Add query message wrapper

* remove standalone gateway overhead

* remove standalone mixnode overhead

* additional cleanup: removed unused dependencies et al.

* removed calls to 'log::'

.github/workflows/cd-docs.yml

@@ -5,21 +5,28 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
       - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
         run: sudo pip3 install pandas tabulate
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
+        with:
+          version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 20
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -29,33 +36,13 @@ jobs:
         with:
           command: build
           args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh
 
-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
-
-      - name: Post process
-        run: cd documentation && ./post_process.sh
-        continue-on-error: false
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh
 
       - name: Create Vercel project file
         uses: mobiledevops/secret-to-file-action@v1
@@ -99,24 +86,3 @@ jobs:
         run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
         continue-on-error: false
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: cd-docs
-          NYM_PROJECT_NAME: "Docs CD"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CD_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-build-ts.yml

@@ -1,6 +1,7 @@
 name: ci-build-ts
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - "ts-packages/**"
@@ -9,7 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
     - uses: actions/checkout@v4
     - name: Install rsync
@@ -45,23 +46,3 @@ jobs:
         REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
         TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ts-${{ env.GITHUB_REF_SLUG }}-example
         EXCLUDE: "/dist/, /node_modules/"
-    - name: Matrix - Node Install
-      run: npm install
-      working-directory: .github/workflows/support-files
-    - name: Matrix - Send Notification
-      env:
-        NYM_NOTIFICATION_KIND: ts-packages
-        NYM_PROJECT_NAME: "ts-packages"
-        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-        GIT_BRANCH: "${GITHUB_REF##*/}"
-        IS_SUCCESS: "${{ job.status == 'success' }}"
-        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-      uses: docker://keybaseio/client:stable-node
-      with:
-        args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-build-upload-binaries.yml

@@ -15,23 +15,6 @@ on:
         type: boolean
   schedule:
     - cron: "14 0 * * *"
-  pull_request:
-    paths:
-      - "clients/**"
-      - "common/**"
-      - "explorer-api/**"
-      - "gateway/**"
-      - "integrations/**"
-      - "mixnode/**"
-      - "nym-api/**"
-      - "nym-node/**"
-      - "nym-outfox/**"
-      - "nym-validator-rewarder/**"
-      - "sdk/rust/nym-sdk/**"
-      - "service-providers/**"
-      - "tools/**"
-      - "nymvisor/**"
-      - ".github/workflows/ci-build-upload-binaries.yml"
 
 jobs:
   publish-nym:
@@ -96,6 +79,7 @@ jobs:
             target/release/nym-socks5-client
             target/release/nym-api
             target/release/nym-network-requester
+            target/release/nym-data-observatory
             target/release/nym-cli
             target/release/nymvisor
             target/release/nym-node
@@ -113,6 +97,7 @@ jobs:
           cp target/release/nym-socks5-client $OUTPUT_DIR
           cp target/release/nym-api $OUTPUT_DIR
           cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nym-data-observatory $OUTPUT_DIR
           cp target/release/nymvisor $OUTPUT_DIR
           cp target/release/nym-node $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR

.github/workflows/ci-build-vpn-api-wasm.yml

@@ -0,0 +1,41 @@
+name: ci-build-vpn-api-wasm
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workflows/ci-build-vpn-api-wasm.yml'
+
+jobs:
+  wasm:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
+
+      - name: Install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+
+      - name: "Build"
+        run: make
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm

.github/workflows/ci-build.yml

@@ -16,6 +16,7 @@ on:
       - 'nym-api/**'
       - 'nym-node/**'
       - 'nym-outfox/**'
+      - 'nym-data-observatory/**'
       - 'nym-validator-rewarder/**'
       - 'tools/**'
       - 'wasm/**'
@@ -29,7 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [arc-ubuntu-20.04, custom-runner-mac-m1]
+        os: [ arc-ubuntu-20.04, custom-runner-mac-m1 ]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
@@ -56,19 +57,17 @@ jobs:
           command: fmt
           args: --all -- --check
 
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --workspace --all-targets -- -D warnings
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
           command: build
 
-      # while disabled by default, this build ensures nothing is broken within
-      # `axum` feature
-      - name: Build with `axum` feature
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --features axum
-
       - name: Build all examples
         if: contains(matrix.os, 'ubuntu')
         uses: actions-rs/cargo@v1
@@ -89,9 +88,3 @@ jobs:
         with:
           command: test
           args: --workspace -- --ignored
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace --all-targets --features axum -- -D warnings

.github/workflows/ci-cargo-deny.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   cargo-deny:
-    runs-on: arc-ubuntu-22.04-dind
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         checks:
@@ -22,4 +22,4 @@ jobs:
       with:
         log-level: warn
         command: check ${{ matrix.checks }}
-        argument: --all-features
+        arguments: --all-features

.github/workflows/ci-contracts-matrix-includes.json

@@ -2,9 +2,5 @@
   {
     "rust":"stable",
     "runOnEvent":"always"
-  },
-  {
-    "rust":"beta",
-    "runOnEvent":"pull_request"
   }
 ]

.github/workflows/ci-contracts-upload-binaries.yml

@@ -2,11 +2,6 @@ name: ci-contracts-upload-binaries
 
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - 'common/**'
-      - 'contracts/**'
-      - '.github/workflows/ci-contracts-upload-binaries.yml'
 
 env:
   NETWORK: mainnet
@@ -16,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: arc-ubuntu-20.04
+        platform: [ arc-ubuntu-20.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-docs.yml

@@ -3,28 +3,35 @@ name: ci-docs
 on:
   workflow_dispatch:
   push:
-    branches-ignore: master
+    branches-ignore: [master]
     paths:
-      - 'documentation/docs/**'
-      - '.github/workflows/ci-docs.yml'
+      - "documentation/docs/**"
+      - ".github/workflows/ci-docs.yml"
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
+    defaults:
+      run:
+        working-directory: documentation/docs
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
       - name: Install pip3
-        run: sudo apt install -y python3-pip  
+        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
         run: sudo pip3 install pandas tabulate
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.0.0
+        with:
+          version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 20
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -34,30 +41,13 @@ jobs:
         with:
           command: build
           args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
 
-# This is the original flow
-#      - name: Build all projects in documentation/ & move to ~/dist/docs/
-#        run: cd documentation && ./build_all_to_dist.sh
-
-# This is a workaround replacement which builds on the last working commit b332a6b55668f60988e36961f3f62a794ba82ddb and then on current branch
-      - name: Save current branch to ~/current_branch
-        run: git rev-parse --abbrev-ref HEAD > ~/current_branch
-      - name: Git pull, reset & switch to b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: git pull && git reset --hard && git checkout b332a6b55668f60988e36961f3f62a794ba82ddb
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ from b332a6b55668f60988e36961f3f62a794ba82ddb
-        run: cd documentation && ./build_all_to_dist.sh
-
-      - name: Switch to current branch
-        run: git checkout $echo "$(cat ~/current_branch)"
-      - name: Build all projects in documentation/ & move to ~/dist/docs/ on current branch
-        run: cd documentation && ./build_all_to_dist.sh && rm ~/current_branch
-
-# End of replacemet
+      - name: Install project dependencies
+        run: pnpm i
+      - name: Build project
+        run: pnpm run build
+      - name: Move files to /dist/
+        run: ../scripts/move-to-dist.sh
 
       - name: Deploy branch to CI www
         continue-on-error: true
@@ -68,26 +58,5 @@ jobs:
           SOURCE: "dist/docs/"
           REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
           REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-nextra-${{ env.GITHUB_REF_SLUG }}
           EXCLUDE: "/node_modules/"
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ci-docs
-          NYM_PROJECT_NAME: "Docs CI"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-lint-typescript.yml

@@ -1,6 +1,7 @@
 name: ci-lint-typescript
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - "ts-packages/**"
@@ -14,7 +15,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
       - uses: rlespinasse/github-slug-action@v3.x
@@ -53,24 +54,3 @@ jobs:
         run: yarn lint
       - name: Typecheck with tsc
         run: yarn tsc
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "ts-packages"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-nym-api-tests.yml

@@ -1,39 +0,0 @@
-name: ci-nym-api-tests
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - "nym-api/**"
-
-defaults:
-  run:
-    working-directory: nym-api/tests
-
-jobs:
-  test:
-    name: nym-api tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: install yarn in root
-        run: cd ../.. && yarn install
-
-      - name: Install npm
-        run: npm install
-
-      - name: Node v18
-        uses: actions/setup-node@v4
-        with:
-          node-version: 18.1.0
-
-      - name: Install yarn
-        run: yarn install
-
-      - name: Run yarn
-        run: yarn
-
-      - name: Run tests
-        run: yarn test:sandbox
-        working-directory: nym-api/tests

.github/workflows/ci-sdk-docs-typescript.yml

@@ -1,79 +0,0 @@
-name: ci-sdk-docs-typescript
-
-on:
-  pull_request:
-    paths:
-      - "sdk/typescript/**"
-      - "wasm/**"
-      - '.github/workflows/ci-sdk-docs-typescript.yml'
-
-jobs:
-  build:
-    runs-on: custom-linux
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-      - uses: rlespinasse/github-slug-action@v3.x
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 18.17
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.20'
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Install wasm-opt
-        uses: ./.github/actions/install-wasm-opt
-        with:
-          version: '116'
-
-      - name: Build branch WASM packages
-        run: make sdk-wasm-build
-
-      - name: Install
-        run: yarn
-      - name: Build
-        run: yarn docs:prod:build
-      - name: Deploy branch to CI www (docs)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "dist/ts/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "sdk-ts-docs"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}/docs/sdk/typescript"
-          NYM_CI_WWW_LOCATION: "sdk-ts-docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/hello-world.yaml

@@ -0,0 +1,11 @@
+name: Hello world
+
+on:
+  workflow_dispatch:
+
+jobs:
+  my-job:
+    runs-on: arc-ubuntu-22.04
+    steps:
+      - name: my-step
+        run: echo "Hello World!"

.github/workflows/pr-validation.yml

@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - develop
-      - 'release/**'
+      - "release/**"
+    paths-ignore:
+      - "documentation/**"
     types:
       - labeled
       - unlabeled

.github/workflows/publish-sdk-npm.yml

@@ -4,7 +4,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/push-credential-proxy.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Credential Proxy container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-credential-proxy"
+  CONTAINER_NAME: "credential-proxy"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-data-observatory.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Data observatory container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-data-observatory"
+  CONTAINER_NAME: "data-observatory"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-agent.yaml

@@ -0,0 +1,61 @@
+name: Build and upload Node Status agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      gateway_probe_git_ref:
+        type: string
+        description: Which gateway probe git ref to build the image with
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-agent"
+  CONTAINER_NAME: "node-status-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-api.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Node Status API container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-api"
+  CONTAINER_NAME: "node-status-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-nym-node.yaml

@@ -0,0 +1,55 @@
+name: Build and upload nym node container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node"
+  CONTAINER_NAME: "nym-node"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-validator-rewarder.yaml

@@ -0,0 +1,49 @@
+name: Build and upload Validator Rewarder container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-validator-rewarder"
+  CONTAINER_NAME: "validator-rewarder"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

CHANGELOG.md

@@ -4,6 +4,156 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
+## [2024.11-wedel] (2024-09-23)
+
+- Backport #4894 to fix ci ([#4899])
+- Bugfix/ticketbook false double spending ([#4892])
+- fix: allow updating globally stored signatures ([#4891])
+- [DOCs/operators]: Document changelog for patch/2024.10-caramello ([#4886])
+- [DOCs/operators]: Post release docs updates ([#4874])
+- Bump defguard to github latest version ([#4872])
+- chore: removed completed queued mixnet migration ([#4865])
+- Disable push trigger and add missing paths in ci-build ([#4864])
+- Fix linux conditional in ci-build.yml ([#4863])
+- Remove golang workaround in ci-sdk-wasm ([#4858])
+- Revert runner for ci-docs ([#4855])
+- Move credential verification into common crate ([#4853])
+- Fix test failure in ipr request size ([#4844])
+- Start switching over jobs to arc-ubuntu-20.04 ([#4843])
+- Use ecash credential type for bandwidth value ([#4840])
+- Create nym-repo-setup debian package and nym-vpn meta package ([#4837])
+- Remove serde_crate named import ([#4832])
+- Run cargo autoinherit following last weeks dependabot updates ([#4831])
+- revamped ticketbook serialisation and exposed additional cli methods ([#4827])
+- Expose wireguard details on self described endpoint ([#4825])
+- Remove unused wireguard flag from SDK ([#4823])
+- Add `axum` server to `nym-api` ([#4803])
+- Run cargo-autoinherit for a few new crates ([#4801])
+- Update dependabot ([#4796])
+- Fix clippy for unwrap_or_default ([#4783])
+- Enable dependabot version upgrades for root rust workspace ([#4778])
+- Persist used wireguard private IPs ([#4771])
+- Avoid race on ip and registration structures ([#4766])
+- docs/hotfix ([#4765])
+- chore: remove repetitive words ([#4763])
+- Make gateway latency check generic ([#4759])
+- Remove duplicate stat count for retransmissions ([#4756])
+- Update peer refresh value ([#4754])
+- Remove deprecated mark_as_success and use new disarm ([#4751])
+- Add get_mixnodes_described to validator_client ([#4725])
+- New Network Monitor ([#4610])
+
+[#4899]: https://github.com/nymtech/nym/pull/4899
+[#4892]: https://github.com/nymtech/nym/pull/4892
+[#4891]: https://github.com/nymtech/nym/pull/4891
+[#4886]: https://github.com/nymtech/nym/pull/4886
+[#4874]: https://github.com/nymtech/nym/pull/4874
+[#4872]: https://github.com/nymtech/nym/pull/4872
+[#4865]: https://github.com/nymtech/nym/pull/4865
+[#4864]: https://github.com/nymtech/nym/pull/4864
+[#4863]: https://github.com/nymtech/nym/pull/4863
+[#4858]: https://github.com/nymtech/nym/pull/4858
+[#4855]: https://github.com/nymtech/nym/pull/4855
+[#4853]: https://github.com/nymtech/nym/pull/4853
+[#4844]: https://github.com/nymtech/nym/pull/4844
+[#4843]: https://github.com/nymtech/nym/pull/4843
+[#4840]: https://github.com/nymtech/nym/pull/4840
+[#4837]: https://github.com/nymtech/nym/pull/4837
+[#4832]: https://github.com/nymtech/nym/pull/4832
+[#4831]: https://github.com/nymtech/nym/pull/4831
+[#4827]: https://github.com/nymtech/nym/pull/4827
+[#4825]: https://github.com/nymtech/nym/pull/4825
+[#4823]: https://github.com/nymtech/nym/pull/4823
+[#4803]: https://github.com/nymtech/nym/pull/4803
+[#4801]: https://github.com/nymtech/nym/pull/4801
+[#4796]: https://github.com/nymtech/nym/pull/4796
+[#4783]: https://github.com/nymtech/nym/pull/4783
+[#4778]: https://github.com/nymtech/nym/pull/4778
+[#4771]: https://github.com/nymtech/nym/pull/4771
+[#4766]: https://github.com/nymtech/nym/pull/4766
+[#4765]: https://github.com/nymtech/nym/pull/4765
+[#4763]: https://github.com/nymtech/nym/pull/4763
+[#4759]: https://github.com/nymtech/nym/pull/4759
+[#4756]: https://github.com/nymtech/nym/pull/4756
+[#4754]: https://github.com/nymtech/nym/pull/4754
+[#4751]: https://github.com/nymtech/nym/pull/4751
+[#4725]: https://github.com/nymtech/nym/pull/4725
+[#4610]: https://github.com/nymtech/nym/pull/4610
+
 ## [2024.10-caramello] (2024-09-10)
 
 - Backport 4844 and 4845 ([#4857])

Cargo.toml

@@ -19,33 +19,33 @@ members = [
     "clients/native",
     "clients/native/websocket-requests",
     "clients/socks5",
-    "common/authenticator-requests",
     "common/async-file-watcher",
+    "common/authenticator-requests",
     "common/bandwidth-controller",
     "common/bin-common",
     "common/client-core",
     "common/client-core/config-types",
-    "common/client-core/surb-storage",
     "common/client-core/gateways-storage",
+    "common/client-core/surb-storage",
     "common/client-libs/gateway-client",
     "common/client-libs/mixnet-client",
     "common/client-libs/validator-client",
     "common/commands",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
-    "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
     "common/country-group",
     "common/credential-storage",
-    "common/credentials",
     "common/credential-utils",
-    "common/credentials-interface",
     "common/credential-verification",
+    "common/credentials",
+    "common/credentials-interface",
     "common/crypto",
     "common/dkg",
     "common/ecash-double-spending",
@@ -54,19 +54,21 @@ members = [
     "common/exit-policy",
     "common/gateway-requests",
     "common/gateway-storage",
+    "common/gateway-stats-storage",
     "common/http-api-client",
     "common/http-api-common",
     "common/inclusion-probability",
     "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
+    "common/models",
     "common/network-defaults",
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
-    "common/nymcoconut",
-    "common/nym_offline_compact_ecash",
     "common/nym-id",
     "common/nym-metrics",
+    "common/nym_offline_compact_ecash",
+    "common/nymcoconut",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -85,8 +87,10 @@ members = [
     "common/socks5-client-core",
     "common/socks5/proxy-helpers",
     "common/socks5/requests",
+    "common/statistics",
     "common/store-cipher",
     "common/task",
+    "common/ticketbooks-merkle",
     "common/topology",
     "common/tun",
     "common/types",
@@ -95,27 +99,38 @@ members = [
     "common/wasm/utils",
     "common/wireguard",
     "common/wireguard-types",
+    # "documentation/autodoc",
     "explorer-api",
     "explorer-api/explorer-api-requests",
     "explorer-api/explorer-client",
     "gateway",
     "integrations/bity",
     "mixnode",
+    "sdk/ffi/cpp",
+    "sdk/ffi/go",
+    "sdk/ffi/shared",
     "sdk/lib/socks5-listener",
     "sdk/rust/nym-sdk",
     "service-providers/authenticator",
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
-    "nym-network-monitor",
     "nym-api",
-    "nym-browser-extension/storage",
     "nym-api/nym-api-requests",
+    "nym-browser-extension/storage",
+    "nym-credential-proxy/nym-credential-proxy",
+    "nym-credential-proxy/nym-credential-proxy-requests",
+    "nym-credential-proxy/vpn-api-lib-wasm",
+    "nym-data-observatory",
+    "nym-network-monitor",
     "nym-node",
     "nym-node/nym-node-http-api",
     "nym-node/nym-node-requests",
+    "nym-node-status-api",
+    "nym-node-status-agent",
     "nym-outfox",
     "nym-validator-rewarder",
+    "tools/echo-server",
     "tools/internal/ssl-inject",
     # "tools/internal/sdk-version-bump",
     "tools/internal/testnet-manager",
@@ -130,17 +145,27 @@ members = [
     "wasm/mix-fetch",
     "wasm/node-tester",
     "wasm/zknym-lib",
+    "tools/echo-server",
+    "tools/internal/contract-state-importer/importer-cli",
+    "tools/internal/contract-state-importer/importer-contract",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
+    "common/models",
     "explorer-api",
     "gateway",
     "mixnode",
     "nym-api",
+    "nym-credential-proxy/nym-credential-proxy",
+    "nym-data-observatory",
     "nym-node",
+    "nym-node-status-api",
     "nym-validator-rewarder",
+    "nym-node-status-api",
     "service-providers/authenticator",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
@@ -153,7 +178,6 @@ exclude = [
     "nym-wallet",
     "nym-vpn/ui/src-tauri",
     "cpu-cycles",
-    "sdk/ffi/cpp",
 ]
 
 [workspace.package]
@@ -172,24 +196,22 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 aead = "0.5.2"
-anyhow = "1.0.89"
+anyhow = "1.0.90"
 argon2 = "0.5.0"
-async-trait = "0.1.82"
+async-trait = "0.1.83"
+axum-client-ip = "0.6.1"
 axum = "0.7.5"
-axum-extra = "0.9.3"
+axum-extra = "0.9.4"
 base64 = "0.22.1"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
-
-# can we unify those?
-bit-vec = "0.7.0"
+bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
-
 blake3 = "1.5.4"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.7.1"
+bytes = "1.7.2"
 cargo_metadata = "0.18.1"
 celes = "2.4.0"
 cfg-if = "1.0.0"
@@ -197,7 +219,7 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.5.17"
+clap = "4.5.20"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
@@ -213,7 +235,8 @@ ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.4.2"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
 dirs = "5.0"
 doc-comment = "0.3"
@@ -221,10 +244,12 @@ dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
 etherparse = "0.13.0"
+envy = "0.4"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.0.33"
+flate2 = "1.0.34"
 futures = "0.3.28"
+futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
 getset = "0.1.3"
@@ -248,22 +273,25 @@ ipnetwork = "0.20"
 isocountry = "0.3.2"
 itertools = "0.13.0"
 k256 = "0.13"
-lazy_static = "1.4.0"
+lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
 maxminddb = "0.23.0"
+rs_merkle = "1.4.2"
 mime = "0.3.17"
+moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
-once_cell = "1.7.2"
+once_cell = "1.20.2"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
-pin-project = "1.0"
+pin-project = "1.1"
+pin-project-lite = "0.2.14"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
@@ -282,25 +310,27 @@ rocket_okapi = "0.8.0"
 safer-ffi = "0.1.13"
 schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.210"
+serde = "1.0.211"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.128"
+serde_json = "1.0.132"
+serde_json_path = "0.6.7"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
-sqlx = "0.6.3"
+sqlx = "0.7.4"
 strum = "0.26"
+strum_macros = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.30.13"
 tap = "1.0.1"
-tar = "0.4.41"
+tar = "0.4.42"
 tempfile = "3.5.0"
-thiserror = "1.0.63"
+thiserror = "1.0.64"
 time = "0.3.30"
 tokio = "1.39"
 tokio-stream = "0.1.16"
@@ -315,7 +345,8 @@ tracing = "0.1.37"
 tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.16"
 tracing-tree = "0.2.2"
-ts-rs = "7.0.0"
+tracing-log = "0.2"
+ts-rs = "10.0.0"
 tungstenite = { version = "0.20.1", default-features = false }
 url = "2.5"
 utoipa = "4.2"
@@ -337,6 +368,7 @@ prometheus = { version = "0.13.0" }
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }
+subtle = "2.5.0"
 
 # cosmwasm-related
 cosmwasm-schema = "=1.4.3"
@@ -375,14 +407,19 @@ indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", bra
 js-sys = "0.3.70"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.93"
-wasm-bindgen-futures = "0.4.43"
+wasm-bindgen = "0.2.95"
+wasm-bindgen-futures = "0.4.45"
 wasmtimer = "0.2.0"
-web-sys = "0.3.70"
-
+web-sys = "0.3.72"
 
 # Profile settings for individual crates
 
+# Compile-time verified queries do quite a bit of work at compile time. Incremental
+#  actions like cargo check and cargo build can be significantly faster when
+# using an optimized build
+[profile.dev.package.sqlx-macros]
+opt-level = 3
+
 [profile.release.package.nym-socks5-listener]
 strip = true
 codegen-units = 1

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.40"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/client/config/template.rs

@@ -102,5 +102,10 @@ average_ack_delay = '{{ debug.acknowledgements.average_ack_delay }}'
 [debug.cover_traffic]
 loop_cover_traffic_average_delay = '{{ debug.cover_traffic.loop_cover_traffic_average_delay }}'
 
+[debug.stats_reporting]
+enabled = {{ debug.stats_reporting.enabled }}
+provider_address = '{{ debug.stats_reporting.provider_address }}'
+reporting_interval = '{{ debug.stats_reporting.reporting_interval }}'
+
 
 "#;

clients/native/src/commands/init.rs

@@ -81,6 +81,7 @@ impl From<Init> for OverrideConfig {
 
             nyxd_urls: init_config.common_args.nyxd_urls,
             enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
+            stats_reporting_address: init_config.common_args.stats_reporting_address,
         }
     }
 }

clients/native/src/commands/mod.rs

@@ -13,6 +13,7 @@ use clap::{Parser, Subcommand};
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
+use nym_client::client::Recipient;
 use nym_client_core::cli_helpers::CliClient;
 use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_config::OptionalSet;
@@ -104,6 +105,7 @@ pub(crate) struct OverrideConfig {
     no_cover: bool,
     nyxd_urls: Option<Vec<url::Url>>,
     enabled_credentials_mode: Option<bool>,
+    stats_reporting_address: Option<Recipient>,
 }
 
 pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync>> {
@@ -149,6 +151,11 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
             BaseClientConfig::with_disabled_credentials,
             args.enabled_credentials_mode.map(|b| !b),
         )
+        .with_optional_env_ext(
+            BaseClientConfig::with_enabled_stats_reporting_address,
+            args.stats_reporting_address,
+            nym_network_defaults::var_names::CLIENT_STATS_COLLECTION_PROVIDER,
+        )
 }
 
 async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {

clients/native/src/commands/run.rs

@@ -43,6 +43,7 @@ impl From<Run> for OverrideConfig {
             no_cover: run_config.common_args.no_cover,
             nyxd_urls: run_config.common_args.nyxd_urls,
             enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
+            stats_reporting_address: run_config.common_args.stats_reporting_address,
         }
     }
 }

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.40"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

clients/socks5/src/commands/init.rs

@@ -92,6 +92,7 @@ impl From<Init> for OverrideConfig {
             nyxd_urls: init_config.common_args.nyxd_urls,
             enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
             outfox: false,
+            stats_reporting_address: init_config.common_args.stats_reporting_address,
         }
     }
 }

clients/socks5/src/commands/mod.rs

@@ -19,6 +19,7 @@ use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
 use nym_client_core::config::{GroupBy, TopologyStructure};
 use nym_config::OptionalSet;
+use nym_sphinx::addressing::Recipient;
 use nym_sphinx::params::{PacketSize, PacketType};
 use std::error::Error;
 use std::net::IpAddr;
@@ -111,6 +112,7 @@ pub(crate) struct OverrideConfig {
     nyxd_urls: Option<Vec<url::Url>>,
     enabled_credentials_mode: Option<bool>,
     outfox: bool,
+    stats_reporting_address: Option<Recipient>,
 }
 
 pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync>> {
@@ -196,6 +198,11 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
             BaseClientConfig::with_disabled_credentials,
             args.enabled_credentials_mode.map(|b| !b),
         )
+        .with_optional_base_env(
+            BaseClientConfig::with_enabled_stats_reporting_address,
+            args.stats_reporting_address,
+            nym_network_defaults::var_names::CLIENT_STATS_COLLECTION_PROVIDER,
+        )
 }
 
 async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError> {

clients/socks5/src/commands/run.rs

@@ -70,6 +70,7 @@ impl From<Run> for OverrideConfig {
             nyxd_urls: run_config.common_args.nyxd_urls,
             enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
             outfox: run_config.outfox,
+            stats_reporting_address: run_config.common_args.stats_reporting_address,
         }
     }
 }

clients/socks5/src/config/template.rs

@@ -108,4 +108,9 @@ average_ack_delay = '{{ core.debug.acknowledgements.average_ack_delay }}'
 [core.debug.cover_traffic]
 loop_cover_traffic_average_delay = '{{ core.debug.cover_traffic.loop_cover_traffic_average_delay }}'
 
+[core.debug.stats_reporting]
+enabled = {{ core.debug.stats_reporting.enabled }}
+provider_address = '{{ core.debug.stats_reporting.provider_address }}'
+reporting_interval = '{{ core.debug.stats_reporting.reporting_interval }}'
+
 "#;

common/authenticator-requests/Cargo.toml

@@ -17,6 +17,7 @@ thiserror = { workspace = true }
 
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-network-defaults = { path = "../network-defaults" }
 nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-wireguard-types = { path = "../wireguard-types" }

common/authenticator-requests/src/error.rs

@@ -19,4 +19,7 @@ pub enum Error {
         #[source]
         source: hmac::digest::MacError,
     },
+
+    #[error("conversion: {0}")]
+    Conversion(String),
 }

common/authenticator-requests/src/lib.rs

@@ -3,12 +3,15 @@
 
 pub mod v1;
 pub mod v2;
+pub mod v3;
+pub mod v4;
 
 mod error;
 
-pub use v2 as latest;
+pub use error::Error;
+pub use v4 as latest;
 
-pub const CURRENT_VERSION: u8 = 2;
+pub const CURRENT_VERSION: u8 = 4;
 
 fn make_bincode_serializer() -> impl bincode::Options {
     use bincode::Options;

common/authenticator-requests/src/v1/mod.rs

@@ -10,4 +10,4 @@ pub use registration::{ClientMac, GatewayClient, InitMessage, Nonce};
 #[cfg(feature = "verify")]
 pub use registration::HmacSha256;
 
-const VERSION: u8 = 1;
+pub const VERSION: u8 = 1;

common/authenticator-requests/src/v1/registration.rs

@@ -26,7 +26,7 @@ pub type HmacSha256 = Hmac<Sha256>;
 pub type Nonce = u64;
 pub type Taken = Option<SystemTime>;
 
-pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+pub const BANDWIDTH_CAP_PER_DAY: i64 = 1024 * 1024 * 1024; // 1 GB
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct InitMessage {

common/authenticator-requests/src/v2/conversion.rs

@@ -62,8 +62,113 @@ impl From<v1::registration::GatewayClient> for v2::registration::GatewayClient {
     }
 }
 
+impl From<v2::registration::GatewayClient> for v1::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
 impl From<v1::registration::ClientMac> for v2::registration::ClientMac {
     fn from(mac: v1::registration::ClientMac) -> Self {
         Self::new(mac.to_vec())
     }
 }
+
+impl From<v2::registration::ClientMac> for v1::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::response::AuthenticatorResponse> for v1::response::AuthenticatorResponse {
+    fn from(authenticator_response: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            version: authenticator_response.protocol.version,
+            data: authenticator_response.data.into(),
+            reply_to: authenticator_response.reply_to,
+        }
+    }
+}
+
+impl From<v2::response::AuthenticatorResponseData> for v1::response::AuthenticatorResponseData {
+    fn from(authenticator_response_data: v2::response::AuthenticatorResponseData) -> Self {
+        match authenticator_response_data {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => v1::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response.into(),
+            ),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                v1::response::AuthenticatorResponseData::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => v1::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            ),
+        }
+    }
+}
+
+impl From<v2::response::PendingRegistrationResponse> for v1::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RegisteredResponse> for v1::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RemainingBandwidthResponse> for v1::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v2::registration::RegistrationData> for v1::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RemainingBandwidthData> for v1::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth as u64,
+            suspended: false,
+        }
+    }
+}

common/authenticator-requests/src/v2/mod.rs

@@ -6,4 +6,4 @@ pub mod registration;
 pub mod request;
 pub mod response;
 
-const VERSION: u8 = 2;
+pub const VERSION: u8 = 2;

common/authenticator-requests/src/v2/registration.rs

@@ -66,7 +66,7 @@ pub struct RegistredData {
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RemainingBandwidthData {
-    pub available_bandwidth: u64,
+    pub available_bandwidth: i64,
 }
 
 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.

common/authenticator-requests/src/v2/request.rs

@@ -17,6 +17,11 @@ fn generate_random() -> u64 {
     rng.next_u64()
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct QueryMessage {
+    pub pub_key: PeerPublicKey,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct AuthenticatorRequest {
     pub protocol: Protocol,
@@ -65,7 +70,7 @@ impl AuthenticatorRequest {
         )
     }
 
-    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+    pub fn new_query_request(query_message: QueryMessage, reply_to: Recipient) -> (Self, u64) {
         let request_id = generate_random();
         (
             Self {
@@ -73,7 +78,7 @@ impl AuthenticatorRequest {
                     service_provider_type: ServiceProviderType::Authenticator,
                     version: VERSION,
                 },
-                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                data: AuthenticatorRequestData::QueryBandwidth(query_message.pub_key),
                 reply_to,
                 request_id,
             },

common/authenticator-requests/src/v3/conversion.rs

@@ -0,0 +1,188 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3};
+
+impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    fn from(authenticator_request: v2::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 3,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v2::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v2::request::AuthenticatorRequestData::Final(gw_client) => {
+                v3::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v2::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
+    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
+        Box::new(v3::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v3::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v2::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v2::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v2 request couldn't produce a v3 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
+    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
+    fn from(value: v3::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}

common/authenticator-requests/src/v3/mod.rs

@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 3;

common/authenticator-requests/src/v3/registration.rs

@@ -0,0 +1,227 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}

common/authenticator-requests/src/v3/request.rs

@@ -0,0 +1,141 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct QueryMessage {
+    pub pub_key: PeerPublicKey,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(query_message: QueryMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(query_message.pub_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}

common/authenticator-requests/src/v3/response.rs

@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}

common/authenticator-requests/src/v3/topup.rs

@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}

common/authenticator-requests/src/v4/conversion.rs

@@ -0,0 +1,200 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v3, v4};
+
+impl From<v3::request::AuthenticatorRequest> for v4::request::AuthenticatorRequest {
+    fn from(authenticator_request: v3::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 4,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v3::request::AuthenticatorRequestData> for v4::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v3::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v3::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v4::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v3::request::AuthenticatorRequestData::Final(gw_client) => {
+                v4::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
+                v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into())
+            }
+        }
+    }
+}
+
+impl From<v3::registration::InitMessage> for v4::registration::InitMessage {
+    fn from(init_msg: v3::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v3::registration::FinalMessage>> for Box<v4::registration::FinalMessage> {
+    fn from(gw_client: Box<v3::registration::FinalMessage>) -> Self {
+        Box::new(v4::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<Box<v3::topup::TopUpMessage>> for Box<v4::topup::TopUpMessage> {
+    fn from(top_up_message: Box<v3::topup::TopUpMessage>) -> Self {
+        Box::new(v4::topup::TopUpMessage {
+            pub_key: top_up_message.pub_key,
+            credential: top_up_message.credential,
+        })
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v4::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ips: gw_client.private_ip.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v4::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v4::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ips.ipv4.into(),
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::ClientMac> for v4::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v4::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v4::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v4::response::AuthenticatorResponse> for v3::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v4::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v4::response::AuthenticatorResponseData> for v3::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v4::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v4::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v3::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v4::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v3::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v4::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v4::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v3 request couldn't produce a v4 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v4::response::PendingRegistrationResponse> for v3::response::PendingRegistrationResponse {
+    fn from(value: v4::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::RegisteredResponse> for v3::response::RegisteredResponse {
+    fn from(value: v4::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v4::response::RemainingBandwidthResponse> for v3::response::RemainingBandwidthResponse {
+    fn from(value: v4::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v4::registration::RegistrationData> for v3::registration::RegistrationData {
+    fn from(value: v4::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ips.ipv4.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v4::registration::RemainingBandwidthData> for v3::registration::RemainingBandwidthData {
+    fn from(value: v4::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}

common/authenticator-requests/src/v4/mod.rs

@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 4;

common/authenticator-requests/src/v4/registration.rs

@@ -0,0 +1,281 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpPair, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct IpPair {
+    pub ipv4: Ipv4Addr,
+    pub ipv6: Ipv6Addr,
+}
+
+impl IpPair {
+    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
+        IpPair { ipv4, ipv6 }
+    }
+}
+
+impl fmt::Display for IpPair {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "({}, {})", self.ipv4, self.ipv6)
+    }
+}
+
+impl From<IpAddr> for IpPair {
+    fn from(value: IpAddr) -> Self {
+        let (before_last_byte, last_byte) = match value {
+            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
+            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
+        };
+        let last_bytes = (before_last_byte as u16) << 8 | last_byte as u16;
+        let ipv4 = Ipv4Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
+            before_last_byte,
+            last_byte,
+        );
+        let ipv6 = Ipv6Addr::new(
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
+            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
+            last_bytes,
+        );
+        IpPair::new(ipv4, ipv6)
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ips: IpPair,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IPs (v4 and v6)
+    pub private_ips: IpPair,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ips: IpPair,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ips,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ips.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    fn create_ip_pair() {
+        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
+        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
+
+        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
+    }
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}

common/authenticator-requests/src/v4/request.rs

@@ -0,0 +1,141 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct QueryMessage {
+    pub pub_key: PeerPublicKey,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(query_message: QueryMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(query_message.pub_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 4;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}

common/authenticator-requests/src/v4/response.rs

@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}

common/authenticator-requests/src/v4/topup.rs

@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}

common/bandwidth-controller/Cargo.toml

@@ -14,14 +14,15 @@ thiserror = { workspace = true }
 url = { workspace = true }
 zeroize = { workspace = true }
 
-nym-ecash-time = { path = "../ecash-time" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
-nym-network-defaults = { path = "../network-defaults" }
-nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
+nym-ecash-time = { path = "../ecash-time" }
+nym-network-defaults = { path = "../network-defaults" }
+nym-task = { path = "../task" }
+nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
 path = "../client-libs/validator-client"

common/bandwidth-controller/src/event.rs

@@ -1,13 +1,25 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-// See other comments for other TaskStatus message enumds about abusing the Error trait when we
-// should have a new trait for TaskStatus messages
-#[derive(Debug, thiserror::Error)]
+#[derive(Debug)]
 pub enum BandwidthStatusMessage {
-    #[error("remaining bandwidth: {0}")]
     RemainingBandwidth(i64),
-
-    #[error("no bandwidth left")]
     NoBandwidth,
 }
+
+impl std::fmt::Display for BandwidthStatusMessage {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            BandwidthStatusMessage::RemainingBandwidth(b) => {
+                write!(f, "remaining bandwidth: {}", b)
+            }
+            BandwidthStatusMessage::NoBandwidth => write!(f, "no bandwidth left"),
+        }
+    }
+}
+
+impl nym_task::TaskStatusEvent for BandwidthStatusMessage {
+    fn as_any(&self) -> &dyn std::any::Any {
+        self
+    }
+}

common/bandwidth-controller/src/lib.rs

@@ -16,7 +16,7 @@ use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
-    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, TicketType, VerificationKeyAuth,
 };
 use nym_ecash_time::Date;
 use nym_validator_client::nym_api::EpochId;
@@ -64,9 +64,10 @@ impl<C, St: Storage> BandwidthController<C, St> {
         BandwidthController { storage, client }
     }
 
-    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
+    /// Tries to retrieve one of the stored, unused credentials for the given type that hasn't yet expired.
     pub async fn get_next_usable_ticketbook(
         &self,
+        ticketbook_type: TicketType,
         tickets: u32,
     ) -> Result<RetrievedTicketbook, BandwidthControllerError>
     where
@@ -74,7 +75,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
     {
         let Some(ticketbook) = self
             .storage
-            .get_next_unspent_usable_ticketbook(tickets)
+            .get_next_unspent_usable_ticketbook(ticketbook_type.to_string(), tickets)
             .await
             .map_err(BandwidthControllerError::credential_storage_error)?
         else {
@@ -181,6 +182,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
 
     pub async fn prepare_ecash_ticket(
         &self,
+        ticketbook_type: TicketType,
         provider_pk: [u8; 32],
         tickets_to_spend: u32,
     ) -> Result<PreparedCredential, BandwidthControllerError>
@@ -188,7 +190,9 @@ impl<C, St: Storage> BandwidthController<C, St> {
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        let retrieved_ticketbook = self.get_next_usable_ticketbook(tickets_to_spend).await?;
+        let retrieved_ticketbook = self
+            .get_next_usable_ticketbook(ticketbook_type, tickets_to_spend)
+            .await?;
 
         let ticketbook_id = retrieved_ticketbook.ticketbook_id;
         let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();

common/bin-common/Cargo.toml

@@ -45,3 +45,4 @@ tracing = [
     "opentelemetry",
 ]
 clap = [ "dep:clap", "dep:clap_complete", "dep:clap_complete_fig" ]
+models = []

common/client-core/Cargo.toml

@@ -43,6 +43,7 @@ nym-gateway-requests = { path = "../gateway-requests" }
 nym-metrics = { path = "../nym-metrics" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
+nym-statistics-common = { path = "../statistics" }
 nym-pemstore = { path = "../pemstore" }
 nym-topology = { path = "../topology", features = ["serializable"] }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }

common/client-core/config-types/Cargo.toml

@@ -23,4 +23,4 @@ nym-sphinx-addressing = { path = "../../nymsphinx/addressing" }
 
 
 [features]
-disk-persistence = ["nym-pemstore"]
+disk-persistence = ["nym-pemstore"]

common/client-core/config-types/src/lib.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_config::defaults::NymNetworkDetails;
+use nym_config::serde_helpers::{de_maybe_stringified, ser_maybe_stringified};
 use nym_sphinx_addressing::Recipient;
 use nym_sphinx_params::{PacketSize, PacketType};
 use serde::{Deserialize, Serialize};
@@ -61,6 +62,11 @@ const DEFAULT_MAXIMUM_REPLY_SURB_AGE: Duration = Duration::from_secs(12 * 60 * 6
 // 24 hours
 const DEFAULT_MAXIMUM_REPLY_KEY_AGE: Duration = Duration::from_secs(24 * 60 * 60);
 
+// stats reporting related
+
+/// Time interval between reporting statistics to the given provider if it exist
+const STATS_REPORT_INTERVAL_SECS: Duration = Duration::from_secs(300);
+
 use crate::error::InvalidTrafficModeFailure;
 pub use nym_country_group::CountryGroup;
 
@@ -133,6 +139,12 @@ impl Config {
         self
     }
 
+    pub fn with_enabled_stats_reporting_address(mut self, address: Recipient) -> Self {
+        self.debug.stats_reporting.provider_address = Some(address);
+        self.debug.stats_reporting.enabled = true; //since we are overriding the address, we assume the reporting should be enabled
+        self
+    }
+
     // TODO: this should be refactored properly
     // as of 12.09.23 the below is true (not sure how this comment will rot in the future)
     // medium_toggle:
@@ -631,6 +643,34 @@ impl Default for ReplySurbs {
     }
 }
 
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct StatsReporting {
+    /// Is stats reporting enabled
+    pub enabled: bool,
+
+    /// Address of the stats collector. If this is none, no reporting will happen, regardless of `enabled`
+    #[serde(
+        serialize_with = "ser_maybe_stringified",
+        deserialize_with = "de_maybe_stringified"
+    )]
+    pub provider_address: Option<Recipient>,
+
+    /// With what frequence will statistics be sent
+    #[serde(with = "humantime_serde")]
+    pub reporting_interval: Duration,
+}
+
+impl Default for StatsReporting {
+    fn default() -> Self {
+        StatsReporting {
+            enabled: true,
+            provider_address: None,
+            reporting_interval: STATS_REPORT_INTERVAL_SECS,
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct DebugConfig {
@@ -651,6 +691,9 @@ pub struct DebugConfig {
 
     /// Defines all configuration options related to reply SURBs.
     pub reply_surbs: ReplySurbs,
+
+    /// Defines all configuration options related to stats reporting.
+    pub stats_reporting: StatsReporting,
 }
 
 impl DebugConfig {
@@ -672,6 +715,7 @@ impl Default for DebugConfig {
             acknowledgements: Default::default(),
             topology: Default::default(),
             reply_surbs: Default::default(),
+            stats_reporting: Default::default(),
         }
     }
 }

common/client-core/config-types/src/old/v5.rs

@@ -181,6 +181,7 @@ impl From<ConfigV5> for Config {
                     maximum_reply_key_age: value.debug.reply_surbs.maximum_reply_key_age,
                     surb_mix_hops: value.debug.reply_surbs.surb_mix_hops,
                 },
+                stats_reporting: Default::default(),
             },
         }
     }

common/client-core/gateways-storage/.sqlx/query-06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'",
+  "describe": {
+    "columns": [
+      {
+        "name": "exists",
+        "ordinal": 0,
+        "type_info": "Int"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"
+}

common/client-core/gateways-storage/.sqlx/query-0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985.json

@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}

common/client-core/gateways-storage/.sqlx/query-0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}

common/client-core/gateways-storage/.sqlx/query-1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233"
+}

common/client-core/gateways-storage/.sqlx/query-4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d"
+}

common/client-core/gateways-storage/.sqlx/query-54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "data",
+        "ordinal": 1,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11"
+}

common/client-core/gateways-storage/.sqlx/query-5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT gateway_id_bs58 FROM registered_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b"
+}

common/client-core/gateways-storage/.sqlx/query-80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE active_gateway SET active_gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582"
+}

common/client-core/gateways-storage/.sqlx/query-8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
+}

common/client-core/gateways-storage/.sqlx/query-a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}

common/client-core/gateways-storage/.sqlx/query-b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
+}

common/client-core/gateways-storage/.sqlx/query-bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT active_gateway_id_bs58 FROM active_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "active_gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1"
+}

common/client-core/gateways-storage/.sqlx/query-f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM registered_gateway WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93"
+}

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -29,11 +29,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
+            .create_if_missing(true)
+            .disable_statement_logging();
 
         let connection_pool = sqlx::SqlitePool::connect_with(opts)
             .await
@@ -82,7 +81,7 @@ impl StorageManager {
         sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
             .fetch_one(&self.connection_pool)
             .await
-            .map(|result| result.exists == 1)
+            .map(|result| result.exists == Some(1))
     }
 
     pub(crate) async fn maybe_get_registered_gateway(

common/client-core/src/cli_helpers/client_init.rs

@@ -15,6 +15,7 @@ use crate::{
 use log::info;
 use nym_client_core_gateways_storage::GatewayDetails;
 use nym_crypto::asymmetric::identity;
+use nym_sphinx::addressing::Recipient;
 use nym_topology::NymTopology;
 use nym_validator_client::UserAgent;
 use rand::rngs::OsRng;
@@ -88,6 +89,10 @@ pub struct CommonClientInitArgs {
     /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
     pub no_cover: bool,
+
+    /// Sets the address to report statistics
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub stats_reporting_address: Option<Recipient>,
 }
 
 pub struct InitResultsWithConfig<T> {

common/client-core/src/cli_helpers/client_run.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_crypto::asymmetric::identity;
+use nym_sphinx::addressing::Recipient;
 use std::path::PathBuf;
 
 #[cfg_attr(feature = "cli", derive(clap::Args))]
@@ -56,4 +57,8 @@ pub struct CommonClientRunArgs {
     // has defined the conflict on that field itself
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
     pub no_cover: bool,
+
+    /// Sets the address to report statistics
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub stats_reporting_address: Option<Recipient>,
 }

common/client-core/src/client/base_client/mod.rs

@@ -1,8 +1,8 @@
 // Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::packet_statistics_control::PacketStatisticsReporter;
 use super::received_buffer::ReceivedBufferMessage;
+use super::statistics_control::StatisticsControl;
 use super::topology_control::geo_aware_provider::GeoAwareTopologyProvider;
 use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
@@ -12,7 +12,6 @@ use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
-use crate::client::packet_statistics_control::PacketStatisticsControl;
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -49,6 +48,8 @@ use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::addressing::nodes::NodeIdentity;
 use nym_sphinx::params::PacketType;
 use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
+use nym_statistics_common::clients::ClientStatsSender;
+use nym_statistics_common::generate_client_stats_id;
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_task::{TaskClient, TaskHandle};
 use nym_topology::provider_trait::TopologyProvider;
@@ -59,6 +60,7 @@ use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
+use tokio::sync::mpsc::Sender;
 use url::Url;
 
 #[cfg(all(
@@ -273,7 +275,7 @@ where
         self_address: Recipient,
         topology_accessor: TopologyAccessor,
         mix_tx: BatchMixMessageSender,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
         shutdown: TaskClient,
     ) {
         info!("Starting loop cover traffic stream...");
@@ -306,7 +308,7 @@ where
         client_connection_rx: ConnectionCommandReceiver,
         shutdown: TaskClient,
         packet_type: PacketType,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) {
         info!("Starting real traffic stream...");
 
@@ -335,7 +337,7 @@ where
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
         shutdown: TaskClient,
-        packet_statistics_control: PacketStatisticsReporter,
+        metrics_reporter: ClientStatsSender,
     ) {
         info!("Starting received messages buffer controller...");
         let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
@@ -345,7 +347,7 @@ where
                 mixnet_receiver,
                 reply_key_storage,
                 reply_controller_sender,
-                packet_statistics_control,
+                metrics_reporter,
             );
         controller.start_with_shutdown(shutdown)
     }
@@ -356,6 +358,7 @@ where
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
         details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
+        stats_reporter: ClientStatsSender,
         shutdown: TaskClient,
     ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
     where
@@ -371,7 +374,12 @@ where
 
         let mut gateway_client =
             if let Some(existing_client) = initialisation_result.authenticated_ephemeral_client {
-                existing_client.upgrade(packet_router, bandwidth_controller, shutdown)
+                existing_client.upgrade(
+                    packet_router,
+                    bandwidth_controller,
+                    stats_reporter,
+                    shutdown,
+                )
             } else {
                 let cfg = GatewayConfig::new(
                     details.gateway_id,
@@ -392,6 +400,7 @@ where
                     Some(details.shared_key),
                     packet_router,
                     bandwidth_controller,
+                    stats_reporter,
                     shutdown,
                 )
             };
@@ -444,6 +453,7 @@ where
         Ok(gateway_client)
     }
 
+    #[allow(clippy::too_many_arguments)]
     async fn setup_gateway_transceiver(
         custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
         config: &Config,
@@ -451,6 +461,7 @@ where
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
         details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
+        stats_reporter: ClientStatsSender,
         mut shutdown: TaskClient,
     ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
     where
@@ -481,6 +492,7 @@ where
             bandwidth_controller,
             details_store,
             packet_router,
+            stats_reporter,
             shutdown,
         )
         .await?;
@@ -586,11 +598,23 @@ where
         Ok(())
     }
 
-    fn start_packet_statistics_control(shutdown: TaskClient) -> PacketStatisticsReporter {
-        info!("Starting packet statistics control...");
-        let (packet_statistics_control, packet_stats_reporter) = PacketStatisticsControl::new();
-        packet_statistics_control.start_with_shutdown(shutdown);
-        packet_stats_reporter
+    fn start_statistics_control(
+        config: &Config,
+        user_agent: Option<UserAgent>,
+        client_stats_id: String,
+        input_sender: Sender<InputMessage>,
+        shutdown: TaskClient,
+    ) -> ClientStatsSender {
+        info!("Starting statistics control...");
+        StatisticsControl::create_and_start_with_shutdown(
+            config.debug.stats_reporting,
+            user_agent
+                .map(|u| u.application)
+                .unwrap_or("unknown".to_string()),
+            client_stats_id,
+            input_sender.clone(),
+            shutdown.with_suffix("controller"),
+        )
     }
 
     fn start_mix_traffic_controller(
@@ -720,6 +744,14 @@ where
             self.user_agent.clone(),
         );
 
+        let stats_reporter = Self::start_statistics_control(
+            self.config,
+            self.user_agent.clone(),
+            generate_client_stats_id(*self_address.identity()),
+            input_sender.clone(),
+            shutdown.fork("statistics_control"),
+        );
+
         // needs to be started as the first thing to block if required waiting for the gateway
         Self::start_topology_refresher(
             topology_provider,
@@ -731,9 +763,6 @@ where
         )
         .await?;
 
-        let packet_stats_reporter =
-            Self::start_packet_statistics_control(shutdown.fork("packet_statistics_control"));
-
         let gateway_packet_router = PacketRouter::new(
             ack_sender,
             mixnet_messages_sender,
@@ -747,6 +776,7 @@ where
             bandwidth_controller,
             &details_store,
             gateway_packet_router,
+            stats_reporter.clone(),
             shutdown.fork("gateway_transceiver"),
         )
         .await?;
@@ -765,7 +795,7 @@ where
             reply_storage.key_storage(),
             reply_controller_sender.clone(),
             shutdown.fork("received_messages_buffer"),
-            packet_stats_reporter.clone(),
+            stats_reporter.clone(),
         );
 
         // The message_sender is the transmitter for any component generating sphinx packets
@@ -804,7 +834,7 @@ where
             client_connection_rx,
             shutdown.fork("real_traffic_controller"),
             self.config.debug.traffic.packet_type,
-            packet_stats_reporter.clone(),
+            stats_reporter.clone(),
         );
 
         if !self
@@ -819,7 +849,7 @@ where
                 self_address,
                 shared_topology_accessor.clone(),
                 message_sender,
-                packet_stats_reporter,
+                stats_reporter.clone(),
                 shutdown.fork("cover_traffic_stream"),
             );
         }
@@ -847,6 +877,7 @@ where
                 topology_accessor: shared_topology_accessor,
                 gateway_connection: GatewayConnection { gateway_ws_fd },
             },
+            stats_reporter,
             task_handle: shutdown,
         })
     }
@@ -858,6 +889,7 @@ pub struct BaseClient {
     pub client_input: ClientInputStatus,
     pub client_output: ClientOutputStatus,
     pub client_state: ClientState,
+    pub stats_reporter: ClientStatsSender,
 
     pub task_handle: TaskHandle,
 }

common/client-core/src/client/cover_traffic_stream.rs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::mix_traffic::BatchMixMessageSender;
-use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::topology_control::TopologyAccessor;
 use crate::{config, spawn_future};
 use futures::task::{Context, Poll};
@@ -13,6 +12,7 @@ use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::cover::generate_loop_cover_packet;
 use nym_sphinx::params::{PacketSize, PacketType};
 use nym_sphinx::utils::sample_poisson_duration;
+use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::pin::Pin;
 use std::sync::Arc;
@@ -63,7 +63,7 @@ where
 
     packet_type: PacketType,
 
-    stats_tx: PacketStatisticsReporter,
+    stats_tx: ClientStatsSender,
 }
 
 impl<R> Stream for LoopCoverTrafficStream<R>
@@ -109,7 +109,7 @@ impl LoopCoverTrafficStream<OsRng> {
         topology_access: TopologyAccessor,
         traffic_config: config::Traffic,
         cover_config: config::CoverTraffic,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         let rng = OsRng;
 
@@ -198,9 +198,9 @@ impl LoopCoverTrafficStream<OsRng> {
                 }
             }
         } else {
-            self.stats_tx.report(PacketStatisticsEvent::CoverPacketSent(
-                cover_traffic_packet_size.size(),
-            ));
+            self.stats_tx.report(
+                PacketStatisticsEvent::CoverPacketSent(cover_traffic_packet_size.size()).into(),
+            );
         }
 
         // TODO: I'm not entirely sure whether this is really required, because I'm not 100%

common/client-core/src/client/mod.rs

@@ -7,9 +7,9 @@ pub(crate) mod helpers;
 pub mod inbound_messages;
 pub mod key_manager;
 pub mod mix_traffic;
-pub(crate) mod packet_statistics_control;
 pub mod real_messages_control;
 pub mod received_buffer;
 pub mod replies;
+pub mod statistics_control;
 pub mod topology_control;
 pub(crate) mod transmission_buffer;

common/client-core/src/client/real_messages_control/acknowledgement_control/acknowledgement_listener.rs

@@ -1,9 +1,9 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
-
 use super::action_controller::{AckActionSender, Action};
+use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
+
 use futures::StreamExt;
 use log::*;
 use nym_gateway_client::AcknowledgementReceiver;
@@ -19,7 +19,7 @@ pub(super) struct AcknowledgementListener {
     ack_key: Arc<AckKey>,
     ack_receiver: AcknowledgementReceiver,
     action_sender: AckActionSender,
-    stats_tx: PacketStatisticsReporter,
+    stats_tx: ClientStatsSender,
 }
 
 impl AcknowledgementListener {
@@ -27,7 +27,7 @@ impl AcknowledgementListener {
         ack_key: Arc<AckKey>,
         ack_receiver: AcknowledgementReceiver,
         action_sender: AckActionSender,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         AcknowledgementListener {
             ack_key,
@@ -40,7 +40,7 @@ impl AcknowledgementListener {
     async fn on_ack(&mut self, ack_content: Vec<u8>) {
         trace!("Received an ack");
         self.stats_tx
-            .report(PacketStatisticsEvent::AckReceived(ack_content.len()));
+            .report(PacketStatisticsEvent::AckReceived(ack_content.len()).into());
 
         let frag_id = match recover_identifier(&self.ack_key, &ack_content)
             .map(FragmentIdentifier::try_from_bytes)
@@ -57,13 +57,13 @@ impl AcknowledgementListener {
         if frag_id == COVER_FRAG_ID {
             trace!("Received an ack for a cover message - no need to do anything");
             self.stats_tx
-                .report(PacketStatisticsEvent::CoverAckReceived(ack_content.len()));
+                .report(PacketStatisticsEvent::CoverAckReceived(ack_content.len()).into());
             return;
         }
 
         trace!("Received {} from the mix network", frag_id);
         self.stats_tx
-            .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()));
+            .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()).into());
         self.action_sender
             .unbounded_send(Action::new_remove(frag_id))
             .unwrap();

common/client-core/src/client/real_messages_control/acknowledgement_control/mod.rs

@@ -8,7 +8,6 @@ use self::{
     sent_notification_listener::SentNotificationListener,
 };
 use crate::client::inbound_messages::InputMessageReceiver;
-use crate::client::packet_statistics_control::PacketStatisticsReporter;
 use crate::client::real_messages_control::message_handler::MessageHandler;
 use crate::client::replies::reply_controller::ReplyControllerSender;
 use crate::spawn_future;
@@ -24,6 +23,7 @@ use nym_sphinx::{
     chunking::fragment::{Fragment, FragmentIdentifier},
     Delay as SphinxDelay,
 };
+use nym_statistics_common::clients::ClientStatsSender;
 use rand::{CryptoRng, Rng};
 use std::{
     sync::{Arc, Weak},
@@ -209,7 +209,7 @@ where
         connectors: AcknowledgementControllerConnectors,
         message_handler: MessageHandler<R>,
         reply_controller_sender: ReplyControllerSender,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         let (retransmission_tx, retransmission_rx) = mpsc::unbounded();
 

common/client-core/src/client/real_messages_control/mod.rs

@@ -35,7 +35,7 @@ use crate::client::replies::reply_controller;
 use crate::config;
 pub(crate) use acknowledgement_control::{AckActionSender, Action};
 
-use super::packet_statistics_control::PacketStatisticsReporter;
+use nym_statistics_common::clients::ClientStatsSender;
 
 pub(crate) mod acknowledgement_control;
 pub(crate) mod message_handler;
@@ -145,7 +145,7 @@ impl RealMessagesController<OsRng> {
         reply_controller_receiver: ReplyControllerReceiver,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         let rng = OsRng;
 

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -3,7 +3,6 @@
 
 use self::sending_delay_controller::SendingDelayController;
 use crate::client::mix_traffic::BatchMixMessageSender;
-use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::real_messages_control::acknowledgement_control::SentPacketNotificationSender;
 use crate::client::topology_control::TopologyAccessor;
 use crate::client::transmission_buffer::TransmissionBuffer;
@@ -19,6 +18,7 @@ use nym_sphinx::forwarding::packet::MixPacket;
 use nym_sphinx::params::PacketSize;
 use nym_sphinx::preparer::PreparedFragment;
 use nym_sphinx::utils::sample_poisson_duration;
+use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
 use nym_task::connections::{
     ConnectionCommand, ConnectionCommandReceiver, ConnectionId, LaneQueueLengths, TransmissionLane,
 };
@@ -115,8 +115,8 @@ where
     /// Report queue lengths so that upstream can backoff sending data, and keep connections open.
     lane_queue_lengths: LaneQueueLengths,
 
-    /// Channel used for sending statistics events to `PacketStatisticsControl`.
-    stats_tx: PacketStatisticsReporter,
+    /// Channel used for sending metrics events (specifically `PacketStatistics` events) to the metrics tracker.
+    stats_tx: ClientStatsSender,
 }
 
 #[derive(Debug)]
@@ -175,7 +175,7 @@ where
         topology_access: TopologyAccessor,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         OutQueueControl {
             config,
@@ -277,7 +277,7 @@ where
             } else {
                 PacketStatisticsEvent::CoverPacketSent(packet_size)
             };
-            self.stats_tx.report(event);
+            self.stats_tx.report(event.into());
         }
 
         // notify ack controller about sending our message only after we actually managed to push it
@@ -373,13 +373,13 @@ where
             TransmissionLane::Retransmission => Some(PacketStatisticsEvent::RetransmissionQueued),
         };
         if let Some(stat_event) = stat_event {
-            self.stats_tx.report(stat_event);
+            self.stats_tx.report(stat_event.into());
         }
         // To avoid comparing apples to oranges when presenting the fraction of packets that are
         // retransmissions, we also need to keep track to the total number of real messages queued,
         // even though we also track the actual number of messages sent later in the pipeline.
         self.stats_tx
-            .report(PacketStatisticsEvent::RealPacketQueued);
+            .report(PacketStatisticsEvent::RealPacketQueued.into());
 
         Some(real_next)
     }

common/client-core/src/client/received_buffer.rs

@@ -1,9 +1,8 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::{
-    packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter},
-    replies::{reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys},
+use crate::client::replies::{
+    reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys,
 };
 use crate::spawn_future;
 use futures::channel::mpsc;
@@ -20,6 +19,7 @@ use nym_sphinx::anonymous_replies::{encryption_key::EncryptionKeyDigest, SurbEnc
 use nym_sphinx::message::{NymMessage, PlainMessage};
 use nym_sphinx::params::ReplySurbKeyDigestAlgorithm;
 use nym_sphinx::receiver::{MessageReceiver, MessageRecoveryError, ReconstructedMessage};
+use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
 use std::collections::HashSet;
 use std::sync::Arc;
 
@@ -46,7 +46,7 @@ struct ReceivedMessagesBufferInner<R: MessageReceiver> {
     // and every now and then remove ids older than X
     recently_reconstructed: HashSet<i32>,
 
-    stats_tx: PacketStatisticsReporter,
+    stats_tx: ClientStatsSender,
 }
 
 impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
@@ -61,16 +61,12 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
             // received and sent packets due to the sphinx layers being removed by the exit gateway
             // before it reaches the mixnet client.
             self.stats_tx
-                .report(PacketStatisticsEvent::CoverPacketReceived(
-                    fragment_data_size,
-                ));
+                .report(PacketStatisticsEvent::CoverPacketReceived(fragment_data_size).into());
             return None;
         }
 
         self.stats_tx
-            .report(PacketStatisticsEvent::RealPacketReceived(
-                fragment_data_size,
-            ));
+            .report(PacketStatisticsEvent::RealPacketReceived(fragment_data_size).into());
 
         let fragment = match self.message_receiver.recover_fragment(fragment_data) {
             Err(err) => {
@@ -163,7 +159,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         local_encryption_keypair: Arc<encryption::KeyPair>,
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
-        stats_tx: PacketStatisticsReporter,
+        stats_tx: ClientStatsSender,
     ) -> Self {
         ReceivedMessagesBuffer {
             inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
@@ -504,13 +500,13 @@ impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferControll
         mixnet_packet_receiver: MixnetMessageReceiver,
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
-        packet_statistics_reporter: PacketStatisticsReporter,
+        metrics_reporter: ClientStatsSender,
     ) -> Self {
         let received_buffer = ReceivedMessagesBuffer::new(
             local_encryption_keypair,
             reply_key_storage,
             reply_controller_sender,
-            packet_statistics_reporter,
+            metrics_reporter,
         );
 
         ReceivedMessagesBufferController {

common/client-core/src/client/statistics_control.rs

@@ -0,0 +1,151 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+//! # Statistics collection and reporting.
+//!
+//! Modular metrics collection and reporting system. submodules can be added to collect different types of metrics.
+//! On creation the Statistics controller will start a task that will listen for incoming stats events and
+//! multiplex them out to the appropriate metrics module based on type.
+//!
+//! Adding A new module you need to write a new module that implements the `StatsObj` trait and add it to
+//! the `stats` hashmap in the `StatisticsControl` struct during it's initialization in the `new` function in
+//! this file.
+
+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+#![warn(clippy::todo)]
+#![warn(clippy::dbg_macro)]
+
+use std::time::Duration;
+
+use nym_client_core_config_types::StatsReporting;
+use nym_sphinx::addressing::Recipient;
+use nym_statistics_common::clients::{
+    ClientStatsController, ClientStatsReceiver, ClientStatsSender,
+};
+use nym_task::connections::TransmissionLane;
+
+use crate::{
+    client::inbound_messages::{InputMessage, InputMessageSender},
+    spawn_future,
+};
+
+/// Time interval between reporting statistics locally (logging/task_client)
+const LOCAL_REPORT_INTERVAL: Duration = Duration::from_secs(2);
+/// Interval for taking snapshots of the statistics
+const SNAPSHOT_INTERVAL: Duration = Duration::from_millis(500);
+
+/// Launches and manages metrics collection and reporting.
+///
+/// This is designed to be generic to allow for multiple types of metrics to be collected and
+/// reported.
+pub(crate) struct StatisticsControl {
+    /// Keep store the different types of metrics collectors
+    stats: ClientStatsController,
+
+    /// Incoming packet stats events from other tasks
+    stats_rx: ClientStatsReceiver,
+
+    /// Channel to send stats report through the mixnet
+    report_tx: InputMessageSender,
+
+    /// Config for stats reporting (enabled, address, interval)
+    reporting_config: StatsReporting,
+}
+
+impl StatisticsControl {
+    pub(crate) fn create(
+        reporting_config: StatsReporting,
+        client_type: String,
+        client_stats_id: String,
+        report_tx: InputMessageSender,
+    ) -> (Self, ClientStatsSender) {
+        let (stats_tx, stats_rx) = tokio::sync::mpsc::unbounded_channel();
+
+        let stats = ClientStatsController::new(client_stats_id, client_type);
+
+        (
+            StatisticsControl {
+                stats,
+                stats_rx,
+                report_tx,
+                reporting_config,
+            },
+            ClientStatsSender::new(Some(stats_tx)),
+        )
+    }
+
+    async fn report_stats(&mut self, recipient: Recipient) {
+        let stats_report = self.stats.build_report();
+
+        let report_message = InputMessage::new_regular(
+            recipient,
+            stats_report.into(),
+            TransmissionLane::General,
+            None,
+        );
+        if let Err(err) = self.report_tx.send(report_message).await {
+            log::error!("Failed to report client stats: {:?}", err);
+        } else {
+            self.stats.reset();
+        }
+    }
+
+    async fn run_with_shutdown(&mut self, mut task_client: nym_task::TaskClient) {
+        log::debug!("Started StatisticsControl with graceful shutdown support");
+
+        let mut stats_report_interval =
+            tokio::time::interval(self.reporting_config.reporting_interval);
+        let mut local_report_interval = tokio::time::interval(LOCAL_REPORT_INTERVAL);
+        let mut snapshot_interval = tokio::time::interval(SNAPSHOT_INTERVAL);
+
+        loop {
+            tokio::select! {
+                stats_event = self.stats_rx.recv() => match stats_event {
+                        Some(stats_event) => self.stats.handle_event(stats_event),
+                        None => {
+                            log::trace!("StatisticsControl: shutting down due to closed stats channel");
+                            break;
+                        }
+                },
+                _ = snapshot_interval.tick() => {
+                    self.stats.snapshot();
+                }
+                _ = stats_report_interval.tick(), if self.reporting_config.enabled && self.reporting_config.provider_address.is_some() => {
+                    // SAFTEY : this branch executes only if reporting is not none, so unwrapp is fine
+                    #[allow(clippy::unwrap_used)]
+                    self.report_stats(self.reporting_config.provider_address.unwrap()).await;
+                }
+
+                _ = local_report_interval.tick() => {
+                    self.stats.local_report(&mut task_client);
+                }
+                _ = task_client.recv_with_delay() => {
+                    log::trace!("StatisticsControl: Received shutdown");
+                    break;
+                },
+            }
+        }
+        task_client.recv_timeout().await;
+        log::debug!("StatisticsControl: Exiting");
+    }
+
+    pub(crate) fn start_with_shutdown(mut self, task_client: nym_task::TaskClient) {
+        spawn_future(async move {
+            self.run_with_shutdown(task_client).await;
+        })
+    }
+
+    pub(crate) fn create_and_start_with_shutdown(
+        reporting_config: StatsReporting,
+        client_type: String,
+        client_stats_id: String,
+        report_tx: InputMessageSender,
+        task_client: nym_task::TaskClient,
+    ) -> ClientStatsSender {
+        let (controller, sender) =
+            Self::create(reporting_config, client_type, client_stats_id, report_tx);
+        controller.start_with_shutdown(task_client);
+        sender
+    }
+}

common/client-core/src/client/topology_control/geo_aware_provider.rs

@@ -3,11 +3,11 @@ use log::{debug, error};
 use nym_explorer_client::{ExplorerClient, PrettyDetailedMixNodeBond};
 use nym_network_defaults::var_names::EXPLORER_API;
 use nym_topology::{
-    nym_topology_from_detailed,
+    nym_topology_from_basic_info,
     provider_trait::{async_trait, TopologyProvider},
     NymTopology,
 };
-use nym_validator_client::client::MixId;
+use nym_validator_client::client::NodeId;
 use rand::{prelude::SliceRandom, thread_rng};
 use std::collections::HashMap;
 use tap::TapOptional;
@@ -39,10 +39,10 @@ fn create_explorer_client() -> Option<ExplorerClient> {
 
 fn group_mixnodes_by_country_code(
     mixnodes: Vec<PrettyDetailedMixNodeBond>,
-) -> HashMap<CountryGroup, Vec<MixId>> {
+) -> HashMap<CountryGroup, Vec<NodeId>> {
     mixnodes
         .into_iter()
-        .fold(HashMap::<CountryGroup, Vec<MixId>>::new(), |mut acc, m| {
+        .fold(HashMap::<CountryGroup, Vec<NodeId>>::new(), |mut acc, m| {
             if let Some(ref location) = m.location {
                 let country_code = location.two_letter_iso_country_code.clone();
                 let group_code = CountryGroup::new(country_code.as_str());
@@ -53,7 +53,7 @@ fn group_mixnodes_by_country_code(
         })
 }
 
-fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<MixId>>) {
+fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<NodeId>>) {
     let mixnode_distribution = mixnodes
         .iter()
         .map(|(k, v)| format!("{}: {}", k, v.len()))
@@ -110,7 +110,11 @@ impl GeoAwareTopologyProvider {
     }
 
     async fn get_topology(&self) -> Option<NymTopology> {
-        let mixnodes = match self.validator_client.get_cached_active_mixnodes().await {
+        let mixnodes = match self
+            .validator_client
+            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network mixnodes - {err}");
                 return None;
@@ -118,7 +122,11 @@ impl GeoAwareTopologyProvider {
             Ok(mixes) => mixes,
         };
 
-        let gateways = match self.validator_client.get_cached_gateways().await {
+        let gateways = match self
+            .validator_client
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network gateways - {err}");
                 return None;
@@ -182,11 +190,10 @@ impl GeoAwareTopologyProvider {
 
         let mixnodes = mixnodes
             .into_iter()
-            .filter(|m| filtered_mixnode_ids.contains(&m.mix_id()))
+            .filter(|m| filtered_mixnode_ids.contains(&m.node_id))
             .collect::<Vec<_>>();
 
-        let topology = nym_topology_from_detailed(mixnodes, gateways)
-            .filter_system_version(&self.client_version);
+        let topology = nym_topology_from_basic_info(&mixnodes, &gateways);
 
         // TODO: return real error type
         check_layer_integrity(topology.clone()).ok()?;

common/client-core/src/client/topology_control/mod.rs

@@ -6,7 +6,6 @@ pub(crate) use accessor::{TopologyAccessor, TopologyReadPermit};
 use futures::StreamExt;
 use log::*;
 use nym_sphinx::addressing::nodes::NodeIdentity;
-use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::NymTopologyError;
 use std::time::Duration;
 
@@ -18,7 +17,11 @@ use wasmtimer::tokio::sleep;
 
 mod accessor;
 pub mod geo_aware_provider;
-pub(crate) mod nym_api_provider;
+pub mod nym_api_provider;
+
+pub use geo_aware_provider::GeoAwareTopologyProvider;
+pub use nym_api_provider::{Config as NymApiTopologyProviderConfig, NymApiTopologyProvider};
+pub use nym_topology::provider_trait::TopologyProvider;
 
 // TODO: move it to config later
 const MAX_FAILURE_COUNT: usize = 10;

common/client-core/src/client/topology_control/nym_api_provider.rs

@@ -14,9 +14,10 @@ use url::Url;
 pub const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
 pub const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
 
-pub(crate) struct Config {
-    pub(crate) min_mixnode_performance: u8,
-    pub(crate) min_gateway_performance: u8,
+#[derive(Debug)]
+pub struct Config {
+    pub min_mixnode_performance: u8,
+    pub min_gateway_performance: u8,
 }
 
 impl Default for Config {
@@ -29,7 +30,7 @@ impl Default for Config {
     }
 }
 
-pub(crate) struct NymApiTopologyProvider {
+pub struct NymApiTopologyProvider {
     config: Config,
 
     validator_client: nym_validator_client::client::NymApiClient,
@@ -40,7 +41,7 @@ pub(crate) struct NymApiTopologyProvider {
 }
 
 impl NymApiTopologyProvider {
-    pub(crate) fn new(
+    pub fn new(
         config: Config,
         mut nym_api_urls: Vec<Url>,
         client_version: String,
@@ -98,7 +99,7 @@ impl NymApiTopologyProvider {
     async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
         let mixnodes = match self
             .validator_client
-            .get_basic_mixnodes(Some(self.client_version.clone()))
+            .get_all_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -110,7 +111,7 @@ impl NymApiTopologyProvider {
 
         let gateways = match self
             .validator_client
-            .get_basic_gateways(Some(self.client_version.clone()))
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -134,7 +135,6 @@ impl NymApiTopologyProvider {
                 g.performance.round_to_integer() >= self.config.min_gateway_performance
             }),
         );
-
         if let Err(err) = self.check_layer_distribution(&topology) {
             warn!("The current filtered active topology has extremely skewed layer distribution. It cannot be used: {err}");
             self.use_next_nym_api();

common/client-core/src/error.rs

@@ -187,16 +187,6 @@ pub enum ClientCoreError {
         source: Ed25519RecoveryError,
     },
 
-    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {err}")]
-    MalformedGatewayOwnerAccountAddress {
-        gateway_id: String,
-
-        raw_owner: String,
-
-        // just use the string formatting as opposed to underlying type to avoid having to import cosmrs
-        err: String,
-    },
-
     #[error(
         "the listening address of gateway {gateway_id} ({raw_listener}) is malformed: {source}"
     )]
@@ -222,12 +212,29 @@ pub enum ClientCoreError {
 }
 
 /// Set of messages that the client can send to listeners via the task manager
-#[derive(thiserror::Error, Debug)]
+#[derive(Debug)]
 pub enum ClientCoreStatusMessage {
-    // NOTE: The nym-connect frontend listens for these strings, so don't change them until we have a more robust mechanism in place
-    #[error("The connected gateway is slow, or the connection to it is slow")]
     GatewayIsSlow,
-    // NOTE: The nym-connect frontend listens for these strings, so don't change them until we have a more robust mechanism in place
-    #[error("The connected gateway is very slow, or the connection to it is very slow")]
     GatewayIsVerySlow,
 }
+
+impl std::fmt::Display for ClientCoreStatusMessage {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ClientCoreStatusMessage::GatewayIsSlow => write!(
+                f,
+                "The connected gateway is slow, or the connection to it is slow"
+            ),
+            ClientCoreStatusMessage::GatewayIsVerySlow => write!(
+                f,
+                "The connected gateway is very slow, or the connection to it is very slow"
+            ),
+        }
+    }
+}
+
+impl nym_task::TaskStatusEvent for ClientCoreStatusMessage {
+    fn as_any(&self) -> &dyn std::any::Any {
+        self
+    }
+}

common/client-core/src/init/helpers.rs

@@ -7,7 +7,7 @@ use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
-use nym_topology::{filter::VersionFilterable, gateway, mix};
+use nym_topology::{gateway, mix};
 use nym_validator_client::client::IdentityKeyRef;
 use nym_validator_client::UserAgent;
 use rand::{seq::SliceRandom, Rng};
@@ -53,7 +53,7 @@ pub trait ConnectableGateway {
     fn is_wss(&self) -> bool;
 }
 
-impl ConnectableGateway for gateway::Node {
+impl ConnectableGateway for gateway::LegacyNode {
     fn identity(&self) -> &identity::PublicKey {
         self.identity()
     }
@@ -82,7 +82,7 @@ pub async fn current_gateways<R: Rng>(
     rng: &mut R,
     nym_apis: &[Url],
     user_agent: Option<UserAgent>,
-) -> Result<Vec<gateway::Node>, ClientCoreError> {
+) -> Result<Vec<gateway::LegacyNode>, ClientCoreError> {
     let nym_api = nym_apis
         .choose(rng)
         .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
@@ -94,31 +94,26 @@ pub async fn current_gateways<R: Rng>(
 
     log::debug!("Fetching list of gateways from: {nym_api}");
 
-    let gateways = client.get_cached_described_gateways().await?;
+    let gateways = client.get_all_basic_entry_assigned_nodes(None).await?;
     log::debug!("Found {} gateways", gateways.len());
     log::trace!("Gateways: {:#?}", gateways);
 
     let valid_gateways = gateways
-        .into_iter()
+        .iter()
         .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<gateway::Node>>();
-    log::debug!("Ater checking validity: {}", valid_gateways.len());
+        .collect::<Vec<gateway::LegacyNode>>();
+    log::debug!("After checking validity: {}", valid_gateways.len());
     log::trace!("Valid gateways: {:#?}", valid_gateways);
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
-    log::debug!("After filtering for version: {}", filtered_gateways.len());
-    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
+    log::info!("nym-api reports {} valid gateways", valid_gateways.len());
 
-    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
-
-    Ok(filtered_gateways)
+    Ok(valid_gateways)
 }
 
 pub async fn current_mixnodes<R: Rng>(
     rng: &mut R,
     nym_apis: &[Url],
-) -> Result<Vec<mix::Node>, ClientCoreError> {
+) -> Result<Vec<mix::LegacyNode>, ClientCoreError> {
     let nym_api = nym_apis
         .choose(rng)
         .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
@@ -126,15 +121,15 @@ pub async fn current_mixnodes<R: Rng>(
 
     log::trace!("Fetching list of mixnodes from: {nym_api}");
 
-    let mixnodes = client.get_cached_mixnodes().await?;
+    let mixnodes = client
+        .get_all_basic_active_mixing_assigned_nodes(None)
+        .await?;
     let valid_mixnodes = mixnodes
-        .into_iter()
-        .filter_map(|mixnode| (&mixnode.bond_information).try_into().ok())
-        .collect::<Vec<mix::Node>>();
+        .iter()
+        .filter_map(|mixnode| mixnode.try_into().ok())
+        .collect::<Vec<mix::LegacyNode>>();
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_mixnodes = valid_mixnodes.filter_by_version(env!("CARGO_PKG_VERSION"));
-    Ok(filtered_mixnodes)
+    Ok(valid_mixnodes)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -273,9 +268,9 @@ fn filter_by_tls<G: ConnectableGateway>(
 
 pub(super) fn uniformly_random_gateway<R: Rng>(
     rng: &mut R,
-    gateways: &[gateway::Node],
+    gateways: &[gateway::LegacyNode],
     must_use_tls: bool,
-) -> Result<gateway::Node, ClientCoreError> {
+) -> Result<gateway::LegacyNode, ClientCoreError> {
     filter_by_tls(gateways, must_use_tls)?
         .choose(rng)
         .ok_or(ClientCoreError::NoGatewaysOnNetwork)
@@ -284,9 +279,9 @@ pub(super) fn uniformly_random_gateway<R: Rng>(
 
 pub(super) fn get_specified_gateway(
     gateway_identity: IdentityKeyRef,
-    gateways: &[gateway::Node],
+    gateways: &[gateway::LegacyNode],
     must_use_tls: bool,
-) -> Result<gateway::Node, ClientCoreError> {
+) -> Result<gateway::LegacyNode, ClientCoreError> {
     log::debug!("Requesting specified gateway: {}", gateway_identity);
     let user_gateway = identity::PublicKey::from_base58_string(gateway_identity)
         .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;

common/client-core/src/init/mod.rs

@@ -50,7 +50,7 @@ async fn setup_new_gateway<K, D>(
     key_store: &K,
     details_store: &D,
     selection_specification: GatewaySelectionSpecification,
-    available_gateways: Vec<gateway::Node>,
+    available_gateways: Vec<gateway::LegacyNode>,
 ) -> Result<InitialisationResult, ClientCoreError>
 where
     K: KeyStore,

common/client-core/src/init/types.rs

@@ -18,7 +18,6 @@ use nym_validator_client::client::IdentityKey;
 use nym_validator_client::nyxd::AccountId;
 use serde::Serialize;
 use std::fmt::Display;
-use std::str::FromStr;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use url::Url;
@@ -39,7 +38,7 @@ pub enum SelectedGateway {
 
 impl SelectedGateway {
     pub fn from_topology_node(
-        node: gateway::Node,
+        node: gateway::LegacyNode,
         must_use_tls: bool,
     ) -> Result<Self, ClientCoreError> {
         let gateway_listener = if must_use_tls {
@@ -51,20 +50,6 @@ impl SelectedGateway {
             node.clients_address()
         };
 
-        let gateway_owner_address = node
-            .owner
-            .as_ref()
-            .map(|raw_owner| {
-                AccountId::from_str(raw_owner).map_err(|source| {
-                    ClientCoreError::MalformedGatewayOwnerAccountAddress {
-                        gateway_id: node.identity_key.to_base58_string(),
-                        raw_owner: raw_owner.clone(),
-                        err: source.to_string(),
-                    }
-                })
-            })
-            .transpose()?;
-
         let gateway_listener =
             Url::parse(&gateway_listener).map_err(|source| ClientCoreError::MalformedListener {
                 gateway_id: node.identity_key.to_base58_string(),
@@ -74,7 +59,7 @@ impl SelectedGateway {
 
         Ok(SelectedGateway::Remote {
             gateway_id: node.identity_key,
-            gateway_owner_address,
+            gateway_owner_address: None,
             gateway_listener,
         })
     }
@@ -215,7 +200,7 @@ pub enum GatewaySetup {
         specification: GatewaySelectionSpecification,
 
         // TODO: seems to be a bit inefficient to pass them by value
-        available_gateways: Vec<gateway::Node>,
+        available_gateways: Vec<gateway::LegacyNode>,
     },
 
     ReuseConnection {

common/client-core/surb-storage/src/backend/fs_backend/manager.rs

@@ -1,9 +1,12 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::backend::fs_backend::error::StorageError;
-use crate::backend::fs_backend::models::{
-    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
+use crate::backend::fs_backend::{
+    error::StorageError,
+    models::{
+        ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag,
+        StoredSurbSender,
+    },
 };
 use log::{error, info};
 use sqlx::ConnectOptions;
@@ -27,11 +30,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(fresh);
-
-        opts.disable_statement_logging();
+            .create_if_missing(fresh)
+            .disable_statement_logging();
 
         let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
             Ok(pool) => pool,

common/client-libs/gateway-client/Cargo.toml

@@ -24,10 +24,12 @@ zeroize.workspace = true
 nym-bandwidth-controller = { path = "../../bandwidth-controller" }
 nym-credentials = { path = "../../credentials" }
 nym-credential-storage = { path = "../../credential-storage" }
+nym-credentials-interface = { path = "../../credentials-interface" }
 nym-crypto = { path = "../../crypto" }
 nym-gateway-requests = { path = "../../gateway-requests" }
 nym-network-defaults = { path = "../../network-defaults" }
 nym-sphinx = { path = "../../nymsphinx" }
+nym-statistics-common = { path = "../../statistics" }
 nym-pemstore = { path = "../../pemstore" }
 nym-validator-client = { path = "../validator-client", default-features = false }
 nym-task = { path = "../../task" }

common/client-libs/gateway-client/src/bandwidth.rs

@@ -2,21 +2,37 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use si_scale::helpers::bibytes2;
-use std::sync::atomic::{AtomicI64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicI64, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 
-#[derive(Clone, Default)]
+pub(crate) struct BandwidthClaimGuard {
+    inner: Arc<ClientBandwidthInner>,
+}
+
+impl Drop for BandwidthClaimGuard {
+    fn drop(&mut self) {
+        let old = self.inner.claiming_more.swap(false, Ordering::SeqCst);
+        assert!(
+            old,
+            "critical failure: there were multiple BandwidthClaimGuard existing"
+        )
+    }
+}
+
+#[derive(Clone)]
 pub struct ClientBandwidth {
     inner: Arc<ClientBandwidthInner>,
 }
 
-#[derive(Default)]
 struct ClientBandwidthInner {
     /// the actual bandwidth amount (in bytes) available
     available: AtomicI64,
 
+    /// flag to indicate whether this client is currently in the process of claiming additional bandwidth
+    claiming_more: AtomicBool,
+
     /// defines the timestamp when the bandwidth information has been logged to the logs stream
     last_logged_ts: AtomicI64,
 
@@ -29,11 +45,28 @@ impl ClientBandwidth {
         ClientBandwidth {
             inner: Arc::new(ClientBandwidthInner {
                 available: AtomicI64::new(0),
+                claiming_more: AtomicBool::new(false),
                 last_logged_ts: AtomicI64::new(0),
                 last_updated_ts: AtomicI64::new(0),
             }),
         }
     }
+
+    pub(crate) fn begin_bandwidth_claim(&self) -> Option<BandwidthClaimGuard> {
+        if self
+            .inner
+            .claiming_more
+            .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+            .is_ok()
+        {
+            Some(BandwidthClaimGuard {
+                inner: self.inner.clone(),
+            })
+        } else {
+            None
+        }
+    }
+
     pub(crate) fn remaining(&self) -> i64 {
         self.inner.available.load(Ordering::Acquire)
     }

common/client-libs/gateway-client/src/client/mod.rs

@@ -16,6 +16,7 @@ use nym_bandwidth_controller::{BandwidthController, BandwidthStatusMessage};
 use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_credentials::CredentialSpendingData;
+use nym_credentials_interface::TicketType;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
@@ -24,6 +25,8 @@ use nym_gateway_requests::{
     CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
 };
 use nym_sphinx::forwarding::packet::MixPacket;
+use nym_statistics_common::clients::connection::ConnectionStatsEvent;
+use nym_statistics_common::clients::ClientStatsSender;
 use nym_task::TaskClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use rand::rngs::OsRng;
@@ -93,6 +96,7 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
     connection: SocketState,
     packet_router: PacketRouter,
     bandwidth_controller: Option<BandwidthController<C, St>>,
+    stats_reporter: ClientStatsSender,
 
     // currently unused (but populated)
     negotiated_protocol: Option<u8>,
@@ -102,6 +106,7 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
 }
 
 impl<C, St> GatewayClient<C, St> {
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         cfg: GatewayClientConfig,
         gateway_config: GatewayConfig,
@@ -110,6 +115,7 @@ impl<C, St> GatewayClient<C, St> {
         shared_key: Option<Arc<SharedGatewayKey>>,
         packet_router: PacketRouter,
         bandwidth_controller: Option<BandwidthController<C, St>>,
+        stats_reporter: ClientStatsSender,
         task_client: TaskClient,
     ) -> Self {
         GatewayClient {
@@ -123,6 +129,7 @@ impl<C, St> GatewayClient<C, St> {
             connection: SocketState::NotConnected,
             packet_router,
             bandwidth_controller,
+            stats_reporter,
             negotiated_protocol: None,
             task_client,
         }
@@ -713,6 +720,7 @@ impl<C, St> GatewayClient<C, St> {
     {
         // TODO: make it configurable
         const TICKETS_TO_SPEND: u32 = 1;
+        const MIXNET_TICKET: TicketType = TicketType::V1MixnetEntry;
 
         if !self.authenticated {
             return Err(GatewayClientError::NotAuthenticated);
@@ -724,6 +732,11 @@ impl<C, St> GatewayClient<C, St> {
             return Err(GatewayClientError::NoBandwidthControllerAvailable);
         }
 
+        let Some(_claim_guard) = self.bandwidth.begin_bandwidth_claim() else {
+            debug!("there's already an existing bandwidth claim ongoing");
+            return Ok(());
+        };
+
         warn!("Not enough bandwidth. Trying to get more bandwidth, this might take a while");
         if !self.cfg.bandwidth.require_tickets {
             info!("The client is running in disabled credentials mode - attempting to claim bandwidth without a credential");
@@ -743,11 +756,24 @@ impl<C, St> GatewayClient<C, St> {
         }
         let prepared_credential = self
             .unchecked_bandwidth_controller()
-            .prepare_ecash_ticket(self.gateway_identity.to_bytes(), TICKETS_TO_SPEND)
+            .prepare_ecash_ticket(
+                MIXNET_TICKET,
+                self.gateway_identity.to_bytes(),
+                TICKETS_TO_SPEND,
+            )
             .await?;
 
         match self.claim_ecash_bandwidth(prepared_credential.data).await {
-            Ok(_) => Ok(()),
+            Ok(_) => {
+                self.stats_reporter.report(
+                    ConnectionStatsEvent::TicketSpent {
+                        typ: MIXNET_TICKET,
+                        amount: TICKETS_TO_SPEND,
+                    }
+                    .into(),
+                );
+                Ok(())
+            }
             Err(err) => {
                 error!("failed to claim ecash bandwidth with the gateway...: {err}");
                 if err.is_ticket_replay() {
@@ -1020,6 +1046,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
             connection: SocketState::NotConnected,
             packet_router,
             bandwidth_controller: None,
+            stats_reporter: ClientStatsSender::new(None),
             negotiated_protocol: None,
             task_client,
         }
@@ -1029,6 +1056,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
         self,
         packet_router: PacketRouter,
         bandwidth_controller: Option<BandwidthController<C, St>>,
+        stats_reporter: ClientStatsSender,
         task_client: TaskClient,
     ) -> GatewayClient<C, St> {
         // invariants that can't be broken
@@ -1048,6 +1076,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
             connection: self.connection,
             packet_router,
             bandwidth_controller,
+            stats_reporter,
             negotiated_protocol: self.negotiated_protocol,
             task_client,
         }

common/client-libs/validator-client/Cargo.toml

@@ -20,11 +20,12 @@ nym-coconut-bandwidth-contract-common = { path = "../../cosmwasm-smart-contracts
 nym-ecash-contract-common = { path = "../../cosmwasm-smart-contracts/ecash-contract" }
 nym-multisig-contract-common = { path = "../../cosmwasm-smart-contracts/multisig-contract" }
 nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contract" }
+nym-serde-helpers = { path = "../../serde-helpers", features = ["hex", "base64"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 nym-http-api-client = { path = "../../../common/http-api-client" }
 thiserror = { workspace = true }
-log = { workspace = true }
+tracing = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
 time = { workspace = true, features = ["formatting"] }