Feat: implement supply chain attack mitigation

- Add yarn resolutions for vulnerable packages (chalk, strip-ansi, color-convert, etc.) - Add .npmrc and .nvmrc security configurations
Feature/credential proxy crate (#6018 )
2025-09-10 18:51:38 +02:00 · 2025-09-10 09:28:38 +01:00 · 2025-09-09 09:59:54 +01:00 · 2025-09-08 10:50:18 +02:00 · 2025-09-08 09:45:28 +01:00 · 2025-09-04 15:55:56 +03:00
215 changed files with 9656 additions and 6765 deletions
@@ -16,7 +16,7 @@ jobs:
        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -16,7 +16,7 @@ jobs:
        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -6,7 +6,7 @@ jobs:
  greeting:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/first-interaction@v1
+    - uses: actions/first-interaction@v3
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        issue-message: 'Thank you for raising this issue'
@@ -31,7 +31,7 @@ jobs:
      - name: Check out repository code
        uses: actions/checkout@v4
      - name: Download report from previous job
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
        with:
          name: report
          path: .github/workflows/support-files/notifications
@@ -25,7 +25,7 @@ jobs:
        uses: actions/checkout@v4

      - name: Install Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
        with:
          distribution: "temurin"
          java-version: "17"
@@ -91,7 +91,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Download binary artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
        with:
          name: nyms5-apk-arch64
          path: apk
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
@@ -34,18 +34,22 @@ jobs:
      - name: Get version from cargo.toml
        id: get_version
        run: |
-          yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT

      - name: Set GIT_TAG variable
        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV

-      - name: Set RELEASE_TAG variable
+      - name: Initialise RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+      
+      - name: Set RELEASE_TAG for release
        if: github.event.inputs.release_image == 'true'
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
-
+      
      - name: Set IMAGE_NAME_AND_TAGS variable
        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
-
+        
      - name: New env vars
        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        

@@ -65,6 +69,6 @@ jobs:

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile-pg . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }} -t harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }}:latest
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.45.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -0,0 +1,58 @@
+# Security and sensitive files
+.env*
+*.key
+*.pem
+*.p12
+*.pfx
+secrets/
+private/
+config/secrets/
+
+# Development files
+node_modules/
+.npm/
+.npmrc
+.nvmrc
+*.log
+*.tmp
+.DS_Store
+Thumbs.db
+
+# Build artifacts
+dist/
+build/
+target/
+*.tgz
+*.tar.gz
+
+# IDE files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Test files
+test/
+tests/
+__tests__/
+*.test.js
+*.test.ts
+*.spec.js
+*.spec.ts
+
+# Documentation
+docs/
+*.md
+!README.md
+
+# CI/CD files
+.github/
+.gitlab-ci.yml
+.travis.yml
+.circleci/
+azure-pipelines.yml
+
+# Scripts
+scripts/
+!scripts/security-check.sh
@@ -0,0 +1,21 @@
+audit-level=moderate
+fund=false
+update-notifier=false
+ignore-scripts=false
+strict-ssl=true
+
+registry=https://registry.npmjs.org/
+audit=true
+package-lock=true
+package-lock-only=false
+save-exact=false
+
+# use npm ci for production builds (faster and more secure)
+# this will be enforced in CI/CD scripts
+
+# prevent installation of optional dependencies that might contain vulnerabilities
+optional=false
+audit=true
+update-notifier=false
+
+save-exact=false
@@ -0,0 +1 @@
+20.18.0
@@ -847,6 +847,12 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "binstring"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0669d5a35b64fdb5ab7fb19cae13148b6b5cbdf4b8247faf54ece47f699c8cef"
+
 [[package]]
 name = "bip32"
 version = "0.5.3"
@@ -942,6 +948,17 @@ dependencies = [
 "digest 0.10.7",
 ]

+[[package]]
+name = "blake2b_simd"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06e903a20b159e944f91ec8499fe1e55651480c541ea0a584f5d967c49ad9d99"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "constant_time_eq",
+]
+
 [[package]]
 name = "blake3"
 version = "1.8.2"
@@ -1332,6 +1349,17 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"

+[[package]]
+name = "coarsetime"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91849686042de1b41cd81490edc83afbcb0abe5a9b6f2c4114f23ce8cca1bcf4"
+dependencies = [
+ "libc",
+ "wasix",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
@@ -1368,19 +1396,6 @@ dependencies = [
 "crossbeam-utils",
 ]

-[[package]]
-name = "console"
-version = "0.15.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
-dependencies = [
- "encode_unicode",
- "libc",
- "once_cell",
- "unicode-width 0.2.1",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "console"
 version = "0.16.0"
@@ -1868,6 +1883,12 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "ct-codecs"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b10589d1a5e400d61f9f38f12f884cfd080ff345de8f17efda36fe0e4a02aa8"
+
 [[package]]
 name = "ctr"
 version = "0.9.2"
@@ -1898,7 +1919,7 @@ dependencies = [
 "openssl-probe",
 "openssl-sys",
 "schannel",
- "socket2",
+ "socket2 0.5.10",
 "windows-sys 0.59.0",
 ]

@@ -2331,12 +2352,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"

-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -2370,7 +2385,7 @@ version = "0.1.0"
 dependencies = [
 "cosmwasm-std",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.104",
 ]

 [[package]]
@@ -2424,6 +2439,16 @@ dependencies = [
 "signature",
 ]

+[[package]]
+name = "ed25519-compact"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9b3460f44bea8cd47f45a0c70892f1eff856d97cd55358b2f73f663789f6190"
+dependencies = [
+ "ct-codecs",
+ "getrandom 0.2.16",
+]
+
 [[package]]
 name = "ed25519-consensus"
 version = "2.1.0"
@@ -2488,6 +2513,8 @@ dependencies = [
 "ff",
 "generic-array 0.14.7",
 "group",
+ "hkdf",
+ "pem-rfc7468",
 "pkcs8",
 "rand_core 0.6.4",
 "sec1",
@@ -3349,6 +3376,30 @@ dependencies = [
 "digest 0.10.7",
 ]

+[[package]]
+name = "hmac-sha1-compact"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18492c9f6f9a560e0d346369b665ad2bdbc89fa9bceca75796584e79042694c3"
+
+[[package]]
+name = "hmac-sha256"
+version = "1.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad6880c8d4a9ebf39c6e8b77007ce223f646a4d21ce29d99f70cb16420545425"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac-sha512"
+version = "1.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89e8d20b3799fa526152a5301a771eaaad80857f83e01b23216ceaafb2d9280"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "home"
 version = "0.5.11"
@@ -3492,7 +3543,7 @@ dependencies = [
 "httpdate",
 "itoa",
 "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
 "tokio",
 "tower-service",
 "tracing",
@@ -3582,7 +3633,7 @@ dependencies = [
 "libc",
 "percent-encoding",
 "pin-project-lite",
- "socket2",
+ "socket2 0.5.10",
 "tokio",
 "tower-service",
 "tracing",
@@ -3827,26 +3878,13 @@ dependencies = [
 "serde",
 ]

-[[package]]
-name = "indicatif"
-version = "0.17.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
-dependencies = [
- "console 0.15.11",
- "number_prefix",
- "portable-atomic",
- "unicode-width 0.2.1",
- "web-time",
-]
-
 [[package]]
 name = "indicatif"
 version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70a646d946d06bedbbc4cac4c218acf4bbf2d87757a784857025f4d447e4e1cd"
 dependencies = [
- "console 0.16.0",
+ "console",
 "portable-atomic",
 "unicode-width 0.2.1",
 "unit-prefix",
@@ -3947,7 +3985,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
- "socket2",
+ "socket2 0.5.10",
 "widestring",
 "windows-sys 0.48.0",
 "winreg",
@@ -4088,6 +4126,32 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "jwt-simple"
+version = "0.12.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "731011e9647a71ff4f8474176ff6ce6e0d2de87a0173f15613af3a84c3e3401a"
+dependencies = [
+ "anyhow",
+ "binstring",
+ "blake2b_simd",
+ "coarsetime",
+ "ct-codecs",
+ "ed25519-compact",
+ "hmac-sha1-compact",
+ "hmac-sha256",
+ "hmac-sha512",
+ "k256",
+ "p256",
+ "p384",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "superboring",
+ "thiserror 2.0.12",
+ "zeroize",
+]
+
 [[package]]
 name = "k256"
 version = "0.13.4"
@@ -4519,9 +4583,9 @@ dependencies = [

 [[package]]
 name = "mock_instant"
-version = "0.5.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e1d4c44418358edcac6e1d9ce59cea7fb38052429c7704033f1196f0c179e6a"
+checksum = "dce6dd36094cac388f119d2e9dc82dc730ef91c32a6222170d630e5414b956e6"

 [[package]]
 name = "moka"
@@ -4817,12 +4881,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "number_prefix"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
-
 [[package]]
 name = "nym-api"
 version = "1.1.64"
@@ -4843,7 +4901,7 @@ dependencies = [
 "cw3",
 "cw4",
 "dashmap",
- "dotenv",
+ "dotenvy",
 "futures",
 "humantime-serde",
 "moka",
@@ -4863,7 +4921,6 @@ dependencies = [
 "nym-ecash-signer-check",
 "nym-ecash-time",
 "nym-gateway-client",
- "nym-http-api-client",
 "nym-http-api-common",
 "nym-mixnet-contract-common",
 "nym-node-requests",
@@ -4889,6 +4946,7 @@ dependencies = [
 "sqlx",
 "tempfile",
 "tendermint",
+ "test-with",
 "thiserror 2.0.12",
 "time",
 "tokio",
@@ -5094,7 +5152,6 @@ dependencies = [
 "nym-crypto",
 "nym-ecash-contract-common",
 "nym-ecash-time",
- "nym-http-api-client",
 "nym-id",
 "nym-mixnet-contract-common",
 "nym-multisig-contract-common",
@@ -5183,7 +5240,6 @@ dependencies = [
 "nym-http-api-client",
 "nym-id",
 "nym-mixnet-client",
- "nym-mixnet-contract-common",
 "nym-network-defaults",
 "nym-nonexhaustive-delayqueue",
 "nym-pemstore",
@@ -5408,6 +5464,7 @@ dependencies = [
 "nym-bin-common",
 "nym-compact-ecash",
 "nym-config",
+ "nym-credential-proxy-lib",
 "nym-credential-proxy-requests",
 "nym-credentials",
 "nym-credentials-interface",
@@ -5438,6 +5495,43 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "nym-credential-proxy-lib"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum 0.7.9",
+ "bip39",
+ "bs58",
+ "futures",
+ "humantime",
+ "nym-compact-ecash",
+ "nym-credential-proxy-requests",
+ "nym-credentials",
+ "nym-credentials-interface",
+ "nym-crypto",
+ "nym-ecash-contract-common",
+ "nym-ecash-signer-check",
+ "nym-network-defaults",
+ "nym-validator-client",
+ "rand 0.8.5",
+ "reqwest 0.12.22",
+ "serde",
+ "serde_json",
+ "sqlx",
+ "strum",
+ "strum_macros",
+ "tempfile",
+ "thiserror 2.0.12",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "url",
+ "uuid",
+ "zeroize",
+]
+
 [[package]]
 name = "nym-credential-proxy-requests"
 version = "0.1.0"
@@ -5536,7 +5630,6 @@ dependencies = [
 "nym-crypto",
 "nym-ecash-contract-common",
 "nym-ecash-time",
- "nym-http-api-client",
 "nym-network-defaults",
 "nym-serde-helpers",
 "nym-validator-client",
@@ -5581,6 +5674,7 @@ dependencies = [
 "generic-array 0.14.7",
 "hkdf",
 "hmac",
+ "jwt-simple",
 "nym-pemstore",
 "nym-sphinx-types",
 "rand 0.8.5",
@@ -5637,7 +5731,6 @@ version = "0.1.0"
 dependencies = [
 "futures",
 "nym-ecash-signer-check-types",
- "nym-http-api-client",
 "nym-network-defaults",
 "nym-validator-client",
 "semver 1.0.26",
@@ -5670,14 +5763,6 @@ dependencies = [
 "time",
 ]

-[[package]]
-name = "nym-execute"
-version = "0.1.0"
-dependencies = [
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "nym-exit-policy"
 version = "0.1.0"
@@ -5910,7 +5995,6 @@ dependencies = [
 "mime",
 "nym-bin-common",
 "nym-http-api-common",
- "nym-network-defaults",
 "once_cell",
 "reqwest 0.12.22",
 "serde",
@@ -6185,8 +6269,6 @@ dependencies = [
 "nym-client-core",
 "nym-crypto",
 "nym-gateway-requests",
- "nym-http-api-client",
- "nym-mixnet-contract-common",
 "nym-network-defaults",
 "nym-sdk",
 "nym-sphinx",
@@ -6283,7 +6365,7 @@ dependencies = [
 "hkdf",
 "human-repr",
 "humantime-serde",
- "indicatif 0.17.11",
+ "indicatif",
 "ipnetwork",
 "lioness",
 "nym-bin-common",
@@ -6399,7 +6481,7 @@ dependencies = [

 [[package]]
 name = "nym-node-status-api"
-version = "3.3.0"
+version = "3.3.2"
 dependencies = [
 "ammonia",
 "anyhow",
@@ -6654,7 +6736,6 @@ dependencies = [
 "nym-credentials-interface",
 "nym-crypto",
 "nym-gateway-requests",
- "nym-http-api-client",
 "nym-network-defaults",
 "nym-ordered-buffer",
 "nym-service-providers-common",
@@ -6722,6 +6803,26 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "nym-signers-monitor"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "humantime",
+ "itertools 0.14.0",
+ "nym-bin-common",
+ "nym-ecash-signer-check",
+ "nym-network-defaults",
+ "nym-task",
+ "nym-validator-client",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+ "zulip-client",
+]
+
 [[package]]
 name = "nym-socks5-client"
 version = "1.1.61"
@@ -6865,10 +6966,12 @@ dependencies = [
 name = "nym-sphinx-addressing"
 version = "0.1.0"
 dependencies = [
+ "bincode",
 "nym-crypto",
 "nym-sphinx-types",
 "rand 0.8.5",
 "serde",
+ "serde_json",
 "thiserror 2.0.12",
 ]

@@ -7158,6 +7261,22 @@ dependencies = [
 "x25519-dalek",
 ]

+[[package]]
+name = "nym-upgrade-mode-check"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "jwt-simple",
+ "nym-crypto",
+ "nym-http-api-client",
+ "reqwest 0.12.22",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.12",
+ "time",
+ "tracing",
+]
+
 [[package]]
 name = "nym-validator-client"
 version = "0.1.0"
@@ -7228,7 +7347,6 @@ dependencies = [
 "nym-credentials-interface",
 "nym-crypto",
 "nym-ecash-time",
- "nym-http-api-client",
 "nym-network-defaults",
 "nym-pemstore",
 "nym-serde-helpers",
@@ -7258,9 +7376,7 @@ dependencies = [
 "bytes",
 "futures",
 "humantime",
- "nym-api-requests",
 "nym-crypto",
- "nym-http-api-client",
 "nym-task",
 "nym-validator-client",
 "rand 0.8.5",
@@ -7749,6 +7865,18 @@ dependencies = [
 "sha2 0.10.9",
 ]

+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "pairing"
 version = "0.23.0"
@@ -8188,6 +8316,28 @@ dependencies = [
 "elliptic-curve",
 ]

+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -8317,7 +8467,7 @@ dependencies = [
 "quinn-udp",
 "rustc-hash",
 "rustls 0.23.29",
- "socket2",
+ "socket2 0.5.10",
 "thiserror 2.0.12",
 "tokio",
 "tracing",
@@ -8354,7 +8504,7 @@ dependencies = [
 "cfg_aliases",
 "libc",
 "once_cell",
- "socket2",
+ "socket2 0.5.10",
 "tracing",
 "windows-sys 0.59.0",
 ]
@@ -8729,6 +8879,7 @@ dependencies = [
 "pkcs1",
 "pkcs8",
 "rand_core 0.6.4",
+ "sha2 0.10.9",
 "signature",
 "spki",
 "subtle 2.6.1",
@@ -9562,9 +9713,9 @@ checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"

 [[package]]
 name = "slab"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"

 [[package]]
 name = "sluice"
@@ -9640,6 +9791,16 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "socket2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "sphinx-packet"
 version = "0.6.0"
@@ -10008,6 +10169,19 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "734676eb262c623cec13c3155096e08d1f8f29adce39ba17948b18dad1e54142"

+[[package]]
+name = "superboring"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "515cce34a781d7250b8a65706e0f2a5b99236ea605cb235d4baed6685820478f"
+dependencies = [
+ "getrandom 0.2.16",
+ "hmac-sha256",
+ "hmac-sha512",
+ "rand 0.8.5",
+ "rsa",
+]
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -10240,6 +10414,19 @@ dependencies = [
 "winapi-util",
 ]

+[[package]]
+name = "test-with"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0f370b9efbfbbc5f057cbce9888373eaeb146a3095bb8cc869b199c94d15559"
+dependencies = [
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "syn 2.0.104",
+]
+
 [[package]]
 name = "testnet-manager"
 version = "0.1.0"
@@ -10248,11 +10435,11 @@ dependencies = [
 "bip39",
 "bs58",
 "clap",
- "console 0.15.11",
+ "console",
 "cw-utils",
 "dkg-bypass-contract",
 "humantime",
- "indicatif 0.17.11",
+ "indicatif",
 "nym-bin-common",
 "nym-coconut-dkg-common",
 "nym-compact-ecash",
@@ -10261,7 +10448,6 @@ dependencies = [
 "nym-crypto",
 "nym-ecash-contract-common",
 "nym-group-contract-common",
- "nym-http-api-client",
 "nym-mixnet-contract-common",
 "nym-multisig-contract-common",
 "nym-pemstore",
@@ -10433,9 +10619,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.46.1"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cc3a2344dafbe23a245241fe8b09735b521110d30fcefbbd5feb1797ca35d17"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
 "backtrace",
 "bytes",
@@ -10446,10 +10632,10 @@ dependencies = [
 "pin-project-lite",
 "signal-hook-registry",
 "slab",
- "socket2",
+ "socket2 0.6.0",
 "tokio-macros",
 "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -10483,7 +10669,7 @@ dependencies = [
 "postgres-protocol",
 "postgres-types",
 "rand 0.9.2",
- "socket2",
+ "socket2 0.5.10",
 "tokio",
 "tokio-util",
 "whoami",
@@ -10659,7 +10845,7 @@ dependencies = [
 "percent-encoding",
 "pin-project",
 "prost",
- "socket2",
+ "socket2 0.5.10",
 "tokio",
 "tokio-stream",
 "tower 0.4.13",
@@ -10810,7 +10996,7 @@ version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c714cc8fc46db04fcfddbd274c6ef59bebb1b435155984e7c6e89c3ce66f200"
 dependencies = [
- "indicatif 0.18.0",
+ "indicatif",
 "tracing",
 "tracing-core",
 "tracing-subscriber",
@@ -11384,7 +11570,6 @@ dependencies = [
 "clap",
 "comfy-table",
 "nym-bin-common",
- "nym-http-api-client",
 "nym-network-defaults",
 "nym-validator-client",
 "serde",
@@ -11507,6 +11692,15 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"

+[[package]]
+name = "wasix"
+version = "0.12.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1fbb4ef9bbca0c1170e0b00dd28abc9e3b68669821600cad1caaed606583c6d"
+dependencies = [
+ "wasi 0.11.1+wasi-snapshot-preview1",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -11615,7 +11809,6 @@ dependencies = [
 "nym-credential-storage",
 "nym-crypto",
 "nym-gateway-client",
- "nym-http-api-client",
 "nym-sphinx",
 "nym-sphinx-acknowledgements",
 "nym-statistics-common",
@@ -43,6 +43,7 @@ members = [
    "common/cosmwasm-smart-contracts/nym-performance-contract",
    "common/cosmwasm-smart-contracts/nym-pool-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
+    "common/credential-proxy",
    "common/credential-storage",
    "common/credential-utils",
    "common/credential-verification",
@@ -53,7 +54,6 @@ members = [
    "common/ecash-signer-check",
    "common/ecash-signer-check-types",
    "common/ecash-time",
-    "common/execute",
    "common/exit-policy",
    "common/gateway-requests",
    "common/gateway-stats-storage",
@@ -96,7 +96,7 @@ members = [
    "common/ticketbooks-merkle",
    "common/topology",
    "common/tun",
-    "common/types",
+    "common/types", "common/upgrade-mode-check",
    "common/verloc",
    "common/wasm/client-core",
    "common/wasm/storage",
@@ -125,7 +125,7 @@ members = [
    "nym-node-status-api/nym-node-status-client",
    "nym-node/nym-node-metrics",
    "nym-node/nym-node-requests",
-    "nym-outfox",
+    "nym-outfox", "nym-signers-monitor",
    "nym-statistics-api",
    "nym-validator-rewarder",
    "nym-wg-gateway-client",
@@ -226,7 +226,7 @@ clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.2"
 comfy-table = "7.1.4"
-console = "0.15.11"
+console = "0.16.0"
 console-subscriber = "0.4.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
@@ -273,11 +273,12 @@ humantime = "2.2.0"
 humantime-serde = "1.1.1"
 hyper = "1.6.0"
 hyper-util = "0.1"
-indicatif = "0.17.11"
+indicatif = "0.18.0"
 inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
@@ -329,14 +330,15 @@ sqlx = "0.8.6"
 strum = "0.27.2"
 strum_macros = "0.27.2"
 subtle-encoding = "0.5"
-syn = "1"
+syn = "2"
 sysinfo = "0.37.0"
 tap = "1.0.1"
 tar = "0.4.44"
+test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
-tokio = "1.45"
+tokio = "1.47"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
@@ -13,7 +13,7 @@ use nym_credentials_interface::{
 };
 use nym_ecash_time::Date;
 use nym_validator_client::coconut::all_ecash_api_clients;
-use nym_validator_client::nym_api::{EpochId, NymApiClientExt};
+use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use nym_validator_client::EcashApiClient;
 use rand::prelude::SliceRandom;
@@ -53,7 +53,6 @@ nym-client-core-config-types = { path = "./config-types", features = [
 nym-client-core-surb-storage = { path = "./surb-storage" }
 nym-client-core-gateways-storage = { path = "./gateways-storage" }
 nym-ecash-time = { path = "../ecash-time" }
-nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies]
 nym-mixnet-client = { path = "../client-libs/mixnet-client", default-features = false }
@@ -57,7 +57,7 @@ use nym_task::{TaskClient, TaskHandle};
 use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nym_api::NymApiClientExt;
-use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, UserAgent};
+use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, NymApiClient, UserAgent};
 use rand::prelude::SliceRandom;
 use rand::rngs::OsRng;
 use rand::thread_rng;
@@ -566,7 +566,7 @@ where
        custom_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
        config_topology: config::Topology,
        nym_api_urls: Vec<Url>,
-        nym_api_client: nym_http_api_client::Client,
+        nym_api_client: NymApiClient,
    ) -> Box<dyn TopologyProvider + Send + Sync> {
        // if no custom provider was ... provided ..., create one using nym-api
        custom_provider.unwrap_or_else(|| {
@@ -749,42 +749,21 @@ where
        setup_gateway(setup_method, key_store, details_store).await
    }

-    fn construct_nym_api_client(
-        config: &Config,
-        user_agent: Option<UserAgent>,
-    ) -> Result<nym_http_api_client::Client, ClientCoreError> {
+    fn construct_nym_api_client(config: &Config, user_agent: Option<UserAgent>) -> NymApiClient {
        let mut nym_api_urls = config.get_nym_api_endpoints();
        nym_api_urls.shuffle(&mut thread_rng());

-        let mut builder = nym_http_api_client::Client::builder::<
-            _,
-            nym_validator_client::models::RequestError,
-        >(nym_api_urls[0].clone())
-        .map_err(|e| ClientCoreError::NymApiQueryFailure {
-            source: nym_validator_client::nym_api::error::NymAPIError::GenericRequestFailure(
-                e.to_string(),
-            ),
-        })?;
-
        if let Some(user_agent) = user_agent {
-            builder = builder.with_user_agent(user_agent);
+            NymApiClient::new_with_user_agent(nym_api_urls[0].clone(), user_agent)
+        } else {
+            NymApiClient::new(nym_api_urls[0].clone())
        }
-
-        builder = builder.with_bincode();
-
-        builder
-            .build::<nym_validator_client::models::RequestError>()
-            .map_err(|e| ClientCoreError::NymApiQueryFailure {
-                source: nym_validator_client::nym_api::error::NymAPIError::GenericRequestFailure(
-                    e.to_string(),
-                ),
-            })
    }

    async fn determine_key_rotation_state(
-        client: &nym_http_api_client::Client,
+        client: &NymApiClient,
    ) -> Result<KeyRotationConfig, ClientCoreError> {
-        Ok(client.get_key_rotation_info().await?.into())
+        Ok(client.nym_api.get_key_rotation_info().await?.into())
    }

    pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
@@ -851,7 +830,7 @@ where
            .dkg_query_client
            .map(|client| BandwidthController::new(credential_store, client));

-        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone())?;
+        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone());
        let key_rotation_config = Self::determine_key_rotation_state(&nym_api_client).await?;

        let topology_provider = Self::setup_topology_provider(
@@ -175,6 +175,7 @@ impl MixTrafficController {
                            },
                            None => {
                                tracing::trace!("MixTrafficController, client request channel closed");
+                                break
                            }
                        },
                    }
@@ -1,6 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::client::helpers::get_time_now;
 use crate::client::replies::{
    reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys,
 };
@@ -22,7 +23,7 @@ use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, C
 use nym_task::TaskClient;
 use std::collections::HashSet;
 use std::sync::Arc;
-use std::time::{Duration, Instant};
+use std::time::Duration;
 use tracing::*;

 // The interval at which we check for stale buffers
@@ -54,7 +55,7 @@ struct ReceivedMessagesBufferInner<R: MessageReceiver> {
    stats_tx: ClientStatsSender,

    // Periodically check for stale buffers to clean up
-    last_stale_check: Instant,
+    last_stale_check: crate::client::helpers::Instant,
 }

 impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
@@ -154,7 +155,7 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
    }

    fn cleanup_stale_buffers(&mut self) {
-        let now = Instant::now();
+        let now = get_time_now();
        if now - self.last_stale_check > STALE_BUFFER_CHECK_INTERVAL {
            self.last_stale_check = now;
            self.message_receiver
@@ -190,7 +191,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                message_sender: None,
                recently_reconstructed: HashSet::new(),
                stats_tx,
-                last_stale_check: Instant::now(),
+                last_stale_check: get_time_now(),
            })),
            reply_key_storage,
            reply_controller_sender,
@@ -2,10 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0

 use async_trait::async_trait;
-use nym_mixnet_contract_common::EpochRewardedSet;
 use nym_topology::provider_trait::{ToTopologyMetadata, TopologyProvider};
 use nym_topology::NymTopology;
-use nym_validator_client::nym_api::NymApiClientExt;
 use rand::prelude::SliceRandom;
 use rand::thread_rng;
 use std::cmp::min;
@@ -41,43 +39,30 @@ impl Config {
 pub struct NymApiTopologyProvider {
    config: Config,

-    validator_client: nym_http_api_client::Client,
+    validator_client: nym_validator_client::client::NymApiClient,
    nym_api_urls: Vec<Url>,
    currently_used_api: usize,
-    use_bincode: bool,
 }

 impl NymApiTopologyProvider {
    pub fn new(
        config: impl Into<Config>,
        mut nym_api_urls: Vec<Url>,
-        validator_client: nym_http_api_client::Client,
+        mut validator_client: nym_validator_client::client::NymApiClient,
    ) -> Self {
        nym_api_urls.shuffle(&mut thread_rng());
-        let mut provider = NymApiTopologyProvider {
+        validator_client.change_nym_api(nym_api_urls[0].clone());
+
+        NymApiTopologyProvider {
            config: config.into(),
            validator_client,
            nym_api_urls,
            currently_used_api: 0,
-            use_bincode: true,
-        };
-        // Set all API URLs - the client will try them in order with automatic failover
-        provider.validator_client.change_base_urls(
-            provider
-                .nym_api_urls
-                .iter()
-                .map(|u| u.clone().into())
-                .collect(),
-        );
-        provider
+        }
    }

    pub fn disable_bincode(&mut self) {
-        self.use_bincode = false;
-        // Note: The unified client doesn't support toggling bincode after creation.
-        // This would require recreating the client without bincode.
-        // For now, we'll track the preference but it won't take effect.
-        warn!("Disabling bincode on existing client is not currently supported");
+        self.validator_client.use_bincode = false;
    }

    fn use_next_nym_api(&mut self) {
@@ -87,19 +72,8 @@ impl NymApiTopologyProvider {
        }

        self.currently_used_api = (self.currently_used_api + 1) % self.nym_api_urls.len();
-
-        // Provide all URLs starting from the next one in rotation order
-        // This enables automatic failover to other endpoints
-        let rotated_urls: Vec<_> = self
-            .nym_api_urls
-            .iter()
-            .cycle()
-            .skip(self.currently_used_api)
-            .take(self.nym_api_urls.len())
-            .map(|u| u.clone().into())
-            .collect();
-
-        self.validator_client.change_base_urls(rotated_urls)
+        self.validator_client
+            .change_nym_api(self.nym_api_urls[self.currently_used_api].clone())
    }

    async fn get_current_compatible_topology(&mut self) -> Option<NymTopology> {
@@ -125,13 +99,8 @@ impl NymApiTopologyProvider {
                .filter(|n| n.performance.round_to_integer() >= self.config.min_node_performance())
                .collect::<Vec<_>>();

-            let epoch_rewarded_set: EpochRewardedSet = rewarded_set.into();
-            NymTopology::new(
-                metadata.to_topology_metadata(),
-                epoch_rewarded_set,
-                Vec::new(),
-            )
-            .with_skimmed_nodes(&nodes_filtered)
+            NymTopology::new(metadata.to_topology_metadata(), rewarded_set, Vec::new())
+                .with_skimmed_nodes(&nodes_filtered)
        } else {
            // if we're not using extended topology, we're only getting active set mixnodes and gateways

@@ -179,13 +148,8 @@ impl NymApiTopologyProvider {
                }
            }

-            let epoch_rewarded_set: EpochRewardedSet = rewarded_set.into();
-            NymTopology::new(
-                metadata.to_topology_metadata(),
-                epoch_rewarded_set,
-                Vec::new(),
-            )
-            .with_skimmed_nodes(&nodes)
+            NymTopology::new(metadata.to_topology_metadata(), rewarded_set, Vec::new())
+                .with_skimmed_nodes(&nodes)
        };

        if !topology.is_minimally_routable() {
@@ -7,8 +7,7 @@ use futures::{SinkExt, StreamExt};
 use nym_crypto::asymmetric::ed25519;
 use nym_gateway_client::GatewayClient;
 use nym_topology::node::RoutingNode;
-use nym_validator_client::client::{IdentityKeyRef, NymApiClientExt};
-use nym_validator_client::nym_nodes::SkimmedNodesWithMetadata;
+use nym_validator_client::client::IdentityKeyRef;
 use nym_validator_client::UserAgent;
 use rand::{seq::SliceRandom, Rng};
 #[cfg(unix)]
@@ -84,48 +83,6 @@ struct GatewayWithLatency<'a, G: ConnectableGateway> {
    latency: Duration,
 }

-// Helper to collect all pages of entry nodes - replicates NymApiClient's convenience method
-async fn get_all_basic_entry_nodes_with_metadata(
-    client: &nym_http_api_client::Client,
-    use_bincode: bool,
-) -> Result<SkimmedNodesWithMetadata, ClientCoreError> {
-    // Get first page to obtain metadata
-    let mut page = 0;
-    let res = client
-        .get_basic_entry_assigned_nodes_v2(false, Some(page), None, use_bincode)
-        .await?;
-    let mut nodes = res.nodes.data;
-    let metadata = res.metadata;
-
-    if res.nodes.pagination.total == nodes.len() {
-        return Ok(SkimmedNodesWithMetadata::new(nodes, metadata));
-    }
-
-    page += 1;
-
-    // Collect remaining pages
-    loop {
-        let mut res = client
-            .get_basic_entry_assigned_nodes_v2(false, Some(page), None, use_bincode)
-            .await?;
-
-        if !metadata.consistency_check(&res.metadata) {
-            return Err(ClientCoreError::ValidatorClientError(
-                nym_validator_client::ValidatorClientError::InconsistentPagedMetadata,
-            ));
-        }
-
-        nodes.append(&mut res.nodes.data);
-        if nodes.len() < res.nodes.pagination.total {
-            page += 1
-        } else {
-            break;
-        }
-    }
-
-    Ok(SkimmedNodesWithMetadata::new(nodes, metadata))
-}
-
 impl<'a, G: ConnectableGateway> GatewayWithLatency<'a, G> {
    fn new(gateway: &'a G, latency: Duration) -> Self {
        GatewayWithLatency { gateway, latency }
@@ -142,32 +99,16 @@ pub async fn gateways_for_init<R: Rng>(
    let nym_api = nym_apis
        .choose(rng)
        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
-
-    // Use the unified HTTP client directly with optional user agent
-    let mut builder = nym_http_api_client::Client::builder(nym_api.clone())
-        .map_err(|e| {
-            ClientCoreError::ValidatorClientError(
-                nym_validator_client::ValidatorClientError::NymAPIError { source: e },
-            )
-        })?
-        .with_bincode(); // Use bincode for better performance
-
-    if let Some(user_agent) = user_agent {
-        builder = builder.with_user_agent(user_agent);
-    }
-
-    let client = builder
-        .build::<nym_validator_client::models::RequestError>()
-        .map_err(|e| {
-            ClientCoreError::ValidatorClientError(
-                nym_validator_client::ValidatorClientError::NymAPIError { source: e },
-            )
-        })?;
+    let client = if let Some(user_agent) = user_agent {
+        nym_validator_client::client::NymApiClient::new_with_user_agent(nym_api.clone(), user_agent)
+    } else {
+        nym_validator_client::client::NymApiClient::new(nym_api.clone())
+    };

    tracing::debug!("Fetching list of gateways from: {nym_api}");

-    // Use our helper to handle pagination
-    let gateways = get_all_basic_entry_nodes_with_metadata(&client, true)
+    let gateways = client
+        .get_all_basic_entry_assigned_nodes_with_metadata()
        .await?
        .nodes;
    info!("nym api reports {} gateways", gateways.len());
@@ -5,8 +5,8 @@ use crate::nyxd::{self, NyxdClient};
 use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
 use crate::signing::signer::{NoSigner, OfflineSigner};
 use crate::{
-    DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient, ReqwestRpcClient,
-    ValidatorClientError,
+    nym_api, DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient,
+    ReqwestRpcClient, ValidatorClientError,
 };
 use nym_api_requests::ecash::models::{
    AggregatedCoinIndicesSignatureResponse, AggregatedExpirationDateSignatureResponse,
@@ -153,7 +153,7 @@ impl Config {
 pub struct Client<C, S = NoSigner> {
    // ideally they would have been read-only, but unfortunately rust doesn't have such features
    // #[deprecated(note = "please use `nym_api_client` instead")]
-    pub nym_api: nym_http_api_client::Client,
+    pub nym_api: nym_api::Client,
    // pub nym_api_client: NymApiClient,
    pub nyxd: NyxdClient<C, S>,
 }
@@ -214,7 +214,7 @@ impl Client<ReqwestRpcClient> {

 impl<C> Client<C> {
    pub fn new_with_rpc_client(config: Config, rpc_client: C) -> Self {
-        let nym_api_client = nym_http_api_client::Client::new(config.api_url.clone(), None);
+        let nym_api_client = nym_api::Client::new(config.api_url.clone(), None);

        Client {
            nym_api: nym_api_client,
@@ -228,7 +228,7 @@ impl<C, S> Client<C, S> {
    where
        S: OfflineSigner,
    {
-        let nym_api_client = nym_http_api_client::Client::new(config.api_url.clone(), None);
+        let nym_api_client = nym_api::Client::new(config.api_url.clone(), None);

        Client {
            nym_api: nym_api_client,
@@ -385,25 +385,38 @@ impl<C, S> Client<C, S> {
    }
 }

-/// DEPRECATED: Use nym_http_api_client::Client with from_network() or with_bincode() instead
-#[deprecated(
-    since = "1.2.0",
-    note = "Use nym_http_api_client::Client::from_network() or ClientBuilder::with_bincode() instead"
-)]
 #[derive(Clone)]
 pub struct NymApiClient {
    pub use_bincode: bool,
-    pub nym_api: nym_http_api_client::Client,
+    pub nym_api: nym_api::Client,
    // TODO: perhaps if we really need it at some (currently I don't see any reasons for it)
    // we could re-implement the communication with the REST API on port 1317
 }

+impl From<nym_api::Client> for NymApiClient {
+    fn from(nym_api: nym_api::Client) -> Self {
+        NymApiClient {
+            use_bincode: false,
+            nym_api,
+        }
+    }
+}
+
 // we have to allow the use of deprecated method here as they're calling the deprecated trait methods
 #[allow(deprecated)]
 impl NymApiClient {
+    pub fn new(api_url: Url) -> Self {
+        let nym_api = nym_api::Client::new(api_url, None);
+
+        NymApiClient {
+            use_bincode: true,
+            nym_api,
+        }
+    }
+
    #[cfg(not(target_arch = "wasm32"))]
    pub fn new_with_timeout(api_url: Url, timeout: std::time::Duration) -> Self {
-        let nym_api = nym_http_api_client::Client::new(api_url, Some(timeout));
+        let nym_api = nym_api::Client::new(api_url, Some(timeout));

        NymApiClient {
            use_bincode: true,
@@ -418,7 +431,7 @@ impl NymApiClient {
    }

    pub fn new_with_user_agent(api_url: Url, user_agent: impl Into<UserAgent>) -> Self {
-        let nym_api = nym_http_api_client::Client::builder::<_, ValidatorClientError>(api_url)
+        let nym_api = nym_api::Client::builder::<_, ValidatorClientError>(api_url)
            .expect("invalid api url")
            .with_user_agent(user_agent.into())
            .build::<ValidatorClientError>()
@@ -3,6 +3,7 @@

 use crate::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
 use crate::nyxd::error::NyxdError;
+use crate::NymApiClient;
 use nym_coconut_dkg_common::types::{EpochId, NodeIndex};
 use nym_coconut_dkg_common::verification_key::ContractVKShare;
 use nym_compact_ecash::error::CompactEcashError;
@@ -14,7 +15,7 @@ use url::Url;
 // TODO: it really doesn't feel like this should live in this crate.
 #[derive(Clone)]
 pub struct EcashApiClient {
-    pub api_client: nym_http_api_client::Client,
+    pub api_client: NymApiClient,
    pub verification_key: VerificationKeyAuth,
    pub node_id: NodeIndex,
    pub cosmos_address: cosmrs::AccountId,
@@ -24,10 +25,10 @@ impl Display for EcashApiClient {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        write!(
            f,
-            "[id: {}] {} @ {:?}",
+            "[id: {}] {} @ {}",
            self.node_id,
            self.cosmos_address,
-            self.api_client.base_urls()
+            self.api_client.api_url()
        )
    }
 }
@@ -59,9 +60,6 @@ pub enum EcashApiError {
        source: CompactEcashError,
    },

-    #[error("failed to create API client: {0}")]
-    ClientError(String),
-
    #[error("the provided account address is malformed: {source}")]
    MalformedAccountAddress {
        #[from]
@@ -91,16 +89,8 @@ impl TryFrom<ContractVKShare> for EcashApiClient {
        // In non-client applications this resolver can cause warning logs about H2 connection
        // failure. This indicates that the long lived https connection was closed by the remote
        // peer and the resolver will have to reconnect. It should not impact actual functionality
-        let api_client = nym_http_api_client::Client::builder::<
-            _,
-            nym_api_requests::models::RequestError,
-        >(url_address)
-        .map_err(|e| EcashApiError::ClientError(e.to_string()))?
-        .build::<nym_api_requests::models::RequestError>()
-        .map_err(|e| EcashApiError::ClientError(e.to_string()))?;
-
        Ok(EcashApiClient {
-            api_client,
+            api_client: NymApiClient::new(url_address),
            verification_key: VerificationKeyAuth::try_from_bs58(&share.share)?,
            node_id: share.node_index,
            cosmos_address: share.owner.as_str().parse()?,
@@ -1,8 +1,7 @@
-use crate::nym_api::NymApiClientExt;
 use crate::nyxd::contract_traits::MixnetQueryClient;
 use crate::nyxd::error::NyxdError;
 use crate::nyxd::Config as ClientConfig;
-use crate::{QueryHttpRpcNyxdClient, ValidatorClientError};
+use crate::{NymApiClient, QueryHttpRpcNyxdClient, ValidatorClientError};
 use colored::Colorize;
 use core::fmt;
 use itertools::Itertools;
@@ -88,19 +87,8 @@ fn setup_connection_tests<H: BuildHasher + 'static>(
        }
    });

-    let api_connection_test_clients = api_urls.filter_map(|(network, url)| {
-        match nym_http_api_client::Client::builder(url.clone())
-            .and_then(|b| b.build::<nym_api_requests::models::RequestError>())
-        {
-            Ok(client) => Some(ClientForConnectionTest::Api(network, url, client)),
-            Err(err) => {
-                eprintln!(
-                    "Failed to create API client for {}: {err}",
-                    network.network_name
-                );
-                None
-            }
-        }
+    let api_connection_test_clients = api_urls.map(|(network, url)| {
+        ClientForConnectionTest::Api(network, url.clone(), NymApiClient::new(url))
    });

    nyxd_connection_test_clients.chain(api_connection_test_clients)
@@ -172,7 +160,7 @@ async fn test_nyxd_connection(
 async fn test_nym_api_connection(
    network: NymNetworkDetails,
    url: &Url,
-    client: &nym_http_api_client::Client,
+    client: &NymApiClient,
 ) -> ConnectionResult {
    let result = match timeout(
        Duration::from_secs(CONNECTION_TEST_TIMEOUT_SEC),
@@ -198,7 +186,7 @@ async fn test_nym_api_connection(

 enum ClientForConnectionTest {
    Nyxd(NymNetworkDetails, Url, Box<QueryHttpRpcNyxdClient>),
-    Api(NymNetworkDetails, Url, nym_http_api_client::Client),
+    Api(NymNetworkDetails, Url, NymApiClient),
 }

 impl ClientForConnectionTest {
@@ -14,6 +14,7 @@ pub mod signing;
 pub use crate::error::ValidatorClientError;
 pub use crate::rpc::reqwest::ReqwestRpcClient;
 pub use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
+pub use client::NymApiClient;
 pub use client::{Client, Config, EcashApiClient};
 pub use nym_api_requests::*;
 pub use nym_http_api_client::UserAgent;
@@ -3,7 +3,6 @@

 use crate::nym_api::error::NymAPIError;
 use crate::nym_api::routes::{ecash, CORE_STATUS_COUNT, SINCE_ARG};
-use crate::nym_nodes::SkimmedNodesWithMetadata;
 use async_trait::async_trait;
 use nym_api_requests::ecash::models::{
    AggregatedCoinIndicesSignatureResponse, AggregatedExpirationDateSignatureResponse,
@@ -38,7 +37,7 @@ pub use nym_api_requests::{
        MixnodeStatusResponse, MixnodeUptimeHistoryResponse, RewardEstimationResponse,
        StakeSaturationResponse, UptimeResponse,
    },
-    nym_nodes::{CachedNodesResponse, SemiSkimmedNode, SemiSkimmedNodesWithMetadata, SkimmedNode},
+    nym_nodes::{CachedNodesResponse, SemiSkimmedNode, SkimmedNode},
    NymNetworkDetailsResponse,
 };
 use nym_contracts_common::IdentityKey;
@@ -50,8 +49,8 @@ use time::format_description::BorrowedFormatItem;
 use time::Date;
 use tracing::instrument;

-use crate::ValidatorClientError;
 pub use nym_coconut_dkg_common::types::EpochId;
+pub use nym_http_api_client::Client;

 pub mod error;
 pub mod routes;
@@ -63,9 +62,6 @@ pub fn rfc_3339_date() -> Vec<BorrowedFormatItem<'static>> {
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait NymApiClientExt: ApiClient {
-    /// Get the current API URL being used by the client
-    fn api_url(&self) -> &url::Url;
-
    async fn health(&self) -> Result<ApiHealthResponse, NymAPIError> {
        self.get_json(
            &[
@@ -245,162 +241,6 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn get_current_rewarded_set(&self) -> Result<RewardedSetResponse, NymAPIError> {
-        self.get_rewarded_set().await
-    }
-
-    async fn get_all_basic_nodes_with_metadata(
-        &self,
-    ) -> Result<SkimmedNodesWithMetadata, NymAPIError> {
-        // unroll first loop iteration in order to obtain the metadata
-        let mut page = 0;
-        let res = self
-            .get_basic_nodes_v2(false, Some(page), None, true)
-            .await?;
-        let mut nodes = res.nodes.data;
-        let metadata = res.metadata;
-
-        if res.nodes.pagination.total == nodes.len() {
-            return Ok(SkimmedNodesWithMetadata::new(nodes, metadata));
-        }
-
-        page += 1;
-
-        loop {
-            let mut res = self
-                .get_basic_nodes_v2(false, Some(page), None, true)
-                .await?;
-
-            if !metadata.consistency_check(&res.metadata) {
-                // Create a custom error for inconsistent metadata
-                return Err(NymAPIError::EndpointFailure {
-                    status: reqwest::StatusCode::INTERNAL_SERVER_ERROR,
-                    error: nym_api_requests::models::RequestError::new(
-                        "Inconsistent paged metadata",
-                    ),
-                });
-            }
-
-            nodes.append(&mut res.nodes.data);
-            if nodes.len() >= res.nodes.pagination.total {
-                break;
-            } else {
-                page += 1
-            }
-        }
-
-        Ok(SkimmedNodesWithMetadata::new(nodes, metadata))
-    }
-
-    async fn get_all_basic_active_mixing_assigned_nodes_with_metadata(
-        &self,
-    ) -> Result<SkimmedNodesWithMetadata, NymAPIError> {
-        // Get all mixing nodes that are in the active/rewarded set
-        let mut page = 0;
-        let res = self
-            .get_basic_active_mixing_assigned_nodes_v2(false, Some(page), None, false)
-            .await?;
-
-        let metadata = res.metadata;
-        let mut nodes = res.nodes.data;
-
-        if res.nodes.pagination.total == nodes.len() {
-            return Ok(SkimmedNodesWithMetadata::new(nodes, metadata));
-        }
-
-        page += 1;
-
-        loop {
-            let res = self
-                .get_basic_active_mixing_assigned_nodes_v2(false, Some(page), None, false)
-                .await?;
-
-            if !metadata.consistency_check(&res.metadata) {
-                return Err(NymAPIError::EndpointFailure {
-                    status: reqwest::StatusCode::INTERNAL_SERVER_ERROR,
-                    error: nym_api_requests::models::RequestError::new(
-                        "Inconsistent paged metadata",
-                    ),
-                });
-            }
-
-            nodes.append(&mut res.nodes.data.clone());
-
-            // Check if we've got all nodes
-            if nodes.len() >= res.nodes.pagination.total {
-                break;
-            } else {
-                page += 1;
-            }
-        }
-
-        Ok(SkimmedNodesWithMetadata::new(nodes, metadata))
-    }
-
-    async fn get_all_basic_entry_assigned_nodes_with_metadata(
-        &self,
-    ) -> Result<SkimmedNodesWithMetadata, NymAPIError> {
-        // Get all nodes that can act as entry gateways
-        let mut page = 0;
-        let res = self
-            .get_basic_entry_assigned_nodes_v2(false, Some(page), None, false)
-            .await?;
-
-        let metadata = res.metadata;
-        let mut nodes = res.nodes.data;
-
-        if res.nodes.pagination.total == nodes.len() {
-            return Ok(SkimmedNodesWithMetadata::new(nodes, metadata));
-        }
-
-        page += 1;
-
-        loop {
-            let res = self
-                .get_basic_entry_assigned_nodes_v2(false, Some(page), None, false)
-                .await?;
-
-            if !metadata.consistency_check(&res.metadata) {
-                return Err(NymAPIError::EndpointFailure {
-                    status: reqwest::StatusCode::INTERNAL_SERVER_ERROR,
-                    error: nym_api_requests::models::RequestError::new(
-                        "Inconsistent paged metadata",
-                    ),
-                });
-            }
-
-            nodes.append(&mut res.nodes.data.clone());
-
-            // Check if we've got all nodes
-            if nodes.len() >= res.nodes.pagination.total {
-                break;
-            } else {
-                page += 1;
-            }
-        }
-
-        Ok(SkimmedNodesWithMetadata::new(nodes, metadata))
-    }
-
-    async fn get_all_described_nodes(&self) -> Result<Vec<NymNodeDescription>, NymAPIError> {
-        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
-        let mut page = 0;
-        let mut descriptions = Vec::new();
-
-        loop {
-            let mut res = self.get_nodes_described(Some(page), None).await?;
-
-            descriptions.append(&mut res.data);
-            if descriptions.len() < res.pagination.total {
-                page += 1
-            } else {
-                break;
-            }
-        }
-
-        Ok(descriptions)
-    }
-
    #[tracing::instrument(level = "debug", skip_all)]
    async fn get_nym_nodes(
        &self,
@@ -428,25 +268,6 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn get_all_bonded_nym_nodes(&self) -> Result<Vec<NymNodeDetails>, ValidatorClientError> {
-        // TODO: deal with paging in macro or some helper function or something, because it's the same pattern everywhere
-        let mut page = 0;
-        let mut bonds = Vec::new();
-
-        loop {
-            let mut res = self.get_nym_nodes(Some(page), None).await?;
-
-            bonds.append(&mut res.data);
-            if bonds.len() < res.pagination.total {
-                page += 1
-            } else {
-                break;
-            }
-        }
-
-        Ok(bonds)
-    }
-
    #[deprecated]
    #[tracing::instrument(level = "debug", skip_all)]
    async fn get_basic_mixnodes(&self) -> Result<CachedNodesResponse<SkimmedNode>, NymAPIError> {
@@ -1550,49 +1371,8 @@ pub trait NymApiClientExt: ApiClient {
        )
        .await
    }
-
-    /// Method to change the base API URLs being used by the client
-    fn change_base_urls(&mut self, urls: Vec<url::Url>);
-
-    /// Retrieve expanded information for all bonded nodes on the network
-    async fn get_all_expanded_nodes(&self) -> Result<SemiSkimmedNodesWithMetadata, NymAPIError> {
-        // Unroll the first iteration to get the metadata
-        let mut page = 0;
-
-        let res = self.get_expanded_nodes(false, Some(page), None).await?;
-        let mut nodes = res.nodes.data;
-        let metadata = res.metadata;
-
-        if res.nodes.pagination.total == nodes.len() {
-            return Ok(SemiSkimmedNodesWithMetadata::new(nodes, metadata));
-        }
-
-        page += 1;
-
-        loop {
-            let mut res = self.get_expanded_nodes(false, Some(page), None).await?;
-
-            nodes.append(&mut res.nodes.data);
-            if nodes.len() < res.nodes.pagination.total {
-                page += 1
-            } else {
-                break;
-            }
-        }
-
-        Ok(SemiSkimmedNodesWithMetadata::new(nodes, metadata))
-    }
 }

-// Client is already nym_http_api_client::Client (re-exported above), so just one impl needed
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl NymApiClientExt for nym_http_api_client::Client {
-    fn api_url(&self) -> &url::Url {
-        self.current_url().as_ref()
-    }
-
-    fn change_base_urls(&mut self, urls: Vec<url::Url>) {
-        self.change_base_urls(urls.into_iter().map(|u| u.into()).collect());
-    }
-}
+impl NymApiClientExt for Client {}
@@ -28,7 +28,7 @@ use cosmrs::proto::cosmwasm::wasm::v1::{
    QueryRawContractStateResponse, QuerySmartContractStateRequest, QuerySmartContractStateResponse,
 };
 use cosmrs::tendermint::{block, chain, Hash};
-use cosmrs::{AccountId, Coin as CosmosCoin, Tx};
+use cosmrs::{AccountId, Coin as CosmosCoin};
 use prost::Message;
 use serde::{Deserialize, Serialize};

@@ -556,23 +556,12 @@ pub trait CosmWasmClient: TendermintRpcClient {
        Ok(serde_json::from_slice(&res.data)?)
    }

-    // deprecation warning is due to the fact the protobuf files built were based on cosmos-sdk 0.44,
-    // where they prefer using tx_bytes directly. However, in 0.42, which we are using at the time
-    // of writing this, the option does not work
-    // TODO: we should really stop using the `tx` argument here and use `tx_bytes` exlusively,
-    // however, at the time of writing this update, while our QA and mainnet networks do support it,
-    // sandbox is still running old version of wasmd that lacks support for `tx_bytes`
-    #[allow(deprecated)]
-    async fn query_simulate(
-        &self,
-        tx: Option<Tx>,
-        tx_bytes: Vec<u8>,
-    ) -> Result<SimulateResponse, NyxdError> {
+    async fn query_simulate(&self, tx_bytes: Vec<u8>) -> Result<SimulateResponse, NyxdError> {
        let path = Some("/cosmos.tx.v1beta1.Service/Simulate".to_owned());

        let req = SimulateRequest {
-            tx: tx.map(Into::into),
            tx_bytes,
+            ..Default::default()
        };

        let res = self
@@ -81,17 +81,14 @@ where
            auth_info: single_unspecified_signer_auth(public_key, sequence_response.sequence),
            signatures: vec![Vec::new()],
        };
-        self.query_simulate(Some(partial_tx), Vec::new()).await

-        // for completion sake, once we're able to transition into using `tx_bytes`,
-        // we might want to use something like this instead:
-        // let tx_raw: tx::Raw = cosmrs::proto::cosmos::tx::v1beta1::TxRaw {
-        //     body_bytes: partial_tx.body.into_bytes().unwrap(),
-        //     auth_info_bytes: partial_tx.auth_info.into_bytes().unwrap(),
-        //     signatures: partial_tx.signatures,
-        // }
-        // .into();
-        // self.query_simulate(None, tx_raw.to_bytes().unwrap()).await
+        let tx_raw: tx::Raw = cosmrs::proto::cosmos::tx::v1beta1::TxRaw {
+            body_bytes: partial_tx.body.into_bytes()?,
+            auth_info_bytes: partial_tx.auth_info.into_bytes()?,
+            signatures: partial_tx.signatures,
+        }
+        .into();
+        self.query_simulate(tx_raw.to_bytes()?).await
    }

    async fn upload(
@@ -38,7 +38,6 @@ cosmrs = { workspace = true }
 cosmwasm-std = { workspace = true }

 nym-validator-client = { path = "../client-libs/validator-client" }
-nym-http-api-client = { path = "../http-api-client" }
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
 nym-crypto = { path = "../../common/crypto", features = ["asymmetric"] }
 nym-network-defaults = { path = "../network-defaults" }
@@ -2,12 +2,12 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::context::errors::ContextError;
-pub use nym_http_api_client::Client as NymApiClient;
 use nym_network_defaults::{
    setup_env,
    var_names::{MIXNET_CONTRACT_ADDRESS, NYM_API, NYXD, VESTING_CONTRACT_ADDRESS},
    NymNetworkDetails,
 };
+pub use nym_validator_client::nym_api::Client as NymApiClient;
 use nym_validator_client::nyxd::{self, AccountId, NyxdClient};
 use nym_validator_client::{
    DirectSigningHttpRpcNyxdClient, DirectSigningHttpRpcValidatorClient, QueryHttpRpcNyxdClient,
@@ -0,0 +1,55 @@
+[package]
+name = "nym-credential-proxy-lib"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+axum = { workspace = true }
+bip39 = { workspace = true, features = ["zeroize"] }
+bs58 = { workspace = true }
+futures = { workspace = true }
+humantime = { workspace = true }
+rand = { workspace = true }
+reqwest = { workspace = true, features = ["rustls-tls"] }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+strum = { workspace = true, features = ["derive"] }
+strum_macros = { workspace = true }
+sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"] }
+time = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["sync"] }
+tokio-util = { workspace = true, features = ["rt"] }
+tracing = { workspace = true }
+uuid = { workspace = true, features = ["serde"] }
+url = { workspace = true }
+zeroize = { workspace = true }
+
+nym-credentials = { path = "../credentials" }
+nym-crypto = { path = "../crypto", features = ["asymmetric", "rand", "serde"] }
+nym-credentials-interface = { path = "../credentials-interface" }
+nym-credential-proxy-requests = { path = "../../nym-credential-proxy/nym-credential-proxy-requests" }
+nym-ecash-signer-check = { path = "../ecash-signer-check" }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
+nym-compact-ecash = { path = "../nym_offline_compact_ecash" }
+nym-validator-client = { path = "../client-libs/validator-client" }
+nym-network-defaults = { path = "../network-defaults" }
+
+[dev-dependencies]
+tempfile = { workspace = true }
+
+[build-dependencies]
+anyhow = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
+
+[lints]
+workspace = true
@@ -10,11 +10,11 @@ use nym_validator_client::nyxd::{Coin, Hash};
 use time::OffsetDateTime;
 use zeroize::Zeroizing;

-pub(crate) struct BufferedDeposit {
-    pub(crate) deposit_id: u32,
+pub struct BufferedDeposit {
+    pub deposit_id: u32,

    // note: this type implements `ZeroizeOnDrop`
-    pub(crate) ed25519_private_key: ed25519::PrivateKey,
+    pub ed25519_private_key: ed25519::PrivateKey,
 }

 impl TryFrom<StorableEcashDeposit> for BufferedDeposit {
@@ -36,14 +36,14 @@ impl TryFrom<StorableEcashDeposit> for BufferedDeposit {
 }

 impl BufferedDeposit {
-    pub(crate) fn new(deposit_id: u32, ed25519_private_key: ed25519::PrivateKey) -> Self {
+    pub fn new(deposit_id: u32, ed25519_private_key: ed25519::PrivateKey) -> Self {
        BufferedDeposit {
            deposit_id,
            ed25519_private_key,
        }
    }

-    pub(crate) fn sign_ticketbook_plaintext(
+    pub fn sign_ticketbook_plaintext(
        &self,
        withdrawal_request: &WithdrawalRequest,
    ) -> ed25519::Signature {
@@ -52,13 +52,13 @@ impl BufferedDeposit {
    }
 }

-pub(crate) struct PerformedDeposits {
-    pub(crate) deposits_data: Vec<BufferedDeposit>,
+pub struct PerformedDeposits {
+    pub deposits_data: Vec<BufferedDeposit>,

    // shared by all performed deposits as they were included in the same tx
-    pub(crate) tx_hash: Hash,
-    pub(crate) requested_on: OffsetDateTime,
-    pub(crate) deposit_amount: Coin,
+    pub tx_hash: Hash,
+    pub requested_on: OffsetDateTime,
+    pub deposit_amount: Coin,
 }

 impl PerformedDeposits {
@@ -1,11 +1,11 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

-use crate::deposits_buffer::helpers::{request_sizes, BufferedDeposit, PerformedDeposits};
+use crate::deposits_buffer::helpers::request_sizes;
 use crate::deposits_buffer::refill_task::RefillTask;
 use crate::error::CredentialProxyError;
-use crate::http::state::required_deposit_cache::RequiredDepositCache;
-use crate::http::state::ChainClient;
+use crate::shared_state::nyxd_client::ChainClient;
+use crate::shared_state::required_deposit_cache::RequiredDepositCache;
 use crate::storage::CredentialProxyStorage;
 use nym_compact_ecash::PublicKeyUser;
 use nym_crypto::asymmetric::ed25519;
@@ -21,6 +21,8 @@ use tokio_util::sync::CancellationToken;
 use tracing::{debug, error, info, instrument, warn};
 use uuid::Uuid;

+pub use helpers::{BufferedDeposit, PerformedDeposits};
+
 pub(crate) mod helpers;
 mod refill_task;

@@ -43,12 +45,12 @@ struct DepositsBufferInner {
 }

 #[derive(Clone)]
-pub(crate) struct DepositsBuffer {
+pub struct DepositsBuffer {
    inner: Arc<DepositsBufferInner>,
 }

 impl DepositsBuffer {
-    pub(crate) async fn new(
+    pub async fn new(
        storage: CredentialProxyStorage,
        client: ChainClient,
        required_deposit_cache: RequiredDepositCache,
@@ -250,7 +252,7 @@ impl DepositsBuffer {
        }
    }

-    pub(crate) async fn get_valid_deposit(
+    pub async fn get_valid_deposit(
        &self,
        request_uuid: Uuid,
        requested_on: OffsetDateTime,
@@ -290,7 +292,7 @@ impl DepositsBuffer {
        }
    }

-    pub(crate) async fn wait_for_shutdown(&self) {
+    pub async fn wait_for_shutdown(&self) {
        let task_handle = self.inner.deposits_refill_task.take_task_join_handle();
        if let Some(task_handle) = task_handle {
            if !task_handle.is_finished() {
@@ -1,9 +1,9 @@
-// Copyright 2024 Nym Technologies SA <contact@nymtech.net>
+// Copyright 2025 Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

 use nym_ecash_signer_check::SignerCheckError;
 use nym_validator_client::coconut::EcashApiError;
-use nym_validator_client::nym_api::{error::NymAPIError, EpochId};
+use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::error::NyxdError;
 use std::io;
 use std::net::SocketAddr;
@@ -71,12 +71,6 @@ pub enum CredentialProxyError {
        source: EcashApiError,
    },

-    #[error("Nym API request failed: {source}")]
-    NymApiFailure {
-        #[from]
-        source: NymAPIError,
-    },
-
    #[error("Compact ecash internal error: {0}")]
    CompactEcashInternalError(#[from] nym_compact_ecash::error::CompactEcashError),

@@ -134,6 +128,30 @@ pub enum CredentialProxyError {
        #[from]
        source: SignerCheckError,
    },
+
+    #[error(
+        "this operation couldn't be completed as the program is in the process of shutting down"
+    )]
+    ShutdownInProgress,
+
+    #[error("failed to obtain wallet shares with id {id}: {message}")]
+    ShareByIdLoadError { message: String, id: i64 },
+
+    #[error("failed to obtain wallet shares with device_id {device_id} and credential_id: {credential_id}: {message}")]
+    ShareByDeviceLoadError {
+        message: String,
+        device_id: String,
+        credential_id: String,
+    },
+
+    #[error("could not find shares with id {id}")]
+    SharesByIdNotFound { id: i64 },
+
+    #[error("could not find shares with device_id {device_id} and credential_id: {credential_id}")]
+    SharesByDeviceNotFound {
+        device_id: String,
+        credential_id: String,
+    },
 }

 impl CredentialProxyError {
@@ -0,0 +1,67 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use rand::rngs::OsRng;
+use rand::RngCore;
+use time::OffsetDateTime;
+use tracing::{debug, info, warn};
+use uuid::Uuid;
+
+pub fn random_uuid() -> Uuid {
+    let mut bytes = [0u8; 16];
+    let mut rng = OsRng;
+    rng.fill_bytes(&mut bytes);
+    Uuid::from_bytes(bytes)
+}
+
+pub struct LockTimer {
+    created: OffsetDateTime,
+    message: String,
+}
+
+impl LockTimer {
+    pub fn new<S: Into<String>>(message: S) -> Self {
+        LockTimer {
+            message: message.into(),
+            ..Default::default()
+        }
+    }
+}
+
+impl Drop for LockTimer {
+    fn drop(&mut self) {
+        let time_taken = OffsetDateTime::now_utc() - self.created;
+        let time_taken_formatted = humantime::format_duration(time_taken.unsigned_abs());
+        if time_taken > time::Duration::SECOND * 10 {
+            warn!(time_taken = %time_taken_formatted, "{}", self.message)
+        } else if time_taken > time::Duration::SECOND * 5 {
+            info!(time_taken = %time_taken_formatted, "{}", self.message)
+        } else {
+            debug!(time_taken = %time_taken_formatted, "{}", self.message)
+        };
+    }
+}
+
+impl Default for LockTimer {
+    fn default() -> Self {
+        LockTimer {
+            created: OffsetDateTime::now_utc(),
+            message: "released the lock".to_string(),
+        }
+    }
+}
+
+// #[allow(clippy::panic)]
+// fn build_sha_short() -> &'static str {
+//     let bin_info = bin_info!();
+//     if bin_info.commit_sha.len() < 7 {
+//         panic!("unavailable build commit sha")
+//     }
+//
+//     if bin_info.commit_sha == "VERGEN_IDEMPOTENT_OUTPUT" {
+//         error!("the binary hasn't been built correctly. it doesn't have a commit sha information");
+//         return "unknown";
+//     }
+//
+//     &bin_info.commit_sha[..7]
+// }
@@ -1,11 +1,12 @@
-// Copyright 2024 Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

 use crate::error::CredentialProxyError;
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
 use axum::Json;
 use nym_credential_proxy_requests::api::v1::ErrorResponse;
+use tracing::warn;
 use uuid::Uuid;

 #[derive(Debug, Clone)]
@@ -35,6 +36,10 @@ impl RequestError {
        }
    }

+    pub fn new_plain_error(err: CredentialProxyError) -> Self {
+        Self::from_err(err, StatusCode::INTERNAL_SERVER_ERROR)
+    }
+
    pub fn new_server_error(err: CredentialProxyError, uuid: Uuid) -> Self {
        RequestError::new_with_uuid(err.to_string(), uuid, StatusCode::INTERNAL_SERVER_ERROR)
    }
@@ -59,3 +64,12 @@ impl IntoResponse for RequestError {
        (self.status, Json(self.inner)).into_response()
    }
 }
+
+pub fn db_failure<T>(err: CredentialProxyError, uuid: Uuid) -> Result<T, RequestError> {
+    warn!("db failure: {err}");
+    Err(RequestError::new_with_uuid(
+        format!("oh no, something went wrong {err}"),
+        uuid,
+        StatusCode::INTERNAL_SERVER_ERROR,
+    ))
+}
@@ -0,0 +1,13 @@
+// Copyright 2025 Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+pub mod deposits_buffer;
+pub mod error;
+pub mod helpers;
+pub mod http_helpers;
+pub mod nym_api_helpers;
+pub mod quorum_checker;
+pub mod shared_state;
+pub mod storage;
+pub mod ticketbook_manager;
+pub mod webhook;
@@ -19,9 +19,9 @@ use time::{Date, OffsetDateTime};
 use tokio::sync::{Mutex, RwLock, RwLockReadGuard};
 use tracing::warn;

-pub(crate) struct CachedEpoch {
+pub struct CachedEpoch {
    valid_until: OffsetDateTime,
-    pub(crate) current_epoch: Epoch,
+    pub current_epoch: Epoch,
 }

 impl Default for CachedEpoch {
@@ -34,11 +34,11 @@ impl Default for CachedEpoch {
 }

 impl CachedEpoch {
-    pub(crate) fn is_valid(&self) -> bool {
+    pub fn is_valid(&self) -> bool {
        self.valid_until > OffsetDateTime::now_utc()
    }

-    pub(crate) fn update(&mut self, epoch: Epoch) {
+    pub fn update(&mut self, epoch: Epoch) {
        let now = OffsetDateTime::now_utc();

        let validity_duration = if let Some(epoch_finish) = epoch.deadline {
@@ -58,13 +58,13 @@ impl CachedEpoch {
 }

 // a map of items that never change for given key
-pub(crate) struct CachedImmutableItems<K, V> {
+pub struct CachedImmutableItems<K, V> {
    // I wonder if there's a more efficient structure with OnceLock or OnceCell or something
    inner: RwLock<HashMap<K, V>>,
 }

 // an item that stays constant throughout given epoch
-pub(crate) type CachedImmutableEpochItem<T> = CachedImmutableItems<EpochId, T>;
+pub type CachedImmutableEpochItem<T> = CachedImmutableItems<EpochId, T>;

 impl<K, V> Default for CachedImmutableItems<K, V> {
    fn default() -> Self {
@@ -86,11 +86,7 @@ impl<K, V> CachedImmutableItems<K, V>
 where
    K: Eq + Hash,
 {
-    pub(crate) async fn get_or_init<F, U, E>(
-        &self,
-        key: K,
-        f: F,
-    ) -> Result<RwLockReadGuard<'_, V>, E>
+    pub async fn get_or_init<F, U, E>(&self, key: K, f: F) -> Result<RwLockReadGuard<'_, V>, E>
    where
        F: FnOnce() -> U,
        U: Future<Output = Result<V, E>>,
@@ -129,9 +125,7 @@ where
    }
 }

-pub(crate) fn ensure_sane_expiration_date(
-    expiration_date: Date,
-) -> Result<(), CredentialProxyError> {
+pub fn ensure_sane_expiration_date(expiration_date: Date) -> Result<(), CredentialProxyError> {
    let today = ecash_today();

    if expiration_date < today.date() {
@@ -146,7 +140,7 @@ pub(crate) fn ensure_sane_expiration_date(
    Ok(())
 }

-pub(crate) async fn query_all_threshold_apis<F, T, U>(
+pub async fn query_all_threshold_apis<F, T, U>(
    all_apis: Vec<EcashApiClient>,
    threshold: u64,
    f: F,
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use crate::error::CredentialProxyError;
-use crate::http::state::ChainClient;
+use crate::shared_state::nyxd_client::ChainClient;
 use nym_ecash_signer_check::{check_known_dealers, dkg_details_with_client};
 use std::ops::Deref;
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -12,17 +12,17 @@ use tokio_util::sync::CancellationToken;
 use tracing::{error, info, warn};

 #[derive(Clone)]
-pub(crate) struct QuorumState {
+pub struct QuorumState {
    available: Arc<AtomicBool>,
 }

 impl QuorumState {
-    pub(crate) fn available(&self) -> bool {
+    pub fn available(&self) -> bool {
        self.available.load(Ordering::Acquire)
    }
 }

-pub(crate) struct QuorumStateChecker {
+pub struct QuorumStateChecker {
    client: ChainClient,
    cancellation_token: CancellationToken,
    check_interval: Duration,
@@ -0,0 +1,49 @@
+// Copyright 2025 Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::nym_api_helpers::{CachedEpoch, CachedImmutableEpochItem, CachedImmutableItems};
+use crate::quorum_checker::QuorumState;
+use crate::shared_state::required_deposit_cache::RequiredDepositCache;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::{AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures};
+use nym_validator_client::nym_api::EpochId;
+use nym_validator_client::EcashApiClient;
+use time::Date;
+use tokio::sync::RwLock;
+
+pub struct EcashState {
+    pub required_deposit_cache: RequiredDepositCache,
+
+    pub quorum_state: QuorumState,
+
+    pub cached_epoch: RwLock<CachedEpoch>,
+
+    pub master_verification_key: CachedImmutableEpochItem<VerificationKeyAuth>,
+
+    pub threshold_values: CachedImmutableEpochItem<u64>,
+
+    pub epoch_clients: CachedImmutableEpochItem<Vec<EcashApiClient>>,
+
+    pub coin_index_signatures: CachedImmutableEpochItem<AggregatedCoinIndicesSignatures>,
+
+    pub expiration_date_signatures:
+        CachedImmutableItems<(EpochId, Date), AggregatedExpirationDateSignatures>,
+}
+
+impl EcashState {
+    pub fn new(
+        required_deposit_cache: RequiredDepositCache,
+        quorum_state: QuorumState,
+    ) -> EcashState {
+        EcashState {
+            required_deposit_cache,
+            quorum_state,
+            cached_epoch: Default::default(),
+            master_verification_key: Default::default(),
+            threshold_values: Default::default(),
+            epoch_clients: Default::default(),
+            coin_index_signatures: Default::default(),
+            expiration_date_signatures: Default::default(),
+        }
+    }
+}
@@ -0,0 +1,495 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::deposits_buffer::{BufferedDeposit, DepositsBuffer};
+use crate::error::CredentialProxyError;
+use crate::nym_api_helpers::{ensure_sane_expiration_date, query_all_threshold_apis};
+use crate::shared_state::ecash_state::EcashState;
+use crate::shared_state::nyxd_client::ChainClient;
+use crate::storage::CredentialProxyStorage;
+use nym_compact_ecash::scheme::coin_indices_signatures::{
+    aggregate_annotated_indices_signatures, CoinIndexSignatureShare,
+};
+use nym_compact_ecash::scheme::expiration_date_signatures::{
+    aggregate_annotated_expiration_signatures, ExpirationDateSignatureShare,
+};
+use nym_compact_ecash::{Base58, PublicKeyUser, VerificationKeyAuth};
+use nym_credential_proxy_requests::api::v1::ticketbook::models::{
+    AggregatedCoinIndicesSignaturesResponse, AggregatedExpirationDateSignaturesResponse,
+    GlobalDataParams, MasterVerificationKeyResponse,
+};
+use nym_credentials::ecash::utils::EcashTime;
+use nym_credentials::{
+    AggregatedCoinIndicesSignatures, AggregatedExpirationDateSignatures, EpochVerificationKey,
+};
+use nym_ecash_contract_common::deposit::DepositId;
+use nym_validator_client::coconut::EcashApiError;
+use nym_validator_client::nym_api::EpochId;
+use nym_validator_client::nyxd::contract_traits::dkg_query_client::Epoch;
+use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
+use nym_validator_client::nyxd::Coin;
+use nym_validator_client::{DirectSigningHttpRpcNyxdClient, EcashApiClient};
+use std::sync::Arc;
+use std::time::Duration;
+use time::{Date, OffsetDateTime};
+use tokio::sync::RwLockReadGuard;
+use tokio::time::Instant;
+use tracing::{debug, error, info, warn};
+use uuid::Uuid;
+
+pub mod ecash_state;
+pub mod nyxd_client;
+pub mod required_deposit_cache;
+
+#[derive(Clone)]
+pub struct CredentialProxyState {
+    inner: Arc<CredentialProxyStateInner>,
+}
+
+impl CredentialProxyState {
+    pub fn new(
+        storage: CredentialProxyStorage,
+        client: ChainClient,
+        deposits_buffer: DepositsBuffer,
+        ecash_state: EcashState,
+    ) -> Self {
+        CredentialProxyState {
+            inner: Arc::new(CredentialProxyStateInner {
+                storage,
+                client,
+                deposits_buffer,
+                ecash_state,
+            }),
+        }
+    }
+
+    pub fn storage(&self) -> &CredentialProxyStorage {
+        &self.inner.storage
+    }
+
+    pub async fn deposit_amount(&self) -> Result<Coin, CredentialProxyError> {
+        self.ecash_state()
+            .required_deposit_cache
+            .get_or_update(self.client())
+            .await
+    }
+
+    pub fn client(&self) -> &ChainClient {
+        &self.inner.client
+    }
+
+    pub fn deposits_buffer(&self) -> &DepositsBuffer {
+        &self.inner.deposits_buffer
+    }
+
+    pub fn ecash_state(&self) -> &EcashState {
+        &self.inner.ecash_state
+    }
+
+    pub(crate) async fn query_chain(&self) -> RwLockReadGuard<'_, DirectSigningHttpRpcNyxdClient> {
+        self.inner.client.query_chain().await
+    }
+
+    pub async fn ensure_credentials_issuable(&self) -> Result<(), CredentialProxyError> {
+        let epoch = self.current_epoch().await?;
+
+        if epoch.state.is_final() {
+            Ok(())
+        } else if let Some(final_timestamp) = epoch.final_timestamp_secs() {
+            // SAFETY: the timestamp values in our DKG contract should be valid timestamps,
+            // otherwise it means the chain is seriously misbehaving
+            #[allow(clippy::unwrap_used)]
+            let finish_dt = OffsetDateTime::from_unix_timestamp(final_timestamp as i64).unwrap();
+
+            Err(CredentialProxyError::CredentialsNotYetIssuable {
+                availability: finish_dt,
+            })
+        } else if epoch.state.is_waiting_initialisation() {
+            Err(CredentialProxyError::UninitialisedDkg)
+        } else {
+            Err(CredentialProxyError::UnknownEcashFailure)
+        }
+    }
+
+    pub async fn get_deposit(
+        &self,
+        request_uuid: Uuid,
+        requested_on: OffsetDateTime,
+        client_pubkey: PublicKeyUser,
+    ) -> Result<BufferedDeposit, CredentialProxyError> {
+        let start = Instant::now();
+        let deposit = self
+            .deposits_buffer()
+            .get_valid_deposit(request_uuid, requested_on, client_pubkey)
+            .await;
+
+        let time_taken = start.elapsed();
+        let formatted = humantime::format_duration(time_taken);
+        if time_taken > Duration::from_secs(10) {
+            warn!("attempting to get buffered deposit took {formatted}. perhaps the buffer is too small or the process/chain is overloaded?")
+        } else {
+            debug!("attempting to get buffered deposit took {formatted}")
+        };
+
+        deposit
+    }
+
+    pub async fn insert_deposit_usage_error(&self, deposit_id: DepositId, error: String) {
+        if let Err(err) = self
+            .storage()
+            .insert_deposit_usage_error(deposit_id, error)
+            .await
+        {
+            error!("failed to insert information about deposit (id: {deposit_id}) usage failure: {err}")
+        }
+    }
+
+    pub async fn current_epoch_id(&self) -> Result<EpochId, CredentialProxyError> {
+        let read_guard = self.inner.ecash_state.cached_epoch.read().await;
+        if read_guard.is_valid() {
+            return Ok(read_guard.current_epoch.epoch_id);
+        }
+
+        // update cache
+        drop(read_guard);
+        let mut write_guard = self.inner.ecash_state.cached_epoch.write().await;
+        let epoch = self.query_chain().await.get_current_epoch().await?;
+
+        write_guard.update(epoch);
+        Ok(epoch.epoch_id)
+    }
+
+    pub async fn current_epoch(&self) -> Result<Epoch, CredentialProxyError> {
+        let read_guard = self.ecash_state().cached_epoch.read().await;
+        if read_guard.is_valid() {
+            return Ok(read_guard.current_epoch);
+        }
+
+        // update cache
+        drop(read_guard);
+        let mut write_guard = self.ecash_state().cached_epoch.write().await;
+        let epoch = self.query_chain().await.get_current_epoch().await?;
+
+        write_guard.update(epoch);
+        Ok(epoch)
+    }
+
+    pub async fn global_data(
+        &self,
+        global_data: GlobalDataParams,
+        epoch_id: EpochId,
+        expiration_date: Date,
+    ) -> Result<
+        (
+            Option<MasterVerificationKeyResponse>,
+            Option<AggregatedExpirationDateSignaturesResponse>,
+            Option<AggregatedCoinIndicesSignaturesResponse>,
+        ),
+        CredentialProxyError,
+    > {
+        let master_verification_key = if global_data.include_master_verification_key {
+            debug!("including master verification key in the response");
+            Some(
+                self.master_verification_key(Some(epoch_id))
+                    .await
+                    .map(|key| MasterVerificationKeyResponse {
+                        epoch_id,
+                        bs58_encoded_key: key.to_bs58(),
+                    })
+                    .inspect_err(|err| warn!("request failure: {err}"))?,
+            )
+        } else {
+            None
+        };
+
+        let aggregated_expiration_date_signatures =
+            if global_data.include_expiration_date_signatures {
+                debug!("including expiration date signatures in the response");
+                Some(
+                    self.master_expiration_date_signatures(epoch_id, expiration_date)
+                        .await
+                        .map(|signatures| AggregatedExpirationDateSignaturesResponse {
+                            signatures: signatures.clone(),
+                        })
+                        .inspect_err(|err| warn!("request failure: {err}"))?,
+                )
+            } else {
+                None
+            };
+
+        let aggregated_coin_index_signatures = if global_data.include_coin_index_signatures {
+            debug!("including coin index signatures in the response");
+            Some(
+                self.master_coin_index_signatures(Some(epoch_id))
+                    .await
+                    .map(|signatures| AggregatedCoinIndicesSignaturesResponse {
+                        signatures: signatures.clone(),
+                    })
+                    .inspect_err(|err| warn!("request failure: {err}"))?,
+            )
+        } else {
+            None
+        };
+
+        Ok((
+            master_verification_key,
+            aggregated_expiration_date_signatures,
+            aggregated_coin_index_signatures,
+        ))
+    }
+
+    pub async fn master_verification_key(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<RwLockReadGuard<'_, VerificationKeyAuth>, CredentialProxyError> {
+        let epoch_id = match epoch_id {
+            Some(id) => id,
+            None => self.current_epoch_id().await?,
+        };
+
+        self.inner
+            .ecash_state
+            .master_verification_key
+            .get_or_init(epoch_id, || async {
+                // 1. check the storage
+                if let Some(stored) = self
+                    .inner
+                    .storage
+                    .get_master_verification_key(epoch_id)
+                    .await?
+                {
+                    return Ok(stored.key);
+                }
+
+                info!("attempting to establish master verification key for epoch {epoch_id}...");
+
+                // 2. perform actual aggregation
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                if all_apis.len() < threshold as usize {
+                    return Err(CredentialProxyError::InsufficientNumberOfSigners {
+                        threshold,
+                        available: all_apis.len(),
+                    });
+                }
+
+                let master_key = nym_credentials::aggregate_verification_keys(&all_apis)?;
+
+                let epoch = EpochVerificationKey {
+                    epoch_id,
+                    key: master_key,
+                };
+
+                // 3. save the key in the storage for when we reboot
+                self.inner
+                    .storage
+                    .insert_master_verification_key(&epoch)
+                    .await?;
+
+                Ok(epoch.key)
+            })
+            .await
+    }
+
+    pub async fn master_coin_index_signatures(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<RwLockReadGuard<'_, AggregatedCoinIndicesSignatures>, CredentialProxyError> {
+        let epoch_id = match epoch_id {
+            Some(id) => id,
+            None => self.current_epoch_id().await?,
+        };
+
+        self.inner
+            .ecash_state
+            .coin_index_signatures
+            .get_or_init(epoch_id, || async {
+                // 1. check the storage
+                if let Some(master_sigs) = self
+                    .inner
+                    .storage
+                    .get_master_coin_index_signatures(epoch_id)
+                    .await?
+                {
+                    return Ok(master_sigs);
+                }
+
+                info!(
+                    "attempting to establish master coin index signatures for epoch {epoch_id}..."
+                );
+
+                // 2. go around APIs and attempt to aggregate the data
+                let master_vk = self.master_verification_key(Some(epoch_id)).await?;
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                let get_partial_signatures = |api: EcashApiClient| async {
+                    // move the api into the closure
+                    let api = api;
+                    let node_index = api.node_id;
+                    let partial_vk = api.verification_key;
+
+                    let partial = api
+                        .api_client
+                        .partial_coin_indices_signatures(Some(epoch_id))
+                        .await?
+                        .signatures;
+                    Ok(CoinIndexSignatureShare {
+                        index: node_index,
+                        key: partial_vk,
+                        signatures: partial,
+                    })
+                };
+
+                let shares =
+                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
+                        .await?;
+
+                let aggregated = aggregate_annotated_indices_signatures(
+                    nym_credentials_interface::ecash_parameters(),
+                    &master_vk,
+                    &shares,
+                )?;
+
+                let sigs = AggregatedCoinIndicesSignatures {
+                    epoch_id,
+                    signatures: aggregated,
+                };
+
+                // 3. save the signatures in the storage for when we reboot
+                self.inner
+                    .storage
+                    .insert_master_coin_index_signatures(&sigs)
+                    .await?;
+
+                Ok(sigs)
+            })
+            .await
+    }
+
+    pub async fn master_expiration_date_signatures(
+        &self,
+        epoch_id: EpochId,
+        expiration_date: Date,
+    ) -> Result<RwLockReadGuard<'_, AggregatedExpirationDateSignatures>, CredentialProxyError> {
+        self.inner.ecash_state
+            .expiration_date_signatures
+            .get_or_init((epoch_id, expiration_date), || async {
+                // 1. sanity check to see if the expiration_date is not nonsense
+                ensure_sane_expiration_date(expiration_date)?;
+
+                // 2. check the storage
+                if let Some(master_sigs) = self
+                    .storage()
+                    .get_master_expiration_date_signatures(expiration_date, epoch_id)
+                    .await?
+                {
+                    return Ok(master_sigs);
+                }
+
+
+                info!(
+                    "attempting to establish master expiration date signatures for {expiration_date} and epoch {epoch_id}..."
+                );
+
+                // 3. go around APIs and attempt to aggregate the data
+                let epoch_id = self.current_epoch_id().await?;
+                let master_vk = self.master_verification_key(Some(epoch_id)).await?;
+                let all_apis = self.ecash_clients(epoch_id).await?;
+                let threshold = self.ecash_threshold(epoch_id).await?;
+
+                let get_partial_signatures = |api: EcashApiClient| async {
+                    // move the api into the closure
+                    let api = api;
+                    let node_index = api.node_id;
+                    let partial_vk = api.verification_key;
+
+                    let partial = api
+                        .api_client
+                        .partial_expiration_date_signatures(Some(expiration_date), Some(epoch_id))
+                        .await?
+                        .signatures;
+                    Ok(ExpirationDateSignatureShare {
+                        index: node_index,
+                        key: partial_vk,
+                        signatures: partial,
+                    })
+                };
+
+                let shares =
+                    query_all_threshold_apis(all_apis.clone(), threshold, get_partial_signatures)
+                        .await?;
+
+                let aggregated = aggregate_annotated_expiration_signatures(
+                    &master_vk,
+                    expiration_date.ecash_unix_timestamp(),
+                    &shares,
+                )?;
+
+                let sigs = AggregatedExpirationDateSignatures {
+                    epoch_id,
+                    expiration_date,
+                    signatures: aggregated,
+                };
+
+                // 4. save the signatures in the storage for when we reboot
+                self.inner.storage
+                    .insert_master_expiration_date_signatures(&sigs)
+                    .await?;
+
+                Ok(sigs)
+            })
+            .await
+    }
+
+    pub async fn ecash_clients(
+        &self,
+        epoch_id: EpochId,
+    ) -> Result<RwLockReadGuard<'_, Vec<EcashApiClient>>, CredentialProxyError> {
+        self.inner
+            .ecash_state
+            .epoch_clients
+            .get_or_init(epoch_id, || async {
+                Ok(self
+                    .query_chain()
+                    .await
+                    .get_all_verification_key_shares(epoch_id)
+                    .await?
+                    .into_iter()
+                    .map(TryInto::try_into)
+                    .collect::<anyhow::Result<Vec<_>, EcashApiError>>()?)
+            })
+            .await
+    }
+
+    pub async fn ecash_threshold(&self, epoch_id: EpochId) -> Result<u64, CredentialProxyError> {
+        self.inner
+            .ecash_state
+            .threshold_values
+            .get_or_init(epoch_id, || async {
+                if let Some(threshold) = self
+                    .query_chain()
+                    .await
+                    .get_epoch_threshold(epoch_id)
+                    .await?
+                {
+                    Ok(threshold)
+                } else {
+                    Err(CredentialProxyError::UnavailableThreshold { epoch_id })
+                }
+            })
+            .await
+            .map(|t| *t)
+    }
+}
+
+struct CredentialProxyStateInner {
+    storage: CredentialProxyStorage,
+
+    client: ChainClient,
+
+    deposits_buffer: DepositsBuffer,
+
+    ecash_state: EcashState,
+}
@@ -0,0 +1,126 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::CredentialProxyError;
+use crate::helpers::LockTimer;
+use nym_ecash_contract_common::msg::ExecuteMsg;
+use nym_validator_client::nyxd::contract_traits::NymContractsProvider;
+use nym_validator_client::nyxd::cosmwasm_client::types::ExecuteResult;
+use nym_validator_client::nyxd::{Coin, CosmWasmClient, NyxdClient};
+use nym_validator_client::{nyxd, DirectSigningHttpRpcNyxdClient};
+use std::ops::Deref;
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::sync::{RwLock, RwLockReadGuard, RwLockWriteGuard};
+use tracing::{instrument, warn};
+
+#[derive(Clone)]
+pub struct ChainClient(Arc<RwLock<DirectSigningHttpRpcNyxdClient>>);
+
+impl ChainClient {
+    pub fn new(mnemonic: bip39::Mnemonic) -> Result<Self, CredentialProxyError> {
+        let network_details = nym_network_defaults::NymNetworkDetails::new_from_env();
+        let client_config = nyxd::Config::try_from_nym_network_details(&network_details)?;
+
+        let nyxd_url = network_details
+            .endpoints
+            .first()
+            .ok_or_else(|| CredentialProxyError::NoNyxEndpointsAvailable)?
+            .nyxd_url
+            .as_str();
+
+        let client = NyxdClient::connect_with_mnemonic(client_config, nyxd_url, mnemonic)?;
+
+        if client.ecash_contract_address().is_none() {
+            return Err(CredentialProxyError::UnavailableEcashContract);
+        }
+
+        if client.dkg_contract_address().is_none() {
+            return Err(CredentialProxyError::UnavailableDKGContract);
+        }
+
+        Ok(ChainClient(Arc::new(RwLock::new(client))))
+    }
+
+    pub async fn query_chain(&self) -> ChainReadPermit<'_> {
+        let _acquire_timer = LockTimer::new("acquire chain query permit");
+        self.0.read().await
+    }
+
+    pub async fn start_chain_tx(&self) -> ChainWritePermit<'_> {
+        let _acquire_timer = LockTimer::new("acquire exclusive chain write permit");
+
+        ChainWritePermit {
+            lock_timer: LockTimer::new("exclusive chain access permit"),
+            inner: self.0.write().await,
+        }
+    }
+}
+
+pub type ChainReadPermit<'a> = RwLockReadGuard<'a, DirectSigningHttpRpcNyxdClient>;
+
+// explicitly wrap the WriteGuard for extra information regarding time taken
+pub struct ChainWritePermit<'a> {
+    // it's not really dead, we only care about it being dropped
+    #[allow(dead_code)]
+    lock_timer: LockTimer,
+    inner: RwLockWriteGuard<'a, DirectSigningHttpRpcNyxdClient>,
+}
+
+impl ChainWritePermit<'_> {
+    #[instrument(skip(self, short_sha, info), err(Display))]
+    pub async fn make_deposits(
+        self,
+        short_sha: &'static str,
+        info: Vec<(String, Coin)>,
+    ) -> Result<ExecuteResult, CredentialProxyError> {
+        let address = self.inner.address();
+        let starting_sequence = self.inner.get_sequence(&address).await?.sequence;
+
+        let deposits = info.len();
+
+        let ecash_contract = self
+            .inner
+            .ecash_contract_address()
+            .ok_or(CredentialProxyError::UnavailableEcashContract)?;
+        let deposit_messages = info
+            .into_iter()
+            .map(|(identity_key, amount)| {
+                (
+                    ExecuteMsg::DepositTicketBookFunds { identity_key },
+                    vec![amount],
+                )
+            })
+            .collect::<Vec<_>>();
+
+        let res = self
+            .inner
+            .execute_multiple(
+                ecash_contract,
+                deposit_messages,
+                None,
+                format!("cp-{short_sha}: performing {deposits} deposits"),
+            )
+            .await?;
+
+        loop {
+            let updated_sequence = self.inner.get_sequence(&address).await?.sequence;
+
+            if updated_sequence > starting_sequence {
+                break;
+            }
+            warn!("wrong sequence number... waiting before releasing chain lock");
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+
+        Ok(res)
+    }
+}
+
+impl Deref for ChainWritePermit<'_> {
+    type Target = DirectSigningHttpRpcNyxdClient;
+
+    fn deref(&self) -> &Self::Target {
+        self.inner.deref()
+    }
+}
@@ -2,14 +2,14 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use crate::error::CredentialProxyError;
-use crate::http::state::ChainClient;
+use crate::shared_state::nyxd_client::ChainClient;
 use nym_validator_client::nyxd::contract_traits::EcashQueryClient;
 use nym_validator_client::nyxd::Coin;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::sync::RwLock;

-pub(crate) struct CachedDeposit {
+pub struct CachedDeposit {
    valid_until: OffsetDateTime,
    required_amount: Coin,
 }
@@ -40,12 +40,12 @@ impl Default for CachedDeposit {
 }

 #[derive(Clone, Default)]
-pub(crate) struct RequiredDepositCache {
+pub struct RequiredDepositCache {
    inner: Arc<RwLock<CachedDeposit>>,
 }

 impl RequiredDepositCache {
-    pub(crate) async fn get_or_update(
+    pub async fn get_or_update(
        &self,
        chain_client: &ChainClient,
    ) -> Result<Coin, CredentialProxyError> {
@@ -1,7 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only

-use crate::credentials::ticketbook::NodeId;
 use crate::deposits_buffer::helpers::{BufferedDeposit, PerformedDeposits};
 use crate::error::CredentialProxyError;
 use crate::storage::manager::SqliteStorageManager;
@@ -26,6 +25,10 @@ use uuid::Uuid;

 mod manager;
 pub mod models;
+pub(crate) mod pruner;
+
+// TODO: proper import
+type NodeId = u64;

 #[derive(Clone)]
 pub struct CredentialProxyStorage {
@@ -74,7 +77,7 @@ impl CredentialProxyStorage {
    }

    #[allow(dead_code)]
-    pub(crate) async fn load_blinded_shares_status_by_shares_id(
+    pub async fn load_blinded_shares_status_by_shares_id(
        &self,
        id: i64,
    ) -> Result<Option<BlindedShares>, CredentialProxyError> {
@@ -84,7 +87,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn load_wallet_shares_by_shares_id(
+    pub async fn load_wallet_shares_by_shares_id(
        &self,
        id: i64,
    ) -> Result<Vec<MinimalWalletShare>, CredentialProxyError> {
@@ -94,7 +97,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn load_shares_error_by_shares_id(
+    pub async fn load_shares_error_by_shares_id(
        &self,
        id: i64,
    ) -> Result<Option<String>, CredentialProxyError> {
@@ -105,7 +108,7 @@ impl CredentialProxyStorage {
    }

    #[allow(dead_code)]
-    pub(crate) async fn load_blinded_shares_status_by_device_and_credential_id(
+    pub async fn load_blinded_shares_status_by_device_and_credential_id(
        &self,
        device_id: &str,
        credential_id: &str,
@@ -116,7 +119,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn load_wallet_shares_by_device_and_credential_id(
+    pub async fn load_wallet_shares_by_device_and_credential_id(
        &self,
        device_id: &str,
        credential_id: &str,
@@ -127,7 +130,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn load_shares_error_by_device_and_credential_id(
+    pub async fn load_shares_error_by_device_and_credential_id(
        &self,
        device_id: &str,
        credential_id: &str,
@@ -138,7 +141,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn insert_new_pending_async_shares_request(
+    pub async fn insert_new_pending_async_shares_request(
        &self,
        request: Uuid,
        device_id: &str,
@@ -150,7 +153,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn update_pending_async_blinded_shares_issued(
+    pub async fn update_pending_async_blinded_shares_issued(
        &self,
        available_shares: usize,
        device_id: &str,
@@ -166,7 +169,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn update_pending_async_blinded_shares_error(
+    pub async fn update_pending_async_blinded_shares_error(
        &self,
        available_shares: usize,
        device_id: &str,
@@ -184,7 +187,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn prune_old_blinded_shares(&self) -> Result<(), CredentialProxyError> {
+    pub async fn prune_old_blinded_shares(&self) -> Result<(), CredentialProxyError> {
        let max_age = OffsetDateTime::now_utc() - time::Duration::days(31);

        self.storage_manager
@@ -199,7 +202,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn insert_new_deposits(
+    pub async fn insert_new_deposits(
        &self,
        deposits: &PerformedDeposits,
    ) -> Result<(), CredentialProxyError> {
@@ -211,9 +214,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn load_unused_deposits(
-        &self,
-    ) -> Result<Vec<BufferedDeposit>, CredentialProxyError> {
+    pub async fn load_unused_deposits(&self) -> Result<Vec<BufferedDeposit>, CredentialProxyError> {
        self.storage_manager
            .load_unused_deposits()
            .await?
@@ -222,7 +223,7 @@ impl CredentialProxyStorage {
            .collect()
    }

-    pub(crate) async fn insert_deposit_usage(
+    pub async fn insert_deposit_usage(
        &self,
        deposit_id: DepositId,
        requested_on: OffsetDateTime,
@@ -240,7 +241,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn insert_deposit_usage_error(
+    pub async fn insert_deposit_usage_error(
        &self,
        deposit_id: DepositId,
        error: String,
@@ -251,7 +252,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn insert_partial_wallet_share(
+    pub async fn insert_partial_wallet_share(
        &self,
        deposit_id: DepositId,
        epoch_id: EpochId,
@@ -291,7 +292,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn get_master_verification_key(
+    pub async fn get_master_verification_key(
        &self,
        epoch_id: EpochId,
    ) -> Result<Option<EpochVerificationKey>, CredentialProxyError> {
@@ -309,7 +310,7 @@ impl CredentialProxyStorage {
        Ok(Some(deserialised))
    }

-    pub(crate) async fn insert_master_verification_key(
+    pub async fn insert_master_verification_key(
        &self,
        key: &EpochVerificationKey,
    ) -> Result<(), CredentialProxyError> {
@@ -320,7 +321,7 @@ impl CredentialProxyStorage {
            .await?)
    }

-    pub(crate) async fn get_master_coin_index_signatures(
+    pub async fn get_master_coin_index_signatures(
        &self,
        epoch_id: EpochId,
    ) -> Result<Option<AggregatedCoinIndicesSignatures>, CredentialProxyError> {
@@ -340,7 +341,7 @@ impl CredentialProxyStorage {
        Ok(Some(deserialised))
    }

-    pub(crate) async fn insert_master_coin_index_signatures(
+    pub async fn insert_master_coin_index_signatures(
        &self,
        signatures: &AggregatedCoinIndicesSignatures,
    ) -> Result<(), CredentialProxyError> {
@@ -355,7 +356,7 @@ impl CredentialProxyStorage {
        Ok(())
    }

-    pub(crate) async fn get_master_expiration_date_signatures(
+    pub async fn get_master_expiration_date_signatures(
        &self,
        expiration_date: Date,
        epoch_id: EpochId,
@@ -376,7 +377,7 @@ impl CredentialProxyStorage {
        Ok(Some(deserialised))
    }

-    pub(crate) async fn insert_master_expiration_date_signatures(
+    pub async fn insert_master_expiration_date_signatures(
        &self,
        signatures: &AggregatedExpirationDateSignatures,
    ) -> Result<(), CredentialProxyError> {
@@ -398,7 +399,7 @@ impl CredentialProxyStorage {
 #[cfg(test)]
 mod tests {
    use super::*;
-    use crate::http::helpers;
+    use crate::helpers::random_uuid;
    use crate::storage::models::BlindedSharesStatus;
    use nym_compact_ecash::scheme::keygen::KeyPairUser;
    use nym_crypto::asymmetric::ed25519;
@@ -480,7 +481,7 @@ mod tests {
    async fn test_add() -> anyhow::Result<()> {
        let storage = get_storage().await?;

-        let dummy_uuid = helpers::random_uuid();
+        let dummy_uuid = random_uuid();
        println!("🚀 insert_pending_blinded_share...");

        storage.insert_dummy_used_deposit(dummy_uuid).await?;
@@ -1,5 +1,5 @@
-// Copyright 2024 Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

 use crate::storage::CredentialProxyStorage;
 use tokio_util::sync::CancellationToken;
@@ -0,0 +1,163 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::deposits_buffer::DepositsBuffer;
+use crate::error::CredentialProxyError;
+use crate::quorum_checker::QuorumStateChecker;
+use crate::shared_state::ecash_state::EcashState;
+use crate::shared_state::nyxd_client::ChainClient;
+use crate::shared_state::required_deposit_cache::RequiredDepositCache;
+use crate::shared_state::CredentialProxyState;
+use crate::storage::pruner::StoragePruner;
+use crate::storage::CredentialProxyStorage;
+use crate::webhook::ZkNymWebhook;
+use nym_credentials::ecash::utils::ecash_today;
+use nym_validator_client::nym_api::EpochId;
+use std::future::Future;
+use std::time::Duration;
+use time::Date;
+use tokio::task::JoinHandle;
+use tokio_util::sync::CancellationToken;
+use tokio_util::task::TaskTracker;
+
+mod shares_handlers;
+pub mod ticketbook_handlers;
+pub mod wallet_shares;
+
+#[derive(Clone, Default)]
+pub struct ShutdownTracker {
+    pub shutdown_token: CancellationToken,
+    pub tracker: TaskTracker,
+}
+
+#[derive(Clone)]
+pub struct TicketbookManager {
+    pub(crate) state: CredentialProxyState,
+    pub(crate) webhook: ZkNymWebhook,
+    pub(crate) shutdown_tracker: ShutdownTracker,
+}
+
+impl TicketbookManager {
+    pub async fn new(
+        build_sha: &'static str,
+        quorum_check_interval: Duration,
+        deposits_buffer_size: usize,
+        max_concurrent_deposits: usize,
+        storage: CredentialProxyStorage,
+        mnemonic: bip39::Mnemonic,
+        webhook: ZkNymWebhook,
+    ) -> Result<Self, CredentialProxyError> {
+        let chain_client = ChainClient::new(mnemonic)?;
+        let shutdown_tracker = ShutdownTracker::default();
+
+        let quorum_state_checker = QuorumStateChecker::new(
+            chain_client.clone(),
+            quorum_check_interval,
+            shutdown_tracker.shutdown_token.clone(),
+        )
+        .await?;
+
+        let required_deposit_cache = RequiredDepositCache::default();
+
+        let deposits_buffer = DepositsBuffer::new(
+            storage.clone(),
+            chain_client.clone(),
+            required_deposit_cache.clone(),
+            build_sha,
+            deposits_buffer_size,
+            max_concurrent_deposits,
+            shutdown_tracker.shutdown_token.clone(),
+        )
+        .await?;
+
+        let storage_pruner =
+            StoragePruner::new(shutdown_tracker.shutdown_token.clone(), storage.clone());
+
+        let this = TicketbookManager {
+            state: CredentialProxyState::new(
+                storage.clone(),
+                chain_client,
+                deposits_buffer,
+                EcashState::new(
+                    required_deposit_cache,
+                    quorum_state_checker.quorum_state_ref(),
+                ),
+            ),
+            webhook,
+            shutdown_tracker,
+        };
+
+        // since this is startup,
+        // might as well do all the needed network queries to establish needed global signatures
+        // if we don't already have them
+        this.build_initial_cache().await?;
+
+        // spawn the background tasks
+        this.try_spawn_in_background(quorum_state_checker.run_forever());
+        this.try_spawn_in_background(storage_pruner.run_forever());
+
+        Ok(this)
+    }
+
+    async fn build_initial_cache(&self) -> Result<(), CredentialProxyError> {
+        let today = ecash_today().date();
+
+        let epoch_id = self.state.current_epoch_id().await?;
+        let _ = self.state.deposit_amount().await?;
+        let _ = self.state.master_verification_key(Some(epoch_id)).await?;
+        let _ = self.state.ecash_threshold(epoch_id).await?;
+        let _ = self.state.ecash_clients(epoch_id).await?;
+        let _ = self
+            .state
+            .master_coin_index_signatures(Some(epoch_id))
+            .await?;
+        let _ = self
+            .state
+            .master_expiration_date_signatures(epoch_id, today)
+            .await?;
+
+        Ok(())
+    }
+
+    pub async fn cancel_and_wait(&self) {
+        self.shutdown_tracker.shutdown_token.cancel();
+        self.state.deposits_buffer().wait_for_shutdown().await;
+        self.shutdown_tracker.tracker.wait().await
+    }
+
+    pub fn shutdown_token(&self) -> CancellationToken {
+        self.shutdown_tracker.shutdown_token.clone()
+    }
+
+    /// Ensure the required global data for the specified epoch and expiration date exists in our cache (and storage)
+    async fn ensure_global_data_cached(
+        &self,
+        epoch: EpochId,
+        expiration_date: Date,
+    ) -> Result<(), CredentialProxyError> {
+        let _ = self.state.master_verification_key(Some(epoch)).await?;
+        let _ = self.state.master_coin_index_signatures(Some(epoch)).await?;
+        let _ = self
+            .state
+            .master_expiration_date_signatures(epoch, expiration_date)
+            .await?;
+        Ok(())
+    }
+
+    pub fn try_spawn_in_background<F>(&self, task: F) -> Option<JoinHandle<F::Output>>
+    where
+        F: Future + Send + 'static,
+        F::Output: Send + 'static,
+    {
+        // don't spawn new task if we've received cancellation token
+        if self.shutdown_tracker.shutdown_token.is_cancelled() {
+            None
+        } else {
+            self.shutdown_tracker.tracker.reopen();
+            // TODO: later use a task queue since most requests will be blocked waiting on chain permit anyway
+            let join_handle = self.shutdown_tracker.tracker.spawn(task);
+            self.shutdown_tracker.tracker.close();
+            Some(join_handle)
+        }
+    }
+}
@@ -0,0 +1,145 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::CredentialProxyError;
+use crate::storage::models::MinimalWalletShare;
+use crate::ticketbook_manager::TicketbookManager;
+use nym_credential_proxy_requests::api::v1::ticketbook::models::{
+    GlobalDataParams, TicketbookWalletSharesResponse,
+};
+use nym_validator_client::nym_api::EpochId;
+use tracing::{debug, span, Instrument, Level};
+use uuid::Uuid;
+
+impl TicketbookManager {
+    async fn shares_to_response(
+        &self,
+        shares: Vec<MinimalWalletShare>,
+        params: GlobalDataParams,
+    ) -> Result<TicketbookWalletSharesResponse, CredentialProxyError> {
+        // in all calls we ensured the shares are non-empty
+        #[allow(clippy::unwrap_used)]
+        let first = shares.first().unwrap();
+        let expiration_date = first.expiration_date;
+        let epoch_id = first.epoch_id as EpochId;
+
+        let threshold = self.state.ecash_threshold(epoch_id).await?;
+        if shares.len() < threshold as usize {
+            return Err(CredentialProxyError::InsufficientNumberOfCredentials {
+                available: shares.len(),
+                threshold,
+            });
+        }
+
+        // grab any requested additional data
+        let (
+            master_verification_key,
+            aggregated_expiration_date_signatures,
+            aggregated_coin_index_signatures,
+        ) = self
+            .state
+            .global_data(params, epoch_id, expiration_date)
+            .await?;
+
+        // finally produce a response
+        Ok(TicketbookWalletSharesResponse {
+            epoch_id,
+            shares: shares.into_iter().map(Into::into).collect(),
+            master_verification_key,
+            aggregated_coin_index_signatures,
+            aggregated_expiration_date_signatures,
+        })
+    }
+
+    /// Query by id for blinded shares of a bandwidth voucher
+    pub async fn query_for_shares_by_id(
+        &self,
+        uuid: Uuid,
+        params: GlobalDataParams,
+        share_id: i64,
+    ) -> Result<TicketbookWalletSharesResponse, CredentialProxyError> {
+        let span = span!(Level::INFO, "query shares by id", uuid = %uuid, share_id = %share_id);
+        async move {
+            debug!("");
+
+            // TODO: edge case: this will **NOT** work if shares got created in epoch X,
+            // but this query happened in epoch X+1
+            let shares = self
+                .state
+                .storage()
+                .load_wallet_shares_by_shares_id(share_id)
+                .await?;
+            if shares.is_empty() {
+                debug!("shares not found");
+
+                // check for explicit error
+                if let Some(error_message) = self
+                    .state
+                    .storage()
+                    .load_shares_error_by_shares_id(share_id)
+                    .await?
+                {
+                    return Err(CredentialProxyError::ShareByIdLoadError {
+                        message: error_message,
+                        id: share_id,
+                    });
+                }
+
+                return Err(CredentialProxyError::SharesByIdNotFound { id: share_id });
+            }
+
+            self.shares_to_response(shares, params).await
+        }
+        .instrument(span)
+        .await
+    }
+
+    /// Query by id for blinded  wallet shares of a ticketbook
+    pub async fn query_for_shares_by_device_id_and_credential_id(
+        &self,
+        uuid: Uuid,
+        params: GlobalDataParams,
+        device_id: String,
+        credential_id: String,
+    ) -> Result<TicketbookWalletSharesResponse, CredentialProxyError> {
+        let span = span!(Level::INFO, "query shares by device and credential ids", uuid = %uuid, device_id = %device_id, credential_id = %credential_id);
+        async move {
+            debug!("");
+
+            // TODO: edge case: this will **NOT** work if shares got created in epoch X,
+            // but this query happened in epoch X+1
+            let shares = self
+                .state
+                .storage()
+                .load_wallet_shares_by_device_and_credential_id(&device_id, &credential_id)
+                .await?;
+
+            if shares.is_empty() {
+                debug!("shares not found");
+
+                // check for explicit error
+                if let Some(error_message) = self
+                    .state
+                    .storage()
+                    .load_shares_error_by_device_and_credential_id(&device_id, &credential_id)
+                    .await?
+                {
+                    return Err(CredentialProxyError::ShareByDeviceLoadError {
+                        message: error_message,
+                        device_id,
+                        credential_id,
+                    });
+                }
+
+                return Err(CredentialProxyError::SharesByDeviceNotFound {
+                    device_id,
+                    credential_id,
+                });
+            }
+
+            self.shares_to_response(shares, params).await
+        }
+        .instrument(span)
+        .await
+    }
+}
@@ -0,0 +1,164 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::CredentialProxyError;
+use crate::nym_api_helpers::ensure_sane_expiration_date;
+use crate::ticketbook_manager::TicketbookManager;
+use nym_compact_ecash::Base58;
+use nym_credential_proxy_requests::api::v1::ticketbook::models::{
+    CurrentEpochResponse, DepositResponse, GlobalDataParams, MasterVerificationKeyResponse,
+    PartialVerificationKey, PartialVerificationKeysResponse, TicketbookAsyncRequest,
+    TicketbookObtainParams, TicketbookRequest, TicketbookWalletSharesAsyncResponse,
+    TicketbookWalletSharesResponse,
+};
+use time::OffsetDateTime;
+use tracing::{error, info, span, warn, Instrument, Level};
+use uuid::Uuid;
+
+impl TicketbookManager {
+    pub async fn obtain_ticketbook_shares(
+        &self,
+        uuid: Uuid,
+        request: TicketbookRequest,
+        params: GlobalDataParams,
+    ) -> Result<TicketbookWalletSharesResponse, CredentialProxyError> {
+        let requested_on = OffsetDateTime::now_utc();
+        let span = span!(Level::INFO, "obtain ticketboook", uuid = %uuid);
+
+        async move {
+            info!("");
+
+            self.state.ensure_credentials_issuable().await?;
+            let epoch_id = self.state.current_epoch_id().await?;
+            ensure_sane_expiration_date(request.expiration_date)?;
+
+            // if additional data was requested, grab them first in case there are any cache/network issues
+            let (
+                master_verification_key,
+                aggregated_expiration_date_signatures,
+                aggregated_coin_index_signatures,
+            ) = self
+                .state
+                .global_data(params, epoch_id, request.expiration_date)
+                .await?;
+
+            let shares = self
+                .try_obtain_wallet_shares(uuid, requested_on, request)
+                .await
+                .inspect_err(|err| warn!("shares request failure: {err}"))?;
+
+            info!("request was successful!");
+            Ok(TicketbookWalletSharesResponse {
+                epoch_id,
+                shares,
+                master_verification_key,
+                aggregated_coin_index_signatures,
+                aggregated_expiration_date_signatures,
+            })
+        }
+        .instrument(span)
+        .await
+    }
+
+    pub async fn obtain_ticketbook_shares_async(
+        &self,
+        uuid: Uuid,
+        request: TicketbookAsyncRequest,
+        params: TicketbookObtainParams,
+    ) -> Result<TicketbookWalletSharesAsyncResponse, CredentialProxyError> {
+        let requested_on = OffsetDateTime::now_utc();
+        let span = span!(Level::INFO, "[async] obtain ticketboook", uuid = %uuid);
+        async move {
+            info!("");
+
+            // 1. perform basic validation
+            self.state.ensure_credentials_issuable().await?;
+
+            ensure_sane_expiration_date(request.inner.expiration_date)?;
+
+            // 2. store the request to retrieve the id
+            let pending = self
+                .state
+                .storage()
+                .insert_new_pending_async_shares_request(
+                    uuid,
+                    &request.device_id,
+                    &request.credential_id,
+                )
+                .await
+                .inspect_err(|err| error!("failed to insert new pending async shares: {err}"))?;
+
+            let id = pending.id;
+
+            // 3. try to spawn a new task attempting to resolve the request
+            let this = self.clone();
+            if self
+                .try_spawn_in_background(async move {
+                    this.try_obtain_blinded_ticketbook_async(
+                        uuid,
+                        requested_on,
+                        request,
+                        params,
+                        pending,
+                    )
+                    .await
+                })
+                .is_none()
+            {
+                warn!("could not start async ticketbook issuance due to shutdown in progress");
+                return Err(CredentialProxyError::ShutdownInProgress);
+            }
+
+            // 4. in the meantime, return the id to the user
+            Ok(TicketbookWalletSharesAsyncResponse { id, uuid })
+        }
+        .instrument(span)
+        .await
+    }
+
+    pub async fn current_deposit(&self) -> Result<DepositResponse, CredentialProxyError> {
+        let current_deposit = self.state.deposit_amount().await?;
+        Ok(DepositResponse {
+            current_deposit_amount: current_deposit.amount,
+            current_deposit_denom: current_deposit.denom,
+        })
+    }
+
+    pub async fn partial_verification_keys(
+        &self,
+    ) -> Result<PartialVerificationKeysResponse, CredentialProxyError> {
+        self.state.ensure_credentials_issuable().await?;
+
+        let epoch_id = self.state.current_epoch_id().await?;
+        let signers = self.state.ecash_clients(epoch_id).await?;
+        Ok(PartialVerificationKeysResponse {
+            epoch_id,
+            keys: signers
+                .iter()
+                .map(|signer| PartialVerificationKey {
+                    node_index: signer.node_id,
+                    bs58_encoded_key: signer.verification_key.to_bs58(),
+                })
+                .collect(),
+        })
+    }
+
+    pub async fn master_verification_key(
+        &self,
+    ) -> Result<MasterVerificationKeyResponse, CredentialProxyError> {
+        self.state.ensure_credentials_issuable().await?;
+
+        let epoch_id = self.state.current_epoch_id().await?;
+        let key = self.state.master_verification_key(Some(epoch_id)).await?;
+        Ok(MasterVerificationKeyResponse {
+            epoch_id,
+            bs58_encoded_key: key.to_bs58(),
+        })
+    }
+
+    pub async fn current_epoch(&self) -> Result<CurrentEpochResponse, CredentialProxyError> {
+        self.state.ensure_credentials_issuable().await?;
+        let epoch_id = self.state.current_epoch_id().await?;
+        Ok(CurrentEpochResponse { epoch_id })
+    }
+}
@@ -0,0 +1,343 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::CredentialProxyError;
+use crate::storage::models::BlindedShares;
+use crate::ticketbook_manager::TicketbookManager;
+use futures::{stream, StreamExt};
+use nym_compact_ecash::Base58;
+use nym_credential_proxy_requests::api::v1::ticketbook::models::{
+    TicketbookAsyncRequest, TicketbookObtainParams, TicketbookRequest,
+    TicketbookWalletSharesResponse, WalletShare, WebhookTicketbookWalletShares,
+    WebhookTicketbookWalletSharesRequest,
+};
+use nym_validator_client::ecash::BlindSignRequestBody;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+use time::OffsetDateTime;
+use tokio::sync::Mutex;
+use tokio::time::timeout;
+use tracing::{debug, error, info, instrument};
+use uuid::Uuid;
+
+impl TicketbookManager {
+    #[instrument(
+        skip(self, request_data, request, requested_on),
+            fields(
+                expiration_date = %request_data.expiration_date,
+                ticketbook_type = %request_data.ticketbook_type
+        )
+    )]
+    pub async fn try_obtain_wallet_shares(
+        &self,
+        request: Uuid,
+        requested_on: OffsetDateTime,
+        request_data: TicketbookRequest,
+    ) -> Result<Vec<WalletShare>, CredentialProxyError> {
+        // don't proceed if we don't have quorum available as the request will definitely fail
+        if !self.state.ecash_state().quorum_state.available() {
+            return Err(CredentialProxyError::UnavailableSigningQuorum);
+        }
+
+        let epoch = self.state.current_epoch_id().await?;
+        let threshold = self.state.ecash_threshold(epoch).await?;
+        let expiration_date = request_data.expiration_date;
+
+        // before we commit to making the deposit, ensure we have required signatures cached and stored
+        self.ensure_global_data_cached(epoch, expiration_date)
+            .await?;
+        let ecash_api_clients = self.state.ecash_clients(epoch).await?.clone();
+
+        let deposit_data = self
+            .state
+            .get_deposit(request, requested_on, request_data.ecash_pubkey)
+            .await?;
+        let deposit_id = deposit_data.deposit_id;
+        let signature = deposit_data.sign_ticketbook_plaintext(&request_data.withdrawal_request);
+
+        let credential_request = BlindSignRequestBody::new(
+            request_data.withdrawal_request.into(),
+            deposit_id,
+            signature,
+            request_data.ecash_pubkey,
+            request_data.expiration_date,
+            request_data.ticketbook_type,
+        );
+
+        let wallet_shares = Arc::new(Mutex::new(HashMap::new()));
+
+        info!("attempting to contract all nym-apis for the partial wallets...");
+        stream::iter(ecash_api_clients)
+            .for_each_concurrent(None, |client| async {
+                // move the client into the block
+                let client = client;
+
+                debug!("contacting {client} for blinded partial wallet");
+                let res = timeout(
+                    Duration::from_secs(5),
+                    client.api_client.blind_sign(&credential_request),
+                )
+                .await
+                .map_err(|_| CredentialProxyError::EcashApiRequestTimeout {
+                    client_repr: client.to_string(),
+                })
+                .and_then(|res| res.map_err(Into::into));
+
+                // 1. try to store it
+                if let Err(err) = self
+                    .state
+                    .storage()
+                    .insert_partial_wallet_share(
+                        deposit_id,
+                        epoch,
+                        expiration_date,
+                        client.node_id,
+                        &res,
+                    )
+                    .await
+                {
+                    error!("failed to persist issued partial share: {err}")
+                }
+
+                // 2. add it to the map
+                match res {
+                    Ok(share) => {
+                        wallet_shares
+                            .lock()
+                            .await
+                            .insert(client.node_id, share.blinded_signature);
+                    }
+                    Err(err) => {
+                        error!("failed to obtain partial blinded wallet share from {client}: {err}")
+                    }
+                }
+            })
+            .await;
+
+        // SAFETY: the futures have completed, so we MUST have the only arc reference
+        #[allow(clippy::unwrap_used)]
+        let wallet_shares = Arc::into_inner(wallet_shares).unwrap().into_inner();
+        let shares = wallet_shares.len();
+
+        if shares < threshold as usize {
+            let err = CredentialProxyError::InsufficientNumberOfCredentials {
+                available: shares,
+                threshold,
+            };
+            self.state
+                .insert_deposit_usage_error(deposit_id, err.to_string())
+                .await;
+            return Err(err);
+        }
+
+        Ok(wallet_shares
+            .into_iter()
+            .map(|(node_index, share)| WalletShare {
+                node_index,
+                bs58_encoded_share: share.to_bs58(),
+            })
+            .collect())
+    }
+
+    pub async fn try_obtain_wallet_shares_async(
+        &self,
+        request: Uuid,
+        requested_on: OffsetDateTime,
+        request_data: TicketbookRequest,
+        device_id: &str,
+        credential_id: &str,
+    ) -> Result<Vec<WalletShare>, CredentialProxyError> {
+        let shares = match self
+            .try_obtain_wallet_shares(request, requested_on, request_data)
+            .await
+        {
+            Ok(shares) => shares,
+            Err(err) => {
+                let obtained = match err {
+                    CredentialProxyError::InsufficientNumberOfCredentials { available, .. } => {
+                        available
+                    }
+                    _ => 0,
+                };
+
+                // currently there's no retry mechanisms, but, who knows, that might change
+                if let Err(err) = self
+                    .state
+                    .storage()
+                    .update_pending_async_blinded_shares_error(
+                        obtained,
+                        device_id,
+                        credential_id,
+                        &err.to_string(),
+                    )
+                    .await
+                {
+                    error!("failed to update database with the error information: {err}")
+                }
+                return Err(err);
+            }
+        };
+
+        Ok(shares)
+    }
+
+    async fn try_obtain_blinded_ticketbook_async_inner(
+        &self,
+        request: Uuid,
+        requested_on: OffsetDateTime,
+        request_data: TicketbookAsyncRequest,
+        params: TicketbookObtainParams,
+        pending: &BlindedShares,
+    ) -> Result<(), CredentialProxyError> {
+        let epoch_id = self.state.current_epoch_id().await?;
+
+        let device_id = &request_data.device_id;
+        let credential_id = &request_data.credential_id;
+        let secret = request_data.secret.clone();
+
+        // 1. try to obtain global data
+        let (
+            master_verification_key,
+            aggregated_expiration_date_signatures,
+            aggregated_coin_index_signatures,
+        ) = self
+            .state
+            .global_data(params.global, epoch_id, request_data.inner.expiration_date)
+            .await?;
+
+        // 2. try to obtain shares (failures are written to the DB)
+        let shares = self
+            .try_obtain_wallet_shares_async(
+                request,
+                requested_on,
+                request_data.inner,
+                device_id,
+                credential_id,
+            )
+            .await?;
+
+        // 3. update the storage, if possible
+        // (as long as we can trigger webhook, we should still be good)
+        if let Err(err) = self
+            .state
+            .storage()
+            .update_pending_async_blinded_shares_issued(shares.len(), device_id, credential_id)
+            .await
+        {
+            error!(uuid = %request, "failed to update db with issued information: {err}")
+        }
+
+        // 4. build the webhook request body
+        let data = Some(TicketbookWalletSharesResponse {
+            epoch_id,
+            shares,
+            master_verification_key,
+            aggregated_coin_index_signatures,
+            aggregated_expiration_date_signatures,
+        });
+
+        let ticketbook_wallet_shares = WebhookTicketbookWalletShares {
+            id: pending.id,
+            status: pending.status.to_string(),
+            device_id: device_id.clone(),
+            credential_id: credential_id.clone(),
+            data,
+            error_message: None,
+            created: pending.created,
+            updated: pending.updated,
+        };
+
+        let webhook_request = WebhookTicketbookWalletSharesRequest {
+            ticketbook_wallet_shares,
+            secret,
+        };
+
+        // 5. call the webhook
+        self.webhook.try_trigger(request, &webhook_request).await;
+
+        Ok(())
+    }
+
+    async fn try_trigger_webhook_request_for_error(
+        &self,
+        request: Uuid,
+        request_data: TicketbookAsyncRequest,
+        pending: &BlindedShares,
+        error_message: String,
+    ) -> Result<(), CredentialProxyError> {
+        let device_id = &request_data.device_id;
+        let credential_id = &request_data.credential_id;
+        let secret = request_data.secret.clone();
+
+        let ticketbook_wallet_shares = WebhookTicketbookWalletShares {
+            id: pending.id,
+            status: "error".to_string(),
+            device_id: device_id.clone(),
+            credential_id: credential_id.clone(),
+            data: None,
+            error_message: Some(error_message),
+            created: pending.created,
+            updated: pending.updated,
+        };
+
+        let webhook_request = WebhookTicketbookWalletSharesRequest {
+            ticketbook_wallet_shares,
+            secret,
+        };
+
+        self.webhook.try_trigger(request, &webhook_request).await;
+
+        Ok(())
+    }
+
+    #[instrument(
+        skip_all,
+        fields(
+            credential_id = %request_data.credential_id,
+            device_id = %request_data.device_id)
+        )
+    ]
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn try_obtain_blinded_ticketbook_async(
+        &self,
+        request: Uuid,
+        requested_on: OffsetDateTime,
+        request_data: TicketbookAsyncRequest,
+        params: TicketbookObtainParams,
+        pending: BlindedShares,
+    ) {
+        let skip_webhook = params.skip_webhook;
+        if let Err(err) = self
+            .try_obtain_blinded_ticketbook_async_inner(
+                request,
+                requested_on,
+                request_data.clone(),
+                params,
+                &pending,
+            )
+            .await
+        {
+            if skip_webhook {
+                info!(uuid = %request,"the webhook is not going to be called for this request");
+                return;
+            }
+
+            // post to the webhook to notify of errors on this side
+            if let Err(webhook_err) = self
+                .try_trigger_webhook_request_for_error(
+                    request,
+                    request_data,
+                    &pending,
+                    format!("Failed to get ticketbook: {err}"),
+                )
+                .await
+            {
+                error!(uuid = %request, "failed to make webhook request to report error: {webhook_err}")
+            }
+            error!(uuid = %request, "failed to resolve the blinded ticketbook issuance: {err}")
+        } else {
+            info!(uuid = %request, "managed to resolve the blinded ticketbook issuance")
+        }
+    }
+}
@@ -1,57 +1,34 @@
-// Copyright 2024 Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

-use crate::error::CredentialProxyError;
-use clap::Args;
 use reqwest::header::AUTHORIZATION;
 use serde::Serialize;
 use tracing::{debug, error, instrument, span, Instrument, Level};
 use url::Url;
 use uuid::Uuid;

-#[derive(Args, Debug, Clone)]
-pub struct ZkNymWebHookConfig {
-    #[clap(long, env = "WEBHOOK_ZK_NYMS_URL")]
-    pub webhook_url: Url,
+#[derive(Debug, Clone)]
+pub struct ZkNymWebhook {
+    pub webhook_client_url: Url,

-    #[clap(long, env = "WEBHOOK_ZK_NYMS_CLIENT_ID")]
-    pub webhook_client_id: String,
-
-    #[clap(long, env = "WEBHOOK_ZK_NYMS_CLIENT_SECRET")]
    pub webhook_client_secret: String,
 }

-impl ZkNymWebHookConfig {
-    pub fn ensure_valid_client_url(&self) -> Result<(), CredentialProxyError> {
-        self.client_url()
-            .map_err(|_| CredentialProxyError::InvalidWebhookUrl)
-            .map(|_| ())
-    }
-
-    fn client_url(&self) -> Result<Url, url::ParseError> {
-        self.webhook_url.join(&self.webhook_client_id)
-    }
-
-    fn unchecked_client_url(&self) -> Url {
-        // we ensured we have valid url on startup
-        #[allow(clippy::unwrap_used)]
-        self.client_url().unwrap()
-    }
-
+impl ZkNymWebhook {
    fn bearer_token(&self) -> String {
        format!("Bearer {}", self.webhook_client_secret)
    }

    #[instrument(skip_all)]
    pub async fn try_trigger<T: Serialize + ?Sized>(&self, original_uuid: Uuid, payload: &T) {
-        let url = self.unchecked_client_url();
+        let url = self.webhook_client_url.clone();
        let span = span!(Level::DEBUG, "webhook", uuid = %original_uuid, url = %url);

        async move {
            debug!("🕸️ about to trigger the webhook");

            match reqwest::Client::new()
-                .post(url.clone())
+                .post(url)
                .header(AUTHORIZATION, self.bearer_token())
                .json(payload)
                .send()
@@ -14,7 +14,7 @@ use nym_api_requests::ecash::models::{BatchRedeemTicketsBody, VerifyEcashTicketB
 use nym_credentials_interface::Bandwidth;
 use nym_credentials_interface::{ClientTicket, TicketType};
 use nym_validator_client::coconut::EcashApiError;
-use nym_validator_client::nym_api::{EpochId, NymApiClientExt};
+use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::{
    EcashSigningClient, MultisigQueryClient, MultisigSigningClient, PagedMultisigQueryClient,
 };
@@ -354,7 +354,7 @@ impl CredentialHandler {
            Err(err) => {
                error!("failed to send ticket {ticket_id} for verification to ecash signer '{client}': {err}. if we don't reach quorum, we'll retry later");
                Err(EcashTicketError::ApiFailure(EcashApiError::NymApi {
-                    source: nym_validator_client::ValidatorClientError::NymAPIError { source: err },
+                    source: err,
                }))
            }
        }
@@ -22,7 +22,6 @@ nym-ecash-time = { path = "../ecash-time", features = ["expiration"] }
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto" }
 nym-api-requests = { path = "../../nym-api/nym-api-requests" }
-nym-http-api-client = { path = "../http-api-client" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
 nym-network-defaults = { path = "../network-defaults" }
@@ -15,7 +15,7 @@ use nym_credentials_interface::{
 use nym_crypto::asymmetric::ed25519;
 use nym_ecash_contract_common::deposit::DepositId;
 use nym_ecash_time::{ecash_default_expiration_date, ecash_today, EcashTime};
-use nym_validator_client::nym_api::{EpochId, NymApiClientExt};
+use nym_validator_client::nym_api::EpochId;
 use serde::{Deserialize, Serialize};
 use time::Date;

@@ -116,7 +116,7 @@ impl IssuanceTicketBook {

    pub async fn obtain_blinded_credential(
        &self,
-        client: &nym_http_api_client::Client,
+        client: &nym_validator_client::client::NymApiClient,
        request_body: &BlindSignRequestBody,
    ) -> Result<BlindedSignature, Error> {
        let server_response = client.blind_sign(request_body).await?;
@@ -179,7 +179,7 @@ impl IssuanceTicketBook {
    // ideally this would have been generic over credential type, but we really don't need secp256k1 keys for bandwidth vouchers
    pub async fn obtain_partial_ticketbook_credential(
        &self,
-        client: &nym_http_api_client::Client,
+        client: &nym_validator_client::client::NymApiClient,
        signer_index: u64,
        validator_vk: &VerificationKeyAuth,
        signing_data: CredentialSigningData,
@@ -10,7 +10,6 @@ use nym_credentials_interface::{
    VerificationKeyAuth, WalletSignatures,
 };
 use nym_validator_client::client::EcashApiClient;
-use nym_validator_client::nym_api::NymApiClientExt;

 // so we wouldn't break all the existing imports
 pub use nym_ecash_time::{cred_exp_date, ecash_date_offset, ecash_today, EcashTime};
@@ -4,7 +4,7 @@
 use crate::ecash::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
 use nym_credentials_interface::CompactEcashError;
 use nym_crypto::asymmetric::x25519::KeyRecoveryError;
-use nym_validator_client::{nym_api::error::NymAPIError, ValidatorClientError};
+use nym_validator_client::ValidatorClientError;
 use thiserror::Error;

 #[derive(Debug, Error)]
@@ -37,9 +37,6 @@ pub enum Error {
    #[error("Ran into a validator client error - {0}")]
    ValidatorClientError(#[from] ValidatorClientError),

-    #[error("Nym API request failed - {0}")]
-    NymAPIError(#[from] NymAPIError),
-
    #[error("Bandwidth operation overflowed. {0}")]
    BandwidthOverflow(String),

@@ -19,6 +19,7 @@ digest = { workspace = true, optional = true }
 generic-array = { workspace = true, optional = true }
 hkdf = { workspace = true, optional = true }
 hmac = { workspace = true, optional = true }
+jwt-simple = { workspace = true, optional = true }
 cipher = { workspace = true, optional = true }
 x25519-dalek = { workspace = true, features = ["static_secrets"], optional = true }
 ed25519-dalek = { workspace = true, features = ["rand_core"], optional = true }
@@ -40,6 +41,7 @@ rand_chacha = { workspace = true }
 [features]
 default = []
 aead = ["dep:aead", "aead/std", "aes-gcm-siv", "generic-array"]
+naive_jwt = ["asymmetric", "jwt-simple"]
 serde = ["dep:serde", "serde_bytes", "ed25519-dalek/serde", "x25519-dalek/serde"]
 asymmetric = ["x25519-dalek", "ed25519-dalek", "zeroize"]
 hashing = ["blake3", "digest", "hkdf", "hmac", "generic-array", "sha2"]
@@ -2,8 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0

 pub use ed25519_dalek::SignatureError;
-use ed25519_dalek::{SecretKey, Signer, SigningKey};
 pub use ed25519_dalek::{Verifier, PUBLIC_KEY_LENGTH, SECRET_KEY_LENGTH, SIGNATURE_LENGTH};
+
+use ed25519_dalek::Signer;
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
 use std::fmt::{self, Debug, Display, Formatter};
 use std::str::FromStr;
@@ -13,6 +14,9 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 #[cfg(feature = "serde")]
 pub mod serde_helpers;

+#[cfg(feature = "serde")]
+pub use serde_helpers::*;
+
 #[cfg(feature = "sphinx")]
 use nym_sphinx_types::{DestinationAddressBytes, DESTINATION_ADDRESS_LENGTH};

@@ -81,8 +85,8 @@ impl KeyPair {
        }
    }

-    pub fn from_secret(secret: SecretKey, index: u32) -> Self {
-        let ed25519_signing_key = SigningKey::from(secret);
+    pub fn from_secret(secret: ed25519_dalek::SecretKey, index: u32) -> Self {
+        let ed25519_signing_key = ed25519_dalek::SigningKey::from(secret);

        KeyPair {
            private_key: PrivateKey(ed25519_signing_key.to_bytes()),
@@ -276,7 +280,7 @@ impl Display for PrivateKey {

 impl<'a> From<&'a PrivateKey> for PublicKey {
    fn from(pk: &'a PrivateKey) -> Self {
-        PublicKey(SigningKey::from_bytes(&pk.0).verifying_key())
+        PublicKey(ed25519_dalek::SigningKey::from_bytes(&pk.0).verifying_key())
    }
 }

@@ -320,7 +324,7 @@ impl PrivateKey {
    }

    pub fn sign<M: AsRef<[u8]>>(&self, message: M) -> Signature {
-        let signing_key: SigningKey = self.0.into();
+        let signing_key: ed25519_dalek::SigningKey = self.0.into();
        let sig = signing_key.sign(message.as_ref());
        Signature(sig)
    }
@@ -425,9 +429,57 @@ impl<'d> Deserialize<'d> for Signature {
    }
 }

+#[cfg(feature = "naive_jwt")]
+impl PublicKey {
+    pub fn to_jwt_compatible_key(&self) -> jwt_simple::algorithms::Ed25519PublicKey {
+        (*self).into()
+    }
+}
+
+#[cfg(feature = "naive_jwt")]
+impl From<PublicKey> for jwt_simple::algorithms::Ed25519PublicKey {
+    fn from(value: PublicKey) -> Self {
+        // SAFETY: we have a valid ed25519 pubkey, we're just changing to a different library wrapper
+        #[allow(clippy::unwrap_used)]
+        jwt_simple::algorithms::Ed25519PublicKey::from_bytes(&value.to_bytes()).unwrap()
+    }
+}
+
+#[cfg(feature = "naive_jwt")]
+impl PrivateKey {
+    pub fn to_jwt_compatible_keys(&self) -> jwt_simple::algorithms::Ed25519KeyPair {
+        let pub_key = self.public_key();
+        let mut bytes = zeroize::Zeroizing::new([0u8; 64]);
+
+        bytes[..SECRET_KEY_LENGTH]
+            .copy_from_slice(zeroize::Zeroizing::new(self.to_bytes()).as_ref());
+        bytes[SECRET_KEY_LENGTH..].copy_from_slice(&pub_key.to_bytes());
+
+        // SAFETY: we have a valid ed25519 keys, we're just changing to a different library wrapper
+        #[allow(clippy::unwrap_used)]
+        jwt_simple::algorithms::Ed25519KeyPair::from_bytes(bytes.as_ref()).unwrap()
+    }
+}
+
+#[cfg(feature = "naive_jwt")]
+impl KeyPair {
+    pub fn to_jwt_compatible_keys(&self) -> jwt_simple::algorithms::Ed25519KeyPair {
+        let mut bytes = zeroize::Zeroizing::new([0u8; 64]);
+
+        bytes[..SECRET_KEY_LENGTH]
+            .copy_from_slice(zeroize::Zeroizing::new(self.private_key.to_bytes()).as_ref());
+        bytes[SECRET_KEY_LENGTH..].copy_from_slice(&self.public_key.to_bytes());
+
+        // SAFETY: we have a valid ed25519 keys, we're just changing to a different library wrapper
+        #[allow(clippy::unwrap_used)]
+        jwt_simple::algorithms::Ed25519KeyPair::from_bytes(bytes.as_ref()).unwrap()
+    }
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
+    use rand::thread_rng;

    fn assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}

@@ -438,4 +490,29 @@ mod tests {
        assert_zeroize::<PrivateKey>();
        assert_zeroize_on_drop::<PrivateKey>();
    }
+
+    #[test]
+    #[cfg(all(feature = "naive_jwt", feature = "rand"))]
+    fn check_jwt_key_compat_conversion() {
+        let mut rng = thread_rng();
+        let keys = KeyPair::new(&mut rng);
+        let jwt_keys = keys.to_jwt_compatible_keys();
+
+        // internally they're represented by hidden `Edwards25519KeyPair` (plus key_id)
+        // which has way nicer API for assertions
+        let jwt_keys_inner =
+            jwt_simple::algorithms::Edwards25519KeyPair::from_bytes(&jwt_keys.to_bytes()).unwrap();
+
+        let compact_ed25519 = jwt_keys_inner.as_ref();
+        assert!(compact_ed25519
+            .sk
+            .validate_public_key(&compact_ed25519.pk)
+            .is_ok());
+
+        let dummy_message = "hello world";
+        let sig1 = keys.private_key.sign(dummy_message).to_bytes();
+        let sig2 = compact_ed25519.sk.sign(dummy_message, None).to_vec();
+
+        assert_eq!(sig1.to_vec(), sig2);
+    }
 }
@@ -157,6 +157,14 @@ impl<LS, TS, LC, TC> SignerResult<LS, TS, LC, TC> {
    pub fn malformed_details(&self) -> bool {
        self.information.parse().is_err()
    }
+
+    pub fn try_get_test_result(&self) -> Option<&SignerTestResult<LS, TS, LC, TC>> {
+        if let SignerStatus::Tested { result } = &self.status {
+            Some(result)
+        } else {
+            None
+        }
+    }
 }

 impl<LS, TS, LC, TC> SignerResult<LS, TS, LC, TC>
@@ -22,7 +22,6 @@ url = { workspace = true }
 nym-validator-client = { path = "../client-libs/validator-client" }
 nym-network-defaults = { path = "../network-defaults" }
 nym-ecash-signer-check-types = { path = "../ecash-signer-check-types" }
-nym-http-api-client = { path = "../http-api-client" }

 [lints]
 workspace = true
@@ -1,14 +1,15 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::{LocalChainStatus, SignerCheckError, SigningStatus, TypedSignerResult};
+use crate::{LocalChainStatus, SigningStatus, TypedSignerResult};
 use nym_ecash_signer_check_types::dealer_information::RawDealerInformation;
 use nym_ecash_signer_check_types::status::{SignerStatus, SignerTestResult};
+use nym_validator_client::client::NymApiClientExt;
 use nym_validator_client::models::BinaryBuildInformationOwned;
-use nym_validator_client::nym_api::NymApiClientExt;
 use nym_validator_client::nyxd::contract_traits::dkg_query_client::{
    ContractVKShare, DealerDetails,
 };
+use nym_validator_client::NymApiClient;
 use std::time::Duration;
 use tracing::{error, warn};
 use url::Url;
@@ -31,38 +32,37 @@ pub(crate) mod signing_status {
 }

 struct ClientUnderTest {
-    api_client: nym_http_api_client::Client,
+    api_client: NymApiClient,
    build_info: Option<BinaryBuildInformationOwned>,
 }

 impl ClientUnderTest {
-    pub(crate) fn new(api_url: &Url) -> Result<Self, SignerCheckError> {
-        // The builder should not fail with a valid URL that's already parsed
-        // If it does fail, it's an internal error that we can't recover from
-        let api_client = nym_http_api_client::Client::builder(api_url.clone())?.build()?;
-
-        Ok(ClientUnderTest {
-            api_client,
+    pub(crate) fn new(api_url: &Url) -> Self {
+        ClientUnderTest {
+            api_client: NymApiClient::new(api_url.clone()),
            build_info: None,
-        })
+        }
    }

    pub(crate) async fn try_retrieve_build_information(&mut self) -> bool {
-        match tokio::time::timeout(Duration::from_secs(5), self.api_client.build_information())
-            .await
+        match tokio::time::timeout(
+            Duration::from_secs(5),
+            self.api_client.nym_api.build_information(),
+        )
+        .await
        {
            Ok(Ok(build_information)) => {
                self.build_info = Some(build_information);
                true
            }
            Ok(Err(err)) => {
-                warn!("{}: failed to retrieve build information: {err}. the signer is most likely down", self.api_client.current_url());
+                warn!("{}: failed to retrieve build information: {err}. the signer is most likely down", self.api_client.api_url());
                false
            }
            Err(_timeout) => {
                warn!(
                    "{}: timed out while attempting to retrieve build information",
-                    self.api_client.current_url()
+                    self.api_client.api_url()
                );
                false
            }
@@ -77,7 +77,7 @@ impl ClientUnderTest {
                .inspect_err(|err| {
                    error!(
                        "ecash signer '{}' reports invalid version {}: {err}",
-                        self.api_client.current_url(),
+                        self.api_client.api_url(),
                        build_info.build_version
                    )
                })
@@ -121,14 +121,14 @@ impl ClientUnderTest {

        // check if it supports the current query
        if self.supports_chain_status_query() {
-            return match self.api_client.get_chain_blocks_status().await {
+            return match self.api_client.nym_api.get_chain_blocks_status().await {
                Ok(status) => LocalChainStatus::Reachable {
                    response: Box::new(status),
                },
                Err(err) => {
                    warn!(
                        "{}: failed to retrieve local chain status: {err}",
-                        self.api_client.current_url()
+                        self.api_client.api_url()
                    );
                    LocalChainStatus::Unreachable
                }
@@ -136,14 +136,14 @@ impl ClientUnderTest {
        }

        // fallback to the legacy query
-        match self.api_client.get_chain_status().await {
+        match self.api_client.nym_api.get_chain_status().await {
            Ok(status) => LocalChainStatus::ReachableLegacy {
                response: Box::new(status),
            },
            Err(err) => {
                warn!(
                    "{}: failed to retrieve [legacy] local chain status: {err}",
-                    self.api_client.current_url()
+                    self.api_client.api_url()
                );
                LocalChainStatus::Unreachable
            }
@@ -158,14 +158,14 @@ impl ClientUnderTest {

        // check if it supports the current query
        if self.supports_signing_status_query() {
-            return match self.api_client.get_signer_status().await {
+            return match self.api_client.nym_api.get_signer_status().await {
                Ok(response) => SigningStatus::Reachable {
                    response: Box::new(response),
                },
                Err(err) => {
                    warn!(
                        "{}: failed to retrieve signer chain status: {err}",
-                        self.api_client.current_url()
+                        self.api_client.api_url()
                    );
                    SigningStatus::Unreachable
                }
@@ -173,14 +173,14 @@ impl ClientUnderTest {
        }

        // fallback to the legacy query
-        match self.api_client.get_signer_information().await {
+        match self.api_client.nym_api.get_signer_information().await {
            Ok(status) => SigningStatus::ReachableLegacy {
                response: Box::new(status),
            },
            Err(err) => {
                warn!(
                    "{}: failed to retrieve [legacy] signer chain status: {err}",
-                    self.api_client.current_url()
+                    self.api_client.api_url()
                );
                // NOTE: this might equally mean the signing is disabled
                SigningStatus::Unreachable
@@ -201,13 +201,7 @@ pub(crate) async fn check_client(
        return SignerStatus::ProvidedInvalidDetails.with_details(dealer_information, dkg_epoch);
    };

-    let mut client = match ClientUnderTest::new(&parsed_information.announce_address) {
-        Ok(client) => client,
-        Err(err) => {
-            error!("failed to create client instance: {err}");
-            return SignerStatus::Unreachable.with_details(dealer_information, dkg_epoch);
-        }
-    };
+    let mut client = ClientUnderTest::new(&parsed_information.announce_address);

    // 8. check basic connection status - can you retrieve build information?
    if !client.try_retrieve_build_information().await {
@@ -1,7 +1,6 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_http_api_client::HttpClientError;
 use nym_validator_client::nyxd::error::NyxdError;
 use thiserror::Error;

@@ -12,12 +11,6 @@ pub enum SignerCheckError {

    #[error("failed to query the DKG contract: {source}")]
    DKGContractQueryFailure { source: NyxdError },
-
-    #[error("failed to build client: {source}")]
-    HttpClient {
-        #[from]
-        source: HttpClientError,
-    },
 }

 impl SignerCheckError {
@@ -1,12 +0,0 @@
-[package]
-name = "nym-execute"
-version = "0.1.0"
-edition = "2021"
-license.workspace = true
-
-[lib]
-proc-macro = true
-
-[dependencies]
-syn = { workspace = true, features = ["full"] }
-quote = { workspace = true }
@@ -1,110 +0,0 @@
-use proc_macro::TokenStream;
-use quote::quote;
-use syn::{
-    parse_macro_input, Block, ExprMethodCall, FnArg, Ident, ItemFn, LitStr, ReturnType, Token,
-    VisPublic, Visibility,
-};
-
-#[proc_macro_attribute]
-pub fn execute(attr: TokenStream, item: TokenStream) -> TokenStream {
-    let f = parse_macro_input!(item as ItemFn);
-    let target = parse_macro_input!(attr as LitStr).value();
-
-    let cl = if target == "mixnet" {
-        quote! {self.mixnet_contract_address()}
-    } else if target == "vesting" {
-        quote! {self.vesting_contract_address()}
-    } else {
-        panic!("Only `mixnet` and `vesting` targets are supported!")
-    };
-    let cl = proc_macro::TokenStream::from(cl);
-    let cl = parse_macro_input!(cl as ExprMethodCall);
-
-    let orig_f = f.clone();
-    let mut execute_f = f.clone();
-    let mut simulate_f = f.clone();
-    let name = f.sig.ident;
-    let name_str = name.to_string();
-    let call_args = f.sig.inputs.into_iter().filter_map(|arg| match arg {
-        FnArg::Receiver(_) => None,
-        FnArg::Typed(arg) => Some(arg.pat),
-    });
-    let execute_args = call_args.clone();
-    let simulate_args = call_args;
-
-    execute_f.sig.asyncness = Some(Token![async](execute_f.sig.ident.span()));
-    simulate_f.sig.asyncness = Some(Token![async](simulate_f.sig.ident.span()));
-
-    execute_f.vis = Visibility::Public(VisPublic {
-        pub_token: Token![pub](execute_f.sig.ident.span()),
-    });
-    simulate_f.vis = Visibility::Public(VisPublic {
-        pub_token: Token![pub](simulate_f.sig.ident.span()),
-    });
-
-    execute_f.sig.ident = Ident::new(
-        &format!("execute{}", execute_f.sig.ident),
-        execute_f.sig.ident.span(),
-    );
-
-    simulate_f.sig.ident = Ident::new(
-        &format!("simulate{}", simulate_f.sig.ident),
-        simulate_f.sig.ident.span(),
-    );
-
-    let execute_output = quote! {
-        -> Result<ExecuteResult, NyxdError>
-    };
-    let o_ts = proc_macro::TokenStream::from(execute_output);
-    execute_f.sig.output = parse_macro_input!(o_ts as ReturnType);
-
-    let simulate_output = quote! {
-        -> Result<SimulateResponse, NyxdError>
-    };
-    let o_ts = proc_macro::TokenStream::from(simulate_output);
-    simulate_f.sig.output = parse_macro_input!(o_ts as ReturnType);
-
-    let simulate_block = quote! {
-        {
-            let (msg, _fee) = self.#name(#(#simulate_args),*);
-            let msg = self.wrap_contract_execute_message(
-                #cl,
-                &msg,
-                vec![],
-            )?;
-
-            self.simulate(vec![msg]).await
-        }
-    };
-
-    let ts = proc_macro::TokenStream::from(simulate_block);
-    simulate_f.block = Box::new(parse_macro_input!(ts as Block));
-
-    let execute_block = quote! {
-        {
-            let (req, fee) = self.#name(#(#execute_args),*);
-            let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier)));
-            self.client
-                .execute(
-                    self.address(),
-                    #cl,
-                    &req,
-                    fee,
-                    #name_str,
-                    vec![],
-                )
-                .await
-        }
-    };
-
-    let ts = proc_macro::TokenStream::from(execute_block);
-    execute_f.block = Box::new(parse_macro_input!(ts as Block));
-
-    let out = quote! {
-        #orig_f
-        #execute_f
-        #simulate_f
-    };
-
-    out.into()
-}
@@ -13,7 +13,6 @@ license.workspace = true
 [features]
 default=["tunneling"]
 tunneling=[]
-network-defaults = ["dep:nym-network-defaults"]

 [dependencies]
 async-trait = { workspace = true }
@@ -35,7 +34,6 @@ mime = { workspace = true }

 nym-http-api-common = { path = "../http-api-common", default-features = false }
 nym-bin-common = { path = "../bin-common" }
-nym-network-defaults = { path = "../network-defaults", optional = true }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies]
 hickory-resolver = { workspace = true, features = ["https-ring", "tls-ring", "webpki-roots"] }
@@ -54,14 +54,10 @@ impl Front {

 #[derive(Debug, Default, PartialEq, Clone)]
 #[cfg(feature = "tunneling")]
-/// Policy for when to use domain fronting for HTTP requests.
 pub enum FrontPolicy {
-    /// Always use domain fronting for all requests.
    Always,
-    /// Only use domain fronting when retrying failed requests.
    OnRetry,
    #[default]
-    /// Never use domain fronting.
    Off,
 }

@@ -162,8 +162,6 @@ use std::sync::Arc;

 #[cfg(feature = "tunneling")]
 mod fronted;
-#[cfg(feature = "tunneling")]
-pub use fronted::FrontPolicy;
 mod url;
 pub use url::{IntoUrl, Url};
 mod user_agent;
@@ -194,15 +192,6 @@ pub type Params<'a, K, V> = &'a [(K, V)];
 /// Empty collection of HTTP Request Parameters.
 pub const NO_PARAMS: Params<'_, &'_ str, &'_ str> = &[];

-/// Serialization format for API requests and responses
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SerializationFormat {
-    /// Use JSON serialization (default, always works)
-    Json,
-    /// Use bincode serialization (must be explicitly opted into)
-    Bincode,
-}
-
 /// The Errors that may occur when creating or using an HTTP client.
 #[derive(Debug, Error)]
 #[allow(missing_docs)]
@@ -382,7 +371,6 @@ pub struct ClientBuilder {
    front: Option<fronted::Front>,

    retry_limit: usize,
-    serialization: SerializationFormat,
 }

 impl ClientBuilder {
@@ -408,50 +396,6 @@ impl ClientBuilder {
        }
    }

-    /// Create a client builder from network details with sensible defaults
-    #[cfg(feature = "network-defaults")]
-    pub fn from_network(
-        network: &nym_network_defaults::NymNetworkDetails,
-    ) -> Result<Self, HttpClientError> {
-        let urls = network
-            .nym_api_urls
-            .as_ref()
-            .ok_or_else(|| {
-                HttpClientError::GenericRequestFailure(
-                    "No API URLs configured in network details".to_string(),
-                )
-            })?
-            .iter()
-            .map(|api_url| {
-                // Convert ApiUrl to our Url type with fronting support
-                let mut url = Url::parse(&api_url.url)?;
-
-                // Add fronting domains if available
-                #[cfg(feature = "tunneling")]
-                if let Some(ref front_hosts) = api_url.front_hosts {
-                    let fronts: Vec<String> = front_hosts
-                        .iter()
-                        .map(|host| format!("https://{}", host))
-                        .collect();
-                    url = Url::new(api_url.url.clone(), Some(fronts))
-                        .map_err(|e| HttpClientError::GenericRequestFailure(e.to_string()))?;
-                }
-
-                Ok(url)
-            })
-            .collect::<Result<Vec<_>, HttpClientError>>()?;
-
-        let mut builder = Self::new_with_urls(urls);
-
-        // Enable domain fronting by default (on retry)
-        #[cfg(feature = "tunneling")]
-        {
-            builder = builder.with_fronting(FrontPolicy::OnRetry);
-        }
-
-        Ok(builder)
-    }
-
    /// Constructs a new http `ClientBuilder` from a valid url.
    pub fn new_with_urls(urls: Vec<Url>) -> Self {
        let urls = Self::check_urls(urls);
@@ -485,7 +429,6 @@ impl ClientBuilder {
            front: None,

            retry_limit: 0,
-            serialization: SerializationFormat::Json,
        }
    }

@@ -558,17 +501,6 @@ impl ClientBuilder {
        self
    }

-    /// Set the serialization format for API requests and responses
-    pub fn with_serialization(mut self, format: SerializationFormat) -> Self {
-        self.serialization = format;
-        self
-    }
-
-    /// Configure the client to use bincode serialization
-    pub fn with_bincode(self) -> Self {
-        self.with_serialization(SerializationFormat::Bincode)
-    }
-
    /// Returns a Client that uses this ClientBuilder configuration.
    pub fn build<E>(self) -> Result<Client, HttpClientError<E>>
    where
@@ -610,7 +542,6 @@ impl ClientBuilder {
            #[cfg(target_arch = "wasm32")]
            request_timeout: self.timeout.unwrap_or(DEFAULT_TIMEOUT),
            retry_limit: self.retry_limit,
-            serialization: self.serialization,
        };

        Ok(client)
@@ -631,7 +562,6 @@ pub struct Client {
    request_timeout: Duration,

    retry_limit: usize,
-    serialization: SerializationFormat,
 }

 impl Client {
@@ -689,7 +619,6 @@ impl Client {

            #[cfg(target_arch = "wasm32")]
            request_timeout: self.request_timeout,
-            serialization: self.serialization,
        }
    }

@@ -765,37 +694,26 @@ impl Client {
    /// this method. For example, if the client is configured to rotate hosts after each error, this
    /// method should be called after the host has been updated -- i.e. as part of the subsequent
    /// send.
-    fn apply_hosts_to_req(&self, r: &mut reqwest::Request) -> (&str, Option<&str>) {
+    fn apply_hosts_to_req(&self, r: &mut reqwest::Request) {
        let url = self.current_url();
        r.url_mut().set_host(url.host_str()).unwrap();

        #[cfg(feature = "tunneling")]
        if let Some(ref front) = self.front {
            if front.is_enabled() {
-                let front_host = url.front_str().unwrap_or("");
-                let actual_host = url.host_str().unwrap_or("");
-
-                tracing::debug!(
-                    "Domain fronting enabled: routing via CDN {} to actual host {}",
-                    front_host,
-                    actual_host
-                );
-
                // this should never fail as we are transplanting the host from one url to another
-                r.url_mut().set_host(Some(front_host)).unwrap();
+                r.url_mut().set_host(url.front_str()).unwrap();

-                let actual_host_header: HeaderValue =
-                    actual_host.parse().unwrap_or(HeaderValue::from_static(""));
+                let actual_host: HeaderValue = url
+                    .host_str()
+                    .unwrap_or("")
+                    .parse()
+                    .unwrap_or(HeaderValue::from_static(""));
                // If the map did have this key present, the new value is associated with the key
                // and all previous values are removed. (reqwest HeaderMap docs)
-                _ = r
-                    .headers_mut()
-                    .insert(reqwest::header::HOST, actual_host_header);
-
-                return (url.as_str(), url.front_str());
+                _ = r.headers_mut().insert(reqwest::header::HOST, actual_host);
            }
        }
-        (url.as_str(), None)
    }
 }

@@ -825,13 +743,6 @@ impl ApiClientCore for Client {

        let mut rb = RequestBuilder::from_parts(self.reqwest_client.clone(), req);

-        // Set Accept header based on serialization preference
-        let accept_header = match self.serialization {
-            SerializationFormat::Json => "application/json",
-            SerializationFormat::Bincode => "application/bincode",
-        };
-        rb = rb.header(reqwest::header::ACCEPT, accept_header);
-
        if let Some(body) = json_body {
            rb = rb.json(body);
        }
@@ -880,14 +791,7 @@ impl ApiClientCore for Client {
                    if let Some(ref front) = self.front {
                        // If fronting is set to be enabled on error, enable domain fronting as we
                        // have encountered an error.
-                        let was_enabled = front.is_enabled();
                        front.retry_enable();
-                        if !was_enabled && front.is_enabled() {
-                            tracing::info!(
-                                "Domain fronting activated after connection failure: {}",
-                                e
-                            );
-                        }
                    }

                    if attempts < self.retry_limit {
@@ -55,7 +55,6 @@ pub struct ApiUrl {
    pub front_hosts: Option<Vec<String>>,
 }

-#[derive(Copy, Clone)]
 pub struct ApiUrlConst<'a> {
    pub url: &'a str,
    pub front_hosts: Option<&'a [&'a str]>,
@@ -189,14 +188,8 @@ impl NymNetworkDetails {
                ),
            },
            nym_vpn_api_url: parse_optional_str(mainnet::NYM_VPN_API),
-            nym_api_urls: Some(mainnet::NYM_APIS.iter().copied().map(Into::into).collect()),
-            nym_vpn_api_urls: Some(
-                mainnet::NYM_VPN_APIS
-                    .iter()
-                    .copied()
-                    .map(Into::into)
-                    .collect(),
-            ),
+            nym_api_urls: None,
+            nym_vpn_api_urls: None,
        }
    }

@@ -16,3 +16,6 @@ thiserror = { workspace = true }
 [dev-dependencies]
 rand = { workspace = true }
 nym-crypto = { path = "../../crypto", features = ["rand"] }
+bincode = { workspace = true }
+serde_json = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
@@ -7,7 +7,7 @@
 use crate::nodes::{NodeIdentity, NODE_IDENTITY_SIZE};
 use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_sphinx_types::Destination;
-use serde::de::{Error as SerdeError, Unexpected, Visitor};
+use serde::de::{Error as SerdeError, SeqAccess, Unexpected, Visitor};
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use std::fmt::{self, Formatter};
 use std::str::FromStr;
@@ -64,7 +64,7 @@ impl<'de> Deserialize<'de> for Recipient {
    {
        struct RecipientVisitor;

-        impl Visitor<'_> for RecipientVisitor {
+        impl<'de> Visitor<'de> for RecipientVisitor {
            type Value = Recipient;

            fn expecting(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
@@ -90,6 +90,42 @@ impl<'de> Deserialize<'de> for Recipient {
                    )
                })
            }
+
+            fn visit_seq<A>(self, mut seq: A) -> Result<Self::Value, A::Error>
+            where
+                A: SeqAccess<'de>,
+            {
+                // if we know the size hint, check if it matches expectation,
+                // otherwise return an error
+                if let Some(size_hint) = seq.size_hint() {
+                    if size_hint != Recipient::LEN {
+                        return Err(SerdeError::invalid_length(size_hint, &self));
+                    }
+                }
+
+                let mut recipient_bytes = [0u8; Recipient::LEN];
+
+                // clippy's suggestion is completely wrong and it iterates wrong sequence
+                #[allow(clippy::needless_range_loop)]
+                for i in 0..Recipient::LEN {
+                    let Some(elem) = seq.next_element::<u8>()? else {
+                        return Err(SerdeError::invalid_length(i + 1, &self));
+                    };
+                    recipient_bytes[i] = elem;
+                }
+
+                // make sure there are no trailing bytes
+                if seq.next_element::<u8>()?.is_some() {
+                    return Err(SerdeError::invalid_length(Recipient::LEN + 1, &self));
+                }
+
+                Recipient::try_from_bytes(recipient_bytes).map_err(|_| {
+                    SerdeError::invalid_value(
+                        Unexpected::Other("At least one of the curve points was malformed"),
+                        &self,
+                    )
+                })
+            }
        }

        deserializer.deserialize_bytes(RecipientVisitor)
@@ -245,6 +281,18 @@ impl FromStr for Recipient {
 mod tests {
    use super::*;

+    fn mock_recipient() -> Recipient {
+        Recipient::try_from_bytes([
+            67, 5, 132, 146, 3, 236, 116, 89, 254, 57, 131, 159, 69, 181, 55, 208, 12, 108, 136,
+            83, 58, 76, 171, 195, 31, 98, 92, 64, 68, 53, 156, 184, 100, 189, 73, 3, 238, 103, 156,
+            108, 124, 199, 42, 79, 172, 98, 81, 177, 182, 100, 167, 164, 74, 183, 199, 213, 162,
+            173, 102, 112, 30, 159, 148, 66, 44, 75, 230, 182, 138, 114, 170, 163, 209, 82, 204,
+            100, 118, 91, 57, 150, 212, 147, 151, 135, 148, 16, 213, 223, 182, 164, 242, 37, 40,
+            73, 137, 228,
+        ])
+        .unwrap()
+    }
+
    #[test]
    fn string_conversion_works() {
        let mut rng = rand::thread_rng();
@@ -308,4 +356,40 @@ mod tests {
            recovered_recipient.gateway.to_bytes()
        );
    }
+
+    // calls `visit_bytes`
+    #[test]
+    fn bincode_serialisation_works() {
+        let recipient = mock_recipient();
+
+        #[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq)]
+        struct MyStruct {
+            recipient: Recipient,
+        }
+        let a = MyStruct { recipient };
+        let s = bincode::serialize(&a).unwrap();
+
+        let b = bincode::deserialize(&s).unwrap();
+
+        assert_eq!(a, b);
+    }
+
+    // calls `visit_seq`
+    #[test]
+    fn json_serialisation_works() {
+        use serde::{Deserialize, Serialize};
+
+        let recipient = mock_recipient();
+
+        #[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq)]
+        struct MyStruct {
+            recipient: Recipient,
+        }
+        let a = MyStruct { recipient };
+        let s = serde_json::to_string(&a).unwrap();
+
+        let b = serde_json::from_str(&s).unwrap();
+
+        assert_eq!(a, b);
+    }
 }
@@ -180,6 +180,7 @@ impl NymPacket {
    }

    #[cfg(feature = "sphinx")]
+    #[allow(unreachable_patterns)]
    pub fn sphinx_packet_ref(&self) -> Option<&SphinxPacket> {
        match self {
            NymPacket::Sphinx(packet) => Some(packet),
@@ -188,6 +189,7 @@ impl NymPacket {
    }

    #[cfg(feature = "sphinx")]
+    #[allow(unreachable_patterns)]
    pub fn to_sphinx_packet(self) -> Option<SphinxPacket> {
        match self {
            NymPacket::Sphinx(packet) => Some(packet),
@@ -110,6 +110,7 @@ impl ShutdownToken {
    // exposed method with the old name for easier migration
    // it will eventually be removed so please try to use `.clone_with_suffix` instead
    #[must_use]
+    #[deprecated(note = "use .clone_with_suffix instead")]
    pub fn fork<S: Into<String>>(&self, child_suffix: S) -> Self {
        self.clone_with_suffix(child_suffix)
    }
@@ -117,6 +118,7 @@ impl ShutdownToken {
    // exposed method with the old name for easier migration
    // it will eventually be removed so please try to use `.clone().named(name)` instead
    #[must_use]
+    #[deprecated(note = "use .clone().named(name) instead")]
    pub fn fork_named<S: Into<String>>(&self, name: S) -> Self {
        self.clone().named(name)
    }
@@ -232,6 +234,16 @@ impl ShutdownManager {
        manager.with_shutdown(async move { cancel_watcher.cancelled().await })
    }

+    pub fn empty_mock() -> Self {
+        ShutdownManager {
+            root_token: ShutdownToken::ephemeral(),
+            legacy_task_manager: None,
+            shutdown_signals: Default::default(),
+            tracker: Default::default(),
+            max_shutdown_duration: Default::default(),
+        }
+    }
+
    pub fn with_legacy_task_manager(mut self) -> Self {
        let mut legacy_manager =
            TaskManager::default().named(format!("{}-legacy", self.root_token.name()));
@@ -0,0 +1,30 @@
+[package]
+name = "nym-upgrade-mode-check"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+
+[dependencies]
+jwt-simple = { workspace = true }
+reqwest = { workspace = true, features = ["rustls-tls"] }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+time = { workspace = true, features = ["serde"] }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+nym-http-api-client = { path = "../http-api-client", default-features = false }
+nym-crypto = { path = "../crypto", features = ["asymmetric", "serde", "naive_jwt"] }
+
+[dev-dependencies]
+anyhow = { workspace = true }
+time = { workspace = true, features = ["macros"] }
+
+[lints]
+workspace = true
@@ -0,0 +1,123 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::UpgradeModeCheckError;
+use nym_crypto::asymmetric::ed25519;
+use nym_http_api_client::generate_user_agent;
+use serde::{Deserialize, Serialize};
+use std::time::Duration;
+use time::OffsetDateTime;
+
+#[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Copy)]
+pub struct UpgradeModeAttestation {
+    #[serde(flatten)]
+    pub content: UpgradeModeAttestationContent,
+
+    #[serde(with = "ed25519::bs58_ed25519_signature")]
+    pub signature: ed25519::Signature,
+}
+
+#[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Copy)]
+#[serde(tag = "type")]
+#[serde(rename = "upgrade_mode")]
+pub struct UpgradeModeAttestationContent {
+    #[serde(with = "time::serde::timestamp")]
+    pub starting_time: OffsetDateTime,
+
+    #[serde(with = "ed25519::bs58_ed25519_pubkey")]
+    pub attester_public_key: ed25519::PublicKey,
+}
+
+impl UpgradeModeAttestation {
+    pub fn verify(&self) -> bool {
+        self.content
+            .attester_public_key
+            .verify(self.content.as_json(), &self.signature)
+            .is_ok()
+    }
+}
+
+impl UpgradeModeAttestationContent {
+    pub fn as_json(&self) -> String {
+        // SAFETY: Serialize impl is valid and we have no non-string map keys
+        #[allow(clippy::unwrap_used)]
+        serde_json::to_string(&self).unwrap()
+    }
+}
+
+pub fn generate_new_attestation(key: &ed25519::PrivateKey) -> UpgradeModeAttestation {
+    generate_new_attestation_with_starting_time(key, OffsetDateTime::now_utc())
+}
+
+pub fn generate_new_attestation_with_starting_time(
+    key: &ed25519::PrivateKey,
+    starting_time: OffsetDateTime,
+) -> UpgradeModeAttestation {
+    let content = UpgradeModeAttestationContent {
+        starting_time,
+        attester_public_key: key.into(),
+    };
+    UpgradeModeAttestation {
+        signature: key.sign(content.as_json()),
+        content,
+    }
+}
+
+pub async fn attempt_retrieve(
+    url: &str,
+) -> Result<Option<UpgradeModeAttestation>, UpgradeModeCheckError> {
+    let retrieval_failure = |source| UpgradeModeCheckError::AttestationRetrievalFailure {
+        url: url.to_string(),
+        source,
+    };
+
+    let attestation = reqwest::ClientBuilder::new()
+        .user_agent(generate_user_agent!())
+        .timeout(Duration::from_secs(5))
+        .build()
+        .map_err(retrieval_failure)?
+        .get(url)
+        .send()
+        .await
+        .map_err(retrieval_failure)?
+        .json::<Option<UpgradeModeAttestation>>()
+        .await
+        .map_err(retrieval_failure)?;
+
+    Ok(attestation)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn upgrade_mode_attestation_serde_json() -> anyhow::Result<()> {
+        // unix timestamp: 1629720000
+        let starting_time = time::macros::datetime!(2021-08-23 12:00 UTC);
+
+        let key = ed25519::PrivateKey::from_bytes(&[
+            108, 49, 193, 21, 126, 161, 249, 85, 242, 207, 74, 195, 238, 6, 64, 149, 201, 140, 248,
+            163, 122, 170, 79, 198, 87, 85, 36, 29, 243, 92, 64, 161,
+        ])?;
+
+        let attestation = generate_new_attestation_with_starting_time(&key, starting_time);
+
+        let attestation_json = serde_json::to_string(&attestation)?;
+        let attestation_content_json = attestation.content.as_json();
+
+        let expected_attestation = r#"{"type":"upgrade_mode","starting_time":1629720000,"attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt","signature":"5rWUr2ypaDTtrMKegMP3tQkkZGFAuhNTnEVCVe5Azv6QqvLzoGdQiMkFmeyhDd1XSfoXpL9fFM58rsdA1kf4GYMM"}"#;
+        let expected_content = r#"{"type":"upgrade_mode","starting_time":1629720000,"attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt"}"#;
+
+        assert_eq!(attestation_content_json, expected_content);
+        assert_eq!(attestation_json, expected_attestation);
+
+        let recovered_attestation = serde_json::from_str(&attestation_json)?;
+        assert_eq!(attestation, recovered_attestation);
+
+        let recovered_content = serde_json::from_str(&attestation_content_json)?;
+        assert_eq!(attestation.content, recovered_content);
+
+        Ok(())
+    }
+}
@@ -0,0 +1,23 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_crypto::asymmetric::ed25519::Ed25519RecoveryError;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum UpgradeModeCheckError {
+    #[error("failed to decode jwt metadata")]
+    TokenMetadataDecodeFailure { source: jwt_simple::Error },
+
+    #[error("the jwt metadata didn't contain explicit public key")]
+    MissingTokenPublicKey,
+
+    #[error("the attached public key was not valid ed25519 public key")]
+    MalformedEd25519PublicKey { source: Ed25519RecoveryError },
+
+    #[error("failed to verify the jwt: {source}")]
+    JwtVerificationFailure { source: jwt_simple::Error },
+
+    #[error("failed to retrieve attestation from {url}:{source}")]
+    AttestationRetrievalFailure { url: String, source: reqwest::Error },
+}
@@ -0,0 +1,119 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{UpgradeModeAttestation, UpgradeModeCheckError};
+use jwt_simple::claims::Claims;
+use jwt_simple::common::{KeyMetadata, VerificationOptions};
+use jwt_simple::prelude::{EdDSAKeyPairLike, EdDSAPublicKeyLike};
+use jwt_simple::token::Token;
+use nym_crypto::asymmetric::ed25519;
+use std::collections::HashSet;
+use std::time::Duration;
+
+// for now use static issuer such as "nym-credential-proxy"
+pub fn generate_jwt_for_upgrade_mode_attestation(
+    attestation: UpgradeModeAttestation,
+    validity: Duration,
+    keys: &ed25519::KeyPair,
+    issuer: Option<&'static str>,
+) -> String {
+    let claim = Claims::with_custom_claims(attestation, validity.into());
+    let mut claim = if let Some(issuer) = issuer {
+        claim.with_issuer(issuer)
+    } else {
+        claim
+    };
+    claim.create_nonce();
+
+    let md = KeyMetadata::default().with_public_key(keys.public_key().to_base58_string());
+
+    let mut jwt_keys = keys.to_jwt_compatible_keys();
+    // SAFETY: trait impl for EdDSA is infallible
+    #[allow(clippy::unwrap_used)]
+    jwt_keys.attach_metadata(md).unwrap();
+
+    // SAFETY: our construction of the jwt is valid
+    #[allow(clippy::unwrap_used)]
+    jwt_keys.sign(claim).unwrap()
+}
+
+pub fn validate_upgrade_mode_jwt(
+    token: &str,
+    expected_issuer: Option<&'static str>,
+) -> Result<UpgradeModeAttestation, UpgradeModeCheckError> {
+    // for now, we completely ignore the validity of the pubkey (I know, I know).
+    // that will be changed later on
+    // so as a bypass we have to extract the claimed issuer from the jwt to verify against it
+    let metadata = Token::decode_metadata(token)
+        .map_err(|source| UpgradeModeCheckError::TokenMetadataDecodeFailure { source })?;
+
+    let pub_key = metadata
+        .public_key()
+        .ok_or(UpgradeModeCheckError::MissingTokenPublicKey)?;
+
+    let ed25519_pub_key = ed25519::PublicKey::from_base58_string(pub_key)
+        .map_err(|source| UpgradeModeCheckError::MalformedEd25519PublicKey { source })?;
+
+    let mut opts = VerificationOptions::default();
+    if let Some(issuer) = expected_issuer {
+        opts.allowed_issuers = Some(HashSet::from_iter(vec![issuer.to_string()]));
+    }
+
+    let attestation = ed25519_pub_key
+        .to_jwt_compatible_key()
+        .verify_token::<UpgradeModeAttestation>(token, Some(opts))
+        .map_err(|source| UpgradeModeCheckError::JwtVerificationFailure { source })?
+        .custom;
+
+    Ok(attestation)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::generate_new_attestation;
+    use nym_crypto::asymmetric::ed25519;
+
+    #[test]
+    fn generate_and_validate_jwt() {
+        let attestation_key = ed25519::PrivateKey::from_bytes(&[
+            108, 49, 193, 21, 126, 161, 249, 85, 242, 207, 74, 195, 238, 6, 64, 149, 201, 140, 248,
+            163, 122, 170, 79, 198, 87, 85, 36, 29, 243, 92, 64, 161,
+        ])
+        .unwrap();
+        let jwt_key = ed25519::PrivateKey::from_bytes(&[
+            152, 17, 144, 255, 213, 219, 246, 208, 109, 33, 100, 73, 1, 141, 32, 63, 141, 89, 167,
+            2, 52, 215, 241, 219, 200, 18, 159, 241, 76, 111, 42, 32,
+        ])
+        .unwrap();
+        let keys = ed25519::KeyPair::from(jwt_key);
+
+        let attestation = generate_new_attestation(&attestation_key);
+        let jwt_issuer = generate_jwt_for_upgrade_mode_attestation(
+            attestation,
+            Duration::from_secs(60 * 60),
+            &keys,
+            Some("nym-credential-proxy"),
+        );
+        // we expect 'nym-credential-proxy' issuer
+        assert!(validate_upgrade_mode_jwt(&jwt_issuer, Some("nym-credential-proxy")).is_ok());
+
+        // we don't care about issuer
+        assert!(validate_upgrade_mode_jwt(&jwt_issuer, None).is_ok());
+
+        // we expect another-issuer
+        assert!(validate_upgrade_mode_jwt(&jwt_issuer, Some("another-issuer")).is_err());
+
+        let jwt_no_issuer = generate_jwt_for_upgrade_mode_attestation(
+            attestation,
+            Duration::from_secs(60 * 60),
+            &keys,
+            None,
+        );
+        // we expect 'nym-credential-proxy' issuer
+        assert!(validate_upgrade_mode_jwt(&jwt_no_issuer, Some("nym-credential-proxy")).is_err());
+
+        // we don't care about issuer
+        assert!(validate_upgrade_mode_jwt(&jwt_no_issuer, None).is_ok());
+    }
+}
@@ -0,0 +1,13 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub(crate) mod attestation;
+pub(crate) mod error;
+pub(crate) mod jwt;
+
+pub use attestation::{
+    attempt_retrieve, generate_new_attestation, generate_new_attestation_with_starting_time,
+    UpgradeModeAttestation,
+};
+pub use error::UpgradeModeCheckError;
+pub use jwt::{generate_jwt_for_upgrade_mode_attestation, validate_upgrade_mode_jwt};
@@ -25,5 +25,3 @@ url = { workspace = true }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
 nym-task = { path = "../task" }
 nym-validator-client = { path = "../client-libs/validator-client" }
-nym-http-api-client = { path = "../http-api-client" }
-nym-api-requests = { path = "../../nym-api/nym-api-requests" }
@@ -10,7 +10,7 @@ use futures::StreamExt;
 use nym_crypto::asymmetric::ed25519;
 use nym_task::ShutdownToken;
 use nym_validator_client::models::NymNodeDescription;
-use nym_validator_client::nym_api::NymApiClientExt;
+use nym_validator_client::NymApiClient;
 use rand::prelude::SliceRandom;
 use rand::thread_rng;
 use std::net::SocketAddr;
@@ -135,17 +135,10 @@ impl VerlocMeasurer {
        let mut api_endpoints = self.config.nym_api_urls.clone();
        api_endpoints.shuffle(&mut thread_rng());
        for api_endpoint in api_endpoints {
-            let client =
-                match nym_http_api_client::Client::builder(api_endpoint.clone()).and_then(|b| {
-                    b.with_user_agent(self.config.user_agent.clone())
-                        .build::<nym_api_requests::models::RequestError>()
-                }) {
-                    Ok(c) => c,
-                    Err(err) => {
-                        warn!("failed to create client for {api_endpoint}: {err}");
-                        continue;
-                    }
-                };
+            let client = NymApiClient::new_with_user_agent(
+                api_endpoint.clone(),
+                self.config.user_agent.clone(),
+            );
            match client.get_all_described_nodes().await {
                Ok(res) => return Some(res),
                Err(err) => {
@@ -34,7 +34,6 @@ nym-statistics-common = { path = "../../statistics" }
 nym-task = { path = "../../task" }
 nym-topology = { path = "../../topology", features = ["wasm-serde-types"] }
 nym-validator-client = { path = "../../client-libs/validator-client", default-features = false }
-nym-http-api-client = { path = "../../http-api-client" }
 wasm-utils = { path = "../utils" }
 wasm-storage = { path = "../storage" }

@@ -37,12 +37,6 @@ pub enum WasmCoreError {
        source: ValidatorClientError,
    },

-    #[error("failed to query nym api: {source}")]
-    NymApiQueryError {
-        #[from]
-        source: nym_validator_client::nym_api::error::NymAPIError,
-    },
-
    #[error("The provided wasm topology was invalid: {source}")]
    WasmTopologyError {
        #[from]
@@ -19,9 +19,9 @@ use nym_client_core::init::{
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_topology::wasm_helpers::WasmFriendlyNymTopology;
-use nym_topology::{EpochRewardedSet, NymTopology, RoutingNode};
+use nym_topology::{NymTopology, RoutingNode};
 use nym_validator_client::client::IdentityKey;
-use nym_validator_client::{nym_api::NymApiClientExt, UserAgent};
+use nym_validator_client::{NymApiClient, UserAgent};
 use rand::thread_rng;
 use url::Url;
 use wasm_bindgen::prelude::wasm_bindgen;
@@ -72,19 +72,7 @@ pub async fn current_network_topology_async(
        }
    };

-    let api_client = nym_http_api_client::Client::builder::<
-        _,
-        nym_validator_client::models::RequestError,
-    >(url.clone())
-    .map_err(|_err| WasmCoreError::MalformedUrl {
-        raw: nym_api_url.to_string(),
-        source: url::ParseError::EmptyHost,
-    })?
-    .build::<nym_validator_client::models::RequestError>()
-    .map_err(|_err| WasmCoreError::MalformedUrl {
-        raw: nym_api_url.to_string(),
-        source: url::ParseError::EmptyHost,
-    })?;
+    let api_client = NymApiClient::new(url);
    let rewarded_set = api_client.get_current_rewarded_set().await?;
    let mixnodes_res = api_client
        .get_all_basic_active_mixing_assigned_nodes_with_metadata()
@@ -102,14 +90,9 @@ pub async fn current_network_topology_async(

    let gateways = gateways_res.nodes;

-    let epoch_rewarded_set: EpochRewardedSet = rewarded_set.into();
-    let topology = NymTopology::new(
-        metadata.to_topology_metadata(),
-        epoch_rewarded_set,
-        Vec::new(),
-    )
-    .with_skimmed_nodes(&mixnodes)
-    .with_skimmed_nodes(&gateways);
+    let topology = NymTopology::new(metadata.to_topology_metadata(), rewarded_set, Vec::new())
+        .with_skimmed_nodes(&mixnodes)
+        .with_skimmed_nodes(&gateways);

    Ok(topology.into())
 }
@@ -21,7 +21,6 @@ pub use nym_client_core::{
 pub use nym_gateway_client::{
    error::GatewayClientError, GatewayClient, GatewayClientConfig, GatewayConfig,
 };
-pub use nym_http_api_client::Client as ApiClient;
 pub use nym_sphinx::{
    addressing::{clients::Recipient, nodes::NodeIdentity},
    params::PacketType,
@@ -30,6 +29,7 @@ pub use nym_sphinx::{
 pub use nym_statistics_common::clients::ClientStatsSender;
 pub use nym_task;
 pub use nym_topology::{HardcodedTopologyProvider, MixLayer, NymTopology, TopologyProvider};
+pub use nym_validator_client::nym_api::Client as ApiClient;
 pub use nym_validator_client::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient};
 // TODO: that's a very nasty import path. it should come from contracts instead!
 pub use nym_validator_client::client::IdentityKey;
@@ -25,7 +25,7 @@
 //! ```

 use crate::error::ZulipClientError;
-use crate::message::{SendMessageResponse, SendableMessage};
+use crate::message::{DirectMessage, SendMessageResponse, SendableMessage, StreamMessage};
 use nym_bin_common::bin_info;
 use nym_http_api_client::UserAgent;
 use reqwest::{header, Method, RequestBuilder};
@@ -92,6 +92,20 @@ impl Client {
            .map_err(|source| ZulipClientError::RequestDecodeFailure { source })
    }

+    pub async fn send_direct_message(
+        &self,
+        msg: impl Into<DirectMessage>,
+    ) -> Result<SendMessageResponse, ZulipClientError> {
+        self.send_message(msg.into()).await
+    }
+
+    pub async fn send_channel_message(
+        &self,
+        msg: impl Into<StreamMessage>,
+    ) -> Result<SendMessageResponse, ZulipClientError> {
+        self.send_message(msg.into()).await
+    }
+
    fn build_request(&self, method: Method, endpoint: &'static str) -> RequestBuilder {
        let url = format!("{}{endpoint}", self.server_url);
        trace!("posting to {url}");
@@ -22,7 +22,7 @@ pub enum SendMessageResponse {
    },
 }

-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 #[serde(rename_all = "snake_case")]
 #[serde(tag = "type")]
 pub enum SendableMessageContent {
@@ -40,7 +40,7 @@ pub enum SendableMessageContent {
    },
 }

-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 #[serde(rename_all = "snake_case")]
 pub struct SendableMessage {
    #[serde(flatten)]
@@ -117,17 +117,17 @@ impl StreamMessage {
    pub fn new(
        to: impl Into<ToChannel>,
        content: impl Into<String>,
-        topic: Option<String>,
+        topic: impl IntoMaybeTopic,
    ) -> Self {
        StreamMessage {
            to: to.into().to_string(),
-            topic,
+            topic: topic.into_maybe_topic(),
            content: content.into(),
        }
    }

    pub fn no_topic(to: impl Into<ToChannel>, content: impl Into<String>) -> Self {
-        Self::new(to, content, None)
+        Self::new(to, content, None::<String>)
    }

    #[must_use]
@@ -194,22 +194,74 @@ impl From<StreamMessage> for SendableMessageContent {
    }
 }

-impl<T, S> From<(T, S, Option<S>)> for StreamMessage
+impl<T, S, U> From<(T, S, U)> for StreamMessage
 where
    T: Into<ToChannel>,
    S: Into<String>,
+    U: IntoMaybeTopic,
 {
-    fn from((to, content, topic): (T, S, Option<S>)) -> Self {
-        StreamMessage::new(to, content, topic.map(Into::into))
+    fn from((to, content, topic): (T, S, U)) -> Self {
+        StreamMessage::new(to, content, topic)
    }
 }

-impl<T, S> From<(T, S, Option<S>)> for SendableMessage
+impl<T, S> From<(T, S)> for StreamMessage
 where
    T: Into<ToChannel>,
    S: Into<String>,
 {
-    fn from(inner: (T, S, Option<S>)) -> Self {
+    fn from((to, content): (T, S)) -> Self {
+        StreamMessage::no_topic(to, content)
+    }
+}
+
+impl<T, S, U> From<(T, S, U)> for SendableMessage
+where
+    T: Into<ToChannel>,
+    S: Into<String>,
+    U: IntoMaybeTopic,
+{
+    fn from(inner: (T, S, U)) -> Self {
        StreamMessage::from(inner).into()
    }
 }
+
+pub trait IntoMaybeTopic {
+    fn into_maybe_topic(self) -> Option<String>;
+}
+
+impl<S> IntoMaybeTopic for &Option<S>
+where
+    S: Into<String> + Clone,
+{
+    fn into_maybe_topic(self) -> Option<String> {
+        self.clone().map(|s| s.into())
+    }
+}
+
+impl<S> IntoMaybeTopic for Option<S>
+where
+    S: Into<String>,
+{
+    fn into_maybe_topic(self) -> Option<String> {
+        self.map(Into::into)
+    }
+}
+
+impl IntoMaybeTopic for String {
+    fn into_maybe_topic(self) -> Option<String> {
+        Some(self)
+    }
+}
+
+impl IntoMaybeTopic for &String {
+    fn into_maybe_topic(self) -> Option<String> {
+        Some(self.clone())
+    }
+}
+
+impl IntoMaybeTopic for &str {
+    fn into_maybe_topic(self) -> Option<String> {
+        Some(self.to_string())
+    }
+}
@@ -744,7 +744,7 @@ version = "0.1.0"
 dependencies = [
 "cosmwasm-std",
 "quote",
- "syn 1.0.109",
+ "syn 2.0.98",
 ]

 [[package]]
@@ -139,9 +139,9 @@ mod tests {

    fn add_dummy_mixes_with_delegations(test: &mut TestSetup, delegators: usize, mixes: usize) {
        for i in 0..mixes {
-            let mix_id = test.add_legacy_mixnode(&test.make_addr(format!("mix-owner{i}")), None);
+            let mix_id = test.add_legacy_mixnode(&test.make_addr(format!("mix-owner{}", i)), None);
            for delegator in 0..delegators {
-                let name = &test.make_addr(format!("delegator{delegator}"));
+                let name = &test.make_addr(format!("delegator{}", delegator));
                test.add_immediate_delegation(name, 100_000_000u32, mix_id)
            }
        }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tommy Verrall	55a0f80d73	Feat: implement supply chain attack mitigation - Add yarn resolutions for vulnerable packages (chalk, strip-ansi, color-convert, etc.) - Add .npmrc and .nvmrc security configurations	2025-09-10 18:51:38 +02:00
Jędrzej Stuczyński	d3cdaf373b	Feature/credential proxy crate (#6018 ) * moved storage and deposits buffer to the common lib * move more of the state into the shared lib * extracted the rest of the features into the shared lib * fixed test imports * clippy	2025-09-10 09:28:38 +01:00
Jędrzej Stuczyński	7c5f10a219	refresh mixnet contract on epoch progression (#6023 )	2025-09-09 09:59:54 +01:00
Simon Wicky	f90fc4f2f0	Moving clients crate from vpn-client repo to here (#6015 ) * moving crates as is * changes due to crate moving * cargo fmt	2025-09-08 10:50:18 +02:00
Jędrzej Stuczyński	e95aca715c	feat: use `ShutdownToken` (`CancellationToken` inside) for nym-api (#5997 ) * make nym-api use ShutdownToken instead of TaskClient * ignore public-api tests if env is not set * removed default features to avoid pulling in openssl	2025-09-08 09:45:28 +01:00
Bogdan-Ștefan Neacşu	8e7d1d510d	Use default value for the ports until api is deployed (#6007 )	2025-09-04 15:55:56 +03:00
import this	4062734a31	[DOCs/operators]: NIP-2 tokenomics update & fix csv2md bug (#6008 )	2025-09-04 11:29:44 +02:00
import this	ccd8ff26a3	Feature: Delegation program stake checker and adjuster (#5980 ) * initialise stake adjustment program * add readme file with a simple guide * syntax * syntax * FINISHED: faster and returning more data * change dwl link to develop branch	2025-09-03 16:06:06 +00:00
import this	43d043a9cd	Feature: Nym node autorun CLI (#5916 ) * initial commit - add prereqs install script * add env vars prompt * automate latest binary url env var * add install node script * add modes to nym-node install script * start main cli framework * adding branch var for easier deployment and testing * add systemd config * add proxy and wss setup script * add landing page stub and fix nginx script * add nginx setup * fix typo * add checks for existing dir and wg prompt * add nginx commands * add service file check * add service file check * convention alignment * add checks to nginx setup * cleanup old code * add bonding prompt and nym node run fns * fix syntax * fix syntax * fix syntax * fix syntax * fix syntax * fix syntax * fix syntax * fix syntax * add service script to init * fix syntax * fix syntax * add chmod * fix script logic * syntax fix * syntax fix * silent mode trial * fix evn prompt script * make scripts interactive * indent fix * correct node-install script * initial mixnode setup working - gws need more love * fix bonding function * syntax fix * improve run noide as service script * improve service script * improve run service fn * fix logic * beautify * beautify * create run node as service script * syntax fix * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * attempt to resolve memory running out issue * setting wireguard * solved memory issues * rename landing page template * modify wireguard enabled fn * layout change * syntax fix * modify node setup script * sync up envs * return missing function * fix urls * fix network manager script execution * fix wss and nginx * fix layout * tweak WG contion * syntax fix * add init placeholder * syntax fix * redefine wireguard check logic * check if node exists * add argparse and dev option * styling * add panic * add error message * improve logic * improve logic * add arg * add dev arg for all levels * add confirmation loop * styling * fix bonding question * syntax edit * syntax edit * syntax edit * refactor for already bonded nodes * add default branch on top and define metavar * fix node install script * clean and prepare for review * indentation fix * fix nginx setup * fix nginx setup * style cleanup * fix try error logic * tune --dev option to run before command correctly * fix y/n convention across the modules * add explorer URL to the message * minor layout fixes	2025-09-02 20:34:24 +00:00
Drazen Urch	3d6cf730c2	NS-API: Cast to BIGINT to make i64 work (#6003 )	2025-09-02 18:35:25 +01:00
Jędrzej Stuczyński	c0f8d98b63	bugfix: return from MixTrafficController if client request channel has closed (#6002 )	2025-09-02 10:23:25 +01:00
Jędrzej Stuczyński	91995da4f1	chore: use updated version of simulate endpoint (#5988 )	2025-09-02 10:12:52 +01:00
Jędrzej Stuczyński	01fa1df66c	feat: shared library for attempting to retrieve update mode attestation (#5954 ) * feat: shared library for attempting to retrieve update mode attestation * clippy * add nym- prefix to the crate name * use pure-rust impl for jwt-simple	2025-09-02 09:28:32 +01:00
Jędrzej Stuczyński	baddaaac22	feat: nym signers monitor (#5933 ) * initialise nym-signers-monitor * creating nyxd client * performing checks * sending notifications on failure * rate limitting on notifications + clippy	2025-09-02 09:27:09 +01:00
elsirion	2c4b5f168b	fix: use WASM compatible time API in client (#5948 )	2025-09-02 09:26:06 +01:00
Bogdan-Ștefan Neacşu	a557ac22c7	Revert "Create an axum_test client for more integrated unit testing (#5956 )" (#5999 ) This reverts commit `efd61eb47c`.	2025-09-01 15:37:10 +03:00
Jędrzej Stuczyński	55ef89178b	chore: upgraded syn to 2.0 and removed nym-execute (#5998 )	2025-09-01 12:59:13 +01:00
Jędrzej Stuczyński	d97be2d8ef	bugfix: Recipient deserialisation for deserialisers missing bytes specialisation (#5991 ) * bugfix: Recipient deserialisation for deserialisers missing bytes specialisation for example toml or json will just default to visit_seq ignoring bytes related optimisations * clippy	2025-09-01 11:30:35 +01:00
Bogdan-Ștefan Neacşu	efd61eb47c	Create an axum_test client for more integrated unit testing (#5956 )	2025-09-01 13:27:06 +03:00
benedetta davico	4a01973b31	Merge pull request #5981 from nymtech/benny/ns-api-ci-fix Fix the ns api ci workflow	2025-09-01 11:02:21 +02:00
Mark Sinclair	9ad9c3b8e7	Bug fix: NS API monikers (#5990 ) * node-status-api: fix missing monikers because of deserialisation issues from unstructured data * node-status-api: bump version after bug fix monikers --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-09-01 09:48:37 +01:00
dependabot[bot]	6706500132	build(deps): bump pbkdf2 from 3.1.2 to 3.1.3 (#5869 ) Bumps [pbkdf2](https://github.com/crypto-browserify/pbkdf2) from 3.1.2 to 3.1.3. - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](https://github.com/crypto-browserify/pbkdf2/compare/v3.1.2...v3.1.3) --- updated-dependencies: - dependency-name: pbkdf2 dependency-version: 3.1.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 15:52:10 +01:00
dependabot[bot]	33fe059c28	Bump console from 0.15.11 to 0.16.0 (#5931 ) Bumps [console](https://github.com/console-rs/console) from 0.15.11 to 0.16.0. - [Release notes](https://github.com/console-rs/console/releases) - [Changelog](https://github.com/console-rs/console/blob/main/CHANGELOG.md) - [Commits](https://github.com/console-rs/console/compare/0.15.11...0.16.0) --- updated-dependencies: - dependency-name: console dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 14:24:03 +01:00
dependabot[bot]	d6ed2b770b	Bump indicatif from 0.17.11 to 0.18.0 (#5924 ) Bumps [indicatif](https://github.com/console-rs/indicatif) from 0.17.11 to 0.18.0. - [Release notes](https://github.com/console-rs/indicatif/releases) - [Commits](https://github.com/console-rs/indicatif/compare/0.17.11...0.18.0) --- updated-dependencies: - dependency-name: indicatif dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 14:23:39 +01:00
dependabot[bot]	7c18a3dced	Bump mock_instant from 0.5.3 to 0.6.0 (#5930 ) Bumps [mock_instant](https://github.com/museun/mock_instant) from 0.5.3 to 0.6.0. - [Commits](https://github.com/museun/mock_instant/commits/v0.6.0) --- updated-dependencies: - dependency-name: mock_instant dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 14:20:22 +01:00
dependabot[bot]	09475ab4e0	build(deps): bump mikefarah/yq from 4.45.4 to 4.47.1 (#5911 ) Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.45.4 to 4.47.1. - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](https://github.com/mikefarah/yq/compare/v4.45.4...v4.47.1) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-version: 4.47.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:36:39 +01:00
dependabot[bot]	b7606cd2ef	Bump defguard_wireguard_rs from v0.4.7 to v0.7.5 (#5928 ) Bumps [defguard_wireguard_rs](https://github.com/DefGuard/wireguard-rs) from v0.4.7 to v0.7.5. - [Release notes](https://github.com/DefGuard/wireguard-rs/releases) - [Commits](https://github.com/DefGuard/wireguard-rs/compare/ef1cf3714629bf5016fb38cbb7320451dc69fb09...d090d2249e5bb3d4154f07de098387e2ab69bfdc) --- updated-dependencies: - dependency-name: defguard_wireguard_rs dependency-version: d090d2249e5bb3d4154f07de098387e2ab69bfdc dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:35:42 +01:00
dependabot[bot]	006a57312d	Bump tokio from 1.46.1 to 1.47.1 (#5929 ) Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.46.1 to 1.47.1. - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.46.1...tokio-1.47.1) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.47.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:35:18 +01:00
dependabot[bot]	9b5aded8a5	build(deps): bump actions/download-artifact from 4 to 5 (#5939 ) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:33:31 +01:00
dependabot[bot]	f4a69636fe	build(deps): bump actions/first-interaction from 1 to 3 (#5950 ) Bumps [actions/first-interaction](https://github.com/actions/first-interaction) from 1 to 3. - [Release notes](https://github.com/actions/first-interaction/releases) - [Commits](https://github.com/actions/first-interaction/compare/v1...v3) --- updated-dependencies: - dependency-name: actions/first-interaction dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:31:29 +01:00
dependabot[bot]	0463d88646	Bump slab from 0.4.10 to 0.4.11 (#5952 ) Bumps [slab](https://github.com/tokio-rs/slab) from 0.4.10 to 0.4.11. - [Release notes](https://github.com/tokio-rs/slab/releases) - [Changelog](https://github.com/tokio-rs/slab/blob/master/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/slab/compare/v0.4.10...v0.4.11) --- updated-dependencies: - dependency-name: slab dependency-version: 0.4.11 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:31:02 +01:00
dependabot[bot]	534bf5d824	build(deps): bump actions/setup-java from 4 to 5 (#5975 ) Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4 to 5. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:30:00 +01:00
dependabot[bot]	34684b14db	Bump sha.js from 2.4.11 to 2.4.12 (#5983 ) Bumps [sha.js](https://github.com/crypto-browserify/sha.js) from 2.4.11 to 2.4.12. - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/crypto-browserify/sha.js/compare/v2.4.11...v2.4.12) --- updated-dependencies: - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-08-29 13:29:18 +01:00
benedettadavico	66d0296f47	update dockerfile to pg	2025-08-26 16:02:11 +02:00
benedettadavico	03bbbf44e9	ns api ci fix	2025-08-26 16:02:11 +02:00