Feature flag IPv4 forcing

Co-authored-by: Jędrzej Stuczyński <jedrzej.stuczynski@gmail.com>

.github/workflows/ci-build-upload-binaries.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [ arc-linux-latest ]
+        platform: [ arc-ubuntu-22.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-build-vpn-api-wasm.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   wasm:
-    runs-on: arc-linux-latest
+    runs-on: arc-ubuntu-22.04
     env:
       CARGO_TERM_COLOR: always
       RUSTUP_PERMIT_COPY_RENAME: 1

.github/workflows/ci-build.yml

@@ -8,13 +8,10 @@ on:
       - 'gateway/**'
       - 'integrations/**'
       - 'nym-api/**'
-      - 'nym-authenticator-client/**'
       - 'nym-credential-proxy/**'
-      - 'nym-ip-packet-client/**'
       - 'nym-network-monitor/**'
       - 'nym-node/**'
       - 'nym-node-status-api/**'
-      - 'nym-registration-client/**'
       - 'nym-statistics-api/**'
       - 'nym-outfox/**'
       - 'nym-validator-rewarder/**'
@@ -84,21 +81,12 @@ jobs:
           command: fmt
           args: --all -- --check
 
-      - name: Clippy (macos)
-        if: contains(matrix.os, 'mac')
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe -- -D warnings
-
-      - name: Clippy (non-macos)
-        if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
+      - name: Clippy
         uses: actions-rs/cargo@v1
         with:
           command: clippy
           args: --workspace --all-targets -- -D warnings
 
-
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:

.github/workflows/ci-check-ns-api-version.yml

@@ -10,13 +10,13 @@ env:
 
 jobs:
   check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/ci-check-nym-stats-api-version.yml

@@ -10,13 +10,13 @@ env:
 
 jobs:
   check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/ci-contracts-upload-binaries.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [ arc-linux-latest-dind ]
+        platform: [ arc-ubuntu-22.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:
@@ -28,11 +28,18 @@ jobs:
           mkdir -p $OUTPUT_DIR
           echo $OUTPUT_DIR
 
-      - name: Build contracts
-        run: make optimize-contracts
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
 
-      - name: Check optimized contracts
-        run: make docker-check-contracts
+      - name: Install cosmwasm-check
+        run: cargo install cosmwasm-check
+
+      - name: Build release contracts
+        run: make publish-contracts
 
       - name: Prepare build output
         shell: bash

.github/workflows/ci-contracts.yml

@@ -17,7 +17,7 @@ jobs:
   build:
     # since it's going to be compiled into wasm, there's absolutely
     # no point in running CI on different OS-es
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
     env:
       CARGO_TERM_COLOR: always
       RUSTUP_PERMIT_COPY_RENAME: 1
@@ -54,7 +54,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: --lib --manifest-path contracts/Cargo.toml --all-features
+          args: --lib --manifest-path contracts/Cargo.toml
 
       - name: Check formatting
         uses: actions-rs/cargo@v1

.github/workflows/ci-docs.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: arc-ubuntu-22.04
     env:
       RUSTUP_PERMIT_COPY_RENAME: 1
     defaults:

.github/workflows/ci-lint-typescript.yml

@@ -6,14 +6,16 @@ on:
     paths:
       - "ts-packages/**"
       - "sdk/typescript/**"
+      - "nym-connect/desktop/src/**"
+      - "nym-connect/desktop/package.json"
       - "nym-wallet/src/**"
       - "nym-wallet/package.json"
-      - "explorer-v2/**"
+      - "explorer/**"
       - ".github/workflows/ci-lint-typescript.yml"
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
     env:
       RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
@@ -23,7 +25,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 20
-
       - name: Setup yarn
         run: npm install -g yarn
 
@@ -36,12 +37,14 @@ jobs:
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
 
       - name: Install wasm-opt
-        run: cargo install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"
 
       - name: Install
         run: yarn
@@ -49,11 +52,7 @@ jobs:
       - name: Build packages
         run: yarn build:ci
 
-      - name: Install again
-        run: yarn
-
       - name: Lint
         run: yarn lint
-
       - name: Typecheck with tsc
         run: yarn tsc

.github/workflows/ci-nym-wallet-rust.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: arc-ubuntu-22.04
     env:
       CARGO_TERM_COLOR: always
       RUSTUP_PERMIT_COPY_RENAME: 1

.github/workflows/ci-nym-wallet-storybook.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    runs-on: arc-linux-latest
+    runs-on: custom-linux
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/ci-sdk-wasm.yml

@@ -4,14 +4,14 @@ on:
   workflow_dispatch:
   pull_request:
     paths:
-      - "wasm/**"
-      - "clients/client-core/**"
-      - "common/**"
-      - ".github/workflows/ci-sdk-wasm.yml"
+      - 'wasm/**'
+      - 'clients/client-core/**'
+      - 'common/**'
+      - '.github/workflows/ci-sdk-wasm.yml'
 
 jobs:
   wasm:
-    runs-on: arc-linux-latest
+    runs-on: arc-ubuntu-22.04
     env:
       CARGO_TERM_COLOR: always
       RUSTUP_PERMIT_COPY_RENAME: 1
@@ -31,9 +31,9 @@ jobs:
           components: rustfmt, clippy
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"
 
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -41,7 +41,7 @@ jobs:
       - name: Install wasm-opt
         uses: ./.github/actions/install-wasm-opt
         with:
-          version: "116"
+          version: '116'
 
       - name: Install wasm-bindgen-cli
         run: cargo install wasm-bindgen-cli

.github/workflows/ci-sonar.yml

@@ -14,6 +14,6 @@ jobs:
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v6
+        uses: SonarSource/sonarqube-scan-action@v5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/deploy-github-pages.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Pages
         uses: actions/configure-pages@v5
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v3
         with:
           # Upload entire repository
           path: './ppa'

.github/workflows/greetings.yml

@@ -8,6 +8,6 @@ jobs:
     steps:
     - uses: actions/first-interaction@v3
       with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        issue_message: 'Thank you for raising this issue'
-        pr_message: 'Thank you for making this first PR'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: 'Thank you for raising this issue'
+        pr-message: 'Thank you for making this first PR'

.github/workflows/publish-nym-binaries.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: arc-linux-latest
+          - os: arc-ubuntu-22.04
             target: x86_64-unknown-linux-gnu
     runs-on:  ${{ matrix.os }}
 
@@ -56,7 +56,7 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: 1.88.0
+          toolchain: 1.86.0
           override: true
 
       - name: Build all binaries

.github/workflows/publish-sdk-npm.yml

@@ -4,7 +4,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
 
@@ -17,13 +17,10 @@ jobs:
       - name: Setup yarn
         run: npm install -g yarn
 
-      - name: Install rust toolchain
+      - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          profile: minimal
           toolchain: stable
-          override: true
-          components: rustfmt, clippy
 
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -32,9 +29,9 @@ jobs:
         run: cargo install wasm-opt
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"
 
       - name: Install dependencies
         run: yarn

.github/workflows/push-credential-proxy.yaml

@@ -8,7 +8,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml

.github/workflows/push-data-observatory.yaml

@@ -8,7 +8,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-network-monitor.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml

.github/workflows/push-node-status-agent.yaml

@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
   workflow_dispatch:
     inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
       release_image:
         description: 'Tag image as a release'
         required: true
@@ -15,7 +20,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -38,6 +43,16 @@ jobs:
           VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
           echo "result=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
       - name: Initialize RELEASE_TAG
         run: echo "RELEASE_TAG=" >> $GITHUB_ENV
       
@@ -46,12 +61,24 @@ jobs:
         run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
       
       - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
         
       - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-api.yaml

@@ -14,7 +14,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -69,6 +69,6 @@ jobs:
 
       - name: BuildAndPushImageOnHarbor
         run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile-pg . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
           docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
 

.github/workflows/push-nym-api.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml

.github/workflows/push-nym-node.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-nym-statistics-api.yaml

@@ -8,7 +8,7 @@ env:
 
 jobs:
   build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
     steps:
       - name: Login to Harbor
         uses: docker/login-action@v3
@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-nyx-chain-watcher.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.github/workflows/push-validator-rewarder.yaml

@@ -26,7 +26,7 @@ jobs:
           git config --global user.name "Lawrence Stalder"
 
       - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.48.1
+        uses: mikefarah/yq@v4.47.1
         id: get_version
         with:
           cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml

.gitignore

@@ -63,5 +63,3 @@ nym-api/redocly/formatted-openapi.json
 
 **/settings.sql
 **/enter_db.sh
-
-*.profraw

CHANGELOG.md

@@ -4,264 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
-## [2025.21-mozzarella] (2025-11-25)
-
-- [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
-- bugfix: fix credential proxy upgrade mode attestation url arg ([#6202])
-- HTTP API resilience enable & domain rotation conditions ([#6200])
-- Remove debug feature from http-macro spec in gateway probe ([#6195])
-- DNS relibility and troubleshooting  ([#6179])
-- [bugfix] Distinguish authenticator errors by credential spent ([#6176])
-- Typescript SDK 1.4.1 ([#6146])
-- Enable URL rotation and retries for mixnet gateway init ([#6126])
-- Feature/credential proxy jwt ([#5957])
-
-[#6225]: https://github.com/nymtech/nym/pull/6225
-[#6202]: https://github.com/nymtech/nym/pull/6202
-[#6200]: https://github.com/nymtech/nym/pull/6200
-[#6195]: https://github.com/nymtech/nym/pull/6195
-[#6179]: https://github.com/nymtech/nym/pull/6179
-[#6176]: https://github.com/nymtech/nym/pull/6176
-[#6146]: https://github.com/nymtech/nym/pull/6146
-[#6126]: https://github.com/nymtech/nym/pull/6126
-[#5957]: https://github.com/nymtech/nym/pull/5957
-
-## [2025.20-leerdammer] (2025-11-12)
-
-- Max/tweak ts sdk actions ([#6185])
-- chore: resolve clippy 1.91 warnings ([#6168])
-- [chore] Remove unused dependencies ([#6151])
-- Use typed-builder for registration client builder config ([#6150])
-- tommy is too quick ([#6149])
-- configurable mixnet client startup timeout ([#6148])
-- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
-- Bugfix: Add circuit breaker ([#6143])
-- bugfix: update internal owner address in transferred share ([#6139])
-- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
-- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
-- bugfix: update stored epoch share when changing ownership ([#6135])
-- Domain fronting ([#6134])
-- bugfix: update stored epoch share when changing announce address ([#6131])
-
-[#6185]: https://github.com/nymtech/nym/pull/6185
-[#6168]: https://github.com/nymtech/nym/pull/6168
-[#6151]: https://github.com/nymtech/nym/pull/6151
-[#6150]: https://github.com/nymtech/nym/pull/6150
-[#6149]: https://github.com/nymtech/nym/pull/6149
-[#6148]: https://github.com/nymtech/nym/pull/6148
-[#6145]: https://github.com/nymtech/nym/pull/6145
-[#6143]: https://github.com/nymtech/nym/pull/6143
-[#6139]: https://github.com/nymtech/nym/pull/6139
-[#6138]: https://github.com/nymtech/nym/pull/6138
-[#6136]: https://github.com/nymtech/nym/pull/6136
-[#6135]: https://github.com/nymtech/nym/pull/6135
-[#6134]: https://github.com/nymtech/nym/pull/6134
-[#6131]: https://github.com/nymtech/nym/pull/6131
-
-## [2025.19-kase] (2025-10-30)
-
-- update ns agent workflow ([#6154])
-- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
-- bugfix: nym-credential-proxy query params parsing regression ([#6121])
-- bugfix: revert some dep updates introduced in #6043 ([#6120])
-- Skip ipv6 metadata endpoint request ([#6118])
-- update to no longer use 1mb files ([#6117])
-- chore: restore pending dkg contract state migration ([#6116])
-- Revert "Propagate cancel token to mixnet client" ([#6115])
-- Update dirs to 6.0 ([#6109])
-- Propagate cancel token to mixnet client ([#6105])
-- bugfix: retrieve and update ticketbook in the same query ([#6101])
-- bugfix: include network name in the default gateway probe config path ([#6100])
-- Bugfix/incompatibility fixes ([#6099])
-- [DOCs/operators] QUIC deployment script & docs ([#6098])
-- bugfix: testnet manager 02sql migration ([#6096])
-- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
-- bugfix: use custom topology provider for list of init gateways ([#6092])
-- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
-## [2025.18-jarlsberg] (2025-10-14)
-
-- ns-api: add descriptions to dVPN gateway responses ([#6102])
-- NS API: use new probe download filesize and milliseconds field ([#6097])
-- ns-api: use download files size from probes instead of parsing filenames ([#6095])
-- ns-api: add new fields for probe output for query_metadata and download file size and duration in ms ([#6091])
-- Bugfix/bloomfilters purge ([#6089])
-- Hotfix: Update API source in node ping tester script ([#6082])
-- Get wireguard keypair as arg instead of reading it from disk ([#6078])
-- Feature: Ping probe all nodes /described nodes from a server ([#6074])
-- Node Status API: add bridge information to dVPN endpoint ([#6069])
-- frontdoor typo fix ([#6067])
-- Feature: Node rewards tracker ([#6064])
-- [chore] Clippy fix ([#6060])
-- Registration Client ([#6059])
-- Bugfix: Nym node CLI download nym-node exception ([#6058])
-- Feature: Nym node html landing page ([#6053])
-- feat: DKG contract method for updating announce address ([#6050])
-- feat: NS ticket faucet ([#6047])
-- Bridge proto client params in Self-Described ([#6035])
-- Node Status API: remove sqlite support ([#6004])
-- Benny/ci contract fix ([#5962])
-
-[#6102]: https://github.com/nymtech/nym/pull/6102
-[#6097]: https://github.com/nymtech/nym/pull/6097
-[#6095]: https://github.com/nymtech/nym/pull/6095
-[#6091]: https://github.com/nymtech/nym/pull/6091
-[#6089]: https://github.com/nymtech/nym/pull/6089
-[#6082]: https://github.com/nymtech/nym/pull/6082
-[#6078]: https://github.com/nymtech/nym/pull/6078
-[#6074]: https://github.com/nymtech/nym/pull/6074
-[#6069]: https://github.com/nymtech/nym/pull/6069
-[#6067]: https://github.com/nymtech/nym/pull/6067
-[#6064]: https://github.com/nymtech/nym/pull/6064
-[#6060]: https://github.com/nymtech/nym/pull/6060
-[#6059]: https://github.com/nymtech/nym/pull/6059
-[#6058]: https://github.com/nymtech/nym/pull/6058
-[#6053]: https://github.com/nymtech/nym/pull/6053
-[#6050]: https://github.com/nymtech/nym/pull/6050
-[#6047]: https://github.com/nymtech/nym/pull/6047
-[#6035]: https://github.com/nymtech/nym/pull/6035
-[#6004]: https://github.com/nymtech/nym/pull/6004
-[#5962]: https://github.com/nymtech/nym/pull/5962
-
-## [2025.17-isabirra] (2025-09-29)
-
-- Bugfix | Fix the registration handshake ([#6062])
-- Convenience for ShutdownTracker ([#6038])
-- chore: made http-api-client-macro doctest compile ([#6037])
-- feat: refresh mixnet contract on epoch progression ([#6023])
-- chore: remove legacy nodes from nym api [and kinda-ish from node status api] ([#6021])
-- Feature/credential proxy crate ([#6018])
-- Moving clients crate from vpn-client repo to here ([#6015])
-- Feature/cancellation migration ([#6014])
-- Use default value for the ports until api is deployed ([#6007])
-- bugfix: return from MixTrafficController if client request channel has closed ([#6002])
-- Revert "Create an axum_test client for more integrated unit testing (… ([#5999])
-- chore: upgraded syn to 2.0 and removed nym-execute ([#5998])
-- feat: use `ShutdownToken` (`CancellationToken` inside) for nym-api ([#5997])
-- bugfix: Recipient deserialisation for deserialisers missing bytes specialisation ([#5991])
-- chore: use updated version of simulate endpoint ([#5988])
-- chore: purge temp databases on build ([#5984])
-- Bump sha.js from 2.4.11 to 2.4.12 ([#5983])
-- Feature: Delegation program stake checker and adjuster ([#5980])
-- build(deps): bump actions/setup-java from 4 to 5 ([#5975])
-- Domain fronting integration ([#5974])
-- chore: internal hidden command to force advance nyx epoch ([#5964])
-- Create an axum_test client for more integrated unit testing ([#5956])
-- feat: shared library for attempting to retrieve update mode attestation ([#5954])
-- Bump slab from 0.4.10 to 0.4.11 ([#5952])
-- build(deps): bump actions/first-interaction from 1 to 3 ([#5950])
-- fix: use WASM compatible time API in client ([#5948])
-- feat: credential proxy deposit pool ([#5945])
-- build(deps): bump actions/download-artifact from 4 to 5 ([#5939])
-- feat: nym signers monitor ([#5933])
-- Bump console from 0.15.11 to 0.16.0 ([#5931])
-- Bump mock_instant from 0.5.3 to 0.6.0 ([#5930])
-- Bump tokio from 1.46.1 to 1.47.1 ([#5929])
-- Bump defguard_wireguard_rs from v0.4.7 to v0.7.5 ([#5928])
-- Bump indicatif from 0.17.11 to 0.18.0 ([#5924])
-- Feature: Nym node autorun CLI ([#5916])
-- build(deps): bump mikefarah/yq from 4.45.4 to 4.47.1 ([#5911])
-- build(deps): bump pbkdf2 from 3.1.2 to 3.1.3 ([#5869])
-
-[#6062]: https://github.com/nymtech/nym/pull/6062
-[#6038]: https://github.com/nymtech/nym/pull/6038
-[#6037]: https://github.com/nymtech/nym/pull/6037
-[#6023]: https://github.com/nymtech/nym/pull/6023
-[#6021]: https://github.com/nymtech/nym/pull/6021
-[#6018]: https://github.com/nymtech/nym/pull/6018
-[#6015]: https://github.com/nymtech/nym/pull/6015
-[#6014]: https://github.com/nymtech/nym/pull/6014
-[#6007]: https://github.com/nymtech/nym/pull/6007
-[#6002]: https://github.com/nymtech/nym/pull/6002
-[#5999]: https://github.com/nymtech/nym/pull/5999
-[#5998]: https://github.com/nymtech/nym/pull/5998
-[#5997]: https://github.com/nymtech/nym/pull/5997
-[#5991]: https://github.com/nymtech/nym/pull/5991
-[#5988]: https://github.com/nymtech/nym/pull/5988
-[#5984]: https://github.com/nymtech/nym/pull/5984
-[#5983]: https://github.com/nymtech/nym/pull/5983
-[#5980]: https://github.com/nymtech/nym/pull/5980
-[#5975]: https://github.com/nymtech/nym/pull/5975
-[#5974]: https://github.com/nymtech/nym/pull/5974
-[#5964]: https://github.com/nymtech/nym/pull/5964
-[#5956]: https://github.com/nymtech/nym/pull/5956
-[#5954]: https://github.com/nymtech/nym/pull/5954
-[#5952]: https://github.com/nymtech/nym/pull/5952
-[#5950]: https://github.com/nymtech/nym/pull/5950
-[#5948]: https://github.com/nymtech/nym/pull/5948
-[#5945]: https://github.com/nymtech/nym/pull/5945
-[#5939]: https://github.com/nymtech/nym/pull/5939
-[#5933]: https://github.com/nymtech/nym/pull/5933
-[#5931]: https://github.com/nymtech/nym/pull/5931
-[#5930]: https://github.com/nymtech/nym/pull/5930
-[#5929]: https://github.com/nymtech/nym/pull/5929
-[#5928]: https://github.com/nymtech/nym/pull/5928
-[#5924]: https://github.com/nymtech/nym/pull/5924
-[#5916]: https://github.com/nymtech/nym/pull/5916
-[#5911]: https://github.com/nymtech/nym/pull/5911
-[#5869]: https://github.com/nymtech/nym/pull/5869
-
-## [2025.16-halloumi] (2025-09-16)
-
-- Backport metadata endpoint ([#6010])
-- bugfix: make sure tables are removed in correct order to not trigger FK constraint issue ([#5987])
-- chore: move authenticator into gateway crate ([#5982])
-- Fix the ns api ci workflow ([#5981])
-- Remove freshness check on testrun submit ([#5977])
-- Update sysinfo to the latest ([#5976])
-- bugfix: manually calculate per node work on rewarded set changes ([#5972])
-- fixing the ci for ns agent ([#5965])
-- Feature/testing utils ([#5963])
-- bugfix: fix ci-build for linux (and use updated runner) ([#5958])
-- chore: updated refs to cheddar rev of nym repo ([#5955])
-- http api client adjustment ([#5953])
-- chore: fix rust 1.89 clippy issues ([#5944])
-- Wireguard metadata client library ([#5943])
-- chore: remove unused import ([#5942])
-- feat: introduce additional checks when attempting to send to bounded channels ([#5941])
-- Move credential verifier in peer controller ([#5938])
-- change PK/FK on expiration date signatures tables ([#5934])
-- Wireguard private metadata ([#5915])
-
-[#6010]: https://github.com/nymtech/nym/pull/6010
-[#5987]: https://github.com/nymtech/nym/pull/5987
-[#5982]: https://github.com/nymtech/nym/pull/5982
-[#5981]: https://github.com/nymtech/nym/pull/5981
-[#5977]: https://github.com/nymtech/nym/pull/5977
-[#5976]: https://github.com/nymtech/nym/pull/5976
-[#5972]: https://github.com/nymtech/nym/pull/5972
-[#5965]: https://github.com/nymtech/nym/pull/5965
-[#5963]: https://github.com/nymtech/nym/pull/5963
-[#5958]: https://github.com/nymtech/nym/pull/5958
-[#5955]: https://github.com/nymtech/nym/pull/5955
-[#5953]: https://github.com/nymtech/nym/pull/5953
-[#5944]: https://github.com/nymtech/nym/pull/5944
-[#5943]: https://github.com/nymtech/nym/pull/5943
-[#5942]: https://github.com/nymtech/nym/pull/5942
-[#5941]: https://github.com/nymtech/nym/pull/5941
-[#5938]: https://github.com/nymtech/nym/pull/5938
-[#5934]: https://github.com/nymtech/nym/pull/5934
-[#5915]: https://github.com/nymtech/nym/pull/5915
-
 ## [2025.15-gruyere] (2025-08-20)
 
 - Migrate strum to 0.27.2 ([#5960])

Cargo.toml

@@ -31,7 +31,6 @@ members = [
     "common/client-libs/mixnet-client",
     "common/client-libs/validator-client",
     "common/commands",
-    "common/nym-common",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
@@ -44,7 +43,6 @@ members = [
     "common/cosmwasm-smart-contracts/nym-performance-contract",
     "common/cosmwasm-smart-contracts/nym-pool-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
-    "common/credential-proxy",
     "common/credential-storage",
     "common/credential-utils",
     "common/credential-verification",
@@ -60,7 +58,6 @@ members = [
     "common/gateway-stats-storage",
     "common/gateway-storage",
     "common/http-api-client",
-    "common/http-api-client-macro",
     "common/http-api-common",
     "common/inclusion-probability",
     "common/ip-packet-requests",
@@ -69,8 +66,6 @@ members = [
     "common/network-defaults",
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
-    "common/nym-cache",
-    "common/nym-connection-monitor",
     "common/nym-id",
     "common/nym-metrics",
     "common/nym_offline_compact_ecash",
@@ -87,11 +82,8 @@ members = [
     "common/nymsphinx/params",
     "common/nymsphinx/routing",
     "common/nymsphinx/types",
-    "common/nyxd-scraper-sqlite",
-    "common/nyxd-scraper-psql",
-    "common/nyxd-scraper-shared",
+    "common/nyxd-scraper",
     "common/pemstore",
-    "common/registration",
     "common/serde-helpers",
     "common/service-provider-requests-common",
     "common/socks5-client-core",
@@ -99,13 +91,11 @@ members = [
     "common/socks5/requests",
     "common/statistics",
     "common/store-cipher",
-    "common/task",
-    "common/test-utils",
+    "common/task", "common/test-utils",
     "common/ticketbooks-merkle",
     "common/topology",
     "common/tun",
     "common/types",
-    "common/upgrade-mode-check",
     "common/verloc",
     "common/wasm/client-core",
     "common/wasm/storage",
@@ -121,13 +111,10 @@ members = [
     "gateway",
     "nym-api",
     "nym-api/nym-api-requests",
-    "nym-authenticator-client",
     "nym-browser-extension/storage",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-credential-proxy/nym-credential-proxy-requests",
     "nym-credential-proxy/vpn-api-lib-wasm",
-    "nym-data-observatory",
-    "nym-ip-packet-client",
     "nym-network-monitor",
     "nym-node",
     "nym-node-status-api/nym-node-status-agent",
@@ -136,8 +123,6 @@ members = [
     "nym-node/nym-node-metrics",
     "nym-node/nym-node-requests",
     "nym-outfox",
-    "nym-registration-client",
-    "nym-signers-monitor",
     "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
@@ -153,9 +138,10 @@ members = [
     "tools/internal/contract-state-importer/importer-cli",
     "tools/internal/contract-state-importer/importer-contract",
     "tools/internal/mixnet-connectivity-check",
-#    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
     "tools/internal/ssl-inject",
     "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager",
     "tools/internal/testnet-manager/dkg-bypass-contract",
     "tools/internal/validator-status-check",
     "tools/nym-cli",
@@ -168,13 +154,11 @@ members = [
     "wasm/mix-fetch",
     "wasm/node-tester",
     "wasm/zknym-lib",
-    "nym-gateway-probe"
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
-    "nym-authenticator-client",
     "nym-api",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-node",
@@ -188,16 +172,16 @@ default-members = [
     "tools/nymvisor",
 ]
 
-exclude = ["contracts", "nym-wallet", "cpu-cycles"]
+exclude = ["explorer", "contracts", "nym-wallet", "cpu-cycles"]
 
 [workspace.package]
 authors = ["Nym Technologies SA"]
 repository = "https://github.com/nymtech/nym"
 homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
-edition = "2024"
+edition = "2021"
 license = "Apache-2.0"
-rust-version = "1.85"
+rust-version = "1.81"
 readme = "README.md"
 
 [workspace.dependencies]
@@ -219,6 +203,7 @@ base64 = "0.22.1"
 base85rs = "0.1.3"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
+bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
 blake3 = "1.7.0"
 bloomfilter = "3.0.1"
@@ -246,11 +231,13 @@ criterion = "0.5"
 csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
+curve25519-dalek = "4.1"
 dashmap = "5.5.3"
 # We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
 defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
-dirs = "6.0"
+dirs = "5.0"
+doc-comment = "0.3"
 dotenvy = "0.15.6"
 dyn-clone = "1.0.19"
 ecdsa = "0.16"
@@ -266,9 +253,11 @@ futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-glob = "0.3"
+getset = "0.1.5"
 handlebars = "3.5.5"
+headers = "0.4.0"
 hex = "0.4.3"
+hex-literal = "0.3.3"
 hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
@@ -282,20 +271,20 @@ hyper = "1.6.0"
 hyper-util = "0.1"
 indicatif = "0.18.0"
 inquire = "0.6.2"
-inventory = "0.3.21"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
-jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
+maxminddb = "0.23.0"
 mime = "0.3.17"
 moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
+okapi = "0.7.0"
 once_cell = "1.21.3"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
@@ -303,7 +292,7 @@ parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.1"
-pnet_packet = "0.35.0"
+pin-project-lite = "0.2.16"
 publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
 quote = "1"
@@ -311,10 +300,13 @@ rand = "0.8.5"
 rand_chacha = "0.3"
 rand_core = "0.6.3"
 rand_distr = "0.4"
+rand_pcg = "0.3.1"
+rand_seeder = "0.2.3"
 rayon = "1.5.1"
 regex = "1.10.6"
 reqwest = { version = "0.12.15", default-features = false }
 rs_merkle = "1.5.0"
+safer-ffi = "0.1.13"
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
@@ -338,7 +330,6 @@ syn = "2"
 sysinfo = "0.37.0"
 tap = "1.0.1"
 tar = "0.4.44"
-test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
@@ -351,17 +342,15 @@ tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
 tower = "0.5.2"
-tower-http = "0.6.6"
+tower-http = "0.5.2"
 tracing = "0.1.41"
 tracing-log = "0.2"
 tracing-opentelemetry = "0.19.0"
-tracing-subscriber = "0.3.20"
+tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
-tracing-test = "0.2.5"
 ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
-typed-builder = "0.23.0"
 uniffi = "0.29.2"
 uniffi_build = "0.29.0"
 url = "2.5"
@@ -370,7 +359,6 @@ utoipa-swagger-ui = "8.1"
 utoipauto = "0.2"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
-vergen-gitcl = { version = "1.0.8", default-features = false }
 walkdir = "2"
 x25519-dalek = "2.0.0"
 zeroize = "1.7.0"
@@ -402,9 +390,7 @@ cw-multi-test = "=2.3.2"
 bip32 = { version = "0.5.3", default-features = false }
 
 
-cosmrs = { version = "0.22.0" }
-cosmos-sdk-proto = { version = "0.27.0" }
-ibc-proto = { version = "0.52.0" }
+cosmrs = { version = "0.21.1" }
 tendermint = "0.40.4"
 tendermint-rpc = "0.40.4"
 prost = { version = "0.13", default-features = false }
@@ -412,19 +398,18 @@ prost = { version = "0.13", default-features = false }
 # wasm-related dependencies
 gloo-utils = "0.2.0"
 gloo-net = "0.6.0"
-gloo-timers = "0.3.0"
 
 indexed_db_futures = "0.6.4"
 js-sys = "0.3.76"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-tokio_with_wasm = { version = "0.8.7" }
 wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
 web-sys = "0.3.76"
 
+
 # for local development:
 #[patch.crates-io]
 #sphinx-packet = { path = "../sphinx" }
@@ -460,11 +445,6 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
 
 [workspace.lints.clippy]
-suspicious = "deny"
-complexity = "deny"
-perf = "deny"
-style = "deny"
-
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"

Makefile

@@ -109,7 +109,7 @@ sdk-wasm-build:
 	$(MAKE) -C wasm/node-tester
 	$(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
-	# $(MAKE) -C wasm/full-nym-wasm
+	#$(MAKE) -C wasm/full-nym-wasm
 
 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
@@ -154,7 +154,6 @@ CONTRACTS_OUT_DIR = contracts/artifacts
 #
 COSMWASM_OPTIMIZER_IMAGE ?= cosmwasm/optimizer:0.17.0
 COSMWASM_OPTIMIZER_PLATFORM ?= linux/amd64
-COSMWASM_CHECK_IMAGE ?= rust:1.88
 
 # Ensure clean build environment and run the optimizer
 optimize-contracts:
@@ -180,13 +179,6 @@ optimize-contracts:
 	# Cleanup temporary artefacts directory
 	@rm -rf artifacts 2>/dev/null || true
 
-# Check artifacts with cosmwasm-check inside the optimizer image
-docker-check-contracts:
-	@docker run --rm --platform $(COSMWASM_OPTIMIZER_PLATFORM) \
-	  -v $(CURDIR):/code --workdir /code \
-	  --entrypoint /bin/sh \
-	  $(COSMWASM_CHECK_IMAGE) -lc 'apt-get update && apt-get install -y --no-install-recommends llvm-dev libclang-dev pkg-config && export PATH="/usr/local/cargo/bin:/usr/local/rustup/bin:$$PATH" && cargo install cosmwasm-check --locked && WASMER_ENGINE=universal WASMER_COMPILER=singlepass cosmwasm-check contracts/artifacts/*.wasm'
-
 wasm-opt-contracts:
 	@for WASM in $(WASM_CONTRACT_DIR)/*.wasm; do \
 	  echo "Running wasm-opt on $$WASM"; \

clients/native/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "nym-client"
-version = "1.1.67"
+version = "1.1.61"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.70"
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

clients/native/src/client/mod.rs

@@ -11,7 +11,7 @@ use nym_client_core::client::base_client::{
     BaseClientBuilder, ClientInput, ClientOutput, ClientState,
 };
 use nym_sphinx::params::PacketType;
-use nym_task::ShutdownManager;
+use nym_task::TaskHandle;
 use nym_validator_client::QueryHttpRpcNyxdClient;
 use std::error::Error;
 use std::path::PathBuf;
@@ -29,8 +29,6 @@ pub struct SocketClient {
 
     /// Optional path to a .json file containing standalone network details.
     custom_mixnet: Option<PathBuf>,
-
-    shutdown_manager: ShutdownManager,
 }
 
 impl SocketClient {
@@ -42,7 +40,6 @@ impl SocketClient {
         SocketClient {
             config,
             custom_mixnet,
-            shutdown_manager: Default::default(),
         }
     }
 
@@ -52,7 +49,7 @@ impl SocketClient {
         client_output: ClientOutput,
         client_state: ClientState,
         self_address: &Recipient,
-        shutdown_token: nym_task::ShutdownToken,
+        task_client: nym_task::TaskClient,
         packet_type: PacketType,
     ) {
         info!("Starting websocket listener...");
@@ -60,7 +57,6 @@ impl SocketClient {
         let ClientInput {
             connection_command_sender,
             input_sender,
-            ..
         } = client_input;
 
         let ClientOutput {
@@ -81,24 +77,24 @@ impl SocketClient {
             shared_lane_queue_lengths,
             reply_controller_sender,
             Some(packet_type),
-            shutdown_token.clone(),
+            task_client.fork("websocket_handler"),
         );
 
         websocket::Listener::new(
             config.socket.host,
             config.socket.listening_port,
-            shutdown_token.child_token(),
+            task_client.with_suffix("websocket_listener"),
         )
         .start(websocket_handler);
     }
 
     /// blocking version of `start_socket` method. Will run forever (or until SIGINT is sent)
     pub async fn run_socket_forever(self) -> Result<(), Box<dyn Error + Send + Sync>> {
-        let mut shutdown = self.start_socket().await?;
+        let shutdown = self.start_socket().await?;
 
-        shutdown.run_until_shutdown().await;
+        let res = shutdown.wait_for_shutdown().await;
         log::info!("Stopping nym-client");
-        Ok(())
+        res
     }
 
     async fn initialise_storage(&self) -> Result<OnDiskPersistent, ClientError> {
@@ -123,7 +119,6 @@ impl SocketClient {
 
         let mut base_client =
             BaseClientBuilder::new(self.config().base(), storage, dkg_query_client)
-                .with_shutdown(self.shutdown_manager.shutdown_tracker_owned())
                 .with_user_agent(user_agent);
 
         if let Some(custom_mixnet) = &self.custom_mixnet {
@@ -133,7 +128,7 @@ impl SocketClient {
         Ok(base_client)
     }
 
-    pub async fn start_socket(self) -> Result<ShutdownManager, ClientError> {
+    pub async fn start_socket(self) -> Result<TaskHandle, ClientError> {
         if !self.config.socket.socket_type.is_websocket() {
             return Err(ClientError::InvalidSocketMode);
         }
@@ -152,13 +147,13 @@ impl SocketClient {
             client_output,
             client_state,
             &self_address,
-            self.shutdown_manager.child_shutdown_token(),
+            started_client.task_handle.get_handle(),
             packet_type,
         );
 
         info!("Client startup finished!");
         info!("The address of this client is: {self_address}");
 
-        Ok(self.shutdown_manager)
+        Ok(started_client.task_handle)
     }
 }

clients/native/src/websocket/handler.rs

@@ -19,7 +19,7 @@ use nym_sphinx::receiver::ReconstructedMessage;
 use nym_task::connections::{
     ConnectionCommand, ConnectionCommandSender, ConnectionId, LaneQueueLengths, TransmissionLane,
 };
-use nym_task::ShutdownToken;
+use nym_task::TaskClient;
 use std::time::Duration;
 use tokio::net::TcpStream;
 use tokio::time::Instant;
@@ -44,7 +44,7 @@ pub(crate) struct HandlerBuilder {
     lane_queue_lengths: LaneQueueLengths,
     reply_controller_sender: ReplyControllerSender,
     packet_type: Option<PacketType>,
-    shutdown_token: ShutdownToken,
+    task_client: TaskClient,
 }
 
 impl HandlerBuilder {
@@ -57,7 +57,7 @@ impl HandlerBuilder {
         lane_queue_lengths: LaneQueueLengths,
         reply_controller_sender: ReplyControllerSender,
         packet_type: Option<PacketType>,
-        shutdown_token: ShutdownToken,
+        task_client: TaskClient,
     ) -> Self {
         Self {
             msg_input,
@@ -67,13 +67,14 @@ impl HandlerBuilder {
             lane_queue_lengths,
             reply_controller_sender,
             packet_type,
-            shutdown_token,
+            task_client,
         }
     }
 
     // TODO: make sure we only ever have one active handler
     pub fn create_active_handler(&self) -> Handler {
-        let shutdown_token = self.shutdown_token.clone();
+        let mut task_client = self.task_client.fork("active_handler");
+        task_client.disarm();
         Handler {
             msg_input: self.msg_input.clone(),
             client_connection_tx: self.client_connection_tx.clone(),
@@ -84,7 +85,7 @@ impl HandlerBuilder {
             lane_queue_lengths: self.lane_queue_lengths.clone(),
             reply_controller_sender: self.reply_controller_sender.clone(),
             packet_type: self.packet_type,
-            shutdown_token,
+            task_client,
         }
     }
 }
@@ -99,14 +100,19 @@ pub(crate) struct Handler {
     lane_queue_lengths: LaneQueueLengths,
     reply_controller_sender: ReplyControllerSender,
     packet_type: Option<PacketType>,
-    shutdown_token: ShutdownToken,
+    task_client: TaskClient,
 }
 
 impl Drop for Handler {
     fn drop(&mut self) {
-        let _ = self
+        if let Err(err) = self
             .buffer_requester
-            .unbounded_send(ReceivedBufferMessage::ReceiverDisconnect);
+            .unbounded_send(ReceivedBufferMessage::ReceiverDisconnect)
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("failed to disconnect the receiver from the buffer: {err}");
+            }
+        }
     }
 }
 
@@ -136,7 +142,7 @@ impl Handler {
         {
             Ok(length) => length,
             Err(err) => {
-                if !self.shutdown_token.is_cancelled() {
+                if !self.task_client.is_shutdown_poll() {
                     error!(
                         "Failed to get reply queue length for connection {connection_id}: {err}"
                     );
@@ -186,7 +192,7 @@ impl Handler {
         // the ack control is now responsible for chunking, etc.
         let input_msg = InputMessage::new_regular(recipient, message, lane, self.packet_type);
         if let Err(err) = self.msg_input.send(input_msg).await {
-            if !self.shutdown_token.is_cancelled() {
+            if !self.task_client.is_shutdown_poll() {
                 error!("Failed to send message to the input buffer: {err}");
             }
         }
@@ -219,7 +225,7 @@ impl Handler {
         let input_msg =
             InputMessage::new_anonymous(recipient, message, reply_surbs, lane, self.packet_type);
         if let Err(err) = self.msg_input.send(input_msg).await {
-            if !self.shutdown_token.is_cancelled() {
+            if !self.task_client.is_shutdown_poll() {
                 error!("Failed to send anonymous message to the input buffer: {err}");
             }
         }
@@ -247,7 +253,7 @@ impl Handler {
 
         let input_msg = InputMessage::new_reply(recipient_tag, message, lane, self.packet_type);
         if let Err(err) = self.msg_input.send(input_msg).await {
-            if !self.shutdown_token.is_cancelled() {
+            if !self.task_client.is_shutdown_poll() {
                 error!("Failed to send reply message to the input buffer: {err}");
             }
         }
@@ -269,7 +275,7 @@ impl Handler {
             .client_connection_tx
             .unbounded_send(ConnectionCommand::Close(connection_id))
         {
-            if !self.shutdown_token.is_cancelled() {
+            if !self.task_client.is_shutdown_poll() {
                 error!("Failed to send close connection command: {err}");
             }
         }
@@ -388,14 +394,11 @@ impl Handler {
     }
 
     async fn listen_for_requests(&mut self, mut msg_receiver: ReconstructedMessagesReceiver) {
-        let shutdown_token = self.shutdown_token.clone();
+        let mut task_client = self.task_client.fork("select");
+        task_client.disarm();
 
-        loop {
+        while !task_client.is_shutdown() {
             tokio::select! {
-                  _ = shutdown_token.cancelled() => {
-                    log::trace!("Websocket handler: Received shutdown");
-                    break;
-                }
                 // we can either get a client request from the websocket
                 socket_msg = self.next_websocket_request() => {
                     if socket_msg.is_none() {
@@ -433,6 +436,9 @@ impl Handler {
                         break;
                     }
                 }
+                _ = task_client.recv() => {
+                    log::trace!("Websocket handler: Received shutdown");
+                }
             }
         }
         log::debug!("Websocket handler: Exiting");
@@ -458,7 +464,7 @@ impl Handler {
                     reconstructed_sender,
                 ))
         {
-            if !self.shutdown_token.is_cancelled() {
+            if !self.task_client.is_shutdown_poll() {
                 error!("failed to announce the receiver to the buffer: {err}");
             }
         }

clients/native/src/websocket/listener.rs

@@ -3,7 +3,7 @@
 
 use super::handler::HandlerBuilder;
 use log::*;
-use nym_task::ShutdownToken;
+use nym_task::TaskClient;
 use std::net::IpAddr;
 use std::{net::SocketAddr, process, sync::Arc};
 use tokio::io::AsyncWriteExt;
@@ -23,15 +23,15 @@ impl State {
 pub(crate) struct Listener {
     address: SocketAddr,
     state: State,
-    shutdown_token: ShutdownToken,
+    task_client: TaskClient,
 }
 
 impl Listener {
-    pub(crate) fn new(host: IpAddr, port: u16, shutdown_token: ShutdownToken) -> Self {
+    pub(crate) fn new(host: IpAddr, port: u16, task_client: TaskClient) -> Self {
         Listener {
             address: SocketAddr::new(host, port),
             state: State::AwaitingConnection,
-            shutdown_token,
+            task_client,
         }
     }
 
@@ -46,11 +46,11 @@ impl Listener {
 
         let notify = Arc::new(Notify::new());
 
-        while !self.shutdown_token.is_cancelled() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 // When the handler finishes we check if shutdown is signalled
                 _ = notify.notified() => {
-                    if self.shutdown_token.is_cancelled() {
+                    if self.task_client.is_shutdown() {
                         log::trace!("Websocket listener: detected shutdown after connection closed");
                         break;
                     }
@@ -59,7 +59,7 @@ impl Listener {
                 }
                 // ... but when there is no connected client at the time of shutdown being
                 // signalled, we handle it here.
-                _ = self.shutdown_token.cancelled() => {
+                _ = self.task_client.recv() => {
                     if !self.state.is_connected() {
                         log::trace!("Not connected: shutting down");
                         break;

clients/socks5/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.67"
+version = "1.1.61"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.70"
 license.workspace = true
 
 [dependencies]

common/async-file-watcher/src/lib.rs

@@ -1,8 +1,8 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use futures::StreamExt;
 use futures::channel::mpsc;
+use futures::StreamExt;
 use notify::event::{DataChange, MetadataKind, ModifyKind};
 use notify::{Config, Event, EventKind, RecommendedWatcher, RecursiveMode, Watcher};
 use std::collections::HashMap;
@@ -96,10 +96,10 @@ impl AsyncFileWatcher {
         // when testing I was consistently getting two `Modify(Data(Any))` events in quick succession
         // (probably to modify content and metadata).
         // we really only want to propagate one of them
-        if let Some(previous) = self.last_received.get(&event.kind)
-            && now.duration_since(*previous) < self.tick_duration
-        {
-            return false;
+        if let Some(previous) = self.last_received.get(&event.kind) {
+            if now.duration_since(*previous) < self.tick_duration {
+                return false;
+            }
         }
 
         let Some(filters) = &self.filters else {

common/authenticator-requests/Cargo.toml

@@ -13,10 +13,7 @@ base64 = { workspace = true }
 bincode = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
-semver = { workspace = true }
-strum_macros = { workspace = true }
 thiserror = { workspace = true }
-tracing = { workspace = true }
 
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
@@ -30,13 +27,7 @@ hmac = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 x25519-dalek = { workspace = true, features = ["static_secrets"] }
 
-[dev-dependencies]
-nym-test-utils = { path = "../test-utils" }
-
 [features]
 default = ["verify"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
 verify = ["hmac", "sha2"]
-
-[lints]
-workspace = true

common/authenticator-requests/src/client_message.rs

@@ -1,372 +0,0 @@
-// Copyright 2025 Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
-use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::PeerPublicKey;
-
-use crate::{
-    AuthenticatorVersion, Error,
-    traits::{
-        FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-        Versionable,
-    },
-    v2, v3, v4, v5, v6,
-};
-
-// This is very redundant with AuthenticatorRequest and I reckon they could be smooshed.
-// It is a bit out of scope for me at the moment though
-#[derive(Debug)]
-pub enum ClientMessage {
-    Initial(Box<dyn InitMessage + Send + Sync + 'static>),
-    Final(Box<dyn FinalMessage + Send + Sync + 'static>),
-    Query(Box<dyn QueryBandwidthMessage + Send + Sync + 'static>),
-    TopUp(Box<dyn TopUpMessage + Send + Sync + 'static>),
-    UpgradeModeCheck(Box<dyn UpgradeModeMessage + Send + Sync + 'static>),
-}
-
-pub struct SerialisedRequest {
-    pub bytes: Vec<u8>,
-    pub request_id: u64,
-}
-
-impl SerialisedRequest {
-    pub fn new(bytes: Vec<u8>, request_id: u64) -> Self {
-        Self { bytes, request_id }
-    }
-}
-
-impl ClientMessage {
-    fn serialise_v1(&self) -> Result<SerialisedRequest, Error> {
-        Err(Error::UnsupportedVersion)
-    }
-
-    fn serialise_v2(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v2::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v3(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v3::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v4(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v4::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ips: IpPair {
-                                ipv4: final_message
-                                    .gateway_client_ipv4()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                                ipv6: final_message
-                                    .gateway_client_ipv6()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                            },
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v5(&self) -> Result<SerialisedRequest, Error> {
-        use v5::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message
-                        .credential()
-                        .and_then(|c| c.credential.into_zk_nym())
-                        .map(|c| *c),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v6(&self) -> Result<SerialisedRequest, Error> {
-        use v6::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-            upgrade_mode_check::UpgradeModeCheckRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::UpgradeModeCheck(upgrade_mode_check) => {
-                // currently JWT is the only emergency credential option
-                let Some(upgrade_mode_jwt) =
-                    upgrade_mode_check.upgrade_mode_global_attestation_jwt()
-                else {
-                    return Err(Error::conversion(
-                        "no valid known upgrade mode check variants",
-                    ));
-                };
-                let msg = UpgradeModeCheckRequest::UpgradeModeJwt {
-                    token: upgrade_mode_jwt,
-                };
-
-                let (req, id) = AuthenticatorRequest::new_upgrade_mode_check_request(msg);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-        }
-    }
-}
-
-impl ClientMessage {
-    // check if message is wasteful e.g. contains a credential
-    pub fn is_wasteful(&self) -> bool {
-        match self {
-            Self::Final(msg) => msg.credential().is_some(),
-            Self::TopUp(_) => true,
-            Self::Initial(_) | Self::Query(_) | Self::UpgradeModeCheck(_) => false,
-        }
-    }
-
-    fn version(&self) -> AuthenticatorVersion {
-        match self {
-            ClientMessage::Initial(msg) => msg.version(),
-            ClientMessage::Final(msg) => msg.version(),
-            ClientMessage::Query(msg) => msg.version(),
-            ClientMessage::TopUp(msg) => msg.version(),
-            ClientMessage::UpgradeModeCheck(msg) => msg.version(),
-        }
-    }
-
-    pub fn bytes(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        match self.version() {
-            AuthenticatorVersion::V1 => self.serialise_v1(),
-            AuthenticatorVersion::V2 => self.serialise_v2(reply_to),
-            AuthenticatorVersion::V3 => self.serialise_v3(reply_to),
-            AuthenticatorVersion::V4 => self.serialise_v4(reply_to),
-            AuthenticatorVersion::V5 => self.serialise_v5(),
-            AuthenticatorVersion::V6 => self.serialise_v6(),
-            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
-        }
-    }
-
-    pub fn use_surbs(&self) -> bool {
-        use AuthenticatorVersion::*;
-        match self.version() {
-            V1 | V2 | V3 | V4 => false,
-            V5 | V6 => true,
-            UNKNOWN => true,
-        }
-    }
-}
-
-// Same comment as above struct
-#[derive(Debug)]
-pub struct QueryMessageImpl {
-    pub pub_key: PeerPublicKey,
-    pub version: AuthenticatorVersion,
-}
-
-impl Versionable for QueryMessageImpl {
-    fn version(&self) -> AuthenticatorVersion {
-        self.version
-    }
-}
-
-impl QueryBandwidthMessage for QueryMessageImpl {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}

common/authenticator-requests/src/error.rs

@@ -1,7 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use std::fmt::Display;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -24,27 +23,6 @@ pub enum Error {
     #[error("conversion: {0}")]
     Conversion(String),
 
-    // TODO add version number for debugging
-    #[error("unknown version number")]
-    UnknownVersion,
-
-    // TODO add version number for debugging
-    #[error("unsupported request version")]
-    UnsupportedVersion,
-
-    #[error("gateway doesn't support this type of message")]
-    UnsupportedMessage,
-
-    #[error(transparent)]
-    Bincode(#[from] bincode::Error),
-}
-
-impl Error {
-    pub fn conversion(msg: impl Into<String>) -> Self {
-        Error::Conversion(msg.into())
-    }
-
-    pub fn conversion_display(msg: impl Display) -> Self {
-        Error::Conversion(msg.to_string())
-    }
+    #[error("failed to serialize response packet: {source}")]
+    FailedToSerializeResponsePacket { source: Box<bincode::ErrorKind> },
 }

common/authenticator-requests/src/lib.rs

@@ -1,27 +1,20 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-pub mod client_message;
-pub mod models;
-pub mod request;
-pub mod response;
 pub mod traits;
 pub mod v1;
 pub mod v2;
 pub mod v3;
 pub mod v4;
 pub mod v5;
-pub mod v6;
 
 mod error;
 mod util;
-mod version;
 
 pub use error::Error;
-pub use v6 as latest;
-pub use version::AuthenticatorVersion;
+pub use v5 as latest;
 
-pub const CURRENT_VERSION: u8 = latest::VERSION;
+pub const CURRENT_VERSION: u8 = 5;
 
 fn make_bincode_serializer() -> impl bincode::Options {
     use bincode::Options;

common/authenticator-requests/src/models.rs

@@ -1,58 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::{
-    BandwidthCredential, CredentialSpendingData, TicketType, UnknownTicketType,
-};
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq)]
-pub enum CurrentUpgradeModeStatus {
-    Enabled,
-    Disabled,
-    // everything pre-v6
-    Unknown,
-}
-
-impl CurrentUpgradeModeStatus {
-    pub fn is_enabled(&self) -> bool {
-        matches!(self, CurrentUpgradeModeStatus::Enabled)
-    }
-}
-
-impl From<bool> for CurrentUpgradeModeStatus {
-    fn from(value: bool) -> Self {
-        if value {
-            CurrentUpgradeModeStatus::Enabled
-        } else {
-            CurrentUpgradeModeStatus::Disabled
-        }
-    }
-}
-
-impl From<CurrentUpgradeModeStatus> for Option<bool> {
-    fn from(value: CurrentUpgradeModeStatus) -> Self {
-        match value {
-            CurrentUpgradeModeStatus::Enabled => Some(true),
-            CurrentUpgradeModeStatus::Disabled => Some(false),
-            CurrentUpgradeModeStatus::Unknown => None,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct BandwidthClaim {
-    pub credential: BandwidthCredential,
-    pub kind: TicketType,
-}
-
-impl TryFrom<CredentialSpendingData> for BandwidthClaim {
-    type Error = UnknownTicketType;
-
-    fn try_from(credential: CredentialSpendingData) -> Result<Self, Self::Error> {
-        Ok(BandwidthClaim {
-            kind: TicketType::try_from_encoded(credential.payment.t_type)?,
-            credential: BandwidthCredential::from(credential),
-        })
-    }
-}

common/authenticator-requests/src/request.rs

@@ -1,253 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-use nym_sphinx::addressing::Recipient;
-
-use crate::traits::{
-    FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-};
-use crate::{v1, v2, v3, v4, v5, v6};
-
-#[derive(Debug)]
-pub enum AuthenticatorRequest {
-    Initial {
-        msg: Box<dyn InitMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    Final {
-        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    QueryBandwidth {
-        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    TopUpBandwidth {
-        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        reply_to: Option<Recipient>,
-        request_id: u64,
-    },
-    CheckUpgradeMode {
-        msg: Box<dyn UpgradeModeMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        request_id: u64,
-    },
-}
-
-impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v1::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v1::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: Protocol {
-                    version: value.version,
-                    service_provider_type: ServiceProviderType::Authenticator,
-                },
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
-                msg: Box::new(gateway_client),
-                protocol: Protocol {
-                    version: value.version,
-                    service_provider_type: ServiceProviderType::Authenticator,
-                },
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: Protocol {
-                        version: value.version,
-                        service_provider_type: ServiceProviderType::Authenticator,
-                    },
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v2::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v3::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-            v3::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v4::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
-                request_id: value.request_id,
-            },
-            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v5::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v5::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v6::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v6::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v6::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::CheckUpgradeMode(upgrade_mode_check_msg) => {
-                Self::CheckUpgradeMode {
-                    msg: Box::new(upgrade_mode_check_msg),
-                    protocol: value.protocol,
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}

common/authenticator-requests/src/response.rs

@@ -1,153 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::models::CurrentUpgradeModeStatus;
-use crate::traits::{
-    Id, PendingRegistrationResponse, RegisteredResponse, RemainingBandwidthResponse,
-    TopUpBandwidthResponse, UpgradeModeStatus,
-};
-use crate::{v2, v3, v4, v5, v6};
-
-#[derive(Debug)]
-pub enum AuthenticatorResponse {
-    PendingRegistration(Box<dyn PendingRegistrationResponse + Send + Sync + 'static>),
-    Registered(Box<dyn RegisteredResponse + Send + Sync + 'static>),
-    RemainingBandwidth(Box<dyn RemainingBandwidthResponse + Send + Sync + 'static>),
-    TopUpBandwidth(Box<dyn TopUpBandwidthResponse + Send + Sync + 'static>),
-    UpgradeMode(Box<dyn UpgradeModeStatus + Send + Sync + 'static>),
-}
-
-impl UpgradeModeStatus for AuthenticatorResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        match self {
-            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
-                pending_registration_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::Registered(registered_response) => {
-                registered_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::RemainingBandwidth(remaining_bandwidth_response) => {
-                remaining_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
-                top_up_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => {
-                upgrade_mode_response.upgrade_mode_status()
-            }
-        }
-    }
-}
-
-impl Id for AuthenticatorResponse {
-    fn id(&self) -> u64 {
-        match self {
-            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
-                pending_registration_response.id()
-            }
-            AuthenticatorResponse::Registered(registered_response) => registered_response.id(),
-            AuthenticatorResponse::RemainingBandwidth(remaining_bandwidth_response) => {
-                remaining_bandwidth_response.id()
-            }
-            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
-                top_up_bandwidth_response.id()
-            }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => upgrade_mode_response.id(),
-        }
-    }
-}
-
-impl From<v2::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v2::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v2::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v2::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-        }
-    }
-}
-
-impl From<v3::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v3::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v3::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v3::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v3::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v3::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
-
-impl From<v4::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v4::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v4::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v4::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v4::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v4::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
-
-impl From<v5::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v5::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v5::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v5::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-        }
-    }
-}
-
-impl From<v6::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v6::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v6::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v6::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v6::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-            v6::response::AuthenticatorResponseData::UpgradeMode(upgrade_mode_check_response) => {
-                Self::UpgradeMode(Box::new(upgrade_mode_check_response))
-            }
-        }
-    }
-}

common/authenticator-requests/src/v1/registration.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -48,7 +48,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v1/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
 
@@ -34,7 +34,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -108,7 +108,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

common/authenticator-requests/src/v2/conversion.rs

@@ -154,8 +154,8 @@ impl From<v2::registration::RegistrationData> for v1::registration::Registration
     }
 }
 
-impl From<v2::registration::RegisteredData> for v1::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,

common/authenticator-requests/src/v2/registration.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
@@ -58,7 +58,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v2/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -118,7 +118,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v3/conversion.rs

@@ -299,8 +299,8 @@ impl From<v2::registration::RegistrationData> for v3::registration::Registration
     }
 }
 
-impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData {
-    fn from(value: v3::registration::RegisteredData) -> Self {
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,
@@ -309,8 +309,8 @@ impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData
     }
 }
 
-impl From<v2::registration::RegisteredData> for v3::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ip,
@@ -674,7 +674,7 @@ mod tests {
         let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
         let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
         let wg_port = 51822;
-        let registred_data = v2::registration::RegisteredData {
+        let registred_data = v2::registration::RegistredData {
             pub_key,
             private_ip,
             wg_port,
@@ -701,7 +701,7 @@ mod tests {
             v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v3::registration::RegisteredData {
+                reply: v3::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip
@@ -715,7 +715,7 @@ mod tests {
         let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
         let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
         let wg_port = 51822;
-        let registred_data = v3::registration::RegisteredData {
+        let registred_data = v3::registration::RegistredData {
             pub_key,
             private_ip,
             wg_port,
@@ -742,7 +742,7 @@ mod tests {
             v2::response::AuthenticatorResponseData::Registered(v2::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v2::registration::RegisteredData {
+                reply: v2::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip

common/authenticator-requests/src/v3/registration.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
@@ -58,7 +58,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ip: IpAddr,
     pub wg_port: u16,

common/authenticator-requests/src/v3/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -139,7 +139,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v4/conversion.rs

@@ -262,8 +262,8 @@ impl From<v4::response::TopUpBandwidthResponse> for v3::response::TopUpBandwidth
     }
 }
 
-impl From<v3::registration::RegisteredData> for v4::registration::RegisteredData {
-    fn from(value: v3::registration::RegisteredData) -> Self {
+impl From<v3::registration::RegistredData> for v4::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ips: value.private_ip.into(),
@@ -272,8 +272,8 @@ impl From<v3::registration::RegisteredData> for v4::registration::RegisteredData
     }
 }
 
-impl From<v4::registration::RegisteredData> for v3::registration::RegisteredData {
-    fn from(value: v4::registration::RegisteredData) -> Self {
+impl From<v4::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ip: value.private_ips.ipv4.into(),
@@ -565,7 +565,7 @@ mod tests {
         let private_ips =
             v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::a0a").unwrap());
         let wg_port = 51822;
-        let registred_data = v3::registration::RegisteredData {
+        let registred_data = v3::registration::RegistredData {
             pub_key,
             private_ip: ipv4.into(),
             wg_port,
@@ -592,7 +592,7 @@ mod tests {
             v4::response::AuthenticatorResponseData::Registered(v4::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v4::registration::RegisteredData {
+                reply: v4::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ips
@@ -608,7 +608,7 @@ mod tests {
         let private_ips =
             v4::registration::IpPair::new(ipv4, Ipv6Addr::from_str("fc01::10").unwrap());
         let wg_port = 51822;
-        let registred_data = v4::registration::RegisteredData {
+        let registred_data = v4::registration::RegistredData {
             pub_key,
             private_ips,
             wg_port,
@@ -635,7 +635,7 @@ mod tests {
             v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
                 request_id,
                 reply_to,
-                reply: v3::registration::RegisteredData {
+                reply: v3::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ip: ipv4.into()

common/authenticator-requests/src/v4/registration.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
@@ -110,7 +110,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ips: IpPair,
     pub wg_port: u16,

common/authenticator-requests/src/v4/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
     }
 
     pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
         reply_to: Recipient,
         request_id: u64,
     ) -> Self {
@@ -139,7 +139,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
     pub request_id: u64,
     pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v5/conversion.rs

@@ -186,8 +186,8 @@ impl From<v4::response::TopUpBandwidthResponse> for v5::response::TopUpBandwidth
     }
 }
 
-impl From<v4::registration::RegisteredData> for v5::registration::RegisteredData {
-    fn from(value: v4::registration::RegisteredData) -> Self {
+impl From<v4::registration::RegistredData> for v5::registration::RegistredData {
+    fn from(value: v4::registration::RegistredData) -> Self {
         Self {
             pub_key: value.pub_key,
             private_ips: value.private_ips.into(),
@@ -405,7 +405,7 @@ mod tests {
         let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
         let private_ips = v4::registration::IpPair::new(ipv4, ipv6);
         let wg_port = 51822;
-        let registred_data = v4::registration::RegisteredData {
+        let registred_data = v4::registration::RegistredData {
             pub_key,
             private_ips,
             wg_port,
@@ -431,7 +431,7 @@ mod tests {
             upgraded_msg.data,
             v5::response::AuthenticatorResponseData::Registered(v5::response::RegisteredResponse {
                 request_id,
-                reply: v5::registration::RegisteredData {
+                reply: v5::registration::RegistredData {
                     wg_port,
                     pub_key,
                     private_ips: v5::registration::IpPair::new(ipv4, ipv6)

common/authenticator-requests/src/v5/registration.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use base64::{Engine, engine::general_purpose};
+use base64::{engine::general_purpose, Engine};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
@@ -108,7 +108,7 @@ pub struct RegistrationData {
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
     pub pub_key: PeerPublicKey,
     pub private_ips: IpPair,
     pub wg_port: u16,

common/authenticator-requests/src/v5/response.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use serde::{Deserialize, Serialize};
 
@@ -32,7 +32,7 @@ impl AuthenticatorResponse {
         }
     }
 
-    pub fn new_registered(registred_data: RegisteredData, request_id: u64) -> Self {
+    pub fn new_registered(registred_data: RegistredData, request_id: u64) -> Self {
         Self {
             protocol: Protocol {
                 service_provider_type: ServiceProviderType::Authenticator,
@@ -116,7 +116,7 @@ pub struct PendingRegistrationResponse {
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct RegisteredResponse {
     pub request_id: u64,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]

common/authenticator-requests/src/v6/conversion.rs

@@ -1,441 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::{v5, v6};
-
-impl TryFrom<v5::request::AuthenticatorRequest> for v6::request::AuthenticatorRequest {
-    type Error = crate::Error;
-
-    fn try_from(
-        authenticator_request: v5::request::AuthenticatorRequest,
-    ) -> Result<Self, Self::Error> {
-        Ok(Self {
-            protocol: v6::PROTOCOL,
-            data: authenticator_request.data.try_into()?,
-            request_id: authenticator_request.request_id,
-        })
-    }
-}
-
-impl TryFrom<v5::request::AuthenticatorRequestData> for v6::request::AuthenticatorRequestData {
-    type Error = crate::Error;
-
-    fn try_from(
-        authenticator_request_data: v5::request::AuthenticatorRequestData,
-    ) -> Result<Self, Self::Error> {
-        match authenticator_request_data {
-            v5::request::AuthenticatorRequestData::Initial(init_msg) => Ok(
-                v6::request::AuthenticatorRequestData::Initial(init_msg.into()),
-            ),
-            v5::request::AuthenticatorRequestData::Final(final_msg) => Ok(
-                v6::request::AuthenticatorRequestData::Final(Box::new((*final_msg).try_into()?)),
-            ),
-            v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => Ok(
-                v6::request::AuthenticatorRequestData::QueryBandwidth(pub_key),
-            ),
-            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => Ok(
-                v6::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into()),
-            ),
-        }
-    }
-}
-
-impl From<v5::registration::InitMessage> for v6::registration::InitMessage {
-    fn from(init_msg: v5::registration::InitMessage) -> Self {
-        Self {
-            pub_key: init_msg.pub_key,
-        }
-    }
-}
-
-impl TryFrom<v5::registration::FinalMessage> for v6::registration::FinalMessage {
-    type Error = crate::Error;
-
-    fn try_from(final_msg: v5::registration::FinalMessage) -> Result<Self, Self::Error> {
-        Ok(Self {
-            gateway_client: final_msg.gateway_client.into(),
-            credential: final_msg
-                .credential
-                .map(TryInto::try_into)
-                .transpose()
-                .map_err(Self::Error::conversion_display)?,
-        })
-    }
-}
-
-impl From<v5::registration::GatewayClient> for v6::registration::GatewayClient {
-    fn from(gateway_client: v5::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v6::registration::GatewayClient> for v5::registration::GatewayClient {
-    fn from(gateway_client: v6::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v5::registration::ClientMac> for v6::registration::ClientMac {
-    fn from(client_mac: v5::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<v6::registration::ClientMac> for v5::registration::ClientMac {
-    fn from(client_mac: v6::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<Box<v5::topup::TopUpMessage>> for Box<v6::topup::TopUpMessage> {
-    fn from(top_up_message: Box<v5::topup::TopUpMessage>) -> Self {
-        Box::new(v6::topup::TopUpMessage {
-            pub_key: top_up_message.pub_key,
-            credential: top_up_message.credential,
-        })
-    }
-}
-
-impl From<v5::response::AuthenticatorResponse> for v6::response::AuthenticatorResponse {
-    fn from(value: v5::response::AuthenticatorResponse) -> Self {
-        Self {
-            protocol: v6::PROTOCOL,
-            data: value.data.into(),
-        }
-    }
-}
-
-impl From<v5::response::AuthenticatorResponseData> for v6::response::AuthenticatorResponseData {
-    fn from(authenticator_response_data: v5::response::AuthenticatorResponseData) -> Self {
-        match authenticator_response_data {
-            v5::response::AuthenticatorResponseData::PendingRegistration(pending_response) => {
-                v6::response::AuthenticatorResponseData::PendingRegistration(
-                    pending_response.into(),
-                )
-            }
-            v5::response::AuthenticatorResponseData::Registered(registered_response) => {
-                v6::response::AuthenticatorResponseData::Registered(registered_response.into())
-            }
-            v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response.into(),
-            ),
-            v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response) => {
-                v6::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response.into())
-            }
-        }
-    }
-}
-
-impl From<v5::response::RegisteredResponse> for v6::response::RegisteredResponse {
-    fn from(value: v5::response::RegisteredResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::response::PendingRegistrationResponse> for v6::response::PendingRegistrationResponse {
-    fn from(value: v5::response::PendingRegistrationResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::registration::RegistrationData> for v6::registration::RegistrationData {
-    fn from(value: v5::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v6::registration::RegistrationData> for v5::registration::RegistrationData {
-    fn from(value: v6::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v5::response::RemainingBandwidthResponse> for v6::response::RemainingBandwidthResponse {
-    fn from(value: v5::response::RemainingBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.map(Into::into),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::response::TopUpBandwidthResponse> for v6::response::TopUpBandwidthResponse {
-    fn from(value: v5::response::TopUpBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-            upgrade_mode_enabled: false,
-        }
-    }
-}
-
-impl From<v5::registration::RegisteredData> for v6::registration::RegisteredData {
-    fn from(value: v5::registration::RegisteredData) -> Self {
-        Self {
-            pub_key: value.pub_key,
-            private_ips: value.private_ips.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v5::registration::RemainingBandwidthData> for v6::registration::RemainingBandwidthData {
-    fn from(value: v5::registration::RemainingBandwidthData) -> Self {
-        Self {
-            available_bandwidth: value.available_bandwidth,
-        }
-    }
-}
-
-impl From<v5::registration::IpPair> for v6::registration::IpPair {
-    fn from(value: v5::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-impl From<v6::registration::IpPair> for v5::registration::IpPair {
-    fn from(value: v6::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        net::{Ipv4Addr, Ipv6Addr},
-        str::FromStr,
-    };
-
-    use nym_credentials_interface::{BandwidthCredential, CredentialSpendingData, TicketType};
-    use nym_crypto::asymmetric::x25519::PrivateKey;
-    use nym_wireguard_types::PeerPublicKey;
-    use x25519_dalek::PublicKey;
-
-    use super::*;
-    use crate::models::BandwidthClaim;
-    use crate::{util::tests::CREDENTIAL_BYTES, v5};
-
-    #[test]
-    fn upgrade_initial_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_initial_request(
-            v5::registration::InitMessage::new(pub_key),
-        );
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::Initial(v6::registration::InitMessage {
-                pub_key
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_final_req() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let gateway_client = v5::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let credential = CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap();
-        let final_message = v5::registration::FinalMessage {
-            gateway_client: gateway_client.clone(),
-            credential: Some(credential.clone()),
-        };
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_final_request(final_message);
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::Final(Box::new(
-                v6::registration::FinalMessage {
-                    gateway_client: v6::registration::GatewayClient::new(
-                        &local_secret,
-                        (&remote_secret).into(),
-                        v6::registration::IpPair::new(ipv4, ipv6),
-                        nonce
-                    ),
-                    credential: Some(BandwidthClaim {
-                        credential: BandwidthCredential::ZkNym(Box::new(credential)),
-                        kind: TicketType::V1MixnetEntry,
-                    })
-                }
-            ))
-        );
-    }
-
-    #[test]
-    fn upgrade_query_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-
-        let (msg, _) = v5::request::AuthenticatorRequest::new_query_request(pub_key);
-        let upgraded_msg = v6::request::AuthenticatorRequest::try_from(msg).unwrap();
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
-        );
-    }
-
-    #[test]
-    fn upgrade_pending_reg_resp() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let wg_port = 51822;
-        let gateway_data = v5::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let registration_data = v5::registration::RegistrationData {
-            nonce,
-            gateway_data,
-            wg_port,
-        };
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_pending_registration_success(
-            registration_data,
-            request_id,
-        );
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::PendingRegistration(
-                v6::response::PendingRegistrationResponse {
-                    request_id,
-                    reply: v6::registration::RegistrationData {
-                        nonce,
-                        gateway_data: v6::registration::GatewayClient::new(
-                            &local_secret,
-                            (&remote_secret).into(),
-                            v6::registration::IpPair::new(ipv4, ipv6),
-                            nonce
-                        ),
-                        wg_port
-                    },
-                    upgrade_mode_enabled: false,
-                }
-            )
-        );
-    }
-
-    #[test]
-    fn upgrade_registered_resp() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-        let ipv4 = Ipv4Addr::from_str("10.1.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let private_ips = v5::registration::IpPair::new(ipv4, ipv6);
-        let wg_port = 51822;
-        let registered_data = v5::registration::RegisteredData {
-            pub_key,
-            private_ips,
-            wg_port,
-        };
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_registered(registered_data, request_id);
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::Registered(v6::response::RegisteredResponse {
-                request_id,
-                reply: v6::registration::RegisteredData {
-                    wg_port,
-                    pub_key,
-                    private_ips: v6::registration::IpPair::new(ipv4, ipv6)
-                },
-                upgrade_mode_enabled: false,
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_remaining_bandwidth_resp() {
-        let available_bandwidth = 42;
-        let remaining_bandwidth_data = Some(v5::registration::RemainingBandwidthData {
-            available_bandwidth,
-        });
-        let request_id = 123;
-
-        let msg = v5::response::AuthenticatorResponse::new_remaining_bandwidth(
-            remaining_bandwidth_data,
-            request_id,
-        );
-        let upgraded_msg = v6::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(upgraded_msg.protocol, v6::PROTOCOL);
-        assert_eq!(
-            upgraded_msg.data,
-            v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                v6::response::RemainingBandwidthResponse {
-                    request_id,
-                    reply: Some(v6::registration::RemainingBandwidthData {
-                        available_bandwidth,
-                    }),
-                    upgrade_mode_enabled: false,
-                }
-            )
-        );
-    }
-}

common/authenticator-requests/src/v6/mod.rs

@@ -1,15 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-
-pub mod conversion;
-pub mod registration;
-pub mod request;
-pub mod response;
-pub mod topup;
-pub mod upgrade_mode_check;
-
-pub const VERSION: u8 = 6;
-
-pub const PROTOCOL: Protocol = Protocol::new(VERSION, ServiceProviderType::Authenticator);

common/authenticator-requests/src/v6/registration.rs

@@ -1,287 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::error::Error;
-use crate::models::BandwidthClaim;
-use base64::{Engine, engine::general_purpose};
-use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-use std::time::SystemTime;
-use std::{fmt, ops::Deref, str::FromStr};
-
-#[cfg(feature = "verify")]
-use hmac::{Hmac, Mac};
-#[cfg(feature = "verify")]
-use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
-#[cfg(feature = "verify")]
-use sha2::Sha256;
-
-pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
-pub type PrivateIPs = HashMap<IpPair, Taken>;
-
-#[cfg(feature = "verify")]
-pub type HmacSha256 = Hmac<Sha256>;
-
-pub type Nonce = u64;
-pub type Taken = Option<SystemTime>;
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct IpPair {
-    pub ipv4: Ipv4Addr,
-    pub ipv6: Ipv6Addr,
-}
-
-impl IpPair {
-    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
-    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl fmt::Display for IpPair {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "({}, {})", self.ipv4, self.ipv6)
-    }
-}
-
-impl From<IpAddr> for IpPair {
-    fn from(value: IpAddr) -> Self {
-        let (before_last_byte, last_byte) = match value {
-            IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
-        };
-        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
-        let ipv4 = Ipv4Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
-            before_last_byte,
-            last_byte,
-        );
-        let ipv6 = Ipv6Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
-            last_bytes,
-        );
-        IpPair::new(ipv4, ipv6)
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct InitMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-}
-
-impl InitMessage {
-    pub fn new(pub_key: PeerPublicKey) -> Self {
-        InitMessage { pub_key }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct FinalMessage {
-    /// Gateway client data
-    pub gateway_client: GatewayClient,
-
-    /// Ecash credential
-    pub credential: Option<BandwidthClaim>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegistrationData {
-    pub nonce: u64,
-    pub gateway_data: GatewayClient,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
-    pub pub_key: PeerPublicKey,
-    pub private_ips: IpPair,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RemainingBandwidthData {
-    pub available_bandwidth: i64,
-}
-
-/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
-/// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct GatewayClient {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Assigned private IPs (v4 and v6)
-    pub private_ips: IpPair,
-
-    /// Sha256 hmac on the data (alongside the prior nonce)
-    pub mac: ClientMac,
-}
-
-impl GatewayClient {
-    #[cfg(feature = "verify")]
-    pub fn new(
-        local_secret: &PrivateKey,
-        remote_public: x25519_dalek::PublicKey,
-        private_ips: IpPair,
-        nonce: u64,
-    ) -> Self {
-        let local_public = PublicKey::from(local_secret);
-        let remote_public = PublicKey::from(remote_public);
-
-        let dh = local_secret.diffie_hellman(&remote_public);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(&dh[..])
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(local_public.as_bytes());
-        mac.update(private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        GatewayClient {
-            pub_key: PeerPublicKey::new(local_public.into()),
-            private_ips,
-            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
-        }
-    }
-
-    // Reusable secret should be gateways Wireguard PK
-    // Client should perform this step when generating its payload, using its own WG PK
-    #[cfg(feature = "verify")]
-    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
-        // use gateways key as a ref to an x25519_dalek key
-        let dh = gateway_key.inner().diffie_hellman(&self.pub_key);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(self.pub_key.as_bytes());
-        mac.update(self.private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        mac.verify_slice(&self.mac)
-            .map_err(|source| Error::FailedClientMacVerification {
-                client: self.pub_key.to_string(),
-                source,
-            })
-    }
-
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
-// TODO: change the inner type into generic array of size HmacSha256::OutputSize
-// TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone, PartialEq)]
-pub struct ClientMac(Vec<u8>);
-
-impl fmt::Display for ClientMac {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
-    }
-}
-
-impl From<Vec<u8>> for ClientMac {
-    fn from(v: Vec<u8>) -> Self {
-        ClientMac(v)
-    }
-}
-
-impl ClientMac {
-    #[allow(dead_code)]
-    pub fn new(mac: Vec<u8>) -> Self {
-        ClientMac(mac)
-    }
-}
-
-impl Deref for ClientMac {
-    type Target = Vec<u8>;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl FromStr for ClientMac {
-    type Err = Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let mac_bytes: Vec<u8> =
-            general_purpose::STANDARD
-                .decode(s)
-                .map_err(|source| Error::MalformedClientMac {
-                    mac: s.to_string(),
-                    source,
-                })?;
-
-        Ok(ClientMac(mac_bytes))
-    }
-}
-
-impl Serialize for ClientMac {
-    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
-        serializer.serialize_str(&encoded_key)
-    }
-}
-
-impl<'de> Deserialize<'de> for ClientMac {
-    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
-        let encoded_key = String::deserialize(deserializer)?;
-        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use nym_crypto::asymmetric::x25519;
-    use nym_test_utils::helpers::deterministic_rng;
-
-    #[test]
-    fn create_ip_pair() {
-        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
-        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
-
-        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
-    }
-
-    #[test]
-    #[cfg(feature = "verify")]
-    fn client_request_roundtrip() {
-        let mut rng = deterministic_rng();
-
-        let gateway_key_pair = x25519::KeyPair::new(&mut rng);
-        let client_key_pair = x25519::KeyPair::new(&mut rng);
-
-        let nonce = 1234567890;
-
-        let client = GatewayClient::new(
-            client_key_pair.private_key(),
-            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
-            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
-            nonce,
-        );
-        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
-    }
-}

common/authenticator-requests/src/v6/request.rs

@@ -1,135 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::{
-    PROTOCOL,
-    registration::{FinalMessage, InitMessage},
-    topup::TopUpMessage,
-    upgrade_mode_check::UpgradeModeCheckRequest,
-};
-use nym_service_provider_requests_common::Protocol;
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorRequest {
-    pub protocol: Protocol,
-    pub data: AuthenticatorRequestData,
-    pub request_id: u64,
-}
-
-impl AuthenticatorRequest {
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn new_initial_request(init_message: InitMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::Initial(init_message),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_final_request(final_message: FinalMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::Final(Box::new(final_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_query_request(peer_public_key: PeerPublicKey) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_topup_request(top_up_message: TopUpMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_upgrade_mode_check_request(message: UpgradeModeCheckRequest) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: PROTOCOL,
-                data: AuthenticatorRequestData::CheckUpgradeMode(message),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorRequestData {
-    Initial(InitMessage),
-    Final(Box<FinalMessage>),
-    QueryBandwidth(PeerPublicKey),
-    TopUpBandwidth(Box<TopUpMessage>),
-    CheckUpgradeMode(UpgradeModeCheckRequest),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::VERSION;
-    use super::*;
-    use nym_service_provider_requests_common::ServiceProviderType;
-    use std::str::FromStr;
-
-    #[test]
-    fn check_first_bytes_protocol() {
-        let version = VERSION;
-        let data = AuthenticatorRequest {
-            protocol: Protocol {
-                version,
-                service_provider_type: ServiceProviderType::Authenticator,
-            },
-            data: AuthenticatorRequestData::Initial(InitMessage::new(
-                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
-            )),
-            request_id: 1,
-        };
-        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
-        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
-    }
-}

common/authenticator-requests/src/v6/response.rs

@@ -1,153 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
-use nym_service_provider_requests_common::Protocol;
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-use super::PROTOCOL;
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorResponse {
-    pub protocol: Protocol,
-    pub data: AuthenticatorResponseData,
-}
-
-impl AuthenticatorResponse {
-    pub fn new_pending_registration_success(
-        registration_data: RegistrationData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
-                reply: registration_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_registered(
-        registered_data: RegisteredData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::Registered(RegisteredResponse {
-                reply: registered_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_remaining_bandwidth(
-        remaining_bandwidth_data: Option<RemainingBandwidthData>,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_topup_bandwidth(
-        remaining_bandwidth_data: RemainingBandwidthData,
-        request_id: u64,
-        upgrade_mode_enabled: bool,
-    ) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn new_upgrade_mode_check(request_id: u64, upgrade_mode_enabled: bool) -> Self {
-        Self {
-            protocol: PROTOCOL,
-            data: AuthenticatorResponseData::UpgradeMode(UpgradeModeResponse {
-                request_id,
-                upgrade_mode_enabled,
-            }),
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
-            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
-            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
-            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
-            AuthenticatorResponseData::UpgradeMode(response) => Some(response.request_id),
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorResponseData {
-    PendingRegistration(PendingRegistrationResponse),
-    Registered(RegisteredResponse),
-    RemainingBandwidth(RemainingBandwidthResponse),
-    TopUpBandwidth(TopUpBandwidthResponse),
-    UpgradeMode(UpgradeModeResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct PendingRegistrationResponse {
-    pub request_id: u64,
-    pub reply: RegistrationData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RegisteredResponse {
-    pub request_id: u64,
-    pub reply: RegisteredData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RemainingBandwidthResponse {
-    pub request_id: u64,
-    pub reply: Option<RemainingBandwidthData>,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct TopUpBandwidthResponse {
-    pub request_id: u64,
-    pub reply: RemainingBandwidthData,
-    pub upgrade_mode_enabled: bool,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct UpgradeModeResponse {
-    pub request_id: u64,
-    pub upgrade_mode_enabled: bool,
-}

common/authenticator-requests/src/v6/topup.rs

@@ -1,15 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::CredentialSpendingData;
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct TopUpMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Ecash credential
-    pub credential: CredentialSpendingData,
-}

common/authenticator-requests/src/v6/upgrade_mode_check.rs

@@ -1,12 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum UpgradeModeCheckRequest {
-    /// Attempt to request upgrade mode recheck via the JWT issued as the result of
-    /// global attestation.json being published
-    UpgradeModeJwt { token: String },
-}

common/authenticator-requests/src/version.rs

@@ -1,211 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::{v1, v2, v3, v4, v5, v6};
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-
-#[derive(Copy, Clone, Debug, PartialEq, strum_macros::Display)]
-#[strum(serialize_all = "snake_case")]
-pub enum AuthenticatorVersion {
-    /// introduced in wispa release (1.1.5)
-    V1,
-
-    /// introduced in aero release (1.1.9)
-    V2,
-
-    /// introduced in magura release (1.1.10)
-    V3,
-
-    /// introduced in crunch release (1.2.0)
-    V4,
-
-    /// introduced in dorina-patched release (1.6.1)
-    V5,
-
-    /// introduced in niolo release (1.23.0)
-    V6,
-
-    /// an unknown, future, variant that can be present if running outdated software
-    UNKNOWN,
-}
-
-impl AuthenticatorVersion {
-    pub const LATEST: Self = Self::V6;
-
-    pub const fn release_version(&self) -> semver::Version {
-        match self {
-            AuthenticatorVersion::V1 => semver::Version::new(1, 1, 5),
-            AuthenticatorVersion::V2 => semver::Version::new(1, 1, 9),
-            AuthenticatorVersion::V3 => semver::Version::new(1, 1, 10),
-            AuthenticatorVersion::V4 => semver::Version::new(1, 2, 0),
-            AuthenticatorVersion::V5 => semver::Version::new(1, 6, 1),
-            AuthenticatorVersion::V6 => semver::Version::new(1, 23, 0),
-            AuthenticatorVersion::UNKNOWN => semver::Version::new(0, 0, 0),
-        }
-    }
-}
-
-impl From<Protocol> for AuthenticatorVersion {
-    fn from(value: Protocol) -> Self {
-        if value.service_provider_type != ServiceProviderType::Authenticator {
-            AuthenticatorVersion::UNKNOWN
-        } else if value.version == v1::VERSION {
-            AuthenticatorVersion::V1
-        } else if value.version == v2::VERSION {
-            AuthenticatorVersion::V2
-        } else if value.version == v3::VERSION {
-            AuthenticatorVersion::V3
-        } else if value.version == v4::VERSION {
-            AuthenticatorVersion::V4
-        } else if value.version == v5::VERSION {
-            AuthenticatorVersion::V5
-        } else if value.version == v6::VERSION {
-            AuthenticatorVersion::V6
-        } else {
-            AuthenticatorVersion::UNKNOWN
-        }
-    }
-}
-
-impl From<u8> for AuthenticatorVersion {
-    fn from(value: u8) -> Self {
-        if value == v1::VERSION {
-            AuthenticatorVersion::V1
-        } else if value == v2::VERSION {
-            AuthenticatorVersion::V2
-        } else if value == v3::VERSION {
-            AuthenticatorVersion::V3
-        } else if value == v4::VERSION {
-            AuthenticatorVersion::V4
-        } else if value == v5::VERSION {
-            AuthenticatorVersion::V5
-        } else if value == v6::VERSION {
-            AuthenticatorVersion::V6
-        } else {
-            AuthenticatorVersion::UNKNOWN
-        }
-    }
-}
-
-impl From<&str> for AuthenticatorVersion {
-    fn from(value: &str) -> Self {
-        let Ok(semver) = semver::Version::parse(value) else {
-            return Self::UNKNOWN;
-        };
-
-        semver.into()
-    }
-}
-
-impl From<Option<&String>> for AuthenticatorVersion {
-    fn from(value: Option<&String>) -> Self {
-        match value {
-            None => Self::UNKNOWN,
-            Some(value) => value.as_str().into(),
-        }
-    }
-}
-
-impl From<String> for AuthenticatorVersion {
-    fn from(value: String) -> Self {
-        Self::from(value.as_str())
-    }
-}
-
-impl From<Option<String>> for AuthenticatorVersion {
-    fn from(value: Option<String>) -> Self {
-        value.as_ref().into()
-    }
-}
-
-impl From<semver::Version> for AuthenticatorVersion {
-    fn from(semver: semver::Version) -> Self {
-        if semver < AuthenticatorVersion::V1.release_version() {
-            return Self::UNKNOWN;
-        }
-        if semver < AuthenticatorVersion::V2.release_version() {
-            return Self::V1;
-        }
-        if semver < AuthenticatorVersion::V3.release_version() {
-            return Self::V2;
-        }
-        if semver < AuthenticatorVersion::V4.release_version() {
-            return Self::V3;
-        }
-        if semver < AuthenticatorVersion::V5.release_version() {
-            return Self::V4;
-        }
-        if semver < AuthenticatorVersion::V6.release_version() {
-            return Self::V5;
-        }
-        // if provided version is higher (or equal) to release version of V6,
-        // we return the latest (i.e. v6)
-
-        debug_assert_eq!(
-            Self::V6,
-            Self::LATEST,
-            "a new AuthenticatorVersion variant has been introduced without adjusting the `From<semver::Version>` trait"
-        );
-        Self::LATEST
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::latest;
-    use super::*;
-
-    #[test]
-    fn strum_display() {
-        // sanity check on formatting and casing
-        assert_eq!("v1", AuthenticatorVersion::V1.to_string());
-        assert_eq!("v2", AuthenticatorVersion::V2.to_string());
-        assert_eq!("unknown", AuthenticatorVersion::UNKNOWN.to_string());
-    }
-
-    #[test]
-    fn u8_conversion() {
-        assert_eq!(AuthenticatorVersion::V1, AuthenticatorVersion::from(1u8));
-        assert_eq!(AuthenticatorVersion::V2, AuthenticatorVersion::from(2u8));
-
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(latest::VERSION + 1)
-        );
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(0u8)
-        );
-        assert_eq!(
-            AuthenticatorVersion::UNKNOWN,
-            AuthenticatorVersion::from(255u8)
-        );
-    }
-
-    #[test]
-    fn semver_checks() {
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "1.1.4".into());
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "0.1.0".into());
-        assert_eq!(AuthenticatorVersion::UNKNOWN, "1.0.4".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.5".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.6".into());
-        assert_eq!(AuthenticatorVersion::V1, "1.1.8".into());
-        assert_eq!(AuthenticatorVersion::V2, "1.1.9".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.10".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.11".into());
-        assert_eq!(AuthenticatorVersion::V3, "1.1.60".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.2.0".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.2.1".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.5.1".into());
-        assert_eq!(AuthenticatorVersion::V4, "1.6.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.6.1".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.6.11".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.7.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.16.11".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.17.0".into());
-        assert_eq!(AuthenticatorVersion::V5, "1.22.0".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.23.0".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.23.1".into());
-        assert_eq!(AuthenticatorVersion::V6, "1.24.0".into());
-    }
-}

common/bandwidth-controller/Cargo.toml

@@ -7,16 +7,20 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-async-trait = { workspace = true }
+bip39 = { workspace = true }
 log = { workspace = true }
 rand = { workspace = true }
 thiserror = { workspace = true }
+url = { workspace = true }
+zeroize = { workspace = true }
 
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
 nym-ecash-time = { path = "../ecash-time" }
+nym-network-defaults = { path = "../network-defaults" }
 nym-task = { path = "../task" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 

common/bandwidth-controller/src/error.rs

@@ -21,9 +21,6 @@ pub enum BandwidthControllerError {
     #[error("There was a credential storage error - {0}")]
     CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
 
-    #[error("retrieved upgrade mode token is not a valid String")]
-    MalformedUpgradeModeToken,
-
     #[error("the credential storage does not contain any usable credentials")]
     NoCredentialsAvailable,
 

common/bandwidth-controller/src/lib.rs

@@ -12,7 +12,7 @@ use crate::utils::{
     ApiClientsWrapper,
 };
 use log::error;
-use nym_credential_storage::models::{EmergencyCredential, RetrievedTicketbook};
+use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
@@ -23,12 +23,10 @@ use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 
 pub use event::BandwidthStatusMessage;
-pub use traits::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND};
 
 pub mod acquire;
 pub mod error;
 mod event;
-mod traits;
 mod utils;
 
 #[derive(Debug)]
@@ -220,19 +218,6 @@ impl<C, St: Storage> BandwidthController<C, St> {
             }
         }
     }
-
-    pub async fn get_emergency_credential(
-        &self,
-        typ: &str,
-    ) -> Result<Option<EmergencyCredential>, BandwidthControllerError>
-    where
-        <St as Storage>::StorageError: Send + Sync + 'static,
-    {
-        self.storage
-            .get_emergency_credential(typ)
-            .await
-            .map_err(BandwidthControllerError::credential_storage_error)
-    }
 }
 
 impl<C, St> Clone for BandwidthController<C, St>

common/bandwidth-controller/src/traits.rs

@@ -1,59 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use async_trait::async_trait;
-use nym_credential_storage::storage::Storage;
-use nym_credentials_interface::TicketType;
-use nym_crypto::asymmetric::ed25519;
-use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
-
-use crate::{error::BandwidthControllerError, BandwidthController, PreparedCredential};
-
-pub const DEFAULT_TICKETS_TO_SPEND: u32 = 1;
-
-// TODO: this does not really belong here
-pub const UPGRADE_MODE_JWT_TYPE: &str = "UPGRADE_MODE_JWT";
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait BandwidthTicketProvider: Send + Sync {
-    async fn get_ecash_ticket(
-        &self,
-        ticket_type: TicketType,
-        gateway_id: ed25519::PublicKey,
-        tickets_to_spend: u32,
-    ) -> Result<PreparedCredential, BandwidthControllerError>;
-
-    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError>;
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl<C, St> BandwidthTicketProvider for BandwidthController<C, St>
-where
-    C: DkgQueryClient + Sync + Send,
-    St: nym_credential_storage::storage::Storage,
-    <St as Storage>::StorageError: Send + Sync + 'static,
-{
-    async fn get_ecash_ticket(
-        &self,
-        ticket_type: TicketType,
-        gateway_id: ed25519::PublicKey,
-        tickets_to_spend: u32,
-    ) -> Result<PreparedCredential, BandwidthControllerError> {
-        self.prepare_ecash_ticket(ticket_type, gateway_id.to_bytes(), tickets_to_spend)
-            .await
-    }
-
-    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError> {
-        let Some(emergency_credential) =
-            self.get_emergency_credential(UPGRADE_MODE_JWT_TYPE).await?
-        else {
-            return Ok(None);
-        };
-        // upgrade mode credential is just a simple stringified JWT
-        let token = String::from_utf8(emergency_credential.data.content)
-            .map_err(|_| BandwidthControllerError::MalformedUpgradeModeToken)?;
-        Ok(Some(token))
-    }
-}

common/bin-common/src/completions/mod.rs

@@ -1,8 +1,8 @@
-use clap::Args;
 use clap::builder::Command;
 use clap::clap_derive::ValueEnum;
-use clap_complete::Shell as ClapShell;
+use clap::Args;
 use clap_complete::generator::generate;
+use clap_complete::Shell as ClapShell;
 use std::io;
 
 pub fn fig_generate(command: &mut Command, name: &str) {

common/client-core/Cargo.toml

@@ -3,7 +3,7 @@ name = "nym-client-core"
 version = "1.1.15"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.85"
+rust-version = "1.76"
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -36,7 +36,7 @@ nym-bandwidth-controller = { path = "../bandwidth-controller" }
 nym-crypto = { path = "../crypto" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../gateway-requests" }
-nym-http-api-client = { path = "../http-api-client", features = ["network-defaults"] }
+nym-http-api-client = { path = "../http-api-client" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-statistics-common = { path = "../statistics" }
@@ -69,6 +69,7 @@ workspace = true
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
 workspace = true
 features = ["tokio"]
+###
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 workspace = true
@@ -102,7 +103,7 @@ workspace = true
 features = ["tokio"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.gloo-timers]
-workspace = true
+version = "0.3.0"
 features = ["futures"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]
@@ -113,10 +114,6 @@ features = ["websocket"]
 workspace = true
 features = ["wasm-bindgen"]
 
-[target."cfg(target_arch = \"wasm32\")".dependencies.tokio_with_wasm]
-workspace = true
-features = ["full"]
-
 [dev-dependencies]
 tempfile = { workspace = true }
 

common/client-core/config-types/src/lib.rs

@@ -707,10 +707,13 @@ pub struct DebugConfig {
 
     /// Defines all configuration options related to reply SURBs.
     pub reply_surbs: ReplySurbs,
+
     /// Defines all configuration options related to stats reporting.
     pub stats_reporting: StatsReporting,
+
     /// Defines all configuration options related to the forget me flag.
     pub forget_me: ForgetMe,
+
     /// Defines all configuration options related to the remember me flag.
     pub remember_me: RememberMe,
 }

common/client-core/config-types/src/old/v6.rs

@@ -543,8 +543,10 @@ pub struct DebugConfigV6 {
 
     /// Defines all configuration options related to reply SURBs.
     pub reply_surbs: ReplySurbsV6,
+
     /// Defines all configuration options related to stats reporting.
     pub stats_reporting: StatsReportingV6,
+
     /// Defines all configuration options related to the forget me flag.
     pub forget_me: ForgetMeV6,
 

common/client-core/gateways-storage/.sqlx/query-06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32.json

@@ -6,14 +6,14 @@
       {
         "name": "exists",
         "ordinal": 0,
-        "type_info": "Integer"
+        "type_info": "Int"
       }
     ],
     "parameters": {
       "Right": 1
     },
     "nullable": [
-      false
+      null
     ]
   },
   "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"

common/client-core/gateways-storage/.sqlx/query-0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985.json

@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}

common/client-core/gateways-storage/.sqlx/query-0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}

common/client-core/gateways-storage/.sqlx/query-4b739e12ea8d917cb17580337caeabb05f0e3ddbec04fdfa111d0fc86ba75505.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT\n                rgd.gateway_id_bs58,\n                derived_aes256_gcm_siv_key,\n                gateway_listener,\n                fallback_listener\n            FROM\n                remote_gateway_details AS rgd\n            INNER JOIN\n                remote_gateway_shared_keys AS rgsk\n            ON\n                rgd.gateway_id_bs58 = rgsk.gateway_id_bs58\n            WHERE\n                rgd.gateway_id_bs58 = ?",
-  "describe": {
-    "columns": [
-      {
-        "name": "gateway_id_bs58",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "derived_aes256_gcm_siv_key",
-        "ordinal": 1,
-        "type_info": "Blob"
-      },
-      {
-        "name": "gateway_listener",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "fallback_listener",
-        "ordinal": 3,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "4b739e12ea8d917cb17580337caeabb05f0e3ddbec04fdfa111d0fc86ba75505"
-}

common/client-core/gateways-storage/.sqlx/query-700a75acbcd90c74baa7823c40739a8ff8a26400c1d2bd45a689970bf1ba0e66.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_shared_keys(gateway_id_bs58, derived_aes256_gcm_siv_key)\n                VALUES (?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "700a75acbcd90c74baa7823c40739a8ff8a26400c1d2bd45a689970bf1ba0e66"
-}

common/client-core/gateways-storage/.sqlx/query-8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e.json

@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type)\n                VALUES (?, ?, ?)\n            ",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "727598e516090da6d26e36d09062b60ccb76d6468f359891428c0bfb96ddd7ef"
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
 }

common/client-core/gateways-storage/.sqlx/query-a64a557ba87d4b2c7457857afa7ebc7d4f895fc4991da18ec02c9e250bea0fe0.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, gateway_listener, fallback_listener)\n                VALUES (?, ?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "a64a557ba87d4b2c7457857afa7ebc7d4f895fc4991da18ec02c9e250bea0fe0"
-}

common/client-core/gateways-storage/.sqlx/query-a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}

common/client-core/gateways-storage/.sqlx/query-b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4.json

@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data)\n                VALUES (?, ?)\n            ",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "2c113b37864f9fec7e64c0f8fdd38edcdf149acfd38c56a4db3bbf97bdb13210"
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
 }

common/client-core/gateways-storage/Cargo.toml

@@ -9,6 +9,7 @@ rust-version.workspace = true
 
 [dependencies]
 async-trait.workspace = true
+cosmrs.workspace = true
 serde = { workspace = true, features = ["derive"] }
 thiserror.workspace = true
 time.workspace = true
@@ -19,7 +20,6 @@ zeroize = { workspace = true, features = ["zeroize_derive"] }
 
 nym-crypto = { path = "../../crypto", features = ["asymmetric"] }
 nym-gateway-requests = { path = "../../gateway-requests" }
-nym-gateway-client = { path = "../../client-libs/gateway-client" }
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true

common/client-core/gateways-storage/fs_gateways_migrations/20251126120000_remove_legacy_add_fallback.sql

@@ -1,22 +0,0 @@
-/*
- * Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
- * SPDX-License-Identifier: Apache-2.0
- */
-
-CREATE TABLE remote_gateway_details_temp
-(
-    gateway_id_bs58                          TEXT NOT NULL UNIQUE PRIMARY KEY REFERENCES registered_gateway (gateway_id_bs58),
-    derived_aes256_gcm_siv_key               BLOB NOT NULL,
-    gateway_listener                         TEXT NOT NULL,
-    fallback_listener                        TEXT,
-    expiration_timestamp                     DATETIME NOT NULL
-);
-
--- keep only registrations with a non null aes256 key
-INSERT INTO remote_gateway_details_temp SELECT gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, NULL, datetime(0, 'unixepoch') FROM remote_gateway_details WHERE derived_aes256_gcm_siv_key IS NOT NULL;
-
-DROP TABLE remote_gateway_details;
-ALTER TABLE remote_gateway_details_temp RENAME TO remote_gateway_details;
-
--- delete registrations with no key
-DELETE FROM registered_gateway WHERE gateway_id_bs58 NOT IN ( SELECT gateway_id_bs58 FROM remote_gateway_details);

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -6,7 +6,6 @@ use crate::{
     types::{
         RawActiveGateway, RawCustomGatewayDetails, RawRegisteredGateway, RawRemoteGatewayDetails,
     },
-    RawGatewayPublishedData,
 };
 use sqlx::{
     sqlite::{SqliteAutoVacuum, SqliteSynchronous},
@@ -32,6 +31,7 @@ impl StorageManager {
                 }
             })?;
         }
+
         let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
             .synchronous(SqliteSynchronous::Normal)
@@ -145,11 +145,13 @@ impl StorageManager {
         &self,
         gateway_id: &str,
     ) -> Result<RawRemoteGatewayDetails, sqlx::Error> {
-        // query_as! macro doesn't use fromRow
-        sqlx::query_as("SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?")
-            .bind(gateway_id)
-            .fetch_one(&self.connection_pool)
-            .await
+        sqlx::query_as!(
+            RawRemoteGatewayDetails,
+            "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .fetch_one(&self.connection_pool)
+        .await
     }
 
     pub(crate) async fn set_remote_gateway_details(
@@ -158,36 +160,41 @@ impl StorageManager {
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, fallback_listener, expiration_timestamp)
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)
                 VALUES (?, ?, ?, ?, ?)
             "#,
             remote.gateway_id_bs58,
+            remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
             remote.derived_aes256_gcm_siv_key,
-            remote.published_data.gateway_listener,
-            remote.published_data.fallback_listener,
-            remote.published_data.expiration_timestamp
+            remote.gateway_owner_address,
+            remote.gateway_listener,
         )
             .execute(&self.connection_pool)
             .await?;
         Ok(())
     }
 
-    pub(crate) async fn update_remote_gateway_published_data(
+    pub(crate) async fn update_remote_gateway_key(
         &self,
         gateway_id_bs58: &str,
-        published_data: &RawGatewayPublishedData,
+        derived_aes128_ctr_blake3_hmac_keys_bs58: Option<&str>,
+        derived_aes256_gcm_siv_key: Option<&[u8]>,
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                UPDATE remote_gateway_details SET gateway_listener = ?, fallback_listener = ?, expiration_timestamp = ? WHERE gateway_id_bs58 = ?
+                UPDATE remote_gateway_details
+                SET
+                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,
+                    derived_aes256_gcm_siv_key = ?
+                WHERE gateway_id_bs58 = ?
             "#,
-            published_data.gateway_listener,
-            published_data.fallback_listener,
-            published_data.expiration_timestamp,
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
             gateway_id_bs58
         )
-            .execute(&self.connection_pool)
-            .await?;
+        .execute(&self.connection_pool)
+        .await?;
+
         Ok(())
     }
 

common/client-core/gateways-storage/src/backend/fs_backend/mod.rs

@@ -2,16 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{
-    ActiveGateway, BadGateway, GatewayDetails, GatewayPublishedData, GatewayRegistration,
-    GatewayType, GatewaysDetailsStore, StorageError,
+    ActiveGateway, BadGateway, GatewayDetails, GatewayRegistration, GatewayType,
+    GatewaysDetailsStore, StorageError,
 };
 use async_trait::async_trait;
 use manager::StorageManager;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::path::Path;
 
 pub mod error;
 mod manager;
+mod models;
 
 #[derive(Clone)]
 pub struct OnDiskGatewaysDetails {
@@ -132,15 +134,16 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
         Ok(())
     }
 
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError> {
         self.manager
-            .update_remote_gateway_published_data(
+            .update_remote_gateway_key(
                 &gateway_id.to_base58_string(),
-                &published_data.into(),
+                None,
+                Some(updated_key.as_bytes()),
             )
             .await?;
         Ok(())

common/client-core/gateways-storage/src/backend/fs_backend/models.rs

@@ -0,0 +1,2 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

common/client-core/gateways-storage/src/backend/mem_backend.rs

@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::types::{ActiveGateway, GatewayRegistration};
-use crate::{BadGateway, GatewayDetails, GatewayPublishedData, GatewaysDetailsStore};
+use crate::{BadGateway, GatewayDetails, GatewaysDetailsStore};
 use async_trait::async_trait;
-use nym_crypto::asymmetric::ed25519;
+use nym_crypto::asymmetric::ed25519::PublicKey;
+use nym_gateway_requests::{SharedGatewayKey, SharedSymmetricKey};
 use std::collections::HashMap;
 use std::sync::Arc;
 use thiserror::Error;
@@ -95,17 +96,26 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
         Ok(())
     }
 
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError> {
         let mut guard = self.inner.write().await;
-        if let Some(gateway) = guard.gateways.get_mut(&gateway_id.to_base58_string()) {
-            if let GatewayDetails::Remote(ref mut remote_details) = gateway.details {
-                remote_details.published_data = published_data.clone();
-            }
+
+        #[allow(clippy::unwrap_used)]
+        if let Some(target) = guard.gateways.get_mut(&gateway_id.to_string()) {
+            let GatewayDetails::Remote(details) = &mut target.details else {
+                return Ok(());
+            };
+            assert_eq!(Arc::strong_count(&details.shared_key), 1);
+
+            // eh. that's nasty, but it's only ever used for ephemeral clients so should be fine for now...
+            details.shared_key = Arc::new(SharedGatewayKey::Current(
+                SharedSymmetricKey::try_from_bytes(updated_key.as_bytes()).unwrap(),
+            ))
         }
+
         Ok(())
     }
 

common/client-core/gateways-storage/src/error.rs

@@ -18,6 +18,16 @@ pub enum BadGateway {
         source: Ed25519RecoveryError,
     },
 
+    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {source}")]
+    MalformedGatewayOwnerAccountAddress {
+        gateway_id: String,
+
+        raw_owner: String,
+
+        #[source]
+        source: cosmrs::ErrorReport,
+    },
+
     #[error("the shared keys provided for gateway {gateway_id} are malformed: {source}")]
     MalformedSharedKeys {
         gateway_id: String,
@@ -40,12 +50,4 @@ pub enum BadGateway {
         #[source]
         source: url::ParseError,
     },
-
-    #[error("the listening address ({raw_listener}) is malformed: {source}")]
-    MalformedListenerNoId {
-        raw_listener: String,
-
-        #[source]
-        source: url::ParseError,
-    },
 }

common/client-core/gateways-storage/src/lib.rs

@@ -6,6 +6,7 @@
 
 use async_trait::async_trait;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;
 
 pub mod backend;
@@ -59,11 +60,10 @@ pub trait GatewaysDetailsStore {
         details: &GatewayRegistration,
     ) -> Result<(), Self::StorageError>;
 
-    /// Update the gateway details
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
         &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
     ) -> Result<(), Self::StorageError>;
 
     /// Remove given gateway details from the underlying store.

common/client-core/gateways-storage/src/types.rs

@@ -2,21 +2,20 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::BadGateway;
+use cosmrs::AccountId;
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::GatewayListeners;
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
+use std::ops::Deref;
 use std::str::FromStr;
 use std::sync::Arc;
-use time::Duration;
 use time::OffsetDateTime;
 use url::Url;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
 pub const REMOTE_GATEWAY_TYPE: &str = "remote";
 pub const CUSTOM_GATEWAY_TYPE: &str = "custom";
-const GATEWAY_DETAILS_TTL: Duration = Duration::days(7);
 
 #[derive(Debug, Clone, Default)]
 pub struct ActiveGateway {
@@ -66,13 +65,15 @@ impl From<GatewayDetails> for GatewayRegistration {
 impl GatewayDetails {
     pub fn new_remote(
         gateway_id: ed25519::PublicKey,
-        shared_key: Arc<SharedSymmetricKey>,
-        published_data: GatewayPublishedData,
+        shared_key: Arc<SharedGatewayKey>,
+        gateway_owner_address: Option<AccountId>,
+        gateway_listener: Url,
     ) -> Self {
         GatewayDetails::Remote(RemoteGatewayDetails {
             gateway_id,
             shared_key,
-            published_data,
+            gateway_owner_address,
+            gateway_listener,
         })
     }
 
@@ -87,20 +88,13 @@ impl GatewayDetails {
         }
     }
 
-    pub fn shared_key(&self) -> Option<&SharedSymmetricKey> {
+    pub fn shared_key(&self) -> Option<&SharedGatewayKey> {
         match self {
             GatewayDetails::Remote(details) => Some(&details.shared_key),
             GatewayDetails::Custom(_) => None,
         }
     }
 
-    pub fn details_exipration(&self) -> Option<OffsetDateTime> {
-        match self {
-            GatewayDetails::Remote(details) => Some(details.published_data.expiration_timestamp),
-            GatewayDetails::Custom(_) => None,
-        }
-    }
-
     pub fn is_custom(&self) -> bool {
         matches!(self, GatewayDetails::Custom(..))
     }
@@ -170,78 +164,14 @@ pub struct RegisteredGateway {
     pub gateway_type: GatewayType,
 }
 
-#[derive(Debug, Clone)]
-pub struct GatewayPublishedData {
-    pub listeners: GatewayListeners,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl GatewayPublishedData {
-    pub fn new(listeners: GatewayListeners) -> GatewayPublishedData {
-        GatewayPublishedData {
-            listeners,
-            expiration_timestamp: OffsetDateTime::now_utc() + GATEWAY_DETAILS_TTL,
-        }
-    }
-}
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
-pub struct RawGatewayPublishedData {
-    pub gateway_listener: String,
-    pub fallback_listener: Option<String>,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl<'a> From<&'a GatewayPublishedData> for RawGatewayPublishedData {
-    fn from(value: &'a GatewayPublishedData) -> Self {
-        Self {
-            gateway_listener: value.listeners.primary.to_string(),
-            fallback_listener: value.listeners.fallback.as_ref().map(|uri| uri.to_string()),
-            expiration_timestamp: value.expiration_timestamp,
-        }
-    }
-}
-
-impl TryFrom<RawGatewayPublishedData> for GatewayPublishedData {
-    type Error = BadGateway;
-
-    fn try_from(value: RawGatewayPublishedData) -> Result<Self, Self::Error> {
-        let gateway_listener: Url = Url::parse(&value.gateway_listener).map_err(|source| {
-            BadGateway::MalformedListenerNoId {
-                raw_listener: value.gateway_listener.clone(),
-                source,
-            }
-        })?;
-        let fallback_listener = value
-            .fallback_listener
-            .as_ref()
-            .map(|uri| {
-                Url::parse(uri).map_err(|source| BadGateway::MalformedListenerNoId {
-                    raw_listener: uri.to_owned(),
-                    source,
-                })
-            })
-            .transpose()?;
-
-        Ok(GatewayPublishedData {
-            listeners: GatewayListeners {
-                primary: gateway_listener,
-                fallback: fallback_listener,
-            },
-            expiration_timestamp: value.expiration_timestamp,
-        })
-    }
-}
-
 #[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 #[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
 pub struct RawRemoteGatewayDetails {
     pub gateway_id_bs58: String,
-    pub derived_aes256_gcm_siv_key: Vec<u8>,
-    #[zeroize(skip)]
-    #[cfg_attr(feature = "sqlx", sqlx(flatten))]
-    pub published_data: RawGatewayPublishedData,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
+    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
+    pub gateway_owner_address: Option<String>,
+    pub gateway_listener: String,
 }
 
 impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
@@ -256,26 +186,81 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
                 }
             })?;
 
-        let shared_key = SharedSymmetricKey::try_from_bytes(&value.derived_aes256_gcm_siv_key)
-            .map_err(|source| BadGateway::MalformedSharedKeys {
+        let shared_key =
+            match (
+                &value.derived_aes256_gcm_siv_key,
+                &value.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            ) {
+                (None, None) => {
+                    return Err(BadGateway::MissingSharedKey {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                    })
+                }
+                (Some(aes256gcm_siv), _) => {
+                    let current_key =
+                        SharedSymmetricKey::try_from_bytes(aes256gcm_siv).map_err(|source| {
+                            BadGateway::MalformedSharedKeys {
+                                gateway_id: value.gateway_id_bs58.clone(),
+                                source,
+                            }
+                        })?;
+                    SharedGatewayKey::Current(current_key)
+                }
+                (None, Some(aes128ctr_hmac)) => {
+                    let legacy_key = LegacySharedKeys::try_from_base58_string(aes128ctr_hmac)
+                        .map_err(|source| BadGateway::MalformedSharedKeys {
+                            gateway_id: value.gateway_id_bs58.clone(),
+                            source,
+                        })?;
+                    SharedGatewayKey::Legacy(legacy_key)
+                }
+            };
+
+        let gateway_owner_address = value
+            .gateway_owner_address
+            .as_ref()
+            .map(|raw_owner| {
+                AccountId::from_str(raw_owner).map_err(|source| {
+                    BadGateway::MalformedGatewayOwnerAccountAddress {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                        raw_owner: raw_owner.clone(),
+                        source,
+                    }
+                })
+            })
+            .transpose()?;
+
+        let gateway_listener = Url::parse(&value.gateway_listener).map_err(|source| {
+            BadGateway::MalformedListener {
                 gateway_id: value.gateway_id_bs58.clone(),
+                raw_listener: value.gateway_listener.clone(),
                 source,
-            })?;
+            }
+        })?;
 
         Ok(RemoteGatewayDetails {
             gateway_id,
             shared_key: Arc::new(shared_key),
-            published_data: value.published_data.clone().try_into()?,
+            gateway_owner_address,
+            gateway_listener,
         })
     }
 }
 
 impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
     fn from(value: &'a RemoteGatewayDetails) -> Self {
+        let (derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key) =
+            match value.shared_key.deref() {
+                SharedGatewayKey::Current(key) => (None, Some(key.to_bytes())),
+                SharedGatewayKey::Legacy(key) => (Some(key.to_base58_string()), None),
+            };
+
         RawRemoteGatewayDetails {
             gateway_id_bs58: value.gateway_id.to_base58_string(),
-            derived_aes256_gcm_siv_key: value.shared_key.to_bytes(),
-            published_data: (&value.published_data).into(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
+            gateway_owner_address: value.gateway_owner_address.as_ref().map(|o| o.to_string()),
+            gateway_listener: value.gateway_listener.to_string(),
         }
     }
 }
@@ -284,9 +269,11 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
 pub struct RemoteGatewayDetails {
     pub gateway_id: ed25519::PublicKey,
 
-    pub shared_key: Arc<SharedSymmetricKey>,
+    pub shared_key: Arc<SharedGatewayKey>,
 
-    pub published_data: GatewayPublishedData,
+    pub gateway_owner_address: Option<AccountId>,
+
+    pub gateway_listener: Url,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -87,7 +87,6 @@ where
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
-        false,
     );
     tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
@@ -115,12 +114,13 @@ where
         })?;
         hardcoded_topology.entry_capable_nodes().cloned().collect()
     } else {
+        let mut rng = rand::thread_rng();
         crate::init::helpers::gateways_for_init(
+            &mut rng,
             &core.client.nym_api_urls,
             user_agent,
             core.debug.topology.minimum_gateway_performance,
             core.debug.topology.ignore_ingress_epoch_role,
-            None,
         )
         .await?
     };
@@ -168,7 +168,6 @@ where
         identity: gateway_details.gateway_id,
         active: common_args.set_active,
         typ: gateway_registration.details.typ().to_string(),
-        endpoint: Some(gateway_details.published_data.listeners.primary.clone()),
-        fallback_endpoint: gateway_details.published_data.listeners.fallback.clone(),
+        endpoint: Some(gateway_details.gateway_listener.clone()),
     })
 }

common/client-core/src/cli_helpers/client_init.rs

@@ -81,10 +81,6 @@ pub struct CommonClientInitArgs {
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
     pub enabled_credentials_mode: Option<bool>,
 
-    /// Change the default minimum node performance used during initial node selection filtering.
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub minimum_gateway_performance: Option<u8>,
-
     /// Mostly debug-related option to increase default traffic rate so that you would not need to
     /// modify config post init
     #[cfg_attr(feature = "cli", clap(long, hide = true))]
@@ -140,7 +136,6 @@ where
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
         common_args.force_tls_gateway,
-        false,
     );
     tracing::debug!("Gateway selection specification: {selection_spec:?}");
 
@@ -178,16 +173,13 @@ where
         })?;
         hardcoded_topology.entry_capable_nodes().cloned().collect()
     } else {
-        let minimum_performance = common_args
-            .minimum_gateway_performance
-            .unwrap_or(core.debug.topology.minimum_gateway_performance);
-
+        let mut rng = rand::thread_rng();
         crate::init::helpers::gateways_for_init(
+            &mut rng,
             &core.client.nym_api_urls,
             user_agent,
-            minimum_performance,
+            core.debug.topology.minimum_gateway_performance,
             core.debug.topology.ignore_ingress_epoch_role,
-            None,
         )
         .await?
     };

common/client-core/src/cli_helpers/client_list_gateways.rs

@@ -56,8 +56,7 @@ where
                 identity: remote_details.gateway_id,
                 active: active_gateway == Some(remote_details.gateway_id),
                 typ: GatewayType::Remote.to_string(),
-                endpoint: Some(remote_details.published_data.listeners.primary.clone()),
-                fallback_endpoint: remote_details.published_data.listeners.fallback.clone(),
+                endpoint: Some(remote_details.gateway_listener),
             }),
             GatewayDetails::Custom(_) => info.push(GatewayInfo {
                 registration: gateway.registration_timestamp,
@@ -65,7 +64,6 @@ where
                 active: active_gateway == Some(gateway.details.gateway_id()),
                 typ: gateway.details.typ().to_string(),
                 endpoint: None,
-                fallback_endpoint: None,
             }),
         };
     }

common/client-core/src/cli_helpers/types.rs

@@ -15,7 +15,6 @@ pub struct GatewayInfo {
 
     pub typ: String,
     pub endpoint: Option<Url>,
-    pub fallback_endpoint: Option<Url>,
 }
 
 impl Display for GatewayInfo {
@@ -31,9 +30,6 @@ impl Display for GatewayInfo {
         if let Some(endpoint) = &self.endpoint {
             write!(f, " endpoint: {endpoint}")?;
         }
-        if let Some(fallback_endpoint) = &self.fallback_endpoint {
-            write!(f, " fallback: {fallback_endpoint}")?;
-        }
         Ok(())
     }
 }

common/client-core/src/client/base_client/mod.rs

@@ -7,12 +7,11 @@ use super::statistics_control::StatisticsControl;
 use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
-use crate::client::event_control::EventControl;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
-use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController, MixTrafficEvent};
+use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -28,13 +27,13 @@ use crate::client::topology_control::nym_api_provider::NymApiTopologyProvider;
 use crate::client::topology_control::{
     TopologyAccessor, TopologyRefresher, TopologyRefresherConfig,
 };
-use crate::config;
 use crate::config::{Config, DebugConfig};
 use crate::error::ClientCoreError;
 use crate::init::{
     setup_gateway,
     types::{GatewaySetup, InitialisationResult},
 };
+use crate::{config, spawn_future};
 use futures::channel::mpsc;
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_config_types::{ForgetMe, RememberMe};
@@ -49,11 +48,12 @@ use nym_gateway_client::{
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::addressing::nodes::NodeIdentity;
+use nym_sphinx::params::PacketType;
 use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_statistics_common::clients::ClientStatsSender;
 use nym_statistics_common::generate_client_stats_id;
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
-use nym_task::ShutdownTracker;
+use nym_task::{TaskClient, TaskHandle};
 use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nym_api::NymApiClientExt;
@@ -67,16 +67,9 @@ use std::path::Path;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::sync::mpsc::Sender;
+use tracing::*;
 use url::Url;
 
-#[cfg(target_arch = "wasm32")]
-#[cfg(debug_assertions)]
-use wasm_utils::console_log;
-
-/// Default number of retries for Nym API requests when using network details with domain fronting.
-/// This allows the client to try alternative URLs if the primary endpoint is unavailable.
-const DEFAULT_NYM_API_RETRIES: usize = 3;
-
 #[cfg(all(
     not(target_arch = "wasm32"),
     feature = "fs-surb-storage",
@@ -87,28 +80,10 @@ pub mod non_wasm_helpers;
 pub mod helpers;
 pub mod storage;
 
-#[derive(Clone, Copy, Debug)]
-pub enum MixnetClientEvent {
-    Traffic(MixTrafficEvent),
-}
-
-pub type EventReceiver = mpsc::UnboundedReceiver<MixnetClientEvent>;
-#[derive(Clone)]
-pub struct EventSender(pub mpsc::UnboundedSender<MixnetClientEvent>);
-
-impl EventSender {
-    pub fn send(&self, event: MixnetClientEvent) {
-        if let Err(err) = self.0.unbounded_send(event) {
-            tracing::warn!("Failed to send error event. The caller event reader was closed: {err}");
-        }
-    }
-}
-
 #[derive(Clone)]
 pub struct ClientInput {
     pub connection_command_sender: ConnectionCommandSender,
     pub input_sender: InputMessageSender,
-    pub client_request_sender: ClientRequestSender,
 }
 
 impl ClientInput {
@@ -120,6 +95,7 @@ impl ClientInput {
     }
 }
 
+#[derive(Clone)]
 pub struct ClientOutput {
     pub received_buffer_request_sender: ReceivedBufferRequestSender,
 }
@@ -216,14 +192,10 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
     client_store: S,
     dkg_query_client: Option<C>,
 
-    // Optional API URLs for domain fronting support
-    nym_api_urls: Option<Vec<nym_network_defaults::ApiUrl>>,
-
     wait_for_gateway: bool,
     custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
     custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
-    shutdown: Option<ShutdownTracker>,
-    event_tx: Option<EventSender>,
+    shutdown: Option<TaskClient>,
     user_agent: Option<UserAgent>,
 
     setup_method: GatewaySetup,
@@ -248,12 +220,10 @@ where
             config: base_config,
             client_store,
             dkg_query_client,
-            nym_api_urls: None,
             wait_for_gateway: false,
             custom_topology_provider: None,
             custom_gateway_transceiver: None,
             shutdown: None,
-            event_tx: None,
             user_agent: None,
             setup_method: GatewaySetup::MustLoad { gateway_id: None },
             #[cfg(unix)]
@@ -271,16 +241,6 @@ where
         self
     }
 
-    /// Set Nym API URLs for domain fronting support.
-    ///
-    /// When provided, the client will use these API URLs (which include front_hosts)
-    /// to construct HTTP clients with domain fronting enabled.
-    #[must_use]
-    pub fn with_nym_api_urls(mut self, nym_api_urls: Vec<nym_network_defaults::ApiUrl>) -> Self {
-        self.nym_api_urls = Some(nym_api_urls);
-        self
-    }
-
     #[must_use]
     pub fn with_forget_me(mut self, forget_me: &ForgetMe) -> Self {
         self.config.debug.forget_me = *forget_me;
@@ -321,17 +281,11 @@ where
     }
 
     #[must_use]
-    pub fn with_shutdown(mut self, shutdown: ShutdownTracker) -> Self {
+    pub fn with_shutdown(mut self, shutdown: TaskClient) -> Self {
         self.shutdown = Some(shutdown);
         self
     }
 
-    #[must_use]
-    pub fn with_event_tx(mut self, event_tx: EventSender) -> Self {
-        self.event_tx = Some(event_tx);
-        self
-    }
-
     #[must_use]
     pub fn with_user_agent(mut self, user_agent: UserAgent) -> Self {
         self.user_agent = Some(user_agent);
@@ -362,18 +316,6 @@ where
         details.client_address()
     }
 
-    fn start_event_control(
-        parent_event_tx: Option<EventSender>,
-        children_event_rx: EventReceiver,
-        shutdown_tracker: &ShutdownTracker,
-    ) {
-        let event_control = EventControl::new(parent_event_tx, children_event_rx);
-        shutdown_tracker.try_spawn_named_with_shutdown(
-            async move { event_control.run().await },
-            "EventControl",
-        );
-    }
-
     // future constantly pumping loop cover traffic at some specified average rate
     // the pumped traffic goes to the MixTrafficController
     fn start_cover_traffic_stream(
@@ -383,11 +325,11 @@ where
         topology_accessor: TopologyAccessor,
         mix_tx: BatchMixMessageSender,
         stats_tx: ClientStatsSender,
-        shutdown_tracker: &ShutdownTracker,
+        task_client: TaskClient,
     ) {
-        tracing::info!("Starting loop cover traffic stream...");
+        info!("Starting loop cover traffic stream...");
 
-        let mut stream = LoopCoverTrafficStream::new(
+        let stream = LoopCoverTrafficStream::new(
             ack_key,
             debug_config.acknowledgements.average_ack_delay,
             mix_tx,
@@ -396,9 +338,10 @@ where
             debug_config.traffic,
             debug_config.cover_traffic,
             stats_tx,
+            task_client,
         );
-        shutdown_tracker
-            .try_spawn_named_with_shutdown(async move { stream.run().await }, "CoverTrafficStream");
+
+        stream.start();
     }
 
     #[allow(clippy::too_many_arguments)]
@@ -414,12 +357,13 @@ where
         reply_controller_receiver: ReplyControllerReceiver,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
+        task_client: TaskClient,
+        packet_type: PacketType,
         stats_tx: ClientStatsSender,
-        shutdown_tracker: &ShutdownTracker,
     ) {
-        tracing::info!("Starting real traffic stream...");
+        info!("Starting real traffic stream...");
 
-        let real_messages_controller = RealMessagesController::new(
+        RealMessagesController::new(
             controller_config,
             key_rotation_config,
             ack_receiver,
@@ -432,63 +376,9 @@ where
             lane_queue_lengths,
             client_connection_rx,
             stats_tx,
-            shutdown_tracker.clone_shutdown_token(),
-        );
-
-        // break out all the subtasks
-        let (mut out_queue_control, mut reply_controller, ack_controller) =
-            real_messages_controller.into_tasks();
-        let (
-            mut ack_listener,
-            mut input_listener,
-            mut retransmission_listener,
-            mut sent_notification_listener,
-            mut ack_action_controller,
-        ) = ack_controller.into_tasks();
-
-        shutdown_tracker.try_spawn_named(
-            async move { out_queue_control.run().await },
-            "RealMessagesController::OutQueueControl",
-        );
-
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
-            async move { reply_controller.run(shutdown_token).await },
-            "RealMessagesController::ReplyController",
-        );
-
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
-            async move { ack_listener.run(shutdown_token).await },
-            "AcknowledgementController::AcknowledgementListener",
-        );
-
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
-            async move { input_listener.run(shutdown_token).await },
-            "AcknowledgementController::InputMessageListener",
-        );
-
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
-            async move { retransmission_listener.run(shutdown_token).await },
-            "AcknowledgementController::RetransmissionRequestListener",
-        );
-
-        shutdown_tracker.try_spawn_named_with_shutdown(
-            async move {
-                sent_notification_listener.run().await;
-            },
-            "AcknowledgementController::SentNotificationListener",
-        );
-
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
-            async move { ack_action_controller.run(shutdown_token).await },
-            "AcknowledgementController::ActionController",
-        );
-
-        // .start(packet_type);
+            task_client,
+        )
+        .start(packet_type);
     }
 
     // buffer controlling all messages fetched from provider
@@ -499,29 +389,21 @@ where
         mixnet_receiver: MixnetMessageReceiver,
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
+        shutdown: TaskClient,
         metrics_reporter: ClientStatsSender,
-        shutdown_tracker: &ShutdownTracker,
     ) {
-        tracing::info!("Starting received messages buffer controller...");
-        let controller = ReceivedMessagesBufferController::<SphinxMessageReceiver>::new(
-            local_encryption_keypair,
-            query_receiver,
-            mixnet_receiver,
-            reply_key_storage,
-            reply_controller_sender,
-            metrics_reporter,
-            shutdown_tracker.clone_shutdown_token(),
-        );
-        let (mut msg_receiver, mut req_receiver) = controller.into_tasks();
-
-        shutdown_tracker.try_spawn_named(
-            async move { msg_receiver.run().await },
-            "ReceivedMessagesBufferController::FragmentedMessageReceiver",
-        );
-        shutdown_tracker.try_spawn_named(
-            async move { req_receiver.run().await },
-            "ReceivedMessagesBufferController::RequestReceiver",
-        );
+        info!("Starting received messages buffer controller...");
+        let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
+            ReceivedMessagesBufferController::new(
+                local_encryption_keypair,
+                query_receiver,
+                mixnet_receiver,
+                reply_key_storage,
+                reply_controller_sender,
+                metrics_reporter,
+                shutdown,
+            );
+        controller.start()
     }
 
     #[allow(clippy::too_many_arguments)]
@@ -529,10 +411,11 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         stats_reporter: ClientStatsSender,
         #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
-        shutdown_tracker: &ShutdownTracker,
+        shutdown: TaskClient,
     ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
@@ -551,10 +434,17 @@ where
                     packet_router,
                     bandwidth_controller,
                     stats_reporter,
-                    shutdown_tracker.clone_shutdown_token(),
+                    shutdown,
                 )
             } else {
-                let cfg = GatewayConfig::new(details.gateway_id, details.published_data.listeners);
+                let cfg = GatewayConfig::new(
+                    details.gateway_id,
+                    details
+                        .gateway_owner_address
+                        .as_ref()
+                        .map(|o| o.to_string()),
+                    details.gateway_listener.to_string(),
+                );
                 GatewayClient::new(
                     GatewayClientConfig::new_default()
                         .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
@@ -569,7 +459,7 @@ where
                     stats_reporter,
                     #[cfg(unix)]
                     connection_fd_callback,
-                    shutdown_tracker.clone_shutdown_token(),
+                    shutdown,
                 )
             };
 
@@ -584,13 +474,32 @@ where
         // the gateway client startup procedure is slightly more complicated now
         // we need to:
         // - perform handshake (reg or auth)
+        // - check for key upgrade
+        // - maybe perform another upgrade handshake
         // - check for bandwidth
         // - start background tasks
-        let _ = gateway_client
+        let auth_res = gateway_client
             .perform_initial_authentication()
             .await
             .map_err(gateway_failure)?;
 
+        if auth_res.requires_key_upgrade {
+            // drop the shared_key arc because we don't need it and we can't hold it for the purposes of upgrade
+            drop(auth_res);
+
+            let updated_key = gateway_client
+                .upgrade_key_authenticated()
+                .await
+                .map_err(gateway_failure)?;
+
+            details_store
+                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
+                .await.map_err(|err| {
+                error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+            })?
+        }
+
         gateway_client
             .claim_initial_bandwidth()
             .await
@@ -609,10 +518,11 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         stats_reporter: ClientStatsSender,
         #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
-        shutdown_tracker: &ShutdownTracker,
+        mut shutdown: TaskClient,
     ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
@@ -629,6 +539,7 @@ where
                 Err(ClientCoreError::CustomGatewaySelectionExpected)
             } else {
                 // and make sure to invalidate the task client, so we wouldn't cause premature shutdown
+                shutdown.disarm();
                 custom_gateway_transceiver.set_packet_router(packet_router)?;
                 Ok(custom_gateway_transceiver)
             };
@@ -639,11 +550,12 @@ where
             config,
             initialisation_result,
             bandwidth_controller,
+            details_store,
             packet_router,
             stats_reporter,
             #[cfg(unix)]
             connection_fd_callback,
-            shutdown_tracker,
+            shutdown,
         )
         .await?;
 
@@ -674,24 +586,26 @@ where
         topology_accessor: TopologyAccessor,
         local_gateway: NodeIdentity,
         wait_for_gateway: bool,
-        shutdown_tracker: &ShutdownTracker,
+        mut task_client: TaskClient,
     ) -> Result<(), ClientCoreError> {
         let topology_refresher_config =
             TopologyRefresherConfig::new(topology_config.topology_refresh_rate);
 
         if topology_config.disable_refreshing {
             // if we're not spawning the refresher, don't cause shutdown immediately
-            tracing::info!("The background topology refresher is not going to be started");
+            info!("The background topology refesher is not going to be started");
+            task_client.disarm();
         }
 
         let mut topology_refresher = TopologyRefresher::new(
             topology_refresher_config,
             topology_accessor,
             topology_provider,
+            task_client,
         );
         // before returning, block entire runtime to refresh the current network view so that any
         // components depending on topology would see a non-empty view
-        tracing::info!("Obtaining initial network topology");
+        info!("Obtaining initial network topology");
         topology_refresher.try_refresh().await;
 
         if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
@@ -717,13 +631,13 @@ where
                     .wait_for_gateway(local_gateway, waiting_timeout)
                     .await
                 {
-                    tracing::error!(
+                    error!(
                         "the gateway did not come back online within the specified timeout: {err}"
                     );
                     return Err(err.into());
                 }
             } else {
-                tracing::error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
+                error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
                 return Err(err.into());
             }
         }
@@ -731,11 +645,8 @@ where
         if !topology_config.disable_refreshing {
             // don't spawn the refresher if we don't want to be refreshing the topology.
             // only use the initial values obtained
-            tracing::info!("Starting topology refresher...");
-            shutdown_tracker.try_spawn_named_with_shutdown(
-                async move { topology_refresher.run().await },
-                "TopologyRefresher",
-            );
+            info!("Starting topology refresher...");
+            topology_refresher.start();
         }
 
         Ok(())
@@ -746,9 +657,9 @@ where
         user_agent: Option<UserAgent>,
         client_stats_id: String,
         input_sender: Sender<InputMessage>,
-        shutdown_tracker: &ShutdownTracker,
+        task_client: TaskClient,
     ) -> ClientStatsSender {
-        tracing::info!("Starting statistics control...");
+        info!("Starting statistics control...");
         StatisticsControl::create_and_start(
             config.debug.stats_reporting,
             user_agent
@@ -756,30 +667,18 @@ where
                 .unwrap_or("unknown".to_string()),
             client_stats_id,
             input_sender.clone(),
-            shutdown_tracker,
+            task_client,
         )
     }
 
     fn start_mix_traffic_controller(
         gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
-        shutdown_tracker: &ShutdownTracker,
-        event_tx: EventSender,
+        shutdown: TaskClient,
     ) -> (BatchMixMessageSender, ClientRequestSender) {
-        tracing::info!("Starting mix traffic controller...");
-        let mut mix_traffic_controller = MixTrafficController::new(
-            gateway_transceiver,
-            shutdown_tracker.clone_shutdown_token(),
-            event_tx,
-        );
-
-        let mix_tx = mix_traffic_controller.mix_tx();
-        let client_tx = mix_traffic_controller.client_tx();
-
-        shutdown_tracker.try_spawn_named(
-            async move { mix_traffic_controller.run().await },
-            "MixTrafficController",
-        );
-
+        info!("Starting mix traffic controller...");
+        let (mix_traffic_controller, mix_tx, client_tx) =
+            MixTrafficController::new(gateway_transceiver, shutdown);
+        mix_traffic_controller.start();
         (mix_tx, client_tx)
     }
 
@@ -787,7 +686,7 @@ where
     async fn setup_persistent_reply_storage(
         backend: S::ReplyStore,
         key_rotation_config: KeyRotationConfig,
-        shutdown_tracker: &ShutdownTracker,
+        shutdown: TaskClient,
     ) -> Result<CombinedReplyStorage, ClientCoreError>
     where
         <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
@@ -812,14 +711,13 @@ where
             })?;
 
         let store_clone = mem_store.clone();
-        let shutdown_token = shutdown_tracker.clone_shutdown_token();
-        shutdown_tracker.try_spawn_named(
+        spawn_future!(
             async move {
                 persistent_storage
-                    .flush_on_shutdown(store_clone, shutdown_token)
+                    .flush_on_shutdown(store_clone, shutdown)
                     .await
             },
-            "PersistentReplyStorage::flush_on_shutdown",
+            "PersistentReplyStorage::flush_on_shutdown"
         );
 
         Ok(mem_store)
@@ -837,7 +735,7 @@ where
     {
         // if client keys do not exist already, create and persist them
         if key_store.load_keys().await.is_err() {
-            tracing::info!("could not find valid client keys - a new set will be generated");
+            info!("could not find valid client keys - a new set will be generated");
             let mut rng = OsRng;
             let keys = if let Some(derivation_material) = derivation_material {
                 ClientKeys::from_master_key(&mut rng, &derivation_material)
@@ -852,68 +750,35 @@ where
     }
 
     fn construct_nym_api_client(
-        nym_api_urls: Option<&Vec<nym_network_defaults::ApiUrl>>,
         config: &Config,
         user_agent: Option<UserAgent>,
     ) -> Result<nym_http_api_client::Client, ClientCoreError> {
-        tracing::debug!(
-            "construct_nym_api_client called with nym_api_urls: {}",
-            nym_api_urls.is_some()
-        );
-
-        // If API URLs are provided, use new_with_fronted_urls() which handles domain fronting
-        if let Some(nym_api_urls) = nym_api_urls {
-            if nym_api_urls.is_empty() {
-                tracing::warn!("Provided nym_api_urls is empty, falling back to config endpoints");
-            } else {
-                tracing::info!(
-                    "Building nym-api client from provided URLs (with domain fronting support): {} URLs",
-                    nym_api_urls.len()
-                );
-
-                let mut builder =
-                    nym_http_api_client::ClientBuilder::new_with_fronted_urls(nym_api_urls.clone())
-                        .map_err(ClientCoreError::from)?
-                        .with_retries(DEFAULT_NYM_API_RETRIES);
-
-                if let Some(user_agent) = user_agent {
-                    builder = builder.with_user_agent(user_agent);
-                }
-
-                return builder.build().map_err(ClientCoreError::from);
-            }
-        }
-
-        // Fallback to basic client for backwards compatibility
-        tracing::debug!("Building basic nym-api HTTP client from config endpoints");
-
         let mut nym_api_urls = config.get_nym_api_endpoints();
-        if nym_api_urls.is_empty() {
-            tracing::warn!("No API endpoints configured in config, this may cause issues");
-        }
         nym_api_urls.shuffle(&mut thread_rng());
 
-        // Convert config URLs to ApiUrl format for consistency
-        let api_urls: Vec<nym_network_defaults::ApiUrl> = nym_api_urls
-            .into_iter()
-            .map(|url| nym_network_defaults::ApiUrl {
-                url: url.to_string(),
-                front_hosts: None,
-            })
-            .collect();
-
-        tracing::debug!("Using {} config API endpoints", api_urls.len());
-
-        let mut builder = nym_http_api_client::ClientBuilder::new_with_fronted_urls(api_urls)
-            .map_err(ClientCoreError::from)?
-            .with_retries(DEFAULT_NYM_API_RETRIES)
-            .with_bincode();
+        let mut builder =
+            nym_http_api_client::Client::builder(nym_api_urls[0].clone()).map_err(|e| {
+                ClientCoreError::NymApiQueryFailure {
+                    source:
+                        nym_validator_client::nym_api::error::NymAPIError::GenericRequestFailure(
+                            e.to_string(),
+                        ),
+                }
+            })?;
 
         if let Some(user_agent) = user_agent {
             builder = builder.with_user_agent(user_agent);
         }
 
-        builder.build().map_err(ClientCoreError::from)
+        builder = builder.with_bincode();
+
+        builder
+            .build()
+            .map_err(|e| ClientCoreError::NymApiQueryFailure {
+                source: nym_validator_client::nym_api::error::NymAPIError::GenericRequestFailure(
+                    e.to_string(),
+                ),
+            })
     }
 
     async fn determine_key_rotation_state(
@@ -930,12 +795,7 @@ where
         <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
         <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
     {
-        tracing::info!("Starting nym client");
-        #[cfg(debug_assertions)]
-        #[cfg(target_arch = "wasm32")]
-        {
-            console_log!("Starting base Nym Client");
-        }
+        info!("Starting nym client");
 
         // derive (or load) client keys and gateway configuration
         let init_res = Self::initialise_keys_and_gateway(
@@ -946,7 +806,8 @@ where
         )
         .await?;
 
-        let (reply_storage_backend, credential_store, _) = self.client_store.into_runtime_stores();
+        let (reply_storage_backend, credential_store, details_store) =
+            self.client_store.into_runtime_stores();
 
         // channels for inter-component communication
         // TODO: make the channels be internally created by the relevant components
@@ -963,22 +824,17 @@ where
         // channels responsible for controlling real messages
         let (input_sender, input_receiver) = tokio::sync::mpsc::channel::<InputMessage>(1);
 
-        // channels responsible for event management
-        let (event_sender, event_receiver) = mpsc::unbounded();
-
         // channels responsible for controlling ack messages
         let (ack_sender, ack_receiver) = mpsc::unbounded();
         let shared_topology_accessor =
             TopologyAccessor::new(self.config.debug.topology.ignore_egress_epoch_role);
 
-        // Create a shutdown tracker for this client - either as a child of provided tracker
-        // or get one from the registry
-        let shutdown_tracker = match self.shutdown {
-            Some(parent_tracker) => parent_tracker.clone(),
-            None => nym_task::create_sdk_shutdown_tracker()?,
-        };
-
-        Self::start_event_control(self.event_tx, event_receiver, &shutdown_tracker);
+        // Shutdown notifier for signalling tasks to stop
+        let shutdown = self
+            .shutdown
+            .map(Into::<TaskHandle>::into)
+            .unwrap_or_default()
+            .name_if_unnamed("BaseNymClient");
 
         // channels responsible for dealing with reply-related fun
         let (reply_controller_sender, reply_controller_receiver) =
@@ -995,11 +851,7 @@ where
             .dkg_query_client
             .map(|client| BandwidthController::new(credential_store, client));
 
-        let nym_api_client = Self::construct_nym_api_client(
-            self.nym_api_urls.as_ref(),
-            &self.config,
-            self.user_agent.clone(),
-        )?;
+        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone())?;
         let key_rotation_config = Self::determine_key_rotation_state(&nym_api_client).await?;
 
         let topology_provider = Self::setup_topology_provider(
@@ -1014,7 +866,7 @@ where
             self.user_agent.clone(),
             generate_client_stats_id(*self_address.identity()),
             input_sender.clone(),
-            &shutdown_tracker.clone(),
+            shutdown.fork("statistics_control"),
         );
 
         // needs to be started as the first thing to block if required waiting for the gateway
@@ -1024,14 +876,14 @@ where
             shared_topology_accessor.clone(),
             self_address.gateway(),
             self.wait_for_gateway,
-            &shutdown_tracker.clone(),
+            shutdown.fork("topology_refresher"),
         )
         .await?;
 
         let gateway_packet_router = PacketRouter::new(
             ack_sender,
             mixnet_messages_sender,
-            shutdown_tracker.clone_shutdown_token(),
+            shutdown.get_handle().named("gateway-packet-router"),
         );
 
         let gateway_transceiver = Self::setup_gateway_transceiver(
@@ -1039,11 +891,12 @@ where
             &self.config,
             init_res,
             bandwidth_controller,
+            &details_store,
             gateway_packet_router,
             stats_reporter.clone(),
             #[cfg(unix)]
             self.connection_fd_callback,
-            &shutdown_tracker.clone(),
+            shutdown.fork("gateway_transceiver"),
         )
         .await?;
         let gateway_ws_fd = gateway_transceiver.ws_fd();
@@ -1051,7 +904,7 @@ where
         let reply_storage = Self::setup_persistent_reply_storage(
             reply_storage_backend,
             key_rotation_config,
-            &shutdown_tracker.clone(),
+            shutdown.fork("persistent_reply_storage"),
         )
         .await?;
 
@@ -1061,8 +914,8 @@ where
             mixnet_messages_receiver,
             reply_storage.key_storage(),
             reply_controller_sender.clone(),
+            shutdown.fork("received_messages_buffer"),
             stats_reporter.clone(),
-            &shutdown_tracker.clone(),
         );
 
         // The message_sender is the transmitter for any component generating sphinx packets
@@ -1072,8 +925,7 @@ where
 
         let (message_sender, client_request_sender) = Self::start_mix_traffic_controller(
             gateway_transceiver,
-            &shutdown_tracker.clone(),
-            EventSender(event_sender),
+            shutdown.fork("mix_traffic_controller"),
         );
 
         // Channels that the websocket listener can use to signal downstream to the real traffic
@@ -1102,8 +954,9 @@ where
             reply_controller_receiver,
             shared_lane_queue_lengths.clone(),
             client_connection_rx,
+            shutdown.fork("real_traffic_controller"),
+            self.config.debug.traffic.packet_type,
             stats_reporter.clone(),
-            &shutdown_tracker.clone(),
         );
 
         if !self
@@ -1119,19 +972,12 @@ where
                 shared_topology_accessor.clone(),
                 message_sender,
                 stats_reporter.clone(),
-                &shutdown_tracker.clone(),
+                shutdown.fork("cover_traffic_stream"),
             );
         }
 
-        tracing::debug!("Core client startup finished!");
-        tracing::debug!("The address of this client is: {self_address}");
-
-        #[cfg(debug_assertions)]
-        #[cfg(target_arch = "wasm32")]
-        {
-            console_log!("Core client startup finished!");
-            console_log!("Rust::start_base: the address of this client is: {self_address}");
-        }
+        debug!("Core client startup finished!");
+        debug!("The address of this client is: {self_address}");
 
         Ok(BaseClient {
             address: self_address,
@@ -1140,7 +986,6 @@ where
                 client_input: ClientInput {
                     connection_command_sender: client_connection_tx,
                     input_sender,
-                    client_request_sender,
                 },
             },
             client_output: ClientOutputStatus::AwaitingConsumer {
@@ -1155,7 +1000,8 @@ where
                 gateway_connection: GatewayConnection { gateway_ws_fd },
             },
             stats_reporter,
-            shutdown_handle: shutdown_tracker, // The primary tracker for this client
+            task_handle: shutdown,
+            client_request_sender,
             forget_me: self.config.debug.forget_me,
             remember_me: self.config.debug.remember_me,
         })
@@ -1169,57 +1015,8 @@ pub struct BaseClient {
     pub client_output: ClientOutputStatus,
     pub client_state: ClientState,
     pub stats_reporter: ClientStatsSender,
-    pub shutdown_handle: ShutdownTracker,
+    pub client_request_sender: ClientRequestSender,
+    pub task_handle: TaskHandle,
     pub forget_me: ForgetMe,
     pub remember_me: RememberMe,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use nym_network_defaults::{ApiUrl, NymNetworkDetails};
-
-    #[test]
-    fn test_network_details_with_multiple_urls() {
-        // Verify that network details can be configured with multiple API URLs
-        let mut network_details = NymNetworkDetails::new_empty();
-        network_details.nym_api_urls = Some(vec![
-            ApiUrl {
-                url: "https://validator.nymtech.net/api/".to_string(),
-                front_hosts: None,
-            },
-            ApiUrl {
-                url: "https://nym-frontdoor.vercel.app/api/".to_string(),
-                front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
-            },
-        ]);
-
-        assert_eq!(network_details.nym_api_urls.as_ref().unwrap().len(), 2);
-        assert!(network_details.nym_api_urls.as_ref().unwrap()[1]
-            .front_hosts
-            .is_some());
-    }
-
-    #[test]
-    fn test_network_details_with_front_hosts() {
-        // Verify that ApiUrl can store domain fronting configuration
-        let api_url = ApiUrl {
-            url: "https://nym-frontdoor.vercel.app/api/".to_string(),
-            front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
-        };
-
-        assert_eq!(api_url.url, "https://nym-frontdoor.vercel.app/api/");
-        assert_eq!(api_url.front_hosts.as_ref().unwrap().len(), 2);
-        assert!(api_url
-            .front_hosts
-            .as_ref()
-            .unwrap()
-            .contains(&"vercel.app".to_string()));
-    }
-
-    #[test]
-    fn test_default_nym_api_retries_constant() {
-        // Verify the retry constant is set correctly
-        assert_eq!(DEFAULT_NYM_API_RETRIES, 3);
-    }
-}

common/client-core/src/client/base_client/storage/helpers.rs

@@ -4,9 +4,7 @@
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::error::ClientCoreError;
-use nym_client_core_gateways_storage::{
-    ActiveGateway, GatewayPublishedData, GatewayRegistration, GatewaysDetailsStore,
-};
+use nym_client_core_gateways_storage::{ActiveGateway, GatewayRegistration, GatewaysDetailsStore};
 use nym_crypto::asymmetric::ed25519;
 
 // helpers for error wrapping
@@ -87,23 +85,6 @@ where
         })
 }
 
-pub async fn update_stored_published_data_gateway<D>(
-    details_store: &D,
-    gateway_id: &ed25519::PublicKey,
-    published_data: &GatewayPublishedData,
-) -> Result<(), ClientCoreError>
-where
-    D: GatewaysDetailsStore,
-    D::StorageError: Send + Sync + 'static,
-{
-    details_store
-        .update_gateway_published_data(gateway_id, published_data)
-        .await
-        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
-            source: Box::new(source),
-        })
-}
-
 pub async fn load_active_gateway_details<D>(
     details_store: &D,
 ) -> Result<ActiveGateway, ClientCoreError>