential;
+use crate::models::CoconutCredential;
 use std::sync::Arc;
 use tokio::sync::RwLock;

 #[derive(Clone)]
 pub struct CoconutCredentialManager {
-    inner: Arc<RwLock<CoconutCredentialManagerInner>>,
-}
-
-#[derive(Default)]
-struct CoconutCredentialManagerInner {
-    data: Vec<StoredIssuedCredential>,
-    _next_id: i64,
-}
-
-impl CoconutCredentialManagerInner {
-    fn next_id(&mut self) -> i64 {
-        let next = self._next_id;
-        self._next_id += 1;
-        next
-    }
+    inner: Arc<RwLock<Vec<CoconutCredential>>>,
 }

 impl CoconutCredentialManager {
    /// Creates new empty instance of the `CoconutCredentialManager`.
    pub fn new() -> Self {
        CoconutCredentialManager {
-            inner: Default::default(),
+            inner: Arc::new(RwLock::new(Vec::new())),
        }
    }

-    pub async fn insert_issued_credential(
+    /// Inserts provided signature into the database.
+    ///
+    /// # Arguments
+    ///
+    /// * `voucher_value`: Plaintext bandwidth value of the credential.
+    /// * `voucher_info`: Plaintext information of the credential.
+    /// * `serial_number`: Base58 representation of the serial number attribute.
+    /// * `binding_number`: Base58 representation of the binding number attribute.
+    /// * `signature`: Coconut credential in the form of a signature.
+    pub async fn insert_coconut_credential(
        &self,
-        credential_type: String,
-        serialization_revision: u8,
-        credential_data: &[u8],
-        epoch_id: u32,
+        voucher_value: String,
+        voucher_info: String,
+        serial_number: String,
+        binding_number: String,
+        signature: String,
+        epoch_id: String,
    ) {
-        let mut inner = self.inner.write().await;
-        let id = inner.next_id();
-        inner.data.push(StoredIssuedCredential {
+        let mut creds = self.inner.write().await;
+        let id = creds.len() as i64;
+        creds.push(CoconutCredential {
            id,
-            serialization_revision,
-            credential_data: credential_data.to_vec(),
-            credential_type,
+            voucher_value,
+            voucher_info,
+            serial_number,
+            binding_number,
+            signature,
            epoch_id,
            consumed: false,
-            expired: false,
-        })
+        });
    }

    /// Tries to retrieve one of the stored, unused credentials.
-    pub async fn get_next_unspent_credential(&self) -> Option<StoredIssuedCredential> {
+    pub async fn get_next_coconut_credential(&self) -> Option<CoconutCredential> {
        let creds = self.inner.read().await;
-        creds
-            .data
-            .iter()
-            .find(|c| !c.consumed && !c.expired)
-            .cloned()
+        creds.iter().find(|c| !c.consumed).cloned()
    }

    /// Consumes in the database the specified credential.
@@ -69,20 +63,8 @@ impl CoconutCredentialManager {
    /// * `id`: Database id.
    pub async fn consume_coconut_credential(&self, id: i64) {
        let mut creds = self.inner.write().await;
-        if let Some(cred) = creds.data.get_mut(id as usize) {
+        if let Some(cred) = creds.get_mut(id as usize) {
            cred.consumed = true;
        }
    }
-
-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    pub async fn mark_expired(&self, id: i64) {
-        let mut creds = self.inner.write().await;
-        if let Some(cred) = creds.data.get_mut(id as usize) {
-            cred.expired = true;
-        }
-    }
 }
@@ -1,7 +1,7 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::StoredIssuedCredential;
+use crate::models::CoconutCredential;

 #[derive(Clone)]
 pub struct CoconutCredentialManager {
@@ -18,28 +18,40 @@ impl CoconutCredentialManager {
        CoconutCredentialManager { connection_pool }
    }

-    pub async fn insert_issued_credential(
+    /// Inserts provided signature into the database.
+    ///
+    /// # Arguments
+    ///
+    /// * `voucher_value`: Plaintext bandwidth value of the credential.
+    /// * `voucher_info`: Plaintext information of the credential.
+    /// * `serial_number`: Base58 representation of the serial number attribute.
+    /// * `binding_number`: Base58 representation of the binding number attribute.
+    /// * `signature`: Coconut credential in the form of a signature.
+    pub async fn insert_coconut_credential(
        &self,
-        credential_type: String,
-        serialization_revision: u8,
-        credential_data: &[u8],
-        epoch_id: u32,
+        voucher_value: String,
+        voucher_info: String,
+        serial_number: String,
+        binding_number: String,
+        signature: String,
+        epoch_id: String,
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
-            r#"
-                INSERT INTO coconut_credentials(serialization_revision, credential_type, credential_data, epoch_id, consumed, expired)
-                VALUES (?, ?, ?, ?, false, false)
-            "#,
-            serialization_revision, credential_type, credential_data, epoch_id
-        ).execute(&self.connection_pool).await?;
+            "INSERT INTO coconut_credentials(voucher_value, voucher_info, serial_number, binding_number, signature, epoch_id, consumed) VALUES (?, ?, ?, ?, ?, ?, ?)",
+            voucher_value, voucher_info, serial_number, binding_number, signature, epoch_id, false
+        )
+        .execute(&self.connection_pool)
+        .await?;
        Ok(())
    }

-    pub async fn get_next_unspent_credential(
+    /// Tries to retrieve one of the stored, unused credentials.
+    pub async fn get_next_coconut_credential(
        &self,
-    ) -> Result<Option<StoredIssuedCredential>, sqlx::Error> {
-        sqlx::query_as(
-            "SELECT * FROM coconut_credentials WHERE NOT consumed AND NOT expired LIMIT 1",
+    ) -> Result<Option<CoconutCredential>, sqlx::Error> {
+        sqlx::query_as!(
+            CoconutCredential,
+            "SELECT * FROM coconut_credentials WHERE NOT consumed"
        )
        .fetch_optional(&self.connection_pool)
        .await
@@ -59,19 +71,4 @@ impl CoconutCredentialManager {
        .await?;
        Ok(())
    }
-
-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    pub async fn mark_expired(&self, id: i64) -> Result<(), sqlx::Error> {
-        sqlx::query!(
-            "UPDATE coconut_credentials SET expired = TRUE WHERE id = ?",
-            id
-        )
-        .execute(&self.connection_pool)
-        .await?;
-        Ok(())
-    }
 }
@@ -3,7 +3,7 @@

 use crate::backends::memory::CoconutCredentialManager;
 use crate::error::StorageError;
-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
+use crate::models::CoconutCredential;
 use crate::storage::Storage;
 use async_trait::async_trait;

@@ -27,28 +27,37 @@ impl Default for EphemeralStorage {
 impl Storage for EphemeralStorage {
    type StorageError = StorageError;

-    async fn insert_issued_credential<'a>(
+    async fn insert_coconut_credential(
        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
+        voucher_value: String,
+        voucher_info: String,
+        serial_number: String,
+        binding_number: String,
+        signature: String,
+        epoch_id: String,
    ) -> Result<(), StorageError> {
        self.coconut_credential_manager
-            .insert_issued_credential(
-                bandwidth_credential.credential_type,
-                bandwidth_credential.serialization_revision,
-                bandwidth_credential.credential_data,
-                bandwidth_credential.epoch_id,
+            .insert_coconut_credential(
+                voucher_value,
+                voucher_info,
+                serial_number,
+                binding_number,
+                signature,
+                epoch_id,
            )
            .await;
+
        Ok(())
    }

-    async fn get_next_unspent_credential(
-        &self,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
-        Ok(self
+    async fn get_next_coconut_credential(&self) -> Result<CoconutCredential, StorageError> {
+        let credential = self
            .coconut_credential_manager
-            .get_next_unspent_credential()
-            .await)
+            .get_next_coconut_credential()
+            .await
+            .ok_or(StorageError::NoCredential)?;
+
+        Ok(credential)
    }

    async fn consume_coconut_credential(&self, id: i64) -> Result<(), StorageError> {
@@ -58,10 +67,4 @@ impl Storage for EphemeralStorage {

        Ok(())
    }
-
-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
-        self.coconut_credential_manager.mark_expired(id).await;
-
-        Ok(())
-    }
 }
@@ -1,39 +1,15 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use zeroize::{Zeroize, ZeroizeOnDrop};
-
-// #[derive(Clone)]
-// pub struct CoconutCredential {
-//     #[allow(dead_code)]
-//     pub id: i64,
-//     pub voucher_value: String,
-//     pub voucher_info: String,
-//     pub serial_number: String,
-//     pub binding_number: String,
-//     pub signature: String,
-//     pub epoch_id: String,
-//     pub consumed: bool,
-// }
-
-#[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
-#[derive(Zeroize, ZeroizeOnDrop, Clone)]
-pub struct StoredIssuedCredential {
+#[derive(Clone)]
+pub struct CoconutCredential {
+    #[allow(dead_code)]
    pub id: i64,
-
-    pub serialization_revision: u8,
-    pub credential_data: Vec<u8>,
-    pub credential_type: String,
-
-    pub epoch_id: u32,
+    pub voucher_value: String,
+    pub voucher_info: String,
+    pub serial_number: String,
+    pub binding_number: String,
+    pub signature: String,
+    pub epoch_id: String,
    pub consumed: bool,
-    pub expired: bool,
-}
-
-pub struct StorableIssuedCredential<'a> {
-    pub serialization_revision: u8,
-    pub credential_data: &'a [u8],
-    pub credential_type: String,
-
-    pub epoch_id: u32,
 }
@@ -5,7 +5,7 @@ use crate::backends::sqlite::CoconutCredentialManager;
 use crate::error::StorageError;
 use crate::storage::Storage;

-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
+use crate::models::CoconutCredential;
 use async_trait::async_trait;
 use log::{debug, error};
 use sqlx::ConnectOptions;
@@ -58,29 +58,37 @@ impl PersistentStorage {
 impl Storage for PersistentStorage {
    type StorageError = StorageError;

-    async fn insert_issued_credential<'a>(
+    async fn insert_coconut_credential(
        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
-    ) -> Result<(), Self::StorageError> {
+        voucher_value: String,
+        voucher_info: String,
+        serial_number: String,
+        binding_number: String,
+        signature: String,
+        epoch_id: String,
+    ) -> Result<(), StorageError> {
        self.coconut_credential_manager
-            .insert_issued_credential(
-                bandwidth_credential.credential_type,
-                bandwidth_credential.serialization_revision,
-                bandwidth_credential.credential_data,
-                bandwidth_credential.epoch_id,
+            .insert_coconut_credential(
+                voucher_value,
+                voucher_info,
+                serial_number,
+                binding_number,
+                signature,
+                epoch_id,
            )
            .await?;

        Ok(())
    }

-    async fn get_next_unspent_credential(
-        &self,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
-        Ok(self
+    async fn get_next_coconut_credential(&self) -> Result<CoconutCredential, StorageError> {
+        let credential = self
            .coconut_credential_manager
-            .get_next_unspent_credential()
-            .await?)
+            .get_next_coconut_credential()
+            .await?
+            .ok_or(StorageError::NoCredential)?;
+
+        Ok(credential)
    }

    async fn consume_coconut_credential(&self, id: i64) -> Result<(), StorageError> {
@@ -90,10 +98,4 @@ impl Storage for PersistentStorage {

        Ok(())
    }
-
-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
-        self.coconut_credential_manager.mark_expired(id).await?;
-
-        Ok(())
-    }
 }
@@ -1,7 +1,7 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
+use crate::models::CoconutCredential;
 use async_trait::async_trait;
 use std::error::Error;

@@ -9,16 +9,28 @@ use std::error::Error;
 pub trait Storage: Send + Sync {
    type StorageError: Error;

-    async fn insert_issued_credential<'a>(
+    /// Inserts provided signature into the database.
+    ///
+    /// # Arguments
+    ///
+    /// * `voucher_value`: How much bandwidth is in the credential.
+    /// * `voucher_info`: What type of credential it is.
+    /// * `serial_number`: Serial number of the credential.
+    /// * `binding_number`: Binding number of the credential.
+    /// * `signature`: Coconut credential in the form of a signature.
+    /// * `epoch_id`: The epoch when it was signed.
+    async fn insert_coconut_credential(
        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
+        voucher_value: String,
+        voucher_info: String,
+        serial_number: String,
+        binding_number: String,
+        signature: String,
+        epoch_id: String,
    ) -> Result<(), Self::StorageError>;

-    /// Tries to retrieve one of the stored, unused credentials,
-    /// that is also not marked as expired
-    async fn get_next_unspent_credential(
-        &self,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError>;
+    /// Tries to retrieve one of the stored, unused credentials.
+    async fn get_next_coconut_credential(&self) -> Result<CoconutCredential, Self::StorageError>;

    /// Marks as consumed in the database the specified credential.
    ///
@@ -26,11 +38,4 @@ pub trait Storage: Send + Sync {
    ///
    /// * `id`: Id of the credential to be consumed.
    async fn consume_coconut_credential(&self, id: i64) -> Result<(), Self::StorageError>;
-
-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError>;
 }
@@ -12,7 +12,6 @@ thiserror = { workspace = true }
 tokio = { workspace = true }

 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
-nym-coconut = { path = "../nymcoconut" }
 nym-credentials = { path = "../../common/credentials" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-validator-client = { path = "../../common/client-libs/validator-client" }
@@ -3,13 +3,11 @@

 use crate::errors::Result;
 use log::error;
-use nym_credentials::coconut::bandwidth::IssuanceBandwidthCredential;
+use nym_credentials::coconut::bandwidth::BandwidthVoucher;
 use std::fs::{create_dir_all, read_dir, File};
 use std::io::{Read, Write};
 use std::path::PathBuf;

-pub const DUMPED_VOUCHER_EXTENSION: &str = "credentialrecovery";
-
 pub struct RecoveryStorage {
    recovery_dir: PathBuf,
 }
@@ -20,16 +18,14 @@ impl RecoveryStorage {
        Ok(Self { recovery_dir })
    }

-    pub fn unconsumed_vouchers(&self) -> Result<Vec<IssuanceBandwidthCredential>> {
+    pub fn unconsumed_vouchers(&self) -> Result<Vec<BandwidthVoucher>> {
        let entries = read_dir(&self.recovery_dir)?;

        let mut paths = vec![];
        for entry in entries.flatten() {
            let path = entry.path();
-            if let Some(extension) = path.extension() {
-                if extension == DUMPED_VOUCHER_EXTENSION {
-                    paths.push(path)
-                }
+            if path.is_file() {
+                paths.push(path)
            }
        }

@@ -38,7 +34,7 @@ impl RecoveryStorage {
            if let Ok(mut file) = File::open(&path) {
                let mut buff = Vec::new();
                if file.read_to_end(&mut buff).is_ok() {
-                    match IssuanceBandwidthCredential::try_from_recovered_bytes(&buff) {
+                    match BandwidthVoucher::try_from_bytes(&buff) {
                        Ok(voucher) => vouchers.push(voucher),
                        Err(err) => {
                            error!("failed to parse the voucher at {}: {err}", path.display())
@@ -51,17 +47,11 @@ impl RecoveryStorage {
        Ok(vouchers)
    }

-    pub fn voucher_filename(voucher: &IssuanceBandwidthCredential) -> String {
-        let prefix = voucher.typ().to_string();
-        let suffix = voucher.blinded_serial_number_bs58();
-        format!("{prefix}-{suffix}.{DUMPED_VOUCHER_EXTENSION}")
-    }
-
-    pub fn insert_voucher(&self, voucher: &IssuanceBandwidthCredential) -> Result<PathBuf> {
-        let file_name = Self::voucher_filename(voucher);
+    pub fn insert_voucher(&self, voucher: &BandwidthVoucher) -> Result<PathBuf> {
+        let file_name = voucher.tx_hash().to_string();
        let file_path = self.recovery_dir.join(file_name);
        let mut file = File::create(&file_path)?;
-        let buff = voucher.to_recovery_bytes();
+        let buff = voucher.to_bytes();
        file.write_all(&buff)?;

        Ok(file_path)
@@ -5,10 +5,7 @@ use nym_bandwidth_controller::acquire::state::State;
 use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::DEFAULT_DATA_DIR;
 use nym_credential_storage::persistent_storage::PersistentStorage;
-use nym_credentials::coconut::bandwidth::CredentialType;
-use nym_validator_client::nyxd::contract_traits::{
-    dkg_query_client::EpochState, CoconutBandwidthSigningClient, DkgQueryClient,
-};
+use nym_validator_client::nyxd::contract_traits::{CoconutBandwidthSigningClient, DkgQueryClient};
 use nym_validator_client::nyxd::Coin;
 use std::path::PathBuf;
 use std::process::exit;
@@ -44,7 +41,7 @@ where

    let state = nym_bandwidth_controller::acquire::deposit(client, amount.clone()).await?;

-    if nym_bandwidth_controller::acquire::get_bandwidth_voucher(&state, client, persistent_storage)
+    if nym_bandwidth_controller::acquire::get_credential(&state, client, persistent_storage)
        .await
        .is_err()
    {
@@ -90,29 +87,21 @@ where
            .duration_since(SystemTime::UNIX_EPOCH)
            .expect("the system clock is set to 01/01/1970 (or earlier)")
            .as_secs();
-
        if epoch.state.is_final() {
-            if let Some(finish_timestamp) = epoch.deadline {
-                if current_timestamp_secs + SAFETY_BUFFER_SECS >= finish_timestamp.seconds() {
-                    info!("In the next {} minute(s), a transition will take place in the coconut system. Deposits should be halted in this time for safety reasons.", SAFETY_BUFFER_SECS / 60);
-                    exit(0);
-                }
+            if current_timestamp_secs + SAFETY_BUFFER_SECS >= epoch.finish_timestamp.seconds() {
+                info!("In the next {} minute(s), a transition will take place in the coconut system. Deposits should be halted in this time for safety reasons.", SAFETY_BUFFER_SECS / 60);
+                exit(0);
            }

            break;
-        } else if let Some(final_timestamp) = epoch.final_timestamp_secs() {
+        } else {
            // Use 1 additional second to not start the next iteration immediately and spam get_current_epoch queries
-            let secs_until_final = final_timestamp.saturating_sub(current_timestamp_secs) + 1;
+            let secs_until_final = epoch
+                .final_timestamp_secs()
+                .saturating_sub(current_timestamp_secs)
+                + 1;
            info!("Approximately {} seconds until coconut is available. Sleeping until then. You can safely kill the process at any moment.", secs_until_final);
            tokio::time::sleep(Duration::from_secs(secs_until_final)).await;
-        } else if matches!(epoch.state, EpochState::WaitingInitialisation) {
-            info!("dkg hasn't been initialised yet and it is not known when it will be. Going to check again later");
-            tokio::time::sleep(Duration::from_secs(60 * 5)).await;
-        } else {
-            // this should never be the case since the only case where final timestamp is unknown is when it's waiting for initialisation,
-            // but let's guard ourselves against future changes
-            info!("it is unknown when coconut will be come available. Going to check again later");
-            tokio::time::sleep(Duration::from_secs(60 * 5)).await;
        }
    }

@@ -129,29 +118,19 @@ where
 {
    let mut recovered_amount: u128 = 0;
    for voucher in recovery_storage.unconsumed_vouchers()? {
-        let voucher_value = match voucher.typ() {
-            CredentialType::Voucher => voucher.get_bandwidth_attribute(),
-            CredentialType::FreePass => {
-                error!("unimplemented recovery of free pass credentials");
-                continue;
-            }
-        };
+        let voucher_value = voucher.get_voucher_value();
        recovered_amount += voucher_value.parse::<u128>()?;

-        let voucher_name = RecoveryStorage::voucher_filename(&voucher);
        let state = State::new(voucher);
-
+        let voucher = state.voucher.tx_hash();
        if let Err(e) =
-            nym_bandwidth_controller::acquire::get_bandwidth_voucher(&state, client, shared_storage)
-                .await
+            nym_bandwidth_controller::acquire::get_credential(&state, client, shared_storage).await
        {
-            error!("Could not recover deposit {voucher_name} due to {e}, try again later",)
+            error!("Could not recover deposit {voucher} due to {e}, try again later",)
        } else {
-            info!(
-                "Converted deposit {voucher_name} to a credential, removing recovery data for it",
-            );
-            if let Err(err) = recovery_storage.remove_voucher(voucher_name) {
-                warn!("Could not remove recovery data: {err}");
+            info!("Converted deposit {voucher} to a credential, removing recovery data for it",);
+            if let Err(e) = recovery_storage.remove_voucher(voucher.to_string()) {
+                warn!("Could not remove recovery data: {e}");
            }
        }
    }
@@ -1,18 +0,0 @@
-[package]
-name = "nym-credentials-interface"
-version = "0.1.0"
-authors.workspace = true
-repository.workspace = true
-homepage.workspace = true
-documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-bls12_381 = { workspace = true, default-features = false }
-serde = { workspace = true, features = ["derive"] }
-thiserror = { workspace = true }
-
-nym-coconut = { path = "../nymcoconut" }
@@ -1,136 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use bls12_381::Scalar;
-use serde::{Deserialize, Serialize};
-use std::fmt::{Display, Formatter};
-use std::str::FromStr;
-use thiserror::Error;
-
-pub use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar, keygen,
-    prepare_blind_sign, prove_bandwidth_credential, verify_credential, Attribute, Base58,
-    BlindSignRequest, BlindedSerialNumber, BlindedSignature, Bytable, CoconutError, KeyPair,
-    Parameters, PrivateAttribute, PublicAttribute, SecretKey, Signature, SignatureShare,
-    VerificationKey, VerifyCredentialRequest,
-};
-
-pub const VOUCHER_INFO_TYPE: &str = "BandwidthVoucher";
-pub const FREE_PASS_INFO_TYPE: &str = "FreeBandwidthPass";
-
-// pub trait NymCredential {
-//     fn prove_credential(&self) -> Result<(), ()>;
-// }
-
-#[derive(Debug, Error)]
-#[error("{0} is not a valid credential type")]
-pub struct UnknownCredentialType(String);
-
-#[derive(Copy, Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Hash)]
-pub enum CredentialType {
-    Voucher,
-    FreePass,
-}
-
-impl FromStr for CredentialType {
-    type Err = UnknownCredentialType;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        if s == VOUCHER_INFO_TYPE {
-            Ok(CredentialType::Voucher)
-        } else if s == FREE_PASS_INFO_TYPE {
-            Ok(CredentialType::FreePass)
-        } else {
-            Err(UnknownCredentialType(s.to_string()))
-        }
-    }
-}
-
-impl CredentialType {
-    pub fn validate(&self, type_plain: &str) -> bool {
-        match self {
-            CredentialType::Voucher => type_plain == VOUCHER_INFO_TYPE,
-            CredentialType::FreePass => type_plain == FREE_PASS_INFO_TYPE,
-        }
-    }
-
-    pub fn is_free_pass(&self) -> bool {
-        matches!(self, CredentialType::FreePass)
-    }
-
-    pub fn is_voucher(&self) -> bool {
-        matches!(self, CredentialType::Voucher)
-    }
-}
-
-impl Display for CredentialType {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            CredentialType::Voucher => VOUCHER_INFO_TYPE.fmt(f),
-            CredentialType::FreePass => FREE_PASS_INFO_TYPE.fmt(f),
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct CredentialSigningData {
-    pub pedersen_commitments_openings: Vec<Scalar>,
-
-    pub blind_sign_request: BlindSignRequest,
-
-    pub public_attributes_plain: Vec<String>,
-
-    pub typ: CredentialType,
-}
-
-#[derive(Debug, Serialize, Deserialize, PartialEq, Eq, Clone)]
-pub struct CredentialSpendingData {
-    pub embedded_private_attributes: usize,
-
-    pub verify_credential_request: VerifyCredentialRequest,
-
-    pub public_attributes_plain: Vec<String>,
-
-    pub typ: CredentialType,
-
-    /// The (DKG) epoch id under which the credential has been issued so that the verifier could use correct verification key for validation.
-    pub epoch_id: u64,
-}
-
-impl CredentialSpendingData {
-    pub fn verify(&self, params: &Parameters, verification_key: &VerificationKey) -> bool {
-        let hashed_public_attributes = self
-            .public_attributes_plain
-            .iter()
-            .map(hash_to_scalar)
-            .collect::<Vec<_>>();
-
-        // get references to the attributes
-        let public_attributes = hashed_public_attributes.iter().collect::<Vec<_>>();
-
-        verify_credential(
-            params,
-            verification_key,
-            &self.verify_credential_request,
-            &public_attributes,
-        )
-    }
-
-    pub fn validate_type_attribute(&self) -> bool {
-        // the first attribute is variant specific bandwidth encoding, the second one should be the type
-        let Some(type_plain) = self.public_attributes_plain.get(1) else {
-            return false;
-        };
-
-        self.typ.validate(type_plain)
-    }
-
-    pub fn get_bandwidth_attribute(&self) -> Option<&String> {
-        // the first attribute is variant specific bandwidth encoding, the second one should be the type
-        self.public_attributes_plain.first()
-    }
-
-    pub fn blinded_serial_number(&self) -> BlindedSerialNumber {
-        self.verify_credential_request.blinded_serial_number()
-    }
-}
@@ -8,17 +8,14 @@ license.workspace = true

 [dependencies]
 bls12_381 = { workspace = true, default-features = false, features = ["pairings", "alloc", "experimental"] }
-bincode = "1.3.3"
 cosmrs = { workspace = true }
 thiserror = { workspace = true }
 log = { workspace = true }
-time = { workspace = true, features = ["serde"] }
-serde = { workspace = true, features = ["derive"] }
 zeroize = { workspace = true }

 # I guess temporarily until we get serde support in coconut up and running
-nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "serde"] }
+nym-coconut-interface = { path = "../coconut-interface" }
+nym-crypto = { path = "../crypto", features = ["rand", "asymmetric"] }
 nym-api-requests = { path = "../../nym-api/nym-api-requests" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }

@@ -0,0 +1,428 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// for time being assume the bandwidth credential consists of public identity of the requester
+// and private (though known... just go along with it) infinite bandwidth value
+// right now this has no double-spending protection, spender binding, etc
+// it's the simplest possible case
+
+use cosmrs::tendermint::hash::Algorithm;
+use cosmrs::tendermint::Hash;
+use nym_coconut_interface::{
+    hash_to_scalar, prepare_blind_sign, Attribute, BlindSignRequest, Credential, Parameters,
+    PrivateAttribute, PublicAttribute, Signature, VerificationKey,
+};
+use nym_crypto::asymmetric::{encryption, identity};
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use super::utils::prepare_credential_for_spending;
+use crate::error::Error;
+
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub struct BandwidthVoucher {
+    // private attributes
+    /// a random secret value generated by the client used for double-spending detection
+    serial_number: PrivateAttribute,
+
+    /// a random secret value generated by the client used to bind multiple credentials together
+    binding_number: PrivateAttribute,
+
+    // public atttributes:
+    /// the plain text value (e.g., bandwidth) encoded in this voucher
+    // TODO: in another PR change the value from `"1000"` to `"1000unym"`
+    voucher_value_plain: String,
+
+    /// the plain text information
+    voucher_info_plain: String,
+
+    /// the precomputed value (e.g., bandwidth) encoded in this voucher
+    _voucher_value_prehashed: PublicAttribute,
+
+    /// the precomputed field with public information, e.g., type of voucher, interval etc.
+    _voucher_info_prehashed: PublicAttribute,
+
+    /// the hash of the deposit transaction
+    #[zeroize(skip)]
+    tx_hash: Hash,
+
+    /// base58 encoded private key ensuring the depositer requested these attributes
+    signing_key: identity::PrivateKey,
+
+    /// base58 encoded private key ensuring only this client receives the signature share
+    unused_ed25519: encryption::PrivateKey,
+
+    pedersen_commitments_openings: Vec<Attribute>,
+
+    #[zeroize(skip)]
+    blind_sign_request: BlindSignRequest,
+}
+
+impl BandwidthVoucher {
+    pub const PUBLIC_ATTRIBUTES: u32 = 2;
+    pub const PRIVATE_ATTRIBUTES: u32 = 2;
+    pub const ENCODED_ATTRIBUTES: u32 = 4;
+
+    pub fn default_parameters() -> Parameters {
+        // safety: the unwrap is fine here as Self::ENCODED_ATTRIBUTES is non-zero
+        Parameters::new(Self::ENCODED_ATTRIBUTES).unwrap()
+    }
+
+    pub fn new(
+        params: &Parameters,
+        voucher_value: String,
+        voucher_info: String,
+        tx_hash: Hash,
+        signing_key: identity::PrivateKey,
+        encryption_key: encryption::PrivateKey,
+    ) -> Self {
+        let serial_number = params.random_scalar();
+        let binding_number = params.random_scalar();
+        let voucher_value_plain = voucher_value.clone();
+        let voucher_info_plain = voucher_info.clone();
+
+        let _voucher_value_prehashed = hash_to_scalar(voucher_value);
+        let _voucher_info_prehashed = hash_to_scalar(voucher_info);
+
+        let (pedersen_commitments_openings, blind_sign_request) = prepare_blind_sign(
+            params,
+            &[&serial_number, &binding_number],
+            &[&_voucher_value_prehashed, &_voucher_info_prehashed],
+        )
+        .unwrap();
+        BandwidthVoucher {
+            serial_number,
+            binding_number,
+            _voucher_value_prehashed,
+            voucher_value_plain,
+            _voucher_info_prehashed,
+            voucher_info_plain,
+            tx_hash,
+            signing_key,
+            unused_ed25519: encryption_key,
+            pedersen_commitments_openings,
+            blind_sign_request,
+        }
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let serial_number_b = self.serial_number.to_bytes();
+        let binding_number_b = self.binding_number.to_bytes();
+        let voucher_value_plain_b = self.voucher_value_plain.as_bytes();
+        let voucher_info_plain_b = self.voucher_info_plain.as_bytes();
+        let tx_hash_b = self.tx_hash.as_bytes();
+        let signing_key_b = self.signing_key.to_bytes();
+        let encryption_key_b = self.unused_ed25519.to_bytes();
+        let blind_sign_request_b = self.blind_sign_request.to_bytes();
+
+        let mut ret = Vec::new();
+
+        ret.extend_from_slice(&serial_number_b);
+        ret.extend_from_slice(&binding_number_b);
+        ret.extend_from_slice(tx_hash_b);
+        ret.extend_from_slice(&signing_key_b);
+        ret.extend_from_slice(&encryption_key_b);
+        ret.extend_from_slice(&(voucher_value_plain_b.len() as u64).to_be_bytes());
+        ret.extend_from_slice(&(voucher_info_plain_b.len() as u64).to_be_bytes());
+        ret.extend_from_slice(&(blind_sign_request_b.len() as u64).to_be_bytes());
+        ret.extend_from_slice(&(self.pedersen_commitments_openings.len() as u64).to_be_bytes());
+        ret.extend_from_slice(voucher_value_plain_b);
+        ret.extend_from_slice(voucher_info_plain_b);
+        ret.extend_from_slice(&blind_sign_request_b);
+        for commitment in self.pedersen_commitments_openings.iter() {
+            ret.extend_from_slice(&commitment.to_bytes());
+        }
+
+        ret
+    }
+
+    pub fn try_from_bytes(bytes: &[u8]) -> Result<Self, Error> {
+        if bytes.len() < 32 * 5 + 4 * 8 {
+            return Err(Error::BandwidthVoucherDeserializationError(format!(
+                "Less then {} bytes needed",
+                32 * 5 + 4 * 8
+            )));
+        }
+        let mut buff = [0u8; 32];
+        let mut small_buff = [0u8; 8];
+        let scalar_err =
+            || Error::BandwidthVoucherDeserializationError(String::from("Invalid Scalar"));
+        buff.copy_from_slice(&bytes[..32]);
+        let serial_number = Option::<PrivateAttribute>::from(PrivateAttribute::from_bytes(&buff))
+            .ok_or_else(scalar_err)?;
+        buff.copy_from_slice(&bytes[32..2 * 32]);
+        let binding_number = Option::<PrivateAttribute>::from(PrivateAttribute::from_bytes(&buff))
+            .ok_or_else(scalar_err)?;
+        buff.copy_from_slice(&bytes[2 * 32..3 * 32]);
+        let tx_hash = Hash::from_bytes(Algorithm::Sha256, &buff).map_err(|_| {
+            Error::BandwidthVoucherDeserializationError(String::from("Invalid transaction Hash"))
+        })?;
+        buff.copy_from_slice(&bytes[3 * 32..4 * 32]);
+        let signing_key = identity::PrivateKey::from_bytes(&buff).map_err(|_| {
+            Error::BandwidthVoucherDeserializationError(String::from("Invalid key"))
+        })?;
+        buff.copy_from_slice(&bytes[4 * 32..5 * 32]);
+        let encryption_key = encryption::PrivateKey::from_bytes(&buff).map_err(|_| {
+            Error::BandwidthVoucherDeserializationError(String::from("Invalid key"))
+        })?;
+        small_buff.copy_from_slice(&bytes[5 * 32..5 * 32 + 8]);
+        let voucher_value_plain_no = u64::from_be_bytes(small_buff) as usize;
+        small_buff.copy_from_slice(&bytes[5 * 32 + 8..5 * 32 + 2 * 8]);
+        let voucher_info_plain_no = u64::from_be_bytes(small_buff) as usize;
+        small_buff.copy_from_slice(&bytes[5 * 32 + 2 * 8..5 * 32 + 3 * 8]);
+        let blind_sign_request_no = u64::from_be_bytes(small_buff) as usize;
+        small_buff.copy_from_slice(&bytes[5 * 32 + 3 * 8..5 * 32 + 4 * 8]);
+        let pedersen_commitments_openings_no = u64::from_be_bytes(small_buff) as usize;
+
+        let total_length = 32 * 5
+            + 4 * 8
+            + voucher_value_plain_no
+            + voucher_info_plain_no
+            + blind_sign_request_no
+            + pedersen_commitments_openings_no * 32;
+        if bytes.len() != total_length {
+            return Err(Error::BandwidthVoucherDeserializationError(format!(
+                "Expected {total_length} bytes",
+            )));
+        }
+
+        let utf_err = |_| {
+            Err(Error::BandwidthVoucherDeserializationError(String::from(
+                "Invalid UTF8 string",
+            )))
+        };
+        let mut var_length_pointer = 5 * 32 + 4 * 8;
+        let voucher_value_plain = String::from_utf8(
+            bytes[var_length_pointer..var_length_pointer + voucher_value_plain_no].to_vec(),
+        )
+        .or_else(utf_err)?;
+        let _voucher_value_prehashed = hash_to_scalar(&voucher_value_plain);
+        var_length_pointer += voucher_value_plain_no;
+        let voucher_info_plain = String::from_utf8(
+            bytes[var_length_pointer..var_length_pointer + voucher_info_plain_no].to_vec(),
+        )
+        .or_else(utf_err)?;
+        let _voucher_info_prehashed = hash_to_scalar(&voucher_info_plain);
+        var_length_pointer += voucher_info_plain_no;
+        let blind_sign_request = BlindSignRequest::from_bytes(
+            &bytes[var_length_pointer..var_length_pointer + blind_sign_request_no],
+        )?;
+        var_length_pointer += blind_sign_request_no;
+
+        let mut pedersen_commitments_openings = Vec::new();
+        for _ in 0..pedersen_commitments_openings_no {
+            buff.copy_from_slice(&bytes[var_length_pointer..var_length_pointer + 32]);
+            let commitment =
+                Option::<Attribute>::from(Attribute::from_bytes(&buff)).ok_or_else(scalar_err)?;
+            var_length_pointer += 32;
+            pedersen_commitments_openings.push(commitment);
+        }
+
+        Ok(Self {
+            serial_number,
+            binding_number,
+            _voucher_value_prehashed,
+            voucher_value_plain,
+            _voucher_info_prehashed,
+            voucher_info_plain,
+            tx_hash,
+            signing_key,
+            unused_ed25519: encryption_key,
+            pedersen_commitments_openings,
+            blind_sign_request,
+        })
+    }
+
+    /// Check if the plain values correspond to the PublicAttributes
+    pub fn verify_against_plain(values: &[&PublicAttribute], plain_values: &[String]) -> bool {
+        values.len() == 2
+            && plain_values.len() == 2
+            && values[0] == &hash_to_scalar(&plain_values[0])
+            && values[1] == &hash_to_scalar(&plain_values[1])
+    }
+
+    pub fn tx_hash(&self) -> Hash {
+        self.tx_hash
+    }
+
+    pub fn get_public_attributes(&self) -> Vec<&PublicAttribute> {
+        vec![
+            &self._voucher_value_prehashed,
+            &self._voucher_info_prehashed,
+        ]
+    }
+
+    pub fn identity_key(&self) -> &identity::PrivateKey {
+        &self.signing_key
+    }
+
+    pub fn encryption_key(&self) -> &encryption::PrivateKey {
+        &self.unused_ed25519
+    }
+
+    pub fn pedersen_commitments_openings(&self) -> &Vec<Attribute> {
+        &self.pedersen_commitments_openings
+    }
+
+    pub fn blind_sign_request(&self) -> &BlindSignRequest {
+        &self.blind_sign_request
+    }
+
+    pub fn get_voucher_value(&self) -> String {
+        self.voucher_value_plain.clone()
+    }
+
+    pub fn get_public_attributes_plain(&self) -> Vec<String> {
+        vec![
+            self.voucher_value_plain.clone(),
+            self.voucher_info_plain.clone(),
+        ]
+    }
+
+    pub fn get_private_attributes(&self) -> Vec<&PrivateAttribute> {
+        vec![&self.serial_number, &self.binding_number]
+    }
+
+    pub fn signable_plaintext(request: &BlindSignRequest, tx_hash: Hash) -> Vec<u8> {
+        let mut message = request.to_bytes();
+        message.extend_from_slice(tx_hash.as_bytes());
+        message
+    }
+
+    pub fn sign(&self) -> identity::Signature {
+        let message = Self::signable_plaintext(&self.blind_sign_request, self.tx_hash);
+        self.signing_key.sign(message)
+    }
+}
+
+pub fn prepare_for_spending(
+    voucher_value: u64,
+    voucher_info: String,
+    serial_number: &PrivateAttribute,
+    binding_number: &PrivateAttribute,
+    epoch_id: u64,
+    signature: &Signature,
+    verification_key: &VerificationKey,
+) -> Result<Credential, Error> {
+    let params = Parameters::new(BandwidthVoucher::ENCODED_ATTRIBUTES)?;
+
+    prepare_credential_for_spending(
+        &params,
+        voucher_value,
+        voucher_info,
+        serial_number,
+        binding_number,
+        epoch_id,
+        signature,
+        verification_key,
+    )
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use cosmrs::tendermint::hash::Algorithm;
+    use nym_coconut_interface::Base58;
+    use rand::rngs::OsRng;
+
+    fn voucher_fixture() -> BandwidthVoucher {
+        let params = Parameters::new(4).unwrap();
+        let mut rng = OsRng;
+        BandwidthVoucher::new(
+            &params,
+            "1234".to_string(),
+            "voucher info".to_string(),
+            Hash::from_bytes(Algorithm::Sha256, &[0; 32]).unwrap(),
+            identity::PrivateKey::from_base58_string(
+                identity::KeyPair::new(&mut rng)
+                    .private_key()
+                    .to_base58_string(),
+            )
+            .unwrap(),
+            encryption::PrivateKey::from_bytes(
+                &encryption::KeyPair::new(&mut rng).private_key().to_bytes(),
+            )
+            .unwrap(),
+        )
+    }
+
+    #[test]
+    fn serde_voucher() {
+        let voucher = voucher_fixture();
+        let bytes = voucher.to_bytes();
+        let deserialized_voucher = BandwidthVoucher::try_from_bytes(&bytes).unwrap();
+        assert_eq!(voucher.serial_number, deserialized_voucher.serial_number);
+        assert_eq!(voucher.binding_number, deserialized_voucher.binding_number);
+        assert_eq!(
+            voucher.voucher_value_plain,
+            deserialized_voucher.voucher_value_plain
+        );
+        assert_eq!(
+            voucher.voucher_info_plain,
+            deserialized_voucher.voucher_info_plain
+        );
+        assert_eq!(
+            voucher._voucher_value_prehashed,
+            deserialized_voucher._voucher_value_prehashed
+        );
+        assert_eq!(
+            voucher._voucher_info_prehashed,
+            deserialized_voucher._voucher_info_prehashed
+        );
+        assert_eq!(voucher.tx_hash, deserialized_voucher.tx_hash);
+        assert_eq!(
+            voucher.signing_key.to_string(),
+            deserialized_voucher.signing_key.to_string()
+        );
+        assert_eq!(
+            voucher.unused_ed25519.to_string(),
+            deserialized_voucher.unused_ed25519.to_string()
+        );
+        assert_eq!(
+            voucher.pedersen_commitments_openings,
+            deserialized_voucher.pedersen_commitments_openings
+        );
+        assert_eq!(
+            voucher.blind_sign_request.to_bs58(),
+            deserialized_voucher.blind_sign_request.to_bs58()
+        );
+    }
+
+    #[test]
+    fn voucher_consistency() {
+        let voucher = voucher_fixture();
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &[],
+            &voucher.get_public_attributes_plain()
+        ));
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &voucher.get_public_attributes(),
+            &[],
+        ));
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &voucher.get_public_attributes(),
+            &[
+                voucher.get_public_attributes_plain()[0].clone(),
+                String::new()
+            ]
+        ));
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &voucher.get_public_attributes(),
+            &[
+                String::new(),
+                voucher.get_public_attributes_plain()[1].clone()
+            ]
+        ));
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &[voucher.get_public_attributes()[0], &Attribute::one()],
+            &voucher.get_public_attributes_plain()
+        ));
+        assert!(!BandwidthVoucher::verify_against_plain(
+            &[&Attribute::one(), voucher.get_public_attributes()[1]],
+            &voucher.get_public_attributes_plain()
+        ));
+        assert!(BandwidthVoucher::verify_against_plain(
+            &voucher.get_public_attributes(),
+            &voucher.get_public_attributes_plain()
+        ));
+    }
+}
@@ -1,141 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::coconut::utils::scalar_serde_helper;
-use crate::error::Error;
-use nym_api_requests::coconut::FreePassRequest;
-use nym_credentials_interface::{
-    hash_to_scalar, Attribute, BlindedSignature, CredentialSigningData, PublicAttribute,
-};
-use nym_validator_client::signing::AccountData;
-use serde::{Deserialize, Serialize};
-use time::{Duration, OffsetDateTime, Time};
-use zeroize::{Zeroize, ZeroizeOnDrop};
-
-pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
-
-#[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
-pub struct FreePassIssuedData {
-    /// the plain validity value of this credential expressed as unix timestamp
-    #[zeroize(skip)]
-    expiry_date: OffsetDateTime,
-}
-
-impl<'a> From<&'a FreePassIssuanceData> for FreePassIssuedData {
-    fn from(value: &'a FreePassIssuanceData) -> Self {
-        FreePassIssuedData {
-            expiry_date: value.expiry_date,
-        }
-    }
-}
-
-impl FreePassIssuedData {
-    pub fn expired(&self) -> bool {
-        self.expiry_date <= OffsetDateTime::now_utc()
-    }
-
-    pub fn expiry_date(&self) -> OffsetDateTime {
-        self.expiry_date
-    }
-
-    pub fn expiry_date_plain(&self) -> String {
-        self.expiry_date.unix_timestamp().to_string()
-    }
-}
-
-#[derive(Zeroize, Serialize, Deserialize)]
-pub struct FreePassIssuanceData {
-    /// the plain validity value of this credential expressed as unix timestamp
-    #[zeroize(skip)]
-    expiry_date: OffsetDateTime,
-
-    // the expiry date, as unix timestamp, hashed into a scalar
-    #[serde(with = "scalar_serde_helper")]
-    expiry_date_prehashed: PublicAttribute,
-}
-
-impl FreePassIssuanceData {
-    pub fn new(expiry_date: Option<OffsetDateTime>) -> Self {
-        // ideally we should have implemented a proper error handling here, sure.
-        // but given it's meant to only be used by nym, imo it's fine to just panic here in case of invalid arguments
-        let expiry_date = if let Some(provided) = expiry_date {
-            if provided - OffsetDateTime::now_utc() > MAX_FREE_PASS_VALIDITY {
-                panic!("the provided expiry date is bigger than the maximum value of {MAX_FREE_PASS_VALIDITY}");
-            }
-
-            provided
-        } else {
-            Self::default_expiry_date()
-        };
-
-        let expiry_date_prehashed = hash_to_scalar(expiry_date.unix_timestamp().to_string());
-
-        FreePassIssuanceData {
-            expiry_date,
-            expiry_date_prehashed,
-        }
-    }
-
-    pub fn default_expiry_date() -> OffsetDateTime {
-        // set it to furthest midnight in the future such as it's no more than a week away,
-        // i.e. if it's currently for example 9:43 on 2nd March 2024, it will set it to 0:00 on 9th March 2024
-        (OffsetDateTime::now_utc() + MAX_FREE_PASS_VALIDITY).replace_time(Time::MIDNIGHT)
-    }
-
-    pub fn expiry_date_attribute(&self) -> &Attribute {
-        &self.expiry_date_prehashed
-    }
-
-    pub fn expiry_date_plain(&self) -> String {
-        self.expiry_date.unix_timestamp().to_string()
-    }
-
-    pub async fn obtain_free_pass_nonce(
-        &self,
-        client: &nym_validator_client::client::NymApiClient,
-    ) -> Result<[u8; 16], Error> {
-        let server_response = client.free_pass_nonce().await?;
-        Ok(server_response.current_nonce)
-    }
-
-    pub fn create_free_pass_request(
-        &self,
-        signing_request: &CredentialSigningData,
-        account_data: &AccountData,
-        issuer_nonce: [u8; 16],
-    ) -> Result<FreePassRequest, Error> {
-        let nonce_signature = account_data
-            .private_key()
-            .sign(&issuer_nonce)
-            .map_err(|_| Error::Secp256k1SignFailure)?;
-
-        Ok(FreePassRequest {
-            cosmos_pubkey: account_data.public_key(),
-            inner_sign_request: signing_request.blind_sign_request.clone(),
-            used_nonce: issuer_nonce,
-            nonce_signature,
-            public_attributes_plain: signing_request.public_attributes_plain.clone(),
-        })
-    }
-
-    pub async fn obtain_blinded_credential(
-        &self,
-        client: &nym_validator_client::client::NymApiClient,
-        request: &FreePassRequest,
-    ) -> Result<BlindedSignature, Error> {
-        let server_response = client.issue_free_pass_credential(request).await?;
-        Ok(server_response.blinded_signature)
-    }
-
-    pub async fn request_blinded_credential(
-        &self,
-        signing_request: &CredentialSigningData,
-        account_data: &AccountData,
-        client: &nym_validator_client::client::NymApiClient,
-    ) -> Result<BlindedSignature, Error> {
-        let signing_nonce = self.obtain_free_pass_nonce(client).await?;
-        let request =
-            self.create_free_pass_request(signing_request, account_data, signing_nonce)?;
-        self.obtain_blinded_credential(client, &request).await
-    }
-}
--- a/Show More
+++ b/Show More