fix review comments

* feat: add dockerfile

* add github workflow for node status agent

---------

Co-authored-by: Fran Arbanas <arbanasfran@gmail.com>

.github/workflows/cd-docs.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
@@ -99,24 +99,3 @@ jobs:
         run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
         continue-on-error: false
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: cd-docs
-          NYM_PROJECT_NAME: "Docs CD"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CD_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-build-ts.yml

@@ -1,6 +1,7 @@
 name: ci-build-ts
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - "ts-packages/**"
@@ -9,7 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
     - uses: actions/checkout@v4
     - name: Install rsync
@@ -45,23 +46,3 @@ jobs:
         REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
         TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/ts-${{ env.GITHUB_REF_SLUG }}-example
         EXCLUDE: "/dist/, /node_modules/"
-    - name: Matrix - Node Install
-      run: npm install
-      working-directory: .github/workflows/support-files
-    - name: Matrix - Send Notification
-      env:
-        NYM_NOTIFICATION_KIND: ts-packages
-        NYM_PROJECT_NAME: "ts-packages"
-        NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-        NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-        GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-        GIT_BRANCH: "${GITHUB_REF##*/}"
-        IS_SUCCESS: "${{ job.status == 'success' }}"
-        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-      uses: docker://keybaseio/client:stable-node
-      with:
-        args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-build-upload-binaries.yml

@@ -26,6 +26,7 @@ on:
       - "nym-api/**"
       - "nym-node/**"
       - "nym-outfox/**"
+      - 'nym-data-observatory/**'
       - "nym-validator-rewarder/**"
       - "sdk/rust/nym-sdk/**"
       - "service-providers/**"
@@ -56,7 +57,7 @@ jobs:
           echo $OUTPUT_DIR
 
       - name: Install Dependencies (Linux)
-        run: sudo apt update && sudo apt install libudev-dev
+        run: sudo apt-get update && sudo apt-get -y install libudev-dev
 
       - name: Sets env vars for tokio if set in manual dispatch inputs
         run: |
@@ -96,6 +97,7 @@ jobs:
             target/release/nym-socks5-client
             target/release/nym-api
             target/release/nym-network-requester
+            target/release/nym-data-observatory
             target/release/nym-cli
             target/release/nymvisor
             target/release/nym-node
@@ -113,6 +115,7 @@ jobs:
           cp target/release/nym-socks5-client $OUTPUT_DIR
           cp target/release/nym-api $OUTPUT_DIR
           cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nym-data-observatory $OUTPUT_DIR
           cp target/release/nymvisor $OUTPUT_DIR
           cp target/release/nym-node $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR

.github/workflows/ci-build-vpn-api-wasm.yml

@@ -0,0 +1,41 @@
+name: ci-build-vpn-api-wasm
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workflows/ci-build-vpn-api-wasm.yml'
+
+jobs:
+  wasm:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
+
+      - name: Install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+
+      - name: "Build"
+        run: make
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm

.github/workflows/ci-build.yml

@@ -16,6 +16,7 @@ on:
       - 'nym-api/**'
       - 'nym-node/**'
       - 'nym-outfox/**'
+      - 'nym-data-observatory/**'
       - 'nym-validator-rewarder/**'
       - 'tools/**'
       - 'wasm/**'
@@ -29,7 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [arc-ubuntu-20.04, custom-runner-mac-m1]
+        os: [ arc-ubuntu-20.04, custom-runner-mac-m1 ]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
@@ -56,19 +57,17 @@ jobs:
           command: fmt
           args: --all -- --check
 
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: --workspace --all-targets -- -D warnings
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
           command: build
 
-      # while disabled by default, this build ensures nothing is broken within
-      # `axum` feature
-      - name: Build with `axum` feature
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --features axum
-
       - name: Build all examples
         if: contains(matrix.os, 'ubuntu')
         uses: actions-rs/cargo@v1
@@ -89,17 +88,3 @@ jobs:
         with:
           command: test
           args: --workspace -- --ignored
-
-      - name: Annotate with clippy checks
-        if: contains(matrix.os, 'ubuntu')
-        uses: actions-rs/clippy-check@v1
-        continue-on-error: true
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: --workspace --all-targets --features axum -- -D warnings

.github/workflows/ci-cargo-deny.yml

@@ -18,8 +18,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
-    - uses: EmbarkStudios/cargo-deny-action@v1
+    - uses: EmbarkStudios/cargo-deny-action@v2
       with:
         log-level: warn
         command: check ${{ matrix.checks }}
-        argument: --all-features
+        arguments: --all-features

.github/workflows/ci-contracts-upload-binaries.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: arc-ubuntu-20.04
+        platform: [ arc-ubuntu-20.04 ]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-docs.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
       - name: Install Dependencies (Linux)
@@ -70,24 +70,3 @@ jobs:
           REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
           TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
           EXCLUDE: "/node_modules/"
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ci-docs
-          NYM_PROJECT_NAME: "Docs CI"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "docs-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_DOCS }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-lint-typescript.yml

@@ -1,6 +1,7 @@
 name: ci-lint-typescript
 
 on:
+  workflow_dispatch:
   pull_request:
     paths:
       - "ts-packages/**"
@@ -14,7 +15,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
       - uses: rlespinasse/github-slug-action@v3.x
@@ -53,24 +54,3 @@ jobs:
         run: yarn lint
       - name: Typecheck with tsc
         run: yarn tsc
-
-      - name: Matrix - Node Install
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        env:
-          NYM_NOTIFICATION_KIND: ts-packages
-          NYM_PROJECT_NAME: "ts-packages"
-          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
-          NYM_CI_WWW_LOCATION: "ts-${{ env.GITHUB_REF_SLUG }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ job.status == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/ci-nym-credential-proxy.yml

@@ -0,0 +1,45 @@
+name: ci-nym-credential-proxy
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workspace/ci-nym-credential-proxy.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: arc-ubuntu-22.04
+    env:
+      CARGO_TERM_COLOR: always
+      MANIFEST_PATH: "--manifest-path nym-credential-proxy/Cargo.toml"
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: ${{ env.MANIFEST_PATH }} --all -- --check
+
+      - name: Build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets
+
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings

.github/workflows/hello-world.yaml

@@ -0,0 +1,11 @@
+name: Hello world
+
+on:
+  workflow_dispatch:
+
+jobs:
+  my-job:
+    runs-on: arc-ubuntu-22.04
+    steps:
+      - name: my-step
+        run: echo "Hello World!"

.github/workflows/publish-sdk-npm.yml

@@ -4,7 +4,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: arc-ubuntu-20.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/push-credential-proxy.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Credential Proxy container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-credential-proxy"
+  CONTAINER_NAME: "credential-proxy"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-data-observatory.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Data observatory container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-data-observatory"
+  CONTAINER_NAME: "data-observatory"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-network-monitor.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Network monitor container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "."
+  CONTAINER_NAME: "network-monitor"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from package.json
+        uses: sergeysova/jq-action@v2
+        id: get_version
+        with:
+          cmd: jq -r '.version' ${{ env.WORKING_DIRECTORY }}/package.json
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            git push --delete origin ${{ steps.get_version.outputs.value }}
+            git tag -d ${{ steps.get_version.outputs.value }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ steps.get_version.outputs.value }} -m "Version ${{ steps.get_version.outputs.value }}"
+          git push origin ${{ steps.get_version.outputs.value }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f nym-network-monitor.dockerfile ${{ env.WORKING_DIRECTORY }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.value }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-agent.yaml

@@ -0,0 +1,56 @@
+name: Build and upload Node Status agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-agent"
+  CONTAINER_NAME: "node-status-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ steps.get_version.outputs.value }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.value }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/push-node-status-api.yaml

@@ -0,0 +1,55 @@
+name: Build and upload Node Status API container to harbor.nymte.ch
+on:
+  workflow_dispatch:
+
+env:
+  WORKING_DIRECTORY: "nym-node-status-api"
+  CONTAINER_NAME: "node-status-api"
+
+jobs:
+  build-container:
+    runs-on: arc-ubuntu-22.04-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from cargo.toml
+        uses: mikefarah/yq@v4.44.3
+        id: get_version
+        with:
+          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+
+      - name: Check if tag exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            echo "Tag ${{ steps.get_version.outputs.result }} already exists"
+          fi
+
+      - name: Remove existing tag if exists
+        run: |
+          if git rev-parse ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} >/dev/null 2>&1; then
+            git push --delete origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+            git tag -d ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+          fi
+
+      - name: Create tag
+        run: |
+          git tag -a ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }} -m "Version ${{ steps.get_version.outputs.result }}"
+          git push origin ${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}
+
+      - name: BuildAndPushImageOnHarbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:${{ steps.get_version.outputs.result }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

CHANGELOG.md

@@ -4,6 +4,156 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
+## [2024.11-wedel] (2024-09-23)
+
+- Backport #4894 to fix ci ([#4899])
+- Bugfix/ticketbook false double spending ([#4892])
+- fix: allow updating globally stored signatures ([#4891])
+- [DOCs/operators]: Document changelog for patch/2024.10-caramello ([#4886])
+- [DOCs/operators]: Post release docs updates ([#4874])
+- Bump defguard to github latest version ([#4872])
+- chore: removed completed queued mixnet migration ([#4865])
+- Disable push trigger and add missing paths in ci-build ([#4864])
+- Fix linux conditional in ci-build.yml ([#4863])
+- Remove golang workaround in ci-sdk-wasm ([#4858])
+- Revert runner for ci-docs ([#4855])
+- Move credential verification into common crate ([#4853])
+- Fix test failure in ipr request size ([#4844])
+- Start switching over jobs to arc-ubuntu-20.04 ([#4843])
+- Use ecash credential type for bandwidth value ([#4840])
+- Create nym-repo-setup debian package and nym-vpn meta package ([#4837])
+- Remove serde_crate named import ([#4832])
+- Run cargo autoinherit following last weeks dependabot updates ([#4831])
+- revamped ticketbook serialisation and exposed additional cli methods ([#4827])
+- Expose wireguard details on self described endpoint ([#4825])
+- Remove unused wireguard flag from SDK ([#4823])
+- Add `axum` server to `nym-api` ([#4803])
+- Run cargo-autoinherit for a few new crates ([#4801])
+- Update dependabot ([#4796])
+- Fix clippy for unwrap_or_default ([#4783])
+- Enable dependabot version upgrades for root rust workspace ([#4778])
+- Persist used wireguard private IPs ([#4771])
+- Avoid race on ip and registration structures ([#4766])
+- docs/hotfix ([#4765])
+- chore: remove repetitive words ([#4763])
+- Make gateway latency check generic ([#4759])
+- Remove duplicate stat count for retransmissions ([#4756])
+- Update peer refresh value ([#4754])
+- Remove deprecated mark_as_success and use new disarm ([#4751])
+- Add get_mixnodes_described to validator_client ([#4725])
+- New Network Monitor ([#4610])
+
+[#4899]: https://github.com/nymtech/nym/pull/4899
+[#4892]: https://github.com/nymtech/nym/pull/4892
+[#4891]: https://github.com/nymtech/nym/pull/4891
+[#4886]: https://github.com/nymtech/nym/pull/4886
+[#4874]: https://github.com/nymtech/nym/pull/4874
+[#4872]: https://github.com/nymtech/nym/pull/4872
+[#4865]: https://github.com/nymtech/nym/pull/4865
+[#4864]: https://github.com/nymtech/nym/pull/4864
+[#4863]: https://github.com/nymtech/nym/pull/4863
+[#4858]: https://github.com/nymtech/nym/pull/4858
+[#4855]: https://github.com/nymtech/nym/pull/4855
+[#4853]: https://github.com/nymtech/nym/pull/4853
+[#4844]: https://github.com/nymtech/nym/pull/4844
+[#4843]: https://github.com/nymtech/nym/pull/4843
+[#4840]: https://github.com/nymtech/nym/pull/4840
+[#4837]: https://github.com/nymtech/nym/pull/4837
+[#4832]: https://github.com/nymtech/nym/pull/4832
+[#4831]: https://github.com/nymtech/nym/pull/4831
+[#4827]: https://github.com/nymtech/nym/pull/4827
+[#4825]: https://github.com/nymtech/nym/pull/4825
+[#4823]: https://github.com/nymtech/nym/pull/4823
+[#4803]: https://github.com/nymtech/nym/pull/4803
+[#4801]: https://github.com/nymtech/nym/pull/4801
+[#4796]: https://github.com/nymtech/nym/pull/4796
+[#4783]: https://github.com/nymtech/nym/pull/4783
+[#4778]: https://github.com/nymtech/nym/pull/4778
+[#4771]: https://github.com/nymtech/nym/pull/4771
+[#4766]: https://github.com/nymtech/nym/pull/4766
+[#4765]: https://github.com/nymtech/nym/pull/4765
+[#4763]: https://github.com/nymtech/nym/pull/4763
+[#4759]: https://github.com/nymtech/nym/pull/4759
+[#4756]: https://github.com/nymtech/nym/pull/4756
+[#4754]: https://github.com/nymtech/nym/pull/4754
+[#4751]: https://github.com/nymtech/nym/pull/4751
+[#4725]: https://github.com/nymtech/nym/pull/4725
+[#4610]: https://github.com/nymtech/nym/pull/4610
+
 ## [2024.10-caramello] (2024-09-10)
 
 - Backport 4844 and 4845 ([#4857])

Cargo.toml

@@ -54,12 +54,14 @@ members = [
     "common/exit-policy",
     "common/gateway-requests",
     "common/gateway-storage",
+    "common/gateway-stats-storage",
     "common/http-api-client",
     "common/http-api-common",
     "common/inclusion-probability",
     "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
+    "common/models",
     "common/network-defaults",
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
@@ -81,9 +83,11 @@ members = [
     "common/nyxd-scraper",
     "common/pemstore",
     "common/serde-helpers",
+    "common/service-provider-requests-common",
     "common/socks5-client-core",
     "common/socks5/proxy-helpers",
     "common/socks5/requests",
+    "common/statistics",
     "common/store-cipher",
     "common/task",
     "common/topology",
@@ -102,6 +106,9 @@ members = [
     "mixnode",
     "sdk/lib/socks5-listener",
     "sdk/rust/nym-sdk",
+    "sdk/ffi/shared",
+    "sdk/ffi/go",
+    "sdk/ffi/cpp",
     "service-providers/authenticator",
     "service-providers/common",
     "service-providers/ip-packet-router",
@@ -110,11 +117,15 @@ members = [
     "nym-api",
     "nym-browser-extension/storage",
     "nym-api/nym-api-requests",
+    "nym-data-observatory",
     "nym-node",
     "nym-node/nym-node-http-api",
     "nym-node/nym-node-requests",
+    "nym-node-status-api",
+    "nym-node-status-agent",
     "nym-outfox",
     "nym-validator-rewarder",
+    "tools/echo-server",
     "tools/internal/ssl-inject",
     # "tools/internal/sdk-version-bump",
     "tools/internal/testnet-manager",
@@ -129,17 +140,26 @@ members = [
     "wasm/mix-fetch",
     "wasm/node-tester",
     "wasm/zknym-lib",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
+    "tools/echo-server",
+    "tools/internal/contract-state-importer/importer-cli",
+    "tools/internal/contract-state-importer/importer-contract",
 ]
 
 default-members = [
     "clients/native",
     "clients/socks5",
+    "common/models",
     "explorer-api",
     "gateway",
     "mixnode",
     "nym-api",
+    "nym-data-observatory",
     "nym-node",
+    "nym-node-status-api",
     "nym-validator-rewarder",
+    "nym-node-status-api",
     "service-providers/authenticator",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
@@ -152,7 +172,6 @@ exclude = [
     "nym-wallet",
     "nym-vpn/ui/src-tauri",
     "cpu-cycles",
-    "sdk/ffi/cpp",
 ]
 
 [workspace.package]
@@ -169,11 +188,13 @@ readme = "README.md"
 addr = "0.15.6"
 aes = "0.8.1"
 aes-gcm = "0.10.1"
-anyhow = "1.0.87"
+aes-gcm-siv = "0.11.1"
+aead = "0.5.2"
+anyhow = "1.0.90"
 argon2 = "0.5.0"
-async-trait = "0.1.82"
+async-trait = "0.1.83"
 axum = "0.7.5"
-axum-extra = "0.9.3"
+axum-extra = "0.9.4"
 base64 = "0.22.1"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
@@ -186,7 +207,7 @@ blake3 = "1.5.4"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.7.1"
+bytes = "1.7.2"
 cargo_metadata = "0.18.1"
 celes = "2.4.0"
 cfg-if = "1.0.0"
@@ -194,11 +215,11 @@ chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.31"
 cipher = "0.4.3"
-clap = "4.5.17"
+clap = "4.5.20"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.0"
-comfy-table = "6.0.0"
+comfy-table = "7.1.1"
 console = "0.15.8"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
@@ -210,7 +231,8 @@ ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.4.2"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
 dirs = "5.0"
 doc-comment = "0.3"
@@ -218,13 +240,15 @@ dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
 etherparse = "0.13.0"
+envy = "0.4"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.0.33"
+flate2 = "1.0.34"
 futures = "0.3.28"
+futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getset = "0.1.1"
+getset = "0.1.3"
 handlebars = "3.5.5"
 headers = "0.4.0"
 hex = "0.4.3"
@@ -232,10 +256,12 @@ hex-literal = "0.3.3"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
+http-body-util = "0.1"
 httpcodec = "0.2.3"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
-hyper = "1.3.1"
+hyper = "1.4.1"
+hyper-util = "0.1"
 indicatif = "0.17.8"
 inquire = "0.6.2"
 ip_network = "0.4.1"
@@ -249,6 +275,7 @@ ledger-transport-hid = "0.10.0"
 log = "0.4"
 maxminddb = "0.23.0"
 mime = "0.3.17"
+moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
 okapi = "0.7.0"
@@ -258,7 +285,8 @@ opentelemetry-jaeger = "0.18.0"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
-pin-project = "1.0"
+pin-project = "1.1"
+pin-project-lite = "0.2.14"
 pretty_env_logger = "0.4.0"
 publicsuffix = "2.2.3"
 quote = "1"
@@ -274,32 +302,35 @@ reqwest = { version = "0.12.4", default-features = false }
 rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
-safer-ffi = "0.1.12"
+safer-ffi = "0.1.13"
 schemars = "0.8.21"
 semver = "1.0.23"
-serde = "1.0.210"
+serde = "1.0.211"
 serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.128"
+serde_json = "1.0.132"
+serde_json_path = "0.6.7"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
 sphinx-packet = "0.1.1"
-sqlx = "0.6.3"
+sqlx = "0.7.4"
 strum = "0.26"
+strum_macros = "0.26"
 subtle-encoding = "0.5"
 syn = "1"
-sysinfo = "0.30.12"
+sysinfo = "0.30.13"
 tap = "1.0.1"
-tar = "0.4.41"
+tar = "0.4.42"
 tempfile = "3.5.0"
-thiserror = "1.0.63"
+thiserror = "1.0.64"
 time = "0.3.30"
 tokio = "1.39"
 tokio-stream = "0.1.16"
 tokio-test = "0.4.4"
+tokio-tun = "0.11.5"
 tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.12"
 toml = "0.8.14"
@@ -309,11 +340,11 @@ tracing = "0.1.37"
 tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.16"
 tracing-tree = "0.2.2"
-ts-rs = "7.0.0"
+tracing-log = "0.2"
+ts-rs = "10.0.0"
 tungstenite = { version = "0.20.1", default-features = false }
 url = "2.5"
 utoipa = "4.2"
-utoipa-rapidoc = "4.0"
 utoipa-swagger-ui = "7.1"
 utoipauto = "0.1"
 uuid = "*"
@@ -332,9 +363,9 @@ prometheus = { version = "0.13.0" }
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }
+subtle = "2.5.0"
 
 # cosmwasm-related
-cosmwasm-derive = "=1.4.3"
 cosmwasm-schema = "=1.4.3"
 cosmwasm-std = "=1.4.3"
 # use 0.5.0 as that's the version used by cosmwasm-std 1.4.3
@@ -371,14 +402,20 @@ indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", bra
 js-sys = "0.3.70"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
-wasm-bindgen = "0.2.93"
-wasm-bindgen-futures = "0.4.43"
+wasm-bindgen = "0.2.95"
+wasm-bindgen-futures = "0.4.45"
 wasmtimer = "0.2.0"
-web-sys = "0.3.70"
+web-sys = "0.3.72"
 
 
 # Profile settings for individual crates
 
+# Compile-time verified queries do quite a bit of work at compile time. Incremental
+#  actions like cargo check and cargo build can be significantly faster when
+# using an optimized build
+[profile.dev.package.sqlx-macros]
+opt-level = 3
+
 [profile.release.package.nym-socks5-listener]
 strip = true
 codegen-units = 1

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.40"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.40"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/authenticator-requests/Cargo.toml

@@ -9,9 +9,24 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
+base64 = { workspace = true }
 bincode = { workspace = true }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
 
+nym-credentials-interface = { path = "../credentials-interface" }
+nym-crypto = { path = "../crypto", features = ["asymmetric"] }
+nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-wireguard-types = { path = "../wireguard-types" }
+
+## verify:
+hmac = { workspace = true, optional = true }
+sha2 = { workspace = true, optional = true }
+x25519-dalek = { workspace = true, features = ["static_secrets"] }
+
+[features]
+default = ["verify"]
+# this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
+verify = ["hmac", "sha2"]

common/authenticator-requests/src/error.rs

@@ -0,0 +1,25 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("the provided base64-encoded client MAC ('{mac}') was malformed: {source}")]
+    MalformedClientMac {
+        mac: String,
+        #[source]
+        source: base64::DecodeError,
+    },
+
+    #[cfg(feature = "verify")]
+    #[error("failed to verify mac provided by '{client}': {source}")]
+    FailedClientMacVerification {
+        client: String,
+        #[source]
+        source: hmac::digest::MacError,
+    },
+
+    #[error("conversion: {0}")]
+    Conversion(String),
+}

common/authenticator-requests/src/lib.rs

@@ -2,8 +2,15 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub mod v1;
+pub mod v2;
+pub mod v3;
 
-pub const CURRENT_VERSION: u8 = 1;
+mod error;
+
+pub use error::Error;
+pub use v3 as latest;
+
+pub const CURRENT_VERSION: u8 = 3;
 
 fn make_bincode_serializer() -> impl bincode::Options {
     use bincode::Options;

common/authenticator-requests/src/v1/mod.rs

@@ -1,7 +1,13 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+pub mod registration;
 pub mod request;
 pub mod response;
 
-const VERSION: u8 = 1;
+pub use registration::{ClientMac, GatewayClient, InitMessage, Nonce};
+
+#[cfg(feature = "verify")]
+pub use registration::HmacSha256;
+
+pub const VERSION: u8 = 1;

common/authenticator-requests/src/v1/registration.rs

@@ -0,0 +1,218 @@
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: i64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: u64,
+    pub suspended: bool,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}

common/authenticator-requests/src/v1/request.rs

@@ -1,8 +1,9 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use super::registration::{GatewayClient, InitMessage};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::{GatewayClient, InitMessage, PeerPublicKey};
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 
 use crate::make_bincode_serializer;
@@ -82,3 +83,24 @@ pub enum AuthenticatorRequestData {
     Final(GatewayClient),
     QueryBandwidth(PeerPublicKey),
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_byte_version() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            version,
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = data.to_bytes().unwrap();
+        assert_eq!(*bytes.first().unwrap(), version);
+    }
+}

common/authenticator-requests/src/v1/response.rs

@@ -1,8 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
-use nym_wireguard_types::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use serde::{Deserialize, Serialize};
 
 use crate::make_bincode_serializer;

common/authenticator-requests/src/v2/conversion.rs

@@ -0,0 +1,174 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v1, v2};
+
+impl From<v1::request::AuthenticatorRequest> for v2::request::AuthenticatorRequest {
+    fn from(authenticator_request: v1::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v1::request::AuthenticatorRequestData> for v2::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v1::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v1::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v2::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v1::request::AuthenticatorRequestData::Final(gw_client) => {
+                v2::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v1::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v1::registration::InitMessage> for v2::registration::InitMessage {
+    fn from(init_msg: v1::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<v1::registration::GatewayClient> for Box<v2::registration::FinalMessage> {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Box::new(v2::registration::FinalMessage {
+            gateway_client: gw_client.into(),
+            credential: None,
+        })
+    }
+}
+
+impl From<v1::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v1::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v1::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v1::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v1::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::registration::ClientMac> for v1::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v2::response::AuthenticatorResponse> for v1::response::AuthenticatorResponse {
+    fn from(authenticator_response: v2::response::AuthenticatorResponse) -> Self {
+        Self {
+            version: authenticator_response.protocol.version,
+            data: authenticator_response.data.into(),
+            reply_to: authenticator_response.reply_to,
+        }
+    }
+}
+
+impl From<v2::response::AuthenticatorResponseData> for v1::response::AuthenticatorResponseData {
+    fn from(authenticator_response_data: v2::response::AuthenticatorResponseData) -> Self {
+        match authenticator_response_data {
+            v2::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => v1::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response.into(),
+            ),
+            v2::response::AuthenticatorResponseData::Registered(registered_response) => {
+                v1::response::AuthenticatorResponseData::Registered(registered_response.into())
+            }
+            v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => v1::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            ),
+        }
+    }
+}
+
+impl From<v2::response::PendingRegistrationResponse> for v1::response::PendingRegistrationResponse {
+    fn from(value: v2::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RegisteredResponse> for v1::response::RegisteredResponse {
+    fn from(value: v2::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v2::response::RemainingBandwidthResponse> for v1::response::RemainingBandwidthResponse {
+    fn from(value: v2::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v2::registration::RegistrationData> for v1::registration::RegistrationData {
+    fn from(value: v2::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v2::registration::RemainingBandwidthData> for v1::registration::RemainingBandwidthData {
+    fn from(value: v2::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth as u64,
+            suspended: false,
+        }
+    }
+}

common/authenticator-requests/src/v2/mod.rs

@@ -0,0 +1,9 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+
+pub const VERSION: u8 = 2;

common/authenticator-requests/src/v2/registration.rs

@@ -1,9 +1,10 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::Error;
-use crate::PeerPublicKey;
 use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::net::IpAddr;
@@ -29,32 +30,26 @@ pub type Taken = Option<SystemTime>;
 pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
-pub enum ClientMessage {
-    Initial(InitMessage),
-    Final(GatewayClient),
-    Query(PeerPublicKey),
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct InitMessage {
     /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
     pub pub_key: PeerPublicKey,
 }
 
 impl InitMessage {
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
     pub fn new(pub_key: PeerPublicKey) -> Self {
         InitMessage { pub_key }
     }
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RegistrationData {
     pub nonce: u64,
@@ -71,24 +66,20 @@ pub struct RegistredData {
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct RemainingBandwidthData {
-    pub available_bandwidth: u64,
-    pub suspended: bool,
+    pub available_bandwidth: i64,
 }
 
 /// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
 #[derive(Serialize, Deserialize, Debug, Clone)]
-#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct GatewayClient {
     /// Base64 encoded x25519 public key
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
     pub pub_key: PeerPublicKey,
 
     /// Assigned private IP
     pub private_ip: IpAddr,
 
     /// Sha256 hmac on the data (alongside the prior nonce)
-    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
     pub mac: ClientMac,
 }
 

common/authenticator-requests/src/v2/request.rs

@@ -0,0 +1,116 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{FinalMessage, InitMessage};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}

common/authenticator-requests/src/v2/response.rs

@@ -0,0 +1,129 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}

common/authenticator-requests/src/v3/conversion.rs

@@ -0,0 +1,188 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+
+use crate::{v2, v3};
+
+impl From<v2::request::AuthenticatorRequest> for v3::request::AuthenticatorRequest {
+    fn from(authenticator_request: v2::request::AuthenticatorRequest) -> Self {
+        Self {
+            protocol: Protocol {
+                version: 2,
+                service_provider_type: ServiceProviderType::Authenticator,
+            },
+            data: authenticator_request.data.into(),
+            reply_to: authenticator_request.reply_to,
+            request_id: authenticator_request.request_id,
+        }
+    }
+}
+
+impl From<v2::request::AuthenticatorRequestData> for v3::request::AuthenticatorRequestData {
+    fn from(authenticator_request_data: v2::request::AuthenticatorRequestData) -> Self {
+        match authenticator_request_data {
+            v2::request::AuthenticatorRequestData::Initial(init_msg) => {
+                v3::request::AuthenticatorRequestData::Initial(init_msg.into())
+            }
+            v2::request::AuthenticatorRequestData::Final(gw_client) => {
+                v3::request::AuthenticatorRequestData::Final(gw_client.into())
+            }
+            v2::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
+                v3::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
+            }
+        }
+    }
+}
+
+impl From<v2::registration::InitMessage> for v3::registration::InitMessage {
+    fn from(init_msg: v2::registration::InitMessage) -> Self {
+        Self {
+            pub_key: init_msg.pub_key,
+        }
+    }
+}
+
+impl From<Box<v2::registration::FinalMessage>> for Box<v3::registration::FinalMessage> {
+    fn from(gw_client: Box<v2::registration::FinalMessage>) -> Self {
+        Box::new(v3::registration::FinalMessage {
+            gateway_client: gw_client.gateway_client.into(),
+            credential: gw_client.credential,
+        })
+    }
+}
+
+impl From<v2::registration::GatewayClient> for v3::registration::GatewayClient {
+    fn from(gw_client: v2::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v3::registration::GatewayClient> for v2::registration::GatewayClient {
+    fn from(gw_client: v3::registration::GatewayClient) -> Self {
+        Self {
+            pub_key: gw_client.pub_key,
+            private_ip: gw_client.private_ip,
+            mac: gw_client.mac.into(),
+        }
+    }
+}
+
+impl From<v2::registration::ClientMac> for v3::registration::ClientMac {
+    fn from(mac: v2::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl From<v3::registration::ClientMac> for v2::registration::ClientMac {
+    fn from(mac: v3::registration::ClientMac) -> Self {
+        Self::new(mac.to_vec())
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponse> for v2::response::AuthenticatorResponse {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response: v3::response::AuthenticatorResponse,
+    ) -> Result<Self, Self::Error> {
+        Ok(Self {
+            data: authenticator_response.data.try_into()?,
+            reply_to: authenticator_response.reply_to,
+            protocol: authenticator_response.protocol,
+        })
+    }
+}
+
+impl TryFrom<v3::response::AuthenticatorResponseData> for v2::response::AuthenticatorResponseData {
+    type Error = crate::Error;
+
+    fn try_from(
+        authenticator_response_data: v3::response::AuthenticatorResponseData,
+    ) -> Result<Self, Self::Error> {
+        match authenticator_response_data {
+            v3::response::AuthenticatorResponseData::PendingRegistration(
+                pending_registration_response,
+            ) => Ok(
+                v2::response::AuthenticatorResponseData::PendingRegistration(
+                    pending_registration_response.into(),
+                ),
+            ),
+            v3::response::AuthenticatorResponseData::Registered(registered_response) => Ok(
+                v2::response::AuthenticatorResponseData::Registered(registered_response.into()),
+            ),
+            v3::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response,
+            ) => Ok(v2::response::AuthenticatorResponseData::RemainingBandwidth(
+                remaining_bandwidth_response.into(),
+            )),
+            v3::response::AuthenticatorResponseData::TopUpBandwidth(_) => {
+                Err(Self::Error::Conversion(
+                    "a v2 request couldn't produce a v3 only type of response".to_string(),
+                ))
+            }
+        }
+    }
+}
+
+impl From<v3::response::PendingRegistrationResponse> for v2::response::PendingRegistrationResponse {
+    fn from(value: v3::response::PendingRegistrationResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RegisteredResponse> for v2::response::RegisteredResponse {
+    fn from(value: v3::response::RegisteredResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.into(),
+        }
+    }
+}
+
+impl From<v3::response::RemainingBandwidthResponse> for v2::response::RemainingBandwidthResponse {
+    fn from(value: v3::response::RemainingBandwidthResponse) -> Self {
+        Self {
+            request_id: value.request_id,
+            reply_to: value.reply_to,
+            reply: value.reply.map(Into::into),
+        }
+    }
+}
+
+impl From<v3::registration::RegistrationData> for v2::registration::RegistrationData {
+    fn from(value: v3::registration::RegistrationData) -> Self {
+        Self {
+            nonce: value.nonce,
+            gateway_data: value.gateway_data.into(),
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
+        Self {
+            pub_key: value.pub_key,
+            private_ip: value.private_ip,
+            wg_port: value.wg_port,
+        }
+    }
+}
+
+impl From<v3::registration::RemainingBandwidthData> for v2::registration::RemainingBandwidthData {
+    fn from(value: v3::registration::RemainingBandwidthData) -> Self {
+        Self {
+            available_bandwidth: value.available_bandwidth,
+        }
+    }
+}

common/authenticator-requests/src/v3/mod.rs

@@ -0,0 +1,10 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod conversion;
+pub mod registration;
+pub mod request;
+pub mod response;
+pub mod topup;
+
+pub const VERSION: u8 = 3;

common/authenticator-requests/src/v3/registration.rs

@@ -0,0 +1,227 @@
+// -2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::Error;
+use base64::{engine::general_purpose, Engine};
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::IpAddr;
+use std::time::SystemTime;
+use std::{fmt, ops::Deref, str::FromStr};
+
+#[cfg(feature = "verify")]
+use hmac::{Hmac, Mac};
+#[cfg(feature = "verify")]
+use nym_crypto::asymmetric::encryption::PrivateKey;
+#[cfg(feature = "verify")]
+use sha2::Sha256;
+
+pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
+pub type PrivateIPs = HashMap<IpAddr, Taken>;
+
+#[cfg(feature = "verify")]
+pub type HmacSha256 = Hmac<Sha256>;
+
+pub type Nonce = u64;
+pub type Taken = Option<SystemTime>;
+
+pub const BANDWIDTH_CAP_PER_DAY: u64 = 1024 * 1024 * 1024; // 1 GB
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct InitMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+}
+
+impl InitMessage {
+    pub fn new(pub_key: PeerPublicKey) -> Self {
+        InitMessage { pub_key }
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct FinalMessage {
+    /// Gateway client data
+    pub gateway_client: GatewayClient,
+
+    /// Ecash credential
+    pub credential: Option<CredentialSpendingData>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistrationData {
+    pub nonce: u64,
+    pub gateway_data: GatewayClient,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RegistredData {
+    pub pub_key: PeerPublicKey,
+    pub private_ip: IpAddr,
+    pub wg_port: u16,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct RemainingBandwidthData {
+    pub available_bandwidth: i64,
+}
+
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Gateway/Nym node can then verify pub_key payload using the same process
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct GatewayClient {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Assigned private IP
+    pub private_ip: IpAddr,
+
+    /// Sha256 hmac on the data (alongside the prior nonce)
+    pub mac: ClientMac,
+}
+
+impl GatewayClient {
+    #[cfg(feature = "verify")]
+    pub fn new(
+        local_secret: &PrivateKey,
+        remote_public: x25519_dalek::PublicKey,
+        private_ip: IpAddr,
+        nonce: u64,
+    ) -> Self {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
+        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+
+        let dh = static_secret.diffie_hellman(&remote_public);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(local_public.as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        GatewayClient {
+            pub_key: PeerPublicKey::new(local_public),
+            private_ip,
+            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
+        }
+    }
+
+    // Reusable secret should be gateways Wireguard PK
+    // Client should perform this step when generating its payload, using its own WG PK
+    #[cfg(feature = "verify")]
+    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
+        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
+        #[allow(clippy::expect_used)]
+        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+
+        let dh = static_secret.diffie_hellman(&self.pub_key);
+
+        // TODO: change that to use our nym_crypto::hmac module instead
+        #[allow(clippy::expect_used)]
+        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
+            .expect("x25519 shared secret is always 32 bytes long");
+
+        mac.update(self.pub_key.as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(&nonce.to_le_bytes());
+
+        mac.verify_slice(&self.mac)
+            .map_err(|source| Error::FailedClientMacVerification {
+                client: self.pub_key.to_string(),
+                source,
+            })
+    }
+
+    pub fn pub_key(&self) -> PeerPublicKey {
+        self.pub_key
+    }
+}
+
+// TODO: change the inner type into generic array of size HmacSha256::OutputSize
+// TODO2: rely on our internal crypto/hmac
+#[derive(Debug, Clone)]
+pub struct ClientMac(Vec<u8>);
+
+impl fmt::Display for ClientMac {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
+    }
+}
+
+impl ClientMac {
+    #[allow(dead_code)]
+    pub fn new(mac: Vec<u8>) -> Self {
+        ClientMac(mac)
+    }
+}
+
+impl Deref for ClientMac {
+    type Target = Vec<u8>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl FromStr for ClientMac {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let mac_bytes: Vec<u8> =
+            general_purpose::STANDARD
+                .decode(s)
+                .map_err(|source| Error::MalformedClientMac {
+                    mac: s.to_string(),
+                    source,
+                })?;
+
+        Ok(ClientMac(mac_bytes))
+    }
+}
+
+impl Serialize for ClientMac {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
+        serializer.serialize_str(&encoded_key)
+    }
+}
+
+impl<'de> Deserialize<'de> for ClientMac {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let encoded_key = String::deserialize(deserializer)?;
+        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_crypto::asymmetric::encryption;
+
+    #[test]
+    #[cfg(feature = "verify")]
+    fn client_request_roundtrip() {
+        let mut rng = rand::thread_rng();
+
+        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let client_key_pair = encryption::KeyPair::new(&mut rng);
+
+        let nonce = 1234567890;
+
+        let client = GatewayClient::new(
+            client_key_pair.private_key(),
+            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
+            "10.0.0.42".parse().unwrap(),
+            nonce,
+        );
+        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
+    }
+}

common/authenticator-requests/src/v3/request.rs

@@ -0,0 +1,136 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::{
+    registration::{FinalMessage, InitMessage},
+    topup::TopUpMessage,
+};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub protocol: Protocol,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(final_message: FinalMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::Final(Box::new(final_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_topup_request(top_up_message: TopUpMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                protocol: Protocol {
+                    service_provider_type: ServiceProviderType::Authenticator,
+                    version: VERSION,
+                },
+                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(Box<FinalMessage>),
+    QueryBandwidth(PeerPublicKey),
+    TopUpBandwidth(Box<TopUpMessage>),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::str::FromStr;
+
+    #[test]
+    fn check_first_bytes_protocol() {
+        let version = 2;
+        let data = AuthenticatorRequest {
+            protocol: Protocol { version, service_provider_type: ServiceProviderType::Authenticator },
+            data: AuthenticatorRequestData::Initial(InitMessage::new(
+                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
+            )),
+            reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+            request_id: 1,
+        };
+        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
+        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
+    }
+}

common/authenticator-requests/src/v3/response.rs

@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
+use nym_sphinx::addressing::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub protocol: Protocol,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_topup_bandwidth(
+        remaining_bandwidth_data: RemainingBandwidthData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            protocol: Protocol {
+                service_provider_type: ServiceProviderType::Authenticator,
+                version: VERSION,
+            },
+            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+    TopUpBandwidth(TopUpBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct TopUpBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RemainingBandwidthData,
+}

common/authenticator-requests/src/v3/topup.rs

@@ -0,0 +1,15 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_wireguard_types::PeerPublicKey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct TopUpMessage {
+    /// Base64 encoded x25519 public key
+    pub pub_key: PeerPublicKey,
+
+    /// Ecash credential
+    pub credential: CredentialSpendingData,
+}

common/bandwidth-controller/Cargo.toml

@@ -18,7 +18,7 @@ nym-ecash-time = { path = "../ecash-time" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
+nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
 nym-network-defaults = { path = "../network-defaults" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }

common/bandwidth-controller/src/lib.rs

@@ -16,7 +16,7 @@ use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
 use nym_credentials::ecash::bandwidth::CredentialSpendingData;
 use nym_credentials_interface::{
-    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, TicketType, VerificationKeyAuth,
 };
 use nym_ecash_time::Date;
 use nym_validator_client::nym_api::EpochId;
@@ -64,9 +64,10 @@ impl<C, St: Storage> BandwidthController<C, St> {
         BandwidthController { storage, client }
     }
 
-    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
+    /// Tries to retrieve one of the stored, unused credentials for the given type that hasn't yet expired.
     pub async fn get_next_usable_ticketbook(
         &self,
+        ticketbook_type: TicketType,
         tickets: u32,
     ) -> Result<RetrievedTicketbook, BandwidthControllerError>
     where
@@ -74,7 +75,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
     {
         let Some(ticketbook) = self
             .storage
-            .get_next_unspent_usable_ticketbook(tickets)
+            .get_next_unspent_usable_ticketbook(ticketbook_type.to_string(), tickets)
             .await
             .map_err(BandwidthControllerError::credential_storage_error)?
         else {
@@ -181,6 +182,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
 
     pub async fn prepare_ecash_ticket(
         &self,
+        ticketbook_type: TicketType,
         provider_pk: [u8; 32],
         tickets_to_spend: u32,
     ) -> Result<PreparedCredential, BandwidthControllerError>
@@ -188,7 +190,9 @@ impl<C, St: Storage> BandwidthController<C, St> {
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        let retrieved_ticketbook = self.get_next_usable_ticketbook(tickets_to_spend).await?;
+        let retrieved_ticketbook = self
+            .get_next_usable_ticketbook(ticketbook_type, tickets_to_spend)
+            .await?;
 
         let ticketbook_id = retrieved_ticketbook.ticketbook_id;
         let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();

common/bin-common/Cargo.toml

@@ -8,14 +8,14 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-const-str = { workspace = true }
 clap = { workspace = true, features = ["derive"], optional = true }
 clap_complete = { workspace = true, optional = true }
 clap_complete_fig = { workspace = true, optional = true }
+const-str = { workspace = true }
 log = { workspace = true }
 pretty_env_logger = { workspace = true }
-semver = "0.11"
 schemars = { workspace = true, features = ["preserve_order"], optional = true }
+semver.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }
 
@@ -45,3 +45,4 @@ tracing = [
     "opentelemetry",
 ]
 clap = [ "dep:clap", "dep:clap_complete", "dep:clap_complete_fig" ]
+models = []

common/bin-common/src/version_checker/mod.rs

@@ -1,9 +1,10 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use semver::SemVerError;
 pub use semver::Version;
 
+/// Checks if the version is minor version compatible.
+///
 /// Checks whether given `version` is compatible with a given semantic version requirement `req`
 /// according to major-minor semver rules. The semantic version requirement can be passed as a full,
 /// concrete version number, because that's what we'll have in our Cargo.toml files (e.g. 0.3.2).
@@ -22,7 +23,7 @@ pub fn is_minor_version_compatible(version: &str, req: &str) -> bool {
     expected_version.major == req_version.major && expected_version.minor == req_version.minor
 }
 
-pub fn parse_version(raw_version: &str) -> Result<Version, SemVerError> {
+pub fn parse_version(raw_version: &str) -> Result<Version, semver::Error> {
     Version::parse(raw_version)
 }
 

common/client-core/Cargo.toml

@@ -14,7 +14,7 @@ base64 = { workspace = true }
 bs58 = { workspace = true }
 cfg-if = { workspace = true }
 clap = { workspace = true, optional = true }
-comfy-table = { version = "7.1.1", optional = true }
+comfy-table = { workspace = true, optional = true }
 futures = { workspace = true }
 humantime-serde = { workspace = true }
 log = { workspace = true }
@@ -59,19 +59,19 @@ nym-ecash-time = { path = "../ecash-time" }
 
 ### For serving prometheus metrics
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
-version = "1"
+workspace = true
 features = ["server", "http1"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.http-body-util]
-version = "0.1"
+workspace = true
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
-version = "0.1"
+workspace = true
 features = ["tokio"]
 ###
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
-version = "0.1.16"
+workspace = true
 features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio]
@@ -110,7 +110,7 @@ path = "../wasm/utils"
 features = ["websocket"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.time]
-version = "0.3.17"
+workspace = true
 features = ["wasm-bindgen"]
 
 [dev-dependencies]

common/client-core/gateways-storage/.sqlx/query-06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'",
+  "describe": {
+    "columns": [
+      {
+        "name": "exists",
+        "ordinal": 0,
+        "type_info": "Int"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"
+}

common/client-core/gateways-storage/.sqlx/query-0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985.json

@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}

common/client-core/gateways-storage/.sqlx/query-0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}

common/client-core/gateways-storage/.sqlx/query-1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "1da6904e72b5abb9abf75affb13af7974d7795b4cbdba234273345fe161df233"
+}

common/client-core/gateways-storage/.sqlx/query-4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "4f78619aca933484cd67cb89a376b2a5bec1c191993ff58f0c71c03e3ef6d92d"
+}

common/client-core/gateways-storage/.sqlx/query-54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "data",
+        "ordinal": 1,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "54f552a9dbe95236f946ac2b6615e03504afa58e345ae16a128629d8e76f0a11"
+}

common/client-core/gateways-storage/.sqlx/query-5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT gateway_id_bs58 FROM registered_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5661cf1ad8bd5ca062e855e1971a8787133ee41814bd3efdd501f9ee0c050f2b"
+}

common/client-core/gateways-storage/.sqlx/query-80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "UPDATE active_gateway SET active_gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "80476cf2906eb0ecf7f66c16bc5682169b87f488b6927fa67fade6bf5abf7582"
+}

common/client-core/gateways-storage/.sqlx/query-8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
+}

common/client-core/gateways-storage/.sqlx/query-a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}

common/client-core/gateways-storage/.sqlx/query-b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
+}

common/client-core/gateways-storage/.sqlx/query-bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT active_gateway_id_bs58 FROM active_gateway",
+  "describe": {
+    "columns": [
+      {
+        "name": "active_gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bf249752f08c283bf5942b6ff48125c24750b523cfcad1e5e9069dbf7050e2a1"
+}

common/client-core/gateways-storage/.sqlx/query-f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM registered_gateway WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": []
+  },
+  "hash": "f3ebe259e26c05ecdd33bd9085dbb91cd5046a8c9d4434cf085a4fa2ebf03e93"
+}

common/client-core/gateways-storage/fs_gateways_migrations/20240916120000_add_aes256_gcm_siv_key.sql

@@ -0,0 +1,13 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+-- make aes128 key column nullable and add aes256 column
+ALTER TABLE remote_gateway_details RENAME COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58 TO derived_aes128_ctr_blake3_hmac_keys_bs58_old;
+ALTER TABLE remote_gateway_details ADD COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58 TEXT;
+ALTER TABLE remote_gateway_details ADD COLUMN derived_aes256_gcm_siv_key BLOB;
+
+UPDATE remote_gateway_details SET derived_aes128_ctr_blake3_hmac_keys_bs58 = derived_aes128_ctr_blake3_hmac_keys_bs58_old;
+
+ALTER TABLE remote_gateway_details DROP COLUMN derived_aes128_ctr_blake3_hmac_keys_bs58_old;

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -29,11 +29,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
+            .create_if_missing(true)
+            .disable_statement_logging();
 
         let connection_pool = sqlx::SqlitePool::connect_with(opts)
             .await
@@ -82,7 +81,7 @@ impl StorageManager {
         sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
             .fetch_one(&self.connection_pool)
             .await
-            .map(|result| result.exists == 1)
+            .map(|result| result.exists == Some(1))
     }
 
     pub(crate) async fn maybe_get_registered_gateway(
@@ -155,11 +154,12 @@ impl StorageManager {
     ) -> Result<(), sqlx::Error> {
         sqlx::query!(
             r#"
-                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, gateway_owner_address, gateway_listener) 
-                VALUES (?, ?, ?, ?)
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)
+                VALUES (?, ?, ?, ?, ?)
             "#,
             remote.gateway_id_bs58,
             remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            remote.derived_aes256_gcm_siv_key,
             remote.gateway_owner_address,
             remote.gateway_listener,
         )
@@ -168,6 +168,30 @@ impl StorageManager {
         Ok(())
     }
 
+    pub(crate) async fn update_remote_gateway_key(
+        &self,
+        gateway_id_bs58: &str,
+        derived_aes128_ctr_blake3_hmac_keys_bs58: Option<&str>,
+        derived_aes256_gcm_siv_key: Option<&[u8]>,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                UPDATE remote_gateway_details
+                SET
+                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,
+                    derived_aes256_gcm_siv_key = ?
+                WHERE gateway_id_bs58 = ?
+            "#,
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
+            gateway_id_bs58
+        )
+        .execute(&self.connection_pool)
+        .await?;
+
+        Ok(())
+    }
+
     pub(crate) async fn remove_remote_gateway_details(
         &self,
         gateway_id: &str,

common/client-core/gateways-storage/src/backend/fs_backend/mod.rs

@@ -7,7 +7,8 @@ use crate::{
 };
 use async_trait::async_trait;
 use manager::StorageManager;
-use nym_crypto::asymmetric::identity::PublicKey;
+use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::path::Path;
 
 pub mod error;
@@ -67,7 +68,7 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
         Ok(registered)
     }
 
-    async fn all_gateways_identities(&self) -> Result<Vec<PublicKey>, Self::StorageError> {
+    async fn all_gateways_identities(&self) -> Result<Vec<ed25519::PublicKey>, Self::StorageError> {
         Ok(self
             .manager
             .registered_gateways()
@@ -132,6 +133,21 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
         Ok(())
     }
 
+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError> {
+        self.manager
+            .update_remote_gateway_key(
+                &gateway_id.to_base58_string(),
+                None,
+                Some(updated_key.as_bytes()),
+            )
+            .await?;
+        Ok(())
+    }
+
     // ideally all of those should be run under a storage tx to ensure storage consistency,
     // but at that point it's fine
     async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {

common/client-core/gateways-storage/src/backend/mem_backend.rs

@@ -2,8 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::types::{ActiveGateway, GatewayRegistration};
-use crate::{BadGateway, GatewaysDetailsStore};
+use crate::{BadGateway, GatewayDetails, GatewaysDetailsStore};
 use async_trait::async_trait;
+use nym_crypto::asymmetric::ed25519::PublicKey;
+use nym_gateway_requests::{SharedGatewayKey, SharedSymmetricKey};
 use std::collections::HashMap;
 use std::sync::Arc;
 use thiserror::Error;
@@ -34,10 +36,6 @@ struct InMemStorageInner {
 impl GatewaysDetailsStore for InMemGatewaysDetails {
     type StorageError = InMemStorageError;
 
-    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
-        Ok(self.inner.read().await.gateways.contains_key(gateway_id))
-    }
-
     async fn active_gateway(&self) -> Result<ActiveGateway, Self::StorageError> {
         let guard = self.inner.read().await;
 
@@ -68,6 +66,10 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
         Ok(self.inner.read().await.gateways.values().cloned().collect())
     }
 
+    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
+        Ok(self.inner.read().await.gateways.contains_key(gateway_id))
+    }
+
     async fn load_gateway_details(
         &self,
         gateway_id: &str,
@@ -94,6 +96,29 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
         Ok(())
     }
 
+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError> {
+        let mut guard = self.inner.write().await;
+
+        #[allow(clippy::unwrap_used)]
+        if let Some(target) = guard.gateways.get_mut(&gateway_id.to_string()) {
+            let GatewayDetails::Remote(details) = &mut target.details else {
+                return Ok(());
+            };
+            assert_eq!(Arc::strong_count(&details.shared_key), 1);
+
+            // eh. that's nasty, but it's only ever used for ephemeral clients so should be fine for now...
+            details.shared_key = Arc::new(SharedGatewayKey::Current(
+                SharedSymmetricKey::try_from_bytes(updated_key.as_bytes()).unwrap(),
+            ))
+        }
+
+        Ok(())
+    }
+
     async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
         let mut guard = self.inner.write().await;
         if let Some(active) = guard.active_gateway.as_ref() {

common/client-core/gateways-storage/src/error.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
-use nym_gateway_requests::registration::handshake::shared_key::SharedKeyConversionError;
+use nym_gateway_requests::shared_key::SharedKeyConversionError;
 use thiserror::Error;
 
 #[derive(Debug, Error)]
@@ -36,6 +36,9 @@ pub enum BadGateway {
         source: SharedKeyConversionError,
     },
 
+    #[error("could not find any valid shared keys for gateway {gateway_id}")]
+    MissingSharedKey { gateway_id: String },
+
     #[error(
         "the listening address of gateway {gateway_id} ({raw_listener}) is malformed: {source}"
     )]

common/client-core/gateways-storage/src/lib.rs

@@ -5,6 +5,8 @@
 #![warn(clippy::unwrap_used)]
 
 use async_trait::async_trait;
+use nym_crypto::asymmetric::identity;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;
 
 pub mod backend;
@@ -18,7 +20,6 @@ pub use error::BadGateway;
 
 #[cfg(all(not(target_arch = "wasm32"), feature = "fs-gateways-storage"))]
 pub use backend::fs_backend::{error::StorageError, OnDiskGatewaysDetails};
-use nym_crypto::asymmetric::identity;
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -61,6 +62,12 @@ pub trait GatewaysDetailsStore {
         details: &GatewayRegistration,
     ) -> Result<(), Self::StorageError>;
 
+    async fn upgrade_stored_remote_gateway_key(
+        &self,
+        gateway_id: identity::PublicKey,
+        updated_key: &SharedSymmetricKey,
+    ) -> Result<(), Self::StorageError>;
+
     /// Remove given gateway details from the underlying store.
     async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError>;
 }

common/client-core/gateways-storage/src/types.rs

@@ -4,9 +4,10 @@
 use crate::BadGateway;
 use cosmrs::AccountId;
 use nym_crypto::asymmetric::identity;
-use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
+use std::ops::Deref;
 use std::str::FromStr;
 use std::sync::Arc;
 use time::OffsetDateTime;
@@ -64,13 +65,13 @@ impl From<GatewayDetails> for GatewayRegistration {
 impl GatewayDetails {
     pub fn new_remote(
         gateway_id: identity::PublicKey,
-        derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+        shared_key: Arc<SharedGatewayKey>,
         gateway_owner_address: Option<AccountId>,
         gateway_listener: Url,
     ) -> Self {
         GatewayDetails::Remote(RemoteGatewayDetails {
             gateway_id,
-            derived_aes128_ctr_blake3_hmac_keys,
+            shared_key,
             gateway_owner_address,
             gateway_listener,
         })
@@ -87,9 +88,9 @@ impl GatewayDetails {
         }
     }
 
-    pub fn shared_key(&self) -> Option<&SharedKeys> {
+    pub fn shared_key(&self) -> Option<&SharedGatewayKey> {
         match self {
-            GatewayDetails::Remote(details) => Some(&details.derived_aes128_ctr_blake3_hmac_keys),
+            GatewayDetails::Remote(details) => Some(&details.shared_key),
             GatewayDetails::Custom(_) => None,
         }
     }
@@ -167,7 +168,8 @@ pub struct RegisteredGateway {
 #[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
 pub struct RawRemoteGatewayDetails {
     pub gateway_id_bs58: String,
-    pub derived_aes128_ctr_blake3_hmac_keys_bs58: String,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
+    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
     pub gateway_owner_address: Option<String>,
     pub gateway_listener: String,
 }
@@ -184,13 +186,35 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
                 }
             })?;
 
-        let derived_aes128_ctr_blake3_hmac_keys = Arc::new(
-            SharedKeys::try_from_base58_string(&value.derived_aes128_ctr_blake3_hmac_keys_bs58)
-                .map_err(|source| BadGateway::MalformedSharedKeys {
-                    gateway_id: value.gateway_id_bs58.clone(),
-                    source,
-                })?,
-        );
+        let shared_key =
+            match (
+                &value.derived_aes256_gcm_siv_key,
+                &value.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            ) {
+                (None, None) => {
+                    return Err(BadGateway::MissingSharedKey {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                    })
+                }
+                (Some(aes256gcm_siv), _) => {
+                    let current_key =
+                        SharedSymmetricKey::try_from_bytes(aes256gcm_siv).map_err(|source| {
+                            BadGateway::MalformedSharedKeys {
+                                gateway_id: value.gateway_id_bs58.clone(),
+                                source,
+                            }
+                        })?;
+                    SharedGatewayKey::Current(current_key)
+                }
+                (None, Some(aes128ctr_hmac)) => {
+                    let legacy_key = LegacySharedKeys::try_from_base58_string(aes128ctr_hmac)
+                        .map_err(|source| BadGateway::MalformedSharedKeys {
+                            gateway_id: value.gateway_id_bs58.clone(),
+                            source,
+                        })?;
+                    SharedGatewayKey::Legacy(legacy_key)
+                }
+            };
 
         let gateway_owner_address = value
             .gateway_owner_address
@@ -216,7 +240,7 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
 
         Ok(RemoteGatewayDetails {
             gateway_id,
-            derived_aes128_ctr_blake3_hmac_keys,
+            shared_key: Arc::new(shared_key),
             gateway_owner_address,
             gateway_listener,
         })
@@ -225,11 +249,16 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
 
 impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
     fn from(value: &'a RemoteGatewayDetails) -> Self {
+        let (derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key) =
+            match value.shared_key.deref() {
+                SharedGatewayKey::Current(key) => (None, Some(key.to_bytes())),
+                SharedGatewayKey::Legacy(key) => (Some(key.to_base58_string()), None),
+            };
+
         RawRemoteGatewayDetails {
             gateway_id_bs58: value.gateway_id.to_base58_string(),
-            derived_aes128_ctr_blake3_hmac_keys_bs58: value
-                .derived_aes128_ctr_blake3_hmac_keys
-                .to_base58_string(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
             gateway_owner_address: value.gateway_owner_address.as_ref().map(|o| o.to_string()),
             gateway_listener: value.gateway_listener.to_string(),
         }
@@ -240,9 +269,7 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
 pub struct RemoteGatewayDetails {
     pub gateway_id: identity::PublicKey,
 
-    // note: `SharedKeys` implement ZeroizeOnDrop, meaning when `RemoteGatewayDetails` is dropped,
-    // the keys will be zeroized
-    pub derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+    pub shared_key: Arc<SharedGatewayKey>,
 
     pub gateway_owner_address: Option<AccountId>,
 

common/client-core/src/client/base_client/mod.rs

@@ -354,12 +354,14 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         shutdown: TaskClient,
     ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
         <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
     {
         let managed_keys = initialisation_result.client_keys;
         let GatewayDetails::Remote(details) = initialisation_result.gateway_registration.details
@@ -387,23 +389,57 @@ where
                         ),
                     cfg,
                     managed_keys.identity_keypair(),
-                    Some(details.derived_aes128_ctr_blake3_hmac_keys),
+                    Some(details.shared_key),
                     packet_router,
                     bandwidth_controller,
                     shutdown,
                 )
             };
 
-        gateway_client
-            .authenticate_and_start()
+        let gateway_failure = |err| {
+            log::error!("Could not authenticate and start up the gateway connection - {err}");
+            ClientCoreError::GatewayClientError {
+                gateway_id: details.gateway_id.to_base58_string(),
+                source: err,
+            }
+        };
+
+        // the gateway client startup procedure is slightly more complicated now
+        // we need to:
+        // - perform handshake (reg or auth)
+        // - check for key upgrade
+        // - maybe perform another upgrade handshake
+        // - check for bandwidth
+        // - start background tasks
+        let auth_res = gateway_client
+            .perform_initial_authentication()
             .await
-            .map_err(|err| {
-                log::error!("Could not authenticate and start up the gateway connection - {err}");
-                ClientCoreError::GatewayClientError {
-                    gateway_id: details.gateway_id.to_base58_string(),
-                    source: err,
-                }
-            })?;
+            .map_err(gateway_failure)?;
+
+        if auth_res.requires_key_upgrade {
+            // drop the shared_key arc because we don't need it and we can't hold it for the purposes of upgrade
+            drop(auth_res);
+
+            let updated_key = gateway_client
+                .upgrade_key_authenticated()
+                .await
+                .map_err(gateway_failure)?;
+
+            details_store
+                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
+                .await.map_err(|err| {
+                    error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                    ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+            })?
+        }
+
+        gateway_client
+            .claim_initial_bandwidth()
+            .await
+            .map_err(gateway_failure)?;
+        gateway_client
+            .start_listening_for_mixnet_messages()
+            .map_err(gateway_failure)?;
 
         Ok(gateway_client)
     }
@@ -413,12 +449,14 @@ where
         config: &Config,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
         packet_router: PacketRouter,
         mut shutdown: TaskClient,
     ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
         <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
     {
         // if we have setup custom gateway sender and persisted details agree with it, return it
         if let Some(mut custom_gateway_transceiver) = custom_gateway_transceiver {
@@ -429,7 +467,7 @@ where
             {
                 Err(ClientCoreError::CustomGatewaySelectionExpected)
             } else {
-                // and make sure to invalidate the task client so we wouldn't cause premature shutdown
+                // and make sure to invalidate the task client, so we wouldn't cause premature shutdown
                 shutdown.disarm();
                 custom_gateway_transceiver.set_packet_router(packet_router)?;
                 Ok(custom_gateway_transceiver)
@@ -441,6 +479,7 @@ where
             config,
             initialisation_result,
             bandwidth_controller,
+            details_store,
             packet_router,
             shutdown,
         )
@@ -630,7 +669,8 @@ where
         )
         .await?;
 
-        let (reply_storage_backend, credential_store) = self.client_store.into_runtime_stores();
+        let (reply_storage_backend, credential_store, details_store) =
+            self.client_store.into_runtime_stores();
 
         // channels for inter-component communication
         // TODO: make the channels be internally created by the relevant components
@@ -705,6 +745,7 @@ where
             self.config,
             init_res,
             bandwidth_controller,
+            &details_store,
             gateway_packet_router,
             shutdown.fork("gateway_transceiver"),
         )

common/client-core/src/client/base_client/storage/migration_helpers.rs

@@ -13,7 +13,7 @@ pub mod v1_1_33 {
     use nym_client_core_gateways_storage::{
         CustomGatewayDetails, GatewayDetails, GatewayRegistration, RemoteGatewayDetails,
     };
-    use nym_gateway_requests::registration::handshake::SharedKeys;
+    use nym_gateway_requests::shared_key::LegacySharedKeys;
     use serde::{Deserialize, Serialize};
     use sha2::{digest::Digest, Sha256};
     use std::ops::Deref;
@@ -58,7 +58,7 @@ pub mod v1_1_33 {
     }
 
     impl PersistedGatewayConfig {
-        fn verify(&self, shared_key: &SharedKeys) -> bool {
+        fn verify(&self, shared_key: &LegacySharedKeys) -> bool {
             let key_bytes = Zeroizing::new(shared_key.to_bytes());
 
             let mut key_hasher = Sha256::new();
@@ -74,7 +74,7 @@ pub mod v1_1_33 {
         gateway_id: String,
     }
 
-    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<SharedKeys, ClientCoreError> {
+    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<LegacySharedKeys, ClientCoreError> {
         // the shared key was a simple pem file
         Ok(nym_pemstore::load_key(path)?)
     }
@@ -83,7 +83,7 @@ pub mod v1_1_33 {
         gateway_id: String,
         gateway_owner: String,
         gateway_listener: String,
-        gateway_shared_key: SharedKeys,
+        gateway_shared_key: LegacySharedKeys,
     ) -> Result<GatewayDetails, ClientCoreError> {
         Ok(GatewayDetails::Remote(RemoteGatewayDetails {
             gateway_id: gateway_id
@@ -91,7 +91,7 @@ pub mod v1_1_33 {
                 .map_err(|err| ClientCoreError::UpgradeFailure {
                     message: format!("the stored gateway id was malformed: {err}"),
                 })?,
-            derived_aes128_ctr_blake3_hmac_keys: Arc::new(gateway_shared_key),
+            shared_key: Arc::new(gateway_shared_key.into()),
             gateway_owner_address: Some(gateway_owner.parse().map_err(|err| {
                 ClientCoreError::UpgradeFailure {
                     message: format!("the stored gateway owner address was malformed: {err}"),

common/client-core/src/client/base_client/storage/mod.rs

@@ -49,7 +49,13 @@ pub trait MixnetClientStorage {
     type CredentialStore: CredentialStorage;
     type GatewaysDetailsStore: GatewaysDetailsStore;
 
-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore);
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    );
 
     fn key_store(&self) -> &Self::KeyStore;
     fn reply_store(&self) -> &Self::ReplyStore;
@@ -77,8 +83,18 @@ impl MixnetClientStorage for Ephemeral {
     type CredentialStore = EphemeralCredentialStorage;
     type GatewaysDetailsStore = InMemGatewaysDetails;
 
-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore) {
-        (self.reply_store, self.credential_store)
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    ) {
+        (
+            self.reply_store,
+            self.credential_store,
+            self.gateway_details_store,
+        )
     }
 
     fn key_store(&self) -> &Self::KeyStore {
@@ -168,8 +184,18 @@ impl MixnetClientStorage for OnDiskPersistent {
     type CredentialStore = PersistentCredentialStorage;
     type GatewaysDetailsStore = OnDiskGatewaysDetails;
 
-    fn into_runtime_stores(self) -> (Self::ReplyStore, Self::CredentialStore) {
-        (self.reply_store, self.credential_store)
+    fn into_runtime_stores(
+        self,
+    ) -> (
+        Self::ReplyStore,
+        Self::CredentialStore,
+        Self::GatewaysDetailsStore,
+    ) {
+        (
+            self.reply_store,
+            self.credential_store,
+            self.gateway_details_store,
+        )
     }
 
     fn key_store(&self) -> &Self::KeyStore {

common/client-core/src/client/key_manager/mod.rs

@@ -3,7 +3,7 @@
 
 use crate::client::key_manager::persistence::KeyStore;
 use nym_crypto::asymmetric::{encryption, identity};
-use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use nym_sphinx::acknowledgements::AckKey;
 use rand::{CryptoRng, RngCore};
 use std::sync::Arc;
@@ -84,5 +84,7 @@ fn _assert_keys_zeroize_on_drop() {
     _assert_zeroize_on_drop::<identity::KeyPair>();
     _assert_zeroize_on_drop::<encryption::KeyPair>();
     _assert_zeroize_on_drop::<AckKey>();
-    _assert_zeroize_on_drop::<SharedKeys>();
+    _assert_zeroize_on_drop::<LegacySharedKeys>();
+    _assert_zeroize_on_drop::<SharedSymmetricKey>();
+    _assert_zeroize_on_drop::<SharedGatewayKey>();
 }

common/client-core/src/client/topology_control/geo_aware_provider.rs

@@ -3,11 +3,11 @@ use log::{debug, error};
 use nym_explorer_client::{ExplorerClient, PrettyDetailedMixNodeBond};
 use nym_network_defaults::var_names::EXPLORER_API;
 use nym_topology::{
-    nym_topology_from_detailed,
+    nym_topology_from_basic_info,
     provider_trait::{async_trait, TopologyProvider},
     NymTopology,
 };
-use nym_validator_client::client::MixId;
+use nym_validator_client::client::NodeId;
 use rand::{prelude::SliceRandom, thread_rng};
 use std::collections::HashMap;
 use tap::TapOptional;
@@ -39,10 +39,10 @@ fn create_explorer_client() -> Option<ExplorerClient> {
 
 fn group_mixnodes_by_country_code(
     mixnodes: Vec<PrettyDetailedMixNodeBond>,
-) -> HashMap<CountryGroup, Vec<MixId>> {
+) -> HashMap<CountryGroup, Vec<NodeId>> {
     mixnodes
         .into_iter()
-        .fold(HashMap::<CountryGroup, Vec<MixId>>::new(), |mut acc, m| {
+        .fold(HashMap::<CountryGroup, Vec<NodeId>>::new(), |mut acc, m| {
             if let Some(ref location) = m.location {
                 let country_code = location.two_letter_iso_country_code.clone();
                 let group_code = CountryGroup::new(country_code.as_str());
@@ -53,7 +53,7 @@ fn group_mixnodes_by_country_code(
         })
 }
 
-fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<MixId>>) {
+fn log_mixnode_distribution(mixnodes: &HashMap<CountryGroup, Vec<NodeId>>) {
     let mixnode_distribution = mixnodes
         .iter()
         .map(|(k, v)| format!("{}: {}", k, v.len()))
@@ -110,7 +110,11 @@ impl GeoAwareTopologyProvider {
     }
 
     async fn get_topology(&self) -> Option<NymTopology> {
-        let mixnodes = match self.validator_client.get_cached_active_mixnodes().await {
+        let mixnodes = match self
+            .validator_client
+            .get_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network mixnodes - {err}");
                 return None;
@@ -118,7 +122,11 @@ impl GeoAwareTopologyProvider {
             Ok(mixes) => mixes,
         };
 
-        let gateways = match self.validator_client.get_cached_gateways().await {
+        let gateways = match self
+            .validator_client
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
+            .await
+        {
             Err(err) => {
                 error!("failed to get network gateways - {err}");
                 return None;
@@ -182,11 +190,10 @@ impl GeoAwareTopologyProvider {
 
         let mixnodes = mixnodes
             .into_iter()
-            .filter(|m| filtered_mixnode_ids.contains(&m.mix_id()))
+            .filter(|m| filtered_mixnode_ids.contains(&m.node_id))
             .collect::<Vec<_>>();
 
-        let topology = nym_topology_from_detailed(mixnodes, gateways)
-            .filter_system_version(&self.client_version);
+        let topology = nym_topology_from_basic_info(&mixnodes, &gateways);
 
         // TODO: return real error type
         check_layer_integrity(topology.clone()).ok()?;

common/client-core/src/client/topology_control/mod.rs

@@ -102,6 +102,7 @@ impl TopologyRefresher {
             .current_topology()
             .await
             .ok_or(NymTopologyError::EmptyNetworkTopology)?;
+
         if !topology.gateway_exists(gateway) {
             return Err(NymTopologyError::NonExistentGatewayError {
                 identity_key: gateway.to_base58_string(),

common/client-core/src/client/topology_control/nym_api_provider.rs

@@ -98,7 +98,7 @@ impl NymApiTopologyProvider {
     async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
         let mixnodes = match self
             .validator_client
-            .get_basic_mixnodes(Some(self.client_version.clone()))
+            .get_basic_active_mixing_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -110,7 +110,7 @@ impl NymApiTopologyProvider {
 
         let gateways = match self
             .validator_client
-            .get_basic_gateways(Some(self.client_version.clone()))
+            .get_all_basic_entry_assigned_nodes(Some(self.client_version.clone()))
             .await
         {
             Err(err) => {
@@ -134,7 +134,6 @@ impl NymApiTopologyProvider {
                 g.performance.round_to_integer() >= self.config.min_gateway_performance
             }),
         );
-
         if let Err(err) = self.check_layer_distribution(&topology) {
             warn!("The current filtered active topology has extremely skewed layer distribution. It cannot be used: {err}");
             self.use_next_nym_api();

common/client-core/src/error.rs

@@ -187,16 +187,6 @@ pub enum ClientCoreError {
         source: Ed25519RecoveryError,
     },
 
-    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {err}")]
-    MalformedGatewayOwnerAccountAddress {
-        gateway_id: String,
-
-        raw_owner: String,
-
-        // just use the string formatting as opposed to underlying type to avoid having to import cosmrs
-        err: String,
-    },
-
     #[error(
         "the listening address of gateway {gateway_id} ({raw_listener}) is malformed: {source}"
     )]
@@ -214,6 +204,11 @@ pub enum ClientCoreError {
 
     #[error("this client has already registered with gateway {gateway_id}")]
     AlreadyRegistered { gateway_id: String },
+
+    #[error(
+        "fresh registration with gateway {gateway_id} somehow requires an additional key upgrade!"
+    )]
+    UnexpectedKeyUpgrade { gateway_id: String },
 }
 
 /// Set of messages that the client can send to listeners via the task manager

common/client-core/src/init/helpers.rs

@@ -7,7 +7,7 @@ use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
-use nym_topology::{filter::VersionFilterable, gateway, mix};
+use nym_topology::{gateway, mix};
 use nym_validator_client::client::IdentityKeyRef;
 use nym_validator_client::UserAgent;
 use rand::{seq::SliceRandom, Rng};
@@ -53,7 +53,7 @@ pub trait ConnectableGateway {
     fn is_wss(&self) -> bool;
 }
 
-impl ConnectableGateway for gateway::Node {
+impl ConnectableGateway for gateway::LegacyNode {
     fn identity(&self) -> &identity::PublicKey {
         self.identity()
     }
@@ -82,7 +82,7 @@ pub async fn current_gateways<R: Rng>(
     rng: &mut R,
     nym_apis: &[Url],
     user_agent: Option<UserAgent>,
-) -> Result<Vec<gateway::Node>, ClientCoreError> {
+) -> Result<Vec<gateway::LegacyNode>, ClientCoreError> {
     let nym_api = nym_apis
         .choose(rng)
         .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
@@ -94,31 +94,26 @@ pub async fn current_gateways<R: Rng>(
 
     log::debug!("Fetching list of gateways from: {nym_api}");
 
-    let gateways = client.get_cached_described_gateways().await?;
+    let gateways = client.get_all_basic_entry_assigned_nodes(None).await?;
     log::debug!("Found {} gateways", gateways.len());
     log::trace!("Gateways: {:#?}", gateways);
 
     let valid_gateways = gateways
-        .into_iter()
+        .iter()
         .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<gateway::Node>>();
-    log::debug!("Ater checking validity: {}", valid_gateways.len());
+        .collect::<Vec<gateway::LegacyNode>>();
+    log::debug!("After checking validity: {}", valid_gateways.len());
     log::trace!("Valid gateways: {:#?}", valid_gateways);
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
-    log::debug!("After filtering for version: {}", filtered_gateways.len());
-    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
+    log::info!("nym-api reports {} valid gateways", valid_gateways.len());
 
-    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
-
-    Ok(filtered_gateways)
+    Ok(valid_gateways)
 }
 
 pub async fn current_mixnodes<R: Rng>(
     rng: &mut R,
     nym_apis: &[Url],
-) -> Result<Vec<mix::Node>, ClientCoreError> {
+) -> Result<Vec<mix::LegacyNode>, ClientCoreError> {
     let nym_api = nym_apis
         .choose(rng)
         .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
@@ -126,15 +121,13 @@ pub async fn current_mixnodes<R: Rng>(
 
     log::trace!("Fetching list of mixnodes from: {nym_api}");
 
-    let mixnodes = client.get_cached_mixnodes().await?;
+    let mixnodes = client.get_basic_active_mixing_assigned_nodes(None).await?;
     let valid_mixnodes = mixnodes
-        .into_iter()
-        .filter_map(|mixnode| (&mixnode.bond_information).try_into().ok())
-        .collect::<Vec<mix::Node>>();
+        .iter()
+        .filter_map(|mixnode| mixnode.try_into().ok())
+        .collect::<Vec<mix::LegacyNode>>();
 
-    // we were always filtering by version so I'm not removing that 'feature'
-    let filtered_mixnodes = valid_mixnodes.filter_by_version(env!("CARGO_PKG_VERSION"));
-    Ok(filtered_mixnodes)
+    Ok(valid_mixnodes)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -273,9 +266,9 @@ fn filter_by_tls<G: ConnectableGateway>(
 
 pub(super) fn uniformly_random_gateway<R: Rng>(
     rng: &mut R,
-    gateways: &[gateway::Node],
+    gateways: &[gateway::LegacyNode],
     must_use_tls: bool,
-) -> Result<gateway::Node, ClientCoreError> {
+) -> Result<gateway::LegacyNode, ClientCoreError> {
     filter_by_tls(gateways, must_use_tls)?
         .choose(rng)
         .ok_or(ClientCoreError::NoGatewaysOnNetwork)
@@ -284,9 +277,9 @@ pub(super) fn uniformly_random_gateway<R: Rng>(
 
 pub(super) fn get_specified_gateway(
     gateway_identity: IdentityKeyRef,
-    gateways: &[gateway::Node],
+    gateways: &[gateway::LegacyNode],
     must_use_tls: bool,
-) -> Result<gateway::Node, ClientCoreError> {
+) -> Result<gateway::LegacyNode, ClientCoreError> {
     log::debug!("Requesting specified gateway: {}", gateway_identity);
     let user_gateway = identity::PublicKey::from_base58_string(gateway_identity)
         .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;
@@ -320,7 +313,7 @@ pub(super) async fn register_with_gateway(
             source: err,
         }
     })?;
-    let shared_keys = gateway_client
+    let auth_response = gateway_client
         .perform_initial_authentication()
         .await
         .map_err(|err| {
@@ -330,8 +323,17 @@ pub(super) async fn register_with_gateway(
                 source: err,
             }
         })?;
+
+    // this should NEVER happen, if it did, it means the function was misused,
+    // because for any fresh **registration**, the derived key is always up to date
+    if auth_response.requires_key_upgrade {
+        return Err(ClientCoreError::UnexpectedKeyUpgrade {
+            gateway_id: gateway_id.to_base58_string(),
+        });
+    }
+
     Ok(RegistrationResult {
-        shared_keys,
+        shared_keys: auth_response.initial_shared_key,
         authenticated_ephemeral_client: gateway_client,
     })
 }

common/client-core/src/init/mod.rs

@@ -50,7 +50,7 @@ async fn setup_new_gateway<K, D>(
     key_store: &K,
     details_store: &D,
     selection_specification: GatewaySelectionSpecification,
-    available_gateways: Vec<gateway::Node>,
+    available_gateways: Vec<gateway::LegacyNode>,
 ) -> Result<InitialisationResult, ClientCoreError>
 where
     K: KeyStore,

common/client-core/src/init/types.rs

@@ -11,14 +11,13 @@ use nym_client_core_gateways_storage::{
 };
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::client::InitGatewayClient;
-use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_topology::gateway;
 use nym_validator_client::client::IdentityKey;
 use nym_validator_client::nyxd::AccountId;
 use serde::Serialize;
 use std::fmt::Display;
-use std::str::FromStr;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use url::Url;
@@ -39,7 +38,7 @@ pub enum SelectedGateway {
 
 impl SelectedGateway {
     pub fn from_topology_node(
-        node: gateway::Node,
+        node: gateway::LegacyNode,
         must_use_tls: bool,
     ) -> Result<Self, ClientCoreError> {
         let gateway_listener = if must_use_tls {
@@ -51,20 +50,6 @@ impl SelectedGateway {
             node.clients_address()
         };
 
-        let gateway_owner_address = node
-            .owner
-            .as_ref()
-            .map(|raw_owner| {
-                AccountId::from_str(raw_owner).map_err(|source| {
-                    ClientCoreError::MalformedGatewayOwnerAccountAddress {
-                        gateway_id: node.identity_key.to_base58_string(),
-                        raw_owner: raw_owner.clone(),
-                        err: source.to_string(),
-                    }
-                })
-            })
-            .transpose()?;
-
         let gateway_listener =
             Url::parse(&gateway_listener).map_err(|source| ClientCoreError::MalformedListener {
                 gateway_id: node.identity_key.to_base58_string(),
@@ -74,7 +59,7 @@ impl SelectedGateway {
 
         Ok(SelectedGateway::Remote {
             gateway_id: node.identity_key,
-            gateway_owner_address,
+            gateway_owner_address: None,
             gateway_listener,
         })
     }
@@ -104,7 +89,7 @@ impl SelectedGateway {
 /// - shared keys derived between ourselves and the node
 /// - an authenticated handle of an ephemeral handle created for the purposes of registration
 pub struct RegistrationResult {
-    pub shared_keys: Arc<SharedKeys>,
+    pub shared_keys: Arc<SharedGatewayKey>,
     pub authenticated_ephemeral_client: InitGatewayClient,
 }
 
@@ -215,7 +200,7 @@ pub enum GatewaySetup {
         specification: GatewaySelectionSpecification,
 
         // TODO: seems to be a bit inefficient to pass them by value
-        available_gateways: Vec<gateway::Node>,
+        available_gateways: Vec<gateway::LegacyNode>,
     },
 
     ReuseConnection {

common/client-core/surb-storage/src/backend/fs_backend/manager.rs

@@ -1,9 +1,12 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::backend::fs_backend::error::StorageError;
-use crate::backend::fs_backend::models::{
-    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
+use crate::backend::fs_backend::{
+    error::StorageError,
+    models::{
+        ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag,
+        StoredSurbSender,
+    },
 };
 use log::{error, info};
 use sqlx::ConnectOptions;
@@ -27,11 +30,10 @@ impl StorageManager {
             })?;
         }
 
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+        let opts = sqlx::sqlite::SqliteConnectOptions::new()
             .filename(database_path)
-            .create_if_missing(fresh);
-
-        opts.disable_statement_logging();
+            .create_if_missing(fresh)
+            .disable_statement_logging();
 
         let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
             Ok(pool) => pool,

common/client-libs/gateway-client/Cargo.toml

@@ -11,18 +11,20 @@ license.workspace = true
 # TODO: (for this and other crates), similarly to 'tokio', import only required "futures" modules rather than
 # the entire crate
 futures = { workspace = true }
-log = { workspace = true }
+tracing = { workspace = true }
 thiserror = { workspace = true }
 url = { workspace = true }
 rand = { workspace = true }
 tokio = { workspace = true, features = ["macros"] }
 si-scale = { workspace = true }
 time.workspace = true
+zeroize.workspace = true
 
 # internal
 nym-bandwidth-controller = { path = "../../bandwidth-controller" }
 nym-credentials = { path = "../../credentials" }
 nym-credential-storage = { path = "../../credential-storage" }
+nym-credentials-interface = { path = "../../credentials-interface" }
 nym-crypto = { path = "../../crypto" }
 nym-gateway-requests = { path = "../../gateway-requests" }
 nym-network-defaults = { path = "../../network-defaults" }
@@ -43,7 +45,7 @@ workspace = true
 features = ["macros", "rt", "net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
-version = "0.1.16"
+workspace = true
 features = ["net", "sync", "time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]

common/client-libs/gateway-client/src/bandwidth.rs

@@ -2,21 +2,37 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use si_scale::helpers::bibytes2;
-use std::sync::atomic::{AtomicI64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicI64, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 
-#[derive(Clone, Default)]
+pub(crate) struct BandwidthClaimGuard {
+    inner: Arc<ClientBandwidthInner>,
+}
+
+impl Drop for BandwidthClaimGuard {
+    fn drop(&mut self) {
+        let old = self.inner.claiming_more.swap(false, Ordering::SeqCst);
+        assert!(
+            old,
+            "critical failure: there were multiple BandwidthClaimGuard existing"
+        )
+    }
+}
+
+#[derive(Clone)]
 pub struct ClientBandwidth {
     inner: Arc<ClientBandwidthInner>,
 }
 
-#[derive(Default)]
 struct ClientBandwidthInner {
     /// the actual bandwidth amount (in bytes) available
     available: AtomicI64,
 
+    /// flag to indicate whether this client is currently in the process of claiming additional bandwidth
+    claiming_more: AtomicBool,
+
     /// defines the timestamp when the bandwidth information has been logged to the logs stream
     last_logged_ts: AtomicI64,
 
@@ -29,11 +45,28 @@ impl ClientBandwidth {
         ClientBandwidth {
             inner: Arc::new(ClientBandwidthInner {
                 available: AtomicI64::new(0),
+                claiming_more: AtomicBool::new(false),
                 last_logged_ts: AtomicI64::new(0),
                 last_updated_ts: AtomicI64::new(0),
             }),
         }
     }
+
+    pub(crate) fn begin_bandwidth_claim(&self) -> Option<BandwidthClaimGuard> {
+        if self
+            .inner
+            .claiming_more
+            .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+            .is_ok()
+        {
+            Some(BandwidthClaimGuard {
+                inner: self.inner.clone(),
+            })
+        } else {
+            None
+        }
+    }
+
     pub(crate) fn remaining(&self) -> i64 {
         self.inner.available.load(Ordering::Acquire)
     }
@@ -53,9 +86,9 @@ impl ClientBandwidth {
         let remaining_bi2 = bibytes2(remaining as f64);
 
         if remaining < 0 {
-            log::warn!("OUT OF BANDWIDTH. remaining: {remaining_bi2}");
+            tracing::warn!("OUT OF BANDWIDTH. remaining: {remaining_bi2}");
         } else {
-            log::info!("remaining bandwidth: {remaining_bi2}");
+            tracing::info!("remaining bandwidth: {remaining_bi2}");
         }
 
         self.inner

common/client-libs/gateway-client/src/client/mod.rs

@@ -1,5 +1,6 @@
 // Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
+
 use crate::bandwidth::ClientBandwidth;
 use crate::client::config::GatewayClientConfig;
 use crate::error::GatewayClientError;
@@ -11,24 +12,25 @@ use crate::socket_state::{ws_fd, PartiallyDelegatedHandle, SocketState};
 use crate::traits::GatewayPacketRouter;
 use crate::{cleanup_socket_message, try_decrypt_binary_message};
 use futures::{SinkExt, StreamExt};
-use log::*;
 use nym_bandwidth_controller::{BandwidthController, BandwidthStatusMessage};
 use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_credentials::CredentialSpendingData;
+use nym_credentials_interface::TicketType;
 use nym_crypto::asymmetric::identity;
-use nym_gateway_requests::authentication::encrypted_address::EncryptedAddressBytes;
-use nym_gateway_requests::iv::IV;
-use nym_gateway_requests::registration::handshake::{client_handshake, SharedKeys};
+use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
-    BinaryRequest, ClientControlRequest, ServerResponse, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION,
-    CURRENT_PROTOCOL_VERSION,
+    BinaryRequest, ClientControlRequest, ClientRequest, SensitiveServerResponse, ServerResponse,
+    SharedGatewayKey, SharedSymmetricKey, AES_GCM_SIV_PROTOCOL_VERSION,
+    CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
 };
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::TaskClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use rand::rngs::OsRng;
 use std::sync::Arc;
+use tracing::instrument;
+use tracing::*;
 use tungstenite::protocol::Message;
 use url::Url;
 
@@ -45,6 +47,7 @@ use std::os::raw::c_int as RawFd;
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
 use wasmtimer::tokio::sleep;
+use zeroize::Zeroizing;
 
 pub mod config;
 
@@ -71,6 +74,13 @@ impl GatewayConfig {
     }
 }
 
+#[must_use]
+#[derive(Debug)]
+pub struct AuthenticationResponse {
+    pub initial_shared_key: Arc<SharedGatewayKey>,
+    pub requires_key_upgrade: bool,
+}
+
 // TODO: this should be refactored into a state machine that keeps track of its authentication state
 pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
     pub cfg: GatewayClientConfig,
@@ -80,7 +90,7 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
     gateway_address: String,
     gateway_identity: identity::PublicKey,
     local_identity: Arc<identity::KeyPair>,
-    shared_key: Option<Arc<SharedKeys>>,
+    shared_key: Option<Arc<SharedGatewayKey>>,
     connection: SocketState,
     packet_router: PacketRouter,
     bandwidth_controller: Option<BandwidthController<C, St>>,
@@ -98,7 +108,7 @@ impl<C, St> GatewayClient<C, St> {
         gateway_config: GatewayConfig,
         local_identity: Arc<identity::KeyPair>,
         // TODO: make it mandatory. if you don't want to pass it, use `new_init`
-        shared_key: Option<Arc<SharedKeys>>,
+        shared_key: Option<Arc<SharedGatewayKey>>,
         packet_router: PacketRouter,
         bandwidth_controller: Option<BandwidthController<C, St>>,
         task_client: TaskClient,
@@ -293,7 +303,7 @@ impl<C, St> GatewayClient<C, St> {
     // as we need to be able to write the request and read the subsequent response
     async fn send_websocket_message(
         &mut self,
-        msg: Message,
+        msg: impl Into<Message>,
     ) -> Result<ServerResponse, GatewayClientError> {
         let should_restart_mixnet_listener = if self.connection.is_partially_delegated() {
             self.recover_socket_connection().await?;
@@ -307,7 +317,7 @@ impl<C, St> GatewayClient<C, St> {
             SocketState::NotConnected => return Err(GatewayClientError::ConnectionNotEstablished),
             _ => return Err(GatewayClientError::ConnectionInInvalidState),
         };
-        conn.send(msg).await?;
+        conn.send(msg.into()).await?;
         let response = self.read_control_response().await;
 
         if should_restart_mixnet_listener {
@@ -398,13 +408,19 @@ impl<C, St> GatewayClient<C, St> {
         }
     }
 
-    async fn register(&mut self) -> Result<(), GatewayClientError> {
+    async fn register(
+        &mut self,
+        derive_aes256_gcm_siv_key: bool,
+    ) -> Result<(), GatewayClientError> {
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
 
         debug_assert!(self.connection.is_available());
-        log::debug!("Registering gateway");
+        log::debug!(
+            "registering with gateway. using legacy key derivation: {}",
+            !derive_aes256_gcm_siv_key
+        );
 
         // it's fine to instantiate it here as it's only used once (during authentication or registration)
         // and putting it into the GatewayClient struct would be a hassle
@@ -417,13 +433,15 @@ impl<C, St> GatewayClient<C, St> {
                 self.local_identity.as_ref(),
                 self.gateway_identity,
                 self.cfg.bandwidth.require_tickets,
+                derive_aes256_gcm_siv_key,
                 #[cfg(not(target_arch = "wasm32"))]
                 self.task_client.clone(),
             )
             .await
             .map_err(GatewayClientError::RegistrationFailure),
-            _ => unreachable!(),
+            _ => return Err(GatewayClientError::ConnectionInInvalidState),
         }?;
+
         let (authentication_status, gateway_protocol) = match self.read_control_response().await? {
             ServerResponse::Register {
                 protocol_version,
@@ -432,7 +450,7 @@ impl<C, St> GatewayClient<C, St> {
             ServerResponse::Error { message } => {
                 return Err(GatewayClientError::GatewayError(message))
             }
-            _ => return Err(GatewayClientError::UnexpectedResponse),
+            other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         };
 
         self.check_gateway_protocol(gateway_protocol)?;
@@ -448,41 +466,93 @@ impl<C, St> GatewayClient<C, St> {
         Ok(())
     }
 
-    async fn authenticate(
+    pub async fn upgrade_key_authenticated(
         &mut self,
-        shared_key: Option<SharedKeys>,
-    ) -> Result<(), GatewayClientError> {
-        if shared_key.is_none() && self.shared_key.is_none() {
-            return Err(GatewayClientError::NoSharedKeyAvailable);
-        }
+    ) -> Result<Zeroizing<SharedSymmetricKey>, GatewayClientError> {
+        info!("*** STARTING AES128CTR-HMAC KEY UPGRADE INTO AES256GCM-SIV***");
+
         if !self.connection.is_established() {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
-        log::debug!("Authenticating with gateway");
 
-        // it's fine to instantiate it here as it's only used once (during authentication or registration)
-        // and putting it into the GatewayClient struct would be a hassle
-        let mut rng = OsRng;
+        if !self.authenticated {
+            return Err(GatewayClientError::NotAuthenticated);
+        }
+
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        if !shared_key.is_legacy() {
+            return Err(GatewayClientError::KeyAlreadyUpgraded);
+        }
+
+        // make sure we have the only reference, so we could safely swap it
+        if Arc::strong_count(shared_key) != 1 {
+            return Err(GatewayClientError::KeyAlreadyInUse);
+        }
+
+        assert!(shared_key.is_legacy());
+        let legacy_key = shared_key.unwrap_legacy();
+        let (updated_key, hkdf_salt) = legacy_key.upgrade();
+        let derived_key_digest = updated_key.digest();
+
+        let upgrade_request = ClientRequest::UpgradeKey {
+            hkdf_salt,
+            derived_key_digest,
+        }
+        .encrypt(legacy_key)?;
+
+        info!("sending upgrade request and awaiting the acknowledgement back");
+        let (ciphertext, nonce) = match self.send_websocket_message(upgrade_request).await? {
+            ServerResponse::EncryptedResponse { ciphertext, nonce } => (ciphertext, nonce),
+            ServerResponse::Error { message } => {
+                return Err(GatewayClientError::GatewayError(message))
+            }
+            other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
+        };
+
+        // attempt to decrypt it using NEW key
+        let Ok(response) = SensitiveServerResponse::decrypt(&ciphertext, &nonce, &updated_key)
+        else {
+            return Err(GatewayClientError::FatalKeyUpgradeFailure);
+        };
+
+        match response {
+            SensitiveServerResponse::KeyUpgradeAck { .. } => {
+                info!("received key upgrade acknowledgement")
+            }
+            _ => return Err(GatewayClientError::FatalKeyUpgradeFailure),
+        }
+
+        // perform in memory swap and make a copy for updating storage
+        let zeroizing_updated_key = updated_key.zeroizing_clone();
+        self.shared_key = Some(Arc::new(updated_key.into()));
+
+        Ok(zeroizing_updated_key)
+    }
+
+    async fn authenticate(&mut self) -> Result<(), GatewayClientError> {
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+        debug!("authenticating with gateway");
 
-        // because of the previous check one of the unwraps MUST succeed
-        let shared_key = shared_key
-            .as_ref()
-            .unwrap_or_else(|| self.shared_key.as_ref().unwrap());
-        let iv = IV::new_random(&mut rng);
         let self_address = self
             .local_identity
             .as_ref()
             .public_key()
             .derive_destination_address();
-        let encrypted_address = EncryptedAddressBytes::new(&self_address, shared_key, &iv);
 
         let msg = ClientControlRequest::new_authenticate(
             self_address,
-            encrypted_address,
-            iv,
+            shared_key,
             self.cfg.bandwidth.require_tickets,
-        )
-        .into();
+        )?;
 
         match self.send_websocket_message(msg).await? {
             ServerResponse::Authenticate {
@@ -496,39 +566,101 @@ impl<C, St> GatewayClient<C, St> {
 
                 self.negotiated_protocol = protocol_version;
                 log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");
+
                 self.task_client.send_status_msg(Box::new(
                     BandwidthStatusMessage::RemainingBandwidth(bandwidth_remaining),
                 ));
                 Ok(())
             }
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
-            _ => Err(GatewayClientError::UnexpectedResponse),
+            other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         }
     }
 
     /// Helper method to either call register or authenticate based on self.shared_key value
+    #[instrument(skip_all,
+        fields(
+            gateway = %self.gateway_identity,
+            gateway_address = %self.gateway_address
+        )
+    )]
     pub async fn perform_initial_authentication(
         &mut self,
-    ) -> Result<Arc<SharedKeys>, GatewayClientError> {
+    ) -> Result<AuthenticationResponse, GatewayClientError> {
+        if !self.connection.is_established() {
+            self.establish_connection().await?;
+        }
+
+        // 1. check gateway's protocol version
+        let supports_aes_gcm_siv = match self.get_gateway_protocol().await {
+            Ok(protocol) => protocol >= AES_GCM_SIV_PROTOCOL_VERSION,
+            Err(_) => {
+                // if we failed to send the request, it means the gateway is running the old binary,
+                // so it has reset our connection - we have to reconnect
+                self.establish_connection().await?;
+                false
+            }
+        };
+
+        if !supports_aes_gcm_siv {
+            warn!("this gateway is on an old version that doesn't support AES256-GCM-SIV");
+        }
+
         if self.authenticated {
             debug!("Already authenticated");
             return if let Some(shared_key) = &self.shared_key {
-                Ok(Arc::clone(shared_key))
+                Ok(AuthenticationResponse {
+                    initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade: shared_key.is_legacy() && supports_aes_gcm_siv,
+                })
             } else {
                 Err(GatewayClientError::AuthenticationFailureWithPreexistingSharedKey)
             };
         }
 
         if self.shared_key.is_some() {
-            self.authenticate(None).await?;
+            self.authenticate().await?;
+
+            if self.authenticated {
+                // if we are authenticated it means we MUST have an associated shared_key
+                let shared_key = self.shared_key.as_ref().unwrap();
+
+                let requires_key_upgrade = shared_key.is_legacy() && supports_aes_gcm_siv;
+
+                Ok(AuthenticationResponse {
+                    initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade,
+                })
+            } else {
+                Err(GatewayClientError::AuthenticationFailure)
+            }
         } else {
-            self.register().await?;
+            self.register(supports_aes_gcm_siv).await?;
+
+            // if registration didn't return an error, we MUST have an associated shared key
+            let shared_key = self.shared_key.as_ref().unwrap();
+
+            // we're always registering with the highest supported protocol,
+            // so no upgrades are required
+            Ok(AuthenticationResponse {
+                initial_shared_key: Arc::clone(shared_key),
+                requires_key_upgrade: false,
+            })
         }
-        if self.authenticated {
-            // if we are authenticated it means we MUST have an associated shared_key
-            Ok(Arc::clone(self.shared_key.as_ref().unwrap()))
-        } else {
-            Err(GatewayClientError::AuthenticationFailure)
+    }
+
+    pub async fn get_gateway_protocol(&mut self) -> Result<u8, GatewayClientError> {
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+
+        match self
+            .send_websocket_message(ClientControlRequest::SupportedProtocol {})
+            .await?
+        {
+            ServerResponse::SupportedProtocol { version } => Ok(version),
+            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
+            other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         }
     }
 
@@ -536,22 +668,17 @@ impl<C, St> GatewayClient<C, St> {
         &mut self,
         credential: CredentialSpendingData,
     ) -> Result<(), GatewayClientError> {
-        let mut rng = OsRng;
-        let iv = IV::new_random(&mut rng);
-
         let msg = ClientControlRequest::new_enc_ecash_credential(
             credential,
             self.shared_key.as_ref().unwrap(),
-            iv,
-        )
-        .into();
+        )?;
         let bandwidth_remaining = match self.send_websocket_message(msg).await? {
             ServerResponse::Bandwidth { available_total } => Ok(available_total),
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
             ServerResponse::TypedError { error } => {
                 Err(GatewayClientError::TypedGatewayError(error))
             }
-            _ => Err(GatewayClientError::UnexpectedResponse),
+            other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         }?;
 
         // TODO: create tracing span
@@ -562,11 +689,11 @@ impl<C, St> GatewayClient<C, St> {
     }
 
     async fn try_claim_testnet_bandwidth(&mut self) -> Result<(), GatewayClientError> {
-        let msg = ClientControlRequest::ClaimFreeTestnetBandwidth.into();
+        let msg = ClientControlRequest::ClaimFreeTestnetBandwidth;
         let bandwidth_remaining = match self.send_websocket_message(msg).await? {
             ServerResponse::Bandwidth { available_total } => Ok(available_total),
             ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
-            _ => Err(GatewayClientError::UnexpectedResponse),
+            other => Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
         }?;
 
         info!("managed to claim testnet bandwidth");
@@ -598,6 +725,11 @@ impl<C, St> GatewayClient<C, St> {
             return Err(GatewayClientError::NoBandwidthControllerAvailable);
         }
 
+        let Some(_claim_guard) = self.bandwidth.begin_bandwidth_claim() else {
+            debug!("there's already an existing bandwidth claim ongoing");
+            return Ok(());
+        };
+
         warn!("Not enough bandwidth. Trying to get more bandwidth, this might take a while");
         if !self.cfg.bandwidth.require_tickets {
             info!("The client is running in disabled credentials mode - attempting to claim bandwidth without a credential");
@@ -617,7 +749,11 @@ impl<C, St> GatewayClient<C, St> {
         }
         let prepared_credential = self
             .unchecked_bandwidth_controller()
-            .prepare_ecash_ticket(self.gateway_identity.to_bytes(), TICKETS_TO_SPEND)
+            .prepare_ecash_ticket(
+                TicketType::V1MixnetEntry,
+                self.gateway_identity.to_bytes(),
+                TICKETS_TO_SPEND,
+            )
             .await?;
 
         match self.claim_ecash_bandwidth(prepared_credential.data).await {
@@ -665,10 +801,10 @@ impl<C, St> GatewayClient<C, St> {
             return Err(GatewayClientError::ConnectionNotEstablished);
         }
 
-        let messages: Vec<_> = packets
+        let messages: Result<Vec<_>, _> = packets
             .into_iter()
             .map(|mix_packet| {
-                BinaryRequest::new_forward_request(mix_packet).into_ws_message(
+                BinaryRequest::ForwardSphinx { packet: mix_packet }.into_ws_message(
                     self.shared_key
                         .as_ref()
                         .expect("no shared key present even though we're authenticated!"),
@@ -677,7 +813,7 @@ impl<C, St> GatewayClient<C, St> {
             .collect();
 
         if let Err(err) = self
-            .batch_send_websocket_messages_without_response(messages)
+            .batch_send_websocket_messages_without_response(messages?)
             .await
         {
             if err.is_closed_connection() && self.cfg.connection.should_reconnect_on_failure {
@@ -741,11 +877,11 @@ impl<C, St> GatewayClient<C, St> {
         }
         // note: into_ws_message encrypts the requests and adds a MAC on it. Perhaps it should
         // be more explicit in the naming?
-        let msg = BinaryRequest::new_forward_request(mix_packet).into_ws_message(
+        let msg = BinaryRequest::ForwardSphinx { packet: mix_packet }.into_ws_message(
             self.shared_key
                 .as_ref()
                 .expect("no shared key present even though we're authenticated!"),
-        );
+        )?;
         self.send_with_reconnection_on_failure(msg).await
     }
 
@@ -805,8 +941,8 @@ impl<C, St> GatewayClient<C, St> {
             self.establish_connection().await?;
         }
 
-        // TODO: the name of this method is very deceiving
-        self.perform_initial_authentication().await?;
+        // if we're reconnecting, because we lost connection, we need to re-authenticate the connection
+        self.authenticate().await?;
 
         // this call is NON-blocking
         self.start_listening_for_mixnet_messages()?;
@@ -820,16 +956,16 @@ impl<C, St> GatewayClient<C, St> {
         Ok(())
     }
 
-    pub async fn authenticate_and_start(&mut self) -> Result<Arc<SharedKeys>, GatewayClientError>
+    pub async fn claim_initial_bandwidth(&mut self) -> Result<(), GatewayClientError>
     where
         C: DkgQueryClient + Send + Sync,
         St: CredentialStorage,
         <St as CredentialStorage>::StorageError: Send + Sync + 'static,
     {
-        if !self.connection.is_established() {
-            self.establish_connection().await?;
+        if !self.authenticated {
+            return Err(GatewayClientError::NotAuthenticated);
         }
-        let shared_key = self.perform_initial_authentication().await?;
+
         let bandwidth_remaining = self.bandwidth.remaining();
         if bandwidth_remaining < self.cfg.bandwidth.remaining_bandwidth_threshold {
             self.cfg
@@ -838,6 +974,20 @@ impl<C, St> GatewayClient<C, St> {
             info!("Claiming more bandwidth with existing credentials. Stop the process now if you don't want that to happen.");
             self.claim_bandwidth().await?;
         }
+        Ok(())
+    }
+
+    #[deprecated(note = "this method does not deal with upgraded keys for legacy clients")]
+    pub async fn authenticate_and_start(
+        &mut self,
+    ) -> Result<AuthenticationResponse, GatewayClientError>
+    where
+        C: DkgQueryClient + Send + Sync,
+        St: CredentialStorage,
+        <St as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
+        let shared_key = self.perform_initial_authentication().await?;
+        self.claim_initial_bandwidth().await?;
 
         // this call is NON-blocking
         self.start_listening_for_mixnet_messages()?;

common/client-libs/gateway-client/src/error.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_gateway_requests::registration::handshake::error::HandshakeError;
-use nym_gateway_requests::SimpleGatewayRequestsError;
+use nym_gateway_requests::{GatewayRequestsError, SimpleGatewayRequestsError};
 use std::io;
 use thiserror::Error;
 use tungstenite::Error as WsError;
@@ -21,9 +21,21 @@ pub enum GatewayClientError {
     #[error("gateway returned an error response: {0}")]
     TypedGatewayError(SimpleGatewayRequestsError),
 
+    #[error("request error: {0}")]
+    RequestError(#[from] GatewayRequestsError),
+
     #[error("There was a network error: {0}")]
     NetworkError(#[from] WsError),
 
+    #[error("failed to upgrade our shared key - the gateway sent malformed response")]
+    FatalKeyUpgradeFailure,
+
+    #[error("the current key is already up to date! there's no need to upgrade it")]
+    KeyAlreadyUpgraded,
+
+    #[error("can't perform key upgrade as the key is already being used elsewhere")]
+    KeyAlreadyInUse,
+
     #[cfg(target_arch = "wasm32")]
     #[error("There was a network error: {0}")]
     NetworkErrorWasm(#[from] JsError),
@@ -73,8 +85,8 @@ pub enum GatewayClientError {
         cutoff_bi2: String,
     },
 
-    #[error("Received an unexpected response")]
-    UnexpectedResponse,
+    #[error("received an unexpected response of type {name}")]
+    UnexpectedResponse { name: String },
 
     #[error("Connection is in an invalid state - please send a bug report")]
     ConnectionInInvalidState,

common/client-libs/gateway-client/src/lib.rs

@@ -2,12 +2,14 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::GatewayClientError;
-use log::warn;
 use nym_gateway_requests::BinaryResponse;
+use tracing::{error, warn};
 use tungstenite::{protocol::Message, Error as WsError};
 
 pub use client::{config::GatewayClientConfig, GatewayClient, GatewayConfig};
-pub use nym_gateway_requests::registration::handshake::SharedKeys;
+pub use nym_gateway_requests::shared_key::{
+    LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey,
+};
 pub use packet_router::{
     AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
     PacketRouter,
@@ -45,11 +47,15 @@ pub(crate) fn cleanup_socket_messages(
 
 pub(crate) fn try_decrypt_binary_message(
     bin_msg: Vec<u8>,
-    shared_keys: &SharedKeys,
+    shared_keys: &SharedGatewayKey,
 ) -> Option<Vec<u8>> {
     match BinaryResponse::try_from_encrypted_tagged_bytes(bin_msg, shared_keys) {
         Ok(bin_response) => match bin_response {
-            BinaryResponse::PushedMixMessage(plaintext) => Some(plaintext),
+            BinaryResponse::PushedMixMessage { message } => Some(message),
+            _ => {
+                error!("received unhandled binary response");
+                None
+            }
         },
         Err(err) => {
             warn!("message received from the gateway was malformed! - {err}",);

common/client-libs/gateway-client/src/packet_router.rs

@@ -44,7 +44,7 @@ impl PacketRouter {
             // having already been dropped
             if self.shutdown.is_shutdown_poll() || self.shutdown.is_dummy() {
                 // This should ideally not happen, but it's ok
-                log::warn!("Failed to send mixnet messages due to receiver task shutdown");
+                tracing::warn!("Failed to send mixnet messages due to receiver task shutdown");
                 return Err(GatewayClientError::ShutdownInProgress);
             }
             // This should never happen during ordinary operation the way it's currently used.
@@ -60,7 +60,7 @@ impl PacketRouter {
             // having already been dropped
             if self.shutdown.is_shutdown_poll() || self.shutdown.is_dummy() {
                 // This should ideally not happen, but it's ok
-                log::warn!("Failed to send acks due to receiver task shutdown");
+                tracing::warn!("Failed to send acks due to receiver task shutdown");
                 return Err(GatewayClientError::ShutdownInProgress);
             }
             // This should never happen during ordinary operation the way it's currently used.

common/client-libs/gateway-client/src/socket_state.rs

@@ -9,15 +9,15 @@ use crate::{cleanup_socket_messages, try_decrypt_binary_message};
 use futures::channel::oneshot;
 use futures::stream::{SplitSink, SplitStream};
 use futures::{SinkExt, StreamExt};
-use log::*;
-use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_gateway_requests::{ServerResponse, SimpleGatewayRequestsError};
 use nym_task::TaskClient;
+use si_scale::helpers::bibytes2;
 use std::os::raw::c_int as RawFd;
 use std::sync::Arc;
+use tracing::*;
 use tungstenite::{protocol::Message, Error as WsError};
 
-use si_scale::helpers::bibytes2;
 #[cfg(unix)]
 use std::os::fd::AsRawFd;
 #[cfg(not(target_arch = "wasm32"))]
@@ -62,7 +62,7 @@ pub(crate) struct PartiallyDelegatedHandle {
 
 struct PartiallyDelegatedRouter {
     packet_router: PacketRouter,
-    shared_key: Arc<SharedKeys>,
+    shared_key: Arc<SharedGatewayKey>,
     client_bandwidth: ClientBandwidth,
 
     stream_return: SplitStreamSender,
@@ -72,7 +72,7 @@ struct PartiallyDelegatedRouter {
 impl PartiallyDelegatedRouter {
     fn new(
         packet_router: PacketRouter,
-        shared_key: Arc<SharedKeys>,
+        shared_key: Arc<SharedGatewayKey>,
         client_bandwidth: ClientBandwidth,
         stream_return: SplitStreamSender,
         stream_return_requester: oneshot::Receiver<()>,
@@ -247,7 +247,7 @@ impl PartiallyDelegatedHandle {
     pub(crate) fn split_and_listen_for_mixnet_messages(
         conn: WsConn,
         packet_router: PacketRouter,
-        shared_key: Arc<SharedKeys>,
+        shared_key: Arc<SharedGatewayKey>,
         client_bandwidth: ClientBandwidth,
         shutdown: TaskClient,
     ) -> Self {

common/client-libs/gateway-client/src/traits.rs

@@ -1,9 +1,9 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use log::{error, trace, warn};
 use nym_sphinx::addressing::nodes::MAX_NODE_ADDRESS_UNPADDED_LEN;
 use nym_sphinx::params::PacketSize;
+use tracing::{error, trace, warn};
 
 pub trait GatewayPacketRouter {
     type Error: std::error::Error;

common/client-libs/validator-client/Cargo.toml

@@ -20,11 +20,12 @@ nym-coconut-bandwidth-contract-common = { path = "../../cosmwasm-smart-contracts
 nym-ecash-contract-common = { path = "../../cosmwasm-smart-contracts/ecash-contract" }
 nym-multisig-contract-common = { path = "../../cosmwasm-smart-contracts/multisig-contract" }
 nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contract" }
+nym-serde-helpers = { path = "../../serde-helpers", features = ["hex", "base64"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 nym-http-api-client = { path = "../../../common/http-api-client" }
 thiserror = { workspace = true }
-log = { workspace = true }
+tracing = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
 time = { workspace = true, features = ["formatting"] }

common/client-libs/validator-client/src/client.rs

@@ -17,11 +17,11 @@ use nym_api_requests::ecash::{
     BlindSignRequestBody, BlindedSignatureResponse, PartialCoinIndicesSignatureResponse,
     PartialExpirationDateSignatureResponse, VerificationKeyResponse,
 };
-use nym_api_requests::models::{DescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::models::{
     GatewayCoreStatusResponse, MixnodeCoreStatusResponse, MixnodeStatusResponse,
     RewardEstimationResponse, StakeSaturationResponse,
 };
+use nym_api_requests::models::{LegacyDescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::nym_nodes::SkimmedNode;
 use nym_coconut_dkg_common::types::EpochId;
 use nym_http_api_client::UserAgent;
@@ -31,7 +31,7 @@ use url::Url;
 
 pub use crate::nym_api::NymApiClientExt;
 pub use nym_mixnet_contract_common::{
-    mixnode::MixNodeDetails, GatewayBond, IdentityKey, IdentityKeyRef, MixId,
+    mixnode::MixNodeDetails, GatewayBond, IdentityKey, IdentityKeyRef, NodeId,
 };
 
 // re-export the type to not break existing imports
@@ -265,6 +265,13 @@ impl NymApiClient {
         NymApiClient { nym_api }
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn new_with_timeout(api_url: Url, timeout: std::time::Duration) -> Self {
+        let nym_api = nym_api::Client::new(api_url, Some(timeout));
+
+        NymApiClient { nym_api }
+    }
+
     pub fn new_with_user_agent(api_url: Url, user_agent: UserAgent) -> Self {
         let nym_api = nym_api::Client::builder::<_, ValidatorClientError>(api_url)
             .expect("invalid api url")
@@ -283,6 +290,7 @@ impl NymApiClient {
         self.nym_api.change_base_url(new_endpoint);
     }
 
+    #[deprecated(note = "use get_basic_active_mixing_assigned_nodes instead")]
     pub async fn get_basic_mixnodes(
         &self,
         semver_compatibility: Option<String>,
@@ -294,6 +302,7 @@ impl NymApiClient {
             .nodes)
     }
 
+    #[deprecated(note = "use get_all_basic_entry_assigned_nodes instead")]
     pub async fn get_basic_gateways(
         &self,
         semver_compatibility: Option<String>,
@@ -305,6 +314,70 @@ impl NymApiClient {
             .nodes)
     }
 
+    /// retrieve basic information for nodes are capable of operating as an entry gateway
+    /// this includes legacy gateways and nym-nodes
+    pub async fn get_all_basic_entry_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut nodes = Vec::new();
+
+        loop {
+            let mut res = self
+                .nym_api
+                .get_all_basic_entry_assigned_nodes(
+                    semver_compatibility.clone(),
+                    false,
+                    Some(page),
+                    None,
+                )
+                .await?;
+
+            nodes.append(&mut res.nodes.data);
+            if nodes.len() < res.nodes.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(nodes)
+    }
+
+    /// retrieve basic information for nodes that got assigned 'mixing' node in this epoch
+    /// this includes legacy mixnodes and nym-nodes
+    pub async fn get_basic_active_mixing_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+    ) -> Result<Vec<SkimmedNode>, ValidatorClientError> {
+        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
+        let mut page = 0;
+        let mut nodes = Vec::new();
+
+        loop {
+            let mut res = self
+                .nym_api
+                .get_basic_active_mixing_assigned_nodes(
+                    semver_compatibility.clone(),
+                    false,
+                    Some(page),
+                    None,
+                )
+                .await?;
+
+            nodes.append(&mut res.nodes.data);
+            if nodes.len() < res.nodes.pagination.total {
+                page += 1
+            } else {
+                break;
+            }
+        }
+
+        Ok(nodes)
+    }
+
     pub async fn get_cached_active_mixnodes(
         &self,
     ) -> Result<Vec<MixNodeDetails>, ValidatorClientError> {
@@ -327,7 +400,7 @@ impl NymApiClient {
 
     pub async fn get_cached_described_gateways(
         &self,
-    ) -> Result<Vec<DescribedGateway>, ValidatorClientError> {
+    ) -> Result<Vec<LegacyDescribedGateway>, ValidatorClientError> {
         Ok(self.nym_api.get_gateways_described().await?)
     }
 
@@ -344,7 +417,7 @@ impl NymApiClient {
 
     pub async fn get_mixnode_core_status_count(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         since: Option<i64>,
     ) -> Result<MixnodeCoreStatusResponse, ValidatorClientError> {
         Ok(self
@@ -355,21 +428,21 @@ impl NymApiClient {
 
     pub async fn get_mixnode_status(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeStatusResponse, ValidatorClientError> {
         Ok(self.nym_api.get_mixnode_status(mix_id).await?)
     }
 
     pub async fn get_mixnode_reward_estimation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<RewardEstimationResponse, ValidatorClientError> {
         Ok(self.nym_api.get_mixnode_reward_estimation(mix_id).await?)
     }
 
     pub async fn get_mixnode_stake_saturation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<StakeSaturationResponse, ValidatorClientError> {
         Ok(self.nym_api.get_mixnode_stake_saturation(mix_id).await?)
     }

common/client-libs/validator-client/src/connection_tester.rs

@@ -121,36 +121,36 @@ async fn test_nyxd_connection(
     {
         Ok(Err(NyxdError::TendermintErrorRpc(e))) => {
             // If we get a tendermint-rpc error, we classify the node as not contactable
-            log::warn!("Checking: nyxd url: {url}: {}: {}", "failed".red(), e);
+            tracing::warn!("Checking: nyxd url: {url}: {}: {}", "failed".red(), e);
             false
         }
         Ok(Err(NyxdError::AbciError { code, log, .. })) => {
             // We accept the mixnet contract not found as ok from a connection standpoint. This happens
             // for example on a pre-launch network.
-            log::debug!(
+            tracing::debug!(
                 "Checking: nyxd url: {url}: {}, but with abci error: {code}: {log}",
                 "success".green()
             );
             code == 18
         }
         Ok(Err(error @ NyxdError::NoContractAddressAvailable(_))) => {
-            log::warn!("Checking: nyxd url: {url}: {}: {error}", "failed".red());
+            tracing::warn!("Checking: nyxd url: {url}: {}: {error}", "failed".red());
             false
         }
         Ok(Err(e)) => {
             // For any other error, we're optimistic and just try anyway.
-            log::warn!(
+            tracing::warn!(
                 "Checking: nyxd_url: {url}: {}, but with error: {e}",
                 "success".green()
             );
             true
         }
         Ok(Ok(_)) => {
-            log::debug!("Checking: nyxd_url: {url}: {}", "success".green());
+            tracing::debug!("Checking: nyxd_url: {url}: {}", "success".green());
             true
         }
         Err(e) => {
-            log::warn!("Checking: nyxd_url: {url}: {}: {e}", "failed".red());
+            tracing::warn!("Checking: nyxd_url: {url}: {}: {e}", "failed".red());
             false
         }
     };
@@ -169,15 +169,15 @@ async fn test_nym_api_connection(
     .await
     {
         Ok(Ok(_)) => {
-            log::debug!("Checking: api_url: {url}: {}", "success".green());
+            tracing::debug!("Checking: api_url: {url}: {}", "success".green());
             true
         }
         Ok(Err(e)) => {
-            log::debug!("Checking: api_url: {url}: {}: {e}", "failed".red());
+            tracing::debug!("Checking: api_url: {url}: {}: {e}", "failed".red());
             false
         }
         Err(e) => {
-            log::debug!("Checking: api_url: {url}: {}: {e}", "failed".red());
+            tracing::debug!("Checking: api_url: {url}: {}: {e}", "failed".red());
             false
         }
     };

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -10,8 +10,10 @@ use nym_api_requests::ecash::models::{
     VerifyEcashTicketBody,
 };
 use nym_api_requests::ecash::VerificationKeyResponse;
-use nym_api_requests::models::DescribedMixNode;
-use nym_api_requests::nym_nodes::{CachedNodesResponse, SkimmedNode};
+use nym_api_requests::models::{
+    AnnotationResponse, LegacyDescribedMixNode, NodePerformanceResponse,
+};
+use nym_api_requests::nym_nodes::PaginatedCachedNodesResponse;
 pub use nym_api_requests::{
     ecash::{
         models::{
@@ -23,21 +25,23 @@ pub use nym_api_requests::{
         VerifyEcashCredentialBody,
     },
     models::{
-        ComputeRewardEstParam, DescribedGateway, GatewayBondAnnotated, GatewayCoreStatusResponse,
+        ComputeRewardEstParam, GatewayBondAnnotated, GatewayCoreStatusResponse,
         GatewayStatusReportResponse, GatewayUptimeHistoryResponse, InclusionProbabilityResponse,
-        MixNodeBondAnnotated, MixnodeCoreStatusResponse, MixnodeStatusReportResponse,
-        MixnodeStatusResponse, MixnodeUptimeHistoryResponse, RewardEstimationResponse,
-        StakeSaturationResponse, UptimeResponse,
+        LegacyDescribedGateway, MixNodeBondAnnotated, MixnodeCoreStatusResponse,
+        MixnodeStatusReportResponse, MixnodeStatusResponse, MixnodeUptimeHistoryResponse,
+        RewardEstimationResponse, StakeSaturationResponse, UptimeResponse,
     },
+    nym_nodes::{CachedNodesResponse, SkimmedNode},
 };
 pub use nym_coconut_dkg_common::types::EpochId;
 use nym_contracts_common::IdentityKey;
 pub use nym_http_api_client::Client;
 use nym_http_api_client::{ApiClient, NO_PARAMS};
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
-use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, MixId};
+use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, NodeId};
 use time::format_description::BorrowedFormatItem;
 use time::Date;
+use tracing::instrument;
 
 pub mod error;
 pub mod routes;
@@ -49,11 +53,13 @@ pub fn rfc_3339_date() -> Vec<BorrowedFormatItem<'static>> {
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait NymApiClientExt: ApiClient {
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnodes(&self) -> Result<Vec<MixNodeDetails>, NymAPIError> {
         self.get_json(&[routes::API_VERSION, routes::MIXNODES], NO_PARAMS)
             .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnodes_detailed(&self) -> Result<Vec<MixNodeBondAnnotated>, NymAPIError> {
         self.get_json(
             &[
@@ -67,6 +73,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateways_detailed(&self) -> Result<Vec<GatewayBondAnnotated>, NymAPIError> {
         self.get_json(
             &[
@@ -80,6 +87,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnodes_detailed_unfiltered(
         &self,
     ) -> Result<Vec<MixNodeBondAnnotated>, NymAPIError> {
@@ -95,12 +103,14 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateways(&self) -> Result<Vec<GatewayBond>, NymAPIError> {
         self.get_json(&[routes::API_VERSION, routes::GATEWAYS], NO_PARAMS)
             .await
     }
 
-    async fn get_gateways_described(&self) -> Result<Vec<DescribedGateway>, NymAPIError> {
+    #[instrument(level = "debug", skip(self))]
+    async fn get_gateways_described(&self) -> Result<Vec<LegacyDescribedGateway>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::GATEWAYS, routes::DESCRIBED],
             NO_PARAMS,
@@ -108,7 +118,8 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
-    async fn get_mixnodes_described(&self) -> Result<Vec<DescribedMixNode>, NymAPIError> {
+    #[instrument(level = "debug", skip(self))]
+    async fn get_mixnodes_described(&self) -> Result<Vec<LegacyDescribedMixNode>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::MIXNODES, routes::DESCRIBED],
             NO_PARAMS,
@@ -116,6 +127,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[tracing::instrument(level = "debug", skip_all)]
     async fn get_basic_mixnodes(
         &self,
         semver_compatibility: Option<String>,
@@ -139,6 +151,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_basic_gateways(
         &self,
         semver_compatibility: Option<String>,
@@ -162,6 +175,91 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    /// retrieve basic information for nodes are capable of operating as an entry gateway
+    /// this includes legacy gateways and nym-nodes
+    #[instrument(level = "debug", skip(self))]
+    async fn get_all_basic_entry_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+        no_legacy: bool,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(arg) = &semver_compatibility {
+            params.push(("semver_compatibility", arg.clone()))
+        }
+
+        if no_legacy {
+            params.push(("no_legacy", "true".to_string()))
+        }
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "unstable",
+                "nym-nodes",
+                "skimmed",
+                "entry-gateways",
+                "all",
+            ],
+            &params,
+        )
+        .await
+    }
+
+    /// retrieve basic information for nodes that got assigned 'mixing' node in this epoch
+    /// this includes legacy mixnodes and nym-nodes
+    #[instrument(level = "debug", skip(self))]
+    async fn get_basic_active_mixing_assigned_nodes(
+        &self,
+        semver_compatibility: Option<String>,
+        no_legacy: bool,
+        page: Option<u32>,
+        per_page: Option<u32>,
+    ) -> Result<PaginatedCachedNodesResponse<SkimmedNode>, NymAPIError> {
+        let mut params = Vec::new();
+
+        if let Some(arg) = &semver_compatibility {
+            params.push(("semver_compatibility", arg.clone()))
+        }
+
+        if no_legacy {
+            params.push(("no_legacy", "true".to_string()))
+        }
+
+        if let Some(page) = page {
+            params.push(("page", page.to_string()))
+        }
+
+        if let Some(per_page) = per_page {
+            params.push(("per_page", per_page.to_string()))
+        }
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                "unstable",
+                "nym-nodes",
+                "skimmed",
+                "mixnodes",
+                "active",
+            ],
+            &params,
+        )
+        .await
+    }
+
+    #[instrument(level = "debug", skip(self))]
     async fn get_active_mixnodes(&self) -> Result<Vec<MixNodeDetails>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::MIXNODES, routes::ACTIVE],
@@ -170,6 +268,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_active_mixnodes_detailed(&self) -> Result<Vec<MixNodeBondAnnotated>, NymAPIError> {
         self.get_json(
             &[
@@ -184,6 +283,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_rewarded_mixnodes(&self) -> Result<Vec<MixNodeDetails>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::MIXNODES, routes::REWARDED],
@@ -192,9 +292,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_report(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeStatusReportResponse, NymAPIError> {
         self.get_json(
             &[
@@ -209,6 +310,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateway_report(
         &self,
         identity: IdentityKeyRef<'_>,
@@ -226,9 +328,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_history(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeUptimeHistoryResponse, NymAPIError> {
         self.get_json(
             &[
@@ -243,6 +346,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateway_history(
         &self,
         identity: IdentityKeyRef<'_>,
@@ -260,6 +364,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_rewarded_mixnodes_detailed(
         &self,
     ) -> Result<Vec<MixNodeBondAnnotated>, NymAPIError> {
@@ -276,6 +381,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateway_core_status_count(
         &self,
         identity: IdentityKeyRef<'_>,
@@ -307,9 +413,10 @@ pub trait NymApiClientExt: ApiClient {
         }
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_core_status_count(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         since: Option<i64>,
     ) -> Result<MixnodeCoreStatusResponse, NymAPIError> {
         if let Some(since) = since {
@@ -339,9 +446,10 @@ pub trait NymApiClientExt: ApiClient {
         }
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_status(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeStatusResponse, NymAPIError> {
         self.get_json(
             &[
@@ -356,9 +464,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_reward_estimation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<RewardEstimationResponse, NymAPIError> {
         self.get_json(
             &[
@@ -373,9 +482,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn compute_mixnode_reward_estimation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         request_body: &ComputeRewardEstParam,
     ) -> Result<RewardEstimationResponse, NymAPIError> {
         self.post_json(
@@ -392,9 +502,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_stake_saturation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<StakeSaturationResponse, NymAPIError> {
         self.get_json(
             &[
@@ -409,9 +520,10 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_mixnode_inclusion_probability(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<InclusionProbabilityResponse, NymAPIError> {
         self.get_json(
             &[
@@ -426,7 +538,24 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
-    async fn get_mixnode_avg_uptime(&self, mix_id: MixId) -> Result<UptimeResponse, NymAPIError> {
+    #[instrument(level = "debug", skip(self))]
+    async fn get_current_node_performance(
+        &self,
+        node_id: NodeId,
+    ) -> Result<NodePerformanceResponse, NymAPIError> {
+        self.get_json_from(format!("/v1/nym-nodes/performance/{node_id}"))
+            .await
+    }
+
+    async fn get_node_annotation(
+        &self,
+        node_id: NodeId,
+    ) -> Result<AnnotationResponse, NymAPIError> {
+        self.get_json_from(format!("/v1/nym-nodes/annotation/{node_id}"))
+            .await
+    }
+
+    async fn get_mixnode_avg_uptime(&self, mix_id: NodeId) -> Result<UptimeResponse, NymAPIError> {
         self.get_json(
             &[
                 routes::API_VERSION,
@@ -440,7 +569,8 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
-    async fn get_mixnodes_blacklisted(&self) -> Result<Vec<MixId>, NymAPIError> {
+    #[instrument(level = "debug", skip(self))]
+    async fn get_mixnodes_blacklisted(&self) -> Result<Vec<NodeId>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::MIXNODES, routes::BLACKLISTED],
             NO_PARAMS,
@@ -448,6 +578,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn get_gateways_blacklisted(&self) -> Result<Vec<IdentityKey>, NymAPIError> {
         self.get_json(
             &[routes::API_VERSION, routes::GATEWAYS, routes::BLACKLISTED],
@@ -456,6 +587,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self, request_body))]
     async fn blind_sign(
         &self,
         request_body: &BlindSignRequestBody,
@@ -472,6 +604,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self, request_body))]
     async fn verify_ecash_ticket(
         &self,
         request_body: &VerifyEcashTicketBody,
@@ -488,6 +621,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self, request_body))]
     async fn batch_redeem_ecash_tickets(
         &self,
         request_body: &BatchRedeemTicketsBody,
@@ -504,6 +638,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn double_spending_filter_v1(&self) -> Result<SpentCredentialsResponse, NymAPIError> {
         self.get_json(
             &[
@@ -516,6 +651,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn partial_expiration_date_signatures(
         &self,
         expiration_date: Option<Date>,
@@ -539,6 +675,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn partial_coin_indices_signatures(
         &self,
         epoch_id: Option<EpochId>,
@@ -559,6 +696,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn global_expiration_date_signatures(
         &self,
         expiration_date: Option<Date>,
@@ -582,6 +720,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn global_coin_indices_signatures(
         &self,
         epoch_id: Option<EpochId>,
@@ -602,6 +741,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn master_verification_key(
         &self,
         epoch_id: Option<EpochId>,
@@ -621,6 +761,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn epoch_credentials(
         &self,
         dkg_epoch: EpochId,
@@ -637,6 +778,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn issued_credential(
         &self,
         credential_id: i64,
@@ -653,6 +795,7 @@ pub trait NymApiClientExt: ApiClient {
         .await
     }
 
+    #[instrument(level = "debug", skip(self))]
     async fn issued_credentials(
         &self,
         credential_ids: Vec<i64>,

common/client-libs/validator-client/src/nym_api/routes.rs

@@ -38,6 +38,7 @@ pub mod ecash {
 pub const STATUS_ROUTES: &str = "status";
 pub const MIXNODE: &str = "mixnode";
 pub const GATEWAY: &str = "gateway";
+pub const NYM_NODES: &str = "nym-nodes";
 
 pub const CORE_STATUS_COUNT: &str = "core-status-count";
 pub const SINCE_ARG: &str = "since";
@@ -52,5 +53,6 @@ pub const STAKE_SATURATION: &str = "stake-saturation";
 pub const INCLUSION_CHANCE: &str = "inclusion-probability";
 pub const SUBMIT_GATEWAY: &str = "submit-gateway-monitoring-results";
 pub const SUBMIT_NODE: &str = "submit-node-monitoring-results";
+pub const PERFORMANCE: &str = "performance";
 
 pub const SERVICE_PROVIDERS: &str = "services";

common/client-libs/validator-client/src/nyxd/contract_traits/dkg_query_client.rs

@@ -8,9 +8,9 @@ use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
 use cosmwasm_std::Addr;
-use log::trace;
 use nym_coconut_dkg_common::types::{ChunkIndex, NodeIndex, StateAdvanceResponse};
 use serde::Deserialize;
+use tracing::trace;
 
 use nym_coconut_dkg_common::dealer::RegisteredDealerDetails;
 pub use nym_coconut_dkg_common::{

common/client-libs/validator-client/src/nyxd/contract_traits/mixnet_query_client.rs

@@ -8,28 +8,33 @@ use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
 use nym_contracts_common::signing::Nonce;
+use nym_mixnet_contract_common::gateway::{PreassignedGatewayIdsResponse, PreassignedId};
+use nym_mixnet_contract_common::nym_node::{
+    EpochAssignmentResponse, NodeDetailsByIdentityResponse, NodeOwnershipResponse,
+    NodeRewardingDetailsResponse, PagedNymNodeBondsResponse, PagedNymNodeDetailsResponse,
+    PagedUnbondedNymNodesResponse, Role, RolesMetadataResponse, StakeSaturationResponse,
+    UnbondedNodeResponse, UnbondedNymNode,
+};
+use nym_mixnet_contract_common::reward_params::WorkFactor;
 use nym_mixnet_contract_common::{
     delegation,
-    delegation::{MixNodeDelegationResponse, OwnerProxySubKey},
-    families::{Family, FamilyHead},
+    delegation::{NodeDelegationResponse, OwnerProxySubKey},
     mixnode::{
-        MixnodeRewardingDetailsResponse, PagedMixnodesDetailsResponse,
-        PagedUnbondedMixnodesResponse, StakeSaturationResponse, UnbondedMixnodeResponse,
+        MixStakeSaturationResponse, MixnodeRewardingDetailsResponse, PagedMixnodesDetailsResponse,
+        PagedUnbondedMixnodesResponse, UnbondedMixnodeResponse,
     },
     reward_params::{Performance, RewardingParams},
     rewarding::{EstimatedCurrentEpochRewardResponse, PendingRewardResponse},
     ContractBuildInformation, ContractState, ContractStateParams, CurrentIntervalResponse,
-    Delegation, EpochEventId, EpochStatus, FamilyByHeadResponse, FamilyByLabelResponse,
-    FamilyMembersByHeadResponse, FamilyMembersByLabelResponse, GatewayBond, GatewayBondResponse,
-    GatewayOwnershipResponse, IdentityKey, IdentityKeyRef, IntervalEventId, LayerDistribution,
-    MixId, MixNodeBond, MixNodeDetails, MixOwnershipResponse, MixnodeDetailsByIdentityResponse,
-    MixnodeDetailsResponse, NumberOfPendingEventsResponse, PagedAllDelegationsResponse,
-    PagedDelegatorDelegationsResponse, PagedFamiliesResponse, PagedGatewayResponse,
-    PagedMembersResponse, PagedMixNodeDelegationsResponse, PagedMixnodeBondsResponse,
-    PagedRewardedSetResponse, PendingEpochEvent, PendingEpochEventResponse,
-    PendingEpochEventsResponse, PendingIntervalEvent, PendingIntervalEventResponse,
-    PendingIntervalEventsResponse, QueryMsg as MixnetQueryMsg, RewardedSetNodeStatus,
-    UnbondedMixnode,
+    Delegation, EpochEventId, EpochStatus, GatewayBond, GatewayBondResponse,
+    GatewayOwnershipResponse, IdentityKey, IdentityKeyRef, IntervalEventId, MixNodeBond,
+    MixNodeDetails, MixOwnershipResponse, MixnodeDetailsByIdentityResponse, MixnodeDetailsResponse,
+    NodeId, NumberOfPendingEventsResponse, NymNodeBond, NymNodeDetails,
+    PagedAllDelegationsResponse, PagedDelegatorDelegationsResponse, PagedGatewayResponse,
+    PagedMixnodeBondsResponse, PagedNodeDelegationsResponse, PendingEpochEvent,
+    PendingEpochEventResponse, PendingEpochEventsResponse, PendingIntervalEvent,
+    PendingIntervalEventResponse, PendingIntervalEventsResponse, QueryMsg as MixnetQueryMsg,
+    RewardedSet, UnbondedMixnode,
 };
 use serde::Deserialize;
 
@@ -91,56 +96,11 @@ pub trait MixnetQueryClient {
             .await
     }
 
-    async fn get_rewarded_set_paged(
-        &self,
-        start_after: Option<MixId>,
-        limit: Option<u32>,
-    ) -> Result<PagedRewardedSetResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetRewardedSet { limit, start_after })
-            .await
-    }
-
-    async fn get_all_node_families_paged(
-        &self,
-        start_after: Option<String>,
-        limit: Option<u32>,
-    ) -> Result<PagedFamiliesResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetAllFamiliesPaged { limit, start_after })
-            .await
-    }
-
-    async fn get_all_family_members_paged(
-        &self,
-        start_after: Option<String>,
-        limit: Option<u32>,
-    ) -> Result<PagedMembersResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetAllMembersPaged { limit, start_after })
-            .await
-    }
-
-    async fn get_family_members_by_head<S: Into<String> + Send>(
-        &self,
-        head: S,
-    ) -> Result<FamilyMembersByHeadResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetFamilyMembersByHead { head: head.into() })
-            .await
-    }
-
-    async fn get_family_members_by_label<S: Into<String> + Send>(
-        &self,
-        label: S,
-    ) -> Result<FamilyMembersByLabelResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetFamilyMembersByLabel {
-            label: label.into(),
-        })
-        .await
-    }
-
     // mixnode-related:
 
     async fn get_mixnode_bonds_paged(
         &self,
-        start_after: Option<MixId>,
+        start_after: Option<NodeId>,
         limit: Option<u32>,
     ) -> Result<PagedMixnodeBondsResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetMixNodeBonds { limit, start_after })
@@ -149,26 +109,26 @@ pub trait MixnetQueryClient {
 
     async fn get_mixnodes_detailed_paged(
         &self,
-        start_after: Option<MixId>,
+        start_after: Option<NodeId>,
         limit: Option<u32>,
     ) -> Result<PagedMixnodesDetailsResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetMixNodesDetailed { limit, start_after })
             .await
     }
 
-    async fn get_unbonded_paged(
+    async fn get_unbonded_mixnodes_paged(
         &self,
-        start_after: Option<MixId>,
+        start_after: Option<NodeId>,
         limit: Option<u32>,
     ) -> Result<PagedUnbondedMixnodesResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedMixNodes { limit, start_after })
             .await
     }
 
-    async fn get_unbonded_by_owner_paged(
+    async fn get_unbonded_mixnodes_by_owner_paged(
         &self,
         owner: &AccountId,
-        start_after: Option<MixId>,
+        start_after: Option<NodeId>,
         limit: Option<u32>,
     ) -> Result<PagedUnbondedMixnodesResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedMixNodesByOwner {
@@ -179,10 +139,10 @@ pub trait MixnetQueryClient {
         .await
     }
 
-    async fn get_unbonded_by_identity_paged(
+    async fn get_unbonded_mixnodes_by_identity_paged(
         &self,
         identity_key: IdentityKeyRef<'_>,
-        start_after: Option<MixId>,
+        start_after: Option<NodeId>,
         limit: Option<u32>,
     ) -> Result<PagedUnbondedMixnodesResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedMixNodesByIdentityKey {
@@ -205,7 +165,7 @@ pub trait MixnetQueryClient {
 
     async fn get_mixnode_details(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeDetailsResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetMixnodeDetails { mix_id })
             .await
@@ -223,7 +183,7 @@ pub trait MixnetQueryClient {
 
     async fn get_mixnode_rewarding_details(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<MixnodeRewardingDetailsResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetMixnodeRewardingDetails { mix_id })
             .await
@@ -231,24 +191,24 @@ pub trait MixnetQueryClient {
 
     async fn get_mixnode_stake_saturation(
         &self,
-        mix_id: MixId,
-    ) -> Result<StakeSaturationResponse, NyxdError> {
+        mix_id: NodeId,
+    ) -> Result<MixStakeSaturationResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetStakeSaturation { mix_id })
             .await
     }
 
     async fn get_unbonded_mixnode_information(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<UnbondedMixnodeResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedMixNodeInformation { mix_id })
             .await
     }
 
-    async fn get_layer_distribution(&self) -> Result<LayerDistribution, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetLayerDistribution {})
-            .await
-    }
+    // async fn get_layer_distribution(&self) -> Result<LayerDistribution, NyxdError> {
+    //     self.query_mixnet_contract(MixnetQueryMsg::GetRoleDistribution {})
+    //         .await
+    // }
 
     // gateway-related:
 
@@ -281,17 +241,142 @@ pub trait MixnetQueryClient {
         .await
     }
 
+    async fn get_preassigned_gateway_ids_paged(
+        &self,
+        start_after: Option<IdentityKey>,
+        limit: Option<u32>,
+    ) -> Result<PreassignedGatewayIdsResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetPreassignedGatewayIds { start_after, limit })
+            .await
+    }
+
+    // nym-nodes related:
+    async fn get_nymnode_bonds_paged(
+        &self,
+        start_after: Option<NodeId>,
+        limit: Option<u32>,
+    ) -> Result<PagedNymNodeBondsResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodeBondsPaged { limit, start_after })
+            .await
+    }
+
+    async fn get_nymnodes_detailed_paged(
+        &self,
+        start_after: Option<NodeId>,
+        limit: Option<u32>,
+    ) -> Result<PagedNymNodeDetailsResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodesDetailedPaged { limit, start_after })
+            .await
+    }
+
+    async fn get_unbonded_nymnodes_paged(
+        &self,
+        start_after: Option<NodeId>,
+        limit: Option<u32>,
+    ) -> Result<PagedUnbondedNymNodesResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedNymNodesPaged { limit, start_after })
+            .await
+    }
+
+    async fn get_unbonded_nymnodes_by_owner_paged(
+        &self,
+        owner: &AccountId,
+        start_after: Option<NodeId>,
+        limit: Option<u32>,
+    ) -> Result<PagedUnbondedNymNodesResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedNymNodesByOwnerPaged {
+            owner: owner.to_string(),
+            limit,
+            start_after,
+        })
+        .await
+    }
+
+    async fn get_unbonded_nymnodes_by_identity_paged(
+        &self,
+        identity_key: IdentityKeyRef<'_>,
+        start_after: Option<NodeId>,
+        limit: Option<u32>,
+    ) -> Result<PagedUnbondedNymNodesResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedNymNodesByIdentityKeyPaged {
+            identity_key: identity_key.to_string(),
+            limit,
+            start_after,
+        })
+        .await
+    }
+
+    async fn get_owned_nymnode(
+        &self,
+        address: &AccountId,
+    ) -> Result<NodeOwnershipResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetOwnedNymNode {
+            address: address.to_string(),
+        })
+        .await
+    }
+
+    async fn get_nymnode_details(
+        &self,
+        node_id: NodeId,
+    ) -> Result<NodeOwnershipResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodeDetails { node_id })
+            .await
+    }
+
+    async fn get_nymnode_details_by_identity(
+        &self,
+        node_identity: IdentityKey,
+    ) -> Result<NodeDetailsByIdentityResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNymNodeDetailsByIdentityKey { node_identity })
+            .await
+    }
+
+    async fn get_nymnode_rewarding_details(
+        &self,
+        node_id: NodeId,
+    ) -> Result<NodeRewardingDetailsResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNodeRewardingDetails { node_id })
+            .await
+    }
+
+    async fn get_node_stake_saturation(
+        &self,
+        node_id: NodeId,
+    ) -> Result<StakeSaturationResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNodeStakeSaturation { node_id })
+            .await
+    }
+
+    async fn get_unbonded_nymnode_information(
+        &self,
+        node_id: NodeId,
+    ) -> Result<UnbondedNodeResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetUnbondedNymNode { node_id })
+            .await
+    }
+
+    async fn get_role_assignment(&self, role: Role) -> Result<EpochAssignmentResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetRoleAssignment { role })
+            .await
+    }
+
+    async fn get_rewarded_set_metadata(&self) -> Result<RolesMetadataResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetRewardedSetMetadata {})
+            .await
+    }
+
     // delegation-related:
 
     /// Gets list of all delegations towards particular mixnode on particular page.
     async fn get_mixnode_delegations_paged(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
         start_after: Option<String>,
         limit: Option<u32>,
-    ) -> Result<PagedMixNodeDelegationsResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetMixnodeDelegations {
-            mix_id,
+    ) -> Result<PagedNodeDelegationsResponse, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetNodeDelegations {
+            node_id,
             start_after,
             limit,
         })
@@ -302,7 +387,7 @@ pub trait MixnetQueryClient {
     async fn get_delegator_delegations_paged(
         &self,
         delegator: &AccountId,
-        start_after: Option<(MixId, OwnerProxySubKey)>,
+        start_after: Option<(NodeId, OwnerProxySubKey)>,
         limit: Option<u32>,
     ) -> Result<PagedDelegatorDelegationsResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetDelegatorDelegations {
@@ -316,12 +401,12 @@ pub trait MixnetQueryClient {
     /// Checks value of delegation of given client towards particular mixnode.
     async fn get_delegation_details(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
         delegator: &AccountId,
         proxy: Option<String>,
-    ) -> Result<MixNodeDelegationResponse, NyxdError> {
+    ) -> Result<NodeDelegationResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetDelegationDetails {
-            mix_id,
+            node_id,
             delegator: delegator.to_string(),
             proxy,
         })
@@ -351,21 +436,21 @@ pub trait MixnetQueryClient {
 
     async fn get_pending_mixnode_operator_reward(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
     ) -> Result<PendingRewardResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetPendingMixNodeOperatorReward { mix_id })
+        self.query_mixnet_contract(MixnetQueryMsg::GetPendingNodeOperatorReward { node_id })
             .await
     }
 
     async fn get_pending_delegator_reward(
         &self,
         delegator: &AccountId,
-        mix_id: MixId,
+        node_id: NodeId,
         proxy: Option<String>,
     ) -> Result<PendingRewardResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetPendingDelegatorReward {
             address: delegator.to_string(),
-            mix_id,
+            node_id,
             proxy,
         })
         .await
@@ -374,12 +459,14 @@ pub trait MixnetQueryClient {
     // given the provided performance, estimate the reward at the end of the current epoch
     async fn get_estimated_current_epoch_operator_reward(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
         estimated_performance: Performance,
+        estimated_work: Option<WorkFactor>,
     ) -> Result<EstimatedCurrentEpochRewardResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetEstimatedCurrentEpochOperatorReward {
-            mix_id,
+            node_id,
             estimated_performance,
+            estimated_work,
         })
         .await
     }
@@ -388,15 +475,15 @@ pub trait MixnetQueryClient {
     async fn get_estimated_current_epoch_delegator_reward(
         &self,
         delegator: &AccountId,
-        mix_id: MixId,
-        proxy: Option<String>,
+        node_id: NodeId,
         estimated_performance: Performance,
+        estimated_work: Option<WorkFactor>,
     ) -> Result<EstimatedCurrentEpochRewardResponse, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetEstimatedCurrentEpochDelegatorReward {
             address: delegator.to_string(),
-            mix_id,
-            proxy,
+            node_id,
             estimated_performance,
+            estimated_work,
         })
         .await
     }
@@ -450,22 +537,6 @@ pub trait MixnetQueryClient {
         })
         .await
     }
-
-    async fn get_node_family_by_label(
-        &self,
-        label: String,
-    ) -> Result<FamilyByLabelResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetFamilyByLabel { label })
-            .await
-    }
-
-    async fn get_node_family_by_head(
-        &self,
-        head: String,
-    ) -> Result<FamilyByHeadResponse, NyxdError> {
-        self.query_mixnet_contract(MixnetQueryMsg::GetFamilyByHead { head })
-            .await
-    }
 }
 
 // extension trait to the query client to deal with the paged queries
@@ -473,18 +544,35 @@ pub trait MixnetQueryClient {
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait PagedMixnetQueryClient: MixnetQueryClient {
-    async fn get_all_node_families(&self) -> Result<Vec<Family>, NyxdError> {
-        collect_paged!(self, get_all_node_families_paged, families)
+    async fn get_all_nymnode_bonds(&self) -> Result<Vec<NymNodeBond>, NyxdError> {
+        collect_paged!(self, get_nymnode_bonds_paged, nodes)
     }
 
-    async fn get_all_family_members(&self) -> Result<Vec<(IdentityKey, FamilyHead)>, NyxdError> {
-        collect_paged!(self, get_all_family_members_paged, members)
+    async fn get_all_nymnodes_detailed(&self) -> Result<Vec<NymNodeDetails>, NyxdError> {
+        collect_paged!(self, get_nymnodes_detailed_paged, nodes)
     }
 
-    async fn get_all_rewarded_set_mixnodes(
+    async fn get_all_unbonded_nymnodes(&self) -> Result<Vec<UnbondedNymNode>, NyxdError> {
+        collect_paged!(self, get_unbonded_nymnodes_paged, nodes)
+    }
+
+    async fn get_all_unbonded_nymnodes_by_owner(
         &self,
-    ) -> Result<Vec<(MixId, RewardedSetNodeStatus)>, NyxdError> {
-        collect_paged!(self, get_rewarded_set_paged, nodes)
+        owner: &AccountId,
+    ) -> Result<Vec<UnbondedNymNode>, NyxdError> {
+        collect_paged!(self, get_unbonded_nymnodes_by_owner_paged, nodes, owner)
+    }
+
+    async fn get_all_unbonded_nymnodes_by_identity(
+        &self,
+        identity_key: IdentityKeyRef<'_>,
+    ) -> Result<Vec<UnbondedNymNode>, NyxdError> {
+        collect_paged!(
+            self,
+            get_unbonded_nymnodes_by_identity_paged,
+            nodes,
+            identity_key
+        )
     }
 
     async fn get_all_mixnode_bonds(&self) -> Result<Vec<MixNodeBond>, NyxdError> {
@@ -495,31 +583,40 @@ pub trait PagedMixnetQueryClient: MixnetQueryClient {
         collect_paged!(self, get_mixnodes_detailed_paged, nodes)
     }
 
-    async fn get_all_unbonded_mixnodes(&self) -> Result<Vec<(MixId, UnbondedMixnode)>, NyxdError> {
-        collect_paged!(self, get_unbonded_paged, nodes)
+    async fn get_all_unbonded_mixnodes(&self) -> Result<Vec<(NodeId, UnbondedMixnode)>, NyxdError> {
+        collect_paged!(self, get_unbonded_mixnodes_paged, nodes)
     }
 
     async fn get_all_unbonded_mixnodes_by_owner(
         &self,
         owner: &AccountId,
-    ) -> Result<Vec<(MixId, UnbondedMixnode)>, NyxdError> {
-        collect_paged!(self, get_unbonded_by_owner_paged, nodes, owner)
+    ) -> Result<Vec<(NodeId, UnbondedMixnode)>, NyxdError> {
+        collect_paged!(self, get_unbonded_mixnodes_by_owner_paged, nodes, owner)
     }
 
     async fn get_all_unbonded_mixnodes_by_identity(
         &self,
         identity_key: IdentityKeyRef<'_>,
-    ) -> Result<Vec<(MixId, UnbondedMixnode)>, NyxdError> {
-        collect_paged!(self, get_unbonded_by_identity_paged, nodes, identity_key)
+    ) -> Result<Vec<(NodeId, UnbondedMixnode)>, NyxdError> {
+        collect_paged!(
+            self,
+            get_unbonded_mixnodes_by_identity_paged,
+            nodes,
+            identity_key
+        )
     }
 
     async fn get_all_gateways(&self) -> Result<Vec<GatewayBond>, NyxdError> {
         collect_paged!(self, get_gateways_paged, nodes)
     }
 
+    async fn get_all_preassigned_gateway_ids(&self) -> Result<Vec<PreassignedId>, NyxdError> {
+        collect_paged!(self, get_preassigned_gateway_ids_paged, ids)
+    }
+
     async fn get_all_single_mixnode_delegations(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<Vec<Delegation>, NyxdError> {
         collect_paged!(self, get_mixnode_delegations_paged, delegations, mix_id)
     }
@@ -554,6 +651,65 @@ pub trait PagedMixnetQueryClient: MixnetQueryClient {
 #[async_trait]
 impl<T> PagedMixnetQueryClient for T where T: MixnetQueryClient {}
 
+// extension help to provide extra functionalities based on existing queries:
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait MixnetQueryClientExt: MixnetQueryClient {
+    async fn get_rewarded_set(&self) -> Result<RewardedSet, NyxdError> {
+        let error_response = |message| Err(NyxdError::extension_query_failure("mixnet", message));
+
+        let metadata = self.get_rewarded_set_metadata().await?;
+        if !metadata.metadata.fully_assigned {
+            return error_response("the rewarded set hasn't been fully assigned for this epoch");
+        }
+        let expected_epoch_id = metadata.metadata.epoch_id;
+
+        // if we have to query those things more frequently, we could do it concurrently,
+        // but as it stands now, it happens so infrequently it might as well be sequential
+        let entry = self.get_role_assignment(Role::EntryGateway).await?;
+        if entry.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'entry' returned unexpected epoch_id");
+        }
+
+        let exit = self.get_role_assignment(Role::ExitGateway).await?;
+        if exit.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'exit' returned unexpected epoch_id");
+        }
+
+        let layer1 = self.get_role_assignment(Role::Layer1).await?;
+        if layer1.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'layer1' returned unexpected epoch_id");
+        }
+
+        let layer2 = self.get_role_assignment(Role::Layer2).await?;
+        if layer2.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'layer2' returned unexpected epoch_id");
+        }
+
+        let layer3 = self.get_role_assignment(Role::Layer3).await?;
+        if layer3.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'layer3' returned unexpected epoch_id");
+        }
+
+        let standby = self.get_role_assignment(Role::Standby).await?;
+        if standby.epoch_id != expected_epoch_id {
+            return error_response("the nodes assigned for 'standby' returned unexpected epoch_id");
+        }
+
+        Ok(RewardedSet {
+            entry_gateways: entry.nodes,
+            exit_gateways: exit.nodes,
+            layer1: layer1.nodes,
+            layer2: layer2.nodes,
+            layer3: layer3.nodes,
+            standby: standby.nodes,
+        })
+    }
+}
+
+#[async_trait]
+impl<T> MixnetQueryClientExt for T where T: MixnetQueryClient {}
+
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl<C> MixnetQueryClient for C
@@ -585,24 +741,6 @@ mod tests {
     ) -> u32 {
         match msg {
             MixnetQueryMsg::Admin {} => client.admin().ignore(),
-            MixnetQueryMsg::GetAllFamiliesPaged { limit, start_after } => client
-                .get_all_family_members_paged(start_after, limit)
-                .ignore(),
-            MixnetQueryMsg::GetAllMembersPaged { limit, start_after } => client
-                .get_all_family_members_paged(start_after, limit)
-                .ignore(),
-            MixnetQueryMsg::GetFamilyByHead { head } => {
-                client.get_node_family_by_head(head).ignore()
-            }
-            MixnetQueryMsg::GetFamilyByLabel { label } => {
-                client.get_node_family_by_label(label).ignore()
-            }
-            MixnetQueryMsg::GetFamilyMembersByHead { head } => {
-                client.get_family_members_by_head(head).ignore()
-            }
-            MixnetQueryMsg::GetFamilyMembersByLabel { label } => {
-                client.get_family_members_by_label(label).ignore()
-            }
             MixnetQueryMsg::GetContractVersion {} => client.get_mixnet_contract_version().ignore(),
             MixnetQueryMsg::GetCW2ContractVersion {} => {
                 client.get_mixnet_contract_cw2_version().ignore()
@@ -617,31 +755,28 @@ mod tests {
             MixnetQueryMsg::GetCurrentIntervalDetails {} => {
                 client.get_current_interval_details().ignore()
             }
-            MixnetQueryMsg::GetRewardedSet { limit, start_after } => {
-                client.get_rewarded_set_paged(start_after, limit).ignore()
-            }
             MixnetQueryMsg::GetMixNodeBonds { limit, start_after } => {
                 client.get_mixnode_bonds_paged(start_after, limit).ignore()
             }
             MixnetQueryMsg::GetMixNodesDetailed { limit, start_after } => client
                 .get_mixnodes_detailed_paged(start_after, limit)
                 .ignore(),
-            MixnetQueryMsg::GetUnbondedMixNodes { limit, start_after } => {
-                client.get_unbonded_paged(start_after, limit).ignore()
-            }
+            MixnetQueryMsg::GetUnbondedMixNodes { limit, start_after } => client
+                .get_unbonded_mixnodes_paged(start_after, limit)
+                .ignore(),
             MixnetQueryMsg::GetUnbondedMixNodesByOwner {
                 owner,
                 limit,
                 start_after,
             } => client
-                .get_unbonded_by_owner_paged(&owner.parse().unwrap(), start_after, limit)
+                .get_unbonded_mixnodes_by_owner_paged(&owner.parse().unwrap(), start_after, limit)
                 .ignore(),
             MixnetQueryMsg::GetUnbondedMixNodesByIdentityKey {
                 identity_key,
                 limit,
                 start_after,
             } => client
-                .get_unbonded_by_identity_paged(&identity_key, start_after, limit)
+                .get_unbonded_mixnodes_by_identity_paged(&identity_key, start_after, limit)
                 .ignore(),
             MixnetQueryMsg::GetOwnedMixnode { address } => {
                 client.get_owned_mixnode(&address.parse().unwrap()).ignore()
@@ -661,7 +796,6 @@ mod tests {
             MixnetQueryMsg::GetBondedMixnodeDetailsByIdentity { mix_identity } => client
                 .get_mixnode_details_by_identity(mix_identity)
                 .ignore(),
-            MixnetQueryMsg::GetLayerDistribution {} => client.get_layer_distribution().ignore(),
             MixnetQueryMsg::GetGateways { start_after, limit } => {
                 client.get_gateways_paged(start_after, limit).ignore()
             }
@@ -671,8 +805,8 @@ mod tests {
             MixnetQueryMsg::GetOwnedGateway { address } => {
                 client.get_owned_gateway(&address.parse().unwrap()).ignore()
             }
-            MixnetQueryMsg::GetMixnodeDelegations {
-                mix_id,
+            MixnetQueryMsg::GetNodeDelegations {
+                node_id: mix_id,
                 start_after,
                 limit,
             } => client
@@ -686,7 +820,7 @@ mod tests {
                 .get_delegator_delegations_paged(&delegator.parse().unwrap(), start_after, limit)
                 .ignore(),
             MixnetQueryMsg::GetDelegationDetails {
-                mix_id,
+                node_id: mix_id,
                 delegator,
                 proxy,
             } => client
@@ -698,33 +832,38 @@ mod tests {
             MixnetQueryMsg::GetPendingOperatorReward { address } => client
                 .get_pending_operator_reward(&address.parse().unwrap())
                 .ignore(),
-            MixnetQueryMsg::GetPendingMixNodeOperatorReward { mix_id } => {
+            MixnetQueryMsg::GetPendingNodeOperatorReward { node_id: mix_id } => {
                 client.get_pending_mixnode_operator_reward(mix_id).ignore()
             }
             MixnetQueryMsg::GetPendingDelegatorReward {
                 address,
-                mix_id,
+                node_id: mix_id,
                 proxy,
             } => client
                 .get_pending_delegator_reward(&address.parse().unwrap(), mix_id, proxy)
                 .ignore(),
             MixnetQueryMsg::GetEstimatedCurrentEpochOperatorReward {
-                mix_id,
+                node_id,
                 estimated_performance,
+                estimated_work,
             } => client
-                .get_estimated_current_epoch_operator_reward(mix_id, estimated_performance)
+                .get_estimated_current_epoch_operator_reward(
+                    node_id,
+                    estimated_performance,
+                    estimated_work,
+                )
                 .ignore(),
             MixnetQueryMsg::GetEstimatedCurrentEpochDelegatorReward {
                 address,
-                mix_id,
-                proxy,
+                node_id,
                 estimated_performance,
+                estimated_work,
             } => client
                 .get_estimated_current_epoch_delegator_reward(
                     &address.parse().unwrap(),
-                    mix_id,
-                    proxy,
+                    node_id,
                     estimated_performance,
+                    estimated_work,
                 )
                 .ignore(),
             MixnetQueryMsg::GetPendingEpochEvents { limit, start_after } => client
@@ -745,6 +884,54 @@ mod tests {
             MixnetQueryMsg::GetSigningNonce { address } => {
                 client.get_signing_nonce(&address.parse().unwrap()).ignore()
             }
+            MixnetQueryMsg::GetPreassignedGatewayIds { start_after, limit } => client
+                .get_preassigned_gateway_ids_paged(start_after, limit)
+                .ignore(),
+            MixnetQueryMsg::GetNymNodeBondsPaged { limit, start_after } => {
+                client.get_nymnode_bonds_paged(limit, start_after).ignore()
+            }
+            MixnetQueryMsg::GetNymNodesDetailedPaged { limit, start_after } => client
+                .get_nymnodes_detailed_paged(limit, start_after)
+                .ignore(),
+            MixnetQueryMsg::GetUnbondedNymNode { node_id } => {
+                client.get_unbonded_nymnode_information(node_id).ignore()
+            }
+            MixnetQueryMsg::GetUnbondedNymNodesPaged { limit, start_after } => client
+                .get_unbonded_nymnodes_paged(limit, start_after)
+                .ignore(),
+            MixnetQueryMsg::GetUnbondedNymNodesByOwnerPaged {
+                owner,
+                limit,
+                start_after,
+            } => client
+                .get_unbonded_nymnodes_by_owner_paged(&owner.parse().unwrap(), limit, start_after)
+                .ignore(),
+            MixnetQueryMsg::GetUnbondedNymNodesByIdentityKeyPaged {
+                identity_key,
+                limit,
+                start_after,
+            } => client
+                .get_unbonded_nymnodes_by_identity_paged(&identity_key, limit, start_after)
+                .ignore(),
+            MixnetQueryMsg::GetOwnedNymNode { address } => {
+                client.get_owned_nymnode(&address.parse().unwrap()).ignore()
+            }
+            MixnetQueryMsg::GetNymNodeDetails { node_id } => {
+                client.get_nymnode_details(node_id).ignore()
+            }
+            MixnetQueryMsg::GetNymNodeDetailsByIdentityKey { node_identity } => client
+                .get_nymnode_details_by_identity(node_identity)
+                .ignore(),
+            MixnetQueryMsg::GetNodeRewardingDetails { node_id } => {
+                client.get_nymnode_rewarding_details(node_id).ignore()
+            }
+            MixnetQueryMsg::GetNodeStakeSaturation { node_id } => {
+                client.get_node_stake_saturation(node_id).ignore()
+            }
+            MixnetQueryMsg::GetRoleAssignment { role } => client.get_role_assignment(role).ignore(),
+            MixnetQueryMsg::GetRewardedSetMetadata {} => {
+                client.get_rewarded_set_metadata().ignore()
+            }
         }
     }
 }

common/client-libs/validator-client/src/nyxd/contract_traits/mixnet_signing_client.rs

@@ -10,13 +10,15 @@ use crate::signing::signer::OfflineSigner;
 use async_trait::async_trait;
 use cosmrs::AccountId;
 use nym_contracts_common::signing::MessageSignature;
-use nym_mixnet_contract_common::families::FamilyHead;
 use nym_mixnet_contract_common::gateway::GatewayConfigUpdate;
-use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
-use nym_mixnet_contract_common::reward_params::{IntervalRewardingParamsUpdate, Performance};
+use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, NodeCostParams};
+use nym_mixnet_contract_common::nym_node::NodeConfigUpdate;
+use nym_mixnet_contract_common::reward_params::{
+    ActiveSetUpdate, IntervalRewardingParamsUpdate, NodeRewardingParameters,
+};
 use nym_mixnet_contract_common::{
-    ContractStateParams, ExecuteMsg as MixnetExecuteMsg, Gateway, Layer, LayerAssignment, MixId,
-    MixNode,
+    ContractStateParams, ExecuteMsg as MixnetExecuteMsg, Gateway, MixNode, NodeId, NymNode,
+    RoleAssignment,
 };
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -70,14 +72,14 @@ pub trait MixnetSigningClient {
 
     async fn update_active_set_size(
         &self,
-        active_set_size: u32,
+        update: ActiveSetUpdate,
         force_immediately: bool,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
-            MixnetExecuteMsg::UpdateActiveSetSize {
-                active_set_size,
+            MixnetExecuteMsg::UpdateActiveSetDistribution {
+                update,
                 force_immediately,
             },
             vec![],
@@ -126,37 +128,6 @@ pub trait MixnetSigningClient {
             .await
     }
 
-    async fn advance_current_epoch(
-        &self,
-        new_rewarded_set: Vec<LayerAssignment>,
-        expected_active_set_size: u32,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::AdvanceCurrentEpoch {
-                new_rewarded_set,
-                expected_active_set_size,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn assign_node_layer(
-        &self,
-        mix_id: MixId,
-        layer: Layer,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::AssignNodeLayer { mix_id, layer },
-            vec![],
-        )
-        .await
-    }
-
     async fn reconcile_epoch_events(
         &self,
         limit: Option<u32>,
@@ -170,126 +141,21 @@ pub trait MixnetSigningClient {
         .await
     }
 
-    // family related
-    async fn create_family(
+    async fn assign_roles(
         &self,
-        label: String,
+        assignment: RoleAssignment,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(fee, MixnetExecuteMsg::CreateFamily { label }, vec![])
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::AssignRoles { assignment }, vec![])
             .await
     }
 
-    async fn create_family_on_behalf(
-        &self,
-        owner_address: String,
-        label: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::CreateFamilyOnBehalf {
-                owner_address,
-                label,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn join_family(
-        &self,
-        join_permit: MessageSignature,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::JoinFamily {
-                join_permit,
-                family_head,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn join_family_on_behalf(
-        &self,
-        member_address: String,
-        join_permit: MessageSignature,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::JoinFamilyOnBehalf {
-                member_address,
-                join_permit,
-                family_head,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn leave_family(
-        &self,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(fee, MixnetExecuteMsg::LeaveFamily { family_head }, vec![])
-            .await
-    }
-
-    async fn leave_family_on_behalf(
-        &self,
-        member_address: String,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::LeaveFamilyOnBehalf {
-                member_address,
-                family_head,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn kick_family_member(
-        &self,
-        member: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(fee, MixnetExecuteMsg::KickFamilyMember { member }, vec![])
-            .await
-    }
-
-    async fn kick_family_member_on_behalf(
-        &self,
-        head_address: String,
-        member: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::KickFamilyMemberOnBehalf {
-                head_address,
-                member,
-            },
-            vec![],
-        )
-        .await
-    }
     // mixnode-related:
 
     async fn bond_mixnode(
         &self,
         mix_node: MixNode,
-        cost_params: MixNodeCostParams,
+        cost_params: NodeCostParams,
         owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
@@ -310,7 +176,7 @@ pub trait MixnetSigningClient {
         &self,
         owner: AccountId,
         mix_node: MixNode,
-        cost_params: MixNodeCostParams,
+        cost_params: NodeCostParams,
         owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
@@ -409,14 +275,14 @@ pub trait MixnetSigningClient {
         .await
     }
 
-    async fn update_mixnode_cost_params(
+    async fn update_cost_params(
         &self,
-        new_costs: MixNodeCostParams,
+        new_costs: NodeCostParams,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
-            MixnetExecuteMsg::UpdateMixnodeCostParams { new_costs },
+            MixnetExecuteMsg::UpdateCostParams { new_costs },
             vec![],
         )
         .await
@@ -425,7 +291,7 @@ pub trait MixnetSigningClient {
     async fn update_mixnode_cost_params_on_behalf(
         &self,
         owner: AccountId,
-        new_costs: MixNodeCostParams,
+        new_costs: NodeCostParams,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
@@ -559,26 +425,75 @@ pub trait MixnetSigningClient {
         .await
     }
 
-    // delegation-related:
+    // nym-node related:
+    async fn migrate_legacy_mixnode(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::MigrateMixnode {}, vec![])
+            .await
+    }
 
-    async fn delegate_to_mixnode(
+    async fn migrate_legacy_gateway(
         &self,
-        mix_id: MixId,
-        amount: Coin,
+        cost_params: Option<NodeCostParams>,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
-            MixnetExecuteMsg::DelegateToMixnode { mix_id },
-            vec![amount],
+            MixnetExecuteMsg::MigrateGateway { cost_params },
+            vec![],
         )
         .await
     }
 
+    async fn bond_nymnode(
+        &self,
+        node: NymNode,
+        cost_params: NodeCostParams,
+        owner_signature: MessageSignature,
+        pledge: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(
+            fee,
+            MixnetExecuteMsg::BondNymNode {
+                node,
+                cost_params,
+                owner_signature,
+            },
+            vec![pledge],
+        )
+        .await
+    }
+
+    async fn unbond_nymnode(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::UnbondNymNode {}, vec![])
+            .await
+    }
+
+    async fn update_nymnode_config(
+        &self,
+        update: NodeConfigUpdate,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::UpdateNodeConfig { update }, vec![])
+            .await
+    }
+
+    // delegation-related:
+
+    async fn delegate(
+        &self,
+        node_id: NodeId,
+        amount: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::Delegate { node_id }, vec![amount])
+            .await
+    }
+
     async fn delegate_to_mixnode_on_behalf(
         &self,
         delegate: AccountId,
-        mix_id: MixId,
+        mix_id: NodeId,
         amount: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -593,23 +508,19 @@ pub trait MixnetSigningClient {
         .await
     }
 
-    async fn undelegate_from_mixnode(
+    async fn undelegate(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::UndelegateFromMixnode { mix_id },
-            vec![],
-        )
-        .await
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::Undelegate { node_id }, vec![])
+            .await
     }
 
     async fn undelegate_to_mixnode_on_behalf(
         &self,
         delegate: AccountId,
-        mix_id: MixId,
+        mix_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
@@ -625,18 +536,15 @@ pub trait MixnetSigningClient {
 
     // reward-related
 
-    async fn reward_mixnode(
+    async fn reward_node(
         &self,
-        mix_id: MixId,
-        performance: Performance,
+        node_id: NodeId,
+        params: NodeRewardingParameters,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
-            MixnetExecuteMsg::RewardMixnode {
-                mix_id,
-                performance,
-            },
+            MixnetExecuteMsg::RewardNode { node_id, params },
             vec![],
         )
         .await
@@ -664,12 +572,12 @@ pub trait MixnetSigningClient {
 
     async fn withdraw_delegator_reward(
         &self,
-        mix_id: MixId,
+        node_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
-            MixnetExecuteMsg::WithdrawDelegatorReward { mix_id },
+            MixnetExecuteMsg::WithdrawDelegatorReward { node_id },
             vec![],
         )
         .await
@@ -678,7 +586,7 @@ pub trait MixnetSigningClient {
     async fn withdraw_delegator_reward_on_behalf(
         &self,
         owner: AccountId,
-        mix_id: MixId,
+        mix_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
@@ -699,7 +607,7 @@ pub trait MixnetSigningClient {
 
     async fn migrate_vested_delegation(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
@@ -761,6 +669,7 @@ where
 mod tests {
     use super::*;
     use crate::nyxd::contract_traits::tests::{mock_coin, IgnoreValue};
+    use nym_mixnet_contract_common::ExecuteMsg;
 
     // it's enough that this compiles and clippy is happy about it
     #[allow(dead_code)]
@@ -770,56 +679,17 @@ mod tests {
     ) {
         match msg {
             MixnetExecuteMsg::UpdateAdmin { admin } => client.update_admin(admin, None).ignore(),
-            MixnetExecuteMsg::AssignNodeLayer { mix_id, layer } => {
-                client.assign_node_layer(mix_id, layer, None).ignore()
-            }
-            MixnetExecuteMsg::CreateFamily { label } => client.create_family(label, None).ignore(),
-            MixnetExecuteMsg::JoinFamily {
-                join_permit,
-                family_head,
-            } => client.join_family(join_permit, family_head, None).ignore(),
-            MixnetExecuteMsg::LeaveFamily { family_head } => {
-                client.leave_family(family_head, None).ignore()
-            }
-            MixnetExecuteMsg::KickFamilyMember { member } => {
-                client.kick_family_member(member, None).ignore()
-            }
-            MixnetExecuteMsg::CreateFamilyOnBehalf {
-                owner_address,
-                label,
-            } => client
-                .create_family_on_behalf(owner_address, label, None)
-                .ignore(),
-            MixnetExecuteMsg::JoinFamilyOnBehalf {
-                member_address,
-                join_permit,
-                family_head,
-            } => client
-                .join_family_on_behalf(member_address, join_permit, family_head, None)
-                .ignore(),
-            MixnetExecuteMsg::LeaveFamilyOnBehalf {
-                member_address,
-                family_head,
-            } => client
-                .leave_family_on_behalf(member_address, family_head, None)
-                .ignore(),
-            MixnetExecuteMsg::KickFamilyMemberOnBehalf {
-                head_address,
-                member,
-            } => client
-                .kick_family_member_on_behalf(head_address, member, None)
-                .ignore(),
             MixnetExecuteMsg::UpdateRewardingValidatorAddress { address } => client
                 .update_rewarding_validator_address(address.parse().unwrap(), None)
                 .ignore(),
             MixnetExecuteMsg::UpdateContractStateParams { updated_parameters } => client
                 .update_contract_state_params(updated_parameters, None)
                 .ignore(),
-            MixnetExecuteMsg::UpdateActiveSetSize {
-                active_set_size,
+            MixnetExecuteMsg::UpdateActiveSetDistribution {
+                update,
                 force_immediately,
             } => client
-                .update_active_set_size(active_set_size, force_immediately, None)
+                .update_active_set_size(update, force_immediately, None)
                 .ignore(),
             MixnetExecuteMsg::UpdateRewardingParams {
                 updated_params,
@@ -842,12 +712,6 @@ mod tests {
             MixnetExecuteMsg::BeginEpochTransition {} => {
                 client.begin_epoch_transition(None).ignore()
             }
-            MixnetExecuteMsg::AdvanceCurrentEpoch {
-                new_rewarded_set,
-                expected_active_set_size,
-            } => client
-                .advance_current_epoch(new_rewarded_set, expected_active_set_size, None)
-                .ignore(),
             MixnetExecuteMsg::ReconcileEpochEvents { limit } => {
                 client.reconcile_epoch_events(limit, None).ignore()
             }
@@ -887,8 +751,8 @@ mod tests {
             MixnetExecuteMsg::UnbondMixnodeOnBehalf { owner } => client
                 .unbond_mixnode_on_behalf(owner.parse().unwrap(), None)
                 .ignore(),
-            MixnetExecuteMsg::UpdateMixnodeCostParams { new_costs } => {
-                client.update_mixnode_cost_params(new_costs, None).ignore()
+            MixnetExecuteMsg::UpdateCostParams { new_costs } => {
+                client.update_cost_params(new_costs, None).ignore()
             }
             MixnetExecuteMsg::UpdateMixnodeCostParamsOnBehalf { new_costs, owner } => client
                 .update_mixnode_cost_params_on_behalf(owner.parse().unwrap(), new_costs, None)
@@ -928,29 +792,28 @@ mod tests {
             MixnetExecuteMsg::UpdateGatewayConfigOnBehalf { new_config, owner } => client
                 .update_gateway_config_on_behalf(owner.parse().unwrap(), new_config, None)
                 .ignore(),
-            MixnetExecuteMsg::DelegateToMixnode { mix_id } => client
-                .delegate_to_mixnode(mix_id, mock_coin(), None)
-                .ignore(),
+            MixnetExecuteMsg::Delegate { node_id: mix_id } => {
+                client.delegate(mix_id, mock_coin(), None).ignore()
+            }
             MixnetExecuteMsg::DelegateToMixnodeOnBehalf { mix_id, delegate } => client
                 .delegate_to_mixnode_on_behalf(delegate.parse().unwrap(), mix_id, mock_coin(), None)
                 .ignore(),
-            MixnetExecuteMsg::UndelegateFromMixnode { mix_id } => {
-                client.undelegate_from_mixnode(mix_id, None).ignore()
+            MixnetExecuteMsg::Undelegate { node_id: mix_id } => {
+                client.undelegate(mix_id, None).ignore()
             }
             MixnetExecuteMsg::UndelegateFromMixnodeOnBehalf { mix_id, delegate } => client
                 .undelegate_to_mixnode_on_behalf(delegate.parse().unwrap(), mix_id, None)
                 .ignore(),
-            MixnetExecuteMsg::RewardMixnode {
-                mix_id,
-                performance,
-            } => client.reward_mixnode(mix_id, performance, None).ignore(),
+            MixnetExecuteMsg::RewardNode { node_id, params } => {
+                client.reward_node(node_id, params, None).ignore()
+            }
             MixnetExecuteMsg::WithdrawOperatorReward {} => {
                 client.withdraw_operator_reward(None).ignore()
             }
             MixnetExecuteMsg::WithdrawOperatorRewardOnBehalf { owner } => client
                 .withdraw_operator_reward_on_behalf(owner.parse().unwrap(), None)
                 .ignore(),
-            MixnetExecuteMsg::WithdrawDelegatorReward { mix_id } => {
+            MixnetExecuteMsg::WithdrawDelegatorReward { node_id: mix_id } => {
                 client.withdraw_delegator_reward(mix_id, None).ignore()
             }
             MixnetExecuteMsg::WithdrawDelegatorRewardOnBehalf { mix_id, owner } => client
@@ -963,6 +826,25 @@ mod tests {
                 client.migrate_vested_delegation(mix_id, None).ignore()
             }
 
+            ExecuteMsg::AssignRoles { assignment } => {
+                client.assign_roles(assignment, None).ignore()
+            }
+            ExecuteMsg::MigrateMixnode {} => client.migrate_legacy_mixnode(None).ignore(),
+            ExecuteMsg::MigrateGateway { cost_params } => {
+                client.migrate_legacy_gateway(cost_params, None).ignore()
+            }
+            ExecuteMsg::BondNymNode {
+                node,
+                cost_params,
+                owner_signature,
+            } => client
+                .bond_nymnode(node, cost_params, owner_signature, mock_coin(), None)
+                .ignore(),
+            ExecuteMsg::UnbondNymNode {} => client.unbond_nymnode(None).ignore(),
+            ExecuteMsg::UpdateNodeConfig { update } => {
+                client.update_nymnode_config(update, None).ignore()
+            }
+
             #[cfg(feature = "contract-testing")]
             MixnetExecuteMsg::TestingResolveAllPendingEvents { .. } => {
                 client.testing_resolve_all_pending_events(None).ignore()

common/client-libs/validator-client/src/nyxd/contract_traits/vesting_query_client.rs

@@ -9,7 +9,7 @@ use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmwasm_std::{Coin as CosmWasmCoin, Timestamp};
 use nym_contracts_common::ContractBuildInformation;
-use nym_mixnet_contract_common::MixId;
+use nym_mixnet_contract_common::NodeId;
 use nym_vesting_contract_common::{
     messages::QueryMsg as VestingQueryMsg, Account, AccountVestingCoins, AccountsResponse,
     AllDelegationsResponse, BaseVestingAccountInfo, DelegationTimesResponse,
@@ -238,7 +238,7 @@ pub trait VestingQueryClient {
     async fn get_vesting_delegation(
         &self,
         address: &str,
-        mix_id: MixId,
+        mix_id: NodeId,
         block_timestamp_secs: u64,
     ) -> Result<VestingDelegation, NyxdError> {
         self.query_vesting_contract(VestingQueryMsg::GetDelegation {
@@ -252,7 +252,7 @@ pub trait VestingQueryClient {
     async fn get_total_delegation_amount(
         &self,
         address: &str,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<Coin, NyxdError> {
         self.query_vesting_contract(VestingQueryMsg::GetTotalDelegationAmount {
             address: address.to_string(),
@@ -264,7 +264,7 @@ pub trait VestingQueryClient {
     async fn get_delegation_timestamps(
         &self,
         address: &str,
-        mix_id: MixId,
+        mix_id: NodeId,
     ) -> Result<DelegationTimesResponse, NyxdError> {
         self.query_vesting_contract(VestingQueryMsg::GetDelegationTimes {
             address: address.to_string(),
@@ -275,7 +275,7 @@ pub trait VestingQueryClient {
 
     async fn get_all_vesting_delegations_paged(
         &self,
-        start_after: Option<(u32, MixId, u64)>,
+        start_after: Option<(u32, NodeId, u64)>,
         limit: Option<u32>,
     ) -> Result<AllDelegationsResponse, NyxdError> {
         self.query_vesting_contract(VestingQueryMsg::GetAllDelegations { start_after, limit })

common/client-libs/validator-client/src/nyxd/contract_traits/vesting_signing_client.rs

@@ -9,10 +9,9 @@ use crate::signing::signer::OfflineSigner;
 use async_trait::async_trait;
 use cosmrs::AccountId;
 use nym_contracts_common::signing::MessageSignature;
-use nym_mixnet_contract_common::families::FamilyHead;
 use nym_mixnet_contract_common::gateway::GatewayConfigUpdate;
-use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
-use nym_mixnet_contract_common::{Gateway, MixId, MixNode};
+use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, NodeCostParams};
+use nym_mixnet_contract_common::{Gateway, MixNode, NodeId};
 use nym_vesting_contract_common::messages::ExecuteMsg as VestingExecuteMsg;
 use nym_vesting_contract_common::{PledgeCap, VestingSpecification};
 
@@ -28,7 +27,7 @@ pub trait VestingSigningClient {
 
     async fn vesting_update_mixnode_cost_params(
         &self,
-        new_costs: MixNodeCostParams,
+        new_costs: NodeCostParams,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_vesting_contract(
@@ -124,7 +123,7 @@ pub trait VestingSigningClient {
     async fn vesting_bond_mixnode(
         &self,
         mix_node: MixNode,
-        cost_params: MixNodeCostParams,
+        cost_params: NodeCostParams,
         owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
@@ -204,7 +203,7 @@ pub trait VestingSigningClient {
     async fn vesting_track_undelegation(
         &self,
         address: &str,
-        mix_id: MixId,
+        mix_id: NodeId,
         amount: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -222,7 +221,7 @@ pub trait VestingSigningClient {
 
     async fn vesting_delegate_to_mixnode(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         amount: Coin,
         on_behalf_of: Option<String>,
         fee: Option<Fee>,
@@ -241,7 +240,7 @@ pub trait VestingSigningClient {
 
     async fn vesting_undelegate_from_mixnode(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         on_behalf_of: Option<String>,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -301,7 +300,7 @@ pub trait VestingSigningClient {
 
     async fn vesting_withdraw_delegator_reward(
         &self,
-        mix_id: MixId,
+        mix_id: NodeId,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_vesting_contract(
@@ -354,50 +353,6 @@ pub trait VestingSigningClient {
         )
         .await
     }
-
-    async fn vesting_create_family(
-        &self,
-        label: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_vesting_contract(fee, VestingExecuteMsg::CreateFamily { label }, vec![])
-            .await
-    }
-
-    async fn vesting_join_family(
-        &self,
-        join_permit: MessageSignature,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_vesting_contract(
-            fee,
-            VestingExecuteMsg::JoinFamily {
-                join_permit,
-                family_head,
-            },
-            vec![],
-        )
-        .await
-    }
-
-    async fn vesting_leave_family(
-        &self,
-        family_head: FamilyHead,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_vesting_contract(fee, VestingExecuteMsg::LeaveFamily { family_head }, vec![])
-            .await
-    }
-
-    async fn vesting_kick_family_member(
-        &self,
-        member: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_vesting_contract(fee, VestingExecuteMsg::KickFamilyMember { member }, vec![])
-            .await
-    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -446,21 +401,6 @@ mod tests {
         msg: VestingExecuteMsg,
     ) {
         match msg {
-            VestingExecuteMsg::CreateFamily { label } => {
-                client.vesting_create_family(label, None).ignore()
-            }
-            VestingExecuteMsg::JoinFamily {
-                join_permit,
-                family_head,
-            } => client
-                .vesting_join_family(join_permit, family_head, None)
-                .ignore(),
-            VestingExecuteMsg::LeaveFamily { family_head } => {
-                client.vesting_leave_family(family_head, None).ignore()
-            }
-            VestingExecuteMsg::KickFamilyMember { member } => {
-                client.vesting_kick_family_member(member, None).ignore()
-            }
             VestingExecuteMsg::TrackReward { amount, address } => client
                 .vesting_track_reward(amount.into(), address, None)
                 .ignore(),

common/client-libs/validator-client/src/nyxd/cosmwasm_client/client_traits/query_client.rs

@@ -5,7 +5,7 @@ use crate::nyxd;
 use crate::nyxd::coin::Coin;
 use crate::nyxd::cosmwasm_client::helpers::{create_pagination, next_page_key};
 use crate::nyxd::cosmwasm_client::types::{
-    Account, CodeDetails, Contract, ContractCodeId, SequenceResponse, SimulateResponse,
+    Account, CodeDetails, Contract, ContractCodeId, Model, SequenceResponse, SimulateResponse,
 };
 use crate::nyxd::error::NyxdError;
 use crate::nyxd::Query;
@@ -21,15 +21,14 @@ use cosmrs::proto::cosmos::tx::v1beta1::{
     SimulateRequest, SimulateResponse as ProtoSimulateResponse,
 };
 use cosmrs::proto::cosmwasm::wasm::v1::{
-    QueryCodeRequest, QueryCodeResponse, QueryCodesRequest, QueryCodesResponse,
-    QueryContractHistoryRequest, QueryContractHistoryResponse, QueryContractInfoRequest,
-    QueryContractInfoResponse, QueryContractsByCodeRequest, QueryContractsByCodeResponse,
-    QueryRawContractStateRequest, QueryRawContractStateResponse, QuerySmartContractStateRequest,
-    QuerySmartContractStateResponse,
+    QueryAllContractStateRequest, QueryAllContractStateResponse, QueryCodeRequest,
+    QueryCodeResponse, QueryCodesRequest, QueryCodesResponse, QueryContractHistoryRequest,
+    QueryContractHistoryResponse, QueryContractInfoRequest, QueryContractInfoResponse,
+    QueryContractsByCodeRequest, QueryContractsByCodeResponse, QueryRawContractStateRequest,
+    QueryRawContractStateResponse, QuerySmartContractStateRequest, QuerySmartContractStateResponse,
 };
 use cosmrs::tendermint::{block, chain, Hash};
 use cosmrs::{AccountId, Coin as CosmosCoin, Tx};
-use log::trace;
 use prost::Message;
 use serde::{Deserialize, Serialize};
 
@@ -68,7 +67,7 @@ pub trait CosmWasmClient: TendermintRpcClient {
         Res: Message + Default,
     {
         if let Some(ref abci_path) = path {
-            trace!("performing query on abci path {abci_path}")
+            tracing::trace!("performing query on abci path {abci_path}")
         }
         let mut buf = Vec::with_capacity(req.encoded_len());
         req.encode(&mut buf)?;
@@ -218,17 +217,19 @@ pub trait CosmWasmClient: TendermintRpcClient {
 
         loop {
             let mut res = self
-                .tx_search(query.clone(), false, page, 100, Order::Ascending)
+                .tx_search(query.clone(), false, page, per_page, Order::Ascending)
                 .await?;
 
-            results.append(&mut res.txs);
             // sanity check for if tendermint's maximum per_page was modified -
             // we don't want to accidentally be stuck in an infinite loop
-            if res.total_count == 0 || res.txs.is_empty() {
+            let early_break = res.total_count == 0 || res.txs.is_empty();
+            results.append(&mut res.txs);
+
+            if early_break {
                 break;
             }
 
-            if res.total_count >= per_page {
+            if res.total_count > results.len() as u32 {
                 page += 1
             } else {
                 break;
@@ -295,7 +296,7 @@ pub trait CosmWasmClient: TendermintRpcClient {
 
         let start = Instant::now();
         loop {
-            log::debug!(
+            tracing::debug!(
                 "Polling for result of including {} in a block...",
                 broadcasted.hash
             );
@@ -442,6 +443,38 @@ pub trait CosmWasmClient: TendermintRpcClient {
             .collect::<Result<_, _>>()?)
     }
 
+    async fn query_all_contract_state(&self, address: &AccountId) -> Result<Vec<Model>, NyxdError> {
+        let path = Some("/cosmwasm.wasm.v1.Query/AllContractState".to_owned());
+
+        let mut models = Vec::new();
+        let mut pagination = None;
+
+        loop {
+            let req = QueryAllContractStateRequest {
+                address: address.to_string(),
+                pagination,
+            };
+
+            let mut res = self
+                .make_abci_query::<_, QueryAllContractStateResponse>(path.clone(), req)
+                .await?;
+
+            let empty_response = res.models.is_empty();
+            models.append(&mut res.models);
+
+            if empty_response {
+                break;
+            }
+            if let Some(next_key) = next_page_key(res.pagination) {
+                pagination = Some(create_pagination(next_key))
+            } else {
+                break;
+            }
+        }
+
+        Ok(models.into_iter().map(Into::into).collect())
+    }
+
     async fn query_contract_raw(
         &self,
         address: &AccountId,
@@ -488,7 +521,7 @@ pub trait CosmWasmClient: TendermintRpcClient {
             .make_abci_query::<_, QuerySmartContractStateResponse>(path, req)
             .await?;
 
-        trace!("raw query response: {}", String::from_utf8_lossy(&res.data));
+        tracing::trace!("raw query response: {}", String::from_utf8_lossy(&res.data));
         Ok(serde_json::from_slice(&res.data)?)
     }
 

common/client-libs/validator-client/src/nyxd/cosmwasm_client/client_traits/signing_client.rs

@@ -25,12 +25,12 @@ use cosmrs::proto::cosmos::tx::signing::v1beta1::SignMode;
 use cosmrs::staking::{MsgDelegate, MsgUndelegate};
 use cosmrs::tx::{self, Msg};
 use cosmrs::{cosmwasm, AccountId, Any, Tx};
-use log::debug;
 use serde::Serialize;
 use sha2::Digest;
 use sha2::Sha256;
 use std::time::SystemTime;
 use tendermint_rpc::endpoint::broadcast;
+use tracing::debug;
 
 fn empty_fee() -> tx::Fee {
     tx::Fee {

common/client-libs/validator-client/src/nyxd/cosmwasm_client/helpers.rs

@@ -7,9 +7,9 @@ use base64::Engine;
 use cosmrs::abci::TxMsgData;
 use cosmrs::cosmwasm::MsgExecuteContractResponse;
 use cosmrs::proto::cosmos::base::query::v1beta1::{PageRequest, PageResponse};
-use log::error;
 use prost::bytes::Bytes;
 use tendermint_rpc::endpoint::broadcast;
+use tracing::error;
 
 pub use cosmrs::abci::MsgResponse;
 

common/client-libs/validator-client/src/nyxd/cosmwasm_client/types.rs

@@ -27,13 +27,34 @@ use cosmrs::vesting::{
 };
 use cosmrs::{AccountId, Any, Coin as CosmosCoin};
 use prost::Message;
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 
 pub use cosmrs::abci::GasInfo;
 pub use cosmrs::abci::MsgResponse;
 
 pub type ContractCodeId = u64;
 
+// yet another thing to put in cosmrs
+#[derive(Serialize, Deserialize)]
+pub struct Model {
+    #[serde(with = "nym_serde_helpers::hex")]
+    pub key: Vec<u8>,
+
+    #[serde(with = "nym_serde_helpers::base64")]
+    pub value: Vec<u8>,
+}
+
+// follow the cosmwasm serialisation format, i.e. hex for key and base64 for value
+
+impl From<cosmrs::proto::cosmwasm::wasm::v1::Model> for Model {
+    fn from(model: cosmrs::proto::cosmwasm::wasm::v1::Model) -> Self {
+        Model {
+            key: model.key,
+            value: model.value,
+        }
+    }
+}
+
 #[derive(Serialize)]
 pub struct EmptyMsg {}
 

common/client-libs/validator-client/src/nyxd/error.rs

@@ -154,6 +154,23 @@ pub enum NyxdError {
 
     #[error("the response data has invalid size. got {got} bytes, but expected {expected} bytes instead")]
     MalformedResponseData { got: usize, expected: usize },
+
+    #[error(
+        "one of the extension query for {contract} failed with the following message: {message}"
+    )]
+    ExtensionQueryFailure { contract: String, message: String },
+}
+
+impl NyxdError {
+    pub fn extension_query_failure(
+        contract: impl Into<String>,
+        message: impl Into<String>,
+    ) -> Self {
+        NyxdError::ExtensionQueryFailure {
+            contract: contract.into(),
+            message: message.into(),
+        }
+    }
 }
 
 // The purpose of parsing the abci query result is that we want to generate the `pretty_log` if