floating point errors on the explorer

Bump follow-redirects from 1.15.4 to 1.15.6 in /clients/native/examples/js-examples/websocket

.github/actions/nym-hash-releases/action.yml

@@ -14,12 +14,20 @@ inputs:
     description: 'The tag/release to process. Uses the release id when trigger from a release.'
     required: false
     default: ''
+  repo:
+    description: 'The repo to use. Defaults to "nym".'
+    required: false
+    default: 'nym'
+  owner:
+    description: 'The repo owner to use. Defaults to "nymtech".'
+    required: false
+    default: 'nymtech'
 outputs:
   hashes:
     description: 'A string containing JSON with the release asset hashes and signatures'
 runs:
-  using: 'node16'
-  main: 'index.js'
+  using: 'node20'
+  main: 'dist/index.js'
 branding:
   icon: 'hash'
   color: 'green'

.github/actions/nym-hash-releases/dist/37.index.js

@@ -0,0 +1,450 @@
+export const id = 37;
+export const ids = [37];
+export const modules = {
+
+/***/ 4037:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   "toFormData": () => (/* binding */ toFormData)
+/* harmony export */ });
+/* harmony import */ var fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2777);
+/* harmony import */ var formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8010);
+
+
+
+let s = 0;
+const S = {
+	START_BOUNDARY: s++,
+	HEADER_FIELD_START: s++,
+	HEADER_FIELD: s++,
+	HEADER_VALUE_START: s++,
+	HEADER_VALUE: s++,
+	HEADER_VALUE_ALMOST_DONE: s++,
+	HEADERS_ALMOST_DONE: s++,
+	PART_DATA_START: s++,
+	PART_DATA: s++,
+	END: s++
+};
+
+let f = 1;
+const F = {
+	PART_BOUNDARY: f,
+	LAST_BOUNDARY: f *= 2
+};
+
+const LF = 10;
+const CR = 13;
+const SPACE = 32;
+const HYPHEN = 45;
+const COLON = 58;
+const A = 97;
+const Z = 122;
+
+const lower = c => c | 0x20;
+
+const noop = () => {};
+
+class MultipartParser {
+	/**
+	 * @param {string} boundary
+	 */
+	constructor(boundary) {
+		this.index = 0;
+		this.flags = 0;
+
+		this.onHeaderEnd = noop;
+		this.onHeaderField = noop;
+		this.onHeadersEnd = noop;
+		this.onHeaderValue = noop;
+		this.onPartBegin = noop;
+		this.onPartData = noop;
+		this.onPartEnd = noop;
+
+		this.boundaryChars = {};
+
+		boundary = '\r\n--' + boundary;
+		const ui8a = new Uint8Array(boundary.length);
+		for (let i = 0; i < boundary.length; i++) {
+			ui8a[i] = boundary.charCodeAt(i);
+			this.boundaryChars[ui8a[i]] = true;
+		}
+
+		this.boundary = ui8a;
+		this.lookbehind = new Uint8Array(this.boundary.length + 8);
+		this.state = S.START_BOUNDARY;
+	}
+
+	/**
+	 * @param {Uint8Array} data
+	 */
+	write(data) {
+		let i = 0;
+		const length_ = data.length;
+		let previousIndex = this.index;
+		let {lookbehind, boundary, boundaryChars, index, state, flags} = this;
+		const boundaryLength = this.boundary.length;
+		const boundaryEnd = boundaryLength - 1;
+		const bufferLength = data.length;
+		let c;
+		let cl;
+
+		const mark = name => {
+			this[name + 'Mark'] = i;
+		};
+
+		const clear = name => {
+			delete this[name + 'Mark'];
+		};
+
+		const callback = (callbackSymbol, start, end, ui8a) => {
+			if (start === undefined || start !== end) {
+				this[callbackSymbol](ui8a && ui8a.subarray(start, end));
+			}
+		};
+
+		const dataCallback = (name, clear) => {
+			const markSymbol = name + 'Mark';
+			if (!(markSymbol in this)) {
+				return;
+			}
+
+			if (clear) {
+				callback(name, this[markSymbol], i, data);
+				delete this[markSymbol];
+			} else {
+				callback(name, this[markSymbol], data.length, data);
+				this[markSymbol] = 0;
+			}
+		};
+
+		for (i = 0; i < length_; i++) {
+			c = data[i];
+
+			switch (state) {
+				case S.START_BOUNDARY:
+					if (index === boundary.length - 2) {
+						if (c === HYPHEN) {
+							flags |= F.LAST_BOUNDARY;
+						} else if (c !== CR) {
+							return;
+						}
+
+						index++;
+						break;
+					} else if (index - 1 === boundary.length - 2) {
+						if (flags & F.LAST_BOUNDARY && c === HYPHEN) {
+							state = S.END;
+							flags = 0;
+						} else if (!(flags & F.LAST_BOUNDARY) && c === LF) {
+							index = 0;
+							callback('onPartBegin');
+							state = S.HEADER_FIELD_START;
+						} else {
+							return;
+						}
+
+						break;
+					}
+
+					if (c !== boundary[index + 2]) {
+						index = -2;
+					}
+
+					if (c === boundary[index + 2]) {
+						index++;
+					}
+
+					break;
+				case S.HEADER_FIELD_START:
+					state = S.HEADER_FIELD;
+					mark('onHeaderField');
+					index = 0;
+					// falls through
+				case S.HEADER_FIELD:
+					if (c === CR) {
+						clear('onHeaderField');
+						state = S.HEADERS_ALMOST_DONE;
+						break;
+					}
+
+					index++;
+					if (c === HYPHEN) {
+						break;
+					}
+
+					if (c === COLON) {
+						if (index === 1) {
+							// empty header field
+							return;
+						}
+
+						dataCallback('onHeaderField', true);
+						state = S.HEADER_VALUE_START;
+						break;
+					}
+
+					cl = lower(c);
+					if (cl < A || cl > Z) {
+						return;
+					}
+
+					break;
+				case S.HEADER_VALUE_START:
+					if (c === SPACE) {
+						break;
+					}
+
+					mark('onHeaderValue');
+					state = S.HEADER_VALUE;
+					// falls through
+				case S.HEADER_VALUE:
+					if (c === CR) {
+						dataCallback('onHeaderValue', true);
+						callback('onHeaderEnd');
+						state = S.HEADER_VALUE_ALMOST_DONE;
+					}
+
+					break;
+				case S.HEADER_VALUE_ALMOST_DONE:
+					if (c !== LF) {
+						return;
+					}
+
+					state = S.HEADER_FIELD_START;
+					break;
+				case S.HEADERS_ALMOST_DONE:
+					if (c !== LF) {
+						return;
+					}
+
+					callback('onHeadersEnd');
+					state = S.PART_DATA_START;
+					break;
+				case S.PART_DATA_START:
+					state = S.PART_DATA;
+					mark('onPartData');
+					// falls through
+				case S.PART_DATA:
+					previousIndex = index;
+
+					if (index === 0) {
+						// boyer-moore derrived algorithm to safely skip non-boundary data
+						i += boundaryEnd;
+						while (i < bufferLength && !(data[i] in boundaryChars)) {
+							i += boundaryLength;
+						}
+
+						i -= boundaryEnd;
+						c = data[i];
+					}
+
+					if (index < boundary.length) {
+						if (boundary[index] === c) {
+							if (index === 0) {
+								dataCallback('onPartData', true);
+							}
+
+							index++;
+						} else {
+							index = 0;
+						}
+					} else if (index === boundary.length) {
+						index++;
+						if (c === CR) {
+							// CR = part boundary
+							flags |= F.PART_BOUNDARY;
+						} else if (c === HYPHEN) {
+							// HYPHEN = end boundary
+							flags |= F.LAST_BOUNDARY;
+						} else {
+							index = 0;
+						}
+					} else if (index - 1 === boundary.length) {
+						if (flags & F.PART_BOUNDARY) {
+							index = 0;
+							if (c === LF) {
+								// unset the PART_BOUNDARY flag
+								flags &= ~F.PART_BOUNDARY;
+								callback('onPartEnd');
+								callback('onPartBegin');
+								state = S.HEADER_FIELD_START;
+								break;
+							}
+						} else if (flags & F.LAST_BOUNDARY) {
+							if (c === HYPHEN) {
+								callback('onPartEnd');
+								state = S.END;
+								flags = 0;
+							} else {
+								index = 0;
+							}
+						} else {
+							index = 0;
+						}
+					}
+
+					if (index > 0) {
+						// when matching a possible boundary, keep a lookbehind reference
+						// in case it turns out to be a false lead
+						lookbehind[index - 1] = c;
+					} else if (previousIndex > 0) {
+						// if our boundary turned out to be rubbish, the captured lookbehind
+						// belongs to partData
+						const _lookbehind = new Uint8Array(lookbehind.buffer, lookbehind.byteOffset, lookbehind.byteLength);
+						callback('onPartData', 0, previousIndex, _lookbehind);
+						previousIndex = 0;
+						mark('onPartData');
+
+						// reconsider the current character even so it interrupted the sequence
+						// it could be the beginning of a new sequence
+						i--;
+					}
+
+					break;
+				case S.END:
+					break;
+				default:
+					throw new Error(`Unexpected state entered: ${state}`);
+			}
+		}
+
+		dataCallback('onHeaderField');
+		dataCallback('onHeaderValue');
+		dataCallback('onPartData');
+
+		// Update properties for the next call
+		this.index = index;
+		this.state = state;
+		this.flags = flags;
+	}
+
+	end() {
+		if ((this.state === S.HEADER_FIELD_START && this.index === 0) ||
+			(this.state === S.PART_DATA && this.index === this.boundary.length)) {
+			this.onPartEnd();
+		} else if (this.state !== S.END) {
+			throw new Error('MultipartParser.end(): stream ended unexpectedly');
+		}
+	}
+}
+
+function _fileName(headerValue) {
+	// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+	const m = headerValue.match(/\bfilename=("(.*?)"|([^()<>@,;:\\"/[\]?={}\s\t]+))($|;\s)/i);
+	if (!m) {
+		return;
+	}
+
+	const match = m[2] || m[3] || '';
+	let filename = match.slice(match.lastIndexOf('\\') + 1);
+	filename = filename.replace(/%22/g, '"');
+	filename = filename.replace(/&#(\d{4});/g, (m, code) => {
+		return String.fromCharCode(code);
+	});
+	return filename;
+}
+
+async function toFormData(Body, ct) {
+	if (!/multipart/i.test(ct)) {
+		throw new TypeError('Failed to fetch');
+	}
+
+	const m = ct.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
+
+	if (!m) {
+		throw new TypeError('no or bad content-type header, no multipart boundary');
+	}
+
+	const parser = new MultipartParser(m[1] || m[2]);
+
+	let headerField;
+	let headerValue;
+	let entryValue;
+	let entryName;
+	let contentType;
+	let filename;
+	const entryChunks = [];
+	const formData = new formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__/* .FormData */ .Ct();
+
+	const onPartData = ui8a => {
+		entryValue += decoder.decode(ui8a, {stream: true});
+	};
+
+	const appendToFile = ui8a => {
+		entryChunks.push(ui8a);
+	};
+
+	const appendFileToFormData = () => {
+		const file = new fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__/* .File */ .$B(entryChunks, filename, {type: contentType});
+		formData.append(entryName, file);
+	};
+
+	const appendEntryToFormData = () => {
+		formData.append(entryName, entryValue);
+	};
+
+	const decoder = new TextDecoder('utf-8');
+	decoder.decode();
+
+	parser.onPartBegin = function () {
+		parser.onPartData = onPartData;
+		parser.onPartEnd = appendEntryToFormData;
+
+		headerField = '';
+		headerValue = '';
+		entryValue = '';
+		entryName = '';
+		contentType = '';
+		filename = null;
+		entryChunks.length = 0;
+	};
+
+	parser.onHeaderField = function (ui8a) {
+		headerField += decoder.decode(ui8a, {stream: true});
+	};
+
+	parser.onHeaderValue = function (ui8a) {
+		headerValue += decoder.decode(ui8a, {stream: true});
+	};
+
+	parser.onHeaderEnd = function () {
+		headerValue += decoder.decode();
+		headerField = headerField.toLowerCase();
+
+		if (headerField === 'content-disposition') {
+			// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+			const m = headerValue.match(/\bname=("([^"]*)"|([^()<>@,;:\\"/[\]?={}\s\t]+))/i);
+
+			if (m) {
+				entryName = m[2] || m[3] || '';
+			}
+
+			filename = _fileName(headerValue);
+
+			if (filename) {
+				parser.onPartData = appendToFile;
+				parser.onPartEnd = appendFileToFormData;
+			}
+		} else if (headerField === 'content-type') {
+			contentType = headerValue;
+		}
+
+		headerValue = '';
+		headerField = '';
+	};
+
+	for await (const chunk of Body) {
+		parser.write(chunk);
+	}
+
+	parser.end();
+
+	return formData;
+}
+
+
+/***/ })
+
+};

.github/actions/nym-hash-releases/dist/thread.js

@@ -0,0 +1,57 @@
+'use strict';
+const fs = require('fs');
+const crypto = require('crypto');
+const {parentPort} = require('worker_threads');
+
+const handlers = {
+	hashFile: (algorithm, filePath) => new Promise((resolve, reject) => {
+		const hasher = crypto.createHash(algorithm);
+		fs.createReadStream(filePath)
+			// TODO: Use `Stream.pipeline` when targeting Node.js 12.
+			.on('error', reject)
+			.pipe(hasher)
+			.on('error', reject)
+			.on('finish', () => {
+				const {buffer} = new Uint8Array(hasher.read());
+				resolve({value: buffer, transferList: [buffer]});
+			});
+	}),
+	hash: async (algorithm, input) => {
+		const hasher = crypto.createHash(algorithm);
+
+		if (Array.isArray(input)) {
+			for (const part of input) {
+				hasher.update(part);
+			}
+		} else {
+			hasher.update(input);
+		}
+
+		const {buffer} = new Uint8Array(hasher.digest());
+		return {value: buffer, transferList: [buffer]};
+	}
+};
+
+parentPort.on('message', async message => {
+	try {
+		const {method, args} = message;
+		const handler = handlers[method];
+
+		if (handler === undefined) {
+			throw new Error(`Unknown method '${method}'`);
+		}
+
+		const {value, transferList} = await handler(...args);
+		parentPort.postMessage({id: message.id, value}, transferList);
+	} catch (error) {
+		const newError = {message: error.message, stack: error.stack};
+
+		for (const [key, value] of Object.entries(error)) {
+			if (typeof value !== 'object') {
+				newError[key] = value;
+			}
+		}
+
+		parentPort.postMessage({id: message.id, error: newError});
+	}
+});

.github/actions/nym-hash-releases/index.js

@@ -1,15 +0,0 @@
-import core from "@actions/core";
-import github from "@actions/github";
-import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
-
-const algorithm = core.getInput('hash-type');
-const filename = core.getInput("file-name");
-
-// use the release id from the payload if it is set
-const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
-
-try {
-    await createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm, filename  })
-} catch (error) {
-    core.setFailed(error.message);
-}

.github/actions/nym-hash-releases/package.json

@@ -2,17 +2,6 @@
   "name": "nym-hash-release",
   "version": "1.0.0",
   "description": "Generate hashes and signatures for assets in Nym releases",
-  "main": "index.js",
-  "type": "module",
-  "scripts": {
-    "local": "node run-local.mjs"
-  },
-  "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
-    "@octokit/auth-action": "^4.0.0",
-    "@octokit/rest": "^20.0.1",
-    "hasha": "^5.2.0",
-    "node-fetch": "^3.2.10"
-  }
+  "main": "dist/index.js",
+  "type": "module"
 }

.github/actions/nym-hash-releases/run-local.mjs

@@ -1,6 +0,0 @@
-import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
-
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});

.github/actions/nym-hash-releases/src/README.md

@@ -0,0 +1,14 @@
+# nym-hash-release
+
+This is the source code for the custom GitHub Action to calculate hashes.
+
+It is in a subdirectory to avoid issues with `package.json`.
+
+## Build
+
+The following will bundle all code and dependencies into the `dist` folder, and copy it into place for GitHub Actions.
+
+```
+npm run build
+npm run dist:copy
+```

.github/actions/nym-hash-releases/src/create-hashes.mjs

@@ -11,10 +11,14 @@ function getBinInfo(path) {
         let mode = fs.statSync(path).mode
         fs.chmodSync(path, mode | 0o111)
 
-        const raw = execSync(`${path} build-info --output=json`, { stdio: 'pipe', encoding: "utf8" });
+        const cmd = `${path} build-info --output=json`;
+        console.log(`🚚 Running ${cmd}... (for max of 3 seconds, then SIGTERM)`);
+        const raw = execSync(cmd, { stdio: 'pipe', encoding: "utf8", timeout: 3000 });
         const parsed = JSON.parse(raw)
+        console.log(`    ✅ ok`);
         return parsed
     } catch (_) {
+        console.log(`    ❌ failed`);
         return undefined
     }
 }
@@ -24,8 +28,11 @@ async function run(assets, algorithm, filename, cache) {
         console.warn("cache is set to 'false', but we we no longer support it")
     }
 
+    const directory = path.join(process.env.RUNNER_TEMP || '.tmp', process.env.GITHUB_RUN_ID || '');
+    console.log('Temporary directory: ', directory);
+
     try {
-        fs.mkdirSync('.tmp');
+        fs.mkdirSync(directory, { recursive: true });
     } catch(e) {
         // ignore
     }
@@ -40,13 +47,13 @@ async function run(assets, algorithm, filename, cache) {
             let sig = null;
 
             // cache in `${WORKING_DIR}/.tmp/`
-            const cacheFilename = path.resolve(`.tmp/${asset.name}`);
+            const cacheFilename = path.join(directory, `${asset.name}`);
             if(!fs.existsSync(cacheFilename)) {
-                console.log(`Downloading ${asset.browser_download_url}... to ${cacheFilename}`);
+                console.log(`⬇️ Downloading ${asset.browser_download_url}... to ${cacheFilename} [${numAwaiting} of ${assets.length}]`);
                 buffer = Buffer.from(await fetch(asset.browser_download_url).then(res => res.arrayBuffer()));
                 fs.writeFileSync(cacheFilename, buffer);
             } else {
-                console.log(`Loading from ${cacheFilename}`);
+                console.log(`💾 Loading from ${cacheFilename}`);
                 buffer = Buffer.from(fs.readFileSync(cacheFilename));
 
                 // console.log('Reading signature from content');
@@ -131,6 +138,7 @@ async function run(assets, algorithm, filename, cache) {
             }
         }
     }
+    console.log(`Completed hashing ${assets.length} files`);
     return hashes;
 }
 
@@ -142,7 +150,7 @@ export async function createHashes({ assets, algorithm, filename, cache }) {
     return output;
 }
 
-export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true }) {
+export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true, owner = 'nymtech', repo = 'nym' }) {
     console.log("🚀🚀🚀 Getting releases");
 
     let auth;
@@ -157,8 +165,6 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
         auth: process.env.GITHUB_TOKEN,
         request: { fetch }
     });
-    const owner = "nymtech";
-    const repo = "nym";
 
     let releases;
     if(cache) {
@@ -212,7 +218,14 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
 
     releasesToProcess.forEach(release => {
         const {tag_name, name} = release;
-        const tagComponents = tag_name.split('-v');
+        const matches = tag_name.match(/(\S+)-v([0-9]+\.[0-9]+(\.\S+)?)/);
+
+        if(!matches || matches.length < 2) {
+            console.warn('Could not match version structure in tag name = ', tag_name);
+            return;
+        }
+
+        const tagComponents = matches.slice(1);
         const componentName = tagComponents[0];
         const componentVersion = 'v' + tagComponents[1];
 

.github/actions/nym-hash-releases/src/index.js

@@ -0,0 +1,21 @@
+import core from "@actions/core";
+import github from "@actions/github";
+import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
+
+const algorithm = core.getInput('hash-type');
+const filename = core.getInput("file-name");
+const owner = core.getInput("owner");
+const repo = core.getInput("repo");
+
+async function main() {
+// use the release id from the payload if it is set
+    const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
+
+    try {
+        await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId, algorithm, filename, owner, repo})
+    } catch (error) {
+        core.setFailed(error.message);
+    }
+}
+
+main().catch(error => core.setFailed(error.message));

.github/actions/nym-hash-releases/src/package-lock.json

@@ -1,26 +1,28 @@
 {
-  "name": "ghaction-generate-release-hashes",
+  "name": "nym-hash-release",
   "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "ghaction-generate-release-hashes",
+      "name": "nym-hash-release",
       "version": "1.0.0",
-      "license": "MIT",
       "dependencies": {
-        "@actions/core": "^1.10.0",
+        "@actions/core": "^1.10.1",
         "@actions/github": "^5.1.1",
-        "@octokit/auth-action": "^4.0.0",
-        "@octokit/rest": "^20.0.1",
+        "@octokit/auth-action": "^4.0.1",
+        "@octokit/rest": "^20.0.2",
         "hasha": "^5.2.0",
         "node-fetch": "^3.2.10"
+      },
+      "devDependencies": {
+        "@vercel/ncc": "^0.38.1"
       }
     },
     "node_modules/@actions/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
+      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
       "dependencies": {
         "@actions/http-client": "^2.0.1",
         "uuid": "^8.3.2"
@@ -46,12 +48,12 @@
       }
     },
     "node_modules/@octokit/auth-action": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.0.tgz",
-      "integrity": "sha512-sMm9lWZdiX6e89YFaLrgE9EFs94k58BwIkvjOtozNWUqyTmsrnWFr/M5LolaRzZ7Kmb5FbhF9hi7FEeE274SoQ==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.1.tgz",
+      "integrity": "sha512-mJLOcFFafIivLZ7BEkGDCTFoHPJv7BeL5Zwy7j5qMDU0b/DKshhi6GCU9tw3vmKhOxTNquYfvwqsEfPpemaaxg==",
       "dependencies": {
         "@octokit/auth-token": "^4.0.0",
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.0.0"
       },
       "engines": {
         "node": ">= 18"
@@ -66,16 +68,16 @@
       }
     },
     "node_modules/@octokit/auth-action/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
     },
     "node_modules/@octokit/auth-action/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
       "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/auth-token": {
@@ -191,14 +193,14 @@
       }
     },
     "node_modules/@octokit/rest": {
-      "version": "20.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.1.tgz",
-      "integrity": "sha512-wROV21RwHQIMNb2Dgd4+pY+dVy1Dwmp85pBrgr6YRRDYRBu9Gb+D73f4Bl2EukZSj5hInq2Tui9o7gAQpc2k2Q==",
+      "version": "20.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.2.tgz",
+      "integrity": "sha512-Ux8NDgEraQ/DMAU1PlAohyfBBXDwhnX2j33Z1nJNziqAfHi70PuxkFYIcIt8aIAxtRE7KVuKp8lSR8pA0J5iOQ==",
       "dependencies": {
         "@octokit/core": "^5.0.0",
-        "@octokit/plugin-paginate-rest": "^8.0.0",
+        "@octokit/plugin-paginate-rest": "^9.0.0",
         "@octokit/plugin-request-log": "^4.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^9.0.0"
+        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
       },
       "engines": {
         "node": ">= 18"
@@ -261,17 +263,30 @@
       "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-8.0.0.tgz",
-      "integrity": "sha512-2xZ+baZWUg+qudVXnnvXz7qfrTmDeYPCzangBVq/1gXxii/OiS//4shJp9dnCCvj1x+JAm9ji1Egwm1BA47lPQ==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.1.tgz",
+      "integrity": "sha512-wfGhE/TAkXZRLjksFXuDZdmGnJQHvtU/joFQdweXUgzo1XwvBCD4o4+75NtFfjfLK5IwLf9vHTfSiU3sLRYpRw==",
       "dependencies": {
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
         "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-request-log": {
@@ -286,17 +301,30 @@
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-9.0.0.tgz",
-      "integrity": "sha512-KquMF/VB1IkKNiVnzJKspY5mFgGyLd7HzdJfVEGTJFzqu9BRFNWt+nwTCMuUiWc72gLQhRWYubTwOkQj+w/1PA==",
+      "version": "10.4.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
+      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
       "dependencies": {
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
         "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/request": {
@@ -343,6 +371,15 @@
         "@octokit/openapi-types": "^12.11.0"
       }
     },
+    "node_modules/@vercel/ncc": {
+      "version": "0.38.1",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.1.tgz",
+      "integrity": "sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==",
+      "dev": true,
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
+    },
     "node_modules/before-after-hook": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",

.github/actions/nym-hash-releases/src/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "nym-hash-release",
+  "version": "1.0.0",
+  "description": "Generate hashes and signatures for assets in Nym releases",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "local": "node run-local.mjs",
+    "build": "ncc build index.js -o dist",
+    "dist:copy": "mkdir -p ../dist && cp dist/*.js ../dist"
+  },
+  "dependencies": {
+    "@actions/core": "^1.10.1",
+    "@actions/github": "^5.1.1",
+    "@octokit/auth-action": "^4.0.1",
+    "@octokit/rest": "^20.0.2",
+    "hasha": "^5.2.0",
+    "node-fetch": "^3.2.10"
+  },
+  "devDependencies": {
+    "@vercel/ncc": "^0.38.1"
+  }
+}

.github/actions/nym-hash-releases/src/run-local.mjs

@@ -0,0 +1,11 @@
+import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
+
+const cache = true;
+
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-binaries-v2024.1-marabou', cache, upload: false});
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-vpn-desktop-v0.0.8', cache, upload: false, repo: 'nym-vpn-client'});
+
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});

.github/workflows/ci-build-upload-binaries.yml

@@ -9,10 +9,17 @@ on:
         default: false
         type: boolean
       enable_wireguard:
-        description: 'Add --features wireguard'
+        description: "Add --features wireguard"
         required: true
         default: false
         type: boolean
+      enable_deb:
+        description: "True to enable cargo-deb installation and .deb package building"
+        required: false
+        default: false
+        type: boolean
+  schedule:
+    - cron: "14 0 * * *"
   pull_request:
     paths:
       - "clients/**"
@@ -28,6 +35,7 @@ on:
       - "sdk/rust/nym-sdk/**"
       - "service-providers/**"
       - "tools/**"
+      - "nymvisor/**"
 
 jobs:
   publish-nym:
@@ -62,7 +70,9 @@ jobs:
       - name: Set CARGO_FEATURES
         run: |
           echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
-        if: github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true
+        if: >
+          github.event_name == 'schedule' ||
+          (github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true)
 
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
@@ -80,12 +90,12 @@ jobs:
         with:
           command: install
           args: cargo-deb
+        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
 
       - name: Build deb packages
         shell: bash
         run: make deb
-
-      # If this was a manual workflow_dispatch, publish binaries.
+        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
 
       - name: Upload Artifact
         if: github.event_name == 'workflow_dispatch'
@@ -101,12 +111,13 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
+            target/release/nymvisor
           retention-days: 30
 
-      # If this was a pull_request, upload to build server
+      # If this was a pull_request or nightly, upload to build server
 
       - name: Prepare build output
-        if: github.event_name == 'pull_request'
+        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
         shell: bash
         env:
           OUTPUT_DIR: ci-builds/${{ github.ref_name }}
@@ -118,12 +129,14 @@ jobs:
           cp target/release/nym-api $OUTPUT_DIR
           cp target/release/nym-network-requester $OUTPUT_DIR
           cp target/release/nym-network-statistics $OUTPUT_DIR
+          cp target/release/nymvisor $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR
           cp target/release/explorer-api $OUTPUT_DIR
-          cp target/debian/*.deb $OUTPUT_DIR
+          if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
+            cp target/debian/*.deb $OUTPUT_DIR
+          fi
 
       - name: Deploy branch to CI www
-        if: github.event_name == 'pull_request'
         continue-on-error: true
         uses: easingthemes/ssh-deploy@main
         env:

.github/workflows/publish-nym-binaries.yml

@@ -1,4 +1,4 @@
-name: Publish Nym binaries
+name: publish-nym-binaries
 
 on:
   workflow_dispatch:
@@ -29,6 +29,7 @@ jobs:
       client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
       mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
       gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
+      nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -36,6 +37,7 @@ jobs:
       client_version: ${{ steps.binary-versions.outputs.client_version }}
       mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
       gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
+      nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -78,6 +80,7 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
+            target/release/nymvisor
           retention-days: 30
 
       - id: create-release
@@ -95,6 +98,7 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
+            target/release/nymvisor
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

.github/workflows/publish-nym-connect-macos.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (MacOS)
+name: publish-nym-connect-macos
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-connect-ubuntu.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Ubuntu)
+name: publish-nym-connect-ubuntu
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-connect-win10.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Windows 10)
+name: publish-nym-connect-win10
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-contracts.yml

@@ -1,4 +1,4 @@
-name: Build release of Nym smart contracts
+name: publish-nym-contracts
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-macos.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (MacOS)
+name: publish-nym-wallet-macos
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Ubuntu)
+name: publish-nym-wallet-ubuntu
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-win10.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Windows 10)
+name: publish-nym-wallet-win10
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-sdk-npm.yml

@@ -1,4 +1,4 @@
-name: Publish Typescript SDK
+name: publish-sdk-npm
 on:
   workflow_dispatch:
 

.github/workflows/release-calculate-hash.yml

@@ -1,4 +1,4 @@
-name: Releases - calculate file hashes
+name: release-calculate-hash
 
 on:
   workflow_call:
@@ -8,8 +8,8 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    release_tag:
-      tag:
+    inputs:
+      release_tag:
         description: 'Release tag'
         required: true
         type: string
@@ -24,10 +24,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18
-      - name: Install packages
-        run: cd ./.github/actions/nym-hash-releases && npm i
-
-      - uses: ./.github/actions/nym-hash-releases
+      - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

CHANGELOG.md

@@ -4,6 +4,23 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.1-marabou] (2024-02-15)
+
+**New Features:**
+- Introduced nymvisor support for nym-api, gateway, and mixnode binaries ([#4158])
+- Revamped nym-api execution with the addition of init and run commands ([#4225])
+
+**Enhancements:**
+- Implemented internal improvements for gateways to optimize internal packet routing
+- Improved routing score calculation
+
+**Bug Fixes:**
+- Resolved various bugs to enhance overall stability
+
+[#4158]: https://github.com/nymtech/nym/pull/4158
+[#4225]: https://github.com/nymtech/nym/pull/4225
+
+
 ## [2023.5-rolo] (2023-11-28)
 
 - Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])

Cargo.toml

@@ -32,7 +32,7 @@ members = [
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
-    "common/cosmwasm-smart-contracts/ephemera",
+    #    "common/cosmwasm-smart-contracts/ephemera",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
@@ -56,6 +56,8 @@ members = [
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
     "common/nymcoconut",
+    "common/nym-id",
+    "common/nym-metrics",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -104,15 +106,17 @@ members = [
     "nym-outfox",
     "nym-validator-rewarder",
     "tools/internal/ssl-inject",
-    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
     "tools/nym-cli",
+    "tools/nym-id-cli",
     "tools/nym-nr-query",
     "tools/nymvisor",
     "tools/ts-rs-cli",
     "wasm/client",
-#    "wasm/full-nym-wasm",
+    #    "wasm/full-nym-wasm",
     "wasm/mix-fetch",
     "wasm/node-tester",
+    "common/nym-metrics",
 ]
 
 default-members = [
@@ -128,7 +132,16 @@ default-members = [
     "nym-validator-rewarder",
 ]
 
-exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles", "sdk/ffi/cpp"]
+exclude = [
+    "explorer",
+    "contracts",
+    "nym-wallet",
+    "nym-connect/mobile/src-tauri",
+    "nym-connect/desktop",
+    "nym-vpn/ui/src-tauri",
+    "cpu-cycles",
+    "sdk/ffi/cpp",
+]
 
 [workspace.package]
 authors = ["Nym Technologies SA"]
@@ -143,6 +156,7 @@ anyhow = "1.0.71"
 async-trait = "0.1.68"
 axum = "0.6.20"
 base64 = "0.21.4"
+bs58 = "0.5.0"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 clap = "4.4.7"
 cfg-if = "1.0.0"
@@ -158,7 +172,7 @@ log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = "0.11.22"
+reqwest = { version = "0.11.22", default-features = false }
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -168,7 +182,7 @@ time = "0.3.30"
 thiserror = "1.0.48"
 tokio = "1.33.0"
 tokio-util = "0.7.10"
-tokio-tungstenite = "0.20.1"
+tokio-tungstenite = { version = "0.20.1" }
 tracing = "0.1.37"
 tungstenite = { version = "0.20.1", default-features = false }
 ts-rs = "7.0.0"
@@ -177,10 +191,12 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"
 
+prometheus = { version = "0.13.0" }
+
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch ="feature/gt-serialization-0.8.0" }
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch = "feature/gt-serialization-0.8.0" }
 group = "0.13.0"
 ff = "0.13.0"
 
@@ -205,9 +221,9 @@ cw-controllers = { version = "=1.1.0" }
 bip32 = "0.5.1"
 
 # temporarily using a fork again (yay.) because we need staking and slashing support
-cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch ="nym-temp/all-validator-features" }
+cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" }
 #cosmrs = {  git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" } # unfortuntely we need a fork by yours truly to get the staking support
-tendermint = "0.34" # same version as used by cosmrs
+tendermint = "0.34"     # same version as used by cosmrs
 tendermint-rpc = "0.34" # same version as used by cosmrs
 prost = "0.12"
 

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.32"
+version = "1.1.33"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -21,18 +21,19 @@ futures = { workspace = true } # bunch of futures stuff, however, now that I thi
 # and the single instance of abortable we have should really be refactored anyway
 url = { workspace = true }
 
+bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
 dirs = "4.0"
-lazy_static = "1.4.0"
 log = { workspace = true } # self explanatory
-pretty_env_logger = "0.4" # for formatting log messages
 rand = { version = "0.7.3", features = ["wasm-bindgen"] } # rng-related traits + some rng implementation to use
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 tap = "1.0.1"
+time = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "net", "signal"] } # async runtime
 tokio-tungstenite = { workspace = true }
+zeroize = { workspace = true }
 
 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
@@ -50,5 +51,6 @@ nym-task = { path = "../../common/task" }
 nym-topology = { path = "../../common/topology" }
 nym-validator-client = { path = "../../common/client-libs/validator-client", features = ["http-client"] }
 nym-client-websocket-requests = { path = "websocket-requests" }
+nym-id = { path = "../../common/nym-id" }
 
 [dev-dependencies]

clients/native/examples/js-examples/websocket/package-lock.json

@@ -1667,9 +1667,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.4",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
-      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
       "dev": true,
       "funding": [
         {
@@ -1705,9 +1705,9 @@
       }
     },
     "node_modules/fs-monkey": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
-      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
+      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
       "dev": true
     },
     "node_modules/fs.realpath": {
@@ -2160,9 +2160,9 @@
       }
     },
     "node_modules/ip": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
-      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
+      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
       "dev": true
     },
     "node_modules/ipaddr.js": {
@@ -2430,12 +2430,12 @@
       }
     },
     "node_modules/memfs": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
-      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
+      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
       "dev": true,
       "dependencies": {
-        "fs-monkey": "1.0.3"
+        "fs-monkey": "^1.0.4"
       },
       "engines": {
         "node": ">= 4.0.0"
@@ -4047,13 +4047,13 @@
       }
     },
     "node_modules/webpack-dev-middleware": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
-      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
+      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
       "dev": true,
       "dependencies": {
         "colorette": "^2.0.10",
-        "memfs": "^3.4.1",
+        "memfs": "^3.4.3",
         "mime-types": "^2.1.31",
         "range-parser": "^1.2.1",
         "schema-utils": "^4.0.0"
@@ -5800,9 +5800,9 @@
       }
     },
     "follow-redirects": {
-      "version": "1.15.4",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
-      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
       "dev": true
     },
     "forwarded": {
@@ -5818,9 +5818,9 @@
       "dev": true
     },
     "fs-monkey": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
-      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
+      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
       "dev": true
     },
     "fs.realpath": {
@@ -6157,9 +6157,9 @@
       "dev": true
     },
     "ip": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
-      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
+      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
       "dev": true
     },
     "ipaddr.js": {
@@ -6346,12 +6346,12 @@
       "dev": true
     },
     "memfs": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
-      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
+      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
       "dev": true,
       "requires": {
-        "fs-monkey": "1.0.3"
+        "fs-monkey": "^1.0.4"
       }
     },
     "merge-descriptors": {
@@ -7547,13 +7547,13 @@
       }
     },
     "webpack-dev-middleware": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
-      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
+      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
       "dev": true,
       "requires": {
         "colorette": "^2.0.10",
-        "memfs": "^3.4.1",
+        "memfs": "^3.4.3",
         "mime-types": "^2.1.31",
         "range-parser": "^1.2.1",
         "schema-utils": "^4.0.0"

clients/native/src/commands/import_credential.rs

@@ -0,0 +1,54 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::try_load_current_config;
+use crate::error::ClientError;
+use clap::ArgGroup;
+
+use nym_id::import_credential;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(clap::Args)]
+#[clap(group(ArgGroup::new("cred_data").required(true)))]
+pub(crate) struct Args {
+    /// Id of client that is going to import the credential
+    #[clap(long)]
+    pub id: String,
+
+    /// Explicitly provide the encoded credential data (as base58)
+    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
+    pub(crate) credential_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary credential data
+    #[clap(long, group = "cred_data")]
+    pub(crate) credential_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    let config = try_load_current_config(&args.id)?;
+
+    let credentials_store = nym_credential_storage::initialise_persistent_storage(
+        &config.storage_paths.common_paths.credentials_database,
+    )
+    .await;
+
+    let raw_credential = match args.credential_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(args.credential_path.unwrap())?
+        }
+    };
+
+    import_credential(credentials_store, raw_credential, args.version).await?;
+    Ok(())
+}

clients/native/src/commands/mod.rs

@@ -8,7 +8,6 @@ use crate::client::config::{BaseClientConfig, Config};
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
-use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
@@ -21,18 +20,16 @@ use nym_client_core::error::ClientCoreError;
 use nym_config::OptionalSet;
 use std::error::Error;
 use std::net::IpAddr;
+use std::sync::OnceLock;
 
 pub(crate) mod build_info;
+pub(crate) mod import_credential;
 pub(crate) mod init;
 pub(crate) mod run;
 
-lazy_static! {
-    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
-}
-
-// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    &PRETTY_BUILD_INFORMATION
+    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
+    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
 }
 
 #[derive(Parser)]
@@ -58,6 +55,9 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
+    /// Import a pre-generated credential
+    ImportCredential(import_credential::Args),
+
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -86,6 +86,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
+        Commands::ImportCredential(m) => import_credential::execute(m).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),

clients/native/src/error.rs

@@ -1,11 +1,13 @@
 use nym_client_core::error::ClientCoreError;
 
+use nym_id::NymIdError;
+
 #[derive(thiserror::Error, Debug)]
 pub enum ClientError {
     #[error("I/O error: {0}")]
     IoError(#[from] std::io::Error),
 
-    #[error("client-core error: {0}")]
+    #[error(transparent)]
     ClientCoreError(#[from] ClientCoreError),
 
     #[error("Failed to load config for: {0}")]
@@ -20,4 +22,7 @@ pub enum ClientError {
 
     #[error("Attempted to start the client in invalid socket mode")]
     InvalidSocketMode,
+
+    #[error(transparent)]
+    NymIdError(#[from] NymIdError),
 }

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.32"
+version = "1.1.33"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -8,17 +8,18 @@ rust-version = "1.56"
 license.workspace = true
 
 [dependencies]
+bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
-lazy_static = "1.4.0"
 log = { workspace = true }
-pretty_env_logger = "0.4"
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 tap = "1.0.1"
 thiserror = { workspace = true }
 tokio = { version = "1.24.1", features = ["rt-multi-thread", "net", "signal"] }
 rand = "0.7.3"
+time = { workspace = true }
 url = { workspace = true }
+zeroize = { workspace = true }
 
 # internal
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
@@ -34,6 +35,7 @@ nym-ordered-buffer = { path = "../../common/socks5/ordered-buffer" }
 nym-pemstore = { path = "../../common/pemstore" }
 nym-topology = { path = "../../common/topology" }
 nym-socks5-client-core = { path = "../../common/socks5-client-core" }
+nym-id = { path = "../../common/nym-id" }
 
 [features]
 default = []

clients/socks5/src/commands/import_credential.rs

@@ -0,0 +1,54 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::try_load_current_config;
+use crate::error::Socks5ClientError;
+use clap::ArgGroup;
+
+use nym_id::import_credential;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(clap::Args)]
+#[clap(group(ArgGroup::new("cred_data").required(true)))]
+pub(crate) struct Args {
+    /// Id of client that is going to import the credential
+    #[clap(long)]
+    pub id: String,
+
+    /// Explicitly provide the encoded credential data (as base58)
+    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
+    pub(crate) credential_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary credential data
+    #[clap(long, group = "cred_data")]
+    pub(crate) credential_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    let config = try_load_current_config(&args.id)?;
+
+    let credentials_store = nym_credential_storage::initialise_persistent_storage(
+        &config.storage_paths.common_paths.credentials_database,
+    )
+    .await;
+
+    let raw_credential = match args.credential_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(args.credential_path.unwrap())?
+        }
+    };
+
+    import_credential(credentials_store, raw_credential, args.version).await?;
+    Ok(())
+}

clients/socks5/src/commands/mod.rs

@@ -9,7 +9,6 @@ use crate::config::{BaseClientConfig, Config, SocksClientPaths};
 use crate::error::Socks5ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
-use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
@@ -24,18 +23,16 @@ use nym_config::OptionalSet;
 use nym_sphinx::params::{PacketSize, PacketType};
 use std::error::Error;
 use std::net::IpAddr;
+use std::sync::OnceLock;
 
 pub(crate) mod build_info;
+mod import_credential;
 pub mod init;
 pub(crate) mod run;
 
-lazy_static! {
-    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
-}
-
-// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    &PRETTY_BUILD_INFORMATION
+    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
+    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
 }
 
 #[derive(Parser)]
@@ -61,6 +58,9 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
+    /// Import a pre-generated credential
+    ImportCredential(import_credential::Args),
+
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -92,6 +92,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
+        Commands::ImportCredential(m) => import_credential::execute(m).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),

clients/socks5/src/error.rs

@@ -1,5 +1,7 @@
 use nym_client_core::error::ClientCoreError;
 
+use nym_id::NymIdError;
+
 #[derive(thiserror::Error, Debug)]
 pub enum Socks5ClientError {
     #[error("I/O error: {0}")]
@@ -18,6 +20,9 @@ pub enum Socks5ClientError {
     #[error("Fail to bind address")]
     FailToBindAddress,
 
-    #[error("client-core error: {0}")]
+    #[error(transparent)]
     ClientCoreError(#[from] ClientCoreError),
+
+    #[error(transparent)]
+    NymIdError(#[from] NymIdError),
 }

common/bandwidth-controller/src/error.rs

@@ -21,6 +21,9 @@ pub enum BandwidthControllerError {
     #[error("There was a credential storage error - {0}")]
     CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
 
+    #[error("the credential storage does not contain any usable credentials")]
+    NoCredentialsAvailable,
+
     // this should really be fully incorporated into the above, but messing with coconut is the last thing I want to do now
     #[error(transparent)]
     StorageError(#[from] StorageError),

common/bandwidth-controller/src/lib.rs

@@ -3,10 +3,12 @@
 
 use crate::error::BandwidthControllerError;
 use crate::utils::stored_credential_to_issued_bandwidth;
-use log::{error, warn};
+use log::{debug, error, warn};
 use nym_credential_storage::storage::Storage;
+use nym_credentials::coconut::bandwidth::issued::BandwidthCredentialIssuedDataVariant;
 use nym_credentials::coconut::bandwidth::CredentialSpendingData;
 use nym_credentials::coconut::utils::obtain_aggregate_verification_key;
+use nym_credentials::IssuedBandwidthCredential;
 use nym_credentials_interface::VerificationKey;
 use nym_validator_client::coconut::all_coconut_api_clients;
 use nym_validator_client::nym_api::EpochId;
@@ -33,11 +35,67 @@ pub struct PreparedCredential {
     pub credential_id: i64,
 }
 
+pub struct RetrievedCredential {
+    pub credential: IssuedBandwidthCredential,
+    pub credential_id: i64,
+}
+
 impl<C, St: Storage> BandwidthController<C, St> {
     pub fn new(storage: St, client: C) -> Self {
         BandwidthController { storage, client }
     }
 
+    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
+    /// It marks any retrieved intermediate credentials as expired.
+    pub async fn get_next_usable_credential(
+        &self,
+    ) -> Result<RetrievedCredential, BandwidthControllerError>
+    where
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        loop {
+            let Some(maybe_next) = self
+                .storage
+                .get_next_unspent_credential()
+                .await
+                .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?
+            else {
+                return Err(BandwidthControllerError::NoCredentialsAvailable);
+            };
+            let id = maybe_next.id;
+
+            // try to deserialize it
+            let valid_credential = match stored_credential_to_issued_bandwidth(maybe_next) {
+                // check if it has already expired
+                Ok(credential) => match credential.variant_data() {
+                    BandwidthCredentialIssuedDataVariant::Voucher(_) => {
+                        debug!("credential {id} is a bandwidth voucher");
+                        credential
+                    }
+                    BandwidthCredentialIssuedDataVariant::FreePass(freepass_info) => {
+                        debug!("credential {id} is a free pass");
+                        if freepass_info.expired() {
+                            warn!("the free pass (id: {id}) has already expired! The expiration was set to {}", freepass_info.expiry_date());
+                            self.storage.mark_expired(id).await.map_err(|err| {
+                                BandwidthControllerError::CredentialStorageError(Box::new(err))
+                            })?;
+                            continue;
+                        }
+                        credential
+                    }
+                },
+                Err(err) => {
+                    error!("failed to deserialize credential with id {id}: {err}. it may need to be manually removed from the storage");
+                    return Err(err);
+                }
+            };
+            return Ok(RetrievedCredential {
+                credential: valid_credential,
+                credential_id: id,
+            });
+        }
+    }
+
     pub fn storage(&self) -> &St {
         &self.storage
     }
@@ -61,29 +119,16 @@ impl<C, St: Storage> BandwidthController<C, St> {
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        let retrieved_credential = self
-            .storage
-            .get_next_unspent_credential()
-            .await
-            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
+        let retrieved_credential = self.get_next_usable_credential().await?;
 
-        let epoch_id = retrieved_credential.epoch_id as EpochId;
-        let credential_id = retrieved_credential.id;
+        let epoch_id = retrieved_credential.credential.epoch_id();
+        let credential_id = retrieved_credential.credential_id;
 
-        let issued_bandwidth = stored_credential_to_issued_bandwidth(retrieved_credential)?;
+        let verification_key = self.get_aggregate_verification_key(epoch_id).await?;
 
-        let verification_key = match self.get_aggregate_verification_key(epoch_id).await {
-            Ok(key) => key,
-            Err(err) => {
-                warn!("failed to obtain master verification key: {err}. Putting the credential back into the database");
-
-                // TODO: ERROR RECOVERY:
-                error!("unimplemented: putting the credential back into the database");
-                return Err(err);
-            }
-        };
-
-        let spend_request = issued_bandwidth.prepare_for_spending(&verification_key)?;
+        let spend_request = retrieved_credential
+            .credential
+            .prepare_for_spending(&verification_key)?;
 
         Ok(PreparedCredential {
             data: spend_request,

common/bin-common/src/build_information/mod.rs

@@ -69,6 +69,35 @@ impl BinaryBuildInformation {
         }
     }
 
+    // Varient where we want to use the metadata generated by vergen in the consuming crate.
+    pub const fn new_with_local_vergen(
+        binary_name: &'static str,
+        build_timestamp: &'static str,
+        build_version: &'static str,
+        commit_sha: &'static str,
+        commit_timestamp: &'static str,
+        commit_branch: &'static str,
+    ) -> Self {
+        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
+        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
+            "debug"
+        } else {
+            "release"
+        };
+
+        BinaryBuildInformation {
+            binary_name,
+            build_timestamp,
+            build_version,
+            commit_sha,
+            commit_timestamp,
+            commit_branch,
+            rustc_version: env!("VERGEN_RUSTC_SEMVER"),
+            rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
+            cargo_profile,
+        }
+    }
+
     pub fn to_owned(&self) -> BinaryBuildInformationOwned {
         BinaryBuildInformationOwned {
             binary_name: self.binary_name.to_owned(),
@@ -187,3 +216,33 @@ macro_rules! bin_info_owned {
         .to_owned()
     };
 }
+
+// variant that picks up the vergen build information generated by the build.rs in the consumer
+// crate.
+#[macro_export]
+macro_rules! bin_info_local_vergen {
+    () => {
+        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
+            env!("CARGO_PKG_NAME"),
+            env!("VERGEN_BUILD_TIMESTAMP"),
+            env!("CARGO_PKG_VERSION"),
+            env!("VERGEN_GIT_SHA"),
+            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
+            env!("VERGEN_GIT_BRANCH"),
+        )
+    };
+}
+
+#[macro_export]
+macro_rules! bin_info_local_vergen_owned {
+    () => {
+        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
+            env!("CARGO_PKG_NAME"),
+            env!("VERGEN_BUILD_TIMESTAMP"),
+            env!("CARGO_PKG_VERSION"),
+            env!("VERGEN_GIT_SHA"),
+            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
+            env!("VERGEN_GIT_BRANCH"),
+        )
+    };
+}

common/client-core/Cargo.toml

@@ -27,7 +27,7 @@ tap = "1.0.1"
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tungstenite = { workspace = true, default-features = false }
-tokio = { workspace = true, features = ["macros"]}
+tokio = { workspace = true, features = ["macros"] }
 time = "0.3.17"
 zeroize = { workspace = true }
 
@@ -38,6 +38,7 @@ nym-crypto = { path = "../crypto" }
 nym-explorer-client = { path = "../../explorer-api/explorer-client" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../../gateway/gateway-requests" }
+nym-metrics = { path = "../nym-metrics" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-pemstore = { path = "../pemstore" }
@@ -48,6 +49,19 @@ nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
 si-scale = "0.2.2"
 
+### For serving prometheus metrics
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
+version = "1"
+features = ["server", "http1"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.http-body-util]
+version = "0.1"
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
+version = "0.1"
+features = ["tokio"]
+###
+
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 version = "0.1.11"
 features = ["time"]
@@ -58,6 +72,7 @@ features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
 version = "0.20.1"
+features = ["rustls-tls-native-roots"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
@@ -91,11 +106,15 @@ tempfile = "3.1.0"
 
 [build-dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
+sqlx = { workspace = true, features = [
+    "runtime-tokio-rustls",
+    "sqlite",
+    "macros",
+    "migrate",
+] }
 
 [features]
 default = []
 cli = ["clap"]
 fs-surb-storage = ["sqlx"]
 wasm = ["nym-gateway-client/wasm"]
-

common/client-core/src/client/base_client/mod.rs

@@ -52,6 +52,7 @@ use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
+use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
 use url::Url;
@@ -103,6 +104,12 @@ pub struct ClientState {
     pub shared_lane_queue_lengths: LaneQueueLengths,
     pub reply_controller_sender: ReplyControllerSender,
     pub topology_accessor: TopologyAccessor,
+    pub gateway_connection: GatewayConnection,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct GatewayConnection {
+    pub gateway_ws_fd: Option<RawFd>,
 }
 
 pub enum ClientInputStatus {
@@ -666,6 +673,7 @@ where
             shutdown.fork("gateway_transceiver"),
         )
         .await?;
+        let gateway_ws_fd = gateway_transceiver.ws_fd();
 
         let reply_storage = Self::setup_persistent_reply_storage(
             reply_storage_backend,
@@ -759,6 +767,7 @@ where
                 shared_lane_queue_lengths,
                 reply_controller_sender,
                 topology_accessor: shared_topology_accessor,
+                gateway_connection: GatewayConnection { gateway_ws_fd },
             },
             task_handle: shutdown,
         })

common/client-core/src/client/key_manager/mod.rs

@@ -300,7 +300,7 @@ impl KeyManager {
 
     /// Gets an atomically reference counted pointer to [`SharedKey`].
     pub fn gateway_shared_key(&self) -> Option<Arc<SharedKeys>> {
-        self.gateway_shared_key.as_ref().map(Arc::clone)
+        self.gateway_shared_key.clone()
     }
 
     pub fn remove_gateway_key(self) -> KeyManagerBuilder {

common/client-core/src/client/mix_traffic/transceiver.rs

@@ -8,6 +8,7 @@ use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
 use nym_sphinx::forwarding::packet::MixPacket;
 use std::fmt::Debug;
+use std::os::raw::c_int as RawFd;
 use thiserror::Error;
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -25,6 +26,7 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
 /// This combines combines the functionalities of being able to send and receive mix packets.
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
     fn gateway_identity(&self) -> identity::PublicKey;
+    fn ws_fd(&self) -> Option<RawFd>;
 }
 
 /// This trait defines the functionality of sending `MixPacket` into the mixnet,
@@ -66,6 +68,9 @@ impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
     fn gateway_identity(&self) -> identity::PublicKey {
         (**self).gateway_identity()
     }
+    fn ws_fd(&self) -> Option<RawFd> {
+        (**self).ws_fd()
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -112,6 +117,9 @@ where
     fn gateway_identity(&self) -> identity::PublicKey {
         self.gateway_client.gateway_identity()
     }
+    fn ws_fd(&self) -> Option<RawFd> {
+        self.gateway_client.ws_fd()
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -187,6 +195,9 @@ mod nonwasm_sealed {
         fn gateway_identity(&self) -> identity::PublicKey {
             self.local_identity
         }
+        fn ws_fd(&self) -> Option<RawFd> {
+            None
+        }
     }
 
     #[async_trait]
@@ -259,4 +270,7 @@ impl GatewayTransceiver for MockGateway {
     fn gateway_identity(&self) -> identity::PublicKey {
         self.dummy_identity
     }
+    fn ws_fd(&self) -> Option<RawFd> {
+        None
+    }
 }

common/client-core/src/client/packet_statistics_control.rs

@@ -3,8 +3,30 @@ use std::{
     time::{Duration, Instant},
 };
 
+use log::{info, warn};
+use nym_metrics::{inc, inc_by, metrics};
 use si_scale::helpers::bibytes2;
 
+// Metrics server
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use http_body_util::Full;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use hyper::body::Bytes;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use hyper::server::conn::http1;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use hyper::service::service_fn;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use hyper::{Request, Response};
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use hyper_util::rt::TokioIo;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use std::convert::Infallible;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use std::net::SocketAddr;
+#[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))]
+use tokio::net::TcpListener;
+
 use crate::spawn_future;
 
 // Time interval between reporting packet statistics
@@ -53,42 +75,60 @@ impl PacketStatistics {
             PacketStatisticsEvent::RealPacketSent(packet_size) => {
                 self.real_packets_sent += 1;
                 self.real_packets_sent_size += packet_size;
+                inc!("real_packets_sent");
+                inc_by!("real_packets_sent_size", packet_size);
             }
             PacketStatisticsEvent::CoverPacketSent(packet_size) => {
                 self.cover_packets_sent += 1;
                 self.cover_packets_sent_size += packet_size;
+                inc!("cover_packets_sent");
+                inc_by!("cover_packets_sent_size", packet_size);
             }
             PacketStatisticsEvent::RealPacketReceived(packet_size) => {
                 self.real_packets_received += 1;
                 self.real_packets_received_size += packet_size;
+                inc!("real_packets_received");
+                inc_by!("real_packets_received_size", packet_size);
             }
             PacketStatisticsEvent::CoverPacketReceived(packet_size) => {
                 self.cover_packets_received += 1;
                 self.cover_packets_received_size += packet_size;
+                inc!("cover_packets_received");
+                inc_by!("cover_packets_received_size", packet_size);
             }
             PacketStatisticsEvent::AckReceived(packet_size) => {
                 self.total_acks_received += 1;
                 self.total_acks_received_size += packet_size;
+                inc!("total_acks_received");
+                inc_by!("total_acks_received_size", packet_size);
             }
             PacketStatisticsEvent::RealAckReceived(packet_size) => {
                 self.real_acks_received += 1;
                 self.real_acks_received_size += packet_size;
+                inc!("real_acks_received");
+                inc_by!("real_acks_received_size", packet_size);
             }
             PacketStatisticsEvent::CoverAckReceived(packet_size) => {
                 self.cover_acks_received += 1;
                 self.cover_acks_received_size += packet_size;
+                inc!("cover_acks_received");
+                inc_by!("cover_acks_received_size", packet_size);
             }
             PacketStatisticsEvent::RealPacketQueued => {
                 self.real_packets_queued += 1;
+                inc!("real_packets_queued");
             }
             PacketStatisticsEvent::RetransmissionQueued => {
                 self.retransmissions_queued += 1;
+                inc!("retransmissions_queued");
             }
             PacketStatisticsEvent::ReplySurbRequestQueued => {
                 self.reply_surbs_queued += 1;
+                inc!("reply_surbs_queued");
             }
             PacketStatisticsEvent::AdditionalReplySurbRequestQueued => {
                 self.additional_reply_surbs_queued += 1;
+                inc!("additional_reply_surbs_queued");
             }
         }
     }
@@ -266,11 +306,11 @@ impl std::ops::Div<f64> for PacketRates {
 impl PacketRates {
     fn summary(&self) -> String {
         format!(
-            "rx: {}/s (real: {}/s), tx: {}/s (real: {}/s)",
-            bibytes2(self.real_packets_received_size + self.cover_packets_received_size),
+            "down: {}/s, up: {}/s (cover down: {}/s, cover up: {}/s)",
             bibytes2(self.real_packets_received_size),
-            bibytes2(self.real_packets_sent_size + self.cover_packets_sent_size),
             bibytes2(self.real_packets_sent_size),
+            bibytes2(self.cover_packets_received_size),
+            bibytes2(self.cover_packets_sent_size),
         )
     }
 
@@ -288,6 +328,7 @@ impl PacketRates {
     }
 }
 
+#[derive(Debug)]
 pub(crate) enum PacketStatisticsEvent {
     // The real packets sent. Recall that acks are sent by the gateway, so it's not included here.
     RealPacketSent(usize),
@@ -443,7 +484,11 @@ impl PacketStatisticsControl {
             // Check what the number of retransmissions was during the recording window
             if let Some((_, start_stats)) = self.history.front() {
                 let delta = self.stats.clone() - start_stats.clone();
-                log::info!("retransmissions: {}", delta.retransmissions_queued,);
+                log::info!(
+                    "mix packet retransmissions/real mix packets: {}/{}",
+                    delta.retransmissions_queued,
+                    delta.real_packets_queued,
+                );
             } else {
                 log::warn!("Unable to check retransmissions during recording window");
             }
@@ -460,6 +505,33 @@ impl PacketStatisticsControl {
         let snapshot_interval = Duration::from_millis(SNAPSHOT_INTERVAL_MS);
         let mut snapshot_interval = tokio::time::interval(snapshot_interval);
 
+        cfg_if::cfg_if! {
+            if #[cfg(all(target_arch = "wasm32", target_os = "unknown"))] {
+                log::warn!("Metrics server is not supported on wasm32-unknown-unknown");
+                let listener = None;
+            } else {
+                let mut metrics_port = 18000;
+                let listener: Option<TcpListener>;
+                loop {
+                    let addr = SocketAddr::from(([0, 0, 0, 0], metrics_port));
+                    match TcpListener::bind(addr).await {
+                        Ok(l) => {
+                            info!("###############################");
+                            info!("Metrics endpoint is at: {:?}", l.local_addr());
+                            info!("###############################");
+                            listener = Some(l);
+                            break;
+                        },
+                        Err(err) => {
+                            log::warn!("Failed to bind metrics server: {:?}", err);
+                            metrics_port += 1;
+                        }
+                    };
+                }
+
+            }
+        }
+
         loop {
             tokio::select! {
                 stats_event = self.stats_rx.recv() => match stats_event {
@@ -472,6 +544,27 @@ impl PacketStatisticsControl {
                         break;
                     }
                 },
+                // conditional will disable the branch if we're in wasm32-unknown-unknown
+                result = listener.as_ref().unwrap().accept(), if listener.is_some() => {
+                    cfg_if::cfg_if! {
+                        if #[cfg(not(all(target_arch = "wasm32", target_os = "unknown")))] {
+                            if let Ok((stream, _)) = result {
+                                let io = TokioIo::new(stream);
+
+                                tokio::task::spawn(async move {
+                                    if let Err(err) = http1::Builder::new()
+                                        .serve_connection(io, service_fn(serve_metrics))
+                                        .await
+                                    {
+                                        warn!("Error serving connection: {:?}", err);
+                                    }
+                                });
+                            } else {
+                                warn!("Error accepting connection");
+                            }
+                        }
+                    }
+                }
                 _ = snapshot_interval.tick() => {
                     self.update_history();
                     self.update_rates();
@@ -496,3 +589,9 @@ impl PacketStatisticsControl {
         })
     }
 }
+
+async fn serve_metrics(
+    _: Request<hyper::body::Incoming>,
+) -> Result<Response<Full<Bytes>>, Infallible> {
+    Ok(Response::new(Full::new(Bytes::from(metrics!()))))
+}

common/client-libs/gateway-client/Cargo.toml

@@ -48,7 +48,8 @@ features = ["net", "sync", "time"]
 workspace = true
 # the choice of this particular tls feature was arbitrary;
 # if you reckon a different one would be more appropriate, feel free to change it
-features = ["native-tls"]
+# features = ["native-tls"]
+features = ["rustls-tls-native-roots"]
 
 # wasm-only dependencies
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]

common/client-libs/gateway-client/src/client.rs

@@ -6,7 +6,7 @@ use crate::packet_router::PacketRouter;
 pub use crate::packet_router::{
     AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
 };
-use crate::socket_state::{PartiallyDelegated, SocketState};
+use crate::socket_state::{ws_fd, PartiallyDelegated, SocketState};
 use crate::traits::GatewayPacketRouter;
 use crate::{cleanup_socket_message, try_decrypt_binary_message};
 use futures::{SinkExt, StreamExt};
@@ -20,7 +20,8 @@ use nym_gateway_requests::authentication::encrypted_address::EncryptedAddressByt
 use nym_gateway_requests::iv::IV;
 use nym_gateway_requests::registration::handshake::{client_handshake, SharedKeys};
 use nym_gateway_requests::{
-    BinaryRequest, ClientControlRequest, ServerResponse, CURRENT_PROTOCOL_VERSION,
+    BinaryRequest, ClientControlRequest, ServerResponse, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION,
+    CURRENT_PROTOCOL_VERSION,
 };
 use nym_network_defaults::{REMAINING_BANDWIDTH_THRESHOLD, TOKENS_TO_BURN};
 use nym_sphinx::forwarding::packet::MixPacket;
@@ -32,11 +33,15 @@ use std::sync::Arc;
 use std::time::Duration;
 use tungstenite::protocol::Message;
 
+#[cfg(unix)]
+use std::os::fd::RawFd;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::sleep;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::connect_async;
 
+#[cfg(not(unix))]
+use std::os::raw::c_int as RawFd;
 #[cfg(target_arch = "wasm32")]
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
@@ -152,6 +157,14 @@ impl<C, St> GatewayClient<C, St> {
         self.gateway_identity
     }
 
+    pub fn ws_fd(&self) -> Option<RawFd> {
+        match &self.connection {
+            SocketState::Available(conn) => ws_fd(conn.as_ref()),
+            SocketState::PartiallyDelegated(conn) => conn.ws_fd(),
+            _ => None,
+        }
+    }
+
     pub fn remaining_bandwidth(&self) -> i64 {
         self.bandwidth_remaining
     }
@@ -382,6 +395,8 @@ impl<C, St> GatewayClient<C, St> {
         &self,
         gateway_protocol: Option<u8>,
     ) -> Result<(), GatewayClientError> {
+        debug!("gateway protocol: {gateway_protocol:?}, ours: {CURRENT_PROTOCOL_VERSION}");
+
         // right now there are no failure cases here, but this might change in the future
         match gateway_protocol {
             None => {
@@ -423,6 +438,7 @@ impl<C, St> GatewayClient<C, St> {
                 ws_stream,
                 self.local_identity.as_ref(),
                 self.gateway_identity,
+                !self.disabled_credentials_mode,
             )
             .await
             .map_err(GatewayClientError::RegistrationFailure),
@@ -479,8 +495,13 @@ impl<C, St> GatewayClient<C, St> {
             .derive_destination_address();
         let encrypted_address = EncryptedAddressBytes::new(&self_address, shared_key, &iv);
 
-        let msg =
-            ClientControlRequest::new_authenticate(self_address, encrypted_address, iv).into();
+        let msg = ClientControlRequest::new_authenticate(
+            self_address,
+            encrypted_address,
+            iv,
+            !self.disabled_credentials_mode,
+        )
+        .into();
 
         match self.send_websocket_message(msg).await? {
             ServerResponse::Authenticate {
@@ -491,6 +512,7 @@ impl<C, St> GatewayClient<C, St> {
                 self.check_gateway_protocol(protocol_version)?;
                 self.authenticated = status;
                 self.bandwidth_remaining = bandwidth_remaining;
+                self.negotiated_protocol = protocol_version;
                 Ok(())
             }
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -577,6 +599,18 @@ impl<C, St> GatewayClient<C, St> {
             return self.try_claim_testnet_bandwidth().await;
         }
 
+        let Some(gateway_protocol) = self.negotiated_protocol else {
+            return Err(GatewayClientError::OutdatedGatewayCredentialVersion {
+                negotiated_protocol: None,
+            });
+        };
+
+        if gateway_protocol < CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION {
+            return Err(GatewayClientError::OutdatedGatewayCredentialVersion {
+                negotiated_protocol: Some(gateway_protocol),
+            });
+        }
+
         let prepared_credential = self
             .bandwidth_controller
             .as_ref()

common/client-libs/gateway-client/src/error.rs

@@ -47,6 +47,9 @@ pub enum GatewayClientError {
     #[error("Credential could not be serialized")]
     SerializeCredential,
 
+    #[error("can not spend bandwidth credential with the gateway as it's using outdated protocol (version: {negotiated_protocol:?})")]
+    OutdatedGatewayCredentialVersion { negotiated_protocol: Option<u8> },
+
     #[error("Client is not authenticated")]
     NotAuthenticated,
 

common/client-libs/gateway-client/src/packet_router.rs

@@ -69,6 +69,10 @@ impl PacketRouter {
         }
         Ok(())
     }
+
+    pub fn mark_as_success(&mut self) {
+        self.shutdown.mark_as_success();
+    }
 }
 
 impl GatewayPacketRouter for PacketRouter {

common/client-libs/gateway-client/src/socket_state.rs

@@ -11,9 +11,12 @@ use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_gateway_requests::registration::handshake::SharedKeys;
 use nym_task::TaskClient;
+use std::os::raw::c_int as RawFd;
 use std::sync::Arc;
 use tungstenite::Message;
 
+#[cfg(unix)]
+use std::os::fd::AsRawFd;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::net::TcpStream;
 #[cfg(not(target_arch = "wasm32"))]
@@ -37,9 +40,20 @@ type WsConn = JSWebsocket;
 
 type SplitStreamReceiver = oneshot::Receiver<Result<SplitStream<WsConn>, GatewayClientError>>;
 
+pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
+    #[cfg(unix)]
+    match _conn.get_ref() {
+        MaybeTlsStream::Plain(stream) => Some(stream.as_raw_fd()),
+        &_ => None,
+    }
+    #[cfg(not(unix))]
+    None
+}
+
 pub(crate) struct PartiallyDelegated {
     sink_half: SplitSink<WsConn, Message>,
     delegated_stream: (SplitStreamReceiver, oneshot::Sender<()>),
+    ws_fd: Option<RawFd>,
 }
 
 impl PartiallyDelegated {
@@ -83,7 +97,7 @@ impl PartiallyDelegated {
 
     pub(crate) fn split_and_listen_for_mixnet_messages(
         conn: WsConn,
-        packet_router: PacketRouter,
+        mut packet_router: PacketRouter,
         shared_key: Arc<SharedKeys>,
         mut shutdown: TaskClient,
     ) -> Self {
@@ -92,6 +106,8 @@ impl PartiallyDelegated {
         let (notify_sender, notify_receiver) = oneshot::channel();
         let (stream_sender, stream_receiver) = oneshot::channel();
 
+        let ws_fd = ws_fd(&conn);
+
         let (sink, mut stream) = conn.split();
 
         let mixnet_receiver_future = async move {
@@ -124,6 +140,7 @@ impl PartiallyDelegated {
             if match ret_err {
                 Err(err) => stream_sender.send(Err(err)),
                 Ok(_) => {
+                    packet_router.mark_as_success();
                     shutdown.mark_as_success();
                     stream_sender.send(Ok(stream))
                 }
@@ -141,11 +158,16 @@ impl PartiallyDelegated {
         tokio::spawn(mixnet_receiver_future);
 
         PartiallyDelegated {
+            ws_fd,
             sink_half: sink,
             delegated_stream: (stream_receiver, notify_sender),
         }
     }
 
+    pub(crate) fn ws_fd(&self) -> Option<RawFd> {
+        self.ws_fd
+    }
+
     // if we want to send a message and don't care about response, we can don't need to reunite the split,
     // the sink itself is enough
     pub(crate) async fn send_without_response(

common/client-libs/validator-client/Cargo.toml

@@ -31,7 +31,6 @@ log = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
 futures = { workspace = true }
-openssl = { version = "^0.10.55", features = ["vendored"], optional = true }
 
 nym-coconut = { path = "../../nymcoconut" }
 nym-network-defaults = { path = "../../network-defaults" }
@@ -90,7 +89,7 @@ required-features = ["http-client"]
 
 [features]
 default = ["http-client"]
-http-client = ["cosmrs/rpc", "openssl"]
+http-client = ["cosmrs/rpc"]
 generate-ts = []
 contract-testing = ["nym-mixnet-contract-common/contract-testing"]
 

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -397,7 +397,7 @@ pub trait NymApiClientExt: ApiClient {
                 routes::API_VERSION,
                 routes::COCONUT_ROUTES,
                 routes::BANDWIDTH,
-                routes::COCONUT_FREE_PASS_NONCE,
+                routes::COCONUT_FREE_PASS,
             ],
             NO_PARAMS,
             request,

common/client-libs/validator-client/src/nyxd/contract_traits/dkg_query_client.rs

@@ -7,19 +7,20 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use nym_coconut_dkg_common::types::ChunkIndex;
+use cosmwasm_std::Addr;
+use log::trace;
+use nym_coconut_dkg_common::types::{ChunkIndex, NodeIndex, StateAdvanceResponse};
 use serde::Deserialize;
 
+use nym_coconut_dkg_common::dealer::RegisteredDealerDetails;
 pub use nym_coconut_dkg_common::{
-    dealer::{DealerDetailsResponse, PagedDealerResponse},
+    dealer::{DealerDetailsResponse, PagedDealerIndexResponse, PagedDealerResponse},
     dealing::{
         DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
         DealingMetadataResponse, DealingStatusResponse,
     },
     msg::QueryMsg as DkgQueryMsg,
-    types::{
-        DealerDetails, DealingIndex, Epoch, EpochId, EpochState, InitialReplacementData, State,
-    },
+    types::{DealerDetails, DealingIndex, Epoch, EpochId, EpochState, State},
     verification_key::{ContractVKShare, PagedVKSharesResponse, VkShareResponse},
 };
 
@@ -40,13 +41,25 @@ pub trait DkgQueryClient {
         self.query_dkg_contract(request).await
     }
 
+    async fn can_advance_state(&self) -> Result<StateAdvanceResponse, NyxdError> {
+        let request = DkgQueryMsg::CanAdvanceState {};
+        self.query_dkg_contract(request).await
+    }
+
     async fn get_current_epoch_threshold(&self) -> Result<Option<u64>, NyxdError> {
         let request = DkgQueryMsg::GetCurrentEpochThreshold {};
         self.query_dkg_contract(request).await
     }
 
-    async fn get_initial_dealers(&self) -> Result<Option<InitialReplacementData>, NyxdError> {
-        let request = DkgQueryMsg::GetInitialDealers {};
+    async fn get_registered_dealer_details(
+        &self,
+        address: &AccountId,
+        epoch_id: Option<EpochId>,
+    ) -> Result<RegisteredDealerDetails, NyxdError> {
+        let request = DkgQueryMsg::GetRegisteredDealer {
+            dealer_address: address.to_string(),
+            epoch_id,
+        };
         self.query_dkg_contract(request).await
     }
 
@@ -69,12 +82,12 @@ pub trait DkgQueryClient {
         self.query_dkg_contract(request).await
     }
 
-    async fn get_past_dealers_paged(
+    async fn get_dealer_indices_paged(
         &self,
         start_after: Option<String>,
         limit: Option<u32>,
-    ) -> Result<PagedDealerResponse, NyxdError> {
-        let request = DkgQueryMsg::GetPastDealers { start_after, limit };
+    ) -> Result<PagedDealerIndexResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealerIndices { start_after, limit };
         self.query_dkg_contract(request).await
     }
 
@@ -190,8 +203,8 @@ pub trait PagedDkgQueryClient: DkgQueryClient {
         collect_paged!(self, get_current_dealers_paged, dealers)
     }
 
-    async fn get_all_past_dealers(&self) -> Result<Vec<DealerDetails>, NyxdError> {
-        collect_paged!(self, get_past_dealers_paged, dealers)
+    async fn get_all_dealer_indices(&self) -> Result<Vec<(Addr, NodeIndex)>, NyxdError> {
+        collect_paged!(self, get_dealer_indices_paged, indices)
     }
 
     async fn get_all_verification_key_shares(
@@ -218,6 +231,7 @@ where
         let dkg_contract_address = &self
             .dkg_contract_address()
             .ok_or_else(|| NyxdError::unavailable_contract_address("dkg contract"))?;
+        trace!("using the following dkg contract: {dkg_contract_address}");
         self.query_contract_smart(dkg_contract_address, &query)
             .await
     }
@@ -238,18 +252,24 @@ mod tests {
         match msg {
             DkgQueryMsg::GetState {} => client.get_state().ignore(),
             DkgQueryMsg::GetCurrentEpochState {} => client.get_current_epoch().ignore(),
+            DkgQueryMsg::CanAdvanceState {} => client.can_advance_state().ignore(),
             DkgQueryMsg::GetCurrentEpochThreshold {} => {
                 client.get_current_epoch_threshold().ignore()
             }
-            DkgQueryMsg::GetInitialDealers {} => client.get_initial_dealers().ignore(),
+            DkgQueryMsg::GetRegisteredDealer {
+                dealer_address,
+                epoch_id,
+            } => client
+                .get_registered_dealer_details(&dealer_address.parse().unwrap(), epoch_id)
+                .ignore(),
             DkgQueryMsg::GetDealerDetails { dealer_address } => client
                 .get_dealer_details(&dealer_address.parse().unwrap())
                 .ignore(),
             DkgQueryMsg::GetCurrentDealers { limit, start_after } => client
                 .get_current_dealers_paged(start_after, limit)
                 .ignore(),
-            DkgQueryMsg::GetPastDealers { limit, start_after } => {
-                client.get_past_dealers_paged(start_after, limit).ignore()
+            DkgQueryMsg::GetDealerIndices { limit, start_after } => {
+                client.get_dealer_indices_paged(start_after, limit).ignore()
             }
             DkgQueryMsg::GetDealingStatus {
                 epoch_id,

common/client-libs/validator-client/src/nyxd/contract_traits/dkg_signing_client.rs

@@ -39,13 +39,6 @@ pub trait DkgSigningClient {
             .await
     }
 
-    async fn surpass_threshold(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::SurpassedThreshold {};
-
-        self.execute_dkg_contract(fee, req, "surpass DKG threshold".to_string(), vec![])
-            .await
-    }
-
     async fn register_dealer(
         &self,
         bte_key: EncodedBTEPublicKeyWithProof,
@@ -85,10 +78,9 @@ pub trait DkgSigningClient {
     async fn submit_dealing_chunk(
         &self,
         chunk: PartialContractDealing,
-        resharing: bool,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::CommitDealingsChunk { chunk, resharing };
+        let req = DkgExecuteMsg::CommitDealingsChunk { chunk };
 
         self.execute_dkg_contract(fee, req, "dealing chunk commitment".to_string(), vec![])
             .await
@@ -130,6 +122,20 @@ pub trait DkgSigningClient {
         )
         .await
     }
+
+    async fn trigger_dkg_reset(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        let req = DkgExecuteMsg::TriggerReset {};
+
+        self.execute_dkg_contract(fee, req, "trigger DKG reset".to_string(), vec![])
+            .await
+    }
+
+    async fn trigger_dkg_resharing(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        let req = DkgExecuteMsg::TriggerResharing {};
+
+        self.execute_dkg_contract(fee, req, "trigger DKG resharing".to_string(), vec![])
+            .await
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -192,8 +198,8 @@ mod tests {
             } => client
                 .submit_dealing_metadata(dealing_index, chunks, resharing, None)
                 .ignore(),
-            DkgExecuteMsg::CommitDealingsChunk { chunk, resharing } => {
-                client.submit_dealing_chunk(chunk, resharing, None).ignore()
+            DkgExecuteMsg::CommitDealingsChunk { chunk } => {
+                client.submit_dealing_chunk(chunk, None).ignore()
             }
             DkgExecuteMsg::CommitVerificationKeyShare { share, resharing } => client
                 .submit_verification_key_share(share, resharing, None)
@@ -201,8 +207,9 @@ mod tests {
             DkgExecuteMsg::VerifyVerificationKeyShare { owner, resharing } => client
                 .verify_verification_key_share(&owner.parse().unwrap(), resharing, None)
                 .ignore(),
-            DkgExecuteMsg::SurpassedThreshold {} => client.surpass_threshold(None).ignore(),
             DkgExecuteMsg::AdvanceEpochState {} => client.advance_dkg_epoch_state(None).ignore(),
+            DkgExecuteMsg::TriggerReset {} => client.trigger_dkg_reset(None).ignore(),
+            DkgExecuteMsg::TriggerResharing {} => client.trigger_dkg_resharing(None).ignore(),
         };
     }
 }

common/client-libs/validator-client/src/nyxd/mod.rs

@@ -16,7 +16,6 @@ use crate::signing::tx_signer::TxSigner;
 use crate::signing::AccountData;
 use crate::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient, ReqwestRpcClient};
 use async_trait::async_trait;
-use cosmrs::cosmwasm;
 use cosmrs::tendermint::{abci, evidence::Evidence, Genesis};
 use cosmrs::tx::{Raw, SignDoc};
 use cosmwasm_std::Addr;
@@ -40,7 +39,7 @@ pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::{
     bank::MsgSend,
-    bip32,
+    bip32, cosmwasm,
     crypto::PublicKey,
     query::{PageRequest, PageResponse},
     tendermint::{

common/commands/Cargo.toml

@@ -9,7 +9,7 @@ license.workspace = true
 anyhow = { workspace = true }
 base64 = "0.13.0"
 bip39 = { workspace = true }
-bs58 = "0.4"
+bs58 = { workspace = true }
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
 clap = { workspace = true, features = ["derive"] }
@@ -55,6 +55,7 @@ nym-credentials = { path = "../../common/credentials" }
 nym-credentials-interface = { path = "../../common/credentials-interface" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credential-utils = { path = "../../common/credential-utils" }
+nym-id = { path = "../nym-id" }
 
 nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }
 nym-types = { path = "../../common/types" }

common/commands/src/coconut/generate_freepass.rs

@@ -35,10 +35,12 @@ fn parse_rfc3339_expiration_date(raw: &str) -> Result<OffsetDateTime, time::erro
 #[clap(group(ArgGroup::new("expiration").required(true)))]
 pub struct Args {
     /// Specifies the expiration date of the free pass(es)
-    /// Requires
+    /// Can't be set to more than a week into the future.
     #[clap(long, group = "expiration", value_parser = parse_rfc3339_expiration_date)]
     pub(crate) expiration_date: Option<OffsetDateTime>,
 
+    /// The expiration of the free pass(es) expresses as unix timestamp.
+    /// Can't be set to more than a week into the future.
     #[clap(long, group = "expiration")]
     pub(crate) expiration_timestamp: Option<i64>,
 

common/commands/src/coconut/import_credential.rs

@@ -0,0 +1,64 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::utils::CommonConfigsWrapper;
+use anyhow::bail;
+use clap::ArgGroup;
+use clap::Parser;
+use nym_credential_storage::initialise_persistent_storage;
+use nym_id::import_credential;
+use std::fs;
+use std::path::PathBuf;
+
+fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[derive(Debug, Parser)]
+#[clap(group(ArgGroup::new("cred_data").required(true)))]
+pub struct Args {
+    /// Config file of the client that is supposed to use the credential.
+    #[clap(long)]
+    pub(crate) client_config: PathBuf,
+
+    /// Explicitly provide the encoded credential data (as base58)
+    #[clap(long, group = "cred_data", value_parser = parse_encoded_credential_data)]
+    pub(crate) credential_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary credential data
+    #[clap(long, group = "cred_data")]
+    pub(crate) credential_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[clap(long, hide = true)]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn execute(args: Args) -> anyhow::Result<()> {
+    let loaded = CommonConfigsWrapper::try_load(args.client_config)?;
+
+    if let Ok(id) = loaded.try_get_id() {
+        println!("loaded config file for client '{id}'");
+    }
+
+    let Ok(credentials_store) = loaded.try_get_credentials_store() else {
+        bail!("the loaded config does not have a credentials store information")
+    };
+
+    println!(
+        "using credentials store at '{}'",
+        credentials_store.display()
+    );
+    let credentials_store = initialise_persistent_storage(credentials_store).await;
+
+    let raw_credential = match args.credential_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(args.credential_path.unwrap())?
+        }
+    };
+
+    import_credential(credentials_store, raw_credential, args.version).await?;
+    Ok(())
+}

common/commands/src/coconut/mod.rs

@@ -4,6 +4,7 @@
 use clap::{Args, Subcommand};
 
 pub mod generate_freepass;
+pub mod import_credential;
 pub mod issue_credentials;
 pub mod recover_credentials;
 
@@ -19,4 +20,5 @@ pub enum CoconutCommands {
     GenerateFreepass(generate_freepass::Args),
     IssueCredentials(issue_credentials::Args),
     RecoverCredentials(recover_credentials::Args),
+    ImportCredential(import_credential::Args),
 }

common/cosmwasm-smart-contracts/coconut-dkg/src/dealer.rs

@@ -14,20 +14,32 @@ pub struct DealerDetails {
     pub assigned_index: NodeIndex,
 }
 
+#[cw_serde]
+pub struct DealerRegistrationDetails {
+    pub bte_public_key_with_proof: EncodedBTEPublicKeyWithProof,
+    pub ed25519_identity: String,
+    pub announce_address: String,
+}
+
 #[cw_serde]
 #[derive(Copy)]
 pub enum DealerType {
-    Current,
-    Past,
+    Current { assigned_index: NodeIndex },
+    Past { assigned_index: NodeIndex },
     Unknown,
 }
 
 impl DealerType {
     pub fn is_current(&self) -> bool {
-        matches!(&self, DealerType::Current)
+        matches!(&self, DealerType::Current { .. })
     }
 }
 
+#[cw_serde]
+pub struct RegisteredDealerDetails {
+    pub details: Option<DealerRegistrationDetails>,
+}
+
 #[cw_serde]
 pub struct DealerDetailsResponse {
     pub details: Option<DealerDetails>,
@@ -65,3 +77,20 @@ impl PagedDealerResponse {
         }
     }
 }
+
+#[cw_serde]
+pub struct PagedDealerIndexResponse {
+    pub indices: Vec<(Addr, NodeIndex)>,
+
+    /// Field indicating paging information for the following queries if the caller wishes to get further entries.
+    pub start_next_after: Option<Addr>,
+}
+
+impl PagedDealerIndexResponse {
+    pub fn new(indices: Vec<(Addr, NodeIndex)>, start_next_after: Option<Addr>) -> Self {
+        PagedDealerIndexResponse {
+            indices,
+            start_next_after,
+        }
+    }
+}

common/cosmwasm-smart-contracts/coconut-dkg/src/msg.rs

@@ -11,12 +11,15 @@ use cosmwasm_schema::cw_serde;
 
 #[cfg(feature = "schema")]
 use crate::{
-    dealer::{DealerDetailsResponse, PagedDealerResponse},
+    dealer::{
+        DealerDetailsResponse, PagedDealerIndexResponse, PagedDealerResponse,
+        RegisteredDealerDetails,
+    },
     dealing::{
         DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
         DealingMetadataResponse, DealingStatusResponse,
     },
-    types::{Epoch, InitialReplacementData, State},
+    types::{Epoch, State, StateAdvanceResponse},
     verification_key::{PagedVKSharesResponse, VkShareResponse},
 };
 #[cfg(feature = "schema")]
@@ -53,7 +56,6 @@ pub enum ExecuteMsg {
 
     CommitDealingsChunk {
         chunk: PartialContractDealing,
-        resharing: bool,
     },
 
     CommitVerificationKeyShare {
@@ -66,9 +68,11 @@ pub enum ExecuteMsg {
         resharing: bool,
     },
 
-    SurpassedThreshold {},
-
     AdvanceEpochState {},
+
+    TriggerReset {},
+
+    TriggerResharing {},
 }
 
 #[cw_serde]
@@ -83,8 +87,14 @@ pub enum QueryMsg {
     #[cfg_attr(feature = "schema", returns(u64))]
     GetCurrentEpochThreshold {},
 
-    #[cfg_attr(feature = "schema", returns(Option<InitialReplacementData>))]
-    GetInitialDealers {},
+    #[cfg_attr(feature = "schema", returns(StateAdvanceResponse))]
+    CanAdvanceState {},
+
+    #[cfg_attr(feature = "schema", returns(RegisteredDealerDetails))]
+    GetRegisteredDealer {
+        dealer_address: String,
+        epoch_id: Option<EpochId>,
+    },
 
     #[cfg_attr(feature = "schema", returns(DealerDetailsResponse))]
     GetDealerDetails { dealer_address: String },
@@ -95,8 +105,8 @@ pub enum QueryMsg {
         start_after: Option<String>,
     },
 
-    #[cfg_attr(feature = "schema", returns(PagedDealerResponse))]
-    GetPastDealers {
+    #[cfg_attr(feature = "schema", returns(PagedDealerIndexResponse))]
+    GetDealerIndices {
         limit: Option<u32>,
         start_after: Option<String>,
     },

common/cosmwasm-smart-contracts/coconut-dkg/src/types.rs

@@ -5,7 +5,7 @@ use cosmwasm_schema::cw_serde;
 use std::fmt::{Display, Formatter};
 use std::str::FromStr;
 
-pub use crate::dealer::{DealerDetails, PagedDealerResponse};
+pub use crate::dealer::{DealerDetails, DealerRegistrationDetails, PagedDealerResponse};
 pub use contracts_common::dealings::ContractSafeBytes;
 pub use cosmwasm_std::{Addr, Coin, Timestamp};
 pub use cw4::Cw4Contract;
@@ -22,9 +22,19 @@ pub type ChunkIndex = u16;
 pub type PartialContractDealingData = ContractSafeBytes;
 
 #[cw_serde]
-pub struct InitialReplacementData {
-    pub initial_dealers: Vec<Addr>,
-    pub initial_height: u64,
+#[derive(Copy, Default)]
+pub struct StateAdvanceResponse {
+    pub current_state: EpochState,
+    pub progress: StateProgress,
+    pub deadline: Option<Timestamp>,
+    pub reached_deadline: bool,
+    pub is_complete: bool,
+}
+
+impl StateAdvanceResponse {
+    pub fn can_advance(&self) -> bool {
+        self.reached_deadline || self.is_complete
+    }
 }
 
 #[cw_serde]
@@ -40,6 +50,26 @@ pub struct TimeConfiguration {
     pub in_progress_time_secs: u64,
 }
 
+impl TimeConfiguration {
+    pub fn state_duration(&self, state: EpochState) -> Option<u64> {
+        match state {
+            EpochState::WaitingInitialisation => None,
+            EpochState::PublicKeySubmission { .. } => Some(self.public_key_submission_time_secs),
+            EpochState::DealingExchange { .. } => Some(self.dealing_exchange_time_secs),
+            EpochState::VerificationKeySubmission { .. } => {
+                Some(self.verification_key_submission_time_secs)
+            }
+            EpochState::VerificationKeyValidation { .. } => {
+                Some(self.verification_key_validation_time_secs)
+            }
+            EpochState::VerificationKeyFinalization { .. } => {
+                Some(self.verification_key_finalization_time_secs)
+            }
+            EpochState::InProgress => Some(self.in_progress_time_secs),
+        }
+    }
+}
+
 impl FromStr for TimeConfiguration {
     type Err = String;
 
@@ -87,13 +117,41 @@ pub struct State {
     pub key_size: u32,
 }
 
+#[cw_serde]
+#[derive(Copy, Default)]
+pub struct StateProgress {
+    /// Counts the number of dealers that have registered in this epoch.
+    // ideally we want to have here all group members
+    pub registered_dealers: u32,
+
+    /// Counts the number of resharing dealers that have registered in this epoch.
+    /// This field is only populated during a resharing exchange.
+    /// It is always <= registered_dealers.
+    pub registered_resharing_dealers: u32,
+
+    /// Counts the number of fully received dealings (i.e. full chunks) from all the allowed dealers.
+    // we expect registered_dealers * state.key_size number of dealings here (each dealer has to submit key_size number of dealings)
+    pub submitted_dealings: u32,
+
+    /// Counts the number of submitted verification key shared from the dealers.
+    // we expect registered_dealers number of keys here
+    pub submitted_key_shares: u32,
+
+    /// Counts the number of verified key shares.
+    // we expect submitted_key_shares number of verified keys here
+    pub verified_keys: u32,
+}
+
 #[cw_serde]
 #[derive(Copy, Default)]
 pub struct Epoch {
     pub state: EpochState,
     pub epoch_id: EpochId,
+    pub state_progress: StateProgress,
     pub time_configuration: TimeConfiguration,
-    pub finish_timestamp: Option<Timestamp>,
+
+    #[serde(alias = "finish_timestamp")]
+    pub deadline: Option<Timestamp>,
 }
 
 impl Epoch {
@@ -103,35 +161,45 @@ impl Epoch {
         time_configuration: TimeConfiguration,
         current_timestamp: Timestamp,
     ) -> Self {
-        let duration = match state {
-            EpochState::WaitingInitialisation => None,
-            EpochState::PublicKeySubmission { .. } => {
-                Some(time_configuration.public_key_submission_time_secs)
-            }
-            EpochState::DealingExchange { .. } => {
-                Some(time_configuration.dealing_exchange_time_secs)
-            }
-            EpochState::VerificationKeySubmission { .. } => {
-                Some(time_configuration.verification_key_submission_time_secs)
-            }
-            EpochState::VerificationKeyValidation { .. } => {
-                Some(time_configuration.verification_key_validation_time_secs)
-            }
-            EpochState::VerificationKeyFinalization { .. } => {
-                Some(time_configuration.verification_key_finalization_time_secs)
-            }
-            EpochState::InProgress => Some(time_configuration.in_progress_time_secs),
-        };
+        let duration = time_configuration.state_duration(state);
+
         Epoch {
             state,
             epoch_id,
+            state_progress: Default::default(),
             time_configuration,
-            finish_timestamp: duration.map(|d| current_timestamp.plus_seconds(d)),
+            deadline: duration.map(|d| current_timestamp.plus_seconds(d)),
         }
     }
 
+    pub fn update(mut self, next_state: EpochState, current_timestamp: Timestamp) -> Self {
+        self.state = next_state;
+        let duration = self.time_configuration.state_duration(next_state);
+        self.deadline = duration.map(|d| current_timestamp.plus_seconds(d));
+
+        self
+    }
+
+    pub fn next_reset(self, current_timestamp: Timestamp) -> Self {
+        Epoch::new(
+            EpochState::PublicKeySubmission { resharing: false },
+            self.epoch_id + 1,
+            self.time_configuration,
+            current_timestamp,
+        )
+    }
+
+    pub fn next_resharing(self, current_timestamp: Timestamp) -> Self {
+        Epoch::new(
+            EpochState::PublicKeySubmission { resharing: true },
+            self.epoch_id + 1,
+            self.time_configuration,
+            current_timestamp,
+        )
+    }
+
     pub fn final_timestamp_secs(&self) -> Option<u64> {
-        let mut finish = self.finish_timestamp?.seconds();
+        let mut finish = self.deadline?.seconds();
         let time_configuration = self.time_configuration;
         let mut curr_epoch_state = self.state;
         while let Some(state) = curr_epoch_state.next() {
@@ -256,4 +324,8 @@ impl EpochState {
     pub fn is_in_progress(&self) -> bool {
         matches!(self, EpochState::InProgress)
     }
+
+    pub fn is_dealing_exchange(&self) -> bool {
+        matches!(self, EpochState::DealingExchange { .. })
+    }
 }

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -8,7 +8,7 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-bs58 = "0.4.0"
+bs58 = { workspace = true }
 cosmwasm-std = { workspace = true }
 cosmwasm-schema = { workspace = true }
 schemars = "0.8"

common/credential-storage/migrations/20240206120000_add_credential_types.sql

@@ -13,5 +13,6 @@ CREATE TABLE coconut_credentials
     credential_type        TEXT    NOT NULL,
     credential_data        BLOB    NOT NULL,
     epoch_id               INTEGER NOT NULL,
-    consumed               BOOLEAN NOT NULL
+    consumed               BOOLEAN NOT NULL,
+    expired                BOOLEAN NOT NULL
 );

common/credential-storage/src/backends/memory.rs

@@ -48,13 +48,18 @@ impl CoconutCredentialManager {
             credential_type,
             epoch_id,
             consumed: false,
+            expired: false,
         })
     }
 
     /// Tries to retrieve one of the stored, unused credentials.
     pub async fn get_next_unspent_credential(&self) -> Option<StoredIssuedCredential> {
         let creds = self.inner.read().await;
-        creds.data.iter().find(|c| !c.consumed).cloned()
+        creds
+            .data
+            .iter()
+            .find(|c| !c.consumed && !c.expired)
+            .cloned()
     }
 
     /// Consumes in the database the specified credential.
@@ -68,4 +73,16 @@ impl CoconutCredentialManager {
             cred.consumed = true;
         }
     }
+
+    /// Marks the specified credential as expired
+    ///
+    /// # Arguments
+    ///
+    /// * `id`: Id of the credential to mark as expired.
+    pub async fn mark_expired(&self, id: i64) {
+        let mut creds = self.inner.write().await;
+        if let Some(cred) = creds.data.get_mut(id as usize) {
+            cred.expired = true;
+        }
+    }
 }

common/credential-storage/src/backends/sqlite.rs

@@ -27,8 +27,8 @@ impl CoconutCredentialManager {
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                INSERT INTO coconut_credentials(serialization_revision, credential_type, credential_data, epoch_id, consumed)
-                VALUES (?, ?, ?, ?, false)
+                INSERT INTO coconut_credentials(serialization_revision, credential_type, credential_data, epoch_id, consumed, expired)
+                VALUES (?, ?, ?, ?, false, false)
             "#,
             serialization_revision, credential_type, credential_data, epoch_id
         ).execute(&self.connection_pool).await?;
@@ -38,9 +38,11 @@ impl CoconutCredentialManager {
     pub async fn get_next_unspent_credential(
         &self,
     ) -> Result<Option<StoredIssuedCredential>, sqlx::Error> {
-        sqlx::query_as("SELECT * FROM coconut_credentials WHERE NOT consumed LIMIT 1")
-            .fetch_optional(&self.connection_pool)
-            .await
+        sqlx::query_as(
+            "SELECT * FROM coconut_credentials WHERE NOT consumed AND NOT expired LIMIT 1",
+        )
+        .fetch_optional(&self.connection_pool)
+        .await
     }
 
     /// Consumes in the database the specified credential.
@@ -57,4 +59,19 @@ impl CoconutCredentialManager {
         .await?;
         Ok(())
     }
+
+    /// Marks the specified credential as expired
+    ///
+    /// # Arguments
+    ///
+    /// * `id`: Id of the credential to mark as expired.
+    pub async fn mark_expired(&self, id: i64) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "UPDATE coconut_credentials SET expired = TRUE WHERE id = ?",
+            id
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
 }

common/credential-storage/src/ephemeral_storage.rs

@@ -44,14 +44,11 @@ impl Storage for EphemeralStorage {
 
     async fn get_next_unspent_credential(
         &self,
-    ) -> Result<StoredIssuedCredential, Self::StorageError> {
-        let credential = self
+    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
+        Ok(self
             .coconut_credential_manager
             .get_next_unspent_credential()
-            .await
-            .ok_or(StorageError::NoCredential)?;
-
-        Ok(credential)
+            .await)
     }
 
     async fn consume_coconut_credential(&self, id: i64) -> Result<(), StorageError> {
@@ -61,4 +58,10 @@ impl Storage for EphemeralStorage {
 
         Ok(())
     }
+
+    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
+        self.coconut_credential_manager.mark_expired(id).await;
+
+        Ok(())
+    }
 }

common/credential-storage/src/models.rs

@@ -27,6 +27,7 @@ pub struct StoredIssuedCredential {
 
     pub epoch_id: u32,
     pub consumed: bool,
+    pub expired: bool,
 }
 
 pub struct StorableIssuedCredential<'a> {

common/credential-storage/src/persistent_storage.rs

@@ -76,14 +76,11 @@ impl Storage for PersistentStorage {
 
     async fn get_next_unspent_credential(
         &self,
-    ) -> Result<StoredIssuedCredential, Self::StorageError> {
-        let credential = self
+    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
+        Ok(self
             .coconut_credential_manager
             .get_next_unspent_credential()
-            .await?
-            .ok_or(StorageError::NoCredential)?;
-
-        Ok(credential)
+            .await?)
     }
 
     async fn consume_coconut_credential(&self, id: i64) -> Result<(), StorageError> {
@@ -93,4 +90,10 @@ impl Storage for PersistentStorage {
 
         Ok(())
     }
+
+    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
+        self.coconut_credential_manager.mark_expired(id).await?;
+
+        Ok(())
+    }
 }

common/credential-storage/src/storage.rs

@@ -14,10 +14,11 @@ pub trait Storage: Send + Sync {
         bandwidth_credential: StorableIssuedCredential<'a>,
     ) -> Result<(), Self::StorageError>;
 
-    /// Tries to retrieve one of the stored, unused credentials.
+    /// Tries to retrieve one of the stored, unused credentials,
+    /// that is also not marked as expired
     async fn get_next_unspent_credential(
         &self,
-    ) -> Result<StoredIssuedCredential, Self::StorageError>;
+    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError>;
 
     /// Marks as consumed in the database the specified credential.
     ///
@@ -25,4 +26,11 @@ pub trait Storage: Send + Sync {
     ///
     /// * `id`: Id of the credential to be consumed.
     async fn consume_coconut_credential(&self, id: i64) -> Result<(), Self::StorageError>;
+
+    /// Marks the specified credential as expired
+    ///
+    /// # Arguments
+    ///
+    /// * `id`: Id of the credential to mark as expired.
+    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError>;
 }

common/credential-utils/src/recovery_storage.rs

@@ -53,7 +53,7 @@ impl RecoveryStorage {
 
     pub fn voucher_filename(voucher: &IssuanceBandwidthCredential) -> String {
         let prefix = voucher.typ().to_string();
-        let suffix = voucher.blinded_g1_serial_number_bs58();
+        let suffix = voucher.blinded_serial_number_bs58();
         format!("{prefix}-{suffix}.{DUMPED_VOUCHER_EXTENSION}")
     }
 

common/credential-utils/src/utils.rs

@@ -92,7 +92,7 @@ where
             .as_secs();
 
         if epoch.state.is_final() {
-            if let Some(finish_timestamp) = epoch.finish_timestamp {
+            if let Some(finish_timestamp) = epoch.deadline {
                 if current_timestamp_secs + SAFETY_BUFFER_SECS >= finish_timestamp.seconds() {
                     info!("In the next {} minute(s), a transition will take place in the coconut system. Deposits should be halted in this time for safety reasons.", SAFETY_BUFFER_SECS / 60);
                     exit(0);

common/credentials-interface/src/lib.rs

@@ -10,9 +10,9 @@ use thiserror::Error;
 pub use nym_coconut::{
     aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar, keygen,
     prepare_blind_sign, prove_bandwidth_credential, verify_credential, Attribute, Base58,
-    BlindSignRequest, BlindedSignature, Bytable, CoconutError, KeyPair, Parameters,
-    PrivateAttribute, PublicAttribute, SecretKey, Signature, SignatureShare, VerificationKey,
-    VerifyCredentialRequest,
+    BlindSignRequest, BlindedSerialNumber, BlindedSignature, Bytable, CoconutError, KeyPair,
+    Parameters, PrivateAttribute, PublicAttribute, SecretKey, Signature, SignatureShare,
+    VerificationKey, VerifyCredentialRequest,
 };
 
 pub const VOUCHER_INFO_TYPE: &str = "BandwidthVoucher";
@@ -129,4 +129,8 @@ impl CredentialSpendingData {
         // the first attribute is variant specific bandwidth encoding, the second one should be the type
         self.public_attributes_plain.first()
     }
+
+    pub fn blinded_serial_number(&self) -> BlindedSerialNumber {
+        self.verify_credential_request.blinded_serial_number()
+    }
 }

common/credentials/src/coconut/bandwidth/freepass.rs

@@ -14,7 +14,7 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 
 pub const MAX_FREE_PASS_VALIDITY: Duration = Duration::WEEK; // 1 week
 
-#[derive(Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
+#[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub struct FreePassIssuedData {
     /// the plain validity value of this credential expressed as unix timestamp
     #[zeroize(skip)]
@@ -30,6 +30,14 @@ impl<'a> From<&'a FreePassIssuanceData> for FreePassIssuedData {
 }
 
 impl FreePassIssuedData {
+    pub fn expired(&self) -> bool {
+        self.expiry_date <= OffsetDateTime::now_utc()
+    }
+
+    pub fn expiry_date(&self) -> OffsetDateTime {
+        self.expiry_date
+    }
+
     pub fn expiry_date_plain(&self) -> String {
         self.expiry_date.unix_timestamp().to_string()
     }
@@ -85,7 +93,7 @@ impl FreePassIssuanceData {
     pub async fn obtain_free_pass_nonce(
         &self,
         client: &nym_validator_client::client::NymApiClient,
-    ) -> Result<u32, Error> {
+    ) -> Result<[u8; 16], Error> {
         let server_response = client.free_pass_nonce().await?;
         Ok(server_response.current_nonce)
     }
@@ -94,12 +102,11 @@ impl FreePassIssuanceData {
         &self,
         signing_request: &CredentialSigningData,
         account_data: &AccountData,
-        issuer_nonce: u32,
+        issuer_nonce: [u8; 16],
     ) -> Result<FreePassRequest, Error> {
-        let plaintext = issuer_nonce.to_be_bytes();
         let nonce_signature = account_data
             .private_key()
-            .sign(&plaintext)
+            .sign(&issuer_nonce)
             .map_err(|_| Error::Secp256k1SignFailure)?;
 
         Ok(FreePassRequest {

common/credentials/src/coconut/bandwidth/issuance.rs

@@ -9,10 +9,10 @@ use crate::coconut::bandwidth::{
 };
 use crate::coconut::utils::scalar_serde_helper;
 use crate::error::Error;
-use bls12_381::G1Projective;
 use nym_credentials_interface::{
-    aggregate_signature_shares, hash_to_scalar, prepare_blind_sign, Attribute, BlindedSignature,
-    Parameters, PrivateAttribute, PublicAttribute, Signature, SignatureShare, VerificationKey,
+    aggregate_signature_shares, hash_to_scalar, prepare_blind_sign, Attribute, BlindedSerialNumber,
+    BlindedSignature, Parameters, PrivateAttribute, PublicAttribute, Signature, SignatureShare,
+    VerificationKey,
 };
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_validator_client::nym_api::EpochId;
@@ -140,15 +140,14 @@ impl IssuanceBandwidthCredential {
         Self::new(FreePassIssuanceData::new(expiry_date))
     }
 
-    pub fn blind_serial_number_in_g1subgroup(&self) -> G1Projective {
-        bandwidth_credential_params().gen1() * self.serial_number
+    pub fn blind_serial_number(&self) -> BlindedSerialNumber {
+        (bandwidth_credential_params().gen2() * self.serial_number).into()
     }
 
-    // NOT TO BE CONFUSED WITH BLINDED SERIAL NUMBER IN CREDENTIAL ITSELF
-    pub fn blinded_g1_serial_number_bs58(&self) -> String {
+    pub fn blinded_serial_number_bs58(&self) -> String {
         use nym_credentials_interface::Base58;
 
-        self.blind_serial_number_in_g1subgroup().to_bs58()
+        self.blind_serial_number().to_bs58()
     }
 
     pub fn typ(&self) -> CredentialType {
@@ -316,9 +315,12 @@ impl IssuanceBandwidthCredential {
     }
 
     // TODO: is that actually needed?
+    // idea: make it consistent with the issued credential and its vX serde
     pub fn try_from_recovered_bytes(bytes: &[u8]) -> Result<Self, Error> {
         use bincode::Options;
-        Ok(make_recovery_bincode_serializer().deserialize(bytes)?)
+        make_recovery_bincode_serializer()
+            .deserialize(bytes)
+            .map_err(|source| Error::RecoveryCredentialDeserializationFailure { source })
     }
 }
 
@@ -328,3 +330,18 @@ fn make_recovery_bincode_serializer() -> impl bincode::Options {
         .with_big_endian()
         .with_varint_encoding()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}
+
+    fn assert_zeroize<T: Zeroize>() {}
+
+    #[test]
+    fn credential_is_zeroized() {
+        assert_zeroize::<IssuanceBandwidthCredential>();
+        assert_zeroize_on_drop::<IssuanceBandwidthCredential>();
+    }
+}

common/credentials/src/coconut/bandwidth/issued.rs

@@ -20,7 +20,7 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 
 pub const CURRENT_SERIALIZATION_REVISION: u8 = 1;
 
-#[derive(Zeroize, Serialize, Deserialize)]
+#[derive(Debug, Zeroize, Serialize, Deserialize)]
 pub enum BandwidthCredentialIssuedDataVariant {
     Voucher(BandwidthVoucherIssuedData),
     FreePass(FreePassIssuedData),
@@ -116,6 +116,23 @@ impl IssuedBandwidthCredential {
         }
     }
 
+    pub fn try_unpack(bytes: &[u8], revision: impl Into<Option<u8>>) -> Result<Self, Error> {
+        let revision = revision.into().unwrap_or(CURRENT_SERIALIZATION_REVISION);
+
+        match revision {
+            1 => Self::unpack_v1(bytes),
+            _ => Err(Error::UnknownSerializationRevision { revision }),
+        }
+    }
+
+    pub fn epoch_id(&self) -> EpochId {
+        self.epoch_id
+    }
+
+    pub fn variant_data(&self) -> &BandwidthCredentialIssuedDataVariant {
+        &self.variant_data
+    }
+
     pub fn current_serialization_revision(&self) -> u8 {
         CURRENT_SERIALIZATION_REVISION
     }
@@ -130,7 +147,12 @@ impl IssuedBandwidthCredential {
     /// Unpack (deserialize) the credential data from the given bytes using v1 serializer.
     pub fn unpack_v1(bytes: &[u8]) -> Result<Self, Error> {
         use bincode::Options;
-        Ok(make_storable_bincode_serializer().deserialize(bytes)?)
+        make_storable_bincode_serializer()
+            .deserialize(bytes)
+            .map_err(|source| Error::SerializationFailure {
+                source,
+                revision: 1,
+            })
     }
 
     pub fn randomise_signature(&mut self) {
@@ -183,3 +205,18 @@ fn make_storable_bincode_serializer() -> impl bincode::Options {
         .with_big_endian()
         .with_varint_encoding()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}
+
+    fn assert_zeroize<T: Zeroize>() {}
+
+    #[test]
+    fn credential_is_zeroized() {
+        assert_zeroize::<IssuedBandwidthCredential>();
+        assert_zeroize_on_drop::<IssuedBandwidthCredential>();
+    }
+}

common/credentials/src/coconut/bandwidth/voucher.rs

@@ -13,7 +13,7 @@ use nym_validator_client::nyxd::{Coin, Hash};
 use serde::{Deserialize, Serialize};
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-#[derive(Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
+#[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 pub struct BandwidthVoucherIssuedData {
     /// the plain value (e.g., bandwidth) encoded in this voucher
     // note: for legacy reasons we're only using the value of the coin and ignoring the denom
@@ -30,6 +30,10 @@ impl<'a> From<&'a BandwidthVoucherIssuanceData> for BandwidthVoucherIssuedData {
 }
 
 impl BandwidthVoucherIssuedData {
+    pub fn value(&self) -> &Coin {
+        &self.value
+    }
+
     pub fn value_plain(&self) -> String {
         self.value.amount.to_string()
     }

common/credentials/src/error.rs

@@ -5,6 +5,7 @@ use nym_credentials_interface::CoconutError;
 use nym_crypto::asymmetric::encryption::KeyRecoveryError;
 use nym_validator_client::ValidatorClientError;
 
+use crate::coconut::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -12,8 +13,18 @@ pub enum Error {
     #[error("IO error")]
     IOError(#[from] std::io::Error),
 
-    #[error("failed to (de)serialize credential structure: {0}")]
-    SerializationFailure(#[from] bincode::Error),
+    #[error("failed to deserialize a recovery credential: {source}")]
+    RecoveryCredentialDeserializationFailure { source: bincode::Error },
+
+    #[error("failed to (de)serialize provided credential using revision {revision}: {source}")]
+    SerializationFailure {
+        #[source]
+        source: bincode::Error,
+        revision: u8,
+    },
+
+    #[error("unknown credential serializatio revision {revision}. the current (and max supported) version is {CURRENT_SERIALIZATION_REVISION}")]
+    UnknownSerializationRevision { revision: u8 },
 
     #[error("The detailed description is yet to be determined")]
     BandwidthCredentialError,

common/credentials/src/lib.rs

@@ -9,3 +9,4 @@ pub use coconut::bandwidth::{
     IssuedBandwidthCredential,
 };
 pub use coconut::utils::{obtain_aggregate_signature, obtain_aggregate_verification_key};
+pub use error::Error;

common/crypto/Cargo.toml

@@ -9,7 +9,7 @@ repository = { workspace = true }
 
 [dependencies]
 aes = { version = "0.8.1", optional = true }
-bs58 = "0.4.0"
+bs58 = { workspace = true }
 blake3 = { version = "1.3.1", features = ["traits-preview"], optional = true }
 ctr = { version = "0.9.1", optional = true }
 digest = { version = "0.10.3", optional = true }

common/dkg/Cargo.toml

@@ -14,7 +14,7 @@ bitvec = "1.0.0"
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
 bls12_381 = { workspace = true, default-features = false, features = ["alloc", "pairings", "experimental", "zeroize"] }
 nym-contracts-common = { path = "../cosmwasm-smart-contracts/contracts-common", optional = true }
-bs58 = "0.4"
+bs58 = { workspace = true }
 
 
 lazy_static = "1.4.0"

common/dkg/src/bte/proof_chunking.rs

@@ -837,7 +837,7 @@ mod tests {
         let share3 = chunks3.clone().try_into().unwrap();
 
         let shares = vec![share1, share2, share3];
-        let chunks = vec![chunks1, chunks2, chunks3];
+        let chunks = &[chunks1, chunks2, chunks3];
 
         for (i, pk_i) in pks.iter().enumerate() {
             let mut ciphertext_chunk_i = Vec::with_capacity(NUM_CHUNKS);

common/ip-packet-requests/Cargo.toml

@@ -11,6 +11,7 @@ license.workspace = true
 [dependencies]
 bincode = "1.3.3"
 bytes = "1.5.0"
+nym-bin-common = { path = "../bin-common" }
 nym-sphinx = { path = "../nymsphinx" }
 rand = "0.8.5"
 serde = { workspace = true, features = ["derive"] }

common/ip-packet-requests/src/codec.rs

@@ -34,6 +34,13 @@ impl MultiIpPacketCodec {
         }
     }
 
+    pub fn bundle_one_packet(packet: Bytes) -> Bytes {
+        let mut bundled_packets = BytesMut::new();
+        bundled_packets.extend_from_slice(&(packet.len() as u16).to_be_bytes());
+        bundled_packets.extend_from_slice(&packet);
+        bundled_packets.freeze()
+    }
+
     // Append a packet to the buffer and return the buffer if it's full
     pub fn append_packet(&mut self, packet: Bytes) -> Option<Bytes> {
         let mut bundled_packets = BytesMut::new();
@@ -47,7 +54,7 @@ impl MultiIpPacketCodec {
     }
 
     // Flush the current buffer and return it.
-    fn flush_current_buffer(&mut self) -> Bytes {
+    pub fn flush_current_buffer(&mut self) -> Bytes {
         let mut output_buffer = BytesMut::new();
         std::mem::swap(&mut output_buffer, &mut self.buffer);
         output_buffer.freeze()

common/ip-packet-requests/src/lib.rs

@@ -1,8 +1,41 @@
-pub mod codec;
-pub mod request;
-pub mod response;
+use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+use std::net::{Ipv4Addr, Ipv6Addr};
 
-pub const CURRENT_VERSION: u8 = 2;
+// The current version of the protocol.
+// The idea here is that we add new request response types at least one version before we start
+// using them.
+// Also, depending on the version in the client connect message the IPR could respond with a
+// matching older version.
+pub use v6::request;
+pub use v6::response;
+
+pub mod codec;
+pub mod v6;
+
+// version 3: initial version
+// version 4: IPv6 support
+// version 5: Add severity level to info response
+// version 6: Increase the available IPs
+pub const CURRENT_VERSION: u8 = 6;
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct IpPair {
+    pub ipv4: Ipv4Addr,
+    pub ipv6: Ipv6Addr,
+}
+
+impl IpPair {
+    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl Display for IpPair {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "IPv4: {}, IPv6: {}", self.ipv4, self.ipv6)
+    }
+}
 
 fn make_bincode_serializer() -> impl bincode::Options {
     use bincode::Options;

common/ip-packet-requests/src/v6/mod.rs

@@ -0,0 +1,2 @@
+pub mod request;
+pub mod response;

common/ip-packet-requests/src/v6/request.rs

@@ -1,9 +1,7 @@
-use std::net::IpAddr;
-
 use nym_sphinx::addressing::clients::Recipient;
 use serde::{Deserialize, Serialize};
 
-use crate::{make_bincode_serializer, CURRENT_VERSION};
+use crate::{make_bincode_serializer, IpPair, CURRENT_VERSION};
 
 fn generate_random() -> u64 {
     use rand::RngCore;
@@ -19,10 +17,11 @@ pub struct IpPacketRequest {
 
 impl IpPacketRequest {
     pub fn new_static_connect_request(
-        ip: IpAddr,
+        ips: IpPair,
         reply_to: Recipient,
         reply_to_hops: Option<u8>,
         reply_to_avg_mix_delays: Option<f64>,
+        buffer_timeout: Option<u64>,
     ) -> (Self, u64) {
         let request_id = generate_random();
         (
@@ -30,10 +29,11 @@ impl IpPacketRequest {
                 version: CURRENT_VERSION,
                 data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
                     request_id,
-                    ip,
+                    ips,
                     reply_to,
                     reply_to_hops,
                     reply_to_avg_mix_delays,
+                    buffer_timeout,
                 }),
             },
             request_id,
@@ -44,6 +44,7 @@ impl IpPacketRequest {
         reply_to: Recipient,
         reply_to_hops: Option<u8>,
         reply_to_avg_mix_delays: Option<f64>,
+        buffer_timeout: Option<u64>,
     ) -> (Self, u64) {
         let request_id = generate_random();
         (
@@ -54,6 +55,7 @@ impl IpPacketRequest {
                     reply_to,
                     reply_to_hops,
                     reply_to_avg_mix_delays,
+                    buffer_timeout,
                 }),
             },
             request_id,
@@ -74,19 +76,49 @@ impl IpPacketRequest {
         )
     }
 
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+    pub fn new_data_request(ip_packets: bytes::Bytes) -> Self {
         Self {
             version: CURRENT_VERSION,
-            data: IpPacketRequestData::Data(DataRequest { ip_packet }),
+            data: IpPacketRequestData::Data(DataRequest { ip_packets }),
         }
     }
 
+    pub fn new_ping(reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::Ping(PingRequest {
+                    request_id,
+                    reply_to,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_health_request(reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::Health(HealthRequest {
+                    request_id,
+                    reply_to,
+                }),
+            },
+            request_id,
+        )
+    }
+
     pub fn id(&self) -> Option<u64> {
         match &self.data {
             IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
             IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
             IpPacketRequestData::Disconnect(request) => Some(request.request_id),
             IpPacketRequestData::Data(_) => None,
+            IpPacketRequestData::Ping(request) => Some(request.request_id),
+            IpPacketRequestData::Health(request) => Some(request.request_id),
         }
     }
 
@@ -96,6 +128,8 @@ impl IpPacketRequest {
             IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
             IpPacketRequestData::Disconnect(request) => Some(&request.reply_to),
             IpPacketRequestData::Data(_) => None,
+            IpPacketRequestData::Ping(request) => Some(&request.reply_to),
+            IpPacketRequestData::Health(request) => Some(&request.reply_to),
         }
     }
 
@@ -119,35 +153,58 @@ pub enum IpPacketRequestData {
     DynamicConnect(DynamicConnectRequest),
     Disconnect(DisconnectRequest),
     Data(DataRequest),
+    Ping(PingRequest),
+    Health(HealthRequest),
 }
 
+// A static connect request is when the client provides the internal IP address it will use on the
+// ip packet router.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct StaticConnectRequest {
     pub request_id: u64,
-    pub ip: IpAddr,
+
+    pub ips: IpPair,
+
     // The nym-address the response should be sent back to
     pub reply_to: Recipient,
+
     // The number of mix node hops that responses should take, in addition to the entry and exit
     // node. Zero means only client -> entry -> exit -> client.
     pub reply_to_hops: Option<u8>,
+
     // The average delay at each mix node, in milliseconds. Currently this is not supported by the
     // ip packet router.
     pub reply_to_avg_mix_delays: Option<f64>,
+
+    // The maximum time in milliseconds the IPR should wait when filling up a mix packet
+    // with ip packets.
+    pub buffer_timeout: Option<u64>,
 }
 
+// A dynamic connect request is when the client does not provide the internal IP address it will use
+// on the ip packet router, and instead requests one to be assigned to it.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct DynamicConnectRequest {
     pub request_id: u64,
+
     // The nym-address the response should be sent back to
     pub reply_to: Recipient,
+
     // The number of mix node hops that responses should take, in addition to the entry and exit
     // node. Zero means only client -> entry -> exit -> client.
     pub reply_to_hops: Option<u8>,
+
     // The average delay at each mix node, in milliseconds. Currently this is not supported by the
     // ip packet router.
     pub reply_to_avg_mix_delays: Option<f64>,
+
+    // The maximum time in milliseconds the IPR should wait when filling up a mix packet
+    // with ip packets.
+    pub buffer_timeout: Option<u64>,
 }
 
+// A disconnect request is when the client wants to disconnect from the ip packet router and free
+// up the allocated IP address.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct DisconnectRequest {
     pub request_id: u64,
@@ -155,14 +212,32 @@ pub struct DisconnectRequest {
     pub reply_to: Recipient,
 }
 
+// A data request is when the client wants to send an IP packet to a destination.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct DataRequest {
-    pub ip_packet: bytes::Bytes,
+    pub ip_packets: bytes::Bytes,
+}
+
+// A ping request is when the client wants to check if the ip packet router is still alive.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct PingRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HealthRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::net::{Ipv4Addr, Ipv6Addr};
+    use std::str::FromStr;
 
     #[test]
     fn check_size_of_request() {
@@ -171,14 +246,15 @@ mod tests {
             data: IpPacketRequestData::StaticConnect(
                 StaticConnectRequest {
                     request_id: 123,
-                    ip: IpAddr::from([10, 0, 0, 1]),
+                    ips: IpPair::new(Ipv4Addr::from_str("10.0.0.1").unwrap(), Ipv6Addr::from_str("2001:db8:a160::1").unwrap()),
                     reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
                     reply_to_hops: None,
                     reply_to_avg_mix_delays: None,
+                    buffer_timeout: None,
                 },
-            )
+            ),
         };
-        assert_eq!(connect.to_bytes().unwrap().len(), 107);
+        assert_eq!(connect.to_bytes().unwrap().len(), 123);
     }
 
     #[test]
@@ -186,7 +262,7 @@ mod tests {
         let data = IpPacketRequest {
             version: 4,
             data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1u8; 32]),
+                ip_packets: bytes::Bytes::from(vec![1u8; 32]),
             }),
         };
         assert_eq!(data.to_bytes().unwrap().len(), 35);
@@ -197,7 +273,7 @@ mod tests {
         let data = IpPacketRequest {
             version: 4,
             data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
             }),
         };
 
@@ -214,7 +290,7 @@ mod tests {
         assert_eq!(
             deserialized.data,
             IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
             })
         );
     }

common/ip-packet-requests/src/v6/response.rs

@@ -1,9 +1,7 @@
-use std::net::IpAddr;
-
 use nym_sphinx::addressing::clients::Recipient;
 use serde::{Deserialize, Serialize};
 
-use crate::{make_bincode_serializer, CURRENT_VERSION};
+use crate::{make_bincode_serializer, IpPair, CURRENT_VERSION};
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct IpPacketResponse {
@@ -38,13 +36,13 @@ impl IpPacketResponse {
         }
     }
 
-    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
+    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ips: IpPair) -> Self {
         Self {
             version: CURRENT_VERSION,
             data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
                 request_id,
                 reply_to,
-                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
+                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ips }),
             }),
         }
     }
@@ -64,6 +62,45 @@ impl IpPacketResponse {
         }
     }
 
+    pub fn new_disconnect_success(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Disconnect(DisconnectResponse {
+                request_id,
+                reply_to,
+                reply: DisconnectResponseReply::Success,
+            }),
+        }
+    }
+
+    pub fn new_disconnect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: DisconnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Disconnect(DisconnectResponse {
+                request_id,
+                reply_to,
+                reply: DisconnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_unrequested_disconnect(
+        reply_to: Recipient,
+        reason: UnrequestedDisconnectReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::UnrequestedDisconnect(UnrequestedDisconnect {
+                reply_to,
+                reason,
+            }),
+        }
+    }
+
     pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
         Self {
             version: CURRENT_VERSION,
@@ -79,24 +116,59 @@ impl IpPacketResponse {
     ) -> Self {
         Self {
             version: CURRENT_VERSION,
-            data: IpPacketResponseData::Error(ErrorResponse {
+            data: IpPacketResponseData::Info(InfoResponse {
                 request_id,
                 reply_to,
-                reply: ErrorResponseReply::VersionMismatch {
+                reply: InfoResponseReply::VersionMismatch {
                     request_version,
                     response_version: our_version,
                 },
+                level: InfoLevel::Error,
             }),
         }
     }
 
-    pub fn new_data_error_response(reply_to: Recipient, reply: ErrorResponseReply) -> Self {
+    pub fn new_data_info_response(
+        reply_to: Recipient,
+        reply: InfoResponseReply,
+        level: InfoLevel,
+    ) -> Self {
         Self {
             version: CURRENT_VERSION,
-            data: IpPacketResponseData::Error(ErrorResponse {
+            data: IpPacketResponseData::Info(InfoResponse {
                 request_id: 0,
                 reply_to,
                 reply,
+                level,
+            }),
+        }
+    }
+
+    pub fn new_pong(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Pong(PongResponse {
+                request_id,
+                reply_to,
+            }),
+        }
+    }
+
+    pub fn new_health_response(
+        request_id: u64,
+        reply_to: Recipient,
+        build_info: nym_bin_common::build_information::BinaryBuildInformationOwned,
+        routable: Option<bool>,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Health(HealthResponse {
+                request_id,
+                reply_to,
+                reply: HealthResponseReply {
+                    build_info,
+                    routable,
+                },
             }),
         }
     }
@@ -106,8 +178,11 @@ impl IpPacketResponse {
             IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
             IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
             IpPacketResponseData::Disconnect(response) => Some(response.request_id),
+            IpPacketResponseData::UnrequestedDisconnect(_) => None,
             IpPacketResponseData::Data(_) => None,
-            IpPacketResponseData::Error(response) => Some(response.request_id),
+            IpPacketResponseData::Pong(response) => Some(response.request_id),
+            IpPacketResponseData::Health(response) => Some(response.request_id),
+            IpPacketResponseData::Info(response) => Some(response.request_id),
         }
     }
 
@@ -116,8 +191,11 @@ impl IpPacketResponse {
             IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
             IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
             IpPacketResponseData::Disconnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::UnrequestedDisconnect(response) => Some(&response.reply_to),
             IpPacketResponseData::Data(_) => None,
-            IpPacketResponseData::Error(response) => Some(&response.reply_to),
+            IpPacketResponseData::Pong(response) => Some(&response.reply_to),
+            IpPacketResponseData::Health(response) => Some(&response.reply_to),
+            IpPacketResponseData::Info(response) => Some(&response.reply_to),
         }
     }
 
@@ -137,11 +215,29 @@ impl IpPacketResponse {
 #[allow(clippy::large_enum_variant)]
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub enum IpPacketResponseData {
+    // Response for a static connect request
     StaticConnect(StaticConnectResponse),
+
+    // Response for a dynamic connect request
     DynamicConnect(DynamicConnectResponse),
+
+    // Response for a disconnect initiqated by the client
     Disconnect(DisconnectResponse),
+
+    // Message from the server that the client got disconnected without the client initiating it
+    UnrequestedDisconnect(UnrequestedDisconnect),
+
+    // Response to a data request
     Data(DataResponse),
-    Error(ErrorResponse),
+
+    // Response to ping request
+    Pong(PongResponse),
+
+    // Response for a health request
+    Health(HealthResponse),
+
+    // Info response. This can be anything from informative messages to errors
+    Info(InfoResponse),
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -200,7 +296,7 @@ impl DynamicConnectResponseReply {
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct DynamicConnectSuccess {
-    pub ip: IpAddr,
+    pub ips: IpPair,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
@@ -234,20 +330,58 @@ pub enum DisconnectFailureReason {
     Other(String),
 }
 
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct UnrequestedDisconnect {
+    pub reply_to: Recipient,
+    pub reason: UnrequestedDisconnectReason,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum UnrequestedDisconnectReason {
+    #[error("client mixnet traffic timeout")]
+    ClientMixnetTrafficTimeout,
+    #[error("client tun traffic timeout")]
+    ClientTunTrafficTimeout,
+    #[error("{0}")]
+    Other(String),
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct DataResponse {
     pub ip_packet: bytes::Bytes,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct ErrorResponse {
+pub struct PongResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: ErrorResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct HealthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: HealthResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct HealthResponseReply {
+    // Return the binary build information of the IPR
+    pub build_info: nym_bin_common::build_information::BinaryBuildInformationOwned,
+    // Return if the IPR has performed a successful routing test.
+    pub routable: Option<bool>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct InfoResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: InfoResponseReply,
+    pub level: InfoLevel,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum ErrorResponseReply {
+pub enum InfoResponseReply {
     #[error("{msg}")]
     Generic { msg: String },
     #[error(
@@ -260,3 +394,10 @@ pub enum ErrorResponseReply {
     #[error("destination failed exit policy filter check: {dst}")]
     ExitPolicyFilterCheckFailed { dst: String },
 }
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum InfoLevel {
+    Info,
+    Warn,
+    Error,
+}

common/mixnode-common/Cargo.toml

@@ -25,9 +25,6 @@ tokio-util = { workspace = true, features = ["codec"] }
 url = { workspace = true }
 thiserror = { workspace = true }
 
-## tracing
-tracing = { version = "0.1.37", optional = true }
-
 nym-crypto = { path = "../crypto" }
 nym-network-defaults = { path = "../network-defaults" }
 nym-sphinx-acknowledgements = { path = "../nymsphinx/acknowledgements" }
@@ -39,9 +36,4 @@ nym-sphinx-types = { path = "../nymsphinx/types" }
 nym-task = { path = "../task" }
 nym-validator-client = { path = "../client-libs/validator-client" }
 nym-bin-common = { path = "../bin-common" }
-
-cfg-if = "1.0.0"
-cpu-cycles = { path = "../../cpu-cycles", optional = true }
-
-[features]
-cpucycles = ["cpu-cycles", "tracing"]
+nym-metrics = { path = "../nym-metrics" }

common/mixnode-common/src/lib.rs

@@ -2,40 +2,3 @@
 // SPDX-License-Identifier: Apache-2.0
 pub mod packet_processor;
 pub mod verloc;
-
-pub fn cpu_cycles() -> Result<i64, Box<dyn std::error::Error>> {
-    cfg_if::cfg_if! {
-        if #[cfg(feature = "cpucycles")] {
-            Ok(cpu_cycles::cpucycles()?)
-        } else {
-            Err("`cpucycles` feature is not turned on!".into())
-        }
-    }
-}
-
-#[macro_export]
-macro_rules! measure {
-    ( $x:expr ) => {{
-        cfg_if::cfg_if! {
-            if #[cfg(feature = "cpucycles")] {
-                let start_cycles = $crate::cpu_cycles();
-                // if the block needs to return something, we can return it
-                let r = $x;
-                let end_cycles = $crate::cpu_cycles();
-                let name = if let Some(meta) = tracing::Span::current().metadata() {
-                    meta.name()
-                } else {
-                    "measure"
-                };
-                match (start_cycles, end_cycles) {
-                    (Ok(start), Ok(end)) => log::trace!("{} cpucycles: {}", name, end - start),
-                    (Err(e), _) => error!("{e}"),
-                    (_, Err(e)) => error!("{e}"),
-                }
-                r
-            } else {
-                $x
-            }
-        }
-    }};
-}

common/mixnode-common/src/packet_processor/processor.rs

@@ -1,9 +1,9 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::measure;
 use crate::packet_processor::error::MixProcessingError;
 use log::*;
+use nym_metrics::nanos;
 use nym_sphinx_acknowledgements::surb_ack::SurbAck;
 use nym_sphinx_addressing::nodes::NymNodeRoutingAddress;
 use nym_sphinx_forwarding::packet::MixPacket;
@@ -15,8 +15,6 @@ use nym_sphinx_types::{
 };
 use std::convert::TryFrom;
 use std::sync::Arc;
-#[cfg(feature = "cpucycles")]
-use tracing::instrument;
 
 type ForwardAck = MixPacket;
 
@@ -51,15 +49,11 @@ impl SphinxPacketProcessor {
     }
 
     /// Performs a fresh sphinx unwrapping using no cache.
-    #[cfg_attr(
-        feature = "cpucycles",
-        instrument(skip(self, packet), fields(cpucycles))
-    )]
     fn perform_initial_packet_processing(
         &self,
         packet: NymPacket,
     ) -> Result<NymProcessedPacket, MixProcessingError> {
-        measure!({
+        nanos!("perform_initial_packet_processing", {
             packet.process(&self.sphinx_key).map_err(|err| {
                 debug!("Failed to unwrap NymPacket packet: {err}");
                 MixProcessingError::NymPacketProcessingError(err)
@@ -68,17 +62,12 @@ impl SphinxPacketProcessor {
     }
 
     /// Takes the received framed packet and tries to unwrap it from the sphinx encryption.
-    #[cfg_attr(
-        feature = "cpucycles",
-        instrument(skip(self, received), fields(cpucycles))
-    )]
     fn perform_initial_unwrapping(
         &self,
         received: FramedNymPacket,
     ) -> Result<NymProcessedPacket, MixProcessingError> {
-        measure!({
+        nanos!("perform_initial_unwrapping", {
             let packet = received.into_inner();
-
             self.perform_initial_packet_processing(packet)
         })
     }
@@ -223,16 +212,12 @@ impl SphinxPacketProcessor {
         }
     }
 
-    #[cfg_attr(
-        feature = "cpucycles",
-        instrument(skip(self, received), fields(cpucycles))
-    )]
     pub fn process_received(
         &self,
         received: FramedNymPacket,
     ) -> Result<MixProcessingResult, MixProcessingError> {
         // explicit packet size will help to correctly parse final hop
-        measure!({
+        nanos!("process_received", {
             let packet_size = received.packet_size();
             let packet_type = received.packet_type();
 

common/network-defaults/src/lib.rs

@@ -79,7 +79,13 @@ impl NymNetworkDetails {
     pub fn new_from_env() -> Self {
         fn get_optional_env<K: AsRef<OsStr>>(env: K) -> Option<String> {
             match var(env) {
-                Ok(var) => Some(var),
+                Ok(var) => {
+                    if var.is_empty() {
+                        None
+                    } else {
+                        Some(var)
+                    }
+                }
                 Err(VarError::NotPresent) => None,
                 err => panic!("Unable to set: {:?}", err),
             }
@@ -113,28 +119,15 @@ impl NymNetworkDetails {
                 Some(var(var_names::NYM_API).expect("nym api not set")),
                 get_optional_env(var_names::NYXD_WEBSOCKET),
             ))
-            .with_mixnet_contract(Some(
-                var(var_names::MIXNET_CONTRACT_ADDRESS).expect("mixnet contract not set"),
-            ))
-            .with_vesting_contract(Some(
-                var(var_names::VESTING_CONTRACT_ADDRESS).expect("vesting contract not set"),
-            ))
-            .with_coconut_bandwidth_contract(Some(
-                var(var_names::COCONUT_BANDWIDTH_CONTRACT_ADDRESS)
-                    .expect("coconut bandwidth contract not set"),
-            ))
-            .with_group_contract(Some(
-                var(var_names::GROUP_CONTRACT_ADDRESS).expect("group contract not set"),
-            ))
-            .with_multisig_contract(Some(
-                var(var_names::MULTISIG_CONTRACT_ADDRESS).expect("multisig contract not set"),
-            ))
-            .with_coconut_dkg_contract(Some(
-                var(var_names::COCONUT_DKG_CONTRACT_ADDRESS).expect("coconut dkg contract not set"),
-            ))
-            .with_ephemera_contract(Some(
-                var(var_names::EPHEMERA_CONTRACT_ADDRESS).expect("ephemera contract not set"),
+            .with_mixnet_contract(get_optional_env(var_names::MIXNET_CONTRACT_ADDRESS))
+            .with_vesting_contract(get_optional_env(var_names::VESTING_CONTRACT_ADDRESS))
+            .with_coconut_bandwidth_contract(get_optional_env(
+                var_names::COCONUT_BANDWIDTH_CONTRACT_ADDRESS,
             ))
+            .with_group_contract(get_optional_env(var_names::GROUP_CONTRACT_ADDRESS))
+            .with_multisig_contract(get_optional_env(var_names::MULTISIG_CONTRACT_ADDRESS))
+            .with_coconut_dkg_contract(get_optional_env(var_names::COCONUT_DKG_CONTRACT_ADDRESS))
+            .with_ephemera_contract(get_optional_env(var_names::EPHEMERA_CONTRACT_ADDRESS))
             .with_service_provider_directory_contract(get_optional_env(
                 var_names::SERVICE_PROVIDER_DIRECTORY_CONTRACT_ADDRESS,
             ))
@@ -185,6 +178,12 @@ impl NymNetworkDetails {
         self
     }
 
+    #[must_use]
+    pub fn with_chain_details(mut self, chain_details: ChainDetails) -> Self {
+        self.chain_details = chain_details;
+        self
+    }
+
     #[must_use]
     pub fn with_bech32_account_prefix<S: Into<String>>(mut self, prefix: S) -> Self {
         self.chain_details.bech32_account_prefix = prefix.into();
@@ -227,6 +226,12 @@ impl NymNetworkDetails {
         self
     }
 
+    #[must_use]
+    pub fn with_contracts(mut self, contracts: NymContracts) -> Self {
+        self.contracts = contracts;
+        self
+    }
+
     #[must_use]
     pub fn with_mixnet_contract<S: Into<String>>(mut self, contract: Option<S>) -> Self {
         self.contracts.mixnet_contract_address = contract.map(Into::into);

common/network-defaults/src/mainnet.rs

@@ -16,11 +16,13 @@ pub const MIXNET_CONTRACT_ADDRESS: &str =
     "n17srjznxl9dvzdkpwpw24gg668wc73val88a6m5ajg6ankwvz9wtst0cznr";
 pub const VESTING_CONTRACT_ADDRESS: &str =
     "n1nc5tatafv6eyq7llkr2gv50ff9e22mnf70qgjlv737ktmt4eswrq73f2nw";
-pub const COCONUT_BANDWIDTH_CONTRACT_ADDRESS: &str = "n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0";
-pub const GROUP_CONTRACT_ADDRESS: &str = "n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0";
-pub const MULTISIG_CONTRACT_ADDRESS: &str = "n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0";
-pub const COCONUT_DKG_CONTRACT_ADDRESS: &str = "n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0";
-pub const EPHEMERA_CONTRACT_ADDRESS: &str = "n19lc9u84cz0yz3fww5283nucc9yvr8gsjmgeul0";
+
+pub const COCONUT_BANDWIDTH_CONTRACT_ADDRESS: &str = "";
+pub const GROUP_CONTRACT_ADDRESS: &str = "";
+pub const MULTISIG_CONTRACT_ADDRESS: &str = "";
+pub const COCONUT_DKG_CONTRACT_ADDRESS: &str = "";
+pub const EPHEMERA_CONTRACT_ADDRESS: &str = "";
+
 pub const REWARDING_VALIDATOR_ADDRESS: &str = "n10yyd98e2tuwu0f7ypz9dy3hhjw7v772q6287gy";
 
 pub const STATISTICS_SERVICE_DOMAIN_ADDRESS: &str = "https://mainnet-stats.nymte.ch:8090/";

common/nym-id/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "nym-id"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+thiserror.workspace = true
+time.workspace = true
+tracing.workspace = true
+zeroize.workspace = true
+
+nym-credential-storage = { path = "../credential-storage" }
+nym-credentials = { path = "../credentials" }

common/nym-id/src/error.rs

@@ -0,0 +1,20 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::error::Error;
+use thiserror::Error;
+use time::OffsetDateTime;
+
+#[derive(Debug, Error)]
+pub enum NymIdError {
+    #[error("failed to deserialize provided credential: {source}")]
+    CredentialDeserializationFailure { source: nym_credentials::Error },
+
+    #[error("attempted to import an expired credential (it expired on {expiration})")]
+    ExpiredCredentialImport { expiration: OffsetDateTime },
+
+    #[error("failed to store credential in the provided store: {source}")]
+    StorageError {
+        source: Box<dyn Error + Send + Sync>,
+    },
+}

common/nym-id/src/import_credential.rs

@@ -0,0 +1,71 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::NymIdError;
+use nym_credential_storage::models::StorableIssuedCredential;
+use nym_credential_storage::storage::Storage;
+use nym_credentials::coconut::bandwidth::issued::BandwidthCredentialIssuedDataVariant;
+use nym_credentials::IssuedBandwidthCredential;
+use tracing::{debug, warn};
+use zeroize::Zeroizing;
+
+pub async fn import_credential<S>(
+    credentials_store: S,
+    raw_credential: Vec<u8>,
+    credential_version: impl Into<Option<u8>>,
+) -> Result<(), NymIdError>
+where
+    S: Storage,
+    <S as Storage>::StorageError: Send + Sync + 'static,
+{
+    let raw_credential = Zeroizing::new(raw_credential);
+
+    // note: the type itself implements ZeroizeOnDrop
+    let credential = IssuedBandwidthCredential::try_unpack(&raw_credential, credential_version)
+        .map_err(|source| NymIdError::CredentialDeserializationFailure { source })?;
+
+    debug!(
+        "attempting to import credential of type {}",
+        credential.typ()
+    );
+
+    match credential.variant_data() {
+        BandwidthCredentialIssuedDataVariant::Voucher(voucher_info) => {
+            debug!("with value of {}", voucher_info.value())
+        }
+        BandwidthCredentialIssuedDataVariant::FreePass(freepass_info) => {
+            debug!("with expiry at {}", freepass_info.expiry_date());
+            if freepass_info.expired() {
+                warn!("the free pass has already expired!");
+
+                // technically we can import it, but the gateway will just reject it so what's the point
+                return Err(NymIdError::ExpiredCredentialImport {
+                    expiration: freepass_info.expiry_date(),
+                });
+            }
+        }
+    }
+
+    // SAFETY:
+    // for the epoch to run over u32::MAX, we'd have to advance it for few centuries every block...
+    // the alternative is a very particularly malformed serialized data, but at that point blowing up is the right call
+    // because we can't rely on it anyway
+    #[allow(clippy::expect_used)]
+    let storable = StorableIssuedCredential {
+        serialization_revision: credential.current_serialization_revision(),
+        credential_data: &raw_credential,
+        credential_type: credential.typ().to_string(),
+        epoch_id: credential
+            .epoch_id()
+            .try_into()
+            .expect("our epoch is has run over u32::MAX!"),
+    };
+
+    credentials_store
+        .insert_issued_credential(storable)
+        .await
+        .map_err(|source| NymIdError::StorageError {
+            source: Box::new(source),
+        })?;
+    Ok(())
+}

common/nym-id/src/lib.rs

@@ -0,0 +1,11 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+
+pub mod error;
+pub mod import_credential;
+
+pub use error::NymIdError;
+pub use import_credential::import_credential;

common/nym-metrics/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "nym-metrics"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+prometheus = { workspace = true }
+log = { workspace = true }
+dashmap = { workspace = true }
+lazy_static = "1.4"

common/nym-metrics/src/lib.rs

@@ -0,0 +1,278 @@
+use dashmap::DashMap;
+pub use log::error;
+use log::{debug, warn};
+use std::fmt;
+pub use std::time::Instant;
+
+use prometheus::{core::Collector, Counter, Encoder as _, Gauge, Registry, TextEncoder};
+
+#[macro_export]
+macro_rules! prepend_package_name {
+    ($name: literal) => {
+        &format!(
+            "{}_{}",
+            std::module_path!()
+                .split("::")
+                .next()
+                .unwrap_or("x")
+                .to_string(),
+            $name
+        )
+    };
+}
+
+#[macro_export]
+macro_rules! inc_by {
+    ($name:literal, $x:expr) => {
+        $crate::REGISTRY.inc_by($crate::prepend_package_name!($name), $x as f64);
+    };
+}
+
+#[macro_export]
+macro_rules! inc {
+    ($name:literal) => {
+        $crate::REGISTRY.inc($crate::prepend_package_name!($name));
+    };
+}
+
+#[macro_export]
+macro_rules! metrics {
+    () => {
+        $crate::REGISTRY.to_string();
+    };
+}
+
+#[macro_export]
+macro_rules! nanos {
+    ( $name:literal, $x:expr ) => {{
+        let start = $crate::Instant::now();
+        // if the block needs to return something, we can return it
+        let r = $x;
+        let duration = start.elapsed().as_nanos() as f64;
+        let name = $crate::prepend_package_name!($name);
+        $crate::REGISTRY.inc_by(&format!("{}_nanos", $name), duration);
+        r
+    }};
+}
+
+lazy_static::lazy_static! {
+    pub static ref REGISTRY: MetricsController = MetricsController::default();
+}
+
+#[derive(Default)]
+pub struct MetricsController {
+    registry: Registry,
+    registry_index: DashMap<String, Metric>,
+}
+
+enum Metric {
+    C(Box<Counter>),
+    G(Box<Gauge>),
+}
+
+fn fq_name(c: &dyn Collector) -> String {
+    c.desc()
+        .first()
+        .map(|d| d.fq_name.clone())
+        .unwrap_or_default()
+}
+
+impl Metric {
+    #[inline(always)]
+    fn fq_name(&self) -> String {
+        match self {
+            Metric::C(c) => fq_name(c.as_ref()),
+            Metric::G(g) => fq_name(g.as_ref()),
+        }
+    }
+
+    #[inline(always)]
+    fn inc(&self) {
+        match self {
+            Metric::C(c) => c.inc(),
+            Metric::G(g) => g.inc(),
+        }
+    }
+
+    #[inline(always)]
+    fn inc_by(&self, value: f64) {
+        match self {
+            Metric::C(c) => c.inc_by(value),
+            Metric::G(g) => g.add(value),
+        }
+    }
+
+    #[inline(always)]
+    fn set(&self, value: f64) {
+        match self {
+            Metric::C(_c) => {
+                warn!("Cannot set value for counter {:?}", self.fq_name());
+            }
+            Metric::G(g) => g.set(value),
+        }
+    }
+}
+
+impl fmt::Display for MetricsController {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let metrics = self.gather();
+        let output = match String::from_utf8(metrics) {
+            Ok(output) => output,
+            Err(e) => return write!(f, "Error decoding metrics to String: {}", e),
+        };
+        write!(f, "{}", output)
+    }
+}
+
+impl MetricsController {
+    #[inline(always)]
+    pub fn gather(&self) -> Vec<u8> {
+        let mut buffer = vec![];
+        let encoder = TextEncoder::new();
+        let metrics = self.registry.gather();
+        match encoder.encode(&metrics, &mut buffer) {
+            Ok(_) => {}
+            Err(e) => error!("Error encoding metrics to buffer: {}", e),
+        }
+        buffer
+    }
+
+    pub fn to_writer(&self, writer: &mut dyn std::io::Write) {
+        let metrics = self.gather();
+        match writer.write_all(&metrics) {
+            Ok(_) => {}
+            Err(e) => error!("Error writing metrics to writer: {}", e),
+        }
+    }
+
+    pub fn set(&self, name: &str, value: f64) {
+        if let Some(metric) = self.registry_index.get(name) {
+            metric.set(value);
+        } else {
+            let gauge = match Gauge::new(sanitize_metric_name(name), name) {
+                Ok(g) => g,
+                Err(e) => {
+                    debug!("Failed to create gauge {:?}:\n{}", name, e);
+                    return;
+                }
+            };
+            self.register_gauge(Box::new(gauge));
+            self.set(name, value)
+        }
+    }
+
+    pub fn inc(&self, name: &str) {
+        if let Some(metric) = self.registry_index.get(name) {
+            metric.inc();
+        } else {
+            let counter = match Counter::new(sanitize_metric_name(name), name) {
+                Ok(c) => c,
+                Err(e) => {
+                    debug!("Failed to create counter {:?}:\n{}", name, e);
+                    return;
+                }
+            };
+            self.register_counter(Box::new(counter));
+            self.inc(name)
+        }
+    }
+
+    pub fn inc_by(&self, name: &str, value: f64) {
+        if let Some(metric) = self.registry_index.get(name) {
+            metric.inc_by(value);
+        } else {
+            let counter = match Counter::new(sanitize_metric_name(name), name) {
+                Ok(c) => c,
+                Err(e) => {
+                    debug!("Failed to create counter {:?}:\n{}", name, e);
+                    return;
+                }
+            };
+            self.register_counter(Box::new(counter));
+            self.inc_by(name, value)
+        }
+    }
+
+    fn register_gauge(&self, metric: Box<Gauge>) {
+        let fq_name = metric
+            .desc()
+            .first()
+            .map(|d| d.fq_name.clone())
+            .unwrap_or_default();
+
+        if self.registry_index.contains_key(&fq_name) {
+            return;
+        }
+
+        match self.registry.register(metric.clone()) {
+            Ok(_) => {
+                self.registry_index
+                    .insert(fq_name, Metric::G(metric.clone()));
+            }
+            Err(e) => {
+                debug!("Failed to register {:?}:\n{}", fq_name, e)
+            }
+        }
+    }
+
+    fn register_counter(&self, metric: Box<Counter>) {
+        let fq_name = metric
+            .desc()
+            .first()
+            .map(|d| d.fq_name.clone())
+            .unwrap_or_default();
+
+        if self.registry_index.contains_key(&fq_name) {
+            return;
+        }
+        match self.registry.register(metric.clone()) {
+            Ok(_) => {
+                self.registry_index
+                    .insert(fq_name, Metric::C(metric.clone()));
+            }
+            Err(e) => {
+                debug!("Failed to register {:?}:\n{}", fq_name, e)
+            }
+        }
+    }
+}
+
+fn sanitize_metric_name(name: &str) -> String {
+    // The first character must be [a-zA-Z_:], and all subsequent characters must be [a-zA-Z0-9_:].
+    let mut out = String::with_capacity(name.len());
+    let mut is_invalid: fn(char) -> bool = invalid_metric_name_start_character;
+    for c in name.chars() {
+        if is_invalid(c) {
+            out.push('_');
+        } else {
+            out.push(c);
+        }
+        is_invalid = invalid_metric_name_character;
+    }
+    out
+}
+
+#[inline]
+fn invalid_metric_name_start_character(c: char) -> bool {
+    // Essentially, needs to match the regex pattern of [a-zA-Z_:].
+    !(c.is_ascii_alphabetic() || c == '_' || c == ':')
+}
+
+#[inline]
+fn invalid_metric_name_character(c: char) -> bool {
+    // Essentially, needs to match the regex pattern of [a-zA-Z0-9_:].
+    !(c.is_ascii_alphanumeric() || c == '_' || c == ':')
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_sanitization() {
+        assert_eq!(
+            sanitize_metric_name("packets_sent_34.242.65.133:1789"),
+            "packets_sent_34_242_65_133:1789"
+        )
+    }
+}

common/nymcoconut/Cargo.toml

@@ -15,7 +15,7 @@ rand = "0.8"
 thiserror = { workspace = true }
 serde = { workspace = true }
 serde_derive = "1.0"
-bs58 = "0.4.0"
+bs58 = { workspace = true }
 sha2 = "0.9"
 zeroize = { workspace = true, optional = true }
 

common/nymcoconut/src/lib.rs

@@ -24,6 +24,7 @@ pub use scheme::setup::Parameters;
 pub use scheme::verification::check_vk_pairing;
 pub use scheme::verification::prove_bandwidth_credential;
 pub use scheme::verification::verify_credential;
+pub use scheme::verification::BlindedSerialNumber;
 pub use scheme::verification::VerifyCredentialRequest;
 pub use scheme::BlindedSignature;
 pub use scheme::Signature;