Remove empty ephemeral keys

Uncouple storage reference for bandwidth client
build(deps): bump the patch-updates group across 1 directory with 35 updates (#5310 )
2025-01-21 14:32:26 +01:00 · 2025-01-21 14:19:59 +01:00 · 2025-01-08 10:56:39 +01:00 · 2025-01-08 10:56:26 +01:00 · 2025-01-08 10:34:12 +01:00 · 2025-01-06 12:46:16 +00:00
1122 changed files with 34909 additions and 20597 deletions
@@ -4,4 +4,3 @@
 **/node_modules
 **/target
 dist
-documentation
@@ -0,0 +1 @@
+nym-validator-rewarder/.sqlx/** diff=nodiff
@@ -31,3 +31,5 @@ updates:
        update-types:
          - "patch"
    open-pull-requests-limit: 10
+    assignees:
+      - "octol"
@@ -9,15 +9,16 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'mixnode/**'
-      - 'sdk/rust/**'
-      - 'sdk/lib/**'
-      - 'service-providers/**'
-      - 'nym-network-monitor/**'
      - 'nym-api/**'
-      - 'nym-node/**'
-      - 'nym-outfox/**'
      - 'nym-data-observatory/**'
+      - 'nym-network-monitor/**'
+      - 'nym-node/**'
+      - 'nym-node-status-api/**'
+      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
+      - 'sdk/lib/**'
+      - 'sdk/rust/**'
+      - 'service-providers/**'
      - 'tools/**'
      - 'wasm/**'
      - 'Cargo.toml'
@@ -30,10 +31,11 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ arc-ubuntu-20.04, custom-runner-mac-m1 ]
+        os: [ arc-ubuntu-20.04, custom-windows-11, custom-runner-mac-m1 ]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
+      IPINFO_API_TOKEN: ${{ secrets.IPINFO_API_TOKEN }}
    steps:
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
@@ -11,7 +11,7 @@ on:
 jobs:
  check-schema:
    name: Generate and check schema
-    runs-on: arc-ubuntu-20.04
+    runs-on: ubuntu-20.04
    env:
      CARGO_TERM_COLOR: always
    steps:
@@ -13,7 +13,7 @@ on:

 jobs:
  matrix_prep:
-    runs-on: arc-ubuntu-20.04
+    runs-on: ubuntu-20.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
@@ -15,6 +15,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
+      IPINFO_API_TOKEN: ${{ secrets.IPINFO_API_TOKEN }}
    continue-on-error: true
    steps:
      - name: Check out repository code
@@ -55,6 +55,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
+          override: true

      - name: Build all binaries
        uses: actions-rs/cargo@v1
@@ -14,13 +14,14 @@ jobs:
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: stable
+          toolchain: 1.77
          target: wasm32-unknown-unknown
          override: true
-          components: rustfmt, clippy

      - name: Install wasm-opt
-        run: cargo install --version 0.114.0 wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '114'

      - name: Build release contracts
        run: make contracts
@@ -56,14 +56,6 @@ jobs:
          rustup target add aarch64-linux-android \
            x86_64-linux-android

-      - name: Build lib nym-socks5-listener
-        working-directory: sdk/lib/socks5-listener/
-        env:
-          RELEASE: true
-          RUSTFLAGS: "-C link-args=-Wl,--hash-style=gnu"
-        # build for arm64 and x86_64
-        run: ./build-android.sh aarch64 x86_64
-
      - name: Build APKs (unsigned)
        working-directory: nym-connect/native/android
        env:
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -25,31 +25,27 @@ jobs:
          git config --global user.email "lawrence@nymtech.net"
          git config --global user.name "Lawrence Stalder"

-      - name: Get version from package.json
-        uses: sergeysova/jq-action@v2
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
-          cmd: jq -r '.version' ${{ env.WORKING_DIRECTORY }}/package.json
-
-      - name: Check if tag exists
-        run: |
-          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
-            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
-          fi
-
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
+          
      - name: Remove existing tag if exists
        run: |
-          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
-            git push --delete origin ${{ steps.get_version.outputs.value }}
-            git tag -d ${{ steps.get_version.outputs.value }}
+          echo "Checking if tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} exists..."
+          if git rev-parse ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} already exists"
+            git push --delete origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
          fi

      - name: Create tag
        run: |
-          git tag -a ${{ steps.get_version.outputs.value }} -m "Version ${{ steps.get_version.outputs.value }}"
-          git push origin ${{ steps.get_version.outputs.value }}
-
+          git tag -a ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.CONTAINER_NAME }}-${{ steps.get_version.outputs.result }}
+          
      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.value }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
-          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
+          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -8,7 +8,7 @@ on:
        description: Which gateway probe git ref to build the image with

 env:
-  WORKING_DIRECTORY: "nym-node-status-agent"
+  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-agent"
  CONTAINER_NAME: "node-status-agent"

 jobs:
@@ -31,7 +31,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -3,7 +3,7 @@ on:
  workflow_dispatch:

 env:
-  WORKING_DIRECTORY: "nym-node-status-api"
+  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-api"
  CONTAINER_NAME: "node-status-api"

 jobs:
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -0,0 +1,55 @@
+name: Build and upload Nyx Chain Watcher container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nyx-chain-watcher"
+  CONTAINER_NAME: "nyx-chain-watcher"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.6
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -26,10 +26,10 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.44.3
+        uses: mikefarah/yq@v4.44.6
        id: get_version
        with:
-          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

      - name: Remove existing tag if exists
        run: |
@@ -51,4 +51,11 @@ ppa-private-key.b64
 ppa-private-key.asc
 nym-network-monitor/topology.json
 nym-network-monitor/__pycache__
-nym-network-monitor/*.key
+nym-network-monitor/*.key
+nym-network-monitor/.envrc
+nym-network-monitor/.envrc
+nym-api/redocly/formatted-openapi.json
+
+
+*.sqlite
+.build
@@ -4,6 +4,355 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2024.14-crunch-patched] (2024-12-17)
+
+- Fixes an issue to allow previously registred clients to connect to latest nym-nodes
+- Fixes compatibility issues between nym-nodes and older clients
+
+## [2024.14-crunch] (2024-12-11)
+
+- Merge/release/2024.14-crunch ([#5242])
+- bugfix: added explicit openapi servers to account for route prefixes ([#5237])
+- Further config score adjustments ([#5225])
+- feature: remve any filtering on node semver ([#5224])
+- Backport #5218 ([#5220])
+- Derive serialize for UserAgent (#5210) ([#5217])
+- dont consider legacy nodes for rewarded set selection ([#5215])
+- introduce UNSTABLE endpoints for returning network monitor run details ([#5214])
+- Nmv2 add debug config ([#5212])
+- nym-api NMv1 adjustments ([#5209])
+- adjusted config score penalty calculation ([#5206])
+- Fix backwards compat mac generation ([#5202])
+- merge crunch into develop ([#5199])
+- Update Security disclosure email, public key and policy ([#5195])
+- Guard storage access with cache ([#5193])
+- chore: apply 1.84 linter suggestions ([#5192])
+- improvement: make internal gateway clients use the same topology cache ([#5191])
+- Bugfix/credential proxy sequencing ([#5187])
+- Add monitor_run and testing_route indexes ([#5182])
+- Add indexes to monitor run and testing route ([#5181])
+- bugfix: fixed nym-node config migrations (again) ([#5179])
+- bugfix: use default value for verloc config when deserialising missing values ([#5177])
+- Remove peers with no allowed ip from storage ([#5175])
+- Move two minor jobs to free tier github hosted runners ([#5169])
+- Add support for DELETE to nym-http-api-client ([#5166])
+- Fix env var name ([#5165])
+- Add strum::EnumIter for TicketType ([#5164])
+- Add export_to_env to NymNetworkDetails ([#5162])
+- bugfix: correctly expose ecash-related data on nym-api ([#5155])
+- fix: validator-rewarder GH job ([#5151])
+- build(deps): bump cross-spawn from 7.0.3 to 7.0.6 in /testnet-faucet ([#5150])
+- build(deps): bump mikefarah/yq from 4.44.3 to 4.44.5 ([#5149])
+- start session collection for exit gateways ([#5148])
+- add version to clientStatsReport ([#5147])
+- update serde_json_path due to compilation issue ([#5144])
+- chore: remove standalone legacy mixnode/gateway binaries ([#5135])
+- [Product Data] Set up country reporting from vpn-client ([#5134])
+- removed ci-nym-api-tests.yml which was running outdated (and broken) tests ([#5133])
+- CI: reduce jobs running on cluster ([#5132])
+- [DOCS/operators]: Release changes v2024.13-magura & Tokenomics pages v1.0 ([#5128])
+- NS Agent auth with NS API ([#5127])
+- [Product Data] Config deserialization bug fix ([#5126])
+- bugfix: don't send empty BankMsg in ecash contract ([#5121])
+- [Product data] Data consumption with ecash ticket ([#5120])
+- feat: add GH workflow for nym-validator-rewarder ([#5119])
+- feat: add Dockerfile and add env vars for clap arguments ([#5118])
+- feature: config score ([#5117])
+- [Product Data] Add stats reporting configuration in client config  ([#5115])
+- Correct IPv6 address generation ([#5113])
+- feature: rewarding for ticketbook issuance ([#5112])
+- Add granular log on nym-node ([#5111])
+- Send mixnet packet stats using task client ([#5109])
+- Expose time range ([#5108])
+- [Product Data] Client-side stats collection  ([#5107])
+- chore: ecash contract migration to remove unused 'redemption_gateway_share' ([#5104])
+- [Product Data] Better unique user count on gateways ([#5084])
+- feat: add nym node GH workflow ([#5080])
+- IPv6 support for wireguard ([#5059])
+- Node Status API ([#5050])
+- Authenticator CLI client mode ([#5044])
+- Integrate nym-credential-proxy into workspace ([#5027])
+- [Product Data] Introduce data persistence on gateways ([#5022])
+- Bump the patch-updates group across 1 directory with 10 updates ([#5011])
+- build(deps): bump once_cell from 1.19.0 to 1.20.2 ([#4952])
+- Create TaskStatusEvent trait instead of piggybacking on Error ([#4919])
+- build(deps): bump lazy_static from 1.4.0 to 1.5.0 ([#4913])
+- Sync code with .env in build.rs ([#4876])
+- build(deps): bump axios from 1.6.0 to 1.7.5 in /nym-api/tests ([#4790])
+- Bump elliptic from 6.5.4 to 6.5.7 in /testnet-faucet ([#4768])
+
+[#5242]: https://github.com/nymtech/nym/pull/5242
+[#5237]: https://github.com/nymtech/nym/pull/5237
+[#5225]: https://github.com/nymtech/nym/pull/5225
+[#5224]: https://github.com/nymtech/nym/pull/5224
+[#5220]: https://github.com/nymtech/nym/pull/5220
+[#5217]: https://github.com/nymtech/nym/pull/5217
+[#5215]: https://github.com/nymtech/nym/pull/5215
+[#5214]: https://github.com/nymtech/nym/pull/5214
+[#5212]: https://github.com/nymtech/nym/pull/5212
+[#5209]: https://github.com/nymtech/nym/pull/5209
+[#5206]: https://github.com/nymtech/nym/pull/5206
+[#5202]: https://github.com/nymtech/nym/pull/5202
+[#5199]: https://github.com/nymtech/nym/pull/5199
+[#5195]: https://github.com/nymtech/nym/pull/5195
+[#5193]: https://github.com/nymtech/nym/pull/5193
+[#5192]: https://github.com/nymtech/nym/pull/5192
+[#5191]: https://github.com/nymtech/nym/pull/5191
+[#5187]: https://github.com/nymtech/nym/pull/5187
+[#5182]: https://github.com/nymtech/nym/pull/5182
+[#5181]: https://github.com/nymtech/nym/pull/5181
+[#5179]: https://github.com/nymtech/nym/pull/5179
+[#5177]: https://github.com/nymtech/nym/pull/5177
+[#5175]: https://github.com/nymtech/nym/pull/5175
+[#5169]: https://github.com/nymtech/nym/pull/5169
+[#5166]: https://github.com/nymtech/nym/pull/5166
+[#5165]: https://github.com/nymtech/nym/pull/5165
+[#5164]: https://github.com/nymtech/nym/pull/5164
+[#5162]: https://github.com/nymtech/nym/pull/5162
+[#5155]: https://github.com/nymtech/nym/pull/5155
+[#5151]: https://github.com/nymtech/nym/pull/5151
+[#5150]: https://github.com/nymtech/nym/pull/5150
+[#5149]: https://github.com/nymtech/nym/pull/5149
+[#5148]: https://github.com/nymtech/nym/pull/5148
+[#5147]: https://github.com/nymtech/nym/pull/5147
+[#5144]: https://github.com/nymtech/nym/pull/5144
+[#5135]: https://github.com/nymtech/nym/pull/5135
+[#5134]: https://github.com/nymtech/nym/pull/5134
+[#5133]: https://github.com/nymtech/nym/pull/5133
+[#5132]: https://github.com/nymtech/nym/pull/5132
+[#5128]: https://github.com/nymtech/nym/pull/5128
+[#5127]: https://github.com/nymtech/nym/pull/5127
+[#5126]: https://github.com/nymtech/nym/pull/5126
+[#5121]: https://github.com/nymtech/nym/pull/5121
+[#5120]: https://github.com/nymtech/nym/pull/5120
+[#5119]: https://github.com/nymtech/nym/pull/5119
+[#5118]: https://github.com/nymtech/nym/pull/5118
+[#5117]: https://github.com/nymtech/nym/pull/5117
+[#5115]: https://github.com/nymtech/nym/pull/5115
+[#5113]: https://github.com/nymtech/nym/pull/5113
+[#5112]: https://github.com/nymtech/nym/pull/5112
+[#5111]: https://github.com/nymtech/nym/pull/5111
+[#5109]: https://github.com/nymtech/nym/pull/5109
+[#5108]: https://github.com/nymtech/nym/pull/5108
+[#5107]: https://github.com/nymtech/nym/pull/5107
+[#5104]: https://github.com/nymtech/nym/pull/5104
+[#5084]: https://github.com/nymtech/nym/pull/5084
+[#5080]: https://github.com/nymtech/nym/pull/5080
+[#5059]: https://github.com/nymtech/nym/pull/5059
+[#5050]: https://github.com/nymtech/nym/pull/5050
+[#5044]: https://github.com/nymtech/nym/pull/5044
+[#5027]: https://github.com/nymtech/nym/pull/5027
+[#5022]: https://github.com/nymtech/nym/pull/5022
+[#5011]: https://github.com/nymtech/nym/pull/5011
+[#4952]: https://github.com/nymtech/nym/pull/4952
+[#4919]: https://github.com/nymtech/nym/pull/4919
+[#4913]: https://github.com/nymtech/nym/pull/4913
+[#4876]: https://github.com/nymtech/nym/pull/4876
+[#4790]: https://github.com/nymtech/nym/pull/4790
+[#4768]: https://github.com/nymtech/nym/pull/4768
+
+## [2024.13-magura-drift] (2024-11-29)
+
+- Optimised syncing bandwidth information to storage
+
+## [2024.13-magura-patched] (2024-11-22)
+
+- [experimental] allow clients to change between deterministic route selection based on packet headers and a pseudorandom distribution
+- Introduced a configurable limit on retransmission frequency of packets if ACKs are not received
+- Filtered out invalid IP addresses on nym-api
+
+## [2024.13-magura] (2024-11-18)
+
+- Limit race probability ([#5145])
+- bugifx: assign 'node_id' when converting from 'GatewayDetails' to 'TestNode' ([#5143])
+- bugfix: make sure to assign correct node_id and identity during 'gateway_details' table migration ([#5142])
+- Respond to auth messages with same version ([#5140])
+- Pain/polyfill deprecated endpoints ([#5131])
+- change: dont select mixnodes bonded with vested tokens into the rewarded set ([#5129])
+- nym-credential-proxy-requests: reqwest use rustls-tls ([#5116])
+- bugfix: preserve as much as possible of the rewarded set during migration ([#5103])
+- Feature/force refresh node ([#5101])
+- Add NYM_VPN_API to env files ([#5099])
+- bugfix: fixed historical uptimes for nodes ([#5097])
+- Remove old use of 1GB constant ([#5096])
+- Graceful agent 1.1.5 ([#5093])
+- Add more translations from v2 to v3 authenticator ([#5091])
+- Nym node - Fix claim delegator rewards ([#5090])
+- Make 250 GB/30 days for free ride mode ([#5083])
+- Don't increase bandwidth two times ([#5081])
+- Fix expiration date as today + 7 days ([#5076])
+- Fix gateway decreasing bandwidth ([#5075])
+- Allow custom http port to be reset ([#5073])
+- bugfix: additional checks inside credential proxy ([#5072])
+- chore: deprecated old nym-api client methods and replaced them when possible ([#5069])
+- NS API with directory v2 (#5058) ([#5068])
+- bugfix: credential-proxy obtain-async ([#5067])
+- Allow nym node config updates ([#5066])
+- bugfix: use corrext axum extractors for ecash route arguments ([#5065])
+- Merge2/release/2024.13 magura ([#5063])
+- bugfix/feature: added NymApiClient method to get all skimmed nodes ([#5062])
+- Merge1/release/2024.13 magura ([#5061])
+- added hacky routes to return nymnodes alongside legacy nodes ([#5051])
+- bugfix: mark migrated gateways as rewarded in the previous epoch in case theyre in the rewarded set ([#5049])
+- bugfix: adjust runtime storage migration ([#5047])
+- bugfix: supersede 'cb13be27f8f61d9ae74d924e85d2e6787895eb14' by using… ([#5046])
+- bugfix: restore default http port for nym-api ([#5045])
+- bugfix: fix ecash handlers routes ([#5043])
+- bugfix: don't assign exit gateways to standby set ([#5041])
+- bugfix: make sure nym-nodes are also tested by network monitor ([#5040])
+- bugfix: use bonded nym-nodes for determining initial network monitor … ([#5039])
+- bugfix: make gateways insert themselves into [local] topology ([#5038])
+- Pass poisson flag  ([#5037])
+- bugfix: use human readable roles for annotations ([#5036])
+- bugfix: use old name for 'epoch_role' in SkimmedNode ([#5034])
+- bugfix: make sure to use correct highest node id when assigning role ([#5032])
+- feature: use axum_client_ip for attempting to extract source ip ([#5031])
+- bugfix: fixed backwards incompatibility for /gateways/described endpoint ([#5030])
+- bugfix: verifying signed information of legacy nodes ([#5029])
+- bugfix: introduce 'LegacyPendingMixNodeChanges' that does not contain 'cost_params_change' ([#5028])
+- bugfix: missing #[serde(default)] for announce port ([#5024])
+- bugfix: directory v2.1 `get_all_avg_gateway_reliability_in_interval` query ([#5023])
+- added 'get_all_described_nodes' to NymApiClient and adjusted return t… ([#5016])
+- Reapply fixes to new branch ([#5014])
+- Consume only positive bandwidth ([#5013])
+- feature: adjusted ticket sizes to the agreed amounts ([#5009])
+- Push private ip before inserting ([#5008])
+- chore: update itertools in compact ecash ([#4994])
+- feature: make accepting t&c a hard requirement for rewarded set selection ([#4993])
+- Fix rustfmt in nym-credential-proxy ([#4992])
+- bugfix: client memory leak ([#4991])
+- Eliminate 0 bandwidth race check ([#4988])
+- [DOCs;/operators]: Release notes for v2024.12 aero ([#4984])
+- Add topup req constructor ([#4983])
+- Fix critical issues SI86 and SI87 from Cure53 ([#4982])
+- Rename nym-vpn-api to nym-credential-proxy ([#4981])
+- enable global ecash routes even if api is not a signer ([#4980])
+- resolve beta clippy issues in contracts ([#4978])
+- Re-enable vested delegation migration ([#4977])
+- feature: require reporting using nym-node binary for rewarded set selection ([#4976])
+- Top up bandwidth ([#4975])
+- [Product Data] Add session type based on ecash ticket received ([#4974])
+- Bugfix/additional directory fixes ([#4973])
+- feat: add Dockerfile for nym node ([#4972])
+- chore: remove unused rocket code ([#4968])
+- Import nym-vpn-api crates ([#4967])
+- feature: importer-cli to correctly handle mixnet/vesting import ([#4966])
+- bugfix: fix expected return type on /v1/gateways endpoint ([#4965])
+- [Product Data] First step in gateway usage data collection ([#4963])
+- Bump sqlx to 0.7.4 ([#4959])
+- Add env feature to clap and make clap parameters available as env variables ([#4957])
+- Feature/contract state tools ([#4954])
+- expose authenticator address along other address in node-details ([#4953])
+- Extract packet processing from mixnode-common ([#4949])
+- nym-api container ([#4948])
+- Ticket type storage ([#4947])
+- Add "utoipa" feature to nym-node ([#4945])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4944])
+- V2 performance monitoring feature flag ([#4943])
+- Bugfix/rewarder post pruning adjustments ([#4942])
+- Switch over the last set of jobs to arc runners ([#4938])
+- Fix broken build after merge ([#4937])
+- bugfix: correctly paginate through 'search_tx' endpoint ([#4936])
+- Add more conversions for responses of authenticator messages ([#4929])
+- Directory Sevices v2.1 ([#4903])
+- Migrate Legacy Node (Frontend)  ([#4826])
+- Fix critical issues SI84 and SI85 from Cure53 ([#4758])
+
+[#5145]: https://github.com/nymtech/nym/pull/5145
+[#5143]: https://github.com/nymtech/nym/pull/5143
+[#5142]: https://github.com/nymtech/nym/pull/5142
+[#5140]: https://github.com/nymtech/nym/pull/5140
+[#5131]: https://github.com/nymtech/nym/pull/5131
+[#5129]: https://github.com/nymtech/nym/pull/5129
+[#5116]: https://github.com/nymtech/nym/pull/5116
+[#5103]: https://github.com/nymtech/nym/pull/5103
+[#5101]: https://github.com/nymtech/nym/pull/5101
+[#5099]: https://github.com/nymtech/nym/pull/5099
+[#5097]: https://github.com/nymtech/nym/pull/5097
+[#5096]: https://github.com/nymtech/nym/pull/5096
+[#5093]: https://github.com/nymtech/nym/pull/5093
+[#5091]: https://github.com/nymtech/nym/pull/5091
+[#5090]: https://github.com/nymtech/nym/pull/5090
+[#5083]: https://github.com/nymtech/nym/pull/5083
+[#5081]: https://github.com/nymtech/nym/pull/5081
+[#5076]: https://github.com/nymtech/nym/pull/5076
+[#5075]: https://github.com/nymtech/nym/pull/5075
+[#5073]: https://github.com/nymtech/nym/pull/5073
+[#5072]: https://github.com/nymtech/nym/pull/5072
+[#5069]: https://github.com/nymtech/nym/pull/5069
+[#5068]: https://github.com/nymtech/nym/pull/5068
+[#5067]: https://github.com/nymtech/nym/pull/5067
+[#5066]: https://github.com/nymtech/nym/pull/5066
+[#5065]: https://github.com/nymtech/nym/pull/5065
+[#5063]: https://github.com/nymtech/nym/pull/5063
+[#5062]: https://github.com/nymtech/nym/pull/5062
+[#5061]: https://github.com/nymtech/nym/pull/5061
+[#5051]: https://github.com/nymtech/nym/pull/5051
+[#5049]: https://github.com/nymtech/nym/pull/5049
+[#5047]: https://github.com/nymtech/nym/pull/5047
+[#5046]: https://github.com/nymtech/nym/pull/5046
+[#5045]: https://github.com/nymtech/nym/pull/5045
+[#5043]: https://github.com/nymtech/nym/pull/5043
+[#5041]: https://github.com/nymtech/nym/pull/5041
+[#5040]: https://github.com/nymtech/nym/pull/5040
+[#5039]: https://github.com/nymtech/nym/pull/5039
+[#5038]: https://github.com/nymtech/nym/pull/5038
+[#5037]: https://github.com/nymtech/nym/pull/5037
+[#5036]: https://github.com/nymtech/nym/pull/5036
+[#5034]: https://github.com/nymtech/nym/pull/5034
+[#5032]: https://github.com/nymtech/nym/pull/5032
+[#5031]: https://github.com/nymtech/nym/pull/5031
+[#5030]: https://github.com/nymtech/nym/pull/5030
+[#5029]: https://github.com/nymtech/nym/pull/5029
+[#5028]: https://github.com/nymtech/nym/pull/5028
+[#5024]: https://github.com/nymtech/nym/pull/5024
+[#5023]: https://github.com/nymtech/nym/pull/5023
+[#5016]: https://github.com/nymtech/nym/pull/5016
+[#5014]: https://github.com/nymtech/nym/pull/5014
+[#5013]: https://github.com/nymtech/nym/pull/5013
+[#5009]: https://github.com/nymtech/nym/pull/5009
+[#5008]: https://github.com/nymtech/nym/pull/5008
+[#4994]: https://github.com/nymtech/nym/pull/4994
+[#4993]: https://github.com/nymtech/nym/pull/4993
+[#4992]: https://github.com/nymtech/nym/pull/4992
+[#4991]: https://github.com/nymtech/nym/pull/4991
+[#4988]: https://github.com/nymtech/nym/pull/4988
+[#4984]: https://github.com/nymtech/nym/pull/4984
+[#4983]: https://github.com/nymtech/nym/pull/4983
+[#4982]: https://github.com/nymtech/nym/pull/4982
+[#4981]: https://github.com/nymtech/nym/pull/4981
+[#4980]: https://github.com/nymtech/nym/pull/4980
+[#4978]: https://github.com/nymtech/nym/pull/4978
+[#4977]: https://github.com/nymtech/nym/pull/4977
+[#4976]: https://github.com/nymtech/nym/pull/4976
+[#4975]: https://github.com/nymtech/nym/pull/4975
+[#4974]: https://github.com/nymtech/nym/pull/4974
+[#4973]: https://github.com/nymtech/nym/pull/4973
+[#4972]: https://github.com/nymtech/nym/pull/4972
+[#4968]: https://github.com/nymtech/nym/pull/4968
+[#4967]: https://github.com/nymtech/nym/pull/4967
+[#4966]: https://github.com/nymtech/nym/pull/4966
+[#4965]: https://github.com/nymtech/nym/pull/4965
+[#4963]: https://github.com/nymtech/nym/pull/4963
+[#4959]: https://github.com/nymtech/nym/pull/4959
+[#4957]: https://github.com/nymtech/nym/pull/4957
+[#4954]: https://github.com/nymtech/nym/pull/4954
+[#4953]: https://github.com/nymtech/nym/pull/4953
+[#4949]: https://github.com/nymtech/nym/pull/4949
+[#4948]: https://github.com/nymtech/nym/pull/4948
+[#4947]: https://github.com/nymtech/nym/pull/4947
+[#4945]: https://github.com/nymtech/nym/pull/4945
+[#4944]: https://github.com/nymtech/nym/pull/4944
+[#4943]: https://github.com/nymtech/nym/pull/4943
+[#4942]: https://github.com/nymtech/nym/pull/4942
+[#4938]: https://github.com/nymtech/nym/pull/4938
+[#4937]: https://github.com/nymtech/nym/pull/4937
+[#4936]: https://github.com/nymtech/nym/pull/4936
+[#4929]: https://github.com/nymtech/nym/pull/4929
+[#4903]: https://github.com/nymtech/nym/pull/4903
+[#4826]: https://github.com/nymtech/nym/pull/4826
+[#4758]: https://github.com/nymtech/nym/pull/4758
+
 ## [2024.12-aero] (2024-10-17)

 - nym-node: don't use bloomfilters for double spending checks ([#4960])
@@ -61,7 +61,6 @@ members = [
    "common/ip-packet-requests",
    "common/ledger",
    "common/mixnode-common",
-    "common/models",
    "common/network-defaults",
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
@@ -99,17 +98,15 @@ members = [
    "common/wasm/utils",
    "common/wireguard",
    "common/wireguard-types",
-    # "documentation/autodoc",
+    "documentation/autodoc",
    "explorer-api",
    "explorer-api/explorer-api-requests",
    "explorer-api/explorer-client",
    "gateway",
    "integrations/bity",
-    "mixnode",
    "sdk/ffi/cpp",
    "sdk/ffi/go",
    "sdk/ffi/shared",
-    "sdk/lib/socks5-listener",
    "sdk/rust/nym-sdk",
    "service-providers/authenticator",
    "service-providers/common",
@@ -121,13 +118,14 @@ members = [
    "nym-credential-proxy/nym-credential-proxy",
    "nym-credential-proxy/nym-credential-proxy-requests",
    "nym-credential-proxy/vpn-api-lib-wasm",
-    "nym-data-observatory",
    "nym-network-monitor",
+    "nyx-chain-watcher",
    "nym-node",
-    "nym-node/nym-node-http-api",
    "nym-node/nym-node-requests",
-    "nym-node-status-api",
-    "nym-node-status-agent",
+    "nym-node/nym-node-metrics",
+    "nym-node-status-api/nym-node-status-agent",
+    "nym-node-status-api/nym-node-status-api",
+    "nym-node-status-api/nym-node-status-client",
    "nym-outfox",
    "nym-validator-rewarder",
    "tools/echo-server",
@@ -150,22 +148,21 @@ members = [
    "tools/internal/contract-state-importer/importer-contract",
    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
+    "common/verloc",
+    "tools/internal/mixnet-connectivity-check",
 ]

 default-members = [
    "clients/native",
    "clients/socks5",
-    "common/models",
    "explorer-api",
-    "gateway",
-    "mixnode",
    "nym-api",
    "nym-credential-proxy/nym-credential-proxy",
-    "nym-data-observatory",
    "nym-node",
-    "nym-node-status-api",
+    "nym-node-status-api/nym-node-status-agent",
+    "nym-node-status-api/nym-node-status-api",
    "nym-validator-rewarder",
-    "nym-node-status-api",
+    "nyx-chain-watcher",
    "service-providers/authenticator",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
@@ -196,9 +193,9 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 aead = "0.5.2"
-anyhow = "1.0.90"
+anyhow = "1.0.95"
 argon2 = "0.5.0"
-async-trait = "0.1.83"
+async-trait = "0.1.84"
 axum-client-ip = "0.6.1"
 axum = "0.7.5"
 axum-extra = "0.9.4"
@@ -207,7 +204,7 @@ bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
-blake3 = "1.5.4"
+blake3 = "1.5.5"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
@@ -217,20 +214,20 @@ celes = "2.4.0"
 cfg-if = "1.0.0"
 chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
-chrono = "0.4.31"
+chrono = "0.4.39"
 cipher = "0.4.3"
-clap = "4.5.20"
+clap = "4.5.23"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
-comfy-table = "7.1.1"
-console = "0.15.8"
+comfy-table = "7.1.3"
+console = "0.15.10"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
-const_format = "0.2.33"
+const_format = "0.2.34"
 criterion = "0.4"
-csv = "1.3.0"
+csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1"
@@ -247,7 +244,7 @@ etherparse = "0.13.0"
 envy = "0.4"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.0.34"
+flate2 = "1.0.35"
 futures = "0.3.28"
 futures-util = "0.3"
 generic-array = "0.14.7"
@@ -264,9 +261,10 @@ http-body-util = "0.1"
 httpcodec = "0.2.3"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
+human-repr = "1.1.0"
 hyper = "1.4.1"
 hyper-util = "0.1"
-indicatif = "0.17.8"
+indicatif = "0.17.9"
 inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
@@ -291,7 +289,7 @@ parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.1"
-pin-project-lite = "0.2.14"
+pin-project-lite = "0.2.15"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
@@ -309,12 +307,12 @@ rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
 safer-ffi = "0.1.13"
 schemars = "0.8.21"
-semver = "1.0.23"
-serde = "1.0.211"
+semver = "1.0.24"
+serde = "1.0.217"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.132"
-serde_json_path = "0.6.7"
+serde_json = "1.0.134"
+serde_json_path = "0.7.1"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
@@ -328,34 +326,34 @@ subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.30.13"
 tap = "1.0.1"
-tar = "0.4.42"
-tempfile = "3.5.0"
+tar = "0.4.43"
+tempfile = "3.14"
 thiserror = "1.0.64"
-time = "0.3.30"
+time = "0.3.37"
 tokio = "1.39"
-tokio-stream = "0.1.16"
+tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
 tokio-tungstenite = { version = "0.20.1" }
-tokio-util = "0.7.12"
-toml = "0.8.14"
+tokio-util = "0.7.13"
+toml = "0.8.19"
 tower = "0.4.13"
 tower-http = "0.5.2"
-tracing = "0.1.37"
+tracing = "0.1.41"
 tracing-opentelemetry = "0.19.0"
-tracing-subscriber = "0.3.16"
+tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
 tracing-log = "0.2"
 ts-rs = "10.0.0"
 tungstenite = { version = "0.20.1", default-features = false }
 url = "2.5"
-utoipa = "4.2"
-utoipa-swagger-ui = "7.1"
-utoipauto = "0.1"
+utoipa = "5.2"
+utoipa-swagger-ui = "8.0"
+utoipauto = "0.2"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 walkdir = "2"
-wasm-bindgen-test = "0.3.43"
+wasm-bindgen-test = "0.3.45"
 x25519-dalek = "2.0.0"
 zeroize = "1.6.0"

@@ -404,11 +402,11 @@ gloo-net = "0.5.0"
 # this is blocked until the upstream removes outdates `wasm_bindgen` feature usage
 # indexed_db_futures = "0.4.1"
 indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", branch = "update-uuid" }
-js-sys = "0.3.70"
+js-sys = "0.3.76"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.95"
-wasm-bindgen-futures = "0.4.45"
+wasm-bindgen = "0.2.99"
+wasm-bindgen-futures = "0.4.49"
 wasmtimer = "0.2.0"
 web-sys = "0.3.72"

@@ -420,10 +418,6 @@ web-sys = "0.3.72"
 [profile.dev.package.sqlx-macros]
 opt-level = 3

-[profile.release.package.nym-socks5-listener]
-strip = true
-codegen-units = 1
-
 [profile.release.package.nym-client-wasm]
 # lto = true
 opt-level = 'z'
@@ -0,0 +1,23 @@
+Boost Software License - Version 1.0 - August 17th, 2003
+
+Permission is hereby granted, free of charge, to any person or organization
+obtaining a copy of the software and accompanying documentation covered by
+this license (the "Software") to use, reproduce, display, distribute,
+execute, and transmit the Software, and to prepare derivative works of the
+Software, and to permit third-parties to whom the Software is furnished to
+do so, all subject to the following:
+
+The copyright notices in the Software and this entire statement, including
+the above license grant, this restriction and the following disclaimer,
+must be included in all copies of the Software, in whole or in part, and
+all derivative works of the Software, unless such copies or derivative
+works are solely in the form of machine-executable object code generated by
+a source language processor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
@@ -14,6 +14,7 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * `nym-socks5-client` - a Socks5 proxy you can run on your machine and use with existing applications.
 * `nym-explorer` - a (projected) block explorer and (existing) mixnet viewer.
 * `nym-wallet` - a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework.
+* `nym-cli` - a tool for interacting with the network from the CLI. 
 <!-- coming soon
 * `nym-network-monitor` - sends packets through the full system to check that they are working as expected, and stores node uptime histories as the basis of a rewards system ("mixmining" or "proof-of-mixing").
 -->
@@ -35,24 +36,20 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►
 ### Building

 * Platform build instructions are available on Nym [Operators Guide documentation](https://nymtech.net/operators/binaries/building-nym.html).
-* Wallet build instructions are available on Nym [Technical docs](https://nymtech.net/docs/wallet/desktop-wallet.html).
+* Wallet build instructions are available [here](https://github.com/nymtech/nym/tree/master/nym-wallet#installation-prerequisites---linux--mac).

 ### Developing

-There's a [`sandbox.env`](https://github.com/nymtech/nym/envs/sandbox.env) file provided which you can rename to `.env` if you want convenient testing environment. Read more about sandbox environment in our [Operators Guide page](https://nymtech.net/operators/sandbox.html).
-
 References for developers:

-* [Developers Portal](https://nymtech.net/developers)
-* [Typescript SDKs](https://sdk.nymtech.net/)
-* [Technical Documentation - Nym network overview](https://nymtech.net/docs/)
-* [Release Cycle - git flow](https://nymtech.net/operators/release-cycle.html)
+* [Dev Docs](https://nymtech.net/docs/developers)
+* [SDKs](https://nymtech.net/docs/developers/rust)
+* [Network Docs](https://nymtech.net/docs/network)
+* [Release Cycle - git flow](https://nymtech.net/docs/operators/release-cycle)

 ### Developer chat

-You can chat to us in two places:
-* The #dev channel on [Matrix](https://matrix.to/#/#dev:nymtech.chat)
-* The various developer channels on [Discord](https://nymtech.net/go/discord)
+You can chat to us in the #dev channel on [Matrix](https://matrix.to/#/#dev:nymtech.chat) or on the [Nym Forum](https://forum.nymtech.net).

 ### Tokenomics & Rewards

@@ -3,37 +3,23 @@ Critical bug or security issue 💥
 If you're here because you're trying to figure out how to notify us of a security issue, send us a PGP encrypted email to:

 ```
-security@nymte.ch
+security@nym.com
 ```

 Encrypted with our public key which is available below in plain text and also on keyservers:

 ```
-pub   rsa4096 2023-10-30 [SC] [expire : 2026-10-29]
+sec   rsa4096/7C3C727F05090550 2023-10-30 [SC] [expire : 2026-10-29]
      24B2592E801A5AAA8666C8BA7C3C727F05090550
-uid          [  ultime ] Security Nym Technologies <security@nymte.ch>
-sub   rsa4096 2023-10-30 [E] [expire : 2026-10-29]
+uid                [  ultime ] Security Nym Technologies <security@nym.com>
+ssb   rsa4096/ACD0FBD79DC70ACC 2023-10-30 [E] [expire : 2026-10-29]

 ```

 The fingerprint of the key is on the second line above.

-If you need to chat __urgently__ to our team for a __critical__ security issue:
-
-go to Matrix, and alert the core engineers with a private direct message:
-
-    Jedrzej Stuczynski @jstuczyn:nymtech.chat
-    Mark Sinclair @mark:nymtech.chat
-    Raphaël Walther @raphael:nymtech.chat
-
 Please avoid opening public issues on GitHub that contain information about a potential security vulnerability as this makes it difficult to reduce the impact and harm of valid security issues.

-If you don't know what Matrix is, you can follow this documentation to create an account on this federation of instant messaging servers:
-
-[Matrix for Instant Messaging](https://matrix.org/docs/chat_basics/matrix-for-im/)
-
-
-
 ```
 -----BEGIN PGP PUBLIC KEY BLOCK-----

@@ -48,43 +34,69 @@ vMFUIzBMHOPXH16036zGyFMC1esRd2qqil4b9KtLgCOkrD1VgpjcveoA0VyMJCN6
 LmKTrVjwjjDMxby+d49BolRWGnCofXozXwvNQx+CYv8M2WPErTpyYoofYFtpqr7A
 fIufc/e0+um3zoGIbHejrhsbuH9Qf+MKsI+Ng93bdDtjeHz6MEgAlsTm0qeizYpj
 IyKZIObPmfvrAm08hFZ8JnGk+XuooF36XWbJYjCCy0bOyMw1r7ZG99TcSwARAQAB
-tC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW10ZS5jaD6J
-AlQEEwEKAD4WIQQkslkugBpaqoZmyLp8PHJ/BQkFUAUCZT9elwIbAwUJBaOagAUL
-CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRB8PHJ/BQkFUL7dD/9zO73uI5VR+SWx
-PFmJW+9QsPiQbVRvGwNZurctmQ2s2Pe0vHRELFeqD5oYvSx2Lequ3Ir+zn/C3kDM
-kNs40obSL6jCBiLPkxEY0JqzPM9jZr7EjvlibWV3f6DxooRIqEyfN57I3OBGlqZE
-0Mx7sQuCcgau8C70DF952QhKUwXC2cmpmDKHVEEoio1xGSD4dQhGapCB32RQGtna
-OGfAO9celNMvSq0Lp+aJxeACmWFY5T4/y79JPcT5vSs/yEIRmaH/fn2piwaFBsIq
-gHJJMxO3740P1hF8j7KWUoUofuFaEALHBpEpjWTOj8ej1wmFlu+5F+jSVoc781Wb
-ZZXu04cOBXnGTogzSxMpBe9TtLb28zd6WzFotC25KTI3pngMzXsQGLJLOwvoZKiS
-LFjPRjg1rwobmB3Q3J2W5GYSveia0CDsZGP+g87GVVf/oD2Djpa68xyVYwIYeA6T
-3DNdS77qHiRuGiS4kWXyVjDqOICboR4uCvt09zlkBuLDdTWqWYARUvZjtjs4w/Ol
-rdrBI3A88ti8fRldYaNpu17ME1ilpN44yKoJtqiWc3Tisk8eYLfx6c7FQF3PrRva
-mr7FZvhFsYML5CeNFHTEzN6Y3jjKN/60DvCfodWnWFK47Txkl8UAXGY2W9B0fWqQ
-wUVr8uLuMyyMiKbeoufi7rGOj6AMErkCDQRlP16XARAA8FGmD5J3tM1BOM1niJxZ
-JTdCauzEtxEoBL0RuqGBkR8U29sRM6DwuzjU7PwscFnBaGyU+eU73GwGkH3ozFfF
-tllYhQrhP/kkN+0rEO5Xi+nR+4JCFRqrf3nJXAAPfiksURMp8er1dUOY2/e1ZSoL
-tS+nzUivV8CfE+pgj/5YtGwPC+KYHLATkKkMELCrbW4UO06VWOqQsvr6kivXuJQQ
-LdEAMpBlADmXFG45DmPKQzsBWUgvTwyGy3LX0nys8cgpex9BH8hhr01QmGyP469s
-N3cNrtFuu8U6RAsiCD/8mlBuD3EQEU5SF0lc7kCICAZk+wElmXnimEi0TOYsbz6k
-90lteicX70rA9GNeyI76H+VSOYvWpkRwaJAgUdzrAM1o9SHASq+cZ6nD85OZioQk
-DWM6+Q+sf2oen0qJnnGmUr93kJIC0PIdgrXRrtiNfeRa1Z/H0LmREyyEMoFiVivn
-z1vVk85Oq6Sf3ltUwvmDzuuJOtsp2Qp6+x6Snn/yKauI4uf4Cf/wKUch4r6Bwgg5
-Dw49ky7lwlnALio4GIVoGLpLef93wWoDmp4Klyh3ZPf2nB0U91u3bHRUo7m+D7QJ
-98cyKtqLLzjg7szGf60pIWNWRsadYQT3bSncynqknAjOV3BCvx6/ivsnpj//QjYR
-HtviUAcQ1DBB6UC6q23FIs0AEQEAAYkCPAQYAQoAJhYhBCSyWS6AGlqqhmbIunw8
-cn8FCQVQBQJlP16XAhsMBQkFo5qAAAoJEHw8cn8FCQVQzukP/iLxjOxT+UpPR//c
-prDVSLkP4pF5bmw36U07jvqpS+/KTXsxiiQleffRabOpNLcd+K1ueavyt9nnIwHH
-tHS9kM9A7DBw3LnpEbXki46QDCCI6niGijlLOEeAWqnocwMNTT05wVVgCtO3DQP2
-MoSCcqHpXDChvOyr5d5xjYLVJhlctIMSomcVzGryjknPu0Yj/TkC/4c+m86ZWQUD
-HqMHQIuiEenvb62/F4c5OJIRZPEn70wdddkgJuJU3eHdHrnuhCkjCC93GQGbGj03
-Zqos6699y6hmPeD3U5IUv8ujwZYVCCuDm8gJfrp3R6WLfeZeK9WmTVBpCzsDg3fV
-hSwmOk6pp8DAq1/Dev3yRkFggCEyGK6c9b+a0CRBncl8e5Q0QQIzNiS/uExQP3h+
-ELJs3P0MLP+6FWhNUry09n3lnWkr1hY+v1M0GAxbfdv/tsCN1Pq/VQEz+CTqXqya
-ftWldOHWw6Hh+gtwxcHjG4MBOrO5oICQ3lh2hGwQ58cDgZYSK/OGgJ9BggFl1CcM
-0uGC0/TRCI1zt/4y+7efSZQMZkHo7VC/3MFbp2hcNejpW+BxVuwKTunFvWK3TLhq
-sSlQ5yyhqchooepsFHq9bosKFjLJC01uprBv1rinoNduOy43FbyS7JPRRspANN0R
-iC2pMbWdE0ZTQaFq6tPIg058pjqi
-=nqgX
+tCxTZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW0uY29tPokC
+VAQTAQoAPhYhBCSyWS6AGlqqhmbIunw8cn8FCQVQBQJnSd5VAhsDBQkFo5qABQsJ
+CAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEHw8cn8FCQVQPPIP/ipGz2zLAjE2dSE3
+VcqOvras0DfqIL9HDm26Dg6QO2D/4YRntw0RqVyuy+zFnRUm+RZCKLPLUzbQ9Wjb
+G/Og5ttQVYQMu5eKu7OMvXkrbRo3teZFU+8IL08zIW6pyf9haxO6YMhLRy6cLYwW
+0EYC6Qzn5gz3kI7VkI8fWfs2Dk4XEV3D+SVtBoF6KRxMXT6HZvpzoMSEJZBoNj8S
+jw0TF8TFUQf49jUQbIHumukMswolrHi8a5ej8DSfNwSgz+Tt8oh5lu01kyUJiHn7
+nuHaY4Y9cHUVAOSwq/hovG52+ZE1r3aiswvle/B19o9pKeWWVvacSptGxDQagBtQ
+igoNLdRvY0XN2TEyX9pOHR0AoVOxtIW11CpkKuDbQG9vPwovqJ2L6+Fh3pzHYzcI
+2GIShNm/Z2SZBiUqbljJe9H4UAT/aHgMINkEG8qzUKwO42MA5HJT7YbHTR17/QSF
+Il5dhneRzmSbNcW2rdRwx/BmzrcsFJfqCt4JG/WDF293xSOjhFqQYvU4gCO+OB7o
+KXjX907XXDjS2KEJ71OGqVfk/P7BqEfQNfrLtb02TyXJAPQXHhybv23c4E7zUs9V
+lMjNizzxYB96uwJb0LAB2ijzEwoP91uGT2tFjk6F08x2QiArmXUdgrv44b39Stia
+gJS0GYKqSzyr10xHhUuDA+GKYtcitC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVz
+IDxzZWN1cml0eUBueW10ZS5jaD6JAjYEMAEKACAWIQQkslkugBpaqoZmyLp8PHJ/
+BQkFUAUCZ0nftQIdIAAKCRB8PHJ/BQkFUFHDEACtyNuUEjKCLAT5mSfow85PjFgo
+o8kHjQr/IIQ7ZbBOHeJJcrxDuypssiLh5XUjF3x5BiBfZ6vCxSb81RRwsDMp0mA1
+qzv9G8sgW0HTQUnZ9oH6CYut2NgzAnQpmuacrunm9Zy0FJ3ejbmwUY/NqK6gJkle
+66duHKhAy7DWjj7amd0C8bPDR+PA44fI3MezDHkQNaauKZTRqd1TqH8Qk5PAl4cB
+o5gVzeZh/U7/usvtGhazAIUF5BqK6bTmDnYopg+2x8jjwrG4+08GrttZkNjBLXeA
+Y/2U064yMz12LPv01qqAFdZ+coRy/ps/gOQTz34/VeW0CFy7TMqs4t3vSBWTqU7w
+hnw/qj6cM33fdxctj6KDgJSCkZdx2fvwXgxiPqUa5+j9FlFBeD5RDAl6g6t8N1/K
+Xca+zNYuSZgc297q1D+mtSD1C7uJNPxoAl+Bv5KNKpsjfQ+m04++CIFtGyX22aCA
+h2/tHwQZIXhOiMAKOoupidDVDhgxtCJ3Ps416xL0sTZfsPfg+j1Uv/Em9pzPClEl
+fX6+1O4DdSyZUQ4VsjMu/H5W/NQdbHgmqFrxQ6WX/0s5GMwO6GMDiPe8sOrwz9wD
+WYtyjafxXOHEZ1OjYX5gr7bGaG4oKc2btTJN0B3Phg4dStnHCNjEYccxuV3507fj
+HnNotkpXF2nGLxy+PYkCVAQTAQoAPhYhBCSyWS6AGlqqhmbIunw8cn8FCQVQBQJl
+P16XAhsDBQkFo5qABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEHw8cn8FCQVQ
+vt0P/3M7ve4jlVH5JbE8WYlb71Cw+JBtVG8bA1m6ty2ZDazY97S8dEQsV6oPmhi9
+LHYt6q7civ7Of8LeQMyQ2zjShtIvqMIGIs+TERjQmrM8z2NmvsSO+WJtZXd/oPGi
+hEioTJ83nsjc4EaWpkTQzHuxC4JyBq7wLvQMX3nZCEpTBcLZyamYModUQSiKjXEZ
+IPh1CEZqkIHfZFAa2do4Z8A71x6U0y9KrQun5onF4AKZYVjlPj/Lv0k9xPm9Kz/I
+QhGZof9+famLBoUGwiqAckkzE7fvjQ/WEXyPspZShSh+4VoQAscGkSmNZM6Px6PX
+CYWW77kX6NJWhzvzVZtlle7Thw4FecZOiDNLEykF71O0tvbzN3pbMWi0LbkpMjem
+eAzNexAYsks7C+hkqJIsWM9GODWvChuYHdDcnZbkZhK96JrQIOxkY/6DzsZVV/+g
+PYOOlrrzHJVjAhh4DpPcM11LvuoeJG4aJLiRZfJWMOo4gJuhHi4K+3T3OWQG4sN1
+NapZgBFS9mO2OzjD86Wt2sEjcDzy2Lx9GV1ho2m7XswTWKWk3jjIqgm2qJZzdOKy
+Tx5gt/HpzsVAXc+tG9qavsVm+EWxgwvkJ40UdMTM3pjeOMo3/rQO8J+h1adYUrjt
+PGSXxQBcZjZb0HR9apDBRWvy4u4zLIyIpt6i5+LusY6PoAwSuQINBGU/XpcBEADw
+UaYPkne0zUE4zWeInFklN0Jq7MS3ESgEvRG6oYGRHxTb2xEzoPC7ONTs/CxwWcFo
+bJT55TvcbAaQfejMV8W2WViFCuE/+SQ37SsQ7leL6dH7gkIVGqt/eclcAA9+KSxR
+Eynx6vV1Q5jb97VlKgu1L6fNSK9XwJ8T6mCP/li0bA8L4pgcsBOQqQwQsKttbhQ7
+TpVY6pCy+vqSK9e4lBAt0QAykGUAOZcUbjkOY8pDOwFZSC9PDIbLctfSfKzxyCl7
+H0EfyGGvTVCYbI/jr2w3dw2u0W67xTpECyIIP/yaUG4PcRARTlIXSVzuQIgIBmT7
+ASWZeeKYSLRM5ixvPqT3SW16JxfvSsD0Y17Ijvof5VI5i9amRHBokCBR3OsAzWj1
+IcBKr5xnqcPzk5mKhCQNYzr5D6x/ah6fSomecaZSv3eQkgLQ8h2CtdGu2I195FrV
+n8fQuZETLIQygWJWK+fPW9WTzk6rpJ/eW1TC+YPO64k62ynZCnr7HpKef/Ipq4ji
+5/gJ//ApRyHivoHCCDkPDj2TLuXCWcAuKjgYhWgYukt5/3fBagOangqXKHdk9/ac
+HRT3W7dsdFSjub4PtAn3xzIq2osvOODuzMZ/rSkhY1ZGxp1hBPdtKdzKeqScCM5X
+cEK/Hr+K+yemP/9CNhEe2+JQBxDUMEHpQLqrbcUizQARAQABiQI8BBgBCgAmFiEE
+JLJZLoAaWqqGZsi6fDxyfwUJBVAFAmU/XpcCGwwFCQWjmoAACgkQfDxyfwUJBVDO
+6Q/+IvGM7FP5Sk9H/9ymsNVIuQ/ikXlubDfpTTuO+qlL78pNezGKJCV599Fps6k0
+tx34rW55q/K32ecjAce0dL2Qz0DsMHDcuekRteSLjpAMIIjqeIaKOUs4R4Baqehz
+Aw1NPTnBVWAK07cNA/YyhIJyoelcMKG87Kvl3nGNgtUmGVy0gxKiZxXMavKOSc+7
+RiP9OQL/hz6bzplZBQMeowdAi6IR6e9vrb8Xhzk4khFk8SfvTB112SAm4lTd4d0e
+ue6EKSMIL3cZAZsaPTdmqizrr33LqGY94PdTkhS/y6PBlhUIK4ObyAl+undHpYt9
+5l4r1aZNUGkLOwODd9WFLCY6TqmnwMCrX8N6/fJGQWCAITIYrpz1v5rQJEGdyXx7
+lDRBAjM2JL+4TFA/eH4Qsmzc/Qws/7oVaE1SvLT2feWdaSvWFj6/UzQYDFt92/+2
+wI3U+r9VATP4JOperJp+1aV04dbDoeH6C3DFweMbgwE6s7mggJDeWHaEbBDnxwOB
+lhIr84aAn0GCAWXUJwzS4YLT9NEIjXO3/jL7t59JlAxmQejtUL/cwVunaFw16Olb
+4HFW7ApO6cW9YrdMuGqxKVDnLKGpyGih6mwUer1uiwoWMskLTW6msG/WuKeg1247
+LjcVvJLsk9FGykA03RGILakxtZ0TRlNBoWrq08iDTnymOqI=
+=QPTf
 -----END PGP PUBLIC KEY BLOCK-----
+
 ```
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.42"
+version = "1.1.45"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -3,13 +3,10 @@

 use crate::commands::try_load_current_config;
 use crate::{
-    client::{config::Config, SocketClient},
+    client::SocketClient,
    commands::{override_config, OverrideConfig},
-    error::ClientError,
 };
 use clap::Args;
-use log::*;
-use nym_bin_common::version_checker::is_minor_version_compatible;
 use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use std::error::Error;
 use std::net::IpAddr;
@@ -48,36 +45,12 @@ impl From<Run> for OverrideConfig {
    }
 }

-// this only checks compatibility between config the binary. It does not take into consideration
-// network version. It might do so in the future.
-fn version_check(cfg: &Config) -> bool {
-    let binary_version = env!("CARGO_PKG_VERSION");
-    let config_version = &cfg.base.client.version;
-    if binary_version == config_version {
-        true
-    } else {
-        warn!("The native-client binary has different version than what is specified in config file! {} and {}", binary_version, config_version);
-        if is_minor_version_compatible(binary_version, config_version) {
-            info!("but they are still semver compatible. However, consider running the `upgrade` command");
-            true
-        } else {
-            error!("and they are semver incompatible! - please run the `upgrade` command before attempting `run` again");
-            false
-        }
-    }
-}
-
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync>> {
    eprintln!("Starting client {}...", args.common_args.id);

    let mut config = try_load_current_config(&args.common_args.id).await?;
    config = override_config(config, OverrideConfig::from(args.clone()));

-    if !version_check(&config) {
-        error!("failed the local version check");
-        return Err(Box::new(ClientError::FailedLocalVersionCheck));
-    }
-
    SocketClient::new(config, args.common_args.custom_mixnet)
        .run_socket_forever()
        .await
@@ -17,9 +17,6 @@ pub enum ClientError {
    #[error("Failed to validate the loaded config")]
    ConfigValidationFailure,

-    #[error("Failed local version check, client and config mismatch")]
-    FailedLocalVersionCheck,
-
    #[error("Attempted to start the client in invalid socket mode")]
    InvalidSocketMode,

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.42"
+version = "1.1.45"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -2,14 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::commands::try_load_current_config;
-use crate::config::Config;
-use crate::{
-    commands::{override_config, OverrideConfig},
-    error::Socks5ClientError,
-};
+use crate::commands::{override_config, OverrideConfig};
 use clap::Args;
-use log::*;
-use nym_bin_common::version_checker::is_minor_version_compatible;
 use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use nym_client_core::client::base_client::storage::OnDiskPersistent;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
@@ -82,38 +76,12 @@ fn validate_country_group(s: &str) -> Result<CountryGroup, String> {
    }
 }

-// this only checks compatibility between config the binary. It does not take into consideration
-// network version. It might do so in the future.
-fn version_check(cfg: &Config) -> bool {
-    let binary_version = env!("CARGO_PKG_VERSION");
-    let config_version = &cfg.core.base.client.version;
-    if binary_version == config_version {
-        true
-    } else {
-        warn!(
-            "The socks5-client binary has different version than what is specified in config file! {binary_version} and {config_version}",
-        );
-        if is_minor_version_compatible(binary_version, config_version) {
-            info!("but they are still semver compatible. However, consider running the `upgrade` command");
-            true
-        } else {
-            error!("and they are semver incompatible! - please run the `upgrade` command before attempting `run` again");
-            false
-        }
-    }
-}
-
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    eprintln!("Starting client {}...", args.common_args.id);

    let mut config = try_load_current_config(&args.common_args.id).await?;
    config = override_config(config, OverrideConfig::from(args.clone()));

-    if !version_check(&config) {
-        error!("failed the local version check");
-        return Err(Box::new(Socks5ClientError::FailedLocalVersionCheck));
-    }
-
    let storage =
        OnDiskPersistent::from_paths(config.storage_paths.common_paths, &config.core.base.debug)
            .await?;
@@ -14,9 +14,6 @@ pub enum Socks5ClientError {
    #[error("Failed to validate the loaded config")]
    ConfigValidationFailure,

-    #[error("Failed local version check, client and config mismatch")]
-    FailedLocalVersionCheck,
-
    #[error("Fail to bind address")]
    FailToBindAddress,

@@ -22,4 +22,7 @@ pub enum Error {

    #[error("conversion: {0}")]
    Conversion(String),
+
+    #[error("failed to serialize response packet: {source}")]
+    FailedToSerializeResponsePacket { source: Box<bincode::ErrorKind> },
 }
@@ -1,12 +1,14 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+pub mod traits;
 pub mod v1;
 pub mod v2;
 pub mod v3;
 pub mod v4;

 mod error;
+mod util;

 pub use error::Error;
 pub use v4 as latest;
@@ -0,0 +1,343 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_crypto::asymmetric::x25519::PrivateKey;
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+
+use crate::{
+    v1, v2, v3,
+    v4::{self, registration::IpPair},
+    Error,
+};
+
+#[derive(Copy, Clone, Debug)]
+pub enum AuthenticatorVersion {
+    V1,
+    V2,
+    V3,
+    V4,
+    UNKNOWN,
+}
+
+impl From<Protocol> for AuthenticatorVersion {
+    fn from(value: Protocol) -> Self {
+        if value.service_provider_type != ServiceProviderType::Authenticator {
+            AuthenticatorVersion::UNKNOWN
+        } else if value.version == v1::VERSION {
+            AuthenticatorVersion::V1
+        } else if value.version == v2::VERSION {
+            AuthenticatorVersion::V2
+        } else if value.version == v3::VERSION {
+            AuthenticatorVersion::V3
+        } else if value.version == v4::VERSION {
+            AuthenticatorVersion::V4
+        } else {
+            AuthenticatorVersion::UNKNOWN
+        }
+    }
+}
+
+pub trait InitMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+}
+
+impl InitMessage for v1::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v2::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v3::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+impl InitMessage for v4::registration::InitMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+pub trait FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
+    fn private_ips(&self) -> IpPair;
+    fn credential(&self) -> Option<CredentialSpendingData>;
+}
+
+impl FinalMessage for v1::GatewayClient {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        None
+    }
+}
+
+impl FinalMessage for v2::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+impl FinalMessage for v3::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ip.into()
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+impl FinalMessage for v4::registration::FinalMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.gateway_client.pub_key
+    }
+
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        self.gateway_client.verify(private_key, nonce)
+    }
+
+    fn private_ips(&self) -> IpPair {
+        self.gateway_client.private_ips
+    }
+
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
+    }
+}
+
+pub trait QueryBandwidthMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+}
+
+impl QueryBandwidthMessage for PeerPublicKey {
+    fn pub_key(&self) -> PeerPublicKey {
+        *self
+    }
+}
+
+pub trait TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey;
+    fn credential(&self) -> CredentialSpendingData;
+}
+
+impl TopUpMessage for v3::topup::TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn credential(&self) -> CredentialSpendingData {
+        self.credential.clone()
+    }
+}
+
+impl TopUpMessage for v4::topup::TopUpMessage {
+    fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+
+    fn credential(&self) -> CredentialSpendingData {
+        self.credential.clone()
+    }
+}
+
+pub enum AuthenticatorRequest {
+    Initial {
+        msg: Box<dyn InitMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    Final {
+        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    QueryBandwidth {
+        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+    TopUpBandwidth {
+        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
+        protocol: Protocol,
+        reply_to: Recipient,
+        request_id: u64,
+    },
+}
+
+impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v1::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v1::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
+                msg: Box::new(gateway_client),
+                protocol: Protocol {
+                    version: value.version,
+                    service_provider_type: ServiceProviderType::Authenticator,
+                },
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: Protocol {
+                        version: value.version,
+                        service_provider_type: ServiceProviderType::Authenticator,
+                    },
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v2::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v3::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
+
+impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
+    fn from(value: v4::request::AuthenticatorRequest) -> Self {
+        match value.data {
+            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
+                msg: Box::new(init_message),
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
+                msg: final_message,
+                protocol: value.protocol,
+                reply_to: value.reply_to,
+                request_id: value.request_id,
+            },
+            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
+                Self::QueryBandwidth {
+                    msg: Box::new(peer_public_key),
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                Self::TopUpBandwidth {
+                    msg: top_up_message,
+                    protocol: value.protocol,
+                    reply_to: value.reply_to,
+                    request_id: value.request_id,
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,71 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#[cfg(test)]
+pub(crate) mod tests {
+    pub(crate) const CREDENTIAL_BYTES: [u8; 1245] = [
+        0, 0, 4, 133, 96, 179, 223, 185, 136, 23, 213, 166, 59, 203, 66, 69, 209, 181, 227, 254,
+        16, 102, 98, 237, 59, 119, 170, 111, 31, 194, 51, 59, 120, 17, 115, 229, 79, 91, 11, 139,
+        154, 2, 212, 23, 68, 70, 167, 3, 240, 54, 224, 171, 221, 1, 69, 48, 60, 118, 119, 249, 123,
+        35, 172, 227, 131, 96, 232, 209, 187, 123, 4, 197, 102, 90, 96, 45, 125, 135, 140, 99, 1,
+        151, 17, 131, 143, 157, 97, 107, 139, 232, 212, 87, 14, 115, 253, 255, 166, 167, 186, 43,
+        90, 96, 173, 105, 120, 40, 10, 163, 250, 224, 214, 200, 178, 4, 160, 16, 130, 59, 76, 193,
+        39, 240, 3, 101, 141, 209, 183, 226, 186, 207, 56, 210, 187, 7, 164, 240, 164, 205, 37, 81,
+        184, 214, 193, 195, 90, 205, 238, 225, 195, 104, 12, 123, 203, 57, 233, 243, 215, 145, 195,
+        196, 57, 38, 125, 172, 18, 47, 63, 165, 110, 219, 180, 40, 58, 116, 92, 254, 160, 98, 48,
+        92, 254, 232, 107, 184, 80, 234, 60, 160, 235, 249, 76, 41, 38, 165, 28, 40, 136, 74, 48,
+        166, 50, 245, 23, 201, 140, 101, 79, 93, 235, 128, 186, 146, 126, 180, 134, 43, 13, 186,
+        19, 195, 48, 168, 201, 29, 216, 95, 176, 198, 132, 188, 64, 39, 212, 150, 32, 52, 53, 38,
+        228, 199, 122, 226, 217, 75, 40, 191, 151, 48, 164, 242, 177, 79, 14, 122, 105, 151, 85,
+        88, 199, 162, 17, 96, 103, 83, 178, 128, 9, 24, 30, 74, 108, 241, 85, 240, 166, 97, 241,
+        85, 199, 11, 198, 226, 234, 70, 107, 145, 28, 208, 114, 51, 12, 234, 108, 101, 202, 112,
+        48, 185, 22, 159, 67, 109, 49, 27, 149, 90, 109, 32, 226, 112, 7, 201, 208, 209, 104, 31,
+        97, 134, 204, 145, 27, 181, 206, 181, 106, 32, 110, 136, 115, 249, 201, 111, 5, 245, 203,
+        71, 121, 169, 126, 151, 178, 236, 59, 221, 195, 48, 135, 115, 6, 50, 227, 74, 97, 107, 107,
+        213, 90, 2, 203, 154, 138, 47, 128, 52, 134, 128, 224, 51, 65, 240, 90, 8, 55, 175, 180,
+        178, 204, 206, 168, 110, 51, 57, 189, 169, 48, 169, 136, 121, 99, 51, 170, 178, 214, 74, 1,
+        96, 151, 167, 25, 173, 180, 171, 155, 10, 55, 142, 234, 190, 113, 90, 79, 80, 244, 71, 166,
+        30, 235, 113, 150, 133, 1, 218, 17, 109, 111, 223, 24, 216, 177, 41, 2, 204, 65, 221, 212,
+        207, 236, 144, 6, 65, 224, 55, 42, 1, 1, 161, 134, 118, 127, 111, 220, 110, 127, 240, 71,
+        223, 129, 12, 93, 20, 220, 60, 56, 71, 146, 184, 95, 132, 69, 28, 56, 53, 192, 213, 22,
+        119, 230, 152, 225, 182, 188, 163, 219, 37, 175, 247, 73, 14, 247, 38, 72, 243, 1, 48, 131,
+        59, 8, 13, 96, 143, 185, 127, 241, 161, 217, 24, 149, 193, 40, 16, 30, 202, 151, 28, 119,
+        240, 153, 101, 156, 61, 193, 72, 245, 199, 181, 12, 231, 65, 166, 67, 142, 121, 207, 202,
+        58, 197, 113, 188, 248, 42, 124, 105, 48, 161, 241, 55, 209, 36, 194, 27, 63, 233, 144,
+        189, 85, 117, 234, 9, 139, 46, 31, 206, 114, 95, 131, 29, 240, 13, 81, 142, 140, 133, 33,
+        30, 41, 141, 37, 80, 217, 95, 221, 76, 115, 86, 201, 165, 51, 252, 9, 28, 209, 1, 48, 150,
+        74, 248, 212, 187, 222, 66, 210, 3, 200, 19, 217, 171, 184, 42, 148, 53, 150, 57, 50, 6,
+        227, 227, 62, 49, 42, 148, 148, 157, 82, 191, 58, 24, 34, 56, 98, 120, 89, 105, 176, 85,
+        15, 253, 241, 41, 153, 195, 136, 1, 48, 142, 126, 213, 101, 223, 79, 133, 230, 105, 38,
+        161, 149, 2, 21, 136, 150, 42, 72, 218, 85, 146, 63, 223, 58, 108, 186, 183, 248, 62, 20,
+        47, 34, 113, 160, 177, 204, 181, 16, 24, 212, 224, 35, 84, 51, 168, 56, 136, 11, 1, 48,
+        135, 242, 62, 149, 230, 178, 32, 224, 119, 26, 234, 163, 237, 224, 114, 95, 112, 140, 170,
+        150, 96, 125, 136, 221, 180, 78, 18, 11, 12, 184, 2, 198, 217, 119, 43, 69, 4, 172, 109,
+        55, 183, 40, 131, 172, 161, 88, 183, 101, 1, 48, 173, 216, 22, 73, 42, 255, 211, 93, 249,
+        87, 159, 115, 61, 91, 55, 130, 17, 216, 60, 34, 122, 55, 8, 244, 244, 153, 151, 57, 5, 144,
+        178, 55, 249, 64, 211, 168, 34, 148, 56, 89, 92, 203, 70, 124, 219, 152, 253, 165, 0, 32,
+        203, 116, 63, 7, 240, 222, 82, 86, 11, 149, 167, 72, 224, 55, 190, 66, 201, 65, 168, 184,
+        96, 47, 194, 241, 168, 124, 7, 74, 214, 250, 37, 76, 32, 218, 69, 122, 103, 215, 145, 169,
+        24, 212, 229, 168, 106, 10, 144, 31, 13, 25, 178, 242, 250, 106, 159, 40, 48, 163, 165, 61,
+        130, 57, 146, 4, 73, 32, 254, 233, 125, 135, 212, 29, 111, 4, 177, 114, 15, 210, 170, 82,
+        108, 110, 62, 166, 81, 209, 106, 176, 156, 14, 133, 242, 60, 127, 120, 242, 28, 97, 0, 1,
+        32, 103, 93, 109, 89, 240, 91, 1, 84, 150, 50, 206, 157, 203, 49, 220, 120, 234, 175, 234,
+        150, 126, 225, 94, 163, 164, 199, 138, 114, 62, 99, 106, 112, 1, 32, 171, 40, 220, 82, 241,
+        203, 76, 146, 111, 139, 182, 179, 237, 182, 115, 75, 128, 201, 107, 43, 214, 0, 135, 217,
+        160, 68, 150, 232, 144, 114, 237, 98, 32, 30, 134, 232, 59, 93, 163, 253, 244, 13, 202, 52,
+        147, 168, 83, 121, 123, 95, 21, 210, 209, 225, 223, 143, 49, 10, 205, 238, 1, 22, 83, 81,
+        70, 1, 32, 26, 76, 6, 234, 160, 50, 139, 102, 161, 232, 155, 106, 130, 171, 226, 210, 233,
+        178, 85, 247, 71, 123, 55, 53, 46, 67, 148, 137, 156, 207, 208, 107, 1, 32, 102, 31, 4, 98,
+        110, 156, 144, 61, 229, 140, 198, 84, 196, 238, 128, 35, 131, 182, 137, 125, 241, 95, 69,
+        131, 170, 27, 2, 144, 75, 72, 242, 102, 3, 32, 121, 80, 45, 173, 56, 65, 218, 27, 40, 251,
+        197, 32, 169, 104, 123, 110, 90, 78, 153, 166, 38, 9, 129, 228, 99, 8, 1, 116, 142, 233,
+        162, 69, 32, 216, 169, 159, 116, 95, 12, 63, 176, 195, 6, 183, 123, 135, 75, 61, 112, 106,
+        83, 235, 176, 41, 27, 248, 48, 71, 165, 170, 12, 92, 103, 103, 81, 32, 58, 74, 75, 145,
+        192, 94, 153, 69, 80, 128, 241, 3, 16, 117, 192, 86, 161, 103, 44, 174, 211, 196, 182, 124,
+        55, 11, 107, 142, 49, 88, 6, 41, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
+        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
+        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 0, 37, 139, 240, 0, 0,
+        0, 0, 0, 0, 0, 1,
+    ];
+    pub(crate) const RECIPIENT: &str = "CytBseW6yFXUMzz4SGAKdNLGR7q3sJLLYxyBGvutNEQV.4QXYyEVc5fUDjmmi8PrHN9tdUFV4PCvSJE1278cHyvoe@4sBbL1ngf1vtNqykydQKTFh26sQCw888GpUqvPvyNB4f";
+}
@@ -29,7 +29,7 @@ pub type Taken = Option<SystemTime>;

 pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct InitMessage {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -41,7 +41,7 @@ impl InitMessage {
    }
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct FinalMessage {
    /// Gateway client data
    pub gateway_client: GatewayClient,
@@ -50,28 +50,28 @@ pub struct FinalMessage {
    pub credential: Option<CredentialSpendingData>,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistrationData {
    pub nonce: u64,
    pub gateway_data: GatewayClient,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistredData {
    pub pub_key: PeerPublicKey,
    pub private_ip: IpAddr,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RemainingBandwidthData {
    pub available_bandwidth: i64,
 }

 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct GatewayClient {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -147,7 +147,7 @@ impl GatewayClient {

 // TODO: change the inner type into generic array of size HmacSha256::OutputSize
 // TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct ClientMac(Vec<u8>);

 impl fmt::Display for ClientMac {
@@ -87,7 +87,7 @@ impl AuthenticatorRequest {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorRequestData {
    Initial(InitMessage),
    Final(Box<FinalMessage>),
@@ -100,28 +100,28 @@ impl AuthenticatorResponse {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorResponseData {
    PendingRegistration(PendingRegistrationResponse),
    Registered(RegisteredResponse),
    RemainingBandwidth(RemainingBandwidthResponse),
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct PendingRegistrationResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistrationData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RegisteredResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistredData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RemainingBandwidthResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
@@ -19,6 +19,24 @@ impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorReque
    }
 }

+impl TryFrom<v3::request::AuthenticatorRequest> for v2::request::AuthenticatorRequest {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_request: v3::request::AuthenticatorRequest,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.try_into()?,
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        })
+    }
+}
+
 impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
        match authenticator_request_data {
@@ -35,6 +53,29 @@ impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorR
    }
 }

+impl TryFrom<v3::request::AuthenticatorRequestData> for v2::request::AuthenticatorRequestData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_request_data: v3::request::AuthenticatorRequestData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_request_data {
+            v3::request::AuthenticatorRequestData::Initial(init_msg) => Ok(
+                v2::request::AuthenticatorRequestData::Initial(init_msg.into()),
+            ),
+            v3::request::AuthenticatorRequestData::Final(gw_client) => Ok(
+                v2::request::AuthenticatorRequestData::Final(gw_client.into()),
+            ),
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => Ok(
+                v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key),
+            ),
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(_) => Err(
+                Self::Error::Conversion("no top up bandwidth variant in v2".to_string()),
+            ),
+        }
+    }
+}
+
 impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
    fn from(init_msg: v2::registration::InitMessage) -> Self {
        Self {
@@ -43,6 +84,14 @@ impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
    }
 }

+impl From<v3::registration::InitMessage> for v2::registration::InitMessage {
+    fn from(init_msg: v3::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
 impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
        Box::new(v3::registration::FinalMessage {
@@ -52,6 +101,15 @@ impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMe
    }
 }

+impl From<Box<v3::registration::FinalMessage>> for Box<v2::registration::FinalMessage> {
+    fn from(gw_client: Box<v3::registration::FinalMessage>) -> Self {
+        Box::new(v2::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
 impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
    fn from(gw_client: v2::registration::GatewayClient) -> Self {
        Self {
@@ -93,11 +151,27 @@ impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::Authenticato
        Ok(Self {
            data: authenticator_response.data.try_into()?,
            reply_to: authenticator_response.reply_to,
-            protocol: authenticator_response.protocol,
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: authenticator_response.protocol.service_provider_type,
+            },
        })
    }
 }

+impl From<v2::response::AuthenticatorResponse> for v3::response::AuthenticatorResponse {
+    fn from(value: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 3,
+                service_provider_type: value.protocol.service_provider_type,
+            },
+            data: value.data.into(),
+            reply_to: value.reply_to,
+        }
+    }
+}
+
 impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
    type Error = crate::Error;

@@ -129,6 +203,22 @@ impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::Authenti
    }
 }

+impl From<v2::response::AuthenticatorResponseData> for v3::response::AuthenticatorResponseData {
+    fn from(value: v2::response::AuthenticatorResponseData) -> Self {
+        match value {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Self::PendingRegistration(pending_registration_response.into()),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                Self::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Self::RemainingBandwidth(remaining_bandwidth_response.into()),
+        }
+    }
+}
+
 impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
        Self {
@@ -139,6 +229,16 @@ impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRe
    }
 }

+impl From<v2::response::PendingRegistrationResponse> for v3::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
 impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
    fn from(value: v3::response::RegisteredResponse) -> Self {
        Self {
@@ -149,6 +249,16 @@ impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse
    }
 }

+impl From<v2::response::RegisteredResponse> for v3::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
 impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
        Self {
@@ -159,6 +269,16 @@ impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingB
    }
 }

+impl From<v2::response::RemainingBandwidthResponse> for v3::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
 impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
    fn from(value: v3::registration::RegistrationData) -> Self {
        Self {
@@ -169,6 +289,16 @@ impl From<v3::registration::RegistrationData> for v2::registration::Registration
    }
 }

+impl From<v2::registration::RegistrationData> for v3::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
 impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
    fn from(value: v3::registration::RegistredData) -> Self {
        Self {
@@ -179,6 +309,16 @@ impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
    }
 }

+impl From<v2::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
 impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
        Self {
@@ -186,3 +326,519 @@ impl From<v3::registration::RemainingBandwidthData> for v2::registration::Remain
        }
    }
 }
+
+impl From<v2::registration::RemainingBandwidthData> for v3::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{net::IpAddr, str::FromStr};
+
+    use nym_credentials_interface::CredentialSpendingData;
+    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_sphinx::addressing::Recipient;
+    use nym_wireguard_types::PeerPublicKey;
+    use x25519_dalek::PublicKey;
+
+    use super::*;
+    use crate::util::tests::{CREDENTIAL_BYTES, RECIPIENT};
+
+    #[test]
+    fn upgrade_initial_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v2::request::AuthenticatorRequest::new_initial_request(
+            v2::registration::InitMessage::new(pub_key),
+            reply_to,
+        );
+        let upgraded_msg = v3::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::request::AuthenticatorRequestData::Initial(v3::registration::InitMessage {
+                pub_key
+            })
+        );
+    }
+
+    #[test]
+    fn downgrade_initial_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v3::request::AuthenticatorRequest::new_initial_request(
+            v3::registration::InitMessage::new(pub_key),
+            reply_to,
+        );
+        let downgraded_msg = v2::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v2::request::AuthenticatorRequestData::Initial(v2::registration::InitMessage {
+                pub_key
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_final_req() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let gateway_client = v2::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ip,
+            nonce,
+        );
+        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
+        let final_message = v2::registration::FinalMessage {
+            gateway_client,
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v2::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
+        let upgraded_msg = v3::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::request::AuthenticatorRequestData::Final(Box::new(
+                v3::registration::FinalMessage {
+                    gateway_client: v3::registration::GatewayClient::new(
+                        &local_secret,
+                        (&remote_secret).into(),
+                        private_ip,
+                        nonce,
+                    ),
+                    credential
+                }
+            ))
+        );
+    }
+
+    #[test]
+    fn downgrade_final_req() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let gateway_client = v3::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ip,
+            nonce,
+        );
+        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
+        let final_message = v3::registration::FinalMessage {
+            gateway_client,
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v3::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
+        let upgraded_msg = v2::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v2::request::AuthenticatorRequestData::Final(Box::new(
+                v2::registration::FinalMessage {
+                    gateway_client: v2::registration::GatewayClient::new(
+                        &local_secret,
+                        (&remote_secret).into(),
+                        private_ip,
+                        nonce,
+                    ),
+                    credential
+                }
+            ))
+        );
+    }
+
+    #[test]
+    fn upgrade_query_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v2::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
+        let upgraded_msg = v3::request::AuthenticatorRequest::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+        );
+    }
+
+    #[test]
+    fn downgrade_query_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v3::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
+        let downgraded_msg = v2::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+        );
+    }
+
+    #[test]
+    fn downgrade_topup_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let credential = CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap();
+        let top_up_message = v3::topup::TopUpMessage {
+            pub_key,
+            credential,
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v3::request::AuthenticatorRequest::new_topup_request(top_up_message, reply_to);
+        assert!(v2::request::AuthenticatorRequest::try_from(msg).is_err());
+    }
+
+    #[test]
+    fn upgrade_pending_reg_resp() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let wg_port = 51822;
+        let gateway_data = v2::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ip,
+            nonce,
+        );
+        let registration_data = v2::registration::RegistrationData {
+            nonce,
+            gateway_data,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v2::response::AuthenticatorResponse::new_pending_registration_success(
+            registration_data,
+            request_id,
+            reply_to,
+        );
+        let upgraded_msg = v3::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                v3::response::PendingRegistrationResponse {
+                    request_id,
+                    reply_to,
+                    reply: v3::registration::RegistrationData {
+                        nonce,
+                        gateway_data: v3::registration::GatewayClient::new(
+                            &local_secret,
+                            (&remote_secret).into(),
+                            private_ip,
+                            nonce,
+                        ),
+                        wg_port,
+                    }
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn downgrade_pending_reg_resp() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let wg_port = 51822;
+        let gateway_data = v3::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ip,
+            nonce,
+        );
+        let registration_data = v3::registration::RegistrationData {
+            nonce,
+            gateway_data,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_pending_registration_success(
+            registration_data,
+            request_id,
+            reply_to,
+        );
+        let downgraded_msg = v2::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                v2::response::PendingRegistrationResponse {
+                    request_id,
+                    reply_to,
+                    reply: v2::registration::RegistrationData {
+                        nonce,
+                        gateway_data: v2::registration::GatewayClient::new(
+                            &local_secret,
+                            (&remote_secret).into(),
+                            private_ip,
+                            nonce,
+                        ),
+                        wg_port,
+                    }
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn upgrade_registered_resp() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let wg_port = 51822;
+        let registred_data = v2::registration::RegistredData {
+            pub_key,
+            private_ip,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v2::response::AuthenticatorResponse::new_registered(
+            registred_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v3::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
+                request_id,
+                reply_to,
+                reply: v3::registration::RegistredData {
+                    wg_port,
+                    pub_key,
+                    private_ip
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn downgrade_registered_resp() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
+        let wg_port = 51822;
+        let registred_data = v3::registration::RegistredData {
+            pub_key,
+            private_ip,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_registered(
+            registred_data,
+            reply_to,
+            request_id,
+        );
+        let downgraded_msg = v2::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v2::response::AuthenticatorResponseData::Registered(v2::response::RegisteredResponse {
+                request_id,
+                reply_to,
+                reply: v2::registration::RegistredData {
+                    wg_port,
+                    pub_key,
+                    private_ip
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_remaining_bandwidth_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = Some(v2::registration::RemainingBandwidthData {
+            available_bandwidth,
+        });
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v2::response::AuthenticatorResponse::new_remaining_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v3::response::AuthenticatorResponse::from(msg);
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                v3::response::RemainingBandwidthResponse {
+                    request_id,
+                    reply_to,
+                    reply: Some(v3::registration::RemainingBandwidthData {
+                        available_bandwidth,
+                    })
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn downgrade_remaining_bandwidth_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = Some(v3::registration::RemainingBandwidthData {
+            available_bandwidth,
+        });
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_remaining_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        let downgraded_msg = v2::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                v2::response::RemainingBandwidthResponse {
+                    request_id,
+                    reply_to,
+                    reply: Some(v2::registration::RemainingBandwidthData {
+                        available_bandwidth,
+                    })
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn downgrade_topup_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = v3::registration::RemainingBandwidthData {
+            available_bandwidth,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_topup_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        assert!(v2::response::AuthenticatorResponse::try_from(msg).is_err());
+    }
+}
@@ -27,9 +27,9 @@ pub type HmacSha256 = Hmac<Sha256>;
 pub type Nonce = u64;
 pub type Taken = Option<SystemTime>;

-pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 250 * 1024 * 1024 * 1024; // 250 GB

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct InitMessage {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -41,7 +41,7 @@ impl InitMessage {
    }
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct FinalMessage {
    /// Gateway client data
    pub gateway_client: GatewayClient,
@@ -50,28 +50,28 @@ pub struct FinalMessage {
    pub credential: Option<CredentialSpendingData>,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistrationData {
    pub nonce: u64,
    pub gateway_data: GatewayClient,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistredData {
    pub pub_key: PeerPublicKey,
    pub private_ip: IpAddr,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RemainingBandwidthData {
    pub available_bandwidth: i64,
 }

 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct GatewayClient {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -147,7 +147,7 @@ impl GatewayClient {

 // TODO: change the inner type into generic array of size HmacSha256::OutputSize
 // TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct ClientMac(Vec<u8>);

 impl fmt::Display for ClientMac {
@@ -106,7 +106,7 @@ impl AuthenticatorRequest {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorRequestData {
    Initial(InitMessage),
    Final(Box<FinalMessage>),
@@ -120,7 +120,7 @@ impl AuthenticatorResponse {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorResponseData {
    PendingRegistration(PendingRegistrationResponse),
    Registered(RegisteredResponse),
@@ -128,28 +128,28 @@ pub enum AuthenticatorResponseData {
    TopUpBandwidth(TopUpBandwidthResponse),
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct PendingRegistrationResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistrationData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RegisteredResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistredData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RemainingBandwidthResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: Option<RemainingBandwidthData>,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct TopUpBandwidthResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
@@ -5,7 +5,7 @@ use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct TopUpMessage {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -5,35 +5,80 @@ use nym_service_provider_requests_common::{Protocol, ServiceProviderType};

 use crate::{v3, v4};

-impl From<v3::request::AuthenticatorRequest> for v4::request::AuthenticatorRequest {
-    fn from(authenticator_request: v3::request::AuthenticatorRequest) -> Self {
-        Self {
+impl TryFrom<v3::request::AuthenticatorRequest> for v4::request::AuthenticatorRequest {
+    type Error = crate::Error;
+    fn try_from(
+        authenticator_request: v3::request::AuthenticatorRequest,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
            protocol: Protocol {
                version: 4,
                service_provider_type: ServiceProviderType::Authenticator,
            },
-            data: authenticator_request.data.into(),
+            data: authenticator_request.data.try_into()?,
            reply_to: authenticator_request.reply_to,
            request_id: authenticator_request.request_id,
+        })
+    }
+}
+
+impl TryFrom<v4::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    type Error = crate::Error;
+    fn try_from(
+        authenticator_request: v4::request::AuthenticatorRequest,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            protocol: Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.try_into()?,
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        })
+    }
+}
+
+impl TryFrom<v3::request::AuthenticatorRequestData> for v4::request::AuthenticatorRequestData {
+    type Error = crate::Error;
+    fn try_from(
+        authenticator_request_data: v3::request::AuthenticatorRequestData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_request_data {
+            v3::request::AuthenticatorRequestData::Initial(init_msg) => Ok(
+                v4::request::AuthenticatorRequestData::Initial(init_msg.into()),
+            ),
+            v3::request::AuthenticatorRequestData::Final(_) => Err(Self::Error::Conversion(
+                "mac hash breaking change".to_string(),
+            )),
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => Ok(
+                v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key),
+            ),
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => Ok(
+                v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into()),
+            ),
        }
    }
 }

-impl From<v3::request::AuthenticatorRequestData> for v4::request::AuthenticatorRequestData {
-    fn from(authenticator_request_data: v3::request::AuthenticatorRequestData) -> Self {
+impl TryFrom<v4::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    type Error = crate::Error;
+    fn try_from(
+        authenticator_request_data: v4::request::AuthenticatorRequestData,
+    ) -> Result<Self, Self::Error> {
        match authenticator_request_data {
-            v3::request::AuthenticatorRequestData::Initial(init_msg) => {
-                v4::request::AuthenticatorRequestData::Initial(init_msg.into())
-            }
-            v3::request::AuthenticatorRequestData::Final(gw_client) => {
-                v4::request::AuthenticatorRequestData::Final(gw_client.into())
-            }
-            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
-                v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
-            }
-            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into())
-            }
+            v4::request::AuthenticatorRequestData::Initial(init_msg) => Ok(
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into()),
+            ),
+            v4::request::AuthenticatorRequestData::Final(_) => Err(Self::Error::Conversion(
+                "mac hash breaking change".to_string(),
+            )),
+            v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => Ok(
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key),
+            ),
+            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => Ok(
+                v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into()),
+            ),
        }
    }
 }
@@ -46,12 +91,11 @@ impl From<v3::registration::InitMessage> for v4::registration::InitMessage {
    }
 }

-impl From<Box<v3::registration::FinalMessage>> for Box<v4::registration::FinalMessage> {
-    fn from(gw_client: Box<v3::registration::FinalMessage>) -> Self {
-        Box::new(v4::registration::FinalMessage {
-            gateway_client: gw_client.gateway_client.into(),
-            credential: gw_client.credential,
-        })
+impl From<v4::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v4::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
    }
 }

@@ -64,35 +108,26 @@ impl From<Box<v3::topup::TopUpMessage>> for Box<v4::topup::TopUpMessage> {
    }
 }

-impl From<v3::registration::GatewayClient> for v4::registration::GatewayClient {
-    fn from(gw_client: v3::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gw_client.pub_key,
-            private_ips: gw_client.private_ip.into(),
-            mac: gw_client.mac.into(),
-        }
+impl From<Box<v4::topup::TopUpMessage>> for Box<v3::topup::TopUpMessage> {
+    fn from(top_up_message: Box<v4::topup::TopUpMessage>) -> Self {
+        Box::new(v3::topup::TopUpMessage {
+            pub_key: top_up_message.pub_key,
+            credential: top_up_message.credential,
+        })
    }
 }

-impl From<v4::registration::GatewayClient> for v3::registration::GatewayClient {
-    fn from(gw_client: v4::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gw_client.pub_key,
-            private_ip: gw_client.private_ips.ipv4.into(),
-            mac: gw_client.mac.into(),
-        }
-    }
-}
-
-impl From<v3::registration::ClientMac> for v4::registration::ClientMac {
-    fn from(mac: v3::registration::ClientMac) -> Self {
-        Self::new(mac.to_vec())
-    }
-}
-
-impl From<v4::registration::ClientMac> for v3::registration::ClientMac {
-    fn from(mac: v4::registration::ClientMac) -> Self {
-        Self::new(mac.to_vec())
+impl TryFrom<v3::response::AuthenticatorResponse> for v4::response::AuthenticatorResponse {
+    type Error = crate::Error;
+    fn try_from(value: v3::response::AuthenticatorResponse) -> Result<Self, Self::Error> {
+        Ok(Self {
+            protocol: Protocol {
+                version: 4,
+                service_provider_type: value.protocol.service_provider_type,
+            },
+            data: value.data.try_into()?,
+            reply_to: value.reply_to,
+        })
    }
 }

@@ -105,11 +140,40 @@ impl TryFrom<v4::response::AuthenticatorResponse> for v3::response::Authenticato
        Ok(Self {
            data: authenticator_response.data.try_into()?,
            reply_to: authenticator_response.reply_to,
-            protocol: authenticator_response.protocol,
+            protocol: Protocol {
+                version: 3,
+                service_provider_type: authenticator_response.protocol.service_provider_type,
+            },
        })
    }
 }

+impl TryFrom<v3::response::AuthenticatorResponseData> for v4::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(_) => Err(
+                Self::Error::Conversion("mac hash breaking change".to_string()),
+            ),
+
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v4::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v4::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response) => Ok(
+                v4::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response.into()),
+            ),
+        }
+    }
+}
+
 impl TryFrom<v4::response::AuthenticatorResponseData> for v3::response::AuthenticatorResponseData {
    type Error = crate::Error;

@@ -117,13 +181,10 @@ impl TryFrom<v4::response::AuthenticatorResponseData> for v3::response::Authenti
        authenticator_response_data: v4::response::AuthenticatorResponseData,
    ) -> Result<Self, Self::Error> {
        match authenticator_response_data {
-            v4::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Ok(
-                v3::response::AuthenticatorResponseData::PendingRegistration(
-                    pending_registration_response.into(),
-                ),
+            v4::response::AuthenticatorResponseData::PendingRegistration(_) => Err(
+                Self::Error::Conversion("mac hash breaking change".to_string()),
            ),
+
            v4::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
                v3::response::AuthenticatorResponseData::Registered(registered_response.into()),
            ),
@@ -141,8 +202,8 @@ impl TryFrom<v4::response::AuthenticatorResponseData> for v3::response::Authenti
    }
 }

-impl From<v4::response::PendingRegistrationResponse> for v3::response::PendingRegistrationResponse {
-    fn from(value: v4::response::PendingRegistrationResponse) -> Self {
+impl From<v4::response::RegisteredResponse> for v3::response::RegisteredResponse {
+    fn from(value: v4::response::RegisteredResponse) -> Self {
        Self {
            request_id: value.request_id,
            reply_to: value.reply_to,
@@ -151,8 +212,8 @@ impl From<v4::response::PendingRegistrationResponse> for v3::response::PendingRe
    }
 }

-impl From<v4::response::RegisteredResponse> for v3::response::RegisteredResponse {
-    fn from(value: v4::response::RegisteredResponse) -> Self {
+impl From<v3::response::RegisteredResponse> for v4::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
        Self {
            request_id: value.request_id,
            reply_to: value.reply_to,
@@ -161,6 +222,16 @@ impl From<v4::response::RegisteredResponse> for v3::response::RegisteredResponse
    }
 }

+impl From<v3::response::RemainingBandwidthResponse> for v4::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
 impl From<v4::response::RemainingBandwidthResponse> for v3::response::RemainingBandwidthResponse {
    fn from(value: v4::response::RemainingBandwidthResponse) -> Self {
        Self {
@@ -171,11 +242,31 @@ impl From<v4::response::RemainingBandwidthResponse> for v3::response::RemainingB
    }
 }

-impl From<v4::registration::RegistrationData> for v3::registration::RegistrationData {
-    fn from(value: v4::registration::RegistrationData) -> Self {
+impl From<v3::response::TopUpBandwidthResponse> for v4::response::TopUpBandwidthResponse {
+    fn from(value: v3::response::TopUpBandwidthResponse) -> Self {
        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::TopUpBandwidthResponse> for v3::response::TopUpBandwidthResponse {
+    fn from(value: v4::response::TopUpBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v4::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ips: value.private_ip.into(),
            wg_port: value.wg_port,
        }
    }
@@ -191,6 +282,14 @@ impl From<v4::registration::RegistredData> for v3::registration::RegistredData {
    }
 }

+impl From<v3::registration::RemainingBandwidthData> for v4::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}
+
 impl From<v4::registration::RemainingBandwidthData> for v3::registration::RemainingBandwidthData {
    fn from(value: v4::registration::RemainingBandwidthData) -> Self {
        Self {
@@ -198,3 +297,441 @@ impl From<v4::registration::RemainingBandwidthData> for v3::registration::Remain
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        net::{Ipv4Addr, Ipv6Addr},
+        str::FromStr,
+    };
+
+    use nym_credentials_interface::CredentialSpendingData;
+    use nym_crypto::asymmetric::encryption::PrivateKey;
+    use nym_sphinx::addressing::Recipient;
+    use nym_wireguard_types::PeerPublicKey;
+    use x25519_dalek::PublicKey;
+
+    use super::*;
+    use crate::util::tests::{CREDENTIAL_BYTES, RECIPIENT};
+
+    #[test]
+    fn upgrade_initial_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v3::request::AuthenticatorRequest::new_initial_request(
+            v3::registration::InitMessage::new(pub_key),
+            reply_to,
+        );
+        let upgraded_msg = v4::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v4::request::AuthenticatorRequestData::Initial(v4::registration::InitMessage {
+                pub_key
+            })
+        );
+    }
+
+    #[test]
+    fn downgrade_initial_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v4::request::AuthenticatorRequest::new_initial_request(
+            v4::registration::InitMessage::new(pub_key),
+            reply_to,
+        );
+        let downgraded_msg = v3::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v3::request::AuthenticatorRequestData::Initial(v3::registration::InitMessage {
+                pub_key
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_final_req() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let gateway_client = v3::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            ipv4.into(),
+            nonce,
+        );
+        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
+        let final_message = v3::registration::FinalMessage {
+            gateway_client,
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v3::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
+        assert!(v4::request::AuthenticatorRequest::try_from(msg).is_err());
+    }
+
+    #[test]
+    fn downgrade_final_req() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let private_ips =
+            v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::10").unwrap());
+        let nonce = 42;
+        let gateway_client = v4::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ips,
+            nonce,
+        );
+        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
+        let final_message = v4::registration::FinalMessage {
+            gateway_client,
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v4::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
+        assert!(v3::request::AuthenticatorRequest::try_from(msg).is_err());
+    }
+
+    #[test]
+    fn upgrade_query_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v3::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
+        let upgraded_msg = v4::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+        );
+    }
+
+    #[test]
+    fn downgrade_query_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) = v4::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
+        let downgraded_msg = v3::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+        );
+    }
+
+    #[test]
+    fn downgrade_topup_req() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let credential = CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap();
+        let top_up_message = v4::topup::TopUpMessage {
+            pub_key,
+            credential: credential.clone(),
+        };
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let (msg, _) =
+            v4::request::AuthenticatorRequest::new_topup_request(top_up_message, reply_to);
+        let downgraded_msg = v3::request::AuthenticatorRequest::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(Box::new(
+                v3::topup::TopUpMessage {
+                    pub_key,
+                    credential
+                }
+            ))
+        );
+    }
+
+    #[test]
+    fn upgrade_pending_reg_resp() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let nonce = 42;
+        let wg_port = 51822;
+        let gateway_data = v3::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            ipv4.into(),
+            nonce,
+        );
+        let registration_data = v3::registration::RegistrationData {
+            nonce,
+            gateway_data,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_pending_registration_success(
+            registration_data,
+            request_id,
+            reply_to,
+        );
+        assert!(v4::response::AuthenticatorResponse::try_from(msg).is_err());
+    }
+
+    #[test]
+    fn downgrade_pending_reg_resp() {
+        let mut rng = rand::thread_rng();
+
+        let local_secret = PrivateKey::new(&mut rng);
+        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let private_ips =
+            v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::10").unwrap());
+        let nonce = 42;
+        let wg_port = 51822;
+        let gateway_data = v4::registration::GatewayClient::new(
+            &local_secret,
+            (&remote_secret).into(),
+            private_ips,
+            nonce,
+        );
+        let registration_data = v4::registration::RegistrationData {
+            nonce,
+            gateway_data,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_pending_registration_success(
+            registration_data,
+            request_id,
+            reply_to,
+        );
+        assert!(v3::response::AuthenticatorResponse::try_from(msg).is_err());
+    }
+
+    #[test]
+    fn upgrade_registered_resp() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let ipv4 = Ipv4Addr::from_str("10.1.10.10").unwrap();
+        let private_ips =
+            v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::a0a").unwrap());
+        let wg_port = 51822;
+        let registred_data = v3::registration::RegistredData {
+            pub_key,
+            private_ip: ipv4.into(),
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_registered(
+            registred_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v4::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v4::response::AuthenticatorResponseData::Registered(v4::response::RegisteredResponse {
+                request_id,
+                reply_to,
+                reply: v4::registration::RegistredData {
+                    wg_port,
+                    pub_key,
+                    private_ips
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn downgrade_registered_resp() {
+        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
+        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
+        let private_ips =
+            v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::10").unwrap());
+        let wg_port = 51822;
+        let registred_data = v4::registration::RegistredData {
+            pub_key,
+            private_ips,
+            wg_port,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_registered(
+            registred_data,
+            reply_to,
+            request_id,
+        );
+        let downgraded_msg = v3::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
+                request_id,
+                reply_to,
+                reply: v3::registration::RegistredData {
+                    wg_port,
+                    pub_key,
+                    private_ip: ipv4.into()
+                }
+            })
+        );
+    }
+
+    #[test]
+    fn upgrade_remaining_bandwidth_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = Some(v3::registration::RemainingBandwidthData {
+            available_bandwidth,
+        });
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v3::response::AuthenticatorResponse::new_remaining_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        let upgraded_msg = v4::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            upgraded_msg.protocol,
+            Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            upgraded_msg.data,
+            v4::response::AuthenticatorResponseData::RemainingBandwidth(
+                v4::response::RemainingBandwidthResponse {
+                    request_id,
+                    reply_to,
+                    reply: Some(v4::registration::RemainingBandwidthData {
+                        available_bandwidth,
+                    })
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn downgrade_remaining_bandwidth_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = Some(v4::registration::RemainingBandwidthData {
+            available_bandwidth,
+        });
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_remaining_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        let downgraded_msg = v3::response::AuthenticatorResponse::try_from(msg).unwrap();
+
+        assert_eq!(
+            downgraded_msg.protocol,
+            Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator
+            }
+        );
+        assert_eq!(
+            downgraded_msg.data,
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                v3::response::RemainingBandwidthResponse {
+                    request_id,
+                    reply_to,
+                    reply: Some(v3::registration::RemainingBandwidthData {
+                        available_bandwidth,
+                    })
+                }
+            )
+        );
+    }
+
+    #[test]
+    fn downgrade_topup_resp() {
+        let available_bandwidth = 42;
+        let remaining_bandwidth_data = v4::registration::RemainingBandwidthData {
+            available_bandwidth,
+        };
+        let request_id = 123;
+        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
+
+        let msg = v4::response::AuthenticatorResponse::new_topup_bandwidth(
+            remaining_bandwidth_data,
+            reply_to,
+            request_id,
+        );
+        assert!(v3::response::AuthenticatorResponse::try_from(msg).is_err());
+    }
+}
@@ -42,6 +42,12 @@ impl IpPair {
    }
 }

+impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
+    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
 impl fmt::Display for IpPair {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "({}, {})", self.ipv4, self.ipv6)
@@ -75,7 +81,7 @@ impl From<IpAddr> for IpPair {
    }
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct InitMessage {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -87,7 +93,7 @@ impl InitMessage {
    }
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct FinalMessage {
    /// Gateway client data
    pub gateway_client: GatewayClient,
@@ -96,28 +102,28 @@ pub struct FinalMessage {
    pub credential: Option<CredentialSpendingData>,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistrationData {
    pub nonce: u64,
    pub gateway_data: GatewayClient,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RegistredData {
    pub pub_key: PeerPublicKey,
    pub private_ips: IpPair,
    pub wg_port: u16,
 }

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct RemainingBandwidthData {
    pub available_bandwidth: i64,
 }

 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct GatewayClient {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -193,7 +199,7 @@ impl GatewayClient {

 // TODO: change the inner type into generic array of size HmacSha256::OutputSize
 // TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct ClientMac(Vec<u8>);

 impl fmt::Display for ClientMac {
@@ -20,7 +20,7 @@ fn generate_random() -> u64 {
    rng.next_u64()
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct AuthenticatorRequest {
    pub protocol: Protocol,
    pub data: AuthenticatorRequestData,
@@ -106,7 +106,7 @@ impl AuthenticatorRequest {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorRequestData {
    Initial(InitMessage),
    Final(Box<FinalMessage>),
@@ -10,7 +10,7 @@ use crate::make_bincode_serializer;

 use super::VERSION;

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct AuthenticatorResponse {
    pub protocol: Protocol,
    pub data: AuthenticatorResponseData,
@@ -120,7 +120,7 @@ impl AuthenticatorResponse {
    }
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub enum AuthenticatorResponseData {
    PendingRegistration(PendingRegistrationResponse),
    Registered(RegisteredResponse),
@@ -128,28 +128,28 @@ pub enum AuthenticatorResponseData {
    TopUpBandwidth(TopUpBandwidthResponse),
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct PendingRegistrationResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistrationData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RegisteredResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: RegistredData,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RemainingBandwidthResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
    pub reply: Option<RemainingBandwidthData>,
 }

-#[derive(Clone, Debug, Serialize, Deserialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct TopUpBandwidthResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
@@ -5,7 +5,7 @@ use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};

-#[derive(Serialize, Deserialize, Debug, Clone)]
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
 pub struct TopUpMessage {
    /// Base64 encoded x25519 public key
    pub pub_key: PeerPublicKey,
@@ -17,7 +17,7 @@ use nym_validator_client::coconut::all_ecash_api_clients;
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::EcashSigningClient;
 use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, EcashQueryClient};
-use nym_validator_client::nyxd::cosmwasm_client::ToSingletonContractData;
+use nym_validator_client::nyxd::cosmwasm_client::ContractResponseData;
 use nym_validator_client::EcashApiClient;
 use rand::rngs::OsRng;

@@ -15,7 +15,6 @@ const-str = { workspace = true }
 log = { workspace = true }
 pretty_env_logger = { workspace = true }
 schemars = { workspace = true, features = ["preserve_order"], optional = true }
-semver.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }

@@ -44,5 +43,5 @@ tracing = [
    "tracing-opentelemetry",
    "opentelemetry",
 ]
-clap = [ "dep:clap", "dep:clap_complete", "dep:clap_complete_fig" ]
+clap = ["dep:clap", "dep:clap_complete", "dep:clap_complete_fig"]
 models = []
@@ -3,7 +3,6 @@

 pub mod build_information;
 pub mod logging;
-pub mod version_checker;

 #[cfg(feature = "clap")]
 pub mod completions;
@@ -47,6 +47,7 @@ pub fn setup_logging() {
 #[cfg(feature = "basic_tracing")]
 pub fn setup_tracing_logger() {
    let log_builder = tracing_subscriber::fmt()
+        .with_writer(std::io::stderr)
        // Use a more compact, abbreviated log format
        .compact()
        // Display source code file paths
@@ -1,78 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-pub use semver::Version;
-
-/// Checks if the version is minor version compatible.
-///
-/// Checks whether given `version` is compatible with a given semantic version requirement `req`
-/// according to major-minor semver rules. The semantic version requirement can be passed as a full,
-/// concrete version number, because that's what we'll have in our Cargo.toml files (e.g. 0.3.2).
-/// The patch number in the requirement gets dropped and replaced with a wildcard (0.3.*) as all
-/// minor versions should be compatible with each other.
-pub fn is_minor_version_compatible(version: &str, req: &str) -> bool {
-    let expected_version = match Version::parse(version) {
-        Ok(v) => v,
-        Err(_) => return false,
-    };
-    let req_version = match Version::parse(req) {
-        Ok(v) => v,
-        Err(_) => return false,
-    };
-
-    expected_version.major == req_version.major && expected_version.minor == req_version.minor
-}
-
-pub fn parse_version(raw_version: &str) -> Result<Version, semver::Error> {
-    Version::parse(raw_version)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn version_0_3_0_is_compatible_with_requirement_0_3_x() {
-        assert!(is_minor_version_compatible("0.3.0", "0.3.2"));
-    }
-
-    #[test]
-    fn version_0_3_1_is_compatible_with_minimum_requirement_0_3_x() {
-        assert!(is_minor_version_compatible("0.3.1", "0.3.2"));
-    }
-
-    #[test]
-    fn version_0_3_2_is_compatible_with_minimum_requirement_0_3_x() {
-        assert!(is_minor_version_compatible("0.3.2", "0.3.0"));
-    }
-
-    #[test]
-    fn version_0_2_0_is_not_compatible_with_requirement_0_3_x() {
-        assert!(!is_minor_version_compatible("0.2.0", "0.3.2"));
-    }
-
-    #[test]
-    fn version_0_4_0_is_not_compatible_with_requirement_0_3_x() {
-        assert!(!is_minor_version_compatible("0.4.0", "0.3.2"));
-    }
-
-    #[test]
-    fn version_1_3_2_is_not_compatible_with_requirement_0_3_x() {
-        assert!(!is_minor_version_compatible("1.3.2", "0.3.2"));
-    }
-
-    #[test]
-    fn version_0_4_0_rc_1_is_compatible_with_version_0_4_0_rc_1() {
-        assert!(is_minor_version_compatible("0.4.0-rc.1", "0.4.0-rc.1"));
-    }
-
-    #[test]
-    fn returns_false_on_foo_version() {
-        assert!(!is_minor_version_compatible("foo", "0.3.2"));
-    }
-
-    #[test]
-    fn returns_false_on_bar_version() {
-        assert!(!is_minor_version_compatible("0.3.2", "bar"));
-    }
-}
@@ -3,7 +3,7 @@ name = "nym-client-core"
 version = "1.1.15"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.70"
+rust-version = "1.76"
 license.workspace = true

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -45,7 +45,8 @@ nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-statistics-common = { path = "../statistics" }
 nym-pemstore = { path = "../pemstore" }
-nym-topology = { path = "../topology", features = ["serializable"] }
+nym-topology = { path = "../topology", features = ["persistence"] }
+nym-mixnet-client = { path = "../client-libs/mixnet-client", default-features = false }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-task = { path = "../task" }
 nym-credentials-interface = { path = "../credentials-interface" }
@@ -393,13 +393,20 @@ pub struct Traffic {
    /// poisson distribution.
    pub disable_main_poisson_packet_distribution: bool,

+    /// Specify whether route selection should be determined by the packet header.
+    pub deterministic_route_selection: bool,
+
+    /// Specify how many times particular packet can be retransmitted
+    /// None - no limit
+    pub maximum_number_of_retransmissions: Option<u32>,
+
    /// Specifies the packet size used for sent messages.
    /// Do not override it unless you understand the consequences of that change.
    pub primary_packet_size: PacketSize,

    /// Specifies the optional auxiliary packet size for optimizing message streams.
    /// Note that its use decreases overall anonymity.
-    /// Do not set it it unless you understand the consequences of that change.
+    /// Do not set it unless you understand the consequences of that change.
    pub secondary_packet_size: Option<PacketSize>,

    pub packet_type: PacketType,
@@ -424,6 +431,8 @@ impl Default for Traffic {
            average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
            message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
            disable_main_poisson_packet_distribution: false,
+            deterministic_route_selection: false,
+            maximum_number_of_retransmissions: None,
            primary_packet_size: PacketSize::RegularPacket,
            secondary_packet_size: None,
            packet_type: PacketType::Mix,
@@ -541,6 +550,15 @@ pub struct Topology {
    /// Specifies a minimum performance of a gateway that is used on route construction.
    /// This setting is only applicable when `NymApi` topology is used.
    pub minimum_gateway_performance: u8,
+
+    /// Specifies whether this client should attempt to retrieve all available network nodes
+    /// as opposed to just active mixnodes/gateways.
+    /// Useless without `ignore_epoch_roles = true`
+    pub use_extended_topology: bool,
+
+    /// Specifies whether this client should ignore the current epoch role of the target egress node
+    /// when constructing the final hop packets.
+    pub ignore_egress_epoch_role: bool,
 }

 #[allow(clippy::large_enum_variant)]
@@ -577,6 +595,8 @@ impl Default for Topology {
            topology_structure: TopologyStructure::default(),
            minimum_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
            minimum_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
+            use_extended_topology: false,
+            ignore_egress_epoch_role: false,
        }
    }
 }
@@ -111,6 +111,7 @@ impl From<ConfigV5> for Config {
                    primary_packet_size: value.debug.traffic.primary_packet_size,
                    secondary_packet_size: value.debug.traffic.secondary_packet_size,
                    packet_type: value.debug.traffic.packet_type,
+                    ..Default::default()
                },
                cover_traffic: CoverTraffic {
                    loop_cover_traffic_average_delay: value
@@ -8,7 +8,10 @@ use crate::{
    },
 };
 use log::{debug, error};
-use sqlx::ConnectOptions;
+use sqlx::{
+    sqlite::{SqliteAutoVacuum, SqliteSynchronous},
+    ConnectOptions,
+};
 use std::path::Path;

 #[derive(Debug, Clone)]
@@ -30,6 +33,9 @@ impl StorageManager {
        }

        let opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
+            .synchronous(SqliteSynchronous::Normal)
+            .auto_vacuum(SqliteAutoVacuum::Incremental)
            .filename(database_path)
            .create_if_missing(true)
            .disable_statement_logging();
@@ -110,7 +116,7 @@ impl StorageManager {
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) 
+                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type)
                VALUES (?, ?, ?)
            "#,
            registered_gateway.gateway_id_bs58,
@@ -224,7 +230,7 @@ impl StorageManager {
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                INSERT INTO custom_gateway_details(gateway_id_bs58, data) 
+                INSERT INTO custom_gateway_details(gateway_id_bs58, data)
                VALUES (?, ?)
            "#,
            custom.gateway_id_bs58,
@@ -15,6 +15,7 @@ pub mod error;
 mod manager;
 mod models;

+#[derive(Clone)]
 pub struct OnDiskGatewaysDetails {
    manager: StorageManager,
 }
@@ -20,12 +20,12 @@ pub enum InMemStorageError {
    MalformedGateway(#[from] BadGateway),
 }

-#[derive(Debug, Default)]
+#[derive(Clone, Debug, Default)]
 pub struct InMemGatewaysDetails {
    inner: Arc<RwLock<InMemStorageInner>>,
 }

-#[derive(Debug, Default)]
+#[derive(Clone, Debug, Default)]
 struct InMemStorageInner {
    active_gateway: Option<String>,
    gateways: HashMap<String, GatewayRegistration>,
@@ -112,18 +112,23 @@ where
                source,
            }
        })?;
-        hardcoded_topology.get_gateways()
+        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
        let mut rng = rand::thread_rng();
-        crate::init::helpers::current_gateways(&mut rng, &core.client.nym_api_urls, user_agent)
-            .await?
+        crate::init::helpers::current_gateways(
+            &mut rng,
+            &core.client.nym_api_urls,
+            user_agent,
+            core.debug.topology.minimum_gateway_performance,
+        )
+        .await?
    };

    // since we're registering with a brand new gateway,
    // make sure the list of available gateways doesn't overlap the list of known gateways
    let available_gateways = available_gateways
        .into_iter()
-        .filter(|g| !registered_gateways.contains(g.identity()))
+        .filter(|g| !registered_gateways.contains(&g.identity()))
        .collect::<Vec<_>>();

    if available_gateways.is_empty() {
@@ -167,11 +167,16 @@ where
                source,
            }
        })?;
-        hardcoded_topology.get_gateways()
+        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
        let mut rng = rand::thread_rng();
-        crate::init::helpers::current_gateways(&mut rng, &core.client.nym_api_urls, user_agent)
-            .await?
+        crate::init::helpers::current_gateways(
+            &mut rng,
+            &core.client.nym_api_urls,
+            user_agent,
+            core.debug.topology.minimum_gateway_performance,
+        )
+        .await?
    };

    let gateway_setup = GatewaySetup::New {
@@ -3,7 +3,6 @@

 use super::received_buffer::ReceivedBufferMessage;
 use super::statistics_control::StatisticsControl;
-use super::topology_control::geo_aware_provider::GeoAwareTopologyProvider;
 use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
@@ -24,7 +23,7 @@ use crate::client::replies::reply_storage::{
 };
 use crate::client::topology_control::nym_api_provider::NymApiTopologyProvider;
 use crate::client::topology_control::{
-    nym_api_provider, TopologyAccessor, TopologyRefresher, TopologyRefresherConfig,
+    TopologyAccessor, TopologyRefresher, TopologyRefresherConfig,
 };
 use crate::config::{Config, DebugConfig};
 use crate::error::ClientCoreError;
@@ -32,7 +31,7 @@ use crate::init::{
    setup_gateway,
    types::{GatewaySetup, InitialisationResult},
 };
-use crate::{config, spawn_future};
+use crate::{config, spawn_future, ForgetMe};
 use futures::channel::mpsc;
 use log::*;
 use nym_bandwidth_controller::BandwidthController;
@@ -188,6 +187,11 @@ pub struct BaseClientBuilder<'a, C, S: MixnetClientStorage> {
    user_agent: Option<UserAgent>,

    setup_method: GatewaySetup,
+
+    #[cfg(unix)]
+    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+
+    forget_me: ForgetMe,
 }

 impl<'a, C, S> BaseClientBuilder<'a, C, S>
@@ -210,9 +214,18 @@ where
            shutdown: None,
            user_agent: None,
            setup_method: GatewaySetup::MustLoad { gateway_id: None },
+            #[cfg(unix)]
+            connection_fd_callback: None,
+            forget_me: Default::default(),
        }
    }

+    #[must_use]
+    pub fn with_forget_me(mut self, forget_me: &ForgetMe) -> Self {
+        self.forget_me = forget_me.clone();
+        self
+    }
+
    #[must_use]
    pub fn with_gateway_setup(mut self, setup: GatewaySetup) -> Self {
        self.setup_method = setup;
@@ -261,6 +274,15 @@ where
        Ok(self)
    }

+    #[cfg(unix)]
+    pub fn with_connection_fd_callback(
+        mut self,
+        callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+    ) -> Self {
+        self.connection_fd_callback = Some(callback);
+        self
+    }
+
    // note: do **NOT** make this method public as its only valid usage is from within `start_base`
    // because it relies on the crypto keys being already loaded
    fn mix_address(details: &InitialisationResult) -> Recipient {
@@ -352,6 +374,7 @@ where
        controller.start_with_shutdown(shutdown)
    }

+    #[allow(clippy::too_many_arguments)]
    async fn start_gateway_client(
        config: &Config,
        initialisation_result: InitialisationResult,
@@ -359,6 +382,7 @@ where
        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
+        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
        shutdown: TaskClient,
    ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
    where
@@ -401,6 +425,8 @@ where
                    packet_router,
                    bandwidth_controller,
                    stats_reporter,
+                    #[cfg(unix)]
+                    connection_fd_callback,
                    shutdown,
                )
            };
@@ -437,8 +463,8 @@ where
            details_store
                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
                .await.map_err(|err| {
-                    error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
-                    ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+                error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
            })?
        }

@@ -462,6 +488,7 @@ where
        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
+        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
        mut shutdown: TaskClient,
    ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
    where
@@ -493,6 +520,8 @@ where
            details_store,
            packet_router,
            stats_reporter,
+            #[cfg(unix)]
+            connection_fd_callback,
            shutdown,
        )
        .await?;
@@ -509,20 +538,15 @@ where
        // if no custom provider was ... provided ..., create one using nym-api
        custom_provider.unwrap_or_else(|| match config_topology.topology_structure {
            config::TopologyStructure::NymApi => Box::new(NymApiTopologyProvider::new(
-                nym_api_provider::Config {
-                    min_mixnode_performance: config_topology.minimum_mixnode_performance,
-                    min_gateway_performance: config_topology.minimum_gateway_performance,
-                },
+                config_topology,
                nym_api_urls,
-                env!("CARGO_PKG_VERSION").to_string(),
                user_agent,
            )),
            config::TopologyStructure::GeoAware(group_by) => {
-                Box::new(GeoAwareTopologyProvider::new(
-                    nym_api_urls,
-                    env!("CARGO_PKG_VERSION").to_string(),
-                    group_by,
-                ))
+                warn!("using deprecated 'GeoAware' topology provider - this option will be removed very soon");
+
+                #[allow(deprecated)]
+                Box::new(crate::client::topology_control::GeoAwareTopologyProvider::new(nym_api_urls, group_by))
            }
        })
    }
@@ -533,7 +557,7 @@ where
        topology_provider: Box<dyn TopologyProvider + Send + Sync>,
        topology_config: config::Topology,
        topology_accessor: TopologyAccessor,
-        local_gateway: &NodeIdentity,
+        local_gateway: NodeIdentity,
        wait_for_gateway: bool,
        mut shutdown: TaskClient,
    ) -> Result<(), ClientCoreError> {
@@ -565,7 +589,7 @@ where
        };

        if let Err(err) = topology_refresher
-            .ensure_contains_gateway(local_gateway)
+            .ensure_contains_routable_egress(local_gateway)
            .await
        {
            if let Some(waiting_timeout) = gateway_wait_timeout {
@@ -620,9 +644,11 @@ where
    fn start_mix_traffic_controller(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
        shutdown: TaskClient,
+        forget_me: ForgetMe,
    ) -> BatchMixMessageSender {
        info!("Starting mix traffic controller...");
-        let (mix_traffic_controller, mix_tx) = MixTrafficController::new(gateway_transceiver);
+        let (mix_traffic_controller, mix_tx) =
+            MixTrafficController::new(gateway_transceiver, forget_me);
        mix_traffic_controller.start_with_shutdown(shutdown);
        mix_tx
    }
@@ -713,7 +739,8 @@ where

        // channels responsible for controlling ack messages
        let (ack_sender, ack_receiver) = mpsc::unbounded();
-        let shared_topology_accessor = TopologyAccessor::new();
+        let shared_topology_accessor =
+            TopologyAccessor::new(self.config.debug.topology.ignore_egress_epoch_role);

        // Shutdown notifier for signalling tasks to stop
        let shutdown = self
@@ -777,6 +804,8 @@ where
            &details_store,
            gateway_packet_router,
            stats_reporter.clone(),
+            #[cfg(unix)]
+            self.connection_fd_callback,
            shutdown.fork("gateway_transceiver"),
        )
        .await?;
@@ -802,9 +831,11 @@ where
        // that are to be sent to the mixnet. They are used by cover traffic stream and real
        // traffic stream.
        // The MixTrafficController then sends the actual traffic
+
        let message_sender = Self::start_mix_traffic_controller(
            gateway_transceiver,
            shutdown.fork("mix_traffic_controller"),
+            self.forget_me,
        );

        // Channels that the websocket listener can use to signal downstream to the real traffic
@@ -4,6 +4,8 @@
 // TODO: combine those more closely. Perhaps into a single underlying store.
 // Like for persistent, on-disk, storage, what's the point of having 3 different databases?

+use rand::rngs::OsRng;
+
 use crate::client::key_manager::persistence::{InMemEphemeralKeys, KeyStore};
 use crate::client::replies::reply_storage;
 use crate::client::replies::reply_storage::ReplyStorageBackend;
@@ -63,7 +65,7 @@ pub trait MixnetClientStorage {
    fn gateway_details_store(&self) -> &Self::GatewaysDetailsStore;
 }

-#[derive(Default)]
+#[derive(Clone)]
 pub struct Ephemeral {
    key_store: InMemEphemeralKeys,
    reply_store: reply_storage::Empty,
@@ -71,9 +73,14 @@ pub struct Ephemeral {
    gateway_details_store: InMemGatewaysDetails,
 }

-impl Ephemeral {
-    pub fn new() -> Self {
-        Default::default()
+impl Default for Ephemeral {
+    fn default() -> Self {
+        Ephemeral {
+            key_store: InMemEphemeralKeys::new(&mut OsRng),
+            reply_store: Default::default(),
+            credential_store: Default::default(),
+            gateway_details_store: Default::default(),
+        }
    }
 }

@@ -114,6 +121,7 @@ impl MixnetClientStorage for Ephemeral {
    }
 }

+#[derive(Clone)]
 #[cfg(all(
    not(target_arch = "wasm32"),
    feature = "fs-surb-storage",
@@ -163,6 +163,7 @@ impl LoopCoverTrafficStream<OsRng> {
        // poisson delay, but is it really a problem?
        let topology_permit = self.topology_access.get_read_permit().await;
        // the ack is sent back to ourselves (and then ignored)
+
        let topology_ref = match topology_permit.try_get_valid_topology_ref(
            &self.our_full_destination,
            Some(&self.our_full_destination),
@@ -28,7 +28,6 @@ pub enum InputMessage {
        recipient: Recipient,
        data: Vec<u8>,
        lane: TransmissionLane,
-        mix_hops: Option<u8>,
    },

    /// Creates a message used for a duplex anonymous communication where the recipient
@@ -44,7 +43,6 @@ pub enum InputMessage {
        data: Vec<u8>,
        reply_surbs: u32,
        lane: TransmissionLane,
-        mix_hops: Option<u8>,
    },

    /// Attempt to use our internally received and stored `ReplySurb` to send the message back
@@ -94,29 +92,6 @@ impl InputMessage {
            recipient,
            data,
            lane,
-            mix_hops: None,
-        };
-        if let Some(packet_type) = packet_type {
-            InputMessage::new_wrapper(message, packet_type)
-        } else {
-            message
-        }
-    }
-
-    // IMHO `new_regular` should take `mix_hops: Option<u8>` as an argument instead of creating
-    // this function, but that would potentially break backwards compatibility with the current API
-    pub fn new_regular_with_custom_hops(
-        recipient: Recipient,
-        data: Vec<u8>,
-        lane: TransmissionLane,
-        packet_type: Option<PacketType>,
-        mix_hops: Option<u8>,
-    ) -> Self {
-        let message = InputMessage::Regular {
-            recipient,
-            data,
-            lane,
-            mix_hops,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -137,7 +112,6 @@ impl InputMessage {
            data,
            reply_surbs,
            lane,
-            mix_hops: None,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -154,14 +128,12 @@ impl InputMessage {
        reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: Option<PacketType>,
-        mix_hops: Option<u8>,
    ) -> Self {
        let message = InputMessage::Anonymous {
            recipient,
            data,
            reply_surbs,
            lane,
-            mix_hops,
        };
        if let Some(packet_type) = packet_type {
            InputMessage::new_wrapper(message, packet_type)
@@ -3,7 +3,9 @@

 use crate::client::key_manager::ClientKeys;
 use async_trait::async_trait;
+use rand::{CryptoRng, RngCore};
 use std::error::Error;
+use std::sync::Arc;
 use tokio::sync::Mutex;

 #[cfg(not(target_arch = "wasm32"))]
@@ -64,6 +66,7 @@ pub enum OnDiskKeysError {
    },
 }

+#[derive(Clone)]
 #[cfg(not(target_arch = "wasm32"))]
 pub struct OnDiskKeys {
    paths: ClientKeysPaths,
@@ -193,9 +196,20 @@ impl KeyStore for OnDiskKeys {
    }
 }

-#[derive(Default)]
+#[derive(Clone)]
 pub struct InMemEphemeralKeys {
-    keys: Mutex<Option<ClientKeys>>,
+    keys: Arc<Mutex<ClientKeys>>,
+}
+
+impl InMemEphemeralKeys {
+    pub fn new<R>(rng: &mut R) -> Self
+    where
+        R: RngCore + CryptoRng,
+    {
+        InMemEphemeralKeys {
+            keys: Arc::new(Mutex::new(ClientKeys::generate_new(rng))),
+        }
+    }
 }

 #[derive(Debug, thiserror::Error)]
@@ -208,11 +222,11 @@ impl KeyStore for InMemEphemeralKeys {
    type StorageError = EphemeralKeysError;

    async fn load_keys(&self) -> Result<ClientKeys, Self::StorageError> {
-        self.keys.lock().await.clone().ok_or(EphemeralKeysError)
+        Ok(self.keys.lock().await.clone())
    }

    async fn store_keys(&self, keys: &ClientKeys) -> Result<(), Self::StorageError> {
-        *self.keys.lock().await = Some(keys.clone());
+        *self.keys.lock().await = keys.clone();
        Ok(())
    }
 }
@@ -2,8 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::client::mix_traffic::transceiver::GatewayTransceiver;
-use crate::spawn_future;
+use crate::{spawn_future, ForgetMe};
 use log::*;
+use nym_gateway_requests::ClientRequest;
 use nym_sphinx::forwarding::packet::MixPacket;

 pub type BatchMixMessageSender = tokio::sync::mpsc::Sender<Vec<MixPacket>>;
@@ -26,10 +27,14 @@ pub struct MixTrafficController {
    // TODO: this is temporary work-around.
    // in long run `gateway_client` will be moved away from `MixTrafficController` anyway.
    consecutive_gateway_failure_count: usize,
+    forget_me: ForgetMe,
 }

 impl MixTrafficController {
-    pub fn new<T>(gateway_transceiver: T) -> (MixTrafficController, BatchMixMessageSender)
+    pub fn new<T>(
+        gateway_transceiver: T,
+        forget_me: ForgetMe,
+    ) -> (MixTrafficController, BatchMixMessageSender)
    where
        T: GatewayTransceiver + Send + 'static,
    {
@@ -40,6 +45,7 @@ impl MixTrafficController {
                gateway_transceiver: Box::new(gateway_transceiver),
                mix_rx: message_receiver,
                consecutive_gateway_failure_count: 0,
+                forget_me,
            },
            message_sender,
        )
@@ -47,6 +53,7 @@ impl MixTrafficController {

    pub fn new_dynamic(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
+        forget_me: ForgetMe,
    ) -> (MixTrafficController, BatchMixMessageSender) {
        let (message_sender, message_receiver) =
            tokio::sync::mpsc::channel(MIX_MESSAGE_RECEIVER_BUFFER_SIZE);
@@ -55,6 +62,7 @@ impl MixTrafficController {
                gateway_transceiver,
                mix_rx: message_receiver,
                consecutive_gateway_failure_count: 0,
+                forget_me,
            },
            message_sender,
        )
@@ -111,7 +119,27 @@ impl MixTrafficController {
                }
            }
            shutdown.recv_timeout().await;
+
+            if self.forget_me.any() {
+                log::info!("Sending forget me request to the gateway");
+                match self
+                    .gateway_transceiver
+                    .send_client_request(ClientRequest::ForgetMe {
+                        client: self.forget_me.client(),
+                        stats: self.forget_me.stats(),
+                    })
+                    .await
+                {
+                    Ok(_) => {
+                        log::info!("Successfully sent forget me request to the gateway");
+                    }
+                    Err(err) => {
+                        log::error!("Failed to send forget me request to the gateway: {err}");
+                    }
+                }
+            }
+
            log::debug!("MixTrafficController: Exiting");
-        })
+        });
    }
 }
@@ -5,8 +5,10 @@ use async_trait::async_trait;
 use log::{debug, error};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::identity;
+use nym_gateway_client::error::GatewayClientError;
 use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
+use nym_gateway_requests::ClientRequest;
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
@@ -14,7 +16,7 @@ use std::os::raw::c_int as RawFd;
 use thiserror::Error;

 #[cfg(not(target_arch = "wasm32"))]
-use futures::channel::{mpsc, oneshot};
+use futures::channel::oneshot;

 // we need to type erase the error type since we can't have dynamic associated types alongside dynamic dispatch
 #[derive(Debug, Error)]
@@ -26,9 +28,14 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
 }

 /// This combines combines the functionalities of being able to send and receive mix packets.
+#[async_trait]
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
    fn gateway_identity(&self) -> identity::PublicKey;
    fn ws_fd(&self) -> Option<RawFd>;
+    async fn send_client_request(
+        &mut self,
+        message: ClientRequest,
+    ) -> Result<(), GatewayClientError>;
 }

 /// This trait defines the functionality of sending `MixPacket` into the mixnet,
@@ -65,6 +72,7 @@ pub trait GatewayReceiver {
 }

 // to allow for dynamic dispatch
+#[async_trait]
 impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
    #[inline]
    fn gateway_identity(&self) -> identity::PublicKey {
@@ -73,6 +81,13 @@ impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
    fn ws_fd(&self) -> Option<RawFd> {
        (**self).ws_fd()
    }
+
+    async fn send_client_request(
+        &mut self,
+        message: ClientRequest,
+    ) -> Result<(), GatewayClientError> {
+        (**self).send_client_request(message).await
+    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -91,7 +106,6 @@ impl<G: GatewaySender + ?Sized + Send> GatewaySender for Box<G> {
        (**self).batch_send_mix_packets(packets).await
    }
 }
-
 impl<G: GatewayReceiver + ?Sized> GatewayReceiver for Box<G> {
    #[inline]
    fn set_packet_router(&mut self, packet_router: PacketRouter) -> Result<(), ErasedGatewayError> {
@@ -111,6 +125,7 @@ impl<C, St> RemoteGateway<C, St> {
    }
 }

+#[async_trait]
 impl<C, St> GatewayTransceiver for RemoteGateway<C, St>
 where
    C: DkgQueryClient + Send + Sync,
@@ -123,6 +138,20 @@ where
    fn ws_fd(&self) -> Option<RawFd> {
        self.gateway_client.ws_fd()
    }
+
+    async fn send_client_request(
+        &mut self,
+        message: ClientRequest,
+    ) -> Result<(), GatewayClientError> {
+        if let Some(shared_key) = self.gateway_client.shared_key() {
+            self.gateway_client
+                .send_websocket_message(message.encrypt(&*shared_key)?)
+                .await?;
+            Ok(())
+        } else {
+            Err(GatewayClientError::ConnectionInInvalidState)
+        }
+    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -170,7 +199,7 @@ pub struct LocalGateway {

    // 'sender' part
    /// Channel responsible for taking mix packets and forwarding them further into the further mixnet layers.
-    packet_forwarder: mpsc::UnboundedSender<MixPacket>,
+    packet_forwarder: nym_mixnet_client::forwarder::MixForwardingSender,

    // 'receiver' part
    packet_router_tx: Option<oneshot::Sender<PacketRouter>>,
@@ -180,7 +209,7 @@ pub struct LocalGateway {
 impl LocalGateway {
    pub fn new(
        local_identity: identity::PublicKey,
-        packet_forwarder: mpsc::UnboundedSender<MixPacket>,
+        packet_forwarder: nym_mixnet_client::forwarder::MixForwardingSender,
        packet_router_tx: oneshot::Sender<PacketRouter>,
    ) -> Self {
        LocalGateway {
@@ -195,6 +224,7 @@ impl LocalGateway {
 mod nonwasm_sealed {
    use super::*;

+    #[async_trait]
    impl GatewayTransceiver for LocalGateway {
        fn gateway_identity(&self) -> identity::PublicKey {
            self.local_identity
@@ -202,14 +232,20 @@ mod nonwasm_sealed {
        fn ws_fd(&self) -> Option<RawFd> {
            None
        }
+
+        async fn send_client_request(
+            &mut self,
+            _message: ClientRequest,
+        ) -> Result<(), GatewayClientError> {
+            Ok(())
+        }
    }

    #[async_trait]
    impl GatewaySender for LocalGateway {
        async fn send_mix_packet(&mut self, packet: MixPacket) -> Result<(), ErasedGatewayError> {
            self.packet_forwarder
-                .unbounded_send(packet)
-                .map_err(|err| err.into_send_error())
+                .forward_packet(packet)
                .map_err(erase_err)
        }
    }
@@ -270,6 +306,7 @@ impl GatewaySender for MockGateway {
    }
 }

+#[async_trait]
 impl GatewayTransceiver for MockGateway {
    fn gateway_identity(&self) -> identity::PublicKey {
        self.dummy_identity
@@ -277,4 +314,11 @@ impl GatewayTransceiver for MockGateway {
    fn ws_fd(&self) -> Option<RawFd> {
        None
    }
+
+    async fn send_client_request(
+        &mut self,
+        _message: ClientRequest,
+    ) -> Result<(), GatewayClientError> {
+        Ok(())
+    }
 }
@@ -30,7 +30,8 @@ pub(crate) enum Action {
    InsertPending(Vec<PendingAcknowledgement>),

    /// Removes given `PendingAcknowledgement` from the 'shared' state. Also cancels the retransmission timer.
-    /// Initiated by `AcknowledgementListener`
+    /// Initiated by `AcknowledgementListener` upon receiving the acknowledgement. Also by `RetransmissionRequestListener`
+    /// upon deciding to abandon the data.
    RemovePending(FragmentIdentifier),

    /// Starts the retransmission timer on given `PendingAcknowledgement` with the `Duration` based on
@@ -41,7 +42,7 @@ pub(crate) enum Action {

    /// Updates the expected delay of given `PendingAcknowledgement` with the new provided `SphinxDelay`.
    /// Initiated by `RetransmissionRequestListener`
-    UpdateDelay(FragmentIdentifier, SphinxDelay),
+    UpdatePendingAck(FragmentIdentifier, SphinxDelay),
 }

 impl Action {
@@ -57,8 +58,8 @@ impl Action {
        Action::StartTimer(frag_id)
    }

-    pub(crate) fn new_update_delay(frag_id: FragmentIdentifier, delay: SphinxDelay) -> Self {
-        Action::UpdateDelay(frag_id, delay)
+    pub(crate) fn new_update_pending_ack(frag_id: FragmentIdentifier, delay: SphinxDelay) -> Self {
+        Action::UpdatePendingAck(frag_id, delay)
    }
 }

@@ -135,7 +136,7 @@ impl ActionController {
    }

    fn handle_start_timer(&mut self, frag_id: FragmentIdentifier) {
-        trace!("{} is starting its timer", frag_id);
+        trace!("{frag_id} is starting its timer");

        if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.get_mut(&frag_id) {
            // the fact that this branch is now POSSIBLE is a sign of a need to refactor this whole
@@ -193,7 +194,7 @@ impl ActionController {

    // initiated basically as a first step of retransmission. At first data has its delay updated
    // (as new sphinx packet was created with new expected delivery time)
-    fn handle_update_delay(&mut self, frag_id: FragmentIdentifier, delay: SphinxDelay) {
+    fn handle_update_pending_ack(&mut self, frag_id: FragmentIdentifier, delay: SphinxDelay) {
        trace!("{} is updating its delay", frag_id);
        // TODO: is it possible to solve this without either locking or temporarily removing the value?
        if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.remove(&frag_id) {
@@ -202,7 +203,7 @@ impl ActionController {
            // reference to this Arc. HOWEVER, before the Action was pushed onto the queue, the reference
            // was dropped hence this unwrap is safe.
            let mut inner_data = Arc::try_unwrap(pending_ack_data).unwrap();
-            inner_data.update_delay(delay);
+            inner_data.update_retransmitted(delay);

            self.pending_acks_data
                .insert(frag_id, (Arc::new(inner_data), queue_key));
@@ -225,7 +226,7 @@ impl ActionController {
        // about it. Perhaps just reschedule it at later point?
        let frag_id = expired_ack.into_inner();

-        trace!("{} has expired", frag_id);
+        trace!("{frag_id} has expired");

        if let Some((pending_ack_data, queue_key)) = self.pending_acks_data.get_mut(&frag_id) {
            if queue_key.is_none() {
@@ -258,7 +259,9 @@ impl ActionController {
            Action::InsertPending(pending_acks) => self.handle_insert(pending_acks),
            Action::RemovePending(frag_id) => self.handle_remove(frag_id),
            Action::StartTimer(frag_id) => self.handle_start_timer(frag_id),
-            Action::UpdateDelay(frag_id, delay) => self.handle_update_delay(frag_id, delay),
+            Action::UpdatePendingAck(frag_id, delay) => {
+                self.handle_update_pending_ack(frag_id, delay)
+            }
        }
    }

@@ -73,11 +73,10 @@ where
        content: Vec<u8>,
        lane: TransmissionLane,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) {
        if let Err(err) = self
            .message_handler
-            .try_send_plain_message(recipient, content, lane, packet_type, mix_hops)
+            .try_send_plain_message(recipient, content, lane, packet_type)
            .await
        {
            warn!("failed to send a plain message - {err}")
@@ -91,18 +90,10 @@ where
        reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) {
        if let Err(err) = self
            .message_handler
-            .try_send_message_with_reply_surbs(
-                recipient,
-                content,
-                reply_surbs,
-                lane,
-                packet_type,
-                mix_hops,
-            )
+            .try_send_message_with_reply_surbs(recipient, content, reply_surbs, lane, packet_type)
            .await
        {
            warn!("failed to send a repliable message - {err}")
@@ -115,9 +106,8 @@ where
                recipient,
                data,
                lane,
-                mix_hops,
            } => {
-                self.handle_plain_message(recipient, data, lane, PacketType::Mix, mix_hops)
+                self.handle_plain_message(recipient, data, lane, PacketType::Mix)
                    .await
            }
            InputMessage::Anonymous {
@@ -125,17 +115,9 @@ where
                data,
                reply_surbs,
                lane,
-                mix_hops,
            } => {
-                self.handle_repliable_message(
-                    recipient,
-                    data,
-                    reply_surbs,
-                    lane,
-                    PacketType::Mix,
-                    mix_hops,
-                )
-                .await
+                self.handle_repliable_message(recipient, data, reply_surbs, lane, PacketType::Mix)
+                    .await
            }
            InputMessage::Reply {
                recipient_tag,
@@ -153,9 +135,8 @@ where
                    recipient,
                    data,
                    lane,
-                    mix_hops,
                } => {
-                    self.handle_plain_message(recipient, data, lane, packet_type, mix_hops)
+                    self.handle_plain_message(recipient, data, lane, packet_type)
                        .await
                }
                InputMessage::Anonymous {
@@ -163,17 +144,9 @@ where
                    data,
                    reply_surbs,
                    lane,
-                    mix_hops,
                } => {
-                    self.handle_repliable_message(
-                        recipient,
-                        data,
-                        reply_surbs,
-                        lane,
-                        packet_type,
-                        mix_hops,
-                    )
-                    .await
+                    self.handle_repliable_message(recipient, data, reply_surbs, lane, packet_type)
+                        .await
                }
                InputMessage::Reply {
                    recipient_tag,
@@ -70,7 +70,7 @@ pub(crate) struct PendingAcknowledgement {
    message_chunk: Fragment,
    delay: SphinxDelay,
    destination: PacketDestination,
-    mix_hops: Option<u8>,
+    retransmissions: u32,
 }

 impl PendingAcknowledgement {
@@ -79,13 +79,12 @@ impl PendingAcknowledgement {
        message_chunk: Fragment,
        delay: SphinxDelay,
        recipient: Recipient,
-        mix_hops: Option<u8>,
    ) -> Self {
        PendingAcknowledgement {
            message_chunk,
            delay,
            destination: PacketDestination::KnownRecipient(recipient.into()),
-            mix_hops,
+            retransmissions: 0,
        }
    }

@@ -102,9 +101,7 @@ impl PendingAcknowledgement {
                recipient_tag,
                extra_surb_request,
            },
-            // Messages sent using SURBs are using the number of mix hops set by the recipient when
-            // they provided the SURBs, so it doesn't make sense to include it here.
-            mix_hops: None,
+            retransmissions: 0,
        }
    }

@@ -116,8 +113,9 @@ impl PendingAcknowledgement {
        self.message_chunk.clone()
    }

-    fn update_delay(&mut self, new_delay: SphinxDelay) {
+    fn update_retransmitted(&mut self, new_delay: SphinxDelay) {
        self.delay = new_delay;
+        self.retransmissions += 1;
    }
 }

@@ -163,6 +161,9 @@ impl AcknowledgementControllerConnectors {

 /// Configurable parameters of the `AcknowledgementController`
 pub(super) struct Config {
+    /// Specify how many times particular packet can be retransmitted
+    maximum_retransmissions: Option<u32>,
+
    /// Given ack timeout in the form a * BASE_DELAY + b, it specifies the additive part `b`
    ack_wait_addition: Duration,

@@ -174,8 +175,13 @@ pub(super) struct Config {
 }

 impl Config {
-    pub(super) fn new(ack_wait_addition: Duration, ack_wait_multiplier: f64) -> Self {
+    pub(super) fn new(
+        maximum_retransmissions: Option<u32>,
+        ack_wait_addition: Duration,
+        ack_wait_multiplier: f64,
+    ) -> Self {
        Config {
+            maximum_retransmissions,
            ack_wait_addition,
            ack_wait_multiplier,
            packet_size: Default::default(),
@@ -238,6 +244,7 @@ where

        // will listen for any ack timeouts and trigger retransmission
        let retransmission_request_listener = RetransmissionRequestListener::new(
+            config.maximum_retransmissions,
            connectors.ack_action_sender.clone(),
            message_handler,
            retransmission_rx,
@@ -20,6 +20,7 @@ use std::sync::{Arc, Weak};

 // responsible for packet retransmission upon fired timer
 pub(super) struct RetransmissionRequestListener<R> {
+    maximum_retransmissions: Option<u32>,
    action_sender: AckActionSender,
    message_handler: MessageHandler<R>,
    request_receiver: RetransmissionRequestReceiver,
@@ -31,12 +32,14 @@ where
    R: CryptoRng + Rng,
 {
    pub(super) fn new(
+        maximum_retransmissions: Option<u32>,
        action_sender: AckActionSender,
        message_handler: MessageHandler<R>,
        request_receiver: RetransmissionRequestReceiver,
        reply_controller_sender: ReplyControllerSender,
    ) -> Self {
        RetransmissionRequestListener {
+            maximum_retransmissions,
            action_sender,
            message_handler,
            request_receiver,
@@ -49,18 +52,12 @@ where
        packet_recipient: Recipient,
        chunk_data: Fragment,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, PreparationError> {
        debug!("retransmitting normal packet...");

        // TODO: Figure out retransmission packet type signaling
        self.message_handler
-            .try_prepare_single_chunk_for_sending(
-                packet_recipient,
-                chunk_data,
-                packet_type,
-                mix_hops,
-            )
+            .try_prepare_single_chunk_for_sending(packet_recipient, chunk_data, packet_type)
            .await
    }

@@ -77,6 +74,18 @@ where
            }
        };

+        let frag_id = timed_out_ack.message_chunk.fragment_identifier();
+
+        if let Some(limit) = self.maximum_retransmissions {
+            if timed_out_ack.retransmissions >= limit {
+                warn!("reached maximum number of allowed retransmissions for the packet");
+                self.action_sender
+                    .unbounded_send(Action::new_remove(frag_id))
+                    .unwrap();
+                return;
+            }
+        }
+
        let maybe_prepared_fragment = match &timed_out_ack.destination {
            PacketDestination::Anonymous {
                recipient_tag,
@@ -95,14 +104,11 @@ where
                    **recipient,
                    timed_out_ack.message_chunk.clone(),
                    packet_type,
-                    timed_out_ack.mix_hops,
                )
                .await
            }
        };

-        let frag_id = timed_out_ack.message_chunk.fragment_identifier();
-
        let prepared_fragment = match maybe_prepared_fragment {
            Ok(prepared_fragment) => prepared_fragment,
            Err(err) => {
@@ -136,7 +142,7 @@ where
        // with the additional poisson delay.
        // And since Actions are executed in order `UpdateTimer` will HAVE TO be executed before `StartTimer`
        self.action_sender
-            .unbounded_send(Action::new_update_delay(frag_id, new_delay))
+            .unbounded_send(Action::new_update_pending_ack(frag_id, new_delay))
            .unwrap();

        // send to `OutQueueControl` to eventually send to the mix network
@@ -15,11 +15,11 @@ use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, RepliableMessa
 use nym_sphinx::anonymous_replies::{ReplySurb, SurbEncryptionKey};
 use nym_sphinx::chunking::fragment::{Fragment, FragmentIdentifier};
 use nym_sphinx::message::NymMessage;
-use nym_sphinx::params::{PacketSize, PacketType, DEFAULT_NUM_MIX_HOPS};
+use nym_sphinx::params::{PacketSize, PacketType};
 use nym_sphinx::preparer::{MessagePreparer, PreparedFragment};
 use nym_sphinx::Delay;
 use nym_task::connections::TransmissionLane;
-use nym_topology::{NymTopology, NymTopologyError};
+use nym_topology::{NymRouteProvider, NymTopologyError};
 use rand::{CryptoRng, Rng};
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -91,16 +91,15 @@ pub(crate) struct Config {
    /// and surb-based are going to be sent.
    sender_address: Recipient,

+    /// Specify whether route selection should be determined by the packet header.
+    deterministic_route_selection: bool,
+
    /// Average delay a data packet is going to get delay at a single mixnode.
    average_packet_delay: Duration,

    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
    average_ack_delay: Duration,

-    /// Number of mix hops each packet ('real' message, ack, reply) is expected to take.
-    /// Note that it does not include gateway hops.
-    num_mix_hops: u8,
-
    /// Primary predefined packet size used for the encapsulated messages.
    primary_packet_size: PacketSize,

@@ -114,25 +113,19 @@ impl Config {
        sender_address: Recipient,
        average_packet_delay: Duration,
        average_ack_delay: Duration,
+        deterministic_route_selection: bool,
    ) -> Self {
        Config {
            ack_key,
            sender_address,
+            deterministic_route_selection,
            average_packet_delay,
            average_ack_delay,
-            num_mix_hops: DEFAULT_NUM_MIX_HOPS,
            primary_packet_size: PacketSize::default(),
            secondary_packet_size: None,
        }
    }

-    /// Allows setting non-default number of expected mix hops in the network.
-    #[allow(dead_code)]
-    pub fn with_mix_hops(mut self, hops: u8) -> Self {
-        self.num_mix_hops = hops;
-        self
-    }
-
    /// Allows setting non-default size of the sphinx packets sent out.
    pub fn with_custom_primary_packet_size(mut self, packet_size: PacketSize) -> Self {
        self.primary_packet_size = packet_size;
@@ -176,12 +169,11 @@ where
    {
        let message_preparer = MessagePreparer::new(
            rng,
+            config.deterministic_route_selection,
            config.sender_address,
            config.average_packet_delay,
            config.average_ack_delay,
-        )
-        .with_mix_hops(config.num_mix_hops);
-
+        );
        MessageHandler {
            config,
            rng,
@@ -210,7 +202,7 @@ where
    fn get_topology<'a>(
        &self,
        permit: &'a TopologyReadPermit<'a>,
-    ) -> Result<&'a NymTopology, PreparationError> {
+    ) -> Result<&'a NymRouteProvider, PreparationError> {
        match permit.try_get_valid_topology_ref(&self.config.sender_address, None) {
            Ok(topology_ref) => Ok(topology_ref),
            Err(err) => {
@@ -227,9 +219,8 @@ where
            return self.config.primary_packet_size;
        };

-        let primary_count =
-            msg.required_packets(self.config.primary_packet_size, self.config.num_mix_hops);
-        let secondary_count = msg.required_packets(secondary_packet, self.config.num_mix_hops);
+        let primary_count = msg.required_packets(self.config.primary_packet_size);
+        let secondary_count = msg.required_packets(secondary_packet);

        trace!("This message would require: {primary_count} primary packets or {secondary_count} secondary packets...");
        // if there would be no benefit in using the secondary packet - use the primary (duh)
@@ -418,10 +409,9 @@ where
        message: Vec<u8>,
        lane: TransmissionLane,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        let message = NymMessage::new_plain(message);
-        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type, mix_hops)
+        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type)
            .await
    }

@@ -431,7 +421,6 @@ where
        recipient: Recipient,
        lane: TransmissionLane,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        debug!("Sending non-reply message with packet type {packet_type}");
        // TODO: I really dislike existence of this assertion, it implies code has to be re-organised
@@ -464,7 +453,6 @@ where
                &self.config.ack_key,
                &recipient,
                packet_type,
-                mix_hops,
            )?;

            let real_message = RealMessage::new(
@@ -472,8 +460,7 @@ where
                Some(fragment.fragment_identifier()),
            );
            let delay = prepared_fragment.total_delay;
-            let pending_ack =
-                PendingAcknowledgement::new_known(fragment, delay, recipient, mix_hops);
+            let pending_ack = PendingAcknowledgement::new_known(fragment, delay, recipient);

            real_messages.push(real_message);
            pending_acks.push(pending_ack);
@@ -490,7 +477,6 @@ where
        recipient: Recipient,
        amount: u32,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<(), PreparationError> {
        debug!("Sending additional reply SURBs with packet type {packet_type}");
        let sender_tag = self.get_or_create_sender_tag(&recipient);
@@ -507,7 +493,6 @@ where
            recipient,
            TransmissionLane::AdditionalReplySurbs,
            packet_type,
-            mix_hops,
        )
        .await?;

@@ -524,7 +509,6 @@ where
        num_reply_surbs: u32,
        lane: TransmissionLane,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<(), SurbWrappedPreparationError> {
        debug!("Sending message with reply SURBs with packet type {packet_type}");
        let sender_tag = self.get_or_create_sender_tag(&recipient);
@@ -535,7 +519,7 @@ where
        let message =
            NymMessage::new_repliable(RepliableMessage::new_data(message, sender_tag, reply_surbs));

-        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type, mix_hops)
+        self.try_split_and_send_non_reply_message(message, recipient, lane, packet_type)
            .await?;

        log::trace!("storing {} reply keys", reply_keys.len());
@@ -549,23 +533,18 @@ where
        recipient: Recipient,
        chunk: Fragment,
        packet_type: PacketType,
-        mix_hops: Option<u8>,
    ) -> Result<PreparedFragment, PreparationError> {
        debug!("Sending single chunk with packet type {packet_type}");
        let topology_permit = self.topology_access.get_read_permit().await;
        let topology = self.get_topology(&topology_permit)?;

-        let prepared_fragment = self
-            .message_preparer
-            .prepare_chunk_for_sending(
-                chunk,
-                topology,
-                &self.config.ack_key,
-                &recipient,
-                packet_type,
-                mix_hops,
-            )
-            .unwrap();
+        let prepared_fragment = self.message_preparer.prepare_chunk_for_sending(
+            chunk,
+            topology,
+            &self.config.ack_key,
+            &recipient,
+            packet_type,
+        )?;

        Ok(prepared_fragment)
    }
@@ -618,23 +597,20 @@ where
            Err(err) => return Err(err.return_surbs(vec![reply_surb])),
        };

-        let prepared_fragment = self
-            .message_preparer
-            .prepare_reply_chunk_for_sending(
-                chunk,
-                topology,
-                &self.config.ack_key,
-                reply_surb,
-                PacketType::Mix,
-            )
-            .unwrap();
+        let prepared_fragment = self.message_preparer.prepare_reply_chunk_for_sending(
+            chunk,
+            topology,
+            &self.config.ack_key,
+            reply_surb,
+            PacketType::Mix,
+        )?;

        Ok(prepared_fragment)
    }

    pub(crate) fn update_ack_delay(&self, id: FragmentIdentifier, new_delay: Delay) {
        self.action_sender
-            .unbounded_send(Action::UpdateDelay(id, new_delay))
+            .unbounded_send(Action::UpdatePendingAck(id, new_delay))
            .expect("action control task has died")
    }

@@ -65,6 +65,7 @@ pub struct Config {
 impl<'a> From<&'a Config> for acknowledgement_control::Config {
    fn from(cfg: &'a Config) -> Self {
        acknowledgement_control::Config::new(
+            cfg.traffic.maximum_number_of_retransmissions,
            cfg.acks.ack_wait_addition,
            cfg.acks.ack_wait_multiplier,
        )
@@ -97,6 +98,7 @@ impl<'a> From<&'a Config> for message_handler::Config {
            cfg.self_recipient,
            cfg.traffic.average_packet_delay,
            cfg.acks.average_ack_delay,
+            cfg.traffic.deterministic_route_selection,
        )
        .with_custom_primary_packet_size(cfg.traffic.primary_packet_size)
        .with_custom_secondary_packet_size(cfg.traffic.secondary_packet_size)
@@ -230,6 +230,7 @@ where
                // poisson delay, but is it really a problem?
                let topology_permit = self.topology_access.get_read_permit().await;
                // the ack is sent back to ourselves (and then ignored)
+
                let topology_ref = match topology_permit.try_get_valid_topology_ref(
                    &self.config.our_full_destination,
                    Some(&self.config.our_full_destination),
@@ -516,7 +516,6 @@ where
                    recipient,
                    to_send,
                    nym_sphinx::params::PacketType::Mix,
-                    self.config.reply_surbs.surb_mix_hops,
                )
                .await
            {
@@ -2,8 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use nym_sphinx::addressing::clients::Recipient;
-use nym_sphinx::params::DEFAULT_NUM_MIX_HOPS;
-use nym_topology::{NymTopology, NymTopologyError};
+use nym_topology::{NymRouteProvider, NymTopology, NymTopologyError};
 use std::ops::Deref;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
@@ -17,29 +16,36 @@ pub struct TopologyAccessorInner {
    // few seconds, while reads are needed every single packet generated.
    // However, proper benchmarks will be needed to determine if `RwLock` is indeed a better
    // approach than a `Mutex`
-    topology: RwLock<Option<NymTopology>>,
+    topology: RwLock<NymRouteProvider>,
 }

 impl TopologyAccessorInner {
-    fn new() -> Self {
+    fn new(initial: NymRouteProvider) -> Self {
        TopologyAccessorInner {
            controlled_manually: AtomicBool::new(false),
            released_manual_control: Notify::new(),
-            topology: RwLock::new(None),
+            topology: RwLock::new(initial),
        }
    }

    async fn update(&self, new: Option<NymTopology>) {
-        *self.topology.write().await = new;
+        let mut guard = self.topology.write().await;
+
+        match new {
+            Some(updated) => {
+                guard.update(updated);
+            }
+            None => guard.clear_topology(),
+        }
    }
 }

 pub struct TopologyReadPermit<'a> {
-    permit: RwLockReadGuard<'a, Option<NymTopology>>,
+    permit: RwLockReadGuard<'a, NymRouteProvider>,
 }

-impl<'a> Deref for TopologyReadPermit<'a> {
-    type Target = Option<NymTopology>;
+impl Deref for TopologyReadPermit<'_> {
+    type Target = NymRouteProvider;

    fn deref(&self) -> &Self::Target {
        &self.permit
@@ -53,43 +59,31 @@ impl<'a> TopologyReadPermit<'a> {
        &'a self,
        ack_recipient: &Recipient,
        packet_recipient: Option<&Recipient>,
-    ) -> Result<&'a NymTopology, NymTopologyError> {
+    ) -> Result<&'a NymRouteProvider, NymTopologyError> {
+        let route_provider = self.permit.deref();
+        let topology = &route_provider.topology;
+
        // 1. Have we managed to get anything from the refresher, i.e. have the nym-api queries gone through?
-        let topology = self
-            .permit
-            .as_ref()
-            .ok_or(NymTopologyError::EmptyNetworkTopology)?;
+        topology.ensure_not_empty()?;

-        // 2. does it have any mixnode at all?
-        // 3. does it have any gateways at all?
-        // 4. does it have a mixnode on each layer?
-        topology.ensure_can_construct_path_through(DEFAULT_NUM_MIX_HOPS)?;
+        // 2. does the topology have a node on each mixing layer?
+        topology.ensure_minimally_routable()?;

-        // 5. does it contain OUR gateway (so that we could create an ack packet)?
-        if !topology.gateway_exists(ack_recipient.gateway()) {
-            return Err(NymTopologyError::NonExistentGatewayError {
-                identity_key: ack_recipient.gateway().to_base58_string(),
-            });
-        }
+        // 3. does it contain OUR gateway (so that we could create an ack packet)?
+        let _ = route_provider.egress_by_identity(ack_recipient.gateway())?;

-        // 6. for our target recipient, does it contain THEIR gateway (so that we could create
+        // 4. for our target recipient, does it contain THEIR gateway (so that we send anything over?)
        if let Some(recipient) = packet_recipient {
-            if !topology.gateway_exists(recipient.gateway()) {
-                return Err(NymTopologyError::NonExistentGatewayError {
-                    identity_key: recipient.gateway().to_base58_string(),
-                });
-            }
+            let _ = route_provider.egress_by_identity(recipient.gateway())?;
        }

-        Ok(topology)
+        Ok(route_provider)
    }
 }

-impl<'a> From<RwLockReadGuard<'a, Option<NymTopology>>> for TopologyReadPermit<'a> {
-    fn from(read_permit: RwLockReadGuard<'a, Option<NymTopology>>) -> Self {
-        TopologyReadPermit {
-            permit: read_permit,
-        }
+impl<'a> From<RwLockReadGuard<'a, NymRouteProvider>> for TopologyReadPermit<'a> {
+    fn from(permit: RwLockReadGuard<'a, NymRouteProvider>) -> Self {
+        TopologyReadPermit { permit }
    }
 }

@@ -99,9 +93,11 @@ pub struct TopologyAccessor {
 }

 impl TopologyAccessor {
-    pub fn new() -> Self {
+    pub fn new(ignore_egress_epoch_roles: bool) -> Self {
        TopologyAccessor {
-            inner: Arc::new(TopologyAccessorInner::new()),
+            inner: Arc::new(TopologyAccessorInner::new(NymRouteProvider::new_empty(
+                ignore_egress_epoch_roles,
+            ))),
        }
    }

@@ -121,8 +117,21 @@ impl TopologyAccessor {
        self.inner.released_manual_control.notified().await
    }

+    #[deprecated(note = "use .current_route_provider instead")]
    pub async fn current_topology(&self) -> Option<NymTopology> {
-        self.inner.topology.read().await.clone()
+        self.current_route_provider()
+            .await
+            .as_ref()
+            .map(|p| p.topology.clone())
+    }
+
+    pub async fn current_route_provider(&self) -> Option<RwLockReadGuard<NymRouteProvider>> {
+        let provider = self.inner.topology.read().await;
+        if provider.topology.is_empty() {
+            None
+        } else {
+            Some(provider)
+        }
    }

    pub async fn manually_change_topology(&self, new_topology: NymTopology) {
@@ -140,15 +149,11 @@ impl TopologyAccessor {
    // only used by the client at startup to get a slightly more reasonable error message
    // (currently displays as unused because health checker is disabled due to required changes)
    pub async fn ensure_is_routable(&self) -> Result<(), NymTopologyError> {
-        match self.inner.topology.read().await.deref() {
-            None => Err(NymTopologyError::EmptyNetworkTopology),
-            Some(ref topology) => topology.ensure_can_construct_path_through(DEFAULT_NUM_MIX_HOPS),
-        }
-    }
-}
-
-impl Default for TopologyAccessor {
-    fn default() -> Self {
-        TopologyAccessor::new()
+        self.inner
+            .topology
+            .read()
+            .await
+            .topology
+            .ensure_minimally_routable()
    }
 }
@@ -3,7 +3,6 @@ use log::{debug, error};
 use nym_explorer_client::{ExplorerClient, PrettyDetailedMixNodeBond};
 use nym_network_defaults::var_names::EXPLORER_API;
 use nym_topology::{
-    nym_topology_from_basic_info,
    provider_trait::{async_trait, TopologyProvider},
    NymTopology,
 };
@@ -15,8 +14,6 @@ use url::Url;

 pub use nym_country_group::CountryGroup;

-const MIN_NODES_PER_LAYER: usize = 1;
-
 fn create_explorer_client() -> Option<ExplorerClient> {
    let Ok(explorer_api_url) = std::env::var(EXPLORER_API) else {
        error!("Missing EXPLORER_API");
@@ -63,37 +60,22 @@ fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<NodeId>>) {
 }

 fn check_layer_integrity(topology: NymTopology) -> Result<(), ()> {
-    let mixes = topology.mixes();
-    if mixes.keys().len() < 3 {
+    if topology.ensure_minimally_routable().is_err() {
        error!("Layer is missing in topology!");
        return Err(());
    }
-    for (layer, mixnodes) in mixes {
-        debug!("Layer {:?} has {} mixnodes", layer, mixnodes.len());
-        if mixnodes.len() < MIN_NODES_PER_LAYER {
-            error!(
-                "There are only {} mixnodes in layer {:?}",
-                mixnodes.len(),
-                layer
-            );
-            return Err(());
-        }
-    }
    Ok(())
 }

+#[deprecated(note = "use NymApiTopologyProvider instead as explorer API will soon be removed")]
 pub struct GeoAwareTopologyProvider {
    validator_client: nym_validator_client::client::NymApiClient,
    filter_on: GroupBy,
-    client_version: String,
 }

+#[allow(deprecated)]
 impl GeoAwareTopologyProvider {
-    pub fn new(
-        mut nym_api_urls: Vec<Url>,
-        client_version: String,
-        filter_on: GroupBy,
-    ) -> GeoAwareTopologyProvider {
+    pub fn new(mut nym_api_urls: Vec<Url>, filter_on: GroupBy) -> GeoAwareTopologyProvider {
        log::info!(
            "Creating geo-aware topology provider with filter on {}",
            filter_on
@@ -105,14 +87,22 @@ impl GeoAwareTopologyProvider {
                nym_api_urls[0].clone(),
            ),
            filter_on,
-            client_version,
        }
    }

    async fn get_topology(&self) -> Option<NymTopology> {
+        let rewarded_set = self
+            .validator_client
+            .get_current_rewarded_set()
+            .await
+            .inspect_err(|err| error!("failed to get current rewarded set: {err}"))
+            .ok()?;
+
+        let mut topology = NymTopology::new_empty(rewarded_set);
+
        let mixnodes = match self
            .validator_client
-            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
+            .get_all_basic_active_mixing_assigned_nodes()
            .await
        {
            Err(err) => {
@@ -124,7 +114,7 @@ impl GeoAwareTopologyProvider {

        let gateways = match self
            .validator_client
-            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
+            .get_all_basic_entry_assigned_nodes()
            .await
        {
            Err(err) => {
@@ -193,7 +183,8 @@ impl GeoAwareTopologyProvider {
            .filter(|m| filtered_mixnode_ids.contains(&m.node_id))
            .collect::<Vec<_>>();

-        let topology = nym_topology_from_basic_info(&mixnodes, &gateways);
+        topology.add_skimmed_nodes(&mixnodes);
+        topology.add_skimmed_nodes(&gateways);

        // TODO: return real error type
        check_layer_integrity(topology.clone()).ok()?;
@@ -202,6 +193,7 @@ impl GeoAwareTopologyProvider {
    }
 }

+#[allow(deprecated)]
 #[cfg(not(target_arch = "wasm32"))]
 #[async_trait]
 impl TopologyProvider for GeoAwareTopologyProvider {
@@ -211,6 +203,7 @@ impl TopologyProvider for GeoAwareTopologyProvider {
    }
 }

+#[allow(deprecated)]
 #[cfg(target_arch = "wasm32")]
 #[async_trait(?Send)]
 impl TopologyProvider for GeoAwareTopologyProvider {
@@ -19,6 +19,7 @@ mod accessor;
 pub mod geo_aware_provider;
 pub mod nym_api_provider;

+#[allow(deprecated)]
 pub use geo_aware_provider::GeoAwareTopologyProvider;
 pub use nym_api_provider::{Config as NymApiTopologyProviderConfig, NymApiTopologyProvider};
 pub use nym_topology::provider_trait::TopologyProvider;
@@ -27,7 +28,7 @@ pub use nym_topology::provider_trait::TopologyProvider;
 const MAX_FAILURE_COUNT: usize = 10;

 pub struct TopologyRefresherConfig {
-    refresh_rate: Duration,
+    pub refresh_rate: Duration,
 }

 impl TopologyRefresherConfig {
@@ -96,28 +97,24 @@ impl TopologyRefresher {
        self.topology_accessor.ensure_is_routable().await
    }

-    pub async fn ensure_contains_gateway(
+    pub async fn ensure_contains_routable_egress(
        &self,
-        gateway: &NodeIdentity,
+        egress: NodeIdentity,
    ) -> Result<(), NymTopologyError> {
        let topology = self
            .topology_accessor
-            .current_topology()
+            .current_route_provider()
            .await
            .ok_or(NymTopologyError::EmptyNetworkTopology)?;

-        if !topology.gateway_exists(gateway) {
-            return Err(NymTopologyError::NonExistentGatewayError {
-                identity_key: gateway.to_base58_string(),
-            });
-        }
+        let _ = topology.egress_by_identity(egress)?;

        Ok(())
    }

    pub async fn wait_for_gateway(
        &mut self,
-        gateway: &NodeIdentity,
+        gateway: NodeIdentity,
        timeout_duration: Duration,
    ) -> Result<(), NymTopologyError> {
        info!(
@@ -135,7 +132,7 @@ impl TopologyRefresher {
                    })
                }
                _ = self.try_refresh() => {
-                    if self.ensure_contains_gateway(gateway).await.is_ok() {
+                    if self.ensure_contains_routable_egress(gateway).await.is_ok() {
                        return Ok(())
                    }
                    info!("gateway '{gateway}' is still not online...");
@@ -4,47 +4,51 @@
 use async_trait::async_trait;
 use log::{debug, error, warn};
 use nym_topology::provider_trait::TopologyProvider;
-use nym_topology::{NymTopology, NymTopologyError};
+use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
 use rand::prelude::SliceRandom;
 use rand::thread_rng;
+use std::cmp::min;
 use url::Url;

-// the same values as our current (10.06.24) blacklist
-pub const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
-pub const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
-
 #[derive(Debug)]
 pub struct Config {
    pub min_mixnode_performance: u8,
    pub min_gateway_performance: u8,
+    pub use_extended_topology: bool,
+    pub ignore_egress_epoch_role: bool,
 }

-impl Default for Config {
-    fn default() -> Self {
-        // old values that decided on blacklist membership
+impl From<nym_client_core_config_types::Topology> for Config {
+    fn from(value: nym_client_core_config_types::Topology) -> Self {
        Config {
-            min_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
-            min_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
+            min_mixnode_performance: value.minimum_mixnode_performance,
+            min_gateway_performance: value.minimum_gateway_performance,
+            use_extended_topology: value.use_extended_topology,
+            ignore_egress_epoch_role: value.ignore_egress_epoch_role,
        }
    }
 }

+impl Config {
+    // if we're using 'extended' topology, filter the nodes based on the lowest set performance
+    fn min_node_performance(&self) -> u8 {
+        min(self.min_mixnode_performance, self.min_gateway_performance)
+    }
+}
+
 pub struct NymApiTopologyProvider {
    config: Config,

    validator_client: nym_validator_client::client::NymApiClient,
    nym_api_urls: Vec<Url>,
-
-    client_version: String,
    currently_used_api: usize,
 }

 impl NymApiTopologyProvider {
    pub fn new(
-        config: Config,
+        config: impl Into<Config>,
        mut nym_api_urls: Vec<Url>,
-        client_version: String,
        user_agent: Option<UserAgent>,
    ) -> Self {
        nym_api_urls.shuffle(&mut thread_rng());
@@ -59,10 +63,9 @@ impl NymApiTopologyProvider {
        };

        NymApiTopologyProvider {
-            config,
+            config: config.into(),
            validator_client,
            nym_api_urls,
-            client_version,
            currently_used_api: 0,
        }
    }
@@ -78,70 +81,69 @@ impl NymApiTopologyProvider {
            .change_nym_api(self.nym_api_urls[self.currently_used_api].clone())
    }

-    /// Verifies whether nodes a reasonably distributed among all mix layers.
-    ///
-    /// In ideal world we would have 33% nodes on layer 1, 33% on layer 2 and 33% on layer 3.
-    /// However, this is a rather unrealistic expectation, instead we check whether there exists
-    /// a layer with more than 66% of nodes or with fewer than 15% and if so, we trigger a failure.
-    ///
-    /// # Arguments
-    ///
-    /// * `topology`: active topology constructed from validator api data
-    fn check_layer_distribution(
-        &self,
-        active_topology: &NymTopology,
-    ) -> Result<(), NymTopologyError> {
-        let lower_threshold = 0.15;
-        let upper_threshold = 0.66;
-        active_topology.ensure_even_layer_distribution(lower_threshold, upper_threshold)
-    }
-
    async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
-        let mixnodes = match self
+        let rewarded_set = self
            .validator_client
-            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
+            .get_current_rewarded_set()
            .await
-        {
-            Err(err) => {
-                error!("failed to get network mixnodes - {err}");
-                return None;
-            }
-            Ok(mixes) => mixes,
-        };
+            .inspect_err(|err| error!("failed to get current rewarded set: {err}"))
+            .ok()?;

-        let gateways = match self
-            .validator_client
-            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
-            .await
-        {
-            Err(err) => {
-                error!("failed to get network gateways - {err}");
-                return None;
-            }
-            Ok(gateways) => gateways,
-        };
+        let mut topology = NymTopology::new_empty(rewarded_set);

-        debug!(
-            "there are {} mixnodes and {} gateways in total (before performance filtering)",
-            mixnodes.len(),
-            gateways.len()
-        );
+        if self.config.use_extended_topology {
+            let all_nodes = self
+                .validator_client
+                .get_all_basic_nodes()
+                .await
+                .inspect_err(|err| error!("failed to get network nodes: {err}"))
+                .ok()?;

-        let topology = NymTopology::from_unordered(
-            mixnodes.iter().filter(|m| {
-                m.performance.round_to_integer() >= self.config.min_mixnode_performance
-            }),
-            gateways.iter().filter(|g| {
-                g.performance.round_to_integer() >= self.config.min_gateway_performance
-            }),
-        );
-        if let Err(err) = self.check_layer_distribution(&topology) {
-            warn!("The current filtered active topology has extremely skewed layer distribution. It cannot be used: {err}");
-            self.use_next_nym_api();
-            None
+            debug!(
+                "there are {} nodes on the network (before filtering)",
+                all_nodes.len()
+            );
+            topology.add_additional_nodes(all_nodes.iter().filter(|n| {
+                n.performance.round_to_integer() >= self.config.min_node_performance()
+            }));
        } else {
-            Some(topology)
+            // if we're not using extended topology, we're only getting active set mixnodes and gateways
+
+            let mixnodes = self
+                .validator_client
+                .get_all_basic_active_mixing_assigned_nodes()
+                .await
+                .inspect_err(|err| error!("failed to get network mixnodes: {err}"))
+                .ok()?;
+
+            // TODO: we really should be getting ACTIVE gateways only
+            let gateways = self
+                .validator_client
+                .get_all_basic_entry_assigned_nodes()
+                .await
+                .inspect_err(|err| error!("failed to get network gateways: {err}"))
+                .ok()?;
+
+            debug!(
+                "there are {} mixnodes and {} gateways in total (before performance filtering)",
+                mixnodes.len(),
+                gateways.len()
+            );
+
+            topology.add_additional_nodes(mixnodes.iter().filter(|m| {
+                m.performance.round_to_integer() >= self.config.min_mixnode_performance
+            }));
+            topology.add_additional_nodes(gateways.iter().filter(|m| {
+                m.performance.round_to_integer() >= self.config.min_gateway_performance
+            }));
+        };
+
+        if !topology.is_minimally_routable() {
+            error!("the current filtered active topology can't be used to construct any packets");
+            return None;
        }
+
+        Some(topology)
    }
 }

@@ -150,7 +152,11 @@ impl NymApiTopologyProvider {
 #[async_trait]
 impl TopologyProvider for NymApiTopologyProvider {
    async fn get_new_topology(&mut self) -> Option<NymTopology> {
-        self.get_current_compatible_topology().await
+        let Some(topology) = self.get_current_compatible_topology().await else {
+            self.use_next_nym_api();
+            return None;
+        };
+        Some(topology)
    }
 }

@@ -158,6 +164,10 @@ impl TopologyProvider for NymApiTopologyProvider {
 #[async_trait(?Send)]
 impl TopologyProvider for NymApiTopologyProvider {
    async fn get_new_topology(&mut self) -> Option<NymTopology> {
-        self.get_current_compatible_topology().await
+        let Some(topology) = self.get_current_compatible_topology().await else {
+            self.use_next_nym_api();
+            return None;
+        };
+        Some(topology)
    }
 }
@@ -4,8 +4,8 @@
 use crate::client::mix_traffic::transceiver::ErasedGatewayError;
 use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
 use nym_gateway_client::error::GatewayClientError;
-use nym_topology::gateway::GatewayConversionError;
-use nym_topology::NymTopologyError;
+use nym_topology::node::RoutingNodeError;
+use nym_topology::{NodeId, NymTopologyError};
 use nym_validator_client::ValidatorClientError;
 use std::error::Error;
 use std::path::PathBuf;
@@ -74,10 +74,10 @@ pub enum ClientCoreError {
    #[error("the gateway id is invalid - {0}")]
    UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),

-    #[error("The gateway is malformed: {source}")]
+    #[error("the node is malformed: {source}")]
    MalformedGateway {
        #[from]
-        source: GatewayConversionError,
+        source: Box<RoutingNodeError>,
    },

    #[error("failed to establish connection to gateway: {source}")]
@@ -159,6 +159,9 @@ pub enum ClientCoreError {
    #[error("the specified gateway '{gateway}' does not support the wss protocol")]
    UnsupportedWssProtocol { gateway: String },

+    #[error("node {id} ({identity}) does not support mixnet entry mode")]
+    UnsupportedEntry { id: NodeId, identity: String },
+
    #[error(
    "failed to load custom topology using path '{}'. detailed message: {source}", file_path.display()
    )]
@@ -7,7 +7,7 @@ use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
-use nym_topology::{gateway, mix};
+use nym_topology::node::RoutingNode;
 use nym_validator_client::client::IdentityKeyRef;
 use nym_validator_client::UserAgent;
 use rand::{seq::SliceRandom, Rng};
@@ -15,6 +15,7 @@ use std::{sync::Arc, time::Duration};
 use tungstenite::Message;
 use url::Url;

+use nym_topology::NodeId;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::net::TcpStream;
 #[cfg(not(target_arch = "wasm32"))]
@@ -25,7 +26,6 @@ use tokio::time::Instant;
 use tokio_tungstenite::connect_async;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
-
 #[cfg(target_arch = "wasm32")]
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
@@ -48,22 +48,30 @@ const PING_TIMEOUT: Duration = Duration::from_millis(1000);

 // The abstraction that some of these helpers use
 pub trait ConnectableGateway {
-    fn identity(&self) -> &identity::PublicKey;
-    fn clients_address(&self) -> String;
+    fn node_id(&self) -> NodeId;
+    fn identity(&self) -> identity::PublicKey;
+    fn clients_address(&self, prefer_ipv6: bool) -> Option<String>;
    fn is_wss(&self) -> bool;
 }

-impl ConnectableGateway for gateway::LegacyNode {
-    fn identity(&self) -> &identity::PublicKey {
-        self.identity()
+impl ConnectableGateway for RoutingNode {
+    fn node_id(&self) -> NodeId {
+        self.node_id
    }

-    fn clients_address(&self) -> String {
-        self.clients_address()
+    fn identity(&self) -> identity::PublicKey {
+        self.identity_key
+    }
+
+    fn clients_address(&self, prefer_ipv6: bool) -> Option<String> {
+        self.ws_entry_address(prefer_ipv6)
    }

    fn is_wss(&self) -> bool {
-        self.clients_wss_port.is_some()
+        self.entry
+            .as_ref()
+            .map(|e| e.clients_wss_port.is_some())
+            .unwrap_or_default()
    }
 }

@@ -82,7 +90,8 @@ pub async fn current_gateways<R: Rng>(
    rng: &mut R,
    nym_apis: &[Url],
    user_agent: Option<UserAgent>,
-) -> Result<Vec<gateway::LegacyNode>, ClientCoreError> {
+    minimum_performance: u8,
+) -> Result<Vec<RoutingNode>, ClientCoreError> {
    let nym_api = nym_apis
        .choose(rng)
        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
@@ -94,44 +103,27 @@ pub async fn current_gateways<R: Rng>(

    log::debug!("Fetching list of gateways from: {nym_api}");

-    let gateways = client.get_all_basic_entry_assigned_nodes(None).await?;
-    log::debug!("Found {} gateways", gateways.len());
+    let gateways = client.get_all_basic_entry_assigned_nodes().await?;
+    info!("nym api reports {} gateways", gateways.len());
+
    log::trace!("Gateways: {:#?}", gateways);

    let valid_gateways = gateways
        .iter()
+        .filter(|g| g.performance.round_to_integer() >= minimum_performance)
        .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<gateway::LegacyNode>>();
+        .collect::<Vec<_>>();
    log::debug!("After checking validity: {}", valid_gateways.len());
    log::trace!("Valid gateways: {:#?}", valid_gateways);

-    log::info!("nym-api reports {} valid gateways", valid_gateways.len());
+    log::info!(
+        "and {} after validity and performance filtering",
+        valid_gateways.len()
+    );

    Ok(valid_gateways)
 }

-pub async fn current_mixnodes<R: Rng>(
-    rng: &mut R,
-    nym_apis: &[Url],
-) -> Result<Vec<mix::LegacyNode>, ClientCoreError> {
-    let nym_api = nym_apis
-        .choose(rng)
-        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
-    let client = nym_validator_client::client::NymApiClient::new(nym_api.clone());
-
-    log::trace!("Fetching list of mixnodes from: {nym_api}");
-
-    let mixnodes = client
-        .get_all_basic_active_mixing_assigned_nodes(None)
-        .await?;
-    let valid_mixnodes = mixnodes
-        .iter()
-        .filter_map(|mixnode| mixnode.try_into().ok())
-        .collect::<Vec<mix::LegacyNode>>();
-
-    Ok(valid_mixnodes)
-}
-
 #[cfg(not(target_arch = "wasm32"))]
 async fn connect(endpoint: &str) -> Result<WsConn, ClientCoreError> {
    match tokio::time::timeout(CONN_TIMEOUT, connect_async(endpoint)).await {
@@ -150,7 +142,12 @@ async fn measure_latency<G>(gateway: &G) -> Result<GatewayWithLatency<G>, Client
 where
    G: ConnectableGateway,
 {
-    let addr = gateway.clients_address();
+    let Some(addr) = gateway.clients_address(false) else {
+        return Err(ClientCoreError::UnsupportedEntry {
+            id: gateway.node_id(),
+            identity: gateway.identity().to_string(),
+        });
+    };
    trace!(
        "establishing connection to {} ({addr})...",
        gateway.identity(),
@@ -206,7 +203,7 @@ where
    Ok(GatewayWithLatency::new(gateway, avg))
 }

-pub async fn choose_gateway_by_latency<'a, R: Rng, G: ConnectableGateway + Clone>(
+pub async fn choose_gateway_by_latency<R: Rng, G: ConnectableGateway + Clone>(
    rng: &mut R,
    gateways: &[G],
    must_use_tls: bool,
@@ -221,7 +218,7 @@ pub async fn choose_gateway_by_latency<'a, R: Rng, G: ConnectableGateway + Clone
    let gateways_with_latency = Arc::new(tokio::sync::Mutex::new(Vec::new()));
    futures::stream::iter(gateways)
        .for_each_concurrent(CONCURRENT_GATEWAYS_MEASURED, |gateway| async {
-            let id = *gateway.identity();
+            let id = gateway.identity();
            trace!("measuring latency to {id}...");
            match measure_latency(gateway).await {
                Ok(with_latency) => {
@@ -268,9 +265,9 @@ fn filter_by_tls<G: ConnectableGateway>(

 pub(super) fn uniformly_random_gateway<R: Rng>(
    rng: &mut R,
-    gateways: &[gateway::LegacyNode],
+    gateways: &[RoutingNode],
    must_use_tls: bool,
-) -> Result<gateway::LegacyNode, ClientCoreError> {
+) -> Result<RoutingNode, ClientCoreError> {
    filter_by_tls(gateways, must_use_tls)?
        .choose(rng)
        .ok_or(ClientCoreError::NoGatewaysOnNetwork)
@@ -279,9 +276,9 @@ pub(super) fn uniformly_random_gateway<R: Rng>(

 pub(super) fn get_specified_gateway(
    gateway_identity: IdentityKeyRef,
-    gateways: &[gateway::LegacyNode],
+    gateways: &[RoutingNode],
    must_use_tls: bool,
-) -> Result<gateway::LegacyNode, ClientCoreError> {
+) -> Result<RoutingNode, ClientCoreError> {
    log::debug!("Requesting specified gateway: {}", gateway_identity);
    let user_gateway = identity::PublicKey::from_base58_string(gateway_identity)
        .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;
@@ -291,7 +288,14 @@ pub(super) fn get_specified_gateway(
        .find(|gateway| gateway.identity_key == user_gateway)
        .ok_or_else(|| ClientCoreError::NoGatewayWithId(gateway_identity.to_string()))?;

-    if must_use_tls && gateway.clients_wss_port.is_none() {
+    let Some(entry_details) = gateway.entry.as_ref() else {
+        return Err(ClientCoreError::UnsupportedEntry {
+            id: gateway.node_id,
+            identity: gateway.identity().to_string(),
+        });
+    };
+
+    if must_use_tls && entry_details.clients_wss_port.is_none() {
        return Err(ClientCoreError::UnsupportedWssProtocol {
            gateway: gateway_identity.to_string(),
        });
@@ -19,7 +19,7 @@ use crate::init::types::{
 use nym_client_core_gateways_storage::GatewaysDetailsStore;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewayRegistration};
 use nym_gateway_client::client::InitGatewayClient;
-use nym_topology::gateway;
+use nym_topology::node::RoutingNode;
 use rand::rngs::OsRng;
 use rand::{CryptoRng, RngCore};
 use serde::Serialize;
@@ -50,7 +50,7 @@ async fn setup_new_gateway<K, D>(
    key_store: &K,
    details_store: &D,
    selection_specification: GatewaySelectionSpecification,
-    available_gateways: Vec<gateway::LegacyNode>,
+    available_gateways: Vec<RoutingNode>,
 ) -> Result<InitialisationResult, ClientCoreError>
 where
    K: KeyStore,
@@ -13,7 +13,7 @@ use nym_crypto::asymmetric::identity;
 use nym_gateway_client::client::InitGatewayClient;
 use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_sphinx::addressing::clients::Recipient;
-use nym_topology::gateway;
+use nym_topology::node::RoutingNode;
 use nym_validator_client::client::IdentityKey;
 use nym_validator_client::nyxd::AccountId;
 use serde::Serialize;
@@ -38,16 +38,23 @@ pub enum SelectedGateway {

 impl SelectedGateway {
    pub fn from_topology_node(
-        node: gateway::LegacyNode,
+        node: RoutingNode,
        must_use_tls: bool,
    ) -> Result<Self, ClientCoreError> {
+        // for now, let's use 'old' behaviour, if you want to change it, you can pass it up the enum stack yourself : )
+        let prefer_ipv6 = false;
+
        let gateway_listener = if must_use_tls {
-            node.clients_address_tls()
+            node.ws_entry_address_tls()
                .ok_or(ClientCoreError::UnsupportedWssProtocol {
                    gateway: node.identity_key.to_base58_string(),
                })?
        } else {
-            node.clients_address()
+            node.ws_entry_address(prefer_ipv6)
+                .ok_or(ClientCoreError::UnsupportedEntry {
+                    id: node.node_id,
+                    identity: node.identity_key.to_base58_string(),
+                })?
        };

        let gateway_listener =
@@ -200,7 +207,7 @@ pub enum GatewaySetup {
        specification: GatewaySelectionSpecification,

        // TODO: seems to be a bit inefficient to pass them by value
-        available_gateways: Vec<gateway::LegacyNode>,
+        available_gateways: Vec<RoutingNode>,
    },

    ReuseConnection {
@@ -14,8 +14,7 @@ pub mod error;
 pub mod init;

 pub use nym_topology::{
-    HardcodedTopologyProvider, NymTopology, NymTopologyError, SerializableNymTopology,
-    SerializableTopologyError, TopologyProvider,
+    HardcodedTopologyProvider, NymRouteProvider, NymTopology, NymTopologyError, TopologyProvider,
 };

 #[cfg(target_arch = "wasm32")]
@@ -34,3 +33,48 @@ where
 {
    tokio::spawn(future);
 }
+
+#[derive(Clone, Default, Debug)]
+pub struct ForgetMe {
+    client: bool,
+    stats: bool,
+}
+
+impl ForgetMe {
+    pub fn new_all() -> Self {
+        Self {
+            client: true,
+            stats: true,
+        }
+    }
+
+    pub fn new_client() -> Self {
+        Self {
+            client: true,
+            stats: false,
+        }
+    }
+
+    pub fn new_stats() -> Self {
+        Self {
+            client: false,
+            stats: true,
+        }
+    }
+
+    pub fn new(client: bool, stats: bool) -> Self {
+        Self { client, stats }
+    }
+
+    pub fn any(&self) -> bool {
+        self.client || self.stats
+    }
+
+    pub fn client(&self) -> bool {
+        self.client
+    }
+
+    pub fn stats(&self) -> bool {
+        self.stats
+    }
+}
@@ -9,7 +9,10 @@ use crate::backend::fs_backend::{
    },
 };
 use log::{error, info};
-use sqlx::ConnectOptions;
+use sqlx::{
+    sqlite::{SqliteAutoVacuum, SqliteSynchronous},
+    ConnectOptions,
+};
 use std::path::Path;

 #[derive(Debug, Clone)]
@@ -31,6 +34,9 @@ impl StorageManager {
        }

        let opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
+            .synchronous(SqliteSynchronous::Normal)
+            .auto_vacuum(SqliteAutoVacuum::Incremental)
            .filename(database_path)
            .create_if_missing(fresh)
            .disable_statement_logging();
@@ -22,7 +22,7 @@ mod error;
 mod manager;
 mod models;

-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct Backend {
    temporary_old_path: Option<PathBuf>,
    database_path: PathBuf,
@@ -19,7 +19,7 @@ pub mod fs_backend;
 #[error("no information provided")]
 pub struct UndefinedError;

-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct Empty {
    // we need to keep 'basic' metadata here to "load" the CombinedReplyStorage
    pub min_surb_threshold: usize,
@@ -87,8 +87,10 @@ impl ClientBandwidth {

        if remaining < 0 {
            tracing::warn!("OUT OF BANDWIDTH. remaining: {remaining_bi2}");
-        } else {
+        } else if remaining < 1_000_000 {
            tracing::info!("remaining bandwidth: {remaining_bi2}");
+        } else {
+            tracing::debug!("remaining bandwidth: {remaining_bi2}");
        }

        self.inner
@@ -101,6 +101,10 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
    // currently unused (but populated)
    negotiated_protocol: Option<u8>,

+    // Callback on the fd as soon as the connection has been established
+    #[cfg(unix)]
+    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+
    /// Listen to shutdown messages and send notifications back to the task manager
    task_client: TaskClient,
 }
@@ -116,6 +120,7 @@ impl<C, St> GatewayClient<C, St> {
        packet_router: PacketRouter,
        bandwidth_controller: Option<BandwidthController<C, St>>,
        stats_reporter: ClientStatsSender,
+        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
        task_client: TaskClient,
    ) -> Self {
        GatewayClient {
@@ -131,6 +136,8 @@ impl<C, St> GatewayClient<C, St> {
            bandwidth_controller,
            stats_reporter,
            negotiated_protocol: None,
+            #[cfg(unix)]
+            connection_fd_callback,
            task_client,
        }
    }
@@ -139,6 +146,10 @@ impl<C, St> GatewayClient<C, St> {
        self.gateway_identity
    }

+    pub fn shared_key(&self) -> Option<Arc<SharedGatewayKey>> {
+        self.shared_key.clone()
+    }
+
    pub fn ws_fd(&self) -> Option<RawFd> {
        match &self.connection {
            SocketState::Available(conn) => ws_fd(conn.as_ref()),
@@ -201,6 +212,12 @@ impl<C, St> GatewayClient<C, St> {
        };

        self.connection = SocketState::Available(Box::new(ws_stream));
+
+        #[cfg(unix)]
+        if let (Some(callback), Some(fd)) = (self.connection_fd_callback.as_ref(), self.ws_fd()) {
+            callback.as_ref()(fd);
+        }
+
        Ok(())
    }

@@ -307,7 +324,7 @@ impl<C, St> GatewayClient<C, St> {

    // If we want to send a message (with response), we need to have a full control over the socket,
    // as we need to be able to write the request and read the subsequent response
-    async fn send_websocket_message(
+    pub async fn send_websocket_message(
        &mut self,
        msg: impl Into<Message>,
    ) -> Result<ServerResponse, GatewayClientError> {
@@ -408,7 +425,7 @@ impl<C, St> GatewayClient<C, St> {
            }

            Some(_) => {
-                info!("the gateway is using exactly the same (or older) protocol version as we are. We're good to continue!");
+                debug!("the gateway is using exactly the same (or older) protocol version as we are. We're good to continue!");
                Ok(())
            }
        }
@@ -992,24 +1009,6 @@ impl<C, St> GatewayClient<C, St> {
        }
        Ok(())
    }
-
-    #[deprecated(note = "this method does not deal with upgraded keys for legacy clients")]
-    pub async fn authenticate_and_start(
-        &mut self,
-    ) -> Result<AuthenticationResponse, GatewayClientError>
-    where
-        C: DkgQueryClient + Send + Sync,
-        St: CredentialStorage,
-        <St as CredentialStorage>::StorageError: Send + Sync + 'static,
-    {
-        let shared_key = self.perform_initial_authentication().await?;
-        self.claim_initial_bandwidth().await?;
-
-        // this call is NON-blocking
-        self.start_listening_for_mixnet_messages()?;
-
-        Ok(shared_key)
-    }
 }

 // type alias for an ease of use
@@ -1048,6 +1047,8 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            bandwidth_controller: None,
            stats_reporter: ClientStatsSender::new(None),
            negotiated_protocol: None,
+            #[cfg(unix)]
+            connection_fd_callback: None,
            task_client,
        }
    }
@@ -1078,6 +1079,8 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            bandwidth_controller,
            stats_reporter,
            negotiated_protocol: self.negotiated_protocol,
+            #[cfg(unix)]
+            connection_fd_callback: self.connection_fd_callback,
            task_client,
        }
    }
@@ -46,7 +46,8 @@ pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
    #[cfg(unix)]
    match _conn.get_ref() {
        MaybeTlsStream::Plain(stream) => Some(stream.as_raw_fd()),
-        &_ => None,
+        MaybeTlsStream::Rustls(tls_stream) => Some(tls_stream.as_raw_fd()),
+        _ => None,
    }
    #[cfg(not(unix))]
    None
@@ -110,6 +111,11 @@ impl PartiallyDelegatedRouter {
            }
        };

+        if self.stream_return.is_canceled() {
+            // nothing to do, receiver has been dropped
+            return;
+        }
+
        let return_res = match ret {
            Err(err) => self.stream_return.send(Err(err)),
            Ok(_) => {
@@ -8,11 +8,17 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [dependencies]
+dashmap = { workspace = true }
 futures = { workspace = true }
-log = { workspace = true }
-tokio = { workspace = true, features = ["time", "net", "rt"] }
-tokio-util = { workspace = true, features = ["codec"] }
+tracing = { workspace = true }
+tokio = { workspace = true, features = ["time", "sync"] }
+tokio-util = { workspace = true, features = ["codec"], optional = true }
+tokio-stream = { workspace = true }

 # internal
 nym-sphinx = { path = "../../nymsphinx" }
-nym-task = { path = "../../task" }
+nym-task = { path = "../../task", optional = true }
+
+[features]
+default = ["client"]
+client = ["tokio-util", "nym-task", "tokio/net", "tokio/rt"]
@@ -1,30 +1,33 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use futures::channel::mpsc;
+use dashmap::DashMap;
 use futures::StreamExt;
-use log::*;
 use nym_sphinx::addressing::nodes::NymNodeRoutingAddress;
 use nym_sphinx::framing::codec::NymCodec;
 use nym_sphinx::framing::packet::FramedNymPacket;
 use nym_sphinx::params::PacketType;
 use nym_sphinx::NymPacket;
-use std::collections::HashMap;
 use std::io;
 use std::net::SocketAddr;
-use std::sync::atomic::{AtomicU32, Ordering};
+use std::ops::Deref;
+use std::sync::atomic::{AtomicU32, AtomicUsize, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
 use tokio::net::TcpStream;
+use tokio::sync::mpsc;
+use tokio::sync::mpsc::error::TrySendError;
 use tokio::time::sleep;
+use tokio_stream::wrappers::ReceiverStream;
 use tokio_util::codec::Framed;
+use tracing::*;

+#[derive(Clone, Copy)]
 pub struct Config {
    initial_reconnection_backoff: Duration,
    maximum_reconnection_backoff: Duration,
    initial_connection_timeout: Duration,
    maximum_connection_buffer_size: usize,
-    use_legacy_version: bool,
 }

 impl Config {
@@ -33,14 +36,12 @@ impl Config {
        maximum_reconnection_backoff: Duration,
        initial_connection_timeout: Duration,
        maximum_connection_buffer_size: usize,
-        use_legacy_version: bool,
    ) -> Self {
        Config {
            initial_reconnection_backoff,
            maximum_reconnection_backoff,
            initial_connection_timeout,
            maximum_connection_buffer_size,
-            use_legacy_version,
        }
    }
 }
@@ -57,11 +58,37 @@ pub trait SendWithoutResponse {
 }

 pub struct Client {
-    conn_new: HashMap<NymNodeRoutingAddress, ConnectionSender>,
+    active_connections: ActiveConnections,
+    connections_count: Arc<AtomicUsize>,
    config: Config,
 }

-struct ConnectionSender {
+#[derive(Default, Clone)]
+pub struct ActiveConnections {
+    inner: Arc<DashMap<NymNodeRoutingAddress, ConnectionSender>>,
+}
+
+impl ActiveConnections {
+    pub fn pending_packets(&self) -> usize {
+        self.inner
+            .iter()
+            .map(|sender| {
+                let max_capacity = sender.channel.max_capacity();
+                let capacity = sender.channel.capacity();
+                max_capacity - capacity
+            })
+            .sum()
+    }
+}
+
+impl Deref for ActiveConnections {
+    type Target = DashMap<NymNodeRoutingAddress, ConnectionSender>;
+    fn deref(&self) -> &Self::Target {
+        &self.inner
+    }
+}
+
+pub struct ConnectionSender {
    channel: mpsc::Sender<FramedNymPacket>,
    current_reconnection_attempt: Arc<AtomicU32>,
 }
@@ -75,46 +102,53 @@ impl ConnectionSender {
    }
 }

-impl Client {
-    pub fn new(config: Config) -> Client {
-        Client {
-            conn_new: HashMap::new(),
-            config,
+struct ManagedConnection {
+    address: SocketAddr,
+    message_receiver: ReceiverStream<FramedNymPacket>,
+    connection_timeout: Duration,
+    current_reconnection: Arc<AtomicU32>,
+}
+
+impl ManagedConnection {
+    fn new(
+        address: SocketAddr,
+        message_receiver: mpsc::Receiver<FramedNymPacket>,
+        connection_timeout: Duration,
+        current_reconnection: Arc<AtomicU32>,
+    ) -> Self {
+        ManagedConnection {
+            address,
+            message_receiver: ReceiverStream::new(message_receiver),
+            connection_timeout,
+            current_reconnection,
        }
    }

-    async fn manage_connection(
-        address: SocketAddr,
-        receiver: mpsc::Receiver<FramedNymPacket>,
-        connection_timeout: Duration,
-        current_reconnection: &AtomicU32,
-    ) {
+    async fn run(self) {
+        let address = self.address;
        let connection_fut = TcpStream::connect(address);

-        let conn = match tokio::time::timeout(connection_timeout, connection_fut).await {
+        let conn = match tokio::time::timeout(self.connection_timeout, connection_fut).await {
            Ok(stream_res) => match stream_res {
                Ok(stream) => {
-                    debug!("Managed to establish connection to {}", address);
+                    debug!("Managed to establish connection to {}", self.address);
                    // if we managed to connect, reset the reconnection count (whatever it might have been)
-                    current_reconnection.store(0, Ordering::Release);
+                    self.current_reconnection.store(0, Ordering::Release);
                    Framed::new(stream, NymCodec)
                }
                Err(err) => {
-                    debug!(
-                        "failed to establish connection to {} (err: {})",
-                        address, err
-                    );
+                    debug!("failed to establish connection to {address} (err: {err})",);
                    return;
                }
            },
            Err(_) => {
                debug!(
-                    "failed to connect to {} within {:?}",
-                    address, connection_timeout
+                    "failed to connect to {address} within {:?}",
+                    self.connection_timeout
                );

                // we failed to connect - increase reconnection attempt
-                current_reconnection.fetch_add(1, Ordering::SeqCst);
+                self.current_reconnection.fetch_add(1, Ordering::SeqCst);
                return;
            }
        };
@@ -122,15 +156,28 @@ impl Client {
        // Take whatever the receiver channel produces and put it on the connection.
        // We could have as well used conn.send_all(receiver.map(Ok)), but considering we don't care
        // about neither receiver nor the connection, it doesn't matter which one gets consumed
-        if let Err(err) = receiver.map(Ok).forward(conn).await {
-            warn!("Failed to forward packets to {} - {err}", address);
+        if let Err(err) = self.message_receiver.map(Ok).forward(conn).await {
+            warn!("Failed to forward packets to {address}: {err}");
        }

        debug!(
-            "connection manager to {} is finished. Either the connection failed or mixnet client got dropped",
-            address
+            "connection manager to {address} is finished. Either the connection failed or mixnet client got dropped",
        );
    }
+}
+
+impl Client {
+    pub fn new(config: Config, connections_count: Arc<AtomicUsize>) -> Client {
+        Client {
+            active_connections: Default::default(),
+            connections_count,
+            config,
+        }
+    }
+
+    pub fn active_connections(&self) -> ActiveConnections {
+        self.active_connections.clone()
+    }

    /// If we're trying to reconnect, determine how long we should wait.
    fn determine_backoff(&self, current_attempt: u32) -> Option<Duration> {
@@ -150,7 +197,7 @@ impl Client {
    }

    fn make_connection(&mut self, address: NymNodeRoutingAddress, pending_packet: FramedNymPacket) {
-        let (mut sender, receiver) = mpsc::channel(self.config.maximum_connection_buffer_size);
+        let (sender, receiver) = mpsc::channel(self.config.maximum_connection_buffer_size);

        // this CAN'T fail because we just created the channel which has a non-zero capacity
        if self.config.maximum_connection_buffer_size > 0 {
@@ -158,15 +205,16 @@ impl Client {
        }

        // if we already tried to connect to `address` before, grab the current attempt count
-        let current_reconnection_attempt = if let Some(existing) = self.conn_new.get_mut(&address) {
-            existing.channel = sender;
-            Arc::clone(&existing.current_reconnection_attempt)
-        } else {
-            let new_entry = ConnectionSender::new(sender);
-            let current_attempt = Arc::clone(&new_entry.current_reconnection_attempt);
-            self.conn_new.insert(address, new_entry);
-            current_attempt
-        };
+        let current_reconnection_attempt =
+            if let Some(mut existing) = self.active_connections.get_mut(&address) {
+                existing.channel = sender;
+                Arc::clone(&existing.current_reconnection_attempt)
+            } else {
+                let new_entry = ConnectionSender::new(sender);
+                let current_attempt = Arc::clone(&new_entry.current_reconnection_attempt);
+                self.active_connections.insert(address, new_entry);
+                current_attempt
+            };

        // load the actual value.
        let reconnection_attempt = current_reconnection_attempt.load(Ordering::Acquire);
@@ -175,6 +223,7 @@ impl Client {
        // copy the value before moving into another task
        let initial_connection_timeout = self.config.initial_connection_timeout;

+        let connections_count = self.connections_count.clone();
        tokio::spawn(async move {
            // before executing the manager, wait for what was specified, if anything
            if let Some(backoff) = backoff {
@@ -182,13 +231,16 @@ impl Client {
                sleep(backoff).await;
            }

-            Self::manage_connection(
+            connections_count.fetch_add(1, Ordering::SeqCst);
+            ManagedConnection::new(
                address.into(),
                receiver,
                initial_connection_timeout,
-                &current_reconnection_attempt,
+                current_reconnection_attempt,
            )
-            .await
+            .run()
+            .await;
+            connections_count.fetch_sub(1, Ordering::SeqCst);
        });
    }
 }
@@ -200,53 +252,50 @@ impl SendWithoutResponse for Client {
        packet: NymPacket,
        packet_type: PacketType,
    ) -> io::Result<()> {
-        trace!("Sending packet to {:?}", address);
-        let framed_packet =
-            FramedNymPacket::new(packet, packet_type, self.config.use_legacy_version);
+        trace!("Sending packet to {address:?}");
+        let framed_packet = FramedNymPacket::new(packet, packet_type);

-        if let Some(sender) = self.conn_new.get_mut(&address) {
-            if let Err(err) = sender.channel.try_send(framed_packet) {
-                if err.is_full() {
-                    debug!("Connection to {} seems to not be able to handle all the traffic - dropping the current packet", address);
-                    // it's not a 'big' error, but we did not manage to send the packet
-                    // if the queue is full, we can't really do anything but to drop the packet
-                    Err(io::Error::new(
-                        io::ErrorKind::WouldBlock,
-                        "connection queue is full",
-                    ))
-                } else if err.is_disconnected() {
-                    debug!(
-                        "Connection to {} seems to be dead. attempting to re-establish it...",
-                        address
-                    );
-                    // it's not a 'big' error, but we did not manage to send the packet, but queue
-                    // it up to send it as soon as the connection is re-established
-                    self.make_connection(address, err.into_inner());
-                    Err(io::Error::new(
-                        io::ErrorKind::ConnectionAborted,
-                        "reconnection attempt is in progress",
-                    ))
-                } else {
-                    // this can't really happen, but let's safe-guard against it in case something changes in futures library
-                    Err(io::Error::new(
-                        io::ErrorKind::Other,
-                        "unknown connection buffer error",
-                    ))
-                }
-            } else {
-                Ok(())
-            }
-        } else {
+        let Some(sender) = self.active_connections.get_mut(&address) else {
            // there was never a connection to begin with
            debug!("establishing initial connection to {}", address);
            // it's not a 'big' error, but we did not manage to send the packet, but queue the packet
            // for sending for as soon as the connection is created
            self.make_connection(address, framed_packet);
-            Err(io::Error::new(
+            return Err(io::Error::new(
                io::ErrorKind::NotConnected,
                "connection is in progress",
-            ))
-        }
+            ));
+        };
+
+        let sending_res = sender.channel.try_send(framed_packet);
+        drop(sender);
+
+        sending_res.map_err(|err| {
+            match err {
+                TrySendError::Full(_) => {
+                    debug!("Connection to {address} seems to not be able to handle all the traffic - dropping the current packet");
+                    // it's not a 'big' error, but we did not manage to send the packet
+                    // if the queue is full, we can't really do anything but to drop the packet
+                    io::Error::new(
+                        io::ErrorKind::WouldBlock,
+                        "connection queue is full",
+                    )
+                }
+                TrySendError::Closed(dropped) => {
+                    debug!(
+                        "Connection to {address} seems to be dead. attempting to re-establish it...",
+                    );
+
+                    // it's not a 'big' error, but we did not manage to send the packet, but queue
+                    // it up to send it as soon as the connection is re-established
+                    self.make_connection(address, dropped);
+                    io::Error::new(
+                        io::ErrorKind::ConnectionAborted,
+                        "reconnection attempt is in progress",
+                    )
+                }
+            }
+        } )
    }
 }

@@ -255,13 +304,15 @@ mod tests {
    use super::*;

    fn dummy_client() -> Client {
-        Client::new(Config {
-            initial_reconnection_backoff: Duration::from_millis(10_000),
-            maximum_reconnection_backoff: Duration::from_millis(300_000),
-            initial_connection_timeout: Duration::from_millis(1_500),
-            maximum_connection_buffer_size: 128,
-            use_legacy_version: false,
-        })
+        Client::new(
+            Config {
+                initial_reconnection_backoff: Duration::from_millis(10_000),
+                maximum_reconnection_backoff: Duration::from_millis(300_000),
+                initial_connection_timeout: Duration::from_millis(1_500),
+                maximum_connection_buffer_size: 128,
+            },
+            Default::default(),
+        )
    }

    #[test]
@@ -1,77 +1,72 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::client::{Client, Config, SendWithoutResponse};
 use futures::channel::mpsc;
-use futures::StreamExt;
-use log::*;
+use futures::channel::mpsc::SendError;
 use nym_sphinx::forwarding::packet::MixPacket;
-use std::time::Duration;
+use tokio::time::Instant;

-pub type MixForwardingSender = mpsc::UnboundedSender<MixPacket>;
-type MixForwardingReceiver = mpsc::UnboundedReceiver<MixPacket>;
-
-/// A specialisation of client such that it forwards any received packets on the channel into the
-/// mix network immediately, i.e. will not try to listen for any responses.
-pub struct PacketForwarder {
-    mixnet_client: Client,
-    packet_receiver: MixForwardingReceiver,
-    shutdown: nym_task::TaskClient,
+pub fn mix_forwarding_channels() -> (MixForwardingSender, MixForwardingReceiver) {
+    let (tx, rx) = mpsc::unbounded();
+    (tx.into(), rx)
 }

-impl PacketForwarder {
-    pub fn new(
-        initial_reconnection_backoff: Duration,
-        maximum_reconnection_backoff: Duration,
-        initial_connection_timeout: Duration,
-        maximum_connection_buffer_size: usize,
-        use_legacy_version: bool,
-        shutdown: nym_task::TaskClient,
-    ) -> (PacketForwarder, MixForwardingSender) {
-        let client_config = Config::new(
-            initial_reconnection_backoff,
-            maximum_reconnection_backoff,
-            initial_connection_timeout,
-            maximum_connection_buffer_size,
-            use_legacy_version,
-        );
+#[derive(Clone)]
+pub struct MixForwardingSender(mpsc::UnboundedSender<PacketToForward>);

-        let (packet_sender, packet_receiver) = mpsc::unbounded();
+impl From<mpsc::UnboundedSender<PacketToForward>> for MixForwardingSender {
+    fn from(tx: mpsc::UnboundedSender<PacketToForward>) -> Self {
+        MixForwardingSender(tx)
+    }
+}

-        (
-            PacketForwarder {
-                mixnet_client: Client::new(client_config),
-                packet_receiver,
-                shutdown,
-            },
-            packet_sender,
-        )
+impl MixForwardingSender {
+    pub fn forward_packet(&self, packet: impl Into<PacketToForward>) -> Result<(), SendError> {
+        self.0
+            .unbounded_send(packet.into())
+            .map_err(|err| err.into_send_error())
    }

-    pub async fn run(&mut self) {
-        while !self.shutdown.is_shutdown() {
-            tokio::select! {
-                biased;
-                _ = self.shutdown.recv() => {
-                    log::trace!("PacketForwarder: Received shutdown");
-                }
-                Some(mix_packet) = self.packet_receiver.next() => {
-                     trace!("Going to forward packet to {}", mix_packet.next_hop());
+    #[allow(clippy::len_without_is_empty)]
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+}

-                    let next_hop = mix_packet.next_hop();
-                    let packet_type = mix_packet.packet_type();
-                    let packet = mix_packet.into_packet();
-                    // we don't care about responses, we just want to fire packets
-                    // as quickly as possible
+pub type MixForwardingReceiver = mpsc::UnboundedReceiver<PacketToForward>;

-                    if let Err(err) =
-                        self.mixnet_client
-                            .send_without_response(next_hop, packet, packet_type)
-                    {
-                        debug!("failed to forward the packet - {err}")
-                    }
-                }
-            }
+pub struct PacketToForward {
+    pub packet: MixPacket,
+    pub forward_delay_target: Option<Instant>,
+}
+
+impl From<MixPacket> for PacketToForward {
+    fn from(packet: MixPacket) -> Self {
+        PacketToForward::new_no_delay(packet)
+    }
+}
+
+impl From<(MixPacket, Option<Instant>)> for PacketToForward {
+    fn from((packet, delay_until): (MixPacket, Option<Instant>)) -> Self {
+        PacketToForward::new(packet, delay_until)
+    }
+}
+
+impl From<(MixPacket, Instant)> for PacketToForward {
+    fn from((packet, delay_until): (MixPacket, Instant)) -> Self {
+        PacketToForward::new(packet, Some(delay_until))
+    }
+}
+
+impl PacketToForward {
+    pub fn new(packet: MixPacket, forward_delay_target: Option<Instant>) -> Self {
+        PacketToForward {
+            packet,
+            forward_delay_target,
        }
    }
+
+    pub fn new_no_delay(packet: MixPacket) -> Self {
+        Self::new(packet, None)
+    }
 }
@@ -1,7 +1,9 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+#[cfg(feature = "client")]
 pub mod client;
 pub mod forwarder;

+#[cfg(feature = "client")]
 pub use client::{Client, Config, SendWithoutResponse};
@@ -1,7 +1,6 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-pub use crate::nym_api::NymApiClientExt;
 use crate::nyxd::{self, NyxdClient};
 use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
 use crate::signing::signer::{NoSigner, OfflineSigner};
@@ -20,8 +19,8 @@ use nym_api_requests::ecash::{
    PartialExpirationDateSignatureResponse, VerificationKeyResponse,
 };
 use nym_api_requests::models::{
-    ApiHealthResponse, GatewayCoreStatusResponse, MixnodeCoreStatusResponse, MixnodeStatusResponse,
-    NymNodeDescription, RewardEstimationResponse, StakeSaturationResponse,
+    ApiHealthResponse, GatewayBondAnnotated, GatewayCoreStatusResponse, MixnodeCoreStatusResponse,
+    MixnodeStatusResponse, NymNodeDescription, RewardEstimationResponse, StakeSaturationResponse,
 };
 use nym_api_requests::models::{LegacyDescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::nym_nodes::SkimmedNode;
@@ -32,10 +31,11 @@ use nym_network_defaults::NymNetworkDetails;
 use time::Date;
 use url::Url;

+pub use crate::nym_api::NymApiClientExt;
+use nym_mixnet_contract_common::EpochRewardedSet;
 pub use nym_mixnet_contract_common::{
    mixnode::MixNodeDetails, GatewayBond, IdentityKey, IdentityKeyRef, NodeId, NymNodeDetails,
 };
-
 // re-export the type to not break existing imports
 pub use crate::coconut::EcashApiClient;

@@ -257,6 +257,13 @@ impl<C, S> Client<C, S> {
        Ok(self.nym_api.get_gateways().await?)
    }

+    #[deprecated]
+    pub async fn get_cached_gateways_detailed_unfiltered(
+        &self,
+    ) -> Result<Vec<GatewayBondAnnotated>, ValidatorClientError> {
+        Ok(self.nym_api.get_gateways_detailed_unfiltered().await?)
+    }
+
    // TODO: combine with NymApiClient...
    pub async fn get_all_cached_described_nodes(
        &self,
@@ -332,10 +339,10 @@ impl NymApiClient {
        NymApiClient { nym_api }
    }

-    pub fn new_with_user_agent(api_url: Url, user_agent: UserAgent) -> Self {
+    pub fn new_with_user_agent(api_url: Url, user_agent: impl Into<UserAgent>) -> Self {
        let nym_api = nym_api::Client::builder::<_, ValidatorClientError>(api_url)
            .expect("invalid api url")
-            .with_user_agent(user_agent)
+            .with_user_agent(user_agent.into())
            .build::<ValidatorClientError>()
            .expect("failed to build nym api client");

@@ -351,34 +358,23 @@ impl NymApiClient {
    }

    #[deprecated(note = "use get_all_basic_active_mixing_assigned_nodes instead")]
-    pub async fn get_basic_mixnodes(
-        &self,
-        semver_compatibility: Option<String>,
-    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
-        Ok(self
-            .nym_api
-            .get_basic_mixnodes(semver_compatibility)
-            .await?
-            .nodes)
+    pub async fn get_basic_mixnodes(&self) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        Ok(self.nym_api.get_basic_mixnodes().await?.nodes)
    }

    #[deprecated(note = "use get_all_basic_entry_assigned_nodes instead")]
-    pub async fn get_basic_gateways(
-        &self,
-        semver_compatibility: Option<String>,
-    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
-        Ok(self
-            .nym_api
-            .get_basic_gateways(semver_compatibility)
-            .await?
-            .nodes)
+    pub async fn get_basic_gateways(&self) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        Ok(self.nym_api.get_basic_gateways().await?.nodes)
+    }
+
+    pub async fn get_current_rewarded_set(&self) -> Result<EpochRewardedSet, ValidatorClientError> {
+        Ok(self.nym_api.get_rewarded_set().await?.into())
    }

    /// retrieve basic information for nodes are capable of operating as an entry gateway
    /// this includes legacy gateways and nym-nodes
    pub async fn get_all_basic_entry_assigned_nodes(
        &self,
-        semver_compatibility: Option<String>,
    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
        let mut page = 0;
@@ -387,12 +383,7 @@ impl NymApiClient {
        loop {
            let mut res = self
                .nym_api
-                .get_basic_entry_assigned_nodes(
-                    semver_compatibility.clone(),
-                    false,
-                    Some(page),
-                    None,
-                )
+                .get_basic_entry_assigned_nodes(false, Some(page), None)
                .await?;

            nodes.append(&mut res.nodes.data);
@@ -410,7 +401,6 @@ impl NymApiClient {
    /// this includes legacy mixnodes and nym-nodes
    pub async fn get_all_basic_active_mixing_assigned_nodes(
        &self,
-        semver_compatibility: Option<String>,
    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
        let mut page = 0;
@@ -419,12 +409,7 @@ impl NymApiClient {
        loop {
            let mut res = self
                .nym_api
-                .get_basic_active_mixing_assigned_nodes(
-                    semver_compatibility.clone(),
-                    false,
-                    Some(page),
-                    None,
-                )
+                .get_basic_active_mixing_assigned_nodes(false, Some(page), None)
                .await?;

            nodes.append(&mut res.nodes.data);
@@ -442,7 +427,6 @@ impl NymApiClient {
    /// this includes legacy mixnodes and nym-nodes
    pub async fn get_all_basic_mixing_capable_nodes(
        &self,
-        semver_compatibility: Option<String>,
    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
        let mut page = 0;
@@ -451,12 +435,7 @@ impl NymApiClient {
        loop {
            let mut res = self
                .nym_api
-                .get_basic_mixing_capable_nodes(
-                    semver_compatibility.clone(),
-                    false,
-                    Some(page),
-                    None,
-                )
+                .get_basic_mixing_capable_nodes(false, Some(page), None)
                .await?;

            nodes.append(&mut res.nodes.data);
@@ -471,10 +450,7 @@ impl NymApiClient {
    }

    /// retrieve basic information for all bonded nodes on the network
-    pub async fn get_all_basic_nodes(
-        &self,
-        semver_compatibility: Option<String>,
-    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+    pub async fn get_all_basic_nodes(&self) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
        let mut page = 0;
        let mut nodes = Vec::new();
@@ -482,7 +458,7 @@ impl NymApiClient {
        loop {
            let mut res = self
                .nym_api
-                .get_basic_nodes(semver_compatibility.clone(), false, Some(page), None)
+                .get_basic_nodes(false, Some(page), None)
                .await?;

            nodes.append(&mut res.nodes.data);
@@ -13,7 +13,7 @@ use nym_api_requests::ecash::models::{
 use nym_api_requests::ecash::VerificationKeyResponse;
 use nym_api_requests::models::{
    AnnotationResponse, ApiHealthResponse, LegacyDescribedMixNode, NodePerformanceResponse,
-    NymNodeDescription,
+    NodeRefreshBody, NymNodeDescription, RewardedSetResponse,
 };
 use nym_api_requests::nym_nodes::PaginatedCachedNodesResponse;
 use nym_api_requests::pagination::PaginatedResponse;
@@ -102,6 +102,23 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

+    #[deprecated]
+    #[instrument(level = "debug", skip(self))]
+    async fn get_gateways_detailed_unfiltered(
+        &self,
+    ) -> Result<Vec<GatewayBondAnnotated>, NymAPIError> {
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::STATUS,
+                routes::GATEWAYS,
+                routes::DETAILED_UNFILTERED,
+            ],
+            NO_PARAMS,
+        )
+        .await
+    }
+
    #[deprecated]
    #[instrument(level = "debug", skip(self))]
    async fn get_mixnodes_detailed_unfiltered(
@@ -188,16 +205,7 @@ pub trait NymApiClientExt: ApiClient {

    #[deprecated]
    #[tracing::instrument(level = "debug", skip_all)]
-    async fn get_basic_mixnodes(
-        &self,
-        semver_compatibility: Option<String>,
-    ) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
-        let params = if let Some(semver_compatibility) = &semver_compatibility {
-            vec![("semver_compatibility", semver_compatibility.as_str())]
-        } else {
-            vec![]
-        };
-
+    async fn get_basic_mixnodes(&self) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
        self.get_json(
            &[
                routes::API_VERSION,
@@ -206,23 +214,14 @@ pub trait NymApiClientExt: ApiClient {
                "mixnodes",
                "skimmed",
            ],
-            &params,
+            NO_PARAMS,
        )
        .await
    }

    #[deprecated]
    #[instrument(level = "debug", skip(self))]
-    async fn get_basic_gateways(
-        &self,
-        semver_compatibility: Option<String>,
-    ) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
-        let params = if let Some(semver_compatibility) = &semver_compatibility {
-            vec![("semver_compatibility", semver_compatibility.as_str())]
-        } else {
-            vec![]
-        };
-
+    async fn get_basic_gateways(&self) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
        self.get_json(
            &[
                routes::API_VERSION,
@@ -231,7 +230,16 @@ pub trait NymApiClientExt: ApiClient {
                "gateways",
                "skimmed",
            ],
-            &params,
+            NO_PARAMS,
+        )
+        .await
+    }
+
+    #[instrument(level = "debug", skip(self))]
+    async fn get_rewarded_set(&self) -> Result<RewardedSetResponse, NymAPIError> {
+        self.get_json(
+            &[routes::API_VERSION, "nym-nodes", "rewarded-set"],
+            NO_PARAMS,
        )
        .await
    }
@@ -241,17 +249,12 @@ pub trait NymApiClientExt: ApiClient {
    #[instrument(level = "debug", skip(self))]
    async fn get_basic_entry_assigned_nodes(
        &self,
-        semver_compatibility: Option<String>,
        no_legacy: bool,
        page: Option<u32>,
        per_page: Option<u32>,
    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
        let mut params = Vec::new();

-        if let Some(arg) = &semver_compatibility {
-            params.push(("semver_compatibility", arg.clone()))
-        }
-
        if no_legacy {
            params.push(("no_legacy", "true".to_string()))
        }
@@ -283,17 +286,12 @@ pub trait NymApiClientExt: ApiClient {
    #[instrument(level = "debug", skip(self))]
    async fn get_basic_active_mixing_assigned_nodes(
        &self,
-        semver_compatibility: Option<String>,
        no_legacy: bool,
        page: Option<u32>,
        per_page: Option<u32>,
    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
        let mut params = Vec::new();

-        if let Some(arg) = &semver_compatibility {
-            params.push(("semver_compatibility", arg.clone()))
-        }
-
        if no_legacy {
            params.push(("no_legacy", "true".to_string()))
        }
@@ -325,17 +323,12 @@ pub trait NymApiClientExt: ApiClient {
    #[instrument(level = "debug", skip(self))]
    async fn get_basic_mixing_capable_nodes(
        &self,
-        semver_compatibility: Option<String>,
        no_legacy: bool,
        page: Option<u32>,
        per_page: Option<u32>,
    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
        let mut params = Vec::new();

-        if let Some(arg) = &semver_compatibility {
-            params.push(("semver_compatibility", arg.clone()))
-        }
-
        if no_legacy {
            params.push(("no_legacy", "true".to_string()))
        }
@@ -365,17 +358,12 @@ pub trait NymApiClientExt: ApiClient {
    #[instrument(level = "debug", skip(self))]
    async fn get_basic_nodes(
        &self,
-        semver_compatibility: Option<String>,
        no_legacy: bool,
        page: Option<u32>,
        per_page: Option<u32>,
    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
        let mut params = Vec::new();

-        if let Some(arg) = &semver_compatibility {
-            params.push(("semver_compatibility", arg.clone()))
-        }
-
        if no_legacy {
            params.push(("no_legacy", "true".to_string()))
        }
@@ -695,16 +683,32 @@ pub trait NymApiClientExt: ApiClient {
        &self,
        node_id: NodeId,
    ) -> Result<NodePerformanceResponse, NymAPIError> {
-        self.get_json_from(format!("/v1/nym-nodes/performance/{node_id}"))
-            .await
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "nym-nodes",
+                "performance",
+                &node_id.to_string(),
+            ],
+            NO_PARAMS,
+        )
+        .await
    }

    async fn get_node_annotation(
        &self,
        node_id: NodeId,
    ) -> Result<AnnotationResponse, NymAPIError> {
-        self.get_json_from(format!("/v1/nym-nodes/annotation/{node_id}"))
-            .await
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "nym-nodes",
+                "annotation",
+                &node_id.to_string(),
+            ],
+            NO_PARAMS,
+        )
+        .await
    }

    #[deprecated]
@@ -917,6 +921,20 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

+    #[instrument(level = "debug", skip(self))]
+    async fn force_refresh_describe_cache(
+        &self,
+        request: &NodeRefreshBody,
+    ) -> Result<(), NymAPIError> {
+        self.post_json(
+            &[routes::API_VERSION, "nym-nodes", "refresh-described"],
+            NO_PARAMS,
+            request,
+        )
+        .await
+    }
+
+    #[instrument(level = "debug", skip(self))]
    async fn issued_ticketbooks_for(
        &self,
        expiration_date: Date,
@@ -933,6 +951,7 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

+    #[instrument(level = "debug", skip(self))]
    async fn issued_ticketbooks_challenge(
        &self,
        expiration_date: Date,
@@ -32,7 +32,7 @@ impl Div<GasPrice> for Coin {
    }
 }

-impl<'a> Div<GasPrice> for &'a Coin {
+impl Div<GasPrice> for &Coin {
    type Output = Gas;

    fn div(self, rhs: GasPrice) -> Self::Output {
@@ -10,10 +10,10 @@ use cosmrs::AccountId;
 use nym_contracts_common::signing::Nonce;
 use nym_mixnet_contract_common::gateway::{PreassignedGatewayIdsResponse, PreassignedId};
 use nym_mixnet_contract_common::nym_node::{
-    EpochAssignmentResponse, NodeDetailsByIdentityResponse, NodeOwnershipResponse,
-    NodeRewardingDetailsResponse, PagedNymNodeBondsResponse, PagedNymNodeDetailsResponse,
-    PagedUnbondedNymNodesResponse, Role, RolesMetadataResponse, StakeSaturationResponse,
-    UnbondedNodeResponse, UnbondedNymNode,
+    EpochAssignmentResponse, NodeDetailsByIdentityResponse, NodeDetailsResponse,
+    NodeOwnershipResponse, NodeRewardingDetailsResponse, PagedNymNodeBondsResponse,
+    PagedNymNodeDetailsResponse, PagedUnbondedNymNodesResponse, Role, RolesMetadataResponse,
+    StakeSaturationResponse, UnbondedNodeResponse, UnbondedNymNode,
 };
 use nym_mixnet_contract_common::reward_params::WorkFactor;
 use nym_mixnet_contract_common::{
@@ -26,10 +26,11 @@ use nym_mixnet_contract_common::{
    reward_params::{Performance, RewardingParams},
    rewarding::{EstimatedCurrentEpochRewardResponse, PendingRewardResponse},
    ContractBuildInformation, ContractState, ContractStateParams, CurrentIntervalResponse,
-    Delegation, EpochEventId, EpochStatus, GatewayBond, GatewayBondResponse,
-    GatewayOwnershipResponse, IdentityKey, IdentityKeyRef, IntervalEventId, MixNodeBond,
-    MixNodeDetails, MixOwnershipResponse, MixnodeDetailsByIdentityResponse, MixnodeDetailsResponse,
-    NodeId, NumberOfPendingEventsResponse, NymNodeBond, NymNodeDetails,
+    CurrentNymNodeVersionResponse, Delegation, EpochEventId, EpochRewardedSet, EpochStatus,
+    GatewayBond, GatewayBondResponse, GatewayOwnershipResponse, HistoricalNymNodeVersionEntry,
+    IdentityKey, IdentityKeyRef, IntervalEventId, MixNodeBond, MixNodeDetails,
+    MixOwnershipResponse, MixnodeDetailsByIdentityResponse, MixnodeDetailsResponse, NodeId,
+    NumberOfPendingEventsResponse, NymNodeBond, NymNodeDetails, NymNodeVersionHistoryResponse,
    PagedAllDelegationsResponse, PagedDelegatorDelegationsResponse, PagedGatewayResponse,
    PagedMixnodeBondsResponse, PagedNodeDelegationsResponse, PendingEpochEvent,
    PendingEpochEventResponse, PendingEpochEventsResponse, PendingIntervalEvent,
@@ -71,6 +72,22 @@ pub trait MixnetQueryClient {
            .await
    }

+    async fn get_nym_node_version_history_paged(
+        &self,
+        start_after: Option<u32>,
+        limit: Option<u32>,
+    ) -> Result<NymNodeVersionHistoryResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodeVersionHistory { limit, start_after })
+            .await
+    }
+
+    async fn get_current_nym_node_version(
+        &self,
+    ) -> Result<CurrentNymNodeVersionResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetCurrentNymNodeVersion {})
+            .await
+    }
+
    async fn get_mixnet_contract_state(&self) -> Result<ContractState, NyxdError> {
        self.query_mixnet_contract(MixnetQueryMsg::GetState {})
            .await
@@ -311,10 +328,7 @@ pub trait MixnetQueryClient {
        .await
    }

-    async fn get_nymnode_details(
-        &self,
-        node_id: NodeId,
-    ) -> Result<NodeOwnershipResponse, NyxdError> {
+    async fn get_nymnode_details(&self, node_id: NodeId) -> Result<NodeDetailsResponse, NyxdError> {
        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodeDetails { node_id })
            .await
    }
@@ -641,6 +655,12 @@ pub trait PagedMixnetQueryClient: MixnetQueryClient {
    ) -> Result<Vec<PendingIntervalEvent>, NyxdError> {
        collect_paged!(self, get_pending_interval_events_paged, events)
    }
+
+    async fn get_full_nym_node_version_history(
+        &self,
+    ) -> Result<Vec<HistoricalNymNodeVersionEntry>, NyxdError> {
+        collect_paged!(self, get_nym_node_version_history_paged, history)
+    }
 }

 #[async_trait]
@@ -650,7 +670,7 @@ impl<T> PagedMixnetQueryClient for T where T: MixnetQueryClient {}
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait MixnetQueryClientExt: MixnetQueryClient {
-    async fn get_rewarded_set(&self) -> Result<RewardedSet, NyxdError> {
+    async fn get_rewarded_set(&self) -> Result<EpochRewardedSet, NyxdError> {
        let error_response = |message| Err(NyxdError::extension_query_failure("mixnet", message));

        let metadata = self.get_rewarded_set_metadata().await?;
@@ -691,13 +711,16 @@ pub trait MixnetQueryClientExt: MixnetQueryClient {
            return error_response("the nodes assigned for 'standby' returned unexpected epoch_id");
        }

-        Ok(RewardedSet {
-            entry_gateways: entry.nodes,
-            exit_gateways: exit.nodes,
-            layer1: layer1.nodes,
-            layer2: layer2.nodes,
-            layer3: layer3.nodes,
-            standby: standby.nodes,
+        Ok(EpochRewardedSet {
+            epoch_id: expected_epoch_id,
+            assignment: RewardedSet {
+                entry_gateways: entry.nodes,
+                exit_gateways: exit.nodes,
+                layer1: layer1.nodes,
+                layer2: layer2.nodes,
+                layer3: layer3.nodes,
+                standby: standby.nodes,
+            },
        })
    }
 }
@@ -727,6 +750,7 @@ where
 mod tests {
    use super::*;
    use crate::nyxd::contract_traits::tests::IgnoreValue;
+    use nym_mixnet_contract_common::QueryMsg;

    // it's enough that this compiles and clippy is happy about it
    #[allow(dead_code)]
@@ -927,6 +951,10 @@ mod tests {
            MixnetQueryMsg::GetRewardedSetMetadata {} => {
                client.get_rewarded_set_metadata().ignore()
            }
+            QueryMsg::GetCurrentNymNodeVersion {} => client.get_current_nym_node_version().ignore(),
+            QueryMsg::GetNymNodeVersionHistory { limit, start_after } => client
+                .get_nym_node_version_history_paged(start_after, limit)
+                .ignore(),
        }
    }
 }
@@ -13,6 +13,44 @@ use tracing::error;

 pub use cosmrs::abci::MsgResponse;

+pub fn parse_singleton_u32_from_contract_response(b: Vec<u8>) -> Result<u32, NyxdError> {
+    if b.len() != 4 {
+        return Err(NyxdError::MalformedResponseData {
+            got: b.len(),
+            expected: 4,
+        });
+    }
+    Ok(u32::from_be_bytes([b[0], b[1], b[2], b[3]]))
+}
+
+pub fn parse_singleton_u64_from_contract_response(b: Vec<u8>) -> Result<u64, NyxdError> {
+    if b.len() != 8 {
+        return Err(NyxdError::MalformedResponseData {
+            got: b.len(),
+            expected: 8,
+        });
+    }
+    Ok(u64::from_be_bytes([
+        b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
+    ]))
+}
+
+#[derive(Debug, Clone)]
+pub struct ParsedContractResponse {
+    pub message_index: usize,
+    pub response: Vec<u8>,
+}
+
+impl ParsedContractResponse {
+    pub fn parse_singleton_u32_contract_data(self) -> Result<u32, NyxdError> {
+        parse_singleton_u32_from_contract_response(self.response)
+    }
+
+    pub fn parse_singleton_u64_contract_data(self) -> Result<u64, NyxdError> {
+        parse_singleton_u64_from_contract_response(self.response)
+    }
+}
+
 pub fn parse_msg_responses(data: Bytes) -> Vec<MsgResponse> {
    // it seems that currently, on wasmd 0.43 + tendermint-rs 0.37 + cosmrs 0.17.0-pre
    // the data is left in undecoded base64 form, but I'd imagine this might change so if the decoding fails,
@@ -34,35 +72,25 @@ pub fn parse_msg_responses(data: Bytes) -> Vec<MsgResponse> {
 }

 // requires there's a single response message
-pub trait ToSingletonContractData: Sized {
+pub trait ContractResponseData: Sized {
    fn parse_singleton_u32_contract_data(&self) -> Result<u32, NyxdError> {
        let b = self.to_singleton_contract_data()?;
-        if b.len() != 4 {
-            return Err(NyxdError::MalformedResponseData {
-                got: b.len(),
-                expected: 4,
-            });
-        }
-        Ok(u32::from_be_bytes([b[0], b[1], b[2], b[3]]))
+        parse_singleton_u32_from_contract_response(b)
    }

    fn parse_singleton_u64_contract_data(&self) -> Result<u64, NyxdError> {
        let b = self.to_singleton_contract_data()?;
-        if b.len() != 8 {
-            return Err(NyxdError::MalformedResponseData {
-                got: b.len(),
-                expected: 8,
-            });
-        }
-        Ok(u64::from_be_bytes([
-            b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
-        ]))
+        parse_singleton_u64_from_contract_response(b)
    }

    fn to_singleton_contract_data(&self) -> Result<Vec<u8>, NyxdError>;
+
+    fn to_unchecked_contract_data(&self) -> Result<Vec<Vec<u8>>, NyxdError>;
+
+    fn to_contract_data(&self) -> Result<Vec<ParsedContractResponse>, NyxdError>;
 }

-impl ToSingletonContractData for ExecuteResult {
+impl ContractResponseData for ExecuteResult {
    fn to_singleton_contract_data(&self) -> Result<Vec<u8>, NyxdError> {
        if self.msg_responses.len() != 1 {
            return Err(NyxdError::UnexpectedNumberOfMsgResponses {
@@ -72,6 +100,30 @@ impl ToSingletonContractData for ExecuteResult {

        self.msg_responses[0].to_contract_response_data()
    }
+
+    fn to_unchecked_contract_data(&self) -> Result<Vec<Vec<u8>>, NyxdError> {
+        self.msg_responses
+            .iter()
+            .map(ToContractResponseData::to_contract_response_data)
+            .collect()
+    }
+
+    fn to_contract_data(&self) -> Result<Vec<ParsedContractResponse>, NyxdError> {
+        let mut response = Vec::new();
+
+        for (message_index, msg) in self.msg_responses.iter().enumerate() {
+            // unfortunately `Name` trait has not been derived for `MsgExecuteContractResponse`,
+            // so we have to make an explicit string comparison instead
+            if msg.type_url == "/cosmwasm.wasm.v1.MsgExecuteContractResponse" {
+                response.push(ParsedContractResponse {
+                    message_index,
+                    response: msg.to_contract_response_data()?,
+                })
+            }
+        }
+
+        Ok(response)
+    }
 }

 pub trait ToContractResponseData: Sized {
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`nym-validator-rewarder/.sqlx/** diff=nodiff`