attempt to fix unwrap

fixed beta clippy: lints + updated cosmwasm to 1.4

.github/actions/nym-hash-releases/action.yml

@@ -14,12 +14,20 @@ inputs:
     description: 'The tag/release to process. Uses the release id when trigger from a release.'
     required: false
     default: ''
+  repo:
+    description: 'The repo to use. Defaults to "nym".'
+    required: false
+    default: 'nym'
+  owner:
+    description: 'The repo owner to use. Defaults to "nymtech".'
+    required: false
+    default: 'nymtech'
 outputs:
   hashes:
     description: 'A string containing JSON with the release asset hashes and signatures'
 runs:
-  using: 'node16'
-  main: 'index.js'
+  using: 'node20'
+  main: 'dist/index.js'
 branding:
   icon: 'hash'
   color: 'green'

.github/actions/nym-hash-releases/dist/37.index.js

@@ -0,0 +1,450 @@
+export const id = 37;
+export const ids = [37];
+export const modules = {
+
+/***/ 4037:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   "toFormData": () => (/* binding */ toFormData)
+/* harmony export */ });
+/* harmony import */ var fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2777);
+/* harmony import */ var formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8010);
+
+
+
+let s = 0;
+const S = {
+	START_BOUNDARY: s++,
+	HEADER_FIELD_START: s++,
+	HEADER_FIELD: s++,
+	HEADER_VALUE_START: s++,
+	HEADER_VALUE: s++,
+	HEADER_VALUE_ALMOST_DONE: s++,
+	HEADERS_ALMOST_DONE: s++,
+	PART_DATA_START: s++,
+	PART_DATA: s++,
+	END: s++
+};
+
+let f = 1;
+const F = {
+	PART_BOUNDARY: f,
+	LAST_BOUNDARY: f *= 2
+};
+
+const LF = 10;
+const CR = 13;
+const SPACE = 32;
+const HYPHEN = 45;
+const COLON = 58;
+const A = 97;
+const Z = 122;
+
+const lower = c => c | 0x20;
+
+const noop = () => {};
+
+class MultipartParser {
+	/**
+	 * @param {string} boundary
+	 */
+	constructor(boundary) {
+		this.index = 0;
+		this.flags = 0;
+
+		this.onHeaderEnd = noop;
+		this.onHeaderField = noop;
+		this.onHeadersEnd = noop;
+		this.onHeaderValue = noop;
+		this.onPartBegin = noop;
+		this.onPartData = noop;
+		this.onPartEnd = noop;
+
+		this.boundaryChars = {};
+
+		boundary = '\r\n--' + boundary;
+		const ui8a = new Uint8Array(boundary.length);
+		for (let i = 0; i < boundary.length; i++) {
+			ui8a[i] = boundary.charCodeAt(i);
+			this.boundaryChars[ui8a[i]] = true;
+		}
+
+		this.boundary = ui8a;
+		this.lookbehind = new Uint8Array(this.boundary.length + 8);
+		this.state = S.START_BOUNDARY;
+	}
+
+	/**
+	 * @param {Uint8Array} data
+	 */
+	write(data) {
+		let i = 0;
+		const length_ = data.length;
+		let previousIndex = this.index;
+		let {lookbehind, boundary, boundaryChars, index, state, flags} = this;
+		const boundaryLength = this.boundary.length;
+		const boundaryEnd = boundaryLength - 1;
+		const bufferLength = data.length;
+		let c;
+		let cl;
+
+		const mark = name => {
+			this[name + 'Mark'] = i;
+		};
+
+		const clear = name => {
+			delete this[name + 'Mark'];
+		};
+
+		const callback = (callbackSymbol, start, end, ui8a) => {
+			if (start === undefined || start !== end) {
+				this[callbackSymbol](ui8a && ui8a.subarray(start, end));
+			}
+		};
+
+		const dataCallback = (name, clear) => {
+			const markSymbol = name + 'Mark';
+			if (!(markSymbol in this)) {
+				return;
+			}
+
+			if (clear) {
+				callback(name, this[markSymbol], i, data);
+				delete this[markSymbol];
+			} else {
+				callback(name, this[markSymbol], data.length, data);
+				this[markSymbol] = 0;
+			}
+		};
+
+		for (i = 0; i < length_; i++) {
+			c = data[i];
+
+			switch (state) {
+				case S.START_BOUNDARY:
+					if (index === boundary.length - 2) {
+						if (c === HYPHEN) {
+							flags |= F.LAST_BOUNDARY;
+						} else if (c !== CR) {
+							return;
+						}
+
+						index++;
+						break;
+					} else if (index - 1 === boundary.length - 2) {
+						if (flags & F.LAST_BOUNDARY && c === HYPHEN) {
+							state = S.END;
+							flags = 0;
+						} else if (!(flags & F.LAST_BOUNDARY) && c === LF) {
+							index = 0;
+							callback('onPartBegin');
+							state = S.HEADER_FIELD_START;
+						} else {
+							return;
+						}
+
+						break;
+					}
+
+					if (c !== boundary[index + 2]) {
+						index = -2;
+					}
+
+					if (c === boundary[index + 2]) {
+						index++;
+					}
+
+					break;
+				case S.HEADER_FIELD_START:
+					state = S.HEADER_FIELD;
+					mark('onHeaderField');
+					index = 0;
+					// falls through
+				case S.HEADER_FIELD:
+					if (c === CR) {
+						clear('onHeaderField');
+						state = S.HEADERS_ALMOST_DONE;
+						break;
+					}
+
+					index++;
+					if (c === HYPHEN) {
+						break;
+					}
+
+					if (c === COLON) {
+						if (index === 1) {
+							// empty header field
+							return;
+						}
+
+						dataCallback('onHeaderField', true);
+						state = S.HEADER_VALUE_START;
+						break;
+					}
+
+					cl = lower(c);
+					if (cl < A || cl > Z) {
+						return;
+					}
+
+					break;
+				case S.HEADER_VALUE_START:
+					if (c === SPACE) {
+						break;
+					}
+
+					mark('onHeaderValue');
+					state = S.HEADER_VALUE;
+					// falls through
+				case S.HEADER_VALUE:
+					if (c === CR) {
+						dataCallback('onHeaderValue', true);
+						callback('onHeaderEnd');
+						state = S.HEADER_VALUE_ALMOST_DONE;
+					}
+
+					break;
+				case S.HEADER_VALUE_ALMOST_DONE:
+					if (c !== LF) {
+						return;
+					}
+
+					state = S.HEADER_FIELD_START;
+					break;
+				case S.HEADERS_ALMOST_DONE:
+					if (c !== LF) {
+						return;
+					}
+
+					callback('onHeadersEnd');
+					state = S.PART_DATA_START;
+					break;
+				case S.PART_DATA_START:
+					state = S.PART_DATA;
+					mark('onPartData');
+					// falls through
+				case S.PART_DATA:
+					previousIndex = index;
+
+					if (index === 0) {
+						// boyer-moore derrived algorithm to safely skip non-boundary data
+						i += boundaryEnd;
+						while (i < bufferLength && !(data[i] in boundaryChars)) {
+							i += boundaryLength;
+						}
+
+						i -= boundaryEnd;
+						c = data[i];
+					}
+
+					if (index < boundary.length) {
+						if (boundary[index] === c) {
+							if (index === 0) {
+								dataCallback('onPartData', true);
+							}
+
+							index++;
+						} else {
+							index = 0;
+						}
+					} else if (index === boundary.length) {
+						index++;
+						if (c === CR) {
+							// CR = part boundary
+							flags |= F.PART_BOUNDARY;
+						} else if (c === HYPHEN) {
+							// HYPHEN = end boundary
+							flags |= F.LAST_BOUNDARY;
+						} else {
+							index = 0;
+						}
+					} else if (index - 1 === boundary.length) {
+						if (flags & F.PART_BOUNDARY) {
+							index = 0;
+							if (c === LF) {
+								// unset the PART_BOUNDARY flag
+								flags &= ~F.PART_BOUNDARY;
+								callback('onPartEnd');
+								callback('onPartBegin');
+								state = S.HEADER_FIELD_START;
+								break;
+							}
+						} else if (flags & F.LAST_BOUNDARY) {
+							if (c === HYPHEN) {
+								callback('onPartEnd');
+								state = S.END;
+								flags = 0;
+							} else {
+								index = 0;
+							}
+						} else {
+							index = 0;
+						}
+					}
+
+					if (index > 0) {
+						// when matching a possible boundary, keep a lookbehind reference
+						// in case it turns out to be a false lead
+						lookbehind[index - 1] = c;
+					} else if (previousIndex > 0) {
+						// if our boundary turned out to be rubbish, the captured lookbehind
+						// belongs to partData
+						const _lookbehind = new Uint8Array(lookbehind.buffer, lookbehind.byteOffset, lookbehind.byteLength);
+						callback('onPartData', 0, previousIndex, _lookbehind);
+						previousIndex = 0;
+						mark('onPartData');
+
+						// reconsider the current character even so it interrupted the sequence
+						// it could be the beginning of a new sequence
+						i--;
+					}
+
+					break;
+				case S.END:
+					break;
+				default:
+					throw new Error(`Unexpected state entered: ${state}`);
+			}
+		}
+
+		dataCallback('onHeaderField');
+		dataCallback('onHeaderValue');
+		dataCallback('onPartData');
+
+		// Update properties for the next call
+		this.index = index;
+		this.state = state;
+		this.flags = flags;
+	}
+
+	end() {
+		if ((this.state === S.HEADER_FIELD_START && this.index === 0) ||
+			(this.state === S.PART_DATA && this.index === this.boundary.length)) {
+			this.onPartEnd();
+		} else if (this.state !== S.END) {
+			throw new Error('MultipartParser.end(): stream ended unexpectedly');
+		}
+	}
+}
+
+function _fileName(headerValue) {
+	// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+	const m = headerValue.match(/\bfilename=("(.*?)"|([^()<>@,;:\\"/[\]?={}\s\t]+))($|;\s)/i);
+	if (!m) {
+		return;
+	}
+
+	const match = m[2] || m[3] || '';
+	let filename = match.slice(match.lastIndexOf('\\') + 1);
+	filename = filename.replace(/%22/g, '"');
+	filename = filename.replace(/&#(\d{4});/g, (m, code) => {
+		return String.fromCharCode(code);
+	});
+	return filename;
+}
+
+async function toFormData(Body, ct) {
+	if (!/multipart/i.test(ct)) {
+		throw new TypeError('Failed to fetch');
+	}
+
+	const m = ct.match(/boundary=(?:"([^"]+)"|([^;]+))/i);
+
+	if (!m) {
+		throw new TypeError('no or bad content-type header, no multipart boundary');
+	}
+
+	const parser = new MultipartParser(m[1] || m[2]);
+
+	let headerField;
+	let headerValue;
+	let entryValue;
+	let entryName;
+	let contentType;
+	let filename;
+	const entryChunks = [];
+	const formData = new formdata_polyfill_esm_min_js__WEBPACK_IMPORTED_MODULE_1__/* .FormData */ .Ct();
+
+	const onPartData = ui8a => {
+		entryValue += decoder.decode(ui8a, {stream: true});
+	};
+
+	const appendToFile = ui8a => {
+		entryChunks.push(ui8a);
+	};
+
+	const appendFileToFormData = () => {
+		const file = new fetch_blob_from_js__WEBPACK_IMPORTED_MODULE_0__/* .File */ .$B(entryChunks, filename, {type: contentType});
+		formData.append(entryName, file);
+	};
+
+	const appendEntryToFormData = () => {
+		formData.append(entryName, entryValue);
+	};
+
+	const decoder = new TextDecoder('utf-8');
+	decoder.decode();
+
+	parser.onPartBegin = function () {
+		parser.onPartData = onPartData;
+		parser.onPartEnd = appendEntryToFormData;
+
+		headerField = '';
+		headerValue = '';
+		entryValue = '';
+		entryName = '';
+		contentType = '';
+		filename = null;
+		entryChunks.length = 0;
+	};
+
+	parser.onHeaderField = function (ui8a) {
+		headerField += decoder.decode(ui8a, {stream: true});
+	};
+
+	parser.onHeaderValue = function (ui8a) {
+		headerValue += decoder.decode(ui8a, {stream: true});
+	};
+
+	parser.onHeaderEnd = function () {
+		headerValue += decoder.decode();
+		headerField = headerField.toLowerCase();
+
+		if (headerField === 'content-disposition') {
+			// matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+			const m = headerValue.match(/\bname=("([^"]*)"|([^()<>@,;:\\"/[\]?={}\s\t]+))/i);
+
+			if (m) {
+				entryName = m[2] || m[3] || '';
+			}
+
+			filename = _fileName(headerValue);
+
+			if (filename) {
+				parser.onPartData = appendToFile;
+				parser.onPartEnd = appendFileToFormData;
+			}
+		} else if (headerField === 'content-type') {
+			contentType = headerValue;
+		}
+
+		headerValue = '';
+		headerField = '';
+	};
+
+	for await (const chunk of Body) {
+		parser.write(chunk);
+	}
+
+	parser.end();
+
+	return formData;
+}
+
+
+/***/ })
+
+};

.github/actions/nym-hash-releases/dist/thread.js

@@ -0,0 +1,57 @@
+'use strict';
+const fs = require('fs');
+const crypto = require('crypto');
+const {parentPort} = require('worker_threads');
+
+const handlers = {
+	hashFile: (algorithm, filePath) => new Promise((resolve, reject) => {
+		const hasher = crypto.createHash(algorithm);
+		fs.createReadStream(filePath)
+			// TODO: Use `Stream.pipeline` when targeting Node.js 12.
+			.on('error', reject)
+			.pipe(hasher)
+			.on('error', reject)
+			.on('finish', () => {
+				const {buffer} = new Uint8Array(hasher.read());
+				resolve({value: buffer, transferList: [buffer]});
+			});
+	}),
+	hash: async (algorithm, input) => {
+		const hasher = crypto.createHash(algorithm);
+
+		if (Array.isArray(input)) {
+			for (const part of input) {
+				hasher.update(part);
+			}
+		} else {
+			hasher.update(input);
+		}
+
+		const {buffer} = new Uint8Array(hasher.digest());
+		return {value: buffer, transferList: [buffer]};
+	}
+};
+
+parentPort.on('message', async message => {
+	try {
+		const {method, args} = message;
+		const handler = handlers[method];
+
+		if (handler === undefined) {
+			throw new Error(`Unknown method '${method}'`);
+		}
+
+		const {value, transferList} = await handler(...args);
+		parentPort.postMessage({id: message.id, value}, transferList);
+	} catch (error) {
+		const newError = {message: error.message, stack: error.stack};
+
+		for (const [key, value] of Object.entries(error)) {
+			if (typeof value !== 'object') {
+				newError[key] = value;
+			}
+		}
+
+		parentPort.postMessage({id: message.id, error: newError});
+	}
+});

.github/actions/nym-hash-releases/index.js

@@ -1,15 +0,0 @@
-import core from "@actions/core";
-import github from "@actions/github";
-import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
-
-const algorithm = core.getInput('hash-type');
-const filename = core.getInput("file-name");
-
-// use the release id from the payload if it is set
-const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
-
-try {
-    await createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm, filename  })
-} catch (error) {
-    core.setFailed(error.message);
-}

.github/actions/nym-hash-releases/package.json

@@ -2,17 +2,6 @@
   "name": "nym-hash-release",
   "version": "1.0.0",
   "description": "Generate hashes and signatures for assets in Nym releases",
-  "main": "index.js",
-  "type": "module",
-  "scripts": {
-    "local": "node run-local.mjs"
-  },
-  "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
-    "@octokit/auth-action": "^4.0.0",
-    "@octokit/rest": "^20.0.1",
-    "hasha": "^5.2.0",
-    "node-fetch": "^3.2.10"
-  }
+  "main": "dist/index.js",
+  "type": "module"
 }

.github/actions/nym-hash-releases/run-local.mjs

@@ -1,6 +0,0 @@
-import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
-
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
-await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});

.github/actions/nym-hash-releases/src/README.md

@@ -0,0 +1,14 @@
+# nym-hash-release
+
+This is the source code for the custom GitHub Action to calculate hashes.
+
+It is in a subdirectory to avoid issues with `package.json`.
+
+## Build
+
+The following will bundle all code and dependencies into the `dist` folder, and copy it into place for GitHub Actions.
+
+```
+npm run build
+npm run dist:copy
+```

.github/actions/nym-hash-releases/src/create-hashes.mjs

@@ -11,10 +11,14 @@ function getBinInfo(path) {
         let mode = fs.statSync(path).mode
         fs.chmodSync(path, mode | 0o111)
 
-        const raw = execSync(`${path} build-info --output=json`, { stdio: 'pipe', encoding: "utf8" });
+        const cmd = `${path} build-info --output=json`;
+        console.log(`🚚 Running ${cmd}... (for max of 3 seconds, then SIGTERM)`);
+        const raw = execSync(cmd, { stdio: 'pipe', encoding: "utf8", timeout: 3000 });
         const parsed = JSON.parse(raw)
+        console.log(`    ✅ ok`);
         return parsed
     } catch (_) {
+        console.log(`    ❌ failed`);
         return undefined
     }
 }
@@ -24,8 +28,11 @@ async function run(assets, algorithm, filename, cache) {
         console.warn("cache is set to 'false', but we we no longer support it")
     }
 
+    const directory = path.join(process.env.RUNNER_TEMP || '.tmp', process.env.GITHUB_RUN_ID || '');
+    console.log('Temporary directory: ', directory);
+
     try {
-        fs.mkdirSync('.tmp');
+        fs.mkdirSync(directory, { recursive: true });
     } catch(e) {
         // ignore
     }
@@ -40,13 +47,13 @@ async function run(assets, algorithm, filename, cache) {
             let sig = null;
 
             // cache in `${WORKING_DIR}/.tmp/`
-            const cacheFilename = path.resolve(`.tmp/${asset.name}`);
+            const cacheFilename = path.join(directory, `${asset.name}`);
             if(!fs.existsSync(cacheFilename)) {
-                console.log(`Downloading ${asset.browser_download_url}... to ${cacheFilename}`);
+                console.log(`⬇️ Downloading ${asset.browser_download_url}... to ${cacheFilename} [${numAwaiting} of ${assets.length}]`);
                 buffer = Buffer.from(await fetch(asset.browser_download_url).then(res => res.arrayBuffer()));
                 fs.writeFileSync(cacheFilename, buffer);
             } else {
-                console.log(`Loading from ${cacheFilename}`);
+                console.log(`💾 Loading from ${cacheFilename}`);
                 buffer = Buffer.from(fs.readFileSync(cacheFilename));
 
                 // console.log('Reading signature from content');
@@ -131,6 +138,7 @@ async function run(assets, algorithm, filename, cache) {
             }
         }
     }
+    console.log(`Completed hashing ${assets.length} files`);
     return hashes;
 }
 
@@ -142,7 +150,7 @@ export async function createHashes({ assets, algorithm, filename, cache }) {
     return output;
 }
 
-export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true }) {
+export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrId, algorithm = 'sha256', filename = 'hashes.json', cache = false, upload = true, owner = 'nymtech', repo = 'nym' }) {
     console.log("🚀🚀🚀 Getting releases");
 
     let auth;
@@ -157,8 +165,6 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
         auth: process.env.GITHUB_TOKEN,
         request: { fetch }
     });
-    const owner = "nymtech";
-    const repo = "nym";
 
     let releases;
     if(cache) {
@@ -212,7 +218,14 @@ export async function createHashesFromReleaseTagOrNameOrId({ releaseTagOrNameOrI
 
     releasesToProcess.forEach(release => {
         const {tag_name, name} = release;
-        const tagComponents = tag_name.split('-v');
+        const matches = tag_name.match(/(\S+)-v([0-9]+\.[0-9]+(\.\S+)?)/);
+
+        if(!matches || matches.length < 2) {
+            console.warn('Could not match version structure in tag name = ', tag_name);
+            return;
+        }
+
+        const tagComponents = matches.slice(1);
         const componentName = tagComponents[0];
         const componentVersion = 'v' + tagComponents[1];
 

.github/actions/nym-hash-releases/src/index.js

@@ -0,0 +1,21 @@
+import core from "@actions/core";
+import github from "@actions/github";
+import { createHashesFromReleaseTagOrNameOrId } from './create-hashes.mjs';
+
+const algorithm = core.getInput('hash-type');
+const filename = core.getInput("file-name");
+const owner = core.getInput("owner");
+const repo = core.getInput("repo");
+
+async function main() {
+// use the release id from the payload if it is set
+    const releaseTagOrNameOrId = core.getInput("release-tag-or-name-or-id") || github.context.payload.release?.id;
+
+    try {
+        await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId, algorithm, filename, owner, repo})
+    } catch (error) {
+        core.setFailed(error.message);
+    }
+}
+
+main().catch(error => core.setFailed(error.message));

.github/actions/nym-hash-releases/src/package-lock.json

@@ -1,26 +1,28 @@
 {
-  "name": "ghaction-generate-release-hashes",
+  "name": "nym-hash-release",
   "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "ghaction-generate-release-hashes",
+      "name": "nym-hash-release",
       "version": "1.0.0",
-      "license": "MIT",
       "dependencies": {
-        "@actions/core": "^1.10.0",
+        "@actions/core": "^1.10.1",
         "@actions/github": "^5.1.1",
-        "@octokit/auth-action": "^4.0.0",
-        "@octokit/rest": "^20.0.1",
+        "@octokit/auth-action": "^4.0.1",
+        "@octokit/rest": "^20.0.2",
         "hasha": "^5.2.0",
         "node-fetch": "^3.2.10"
+      },
+      "devDependencies": {
+        "@vercel/ncc": "^0.38.1"
       }
     },
     "node_modules/@actions/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
+      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
       "dependencies": {
         "@actions/http-client": "^2.0.1",
         "uuid": "^8.3.2"
@@ -46,12 +48,12 @@
       }
     },
     "node_modules/@octokit/auth-action": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.0.tgz",
-      "integrity": "sha512-sMm9lWZdiX6e89YFaLrgE9EFs94k58BwIkvjOtozNWUqyTmsrnWFr/M5LolaRzZ7Kmb5FbhF9hi7FEeE274SoQ==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-action/-/auth-action-4.0.1.tgz",
+      "integrity": "sha512-mJLOcFFafIivLZ7BEkGDCTFoHPJv7BeL5Zwy7j5qMDU0b/DKshhi6GCU9tw3vmKhOxTNquYfvwqsEfPpemaaxg==",
       "dependencies": {
         "@octokit/auth-token": "^4.0.0",
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.0.0"
       },
       "engines": {
         "node": ">= 18"
@@ -66,16 +68,16 @@
       }
     },
     "node_modules/@octokit/auth-action/node_modules/@octokit/openapi-types": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-18.0.0.tgz",
-      "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
     },
     "node_modules/@octokit/auth-action/node_modules/@octokit/types": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-11.1.0.tgz",
-      "integrity": "sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==",
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
       "dependencies": {
-        "@octokit/openapi-types": "^18.0.0"
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/auth-token": {
@@ -191,14 +193,14 @@
       }
     },
     "node_modules/@octokit/rest": {
-      "version": "20.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.1.tgz",
-      "integrity": "sha512-wROV21RwHQIMNb2Dgd4+pY+dVy1Dwmp85pBrgr6YRRDYRBu9Gb+D73f4Bl2EukZSj5hInq2Tui9o7gAQpc2k2Q==",
+      "version": "20.0.2",
+      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.2.tgz",
+      "integrity": "sha512-Ux8NDgEraQ/DMAU1PlAohyfBBXDwhnX2j33Z1nJNziqAfHi70PuxkFYIcIt8aIAxtRE7KVuKp8lSR8pA0J5iOQ==",
       "dependencies": {
         "@octokit/core": "^5.0.0",
-        "@octokit/plugin-paginate-rest": "^8.0.0",
+        "@octokit/plugin-paginate-rest": "^9.0.0",
         "@octokit/plugin-request-log": "^4.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "^9.0.0"
+        "@octokit/plugin-rest-endpoint-methods": "^10.0.0"
       },
       "engines": {
         "node": ">= 18"
@@ -261,17 +263,30 @@
       "integrity": "sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw=="
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-8.0.0.tgz",
-      "integrity": "sha512-2xZ+baZWUg+qudVXnnvXz7qfrTmDeYPCzangBVq/1gXxii/OiS//4shJp9dnCCvj1x+JAm9ji1Egwm1BA47lPQ==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.1.tgz",
+      "integrity": "sha512-wfGhE/TAkXZRLjksFXuDZdmGnJQHvtU/joFQdweXUgzo1XwvBCD4o4+75NtFfjfLK5IwLf9vHTfSiU3sLRYpRw==",
       "dependencies": {
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
         "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-request-log": {
@@ -286,17 +301,30 @@
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-9.0.0.tgz",
-      "integrity": "sha512-KquMF/VB1IkKNiVnzJKspY5mFgGyLd7HzdJfVEGTJFzqu9BRFNWt+nwTCMuUiWc72gLQhRWYubTwOkQj+w/1PA==",
+      "version": "10.4.1",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
+      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
       "dependencies": {
-        "@octokit/types": "^11.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
         "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=5"
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+    },
+    "node_modules/@octokit/rest/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
+      "version": "12.6.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "dependencies": {
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@octokit/rest/node_modules/@octokit/request": {
@@ -343,6 +371,15 @@
         "@octokit/openapi-types": "^12.11.0"
       }
     },
+    "node_modules/@vercel/ncc": {
+      "version": "0.38.1",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.1.tgz",
+      "integrity": "sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==",
+      "dev": true,
+      "bin": {
+        "ncc": "dist/ncc/cli.js"
+      }
+    },
     "node_modules/before-after-hook": {
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",

.github/actions/nym-hash-releases/src/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "nym-hash-release",
+  "version": "1.0.0",
+  "description": "Generate hashes and signatures for assets in Nym releases",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "local": "node run-local.mjs",
+    "build": "ncc build index.js -o dist",
+    "dist:copy": "mkdir -p ../dist && cp dist/*.js ../dist"
+  },
+  "dependencies": {
+    "@actions/core": "^1.10.1",
+    "@actions/github": "^5.1.1",
+    "@octokit/auth-action": "^4.0.1",
+    "@octokit/rest": "^20.0.2",
+    "hasha": "^5.2.0",
+    "node-fetch": "^3.2.10"
+  },
+  "devDependencies": {
+    "@vercel/ncc": "^0.38.1"
+  }
+}

.github/actions/nym-hash-releases/src/run-local.mjs

@@ -0,0 +1,11 @@
+import {createHashesFromReleaseTagOrNameOrId} from './create-hashes.mjs';
+
+const cache = true;
+
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-binaries-v2024.1-marabou', cache, upload: false});
+await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-vpn-desktop-v0.0.8', cache, upload: false, repo: 'nym-vpn-client'});
+
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 119065724, cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: '119065724', cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'nym-connect-v1.1.19-snickers', cache: true, upload: false});
+// await createHashesFromReleaseTagOrNameOrId({releaseTagOrNameOrId: 'Nym Connect v1.1.19-snickers', cache: true, upload: false});

.github/workflows/build-upload-binaries.yml

@@ -1,61 +0,0 @@
-name: build-upload-binaries
-
-on:
-  workflow_dispatch:
-    inputs:
-      add_tokio_unstable:
-        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
-        required: true
-        default: false
-        type: boolean
-
-env:
-  NETWORK: mainnet
-
-jobs:
-  publish-nym:
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [ubuntu-20.04]
-
-    runs-on: ${{ matrix.platform }}
-    env:
-      CARGO_TERM_COLOR: always
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
-        continue-on-error: true
-
-      - name: Sets env vars for tokio if set in manual dispatch inputs
-        run: |
-          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
-        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
-
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-
-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --release
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: nym-binaries-artifacts
-          path: |
-            target/release/nym-client
-            target/release/nym-gateway
-            target/release/nym-mixnode
-            target/release/nym-socks5-client
-            target/release/nym-api
-            target/release/nym-network-requester
-            target/release/nym-network-statistics
-            target/release/nym-cli
-          retention-days: 30

.github/workflows/ci-build-upload-binaries.yml

@@ -2,20 +2,40 @@ name: ci-build-upload-binaries
 
 on:
   workflow_dispatch:
+    inputs:
+      add_tokio_unstable:
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
+        default: false
+        type: boolean
+      enable_wireguard:
+        description: "Add --features wireguard"
+        required: true
+        default: false
+        type: boolean
+      enable_deb:
+        description: "True to enable cargo-deb installation and .deb package building"
+        required: false
+        default: false
+        type: boolean
+  schedule:
+    - cron: "14 0 * * *"
   pull_request:
     paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/ts-rs-cli/**'
+      - "clients/**"
+      - "common/**"
+      - "explorer-api/**"
+      - "gateway/**"
+      - "integrations/**"
+      - "mixnode/**"
+      - "nym-api/**"
+      - "nym-node/**"
+      - "nym-outfox/**"
+      - "nym-validator-rewarder/**"
+      - "sdk/rust/nym-sdk/**"
+      - "service-providers/**"
+      - "tools/**"
+      - "nymvisor/**"
 
 jobs:
   publish-nym:
@@ -42,6 +62,18 @@ jobs:
       - name: Install Dependencies (Linux)
         run: sudo apt update && sudo apt install libudev-dev
 
+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        run: |
+          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
+
+      - name: Set CARGO_FEATURES
+        run: |
+          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
+        if: >
+          github.event_name == 'schedule' ||
+          (github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true)
+
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -51,9 +83,41 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --workspace --release
+          args: --workspace --release ${{ env.CARGO_FEATURES }}
+
+      - name: Install cargo-deb
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-deb
+        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
+
+      - name: Build deb packages
+        shell: bash
+        run: make deb
+        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
+
+      - name: Upload Artifact
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@v3
+        with:
+          name: nym-binaries-artifacts
+          path: |
+            target/release/nym-client
+            target/release/nym-gateway
+            target/release/nym-mixnode
+            target/release/nym-socks5-client
+            target/release/nym-api
+            target/release/nym-network-requester
+            target/release/nym-network-statistics
+            target/release/nym-cli
+            target/release/nymvisor
+          retention-days: 30
+
+      # If this was a pull_request or nightly, upload to build server
 
       - name: Prepare build output
+        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
         shell: bash
         env:
           OUTPUT_DIR: ci-builds/${{ github.ref_name }}
@@ -65,8 +129,12 @@ jobs:
           cp target/release/nym-api $OUTPUT_DIR
           cp target/release/nym-network-requester $OUTPUT_DIR
           cp target/release/nym-network-statistics $OUTPUT_DIR
+          cp target/release/nymvisor $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR
           cp target/release/explorer-api $OUTPUT_DIR
+          if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
+            cp target/debian/*.deb $OUTPUT_DIR
+          fi
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/ci-cargo-deny.yml

@@ -1,5 +1,8 @@
 name: ci-cargo-deny
-on: [workflow_dispatch]
+on:
+  workflow_dispatch:
+  pull_request:
+
 jobs:
   cargo-deny:
     runs-on: ubuntu-22.04
@@ -7,10 +10,7 @@ jobs:
       matrix:
         checks:
           # - advisories
-          - licenses
-          - bans sources
-
-    continue-on-error: ${{ matrix.checks == 'licenses' }}
+          - licenses bans sources
 
     steps:
     - uses: actions/checkout@v3

.github/workflows/ci-contracts-upload-binaries.yml

@@ -60,7 +60,6 @@ jobs:
           cp contracts/target/wasm32-unknown-unknown/release/cw4_group.wasm $OUTPUT_DIR
           cp contracts/target/wasm32-unknown-unknown/release/nym_service_provider_directory.wasm $OUTPUT_DIR
           cp contracts/target/wasm32-unknown-unknown/release/nym_name_service.wasm $OUTPUT_DIR
-          cp contracts/target/wasm32-unknown-unknown/release/nym_ephemera.wasm $OUTPUT_DIR
 
       - name: Deploy branch to CI www
         continue-on-error: true

.github/workflows/ci-nym-api-tests.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: install yarn in root
-        run: cd ../.. yarn install
+        run: cd ../.. && yarn install
 
       - name: Install npm
         run: npm install

.github/workflows/publish-nym-binaries.yml

@@ -1,4 +1,4 @@
-name: Publish Nym binaries
+name: publish-nym-binaries
 
 on:
   workflow_dispatch:
@@ -29,6 +29,7 @@ jobs:
       client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
       mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
       gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
+      nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -36,6 +37,7 @@ jobs:
       client_version: ${{ steps.binary-versions.outputs.client_version }}
       mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
       gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
+      nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -78,6 +80,7 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
+            target/release/nymvisor
           retention-days: 30
 
       - id: create-release
@@ -95,6 +98,7 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
+            target/release/nymvisor
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

.github/workflows/publish-nym-connect-macos.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (MacOS)
+name: publish-nym-connect-macos
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-connect-ubuntu.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Ubuntu)
+name: publish-nym-connect-ubuntu
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-connect-win10.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Windows 10)
+name: publish-nym-connect-win10
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-contracts.yml

@@ -1,4 +1,4 @@
-name: Build release of Nym smart contracts
+name: publish-nym-contracts
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-macos.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (MacOS)
+name: publish-nym-wallet-macos
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Ubuntu)
+name: publish-nym-wallet-ubuntu
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-nym-wallet-win10.yml

@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Windows 10)
+name: publish-nym-wallet-win10
 on:
   workflow_dispatch:
   release:

.github/workflows/publish-sdk-npm.yml

@@ -1,4 +1,4 @@
-name: Publish Typescript SDK
+name: publish-sdk-npm
 on:
   workflow_dispatch:
 

.github/workflows/release-calculate-hash.yml

@@ -1,4 +1,4 @@
-name: Releases - calculate file hashes
+name: release-calculate-hash
 
 on:
   workflow_call:
@@ -8,8 +8,8 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    release_tag:
-      tag:
+    inputs:
+      release_tag:
         description: 'Release tag'
         required: true
         type: string
@@ -24,10 +24,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18
-      - name: Install packages
-        run: cd ./.github/actions/nym-hash-releases && npm i
-
-      - uses: ./.github/actions/nym-hash-releases
+      - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

CHANGELOG.md

@@ -4,6 +4,23 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.1-marabou] (2024-02-15)
+
+**New Features:**
+- Introduced nymvisor support for nym-api, gateway, and mixnode binaries ([#4158])
+- Revamped nym-api execution with the addition of init and run commands ([#4225])
+
+**Enhancements:**
+- Implemented internal improvements for gateways to optimize internal packet routing
+- Improved routing score calculation
+
+**Bug Fixes:**
+- Resolved various bugs to enhance overall stability
+
+[#4158]: https://github.com/nymtech/nym/pull/4158
+[#4225]: https://github.com/nymtech/nym/pull/4225
+
+
 ## [2023.5-rolo] (2023-11-28)
 
 - Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])

Cargo.toml

@@ -24,16 +24,17 @@ members = [
     "common/bandwidth-controller",
     "common/bin-common",
     "common/client-core",
+    "common/client-core/surb-storage",
+    "common/client-core/gateways-storage",
     "common/client-libs/gateway-client",
     "common/client-libs/mixnet-client",
     "common/client-libs/validator-client",
-    "common/coconut-interface",
     "common/commands",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
-    "common/cosmwasm-smart-contracts/ephemera",
+    #    "common/cosmwasm-smart-contracts/ephemera",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
@@ -43,6 +44,7 @@ members = [
     "common/credential-storage",
     "common/credentials",
     "common/credential-utils",
+    "common/credentials-interface",
     "common/crypto",
     "common/dkg",
     "common/execute",
@@ -56,6 +58,8 @@ members = [
     "common/node-tester-utils",
     "common/nonexhaustive-delayqueue",
     "common/nymcoconut",
+    "common/nym-id",
+    "common/nym-metrics",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -104,15 +108,17 @@ members = [
     "nym-outfox",
     "nym-validator-rewarder",
     "tools/internal/ssl-inject",
-    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
     "tools/nym-cli",
+    "tools/nym-id-cli",
     "tools/nym-nr-query",
     "tools/nymvisor",
     "tools/ts-rs-cli",
     "wasm/client",
-#    "wasm/full-nym-wasm",
+    #    "wasm/full-nym-wasm",
     "wasm/mix-fetch",
     "wasm/node-tester",
+    "common/nym-metrics",
 ]
 
 default-members = [
@@ -128,7 +134,16 @@ default-members = [
     "nym-validator-rewarder",
 ]
 
-exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles"]
+exclude = [
+    "explorer",
+    "contracts",
+    "nym-wallet",
+    "nym-connect/mobile/src-tauri",
+    "nym-connect/desktop",
+    "nym-vpn/ui/src-tauri",
+    "cpu-cycles",
+    "sdk/ffi/cpp",
+]
 
 [workspace.package]
 authors = ["Nym Technologies SA"]
@@ -143,6 +158,7 @@ anyhow = "1.0.71"
 async-trait = "0.1.68"
 axum = "0.6.20"
 base64 = "0.21.4"
+bs58 = "0.5.0"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 clap = "4.4.7"
 cfg-if = "1.0.0"
@@ -158,7 +174,7 @@ log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = "0.11.22"
+reqwest = { version = "0.11.22", default-features = false }
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -168,7 +184,7 @@ time = "0.3.30"
 thiserror = "1.0.48"
 tokio = "1.33.0"
 tokio-util = "0.7.10"
-tokio-tungstenite = "0.20.1"
+tokio-tungstenite = { version = "0.20.1" }
 tracing = "0.1.37"
 tungstenite = { version = "0.20.1", default-features = false }
 ts-rs = "7.0.0"
@@ -177,37 +193,39 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"
 
+prometheus = { version = "0.13.0" }
+
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch ="feature/gt-serialization-0.8.0" }
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", branch = "feature/gt-serialization-0.8.0" }
 group = "0.13.0"
 ff = "0.13.0"
 
 
 # cosmwasm-related
-cosmwasm-derive = "=1.3.0"
-cosmwasm-schema = "=1.3.0"
-cosmwasm-std = "=1.3.0"
-# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
+cosmwasm-derive = "=1.4.3"
+cosmwasm-schema = "=1.4.3"
+cosmwasm-std = "=1.4.3"
+# use 0.5.0 as that's the version used by cosmwasm-std 1.4.3
 # (and ideally we don't want to pull the same dependency twice)
 serde-json-wasm = "=0.5.0"
-cosmwasm-storage = "=1.3.0"
+cosmwasm-storage = "=1.4.3"
 # same version as used by cosmwasm
 cw-utils = "=1.0.1"
-cw-storage-plus = "=1.1.0"
-cw2 = { version = "=1.1.0" }
-cw3 = { version = "=1.1.0" }
-cw4 = { version = "=1.1.0" }
+cw-storage-plus = "=1.2.0"
+cw2 = { version = "=1.1.2" }
+cw3 = { version = "=1.1.2" }
+cw4 = { version = "=1.1.2" }
 cw-controllers = { version = "=1.1.0" }
 
 # cosmrs-related
 bip32 = "0.5.1"
 
 # temporarily using a fork again (yay.) because we need staking and slashing support
-cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch ="nym-temp/all-validator-features" }
+cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" }
 #cosmrs = {  git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" } # unfortuntely we need a fork by yours truly to get the staking support
-tendermint = "0.34" # same version as used by cosmrs
+tendermint = "0.34"     # same version as used by cosmrs
 tendermint-rpc = "0.34" # same version as used by cosmrs
 prost = "0.12"
 

Makefile

@@ -12,6 +12,7 @@ help:
 	@echo "  clippy: run clippy for all workspaces"
 	@echo "  test: run clippy, unit tests, and formatting."
 	@echo "  test-all: like test, but also includes the expensive tests"
+	@echo "  deb: build debian packages
 
 # -----------------------------------------------------------------------------
 # Meta targets
@@ -157,6 +158,12 @@ build-explorer-api:
 build-nym-cli:
 	cargo build -p nym-cli --release
 
+build-nym-gateway:
+	cargo build -p nym-gateway --release
+
+build-nym-mixnode:
+	cargo build -p nym-mixnode --release
+
 # -----------------------------------------------------------------------------
 # Misc
 # -----------------------------------------------------------------------------
@@ -169,6 +176,13 @@ run-api-tests:
 	cd nym-api/tests/functional_test && yarn test:qa
 
 # Build debian package, and update PPA
-# Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
-deb:
-	scripts/ppa.sh
+deb-mixnode: build-nym-mixnode
+	cargo deb -p nym-mixnode 
+
+deb-gateway: build-nym-gateway
+	cargo deb -p nym-gateway
+
+deb-cli: build-nym-cli
+	cargo deb -p nym-cli
+
+deb: deb-mixnode deb-gateway deb-cli

clients/native/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "nym-client"
-version = "1.1.32"
+version = "1.1.33"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
-rust-version = "1.65"
+rust-version = "1.70"
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -21,24 +21,24 @@ futures = { workspace = true } # bunch of futures stuff, however, now that I thi
 # and the single instance of abortable we have should really be refactored anyway
 url = { workspace = true }
 
+bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
 dirs = "4.0"
-lazy_static = "1.4.0"
 log = { workspace = true } # self explanatory
-pretty_env_logger = "0.4" # for formatting log messages
 rand = { version = "0.7.3", features = ["wasm-bindgen"] } # rng-related traits + some rng implementation to use
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 tap = "1.0.1"
+time = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "net", "signal"] } # async runtime
 tokio-tungstenite = { workspace = true }
+zeroize = { workspace = true }
 
 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
-nym-coconut-interface = { path = "../../common/coconut-interface" }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "fs-gateways-storage", "cli"] }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }
 nym-credentials = { path = "../../common/credentials" }
@@ -51,5 +51,6 @@ nym-task = { path = "../../common/task" }
 nym-topology = { path = "../../common/topology" }
 nym-validator-client = { path = "../../common/client-libs/validator-client", features = ["http-client"] }
 nym-client-websocket-requests = { path = "websocket-requests" }
+nym-id = { path = "../../common/nym-id" }
 
 [dev-dependencies]

clients/native/examples/js-examples/websocket/package-lock.json

@@ -1667,9 +1667,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.4",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
-      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
       "dev": true,
       "funding": [
         {
@@ -1705,9 +1705,9 @@
       }
     },
     "node_modules/fs-monkey": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
-      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
+      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
       "dev": true
     },
     "node_modules/fs.realpath": {
@@ -2160,9 +2160,9 @@
       }
     },
     "node_modules/ip": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
-      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
+      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
       "dev": true
     },
     "node_modules/ipaddr.js": {
@@ -2430,12 +2430,12 @@
       }
     },
     "node_modules/memfs": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
-      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
+      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
       "dev": true,
       "dependencies": {
-        "fs-monkey": "1.0.3"
+        "fs-monkey": "^1.0.4"
       },
       "engines": {
         "node": ">= 4.0.0"
@@ -4047,13 +4047,13 @@
       }
     },
     "node_modules/webpack-dev-middleware": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
-      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
+      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
       "dev": true,
       "dependencies": {
         "colorette": "^2.0.10",
-        "memfs": "^3.4.1",
+        "memfs": "^3.4.3",
         "mime-types": "^2.1.31",
         "range-parser": "^1.2.1",
         "schema-utils": "^4.0.0"
@@ -5800,9 +5800,9 @@
       }
     },
     "follow-redirects": {
-      "version": "1.15.4",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
-      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
+      "version": "1.15.6",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+      "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
       "dev": true
     },
     "forwarded": {
@@ -5818,9 +5818,9 @@
       "dev": true
     },
     "fs-monkey": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
-      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.5.tgz",
+      "integrity": "sha512-8uMbBjrhzW76TYgEV27Y5E//W2f/lTFmx78P2w19FZSxarhI/798APGQyuGCwmkNxgwGRhrLfvWyLBvNtuOmew==",
       "dev": true
     },
     "fs.realpath": {
@@ -6157,9 +6157,9 @@
       "dev": true
     },
     "ip": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.5.tgz",
-      "integrity": "sha1-vd7XARQpCCjAoDnnLvJfWq7ENUo=",
+      "version": "1.1.9",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.9.tgz",
+      "integrity": "sha512-cyRxvOEpNHNtchU3Ln9KC/auJgup87llfQpQ+t5ghoC/UhL16SWzbueiCsdTnWmqAWl7LadfuwhlqmtOaqMHdQ==",
       "dev": true
     },
     "ipaddr.js": {
@@ -6346,12 +6346,12 @@
       "dev": true
     },
     "memfs": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.1.tgz",
-      "integrity": "sha512-1c9VPVvW5P7I85c35zAdEr1TD5+F11IToIHIlrVIcflfnzPkJa0ZoYEoEdYDP8KgPFoSZ/opDrUsAoZWym3mtw==",
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
+      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
       "dev": true,
       "requires": {
-        "fs-monkey": "1.0.3"
+        "fs-monkey": "^1.0.4"
       }
     },
     "merge-descriptors": {
@@ -7547,13 +7547,13 @@
       }
     },
     "webpack-dev-middleware": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.1.tgz",
-      "integrity": "sha512-81EujCKkyles2wphtdrnPg/QqegC/AtqNH//mQkBYSMqwFVCQrxM6ktB2O/SPlZy7LqeEfTbV3cZARGQz6umhg==",
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
+      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
       "dev": true,
       "requires": {
         "colorette": "^2.0.10",
-        "memfs": "^3.4.1",
+        "memfs": "^3.4.3",
         "mime-types": "^2.1.31",
         "range-parser": "^1.2.1",
         "schema-utils": "^4.0.0"

clients/native/src/client/config/mod.rs

@@ -4,7 +4,7 @@
 use crate::client::config::persistence::ClientPaths;
 use crate::client::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::cli_helpers::client_init::ClientConfig;
+use nym_client_core::cli_helpers::CliClientConfig;
 use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
 use nym_config::{
@@ -19,11 +19,12 @@ use std::path::{Path, PathBuf};
 use std::str::FromStr;
 
 pub use nym_client_core::config::Config as BaseClientConfig;
-pub use nym_client_core::config::{DebugConfig, GatewayEndpointConfig};
+pub use nym_client_core::config::DebugConfig;
 
 pub mod old_config_v1_1_13;
 pub mod old_config_v1_1_20;
 pub mod old_config_v1_1_20_2;
+pub mod old_config_v1_1_33;
 mod persistence;
 mod template;
 
@@ -74,7 +75,7 @@ impl NymConfigTemplate for Config {
     }
 }
 
-impl ClientConfig for Config {
+impl CliClientConfig for Config {
     fn common_paths(&self) -> &CommonClientPaths {
         &self.storage_paths.common_paths
     }

clients/native/src/client/config/old_config_v1_1_20.rs

@@ -5,8 +5,8 @@ use crate::client::config::old_config_v1_1_20_2::{
     ClientPathsV1_1_20_2, ConfigV1_1_20_2, SocketTypeV1_1_20_2, SocketV1_1_20_2,
 };
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::config::disk_persistence::keys_paths::ClientKeysPaths;
 use nym_client_core::config::disk_persistence::old_v1_1_20_2::CommonClientPathsV1_1_20_2;
+use nym_client_core::config::disk_persistence::old_v1_1_33::ClientKeysPathsV1_1_33;
 use nym_client_core::config::old_config_v1_1_20::ConfigV1_1_20 as BaseConfigV1_1_20;
 use nym_client_core::config::old_config_v1_1_20_2::{
     ClientV1_1_20_2, ConfigV1_1_20_2 as BaseConfigV1_1_20_2,
@@ -60,7 +60,7 @@ impl From<ConfigV1_1_20> for ConfigV1_1_20_2 {
             socket: value.socket.into(),
             storage_paths: ClientPathsV1_1_20_2 {
                 common_paths: CommonClientPathsV1_1_20_2 {
-                    keys: ClientKeysPaths {
+                    keys: ClientKeysPathsV1_1_33 {
                         private_identity_key_file: value.base.client.private_identity_key_file,
                         public_identity_key_file: value.base.client.public_identity_key_file,
                         private_encryption_key_file: value.base.client.private_encryption_key_file,

clients/native/src/client/config/old_config_v1_1_20_2.rs

@@ -1,18 +1,15 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::{
-    client::config::{
-        default_config_filepath, persistence::ClientPaths, Config, Socket, SocketType,
-    },
-    error::ClientError,
+use crate::client::config::old_config_v1_1_33::{
+    ClientPathsV1_1_33, ConfigV1_1_33, SocketTypeV1_1_33, SocketV1_1_33,
 };
-
+use crate::{client::config::default_config_filepath, error::ClientError};
 use nym_bin_common::logging::LoggingSettings;
 use nym_client_core::config::disk_persistence::old_v1_1_20_2::CommonClientPathsV1_1_20_2;
 use nym_client_core::config::old_config_v1_1_20_2::ConfigV1_1_20_2 as BaseConfigV1_1_20_2;
 use nym_client_core::config::old_config_v1_1_30::ConfigV1_1_30 as BaseConfigV1_1_30;
-use nym_client_core::config::GatewayEndpointConfig;
+use nym_client_core::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
 use nym_config::read_config_from_toml_file;
 use nym_network_defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
 use serde::{Deserialize, Serialize};
@@ -49,12 +46,12 @@ impl ConfigV1_1_20_2 {
 
     // in this upgrade, gateway endpoint configuration was moved out of the config file,
     // so its returned to be stored elsewhere.
-    pub fn upgrade(self) -> Result<(Config, GatewayEndpointConfig), ClientError> {
+    pub fn upgrade(self) -> Result<(ConfigV1_1_33, OldGatewayEndpointConfigV1_1_33), ClientError> {
         let gateway_details = self.base.client.gateway_endpoint.clone().into();
-        let config = Config {
+        let config = ConfigV1_1_33 {
             base: BaseConfigV1_1_30::from(self.base).into(),
             socket: self.socket.into(),
-            storage_paths: ClientPaths {
+            storage_paths: ClientPathsV1_1_33 {
                 common_paths: self.storage_paths.common_paths.upgrade_default()?,
             },
             logging: self.logging,
@@ -71,11 +68,11 @@ pub enum SocketTypeV1_1_20_2 {
     None,
 }
 
-impl From<SocketTypeV1_1_20_2> for SocketType {
+impl From<SocketTypeV1_1_20_2> for SocketTypeV1_1_33 {
     fn from(value: SocketTypeV1_1_20_2) -> Self {
         match value {
-            SocketTypeV1_1_20_2::WebSocket => SocketType::WebSocket,
-            SocketTypeV1_1_20_2::None => SocketType::None,
+            SocketTypeV1_1_20_2::WebSocket => SocketTypeV1_1_33::WebSocket,
+            SocketTypeV1_1_20_2::None => SocketTypeV1_1_33::None,
         }
     }
 }
@@ -88,9 +85,9 @@ pub struct SocketV1_1_20_2 {
     pub listening_port: u16,
 }
 
-impl From<SocketV1_1_20_2> for Socket {
+impl From<SocketV1_1_20_2> for SocketV1_1_33 {
     fn from(value: SocketV1_1_20_2) -> Self {
-        Socket {
+        SocketV1_1_33 {
             socket_type: value.socket_type.into(),
             host: value.host,
             listening_port: value.listening_port,

clients/native/src/client/config/old_config_v1_1_33.rs

@@ -0,0 +1,99 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::config::persistence::ClientPaths;
+use crate::client::config::{default_config_filepath, Config, Socket, SocketType};
+use crate::error::ClientError;
+use nym_bin_common::logging::LoggingSettings;
+use nym_client_core::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
+use nym_client_core::config::old_config_v1_1_33::ConfigV1_1_33 as BaseConfigV1_1_33;
+use nym_config::read_config_from_toml_file;
+use nym_network_defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
+use serde::{Deserialize, Serialize};
+use std::io;
+use std::net::{IpAddr, Ipv4Addr};
+use std::path::Path;
+
+#[derive(Debug, Deserialize, PartialEq, Eq, Serialize, Clone)]
+pub struct ClientPathsV1_1_33 {
+    #[serde(flatten)]
+    pub common_paths: CommonClientPathsV1_1_33,
+}
+
+#[derive(Debug, Deserialize, PartialEq, Serialize)]
+pub struct ConfigV1_1_33 {
+    #[serde(flatten)]
+    pub base: BaseConfigV1_1_33,
+
+    pub socket: SocketV1_1_33,
+
+    // \/ CHANGED
+    pub storage_paths: ClientPathsV1_1_33,
+    // /\ CHANGED
+    pub logging: LoggingSettings,
+}
+
+impl ConfigV1_1_33 {
+    pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
+        read_config_from_toml_file(path)
+    }
+
+    pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
+        Self::read_from_toml_file(default_config_filepath(id))
+    }
+
+    pub fn try_upgrade(self) -> Result<Config, ClientError> {
+        Ok(Config {
+            base: self.base.into(),
+            socket: self.socket.into(),
+            storage_paths: ClientPaths {
+                common_paths: self.storage_paths.common_paths.upgrade_default()?,
+            },
+            logging: self.logging,
+        })
+    }
+}
+
+#[derive(Debug, Deserialize, PartialEq, Eq, Serialize, Clone, Copy)]
+#[serde(deny_unknown_fields)]
+pub enum SocketTypeV1_1_33 {
+    WebSocket,
+    None,
+}
+
+impl From<SocketTypeV1_1_33> for SocketType {
+    fn from(value: SocketTypeV1_1_33) -> Self {
+        match value {
+            SocketTypeV1_1_33::WebSocket => SocketType::WebSocket,
+            SocketTypeV1_1_33::None => SocketType::None,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, PartialEq, Eq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct SocketV1_1_33 {
+    pub socket_type: SocketTypeV1_1_33,
+    pub host: IpAddr,
+    pub listening_port: u16,
+}
+
+impl From<SocketV1_1_33> for Socket {
+    fn from(value: SocketV1_1_33) -> Self {
+        Socket {
+            socket_type: value.socket_type.into(),
+            host: value.host,
+            listening_port: value.listening_port,
+        }
+    }
+}
+
+impl Default for SocketV1_1_33 {
+    fn default() -> Self {
+        SocketV1_1_33 {
+            socket_type: SocketTypeV1_1_33::WebSocket,
+            host: IpAddr::V4(Ipv4Addr::LOCALHOST),
+            listening_port: DEFAULT_WEBSOCKET_LISTENING_PORT,
+        }
+    }
+}

clients/native/src/client/config/template.rs

@@ -50,10 +50,6 @@ keys.private_encryption_key_file = '{{ storage_paths.keys.private_encryption_key
 # Path to file containing public encryption key.
 keys.public_encryption_key_file = '{{ storage_paths.keys.public_encryption_key_file }}'
 
-# A gateway specific, optional, base58 stringified shared key used for
-# communication with particular gateway.
-keys.gateway_shared_key_file = '{{ storage_paths.keys.gateway_shared_key_file }}'
-
 # Path to file containing key used for encrypting and decrypting the content of an
 # acknowledgement so that nobody besides the client knows which packet it refers to.
 keys.ack_key_file = '{{ storage_paths.keys.ack_key_file }}'
@@ -64,9 +60,9 @@ credentials_database = '{{ storage_paths.credentials_database }}'
 # Path to the persistent store for received reply surbs, unused encryption keys and used sender tags.
 reply_surb_database = '{{ storage_paths.reply_surb_database }}'
 
-# Path to the file containing information about gateway used by this client,
-# i.e. details such as its public key, owner address or the network information.
-gateway_details = '{{ storage_paths.gateway_details }}'
+# Path to the file containing information about gateways used by this client,
+# i.e. details such as their public keys, owner addresses or the network information.
+gateway_registrations = '{{ storage_paths.gateway_registrations }}'
 
 ##### socket config options #####
 

clients/native/src/commands/add_gateway.rs

@@ -0,0 +1,30 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_add_gateway::{add_gateway, CommonClientAddGatewayArgs};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonClientAddGatewayArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonClientAddGatewayArgs> for Args {
+    fn as_ref(&self) -> &CommonClientAddGatewayArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    let output = args.output;
+    let res = add_gateway::<CliNativeClient, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}

clients/native/src/commands/import_credential.rs

@@ -0,0 +1,12 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_import_credential::{
+    import_credential, CommonClientImportCredentialArgs,
+};
+
+pub(crate) async fn execute(args: CommonClientImportCredentialArgs) -> Result<(), ClientError> {
+    import_credential::<CliNativeClient, _>(args).await
+}

clients/native/src/commands/init.rs

@@ -4,7 +4,7 @@
 use crate::client::config::{
     default_config_directory, default_config_filepath, default_data_directory,
 };
-use crate::commands::try_upgrade_config;
+use crate::commands::CliNativeClient;
 use crate::{
     client::config::Config,
     commands::{override_config, OverrideConfig},
@@ -21,17 +21,8 @@ use std::fs;
 use std::net::IpAddr;
 use std::path::PathBuf;
 
-struct NativeClientInit;
-
-impl InitialisableClient for NativeClientInit {
-    const NAME: &'static str = "native";
-    type Error = ClientError;
+impl InitialisableClient for CliNativeClient {
     type InitArgs = Init;
-    type Config = Config;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
-        try_upgrade_config(id)
-    }
 
     fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
         fs::create_dir_all(default_data_directory(id))?;
@@ -51,7 +42,7 @@ impl InitialisableClient for NativeClientInit {
     }
 }
 
-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
     #[command(flatten)]
     common_args: CommonClientInitArgs,
@@ -124,7 +115,7 @@ pub(crate) async fn execute(args: Init) -> Result<(), ClientError> {
     eprintln!("Initialising client...");
 
     let output = args.output;
-    let res = initialise_client::<NativeClientInit>(args).await?;
+    let res = initialise_client::<CliNativeClient>(args).await?;
 
     let init_results = InitResults::new(res);
     println!("{}", output.format(&init_results));

clients/native/src/commands/list_gateways.rs

@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_list_gateways::{
+    list_gateways, CommonClientListGatewaysArgs,
+};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonClientListGatewaysArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonClientListGatewaysArgs> for Args {
+    fn as_ref(&self) -> &CommonClientListGatewaysArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    let output = args.output;
+    let res = list_gateways::<CliNativeClient, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}

clients/native/src/commands/mod.rs

@@ -4,35 +4,49 @@
 use crate::client::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::client::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::client::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
+use crate::client::config::old_config_v1_1_33::ConfigV1_1_33;
 use crate::client::config::{BaseClientConfig, Config};
 use crate::error::ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
-use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::client::base_client::storage::gateway_details::{
-    OnDiskGatewayDetails, PersistedGatewayDetails,
-};
-use nym_client_core::client::key_manager::persistence::OnDiskKeys;
-use nym_client_core::config::GatewayEndpointConfig;
-use nym_client_core::error::ClientCoreError;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
+use nym_client_core::cli_helpers::CliClient;
+use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_config::OptionalSet;
 use std::error::Error;
 use std::net::IpAddr;
+use std::sync::OnceLock;
 
+mod add_gateway;
 pub(crate) mod build_info;
+pub(crate) mod import_credential;
 pub(crate) mod init;
+mod list_gateways;
 pub(crate) mod run;
+mod switch_gateway;
 
-lazy_static! {
-    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
+pub(crate) struct CliNativeClient;
+
+impl CliClient for CliNativeClient {
+    const NAME: &'static str = "native";
+    type Error = ClientError;
+    type Config = Config;
+
+    async fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
+        try_upgrade_config(id).await
+    }
+
+    async fn try_load_current_config(id: &str) -> Result<Self::Config, Self::Error> {
+        try_load_current_config(id).await
+    }
 }
 
-// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    &PRETTY_BUILD_INFORMATION
+    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
+    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
 }
 
 #[derive(Parser)]
@@ -58,6 +72,18 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
+    /// Import a pre-generated credential
+    ImportCredential(CommonClientImportCredentialArgs),
+
+    /// List all registered with gateways
+    ListGateways(list_gateways::Args),
+
+    /// Add new gateway to this client
+    AddGateway(add_gateway::Args),
+
+    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
+    SwitchGateway(switch_gateway::Args),
+
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -86,6 +112,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
+        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::ListGateways(args) => list_gateways::execute(args).await?,
+        Commands::AddGateway(args) => add_gateway::execute(args).await?,
+        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -121,29 +151,7 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
         )
 }
 
-fn persist_gateway_details(
-    config: &Config,
-    details: GatewayEndpointConfig,
-) -> Result<(), ClientError> {
-    let details_store =
-        OnDiskGatewayDetails::new(&config.storage_paths.common_paths.gateway_details);
-    let keys_store = OnDiskKeys::new(config.storage_paths.common_paths.keys.clone());
-    let shared_keys = keys_store.ephemeral_load_gateway_keys().map_err(|source| {
-        ClientError::ClientCoreError(ClientCoreError::KeyStoreError {
-            source: Box::new(source),
-        })
-    })?;
-    let persisted_details = PersistedGatewayDetails::new(details.into(), Some(&shared_keys))?;
-    details_store
-        .store_to_disk(&persisted_details)
-        .map_err(|source| {
-            ClientError::ClientCoreError(ClientCoreError::GatewayDetailsStoreError {
-                source: Box::new(source),
-            })
-        })
-}
-
-fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {
+async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {
     use nym_config::legacy_helpers::nym_config::MigrationNymConfig;
 
     // explicitly load it as v1.1.13 (which is incompatible with the next step, i.e. 1.1.19)
@@ -157,14 +165,22 @@ fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, ClientError> {
 
     let updated_step1: ConfigV1_1_20 = old_config.into();
     let updated_step2: ConfigV1_1_20_2 = updated_step1.into();
-    let (updated, gateway_config) = updated_step2.upgrade()?;
-    persist_gateway_details(&updated, gateway_config)?;
+    let (updated_step3, gateway_config) = updated_step2.upgrade()?;
+    let old_paths = updated_step3.storage_paths.clone();
+    let updated = updated_step3.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
 
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, ClientError> {
+async fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, ClientError> {
     use nym_config::legacy_helpers::nym_config::MigrationNymConfig;
 
     // explicitly load it as v1.1.20 (which is incompatible with the current one, i.e. +1.1.21)
@@ -177,14 +193,21 @@ fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, ClientError> {
     info!("It is going to get updated to the current specification.");
 
     let updated_step1: ConfigV1_1_20_2 = old_config.into();
-    let (updated, gateway_config) = updated_step1.upgrade()?;
-    persist_gateway_details(&updated, gateway_config)?;
+    let (updated_step2, gateway_config) = updated_step1.upgrade()?;
+    let old_paths = updated_step2.storage_paths.clone();
+    let updated = updated_step2.try_upgrade()?;
 
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, ClientError> {
+async fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, ClientError> {
     // explicitly load it as v1.1.20_2 (which is incompatible with the current one, i.e. +1.1.21)
     let Ok(old_config) = ConfigV1_1_20_2::read_from_default_path(id) else {
         // if we failed to load it, there might have been nothing to upgrade
@@ -194,28 +217,62 @@ fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, ClientError> {
     info!("It seems the client is using <= v1.1.20_2 config template.");
     info!("It is going to get updated to the current specification.");
 
-    let (updated, gateway_config) = old_config.upgrade()?;
-    persist_gateway_details(&updated, gateway_config)?;
+    let (updated_step1, gateway_config) = old_config.upgrade()?;
+    let old_paths = updated_step1.storage_paths.clone();
+    let updated = updated_step1.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
+    updated.save_to_default_location()?;
+    Ok(true)
+}
+
+async fn try_upgrade_v1_1_33_config(id: &str) -> Result<bool, ClientError> {
+    // explicitly load it as v1.1.33 (which is incompatible with the current one, i.e. +1.1.34)
+    let Ok(old_config) = ConfigV1_1_33::read_from_default_path(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(false);
+    };
+    info!("It seems the client is using <= v1.1.33 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let old_paths = old_config.storage_paths.clone();
+    let updated = old_config.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        None,
+    )
+    .await?;
 
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_config(id: &str) -> Result<(), ClientError> {
-    if try_upgrade_v1_1_13_config(id)? {
+async fn try_upgrade_config(id: &str) -> Result<(), ClientError> {
+    if try_upgrade_v1_1_13_config(id).await? {
         return Ok(());
     }
-    if try_upgrade_v1_1_20_config(id)? {
+    if try_upgrade_v1_1_20_config(id).await? {
         return Ok(());
     }
-    if try_upgrade_v1_1_20_2_config(id)? {
+    if try_upgrade_v1_1_20_2_config(id).await? {
+        return Ok(());
+    }
+    if try_upgrade_v1_1_33_config(id).await? {
         return Ok(());
     }
 
     Ok(())
 }
 
-fn try_load_current_config(id: &str) -> Result<Config, ClientError> {
+async fn try_load_current_config(id: &str) -> Result<Config, ClientError> {
     // try to load the config as is
     if let Ok(cfg) = Config::read_from_default_path(id) {
         return if !cfg.validate() {
@@ -226,7 +283,7 @@ fn try_load_current_config(id: &str) -> Result<Config, ClientError> {
     }
 
     // we couldn't load it - try upgrading it from older revisions
-    try_upgrade_config(id)?;
+    try_upgrade_config(id).await?;
 
     let config = match Config::read_from_default_path(id) {
         Ok(cfg) => cfg,
@@ -246,7 +303,6 @@ fn try_load_current_config(id: &str) -> Result<Config, ClientError> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use clap::CommandFactory;
 
     #[test]
     fn verify_cli() {

clients/native/src/commands/run.rs

@@ -69,7 +69,7 @@ fn version_check(cfg: &Config) -> bool {
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync>> {
     eprintln!("Starting client {}...", args.common_args.id);
 
-    let mut config = try_load_current_config(&args.common_args.id)?;
+    let mut config = try_load_current_config(&args.common_args.id).await?;
     config = override_config(config, OverrideConfig::from(args.clone()));
 
     if !version_check(&config) {

clients/native/src/commands/switch_gateway.rs

@@ -0,0 +1,24 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_client_core::cli_helpers::client_switch_gateway::{
+    switch_gateway, CommonClientSwitchGatewaysArgs,
+};
+
+#[derive(clap::Args, Clone, Debug)]
+pub struct Args {
+    #[command(flatten)]
+    common_args: CommonClientSwitchGatewaysArgs,
+}
+
+impl AsRef<CommonClientSwitchGatewaysArgs> for Args {
+    fn as_ref(&self) -> &CommonClientSwitchGatewaysArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    switch_gateway::<CliNativeClient, _>(args).await
+}

clients/native/src/error.rs

@@ -1,11 +1,13 @@
 use nym_client_core::error::ClientCoreError;
 
+use nym_id::NymIdError;
+
 #[derive(thiserror::Error, Debug)]
 pub enum ClientError {
     #[error("I/O error: {0}")]
     IoError(#[from] std::io::Error),
 
-    #[error("client-core error: {0}")]
+    #[error(transparent)]
     ClientCoreError(#[from] ClientCoreError),
 
     #[error("Failed to load config for: {0}")]
@@ -20,4 +22,7 @@ pub enum ClientError {
 
     #[error("Attempted to start the client in invalid socket mode")]
     InvalidSocketMode,
+
+    #[error(transparent)]
+    NymIdError(#[from] NymIdError),
 }

clients/native/websocket-requests/src/requests.rs

@@ -8,7 +8,7 @@ use crate::error::{self, ErrorKind};
 use crate::text::ClientRequestText;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, SENDER_TAG_SIZE};
-use std::convert::{TryFrom, TryInto};
+
 use std::mem::size_of;
 
 #[repr(u8)]

clients/native/websocket-requests/src/responses.rs

@@ -9,7 +9,7 @@ use crate::text::ServerResponseText;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::{AnonymousSenderTag, SENDER_TAG_SIZE};
 use nym_sphinx::receiver::ReconstructedMessage;
-use std::convert::TryInto;
+
 use std::mem::size_of;
 
 #[repr(u8)]

clients/native/websocket-requests/src/text.rs

@@ -7,7 +7,6 @@ use crate::responses::ServerResponse;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use serde::{Deserialize, Serialize};
-use std::convert::{TryFrom, TryInto};
 
 // local text equivalent of `ClientRequest` for easier serialization + deserialization with serde
 // TODO: figure out if there's an easy way to avoid defining it

clients/socks5/Cargo.toml

@@ -1,29 +1,29 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.32"
+version = "1.1.33"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
-rust-version = "1.56"
+rust-version = "1.70"
 license.workspace = true
 
 [dependencies]
+bs58 = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive"] }
-lazy_static = "1.4.0"
 log = { workspace = true }
-pretty_env_logger = "0.4"
 serde = { workspace = true, features = ["derive"] } # for config serialization/deserialization
 serde_json = { workspace = true }
 tap = "1.0.1"
 thiserror = { workspace = true }
 tokio = { version = "1.24.1", features = ["rt-multi-thread", "net", "signal"] }
 rand = "0.7.3"
+time = { workspace = true }
 url = { workspace = true }
+zeroize = { workspace = true }
 
 # internal
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
-nym-coconut-interface = { path = "../../common/coconut-interface" }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "fs-gateways-storage", "cli"] }
 nym-config = { path = "../../common/config" }
 nym-credentials = { path = "../../common/credentials" }
 nym-crypto = { path = "../../common/crypto" }
@@ -35,6 +35,7 @@ nym-ordered-buffer = { path = "../../common/socks5/ordered-buffer" }
 nym-pemstore = { path = "../../common/pemstore" }
 nym-topology = { path = "../../common/topology" }
 nym-socks5-client-core = { path = "../../common/socks5-client-core" }
+nym-id = { path = "../../common/nym-id" }
 
 [features]
 default = []

clients/socks5/src/commands/add_gateway.rs

@@ -0,0 +1,30 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_add_gateway::{add_gateway, CommonClientAddGatewayArgs};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonClientAddGatewayArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonClientAddGatewayArgs> for Args {
+    fn as_ref(&self) -> &CommonClientAddGatewayArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    let output = args.output;
+    let res = add_gateway::<CliSocks5Client, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}

clients/socks5/src/commands/import_credential.rs

@@ -0,0 +1,14 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_import_credential::{
+    import_credential, CommonClientImportCredentialArgs,
+};
+
+pub(crate) async fn execute(
+    args: CommonClientImportCredentialArgs,
+) -> Result<(), Socks5ClientError> {
+    import_credential::<CliSocks5Client, _>(args).await
+}

clients/socks5/src/commands/init.rs

@@ -1,7 +1,7 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::commands::try_upgrade_config;
+use crate::commands::CliSocks5Client;
 use crate::config::{
     default_config_directory, default_config_filepath, default_data_directory, Config,
 };
@@ -21,17 +21,8 @@ use std::fs;
 use std::net::{IpAddr, SocketAddr};
 use std::path::PathBuf;
 
-struct Socks5ClientInit;
-
-impl InitialisableClient for Socks5ClientInit {
-    const NAME: &'static str = "socks5";
-    type Error = Socks5ClientError;
+impl InitialisableClient for CliSocks5Client {
     type InitArgs = Init;
-    type Config = Config;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
-        try_upgrade_config(id)
-    }
 
     fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
         fs::create_dir_all(default_data_directory(id))?;
@@ -51,7 +42,7 @@ impl InitialisableClient for Socks5ClientInit {
     }
 }
 
-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
     #[command(flatten)]
     common_args: CommonClientInitArgs,
@@ -118,7 +109,7 @@ impl InitResults {
         Self {
             client_address: res.init_results.address.to_string(),
             client_core: res.init_results,
-            socks5_listening_address: res.config.core.socks5.bind_adddress,
+            socks5_listening_address: res.config.core.socks5.bind_address,
         }
     }
 }
@@ -139,7 +130,7 @@ pub(crate) async fn execute(args: Init) -> Result<(), Socks5ClientError> {
     eprintln!("Initialising client...");
 
     let output = args.output;
-    let res = initialise_client::<Socks5ClientInit>(args).await?;
+    let res = initialise_client::<CliSocks5Client>(args).await?;
 
     let init_results = InitResults::new(res);
     println!("{}", output.format(&init_results));

clients/socks5/src/commands/list_gateways.rs

@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_list_gateways::{
+    list_gateways, CommonClientListGatewaysArgs,
+};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonClientListGatewaysArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonClientListGatewaysArgs> for Args {
+    fn as_ref(&self) -> &CommonClientListGatewaysArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    let output = args.output;
+    let res = list_gateways::<CliSocks5Client, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}

clients/socks5/src/commands/mod.rs

@@ -5,37 +5,52 @@ use crate::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::config::old_config_v1_1_20::ConfigV1_1_20;
 use crate::config::old_config_v1_1_20_2::ConfigV1_1_20_2;
 use crate::config::old_config_v1_1_30::ConfigV1_1_30;
-use crate::config::{BaseClientConfig, Config, SocksClientPaths};
+use crate::config::old_config_v1_1_33::ConfigV1_1_33;
+use crate::config::{BaseClientConfig, Config};
 use crate::error::Socks5ClientError;
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
-use lazy_static::lazy_static;
 use log::{error, info};
 use nym_bin_common::bin_info;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_client_core::client::base_client::storage::gateway_details::{
-    OnDiskGatewayDetails, PersistedGatewayDetails,
-};
-use nym_client_core::client::key_manager::persistence::OnDiskKeys;
+use nym_client_core::cli_helpers::client_import_credential::CommonClientImportCredentialArgs;
+use nym_client_core::cli_helpers::CliClient;
+use nym_client_core::client::base_client::storage::migration_helpers::v1_1_33;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
-use nym_client_core::config::{GatewayEndpointConfig, GroupBy, TopologyStructure};
-use nym_client_core::error::ClientCoreError;
+use nym_client_core::config::{GroupBy, TopologyStructure};
 use nym_config::OptionalSet;
 use nym_sphinx::params::{PacketSize, PacketType};
 use std::error::Error;
 use std::net::IpAddr;
+use std::sync::OnceLock;
 
+mod add_gateway;
 pub(crate) mod build_info;
+mod import_credential;
 pub mod init;
+mod list_gateways;
 pub(crate) mod run;
+mod switch_gateway;
 
-lazy_static! {
-    pub static ref PRETTY_BUILD_INFORMATION: String = bin_info!().pretty_print();
+pub(crate) struct CliSocks5Client;
+
+impl CliClient for CliSocks5Client {
+    const NAME: &'static str = "socks5";
+    type Error = Socks5ClientError;
+    type Config = Config;
+
+    async fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
+        try_upgrade_config(id).await
+    }
+
+    async fn try_load_current_config(id: &str) -> Result<Self::Config, Self::Error> {
+        try_load_current_config(id).await
+    }
 }
 
-// Helper for passing LONG_VERSION to clap
 fn pretty_build_info_static() -> &'static str {
-    &PRETTY_BUILD_INFORMATION
+    static PRETTY_BUILD_INFORMATION: OnceLock<String> = OnceLock::new();
+    PRETTY_BUILD_INFORMATION.get_or_init(|| bin_info!().pretty_print())
 }
 
 #[derive(Parser)]
@@ -61,6 +76,18 @@ pub(crate) enum Commands {
     /// Run the Nym client with provided configuration client optionally overriding set parameters
     Run(run::Run),
 
+    /// Import a pre-generated credential
+    ImportCredential(CommonClientImportCredentialArgs),
+
+    /// List all registered with gateways
+    ListGateways(list_gateways::Args),
+
+    /// Add new gateway to this client
+    AddGateway(add_gateway::Args),
+
+    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
+    SwitchGateway(switch_gateway::Args),
+
     /// Show build information of this binary
     BuildInfo(build_info::BuildInfo),
 
@@ -92,6 +119,10 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
     match args.command {
         Commands::Init(m) => init::execute(m).await?,
         Commands::Run(m) => run::execute(m).await?,
+        Commands::ImportCredential(m) => import_credential::execute(m).await?,
+        Commands::ListGateways(args) => list_gateways::execute(args).await?,
+        Commands::AddGateway(args) => add_gateway::execute(args).await?,
+        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
         Commands::BuildInfo(m) => build_info::execute(m),
         Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
         Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -167,28 +198,7 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
         )
 }
 
-fn persist_gateway_details(
-    storage_paths: &SocksClientPaths,
-    details: GatewayEndpointConfig,
-) -> Result<(), Socks5ClientError> {
-    let details_store = OnDiskGatewayDetails::new(&storage_paths.common_paths.gateway_details);
-    let keys_store = OnDiskKeys::new(storage_paths.common_paths.keys.clone());
-    let shared_keys = keys_store.ephemeral_load_gateway_keys().map_err(|source| {
-        Socks5ClientError::ClientCoreError(ClientCoreError::KeyStoreError {
-            source: Box::new(source),
-        })
-    })?;
-    let persisted_details = PersistedGatewayDetails::new(details.into(), Some(&shared_keys))?;
-    details_store
-        .store_to_disk(&persisted_details)
-        .map_err(|source| {
-            Socks5ClientError::ClientCoreError(ClientCoreError::GatewayDetailsStoreError {
-                source: Box::new(source),
-            })
-        })
-}
-
-fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError> {
+async fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError> {
     use nym_config::legacy_helpers::nym_config::MigrationNymConfig;
 
     // explicitly load it as v1.1.13 (which is incompatible with the next step, i.e. 1.1.19)
@@ -203,14 +213,23 @@ fn try_upgrade_v1_1_13_config(id: &str) -> Result<bool, Socks5ClientError> {
     let updated_step1: ConfigV1_1_20 = old_config.into();
     let updated_step2: ConfigV1_1_20_2 = updated_step1.into();
     let (updated_step3, gateway_config) = updated_step2.upgrade()?;
-    persist_gateway_details(&updated_step3.storage_paths, gateway_config)?;
+    let old_paths = updated_step3.storage_paths.clone();
+
+    let updated_step4: ConfigV1_1_33 = updated_step3.into();
+    let updated = updated_step4.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
 
-    let updated: Config = updated_step3.into();
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, Socks5ClientError> {
+async fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, Socks5ClientError> {
     use nym_config::legacy_helpers::nym_config::MigrationNymConfig;
 
     // explicitly load it as v1.1.20 (which is incompatible with the current one, i.e. +1.1.21)
@@ -224,14 +243,23 @@ fn try_upgrade_v1_1_20_config(id: &str) -> Result<bool, Socks5ClientError> {
 
     let updated_step1: ConfigV1_1_20_2 = old_config.into();
     let (updated_step2, gateway_config) = updated_step1.upgrade()?;
-    persist_gateway_details(&updated_step2.storage_paths, gateway_config)?;
+    let old_paths = updated_step2.storage_paths.clone();
+
+    let updated_step3: ConfigV1_1_33 = updated_step2.into();
+    let updated = updated_step3.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
 
-    let updated: Config = updated_step2.into();
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, Socks5ClientError> {
+async fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, Socks5ClientError> {
     // explicitly load it as v1.1.20_2 (which is incompatible with the current one, i.e. +1.1.21)
     let Ok(old_config) = ConfigV1_1_20_2::read_from_default_path(id) else {
         // if we failed to load it, there might have been nothing to upgrade
@@ -242,14 +270,23 @@ fn try_upgrade_v1_1_20_2_config(id: &str) -> Result<bool, Socks5ClientError> {
     info!("It is going to get updated to the current specification.");
 
     let (updated_step1, gateway_config) = old_config.upgrade()?;
-    persist_gateway_details(&updated_step1.storage_paths, gateway_config)?;
+    let old_paths = updated_step1.storage_paths.clone();
+
+    let updated_step2: ConfigV1_1_33 = updated_step1.into();
+    let updated = updated_step2.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        Some(gateway_config),
+    )
+    .await?;
 
-    let updated: Config = updated_step1.into();
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_v1_1_30_config(id: &str) -> Result<bool, Socks5ClientError> {
+async fn try_upgrade_v1_1_30_config(id: &str) -> Result<bool, Socks5ClientError> {
     // explicitly load it as v1.1.30 (which is incompatible with the current one, i.e. +1.1.31)
     let Ok(old_config) = ConfigV1_1_30::read_from_default_path(id) else {
         // if we failed to load it, there might have been nothing to upgrade
@@ -259,29 +296,68 @@ fn try_upgrade_v1_1_30_config(id: &str) -> Result<bool, Socks5ClientError> {
     info!("It seems the client is using <= v1.1.30 config template.");
     info!("It is going to get updated to the current specification.");
 
-    let updated: Config = old_config.into();
+    let old_paths = old_config.storage_paths.clone();
+
+    let updated_step1: ConfigV1_1_33 = old_config.into();
+    let updated = updated_step1.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        None,
+    )
+    .await?;
+
     updated.save_to_default_location()?;
     Ok(true)
 }
 
-fn try_upgrade_config(id: &str) -> Result<(), Socks5ClientError> {
-    if try_upgrade_v1_1_13_config(id)? {
+async fn try_upgrade_v1_1_33_config(id: &str) -> Result<bool, Socks5ClientError> {
+    // explicitly load it as v1.1.33 (which is incompatible with the current one, i.e. +1.1.34)
+    let Ok(old_config) = ConfigV1_1_33::read_from_default_path(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(false);
+    };
+    info!("It seems the client is using <= v1.1.33 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let old_paths = old_config.storage_paths.clone();
+
+    let updated = old_config.try_upgrade()?;
+
+    v1_1_33::migrate_gateway_details(
+        &old_paths.common_paths,
+        &updated.storage_paths.common_paths,
+        None,
+    )
+    .await?;
+
+    updated.save_to_default_location()?;
+    Ok(true)
+}
+
+async fn try_upgrade_config(id: &str) -> Result<(), Socks5ClientError> {
+    if try_upgrade_v1_1_13_config(id).await? {
         return Ok(());
     }
-    if try_upgrade_v1_1_20_config(id)? {
+    if try_upgrade_v1_1_20_config(id).await? {
         return Ok(());
     }
-    if try_upgrade_v1_1_20_2_config(id)? {
+    if try_upgrade_v1_1_20_2_config(id).await? {
         return Ok(());
     }
-    if try_upgrade_v1_1_30_config(id)? {
+    if try_upgrade_v1_1_30_config(id).await? {
+        return Ok(());
+    }
+    if try_upgrade_v1_1_33_config(id).await? {
         return Ok(());
     }
 
     Ok(())
 }
 
-fn try_load_current_config(id: &str) -> Result<Config, Socks5ClientError> {
+async fn try_load_current_config(id: &str) -> Result<Config, Socks5ClientError> {
     // try to load the config as is
     if let Ok(cfg) = Config::read_from_default_path(id) {
         return if !cfg.validate() {
@@ -292,7 +368,7 @@ fn try_load_current_config(id: &str) -> Result<Config, Socks5ClientError> {
     }
 
     // we couldn't load it - try upgrading it from older revisions
-    try_upgrade_config(id)?;
+    try_upgrade_config(id).await?;
 
     let config = match Config::read_from_default_path(id) {
         Ok(cfg) => cfg,
@@ -312,7 +388,6 @@ fn try_load_current_config(id: &str) -> Result<Config, Socks5ClientError> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use clap::CommandFactory;
 
     #[test]
     fn verify_cli() {

clients/socks5/src/commands/run.rs

@@ -105,7 +105,7 @@ fn version_check(cfg: &Config) -> bool {
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     eprintln!("Starting client {}...", args.common_args.id);
 
-    let mut config = try_load_current_config(&args.common_args.id)?;
+    let mut config = try_load_current_config(&args.common_args.id).await?;
     config = override_config(config, OverrideConfig::from(args.clone()));
 
     if !version_check(&config) {

clients/socks5/src/commands/switch_gateway.rs

@@ -0,0 +1,24 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_client_core::cli_helpers::client_switch_gateway::{
+    switch_gateway, CommonClientSwitchGatewaysArgs,
+};
+
+#[derive(clap::Args, Clone, Debug)]
+pub struct Args {
+    #[command(flatten)]
+    common_args: CommonClientSwitchGatewaysArgs,
+}
+
+impl AsRef<CommonClientSwitchGatewaysArgs> for Args {
+    fn as_ref(&self) -> &CommonClientSwitchGatewaysArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    switch_gateway::<CliSocks5Client, _>(args).await
+}

clients/socks5/src/config/mod.rs

@@ -3,7 +3,7 @@
 
 use crate::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::cli_helpers::client_init::ClientConfig;
+use nym_client_core::cli_helpers::CliClientConfig;
 use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::{
     must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
@@ -24,6 +24,7 @@ pub mod old_config_v1_1_13;
 pub mod old_config_v1_1_20;
 pub mod old_config_v1_1_20_2;
 pub mod old_config_v1_1_30;
+pub mod old_config_v1_1_33;
 mod persistence;
 mod template;
 
@@ -71,7 +72,7 @@ impl NymConfigTemplate for Config {
     }
 }
 
-impl ClientConfig for Config {
+impl CliClientConfig for Config {
     fn common_paths(&self) -> &CommonClientPaths {
         &self.storage_paths.common_paths
     }

clients/socks5/src/config/old_config_v1_1_20.rs

@@ -5,8 +5,8 @@ use crate::config::old_config_v1_1_20_2::{
     ConfigV1_1_20_2, CoreConfigV1_1_20_2, SocksClientPathsV1_1_20_2,
 };
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::config::disk_persistence::keys_paths::ClientKeysPaths;
 use nym_client_core::config::disk_persistence::old_v1_1_20_2::CommonClientPathsV1_1_20_2;
+use nym_client_core::config::disk_persistence::old_v1_1_33::ClientKeysPathsV1_1_33;
 use nym_client_core::config::old_config_v1_1_20::ConfigV1_1_20 as BaseConfigV1_1_20;
 use nym_client_core::config::old_config_v1_1_20_2::ClientV1_1_20_2;
 use nym_config::legacy_helpers::nym_config::MigrationNymConfig;
@@ -50,7 +50,7 @@ impl From<ConfigV1_1_20> for ConfigV1_1_20_2 {
             },
             storage_paths: SocksClientPathsV1_1_20_2 {
                 common_paths: CommonClientPathsV1_1_20_2 {
-                    keys: ClientKeysPaths {
+                    keys: ClientKeysPathsV1_1_33 {
                         private_identity_key_file: value.base.client.private_identity_key_file,
                         public_identity_key_file: value.base.client.public_identity_key_file,
                         private_encryption_key_file: value.base.client.private_encryption_key_file,

clients/socks5/src/config/old_config_v1_1_20_2.rs

@@ -2,13 +2,11 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::config::old_config_v1_1_30::ConfigV1_1_30;
-use crate::{
-    config::{default_config_filepath, persistence::SocksClientPaths},
-    error::Socks5ClientError,
-};
+use crate::config::old_config_v1_1_33::SocksClientPathsV1_1_33;
+use crate::{config::default_config_filepath, error::Socks5ClientError};
 use nym_bin_common::logging::LoggingSettings;
 use nym_client_core::config::disk_persistence::old_v1_1_20_2::CommonClientPathsV1_1_20_2;
-use nym_client_core::config::GatewayEndpointConfig;
+use nym_client_core::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
 use nym_config::read_config_from_toml_file;
 use serde::{Deserialize, Serialize};
 use std::io;
@@ -43,11 +41,13 @@ impl ConfigV1_1_20_2 {
 
     // in this upgrade, gateway endpoint configuration was moved out of the config file,
     // so its returned to be stored elsewhere.
-    pub fn upgrade(self) -> Result<(ConfigV1_1_30, GatewayEndpointConfig), Socks5ClientError> {
+    pub fn upgrade(
+        self,
+    ) -> Result<(ConfigV1_1_30, OldGatewayEndpointConfigV1_1_33), Socks5ClientError> {
         let gateway_details = self.core.base.client.gateway_endpoint.clone().into();
         let config = ConfigV1_1_30 {
             core: self.core.into(),
-            storage_paths: SocksClientPaths {
+            storage_paths: SocksClientPathsV1_1_33 {
                 common_paths: self.storage_paths.common_paths.upgrade_default()?,
             },
             logging: self.logging,

clients/socks5/src/config/old_config_v1_1_30.rs

@@ -1,8 +1,8 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::config::persistence::SocksClientPaths;
-use crate::config::{default_config_filepath, Config};
+use crate::config::default_config_filepath;
+use crate::config::old_config_v1_1_33::{ConfigV1_1_33, SocksClientPathsV1_1_33};
 use nym_bin_common::logging::LoggingSettings;
 use nym_config::read_config_from_toml_file;
 use nym_socks5_client_core::config::old_config_v1_1_30::ConfigV1_1_30 as CoreConfigV1_1_30;
@@ -15,17 +15,14 @@ use std::path::Path;
 pub struct ConfigV1_1_30 {
     pub core: CoreConfigV1_1_30,
 
-    // I'm leaving a landmine here for when the paths actually do change the next time,
-    // but propagating the change right now (in ALL clients) would be such a hassle...,
-    // so sorry for the next person looking at it : )
-    pub storage_paths: SocksClientPaths,
+    pub storage_paths: SocksClientPathsV1_1_33,
 
     pub logging: LoggingSettings,
 }
 
-impl From<ConfigV1_1_30> for Config {
+impl From<ConfigV1_1_30> for ConfigV1_1_33 {
     fn from(value: ConfigV1_1_30) -> Self {
-        Config {
+        ConfigV1_1_33 {
             core: value.core.into(),
             storage_paths: value.storage_paths,
             logging: LoggingSettings::default(),

clients/socks5/src/config/old_config_v1_1_33.rs

@@ -0,0 +1,49 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::config::{default_config_filepath, Config, SocksClientPaths};
+use crate::error::Socks5ClientError;
+use nym_bin_common::logging::LoggingSettings;
+use nym_client_core::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
+use nym_config::read_config_from_toml_file;
+use nym_socks5_client_core::config::old_config_v1_1_33::ConfigV1_1_33 as CoreConfigV1_1_33;
+use serde::{Deserialize, Serialize};
+use std::io;
+use std::path::Path;
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+pub struct SocksClientPathsV1_1_33 {
+    #[serde(flatten)]
+    pub common_paths: CommonClientPathsV1_1_33,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConfigV1_1_33 {
+    pub core: CoreConfigV1_1_33,
+
+    // \/ CHANGED
+    pub storage_paths: SocksClientPathsV1_1_33,
+    // /\ CHANGED
+    pub logging: LoggingSettings,
+}
+
+impl ConfigV1_1_33 {
+    pub fn read_from_toml_file<P: AsRef<Path>>(path: P) -> io::Result<Self> {
+        read_config_from_toml_file(path)
+    }
+
+    pub fn read_from_default_path<P: AsRef<Path>>(id: P) -> io::Result<Self> {
+        Self::read_from_toml_file(default_config_filepath(id))
+    }
+
+    pub fn try_upgrade(self) -> Result<Config, Socks5ClientError> {
+        Ok(Config {
+            core: self.core.into(),
+            storage_paths: SocksClientPaths {
+                common_paths: self.storage_paths.common_paths.upgrade_default()?,
+            },
+            logging: self.logging,
+        })
+    }
+}

clients/socks5/src/config/template.rs

@@ -50,10 +50,6 @@ keys.private_encryption_key_file = '{{ storage_paths.keys.private_encryption_key
 # Path to file containing public encryption key.
 keys.public_encryption_key_file = '{{ storage_paths.keys.public_encryption_key_file }}'
 
-# A gateway specific, optional, base58 stringified shared key used for
-# communication with particular gateway.
-keys.gateway_shared_key_file = '{{ storage_paths.keys.gateway_shared_key_file }}'
-
 # Path to file containing key used for encrypting and decrypting the content of an
 # acknowledgement so that nobody besides the client knows which packet it refers to.
 keys.ack_key_file = '{{ storage_paths.keys.ack_key_file }}'
@@ -64,9 +60,9 @@ credentials_database = '{{ storage_paths.credentials_database }}'
 # Path to the persistent store for received reply surbs, unused encryption keys and used sender tags.
 reply_surb_database = '{{ storage_paths.reply_surb_database }}'
 
-# Path to the file containing information about gateway used by this client,
-# i.e. details such as its public key, owner address or the network information.
-gateway_details = '{{ storage_paths.gateway_details }}'
+# Path to the file containing information about gateways used by this client,
+# i.e. details such as their public keys, owner addresses or the network information.
+gateway_registrations = '{{ storage_paths.gateway_registrations }}'
 
 ##### socket config options #####
 
@@ -77,7 +73,7 @@ provider_mix_address = '{{ core.socks5.provider_mix_address }}'
 
 # The address on which the client will be listening for incoming requests
 # (default: 127.0.0.1:1080)
-bind_adddress = '{{ core.socks5.bind_adddress }}'
+bind_address = '{{ core.socks5.bind_address }}'
 
 # Specifies whether this client is going to use an anonymous sender tag for communication with the service provider.
 # While this is going to hide its actual address information, it will make the actual communication

clients/socks5/src/error.rs

@@ -1,5 +1,7 @@
 use nym_client_core::error::ClientCoreError;
 
+use nym_id::NymIdError;
+
 #[derive(thiserror::Error, Debug)]
 pub enum Socks5ClientError {
     #[error("I/O error: {0}")]
@@ -18,6 +20,9 @@ pub enum Socks5ClientError {
     #[error("Fail to bind address")]
     FailToBindAddress,
 
-    #[error("client-core error: {0}")]
+    #[error(transparent)]
     ClientCoreError(#[from] ClientCoreError),
+
+    #[error(transparent)]
+    NymIdError(#[from] NymIdError),
 }

common/async-file-watcher/Cargo.toml

@@ -1,13 +1,13 @@
 [package]
-name = "async-file-watcher"
+name = "nym-async-file-watcher"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-log = "0.4"
-tokio = { workspace = true, features = ["time"] }
 futures = { workspace = true }
+log = "0.4"
 notify = "5.1.0"
+tokio = { workspace = true, features = ["time"] }

common/bandwidth-controller/Cargo.toml

@@ -8,14 +8,16 @@ license.workspace = true
 
 [dependencies]
 bip39 = { workspace = true }
+log = { workspace = true }
 rand = "0.7.3"
 thiserror = { workspace = true }
 url = { workspace = true }
 zeroize = { workspace = true }
 
-nym-coconut-interface = { path = "../coconut-interface" }
+nym-coconut = { path = "../nymcoconut" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
+nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
 nym-network-defaults = { path = "../network-defaults" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }

common/bandwidth-controller/src/acquire/mod.rs

@@ -2,18 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::BandwidthControllerError;
-use nym_coconut_interface::Base58;
+use nym_credential_storage::models::StorableIssuedCredential;
 use nym_credential_storage::storage::Storage;
-use nym_credentials::coconut::bandwidth::BandwidthVoucher;
+use nym_credentials::coconut::bandwidth::{CredentialType, IssuanceBandwidthCredential};
 use nym_credentials::coconut::utils::obtain_aggregate_signature;
 use nym_crypto::asymmetric::{encryption, identity};
-use nym_network_defaults::VOUCHER_INFO;
 use nym_validator_client::coconut::all_coconut_api_clients;
 use nym_validator_client::nyxd::contract_traits::CoconutBandwidthSigningClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use nym_validator_client::nyxd::Coin;
 use rand::rngs::OsRng;
 use state::State;
+use zeroize::Zeroizing;
 
 pub mod state;
 
@@ -24,13 +24,11 @@ where
     let mut rng = OsRng;
     let signing_key = identity::PrivateKey::new(&mut rng);
     let encryption_key = encryption::PrivateKey::new(&mut rng);
-    let params = BandwidthVoucher::default_parameters();
-    let voucher_value = amount.amount.to_string();
 
     let tx_hash = client
         .deposit(
-            amount,
-            String::from(VOUCHER_INFO),
+            amount.clone(),
+            CredentialType::Voucher.to_string(),
             signing_key.public_key().to_base58_string(),
             encryption_key.public_key().to_base58_string(),
             None,
@@ -38,21 +36,15 @@ where
         .await?
         .transaction_hash;
 
-    let voucher = BandwidthVoucher::new(
-        &params,
-        voucher_value,
-        VOUCHER_INFO.to_string(),
-        tx_hash,
-        signing_key,
-        encryption_key,
-    );
+    let voucher =
+        IssuanceBandwidthCredential::new_voucher(amount, tx_hash, signing_key, encryption_key);
 
-    let state = State { voucher, params };
+    let state = State { voucher };
 
     Ok(state)
 }
 
-pub async fn get_credential<C, St>(
+pub async fn get_bandwidth_voucher<C, St>(
     state: &State,
     client: &C,
     storage: &St,
@@ -62,6 +54,9 @@ where
     St: Storage,
     <St as Storage>::StorageError: Send + Sync + 'static,
 {
+    // temporary
+    assert!(state.voucher.typ().is_voucher());
+
     let epoch_id = client.get_current_epoch().await?.epoch_id;
     let threshold = client
         .get_current_epoch_threshold()
@@ -70,22 +65,23 @@ where
 
     let coconut_api_clients = all_coconut_api_clients(client, epoch_id).await?;
 
-    let signature = obtain_aggregate_signature(
-        &state.params,
-        &state.voucher,
-        &coconut_api_clients,
-        threshold,
-    )
-    .await?;
+    let signature =
+        obtain_aggregate_signature(&state.voucher, &coconut_api_clients, threshold).await?;
+    let issued = state.voucher.to_issued_credential(signature, epoch_id);
+
+    // make sure the data gets zeroized after persisting it
+    let credential_data = Zeroizing::new(issued.pack_v1());
+    let storable = StorableIssuedCredential {
+        serialization_revision: issued.current_serialization_revision(),
+        credential_data: credential_data.as_ref(),
+        credential_type: issued.typ().to_string(),
+        epoch_id: epoch_id
+            .try_into()
+            .expect("our epoch is has run over u32::MAX!"),
+    };
+
     storage
-        .insert_coconut_credential(
-            state.voucher.get_voucher_value(),
-            VOUCHER_INFO.to_string(),
-            state.voucher.get_private_attributes()[0].to_bs58(),
-            state.voucher.get_private_attributes()[1].to_bs58(),
-            signature.to_bs58(),
-            epoch_id.to_string(),
-        )
+        .insert_issued_credential(storable)
         .await
         .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
 }

common/bandwidth-controller/src/acquire/state.rs

@@ -1,19 +1,14 @@
-// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use nym_coconut_interface::Parameters;
-use nym_credentials::coconut::bandwidth::BandwidthVoucher;
+use nym_credentials::coconut::bandwidth::IssuanceBandwidthCredential;
 
 pub struct State {
-    pub voucher: BandwidthVoucher,
-    pub params: Parameters,
+    pub voucher: IssuanceBandwidthCredential,
 }
 
 impl State {
-    pub fn new(voucher: BandwidthVoucher) -> Self {
-        State {
-            voucher,
-            params: BandwidthVoucher::default_parameters(),
-        }
+    pub fn new(voucher: IssuanceBandwidthCredential) -> Self {
+        State { voucher }
     }
 }

common/bandwidth-controller/src/error.rs

@@ -1,7 +1,7 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use nym_coconut_interface::CoconutError;
+use nym_coconut::CoconutError;
 use nym_credential_storage::error::StorageError;
 use nym_credentials::error::Error as CredentialsError;
 use nym_crypto::asymmetric::encryption::KeyRecoveryError;
@@ -21,6 +21,9 @@ pub enum BandwidthControllerError {
     #[error("There was a credential storage error - {0}")]
     CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
 
+    #[error("the credential storage does not contain any usable credentials")]
+    NoCredentialsAvailable,
+
     // this should really be fully incorporated into the above, but messing with coconut is the last thing I want to do now
     #[error(transparent)]
     StorageError(#[from] StorageError),
@@ -45,4 +48,7 @@ pub enum BandwidthControllerError {
 
     #[error("Threshold not set yet")]
     NoThreshold,
+
+    #[error("can't handle recovering storage with revision {stored}. {expected} was expected")]
+    UnsupportedCredentialStorageRevision { stored: u8, expected: u8 },
 }

common/bandwidth-controller/src/lib.rs

@@ -1,90 +1,154 @@
-// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::BandwidthControllerError;
-use nym_credential_storage::error::StorageError;
+use crate::utils::stored_credential_to_issued_bandwidth;
+use log::{debug, error, warn};
 use nym_credential_storage::storage::Storage;
+use nym_credentials::coconut::bandwidth::issued::BandwidthCredentialIssuedDataVariant;
+use nym_credentials::coconut::bandwidth::CredentialSpendingData;
+use nym_credentials::coconut::utils::obtain_aggregate_verification_key;
+use nym_credentials::IssuedBandwidthCredential;
+use nym_credentials_interface::VerificationKey;
 use nym_validator_client::coconut::all_coconut_api_clients;
+use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
-use std::str::FromStr;
-use zeroize::Zeroizing;
-use {
-    nym_coconut_interface::Base58,
-    nym_credentials::coconut::{
-        bandwidth::prepare_for_spending, utils::obtain_aggregate_verification_key,
-    },
-};
 
 pub mod acquire;
 pub mod error;
+mod utils;
 
 pub struct BandwidthController<C, St> {
     storage: St,
     client: C,
 }
 
+pub struct PreparedCredential {
+    /// The cryptographic material required for spending the underlying credential.
+    pub data: CredentialSpendingData,
+
+    /// The (DKG) epoch id under which the credential has been issued so that the verifier
+    /// could use correct verification key for validation.
+    pub epoch_id: EpochId,
+
+    /// The database id of the stored credential.
+    pub credential_id: i64,
+}
+
+pub struct RetrievedCredential {
+    pub credential: IssuedBandwidthCredential,
+    pub credential_id: i64,
+}
+
 impl<C, St: Storage> BandwidthController<C, St> {
     pub fn new(storage: St, client: C) -> Self {
         BandwidthController { storage, client }
     }
 
+    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
+    /// It marks any retrieved intermediate credentials as expired.
+    pub async fn get_next_usable_credential(
+        &self,
+        gateway_id: &str,
+    ) -> Result<RetrievedCredential, BandwidthControllerError>
+    where
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        loop {
+            let Some(maybe_next) = self
+                .storage
+                .get_next_unspent_credential(gateway_id)
+                .await
+                .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?
+            else {
+                return Err(BandwidthControllerError::NoCredentialsAvailable);
+            };
+            let id = maybe_next.id;
+
+            // try to deserialize it
+            let valid_credential = match stored_credential_to_issued_bandwidth(maybe_next) {
+                // check if it has already expired
+                Ok(credential) => match credential.variant_data() {
+                    BandwidthCredentialIssuedDataVariant::Voucher(_) => {
+                        debug!("credential {id} is a bandwidth voucher");
+                        credential
+                    }
+                    BandwidthCredentialIssuedDataVariant::FreePass(freepass_info) => {
+                        debug!("credential {id} is a free pass");
+                        if freepass_info.expired() {
+                            warn!("the free pass (id: {id}) has already expired! The expiration was set to {}", freepass_info.expiry_date());
+                            self.storage.mark_expired(id).await.map_err(|err| {
+                                BandwidthControllerError::CredentialStorageError(Box::new(err))
+                            })?;
+                            continue;
+                        }
+                        credential
+                    }
+                },
+                Err(err) => {
+                    error!("failed to deserialize credential with id {id}: {err}. it may need to be manually removed from the storage");
+                    return Err(err);
+                }
+            };
+            return Ok(RetrievedCredential {
+                credential: valid_credential,
+                credential_id: id,
+            });
+        }
+    }
+
     pub fn storage(&self) -> &St {
         &self.storage
     }
 
-    pub async fn prepare_coconut_credential(
+    async fn get_aggregate_verification_key(
         &self,
-    ) -> Result<(nym_coconut_interface::Credential, i64), BandwidthControllerError>
+        epoch_id: EpochId,
+    ) -> Result<VerificationKey, BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        let bandwidth_credential = self
-            .storage
-            .get_next_coconut_credential()
-            .await
-            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
-        let voucher_value = u64::from_str(&bandwidth_credential.voucher_value)
-            .map_err(|_| StorageError::InconsistentData)?;
-        let voucher_info = bandwidth_credential.voucher_info.clone();
-        let serial_number = Zeroizing::new(nym_coconut_interface::Attribute::try_from_bs58(
-            bandwidth_credential.serial_number,
-        )?);
-        let binding_number = Zeroizing::new(nym_coconut_interface::Attribute::try_from_bs58(
-            bandwidth_credential.binding_number,
-        )?);
-        let signature =
-            nym_coconut_interface::Signature::try_from_bs58(bandwidth_credential.signature)?;
-        let epoch_id = u64::from_str(&bandwidth_credential.epoch_id)
-            .map_err(|_| StorageError::InconsistentData)?;
-
         let coconut_api_clients = all_coconut_api_clients(&self.client, epoch_id).await?;
-
-        let verification_key = obtain_aggregate_verification_key(&coconut_api_clients).await?;
-
-        // the below would only be executed once we know where we want to spend it (i.e. which gateway and stuff)
-        Ok((
-            prepare_for_spending(
-                voucher_value,
-                voucher_info,
-                &serial_number,
-                &binding_number,
-                epoch_id,
-                &signature,
-                &verification_key,
-            )?,
-            bandwidth_credential.id,
-        ))
+        Ok(obtain_aggregate_verification_key(&coconut_api_clients)?)
     }
 
-    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError>
+    pub async fn prepare_bandwidth_credential(
+        &self,
+        gateway_id: &str,
+    ) -> Result<PreparedCredential, BandwidthControllerError>
+    where
+        C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        let retrieved_credential = self.get_next_usable_credential(gateway_id).await?;
+
+        let epoch_id = retrieved_credential.credential.epoch_id();
+        let credential_id = retrieved_credential.credential_id;
+
+        let verification_key = self.get_aggregate_verification_key(epoch_id).await?;
+
+        let spend_request = retrieved_credential
+            .credential
+            .prepare_for_spending(&verification_key)?;
+
+        Ok(PreparedCredential {
+            data: spend_request,
+            epoch_id,
+            credential_id,
+        })
+    }
+
+    pub async fn consume_credential(
+        &self,
+        id: i64,
+        gateway_id: &str,
+    ) -> Result<(), BandwidthControllerError>
     where
         <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        // JS: shouldn't we send some contract/validator/gateway message here to actually, you know,
-        // consume it?
         self.storage
-            .consume_coconut_credential(id)
+            .consume_coconut_credential(id, gateway_id)
             .await
             .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
     }
@@ -93,7 +157,7 @@ impl<C, St: Storage> BandwidthController<C, St> {
 impl<C, St> Clone for BandwidthController<C, St>
 where
     C: Clone,
-    St: Storage + Clone,
+    St: Clone,
 {
     fn clone(&self) -> Self {
         BandwidthController {

common/bandwidth-controller/src/utils.rs

@@ -0,0 +1,22 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::BandwidthControllerError;
+use nym_credential_storage::models::StoredIssuedCredential;
+use nym_credentials::coconut::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
+use nym_credentials::coconut::bandwidth::IssuedBandwidthCredential;
+
+pub fn stored_credential_to_issued_bandwidth(
+    cred: StoredIssuedCredential,
+) -> Result<IssuedBandwidthCredential, BandwidthControllerError> {
+    if cred.serialization_revision != CURRENT_SERIALIZATION_REVISION {
+        return Err(
+            BandwidthControllerError::UnsupportedCredentialStorageRevision {
+                stored: cred.serialization_revision,
+                expected: CURRENT_SERIALIZATION_REVISION,
+            },
+        );
+    }
+
+    Ok(IssuedBandwidthCredential::unpack_v1(&cred.credential_data)?)
+}

common/bin-common/Cargo.toml

@@ -9,6 +9,7 @@ repository = { workspace = true }
 
 [dependencies]
 atty = "0.2"
+const-str = "0.5.6"
 clap = { workspace = true, features = ["derive"] }
 clap_complete = "4.0"
 clap_complete_fig = "4.0"

common/bin-common/src/build_information/mod.rs

@@ -42,12 +42,20 @@ pub struct BinaryBuildInformation {
 
     // VERGEN_CARGO_DEBUG
     /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: &'static str,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: &'static str,
 }
 
 impl BinaryBuildInformation {
     // explicitly require the build_version to be passed as it's binary specific
     pub const fn new(binary_name: &'static str, build_version: &'static str) -> Self {
+        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
+        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
+            "debug"
+        } else {
+            "release"
+        };
+
         BinaryBuildInformation {
             binary_name,
             build_timestamp: env!("VERGEN_BUILD_TIMESTAMP"),
@@ -57,7 +65,36 @@ impl BinaryBuildInformation {
             commit_branch: env!("VERGEN_GIT_BRANCH"),
             rustc_version: env!("VERGEN_RUSTC_SEMVER"),
             rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
-            cargo_debug: env!("VERGEN_CARGO_DEBUG"),
+            cargo_profile,
+        }
+    }
+
+    // Varient where we want to use the metadata generated by vergen in the consuming crate.
+    pub const fn new_with_local_vergen(
+        binary_name: &'static str,
+        build_timestamp: &'static str,
+        build_version: &'static str,
+        commit_sha: &'static str,
+        commit_timestamp: &'static str,
+        commit_branch: &'static str,
+    ) -> Self {
+        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
+        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
+            "debug"
+        } else {
+            "release"
+        };
+
+        BinaryBuildInformation {
+            binary_name,
+            build_timestamp,
+            build_version,
+            commit_sha,
+            commit_timestamp,
+            commit_branch,
+            rustc_version: env!("VERGEN_RUSTC_SEMVER"),
+            rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
+            cargo_profile,
         }
     }
 
@@ -71,7 +108,7 @@ impl BinaryBuildInformation {
             commit_branch: self.commit_branch.to_owned(),
             rustc_version: self.rustc_version.to_owned(),
             rustc_channel: self.rustc_channel.to_owned(),
-            cargo_debug: self.cargo_debug.to_owned(),
+            cargo_profile: self.cargo_profile.to_owned(),
         }
     }
 
@@ -117,7 +154,8 @@ pub struct BinaryBuildInformationOwned {
 
     // VERGEN_CARGO_DEBUG
     /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: String,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: String,
 }
 
 impl Display for BinaryBuildInformationOwned {
@@ -151,8 +189,8 @@ impl Display for BinaryBuildInformationOwned {
             self.rustc_version,
             "rustc Channel:",
             self.rustc_channel,
-            "cargo Debug:",
-            self.cargo_debug,
+            "cargo Profile:",
+            self.cargo_profile,
         )
     }
 }
@@ -178,3 +216,33 @@ macro_rules! bin_info_owned {
         .to_owned()
     };
 }
+
+// variant that picks up the vergen build information generated by the build.rs in the consumer
+// crate.
+#[macro_export]
+macro_rules! bin_info_local_vergen {
+    () => {
+        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
+            env!("CARGO_PKG_NAME"),
+            env!("VERGEN_BUILD_TIMESTAMP"),
+            env!("CARGO_PKG_VERSION"),
+            env!("VERGEN_GIT_SHA"),
+            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
+            env!("VERGEN_GIT_BRANCH"),
+        )
+    };
+}
+
+#[macro_export]
+macro_rules! bin_info_local_vergen_owned {
+    () => {
+        $crate::build_information::BinaryBuildInformation::new_with_local_vergen(
+            env!("CARGO_PKG_NAME"),
+            env!("VERGEN_BUILD_TIMESTAMP"),
+            env!("CARGO_PKG_VERSION"),
+            env!("VERGEN_GIT_SHA"),
+            env!("VERGEN_GIT_COMMIT_TIMESTAMP"),
+            env!("VERGEN_GIT_BRANCH"),
+        )
+    };
+}

common/client-core/Cargo.toml

@@ -11,33 +11,34 @@ license.workspace = true
 [dependencies]
 async-trait = { workspace = true }
 base64 = "0.21.2"
+bs58 = { workspace = true }
 cfg-if = "1.0.0"
 clap = { workspace = true, optional = true }
-dashmap = { workspace = true }
-dirs = "4.0"
 futures = { workspace = true }
 humantime-serde = "1.0"
 log = { workspace = true }
 rand = { version = "0.7.3", features = ["wasm-bindgen"] }
-reqwest = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 sha2 = "0.10.6"
+si-scale = "0.2.2"
 tap = "1.0.1"
 thiserror = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tungstenite = { workspace = true, default-features = false }
-tokio = { workspace = true, features = ["macros"]}
-time = "0.3.17"
+tokio = { workspace = true, features = ["macros"] }
+time = { workspace = true }
 zeroize = { workspace = true }
 
 # internal
+nym-id = { path = "../nym-id" }
 nym-bandwidth-controller = { path = "../bandwidth-controller" }
 nym-config = { path = "../config" }
 nym-crypto = { path = "../crypto" }
 nym-explorer-client = { path = "../../explorer-api/explorer-client" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../../gateway/gateway-requests" }
+nym-metrics = { path = "../nym-metrics" }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-pemstore = { path = "../pemstore" }
@@ -46,6 +47,21 @@ nym-validator-client = { path = "../client-libs/validator-client", default-featu
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
+nym-client-core-surb-storage = { path = "./surb-storage" }
+nym-client-core-gateways-storage = { path = "./gateways-storage" }
+
+### For serving prometheus metrics
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
+version = "1"
+features = ["server", "http1"]
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.http-body-util]
+version = "0.1"
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper-util]
+version = "0.1"
+features = ["tokio"]
+###
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 version = "0.1.11"
@@ -57,11 +73,7 @@ features = ["time"]
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-tungstenite]
 version = "0.20.1"
-
-[target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
-workspace = true
-features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"]
-optional = true
+features = ["rustls-tls-native-roots"]
 
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen-futures]
 workspace = true
@@ -88,13 +100,10 @@ features = ["wasm-bindgen"]
 [dev-dependencies]
 tempfile = "3.1.0"
 
-[build-dependencies]
-tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
-
 [features]
 default = []
 cli = ["clap"]
-fs-surb-storage = ["sqlx"]
+fs-surb-storage = ["nym-client-core-surb-storage/fs-surb-storage"]
+fs-gateways-storage = ["nym-client-core-gateways-storage/fs-gateways-storage"]
 wasm = ["nym-gateway-client/wasm"]
-
+metrics-server = []

common/client-core/gateways-storage/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "nym-client-core-gateways-storage"
+version = "0.1.0"
+edition = "2021"
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+async-trait.workspace = true
+cosmrs.workspace = true
+log.workspace = true
+serde = { workspace = true, features = ["derive"] }
+thiserror.workspace = true
+time.workspace = true
+tokio = { workspace = true, features = ["sync"] }
+url.workspace = true
+zeroize = { workspace = true, features = ["zeroize_derive"] }
+
+nym-crypto = { path = "../../crypto", features = ["asymmetric"] }
+nym-gateway-requests = { path = "../../../gateway/gateway-requests" }
+
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
+workspace = true
+features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"]
+optional = true
+
+[build-dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
+
+[features]
+fs-gateways-storage = ["sqlx"]

common/client-core/gateways-storage/build.rs

@@ -0,0 +1,31 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#[tokio::main]
+async fn main() {
+    #[cfg(feature = "fs-gateways-storage")]
+    {
+        use sqlx::{Connection, SqliteConnection};
+        use std::env;
+
+        let out_dir = env::var("OUT_DIR").unwrap();
+        let database_path = format!("{out_dir}/gateways-storage-example.sqlite");
+
+        let mut conn = SqliteConnection::connect(&format!("sqlite://{database_path}?mode=rwc"))
+            .await
+            .expect("Failed to create SQLx database connection");
+
+        sqlx::migrate!("./fs_gateways_migrations")
+            .run(&mut conn)
+            .await
+            .expect("Failed to perform SQLx migrations");
+
+        #[cfg(target_family = "unix")]
+        println!("cargo:rustc-env=DATABASE_URL=sqlite://{}", &database_path);
+
+        #[cfg(target_family = "windows")]
+        // for some strange reason we need to add a leading `/` to the windows path even though it's
+        // not a valid windows path... but hey, it works...
+        println!("cargo:rustc-env=DATABASE_URL=sqlite:///{}", &database_path);
+    }
+}

common/client-core/gateways-storage/fs_gateways_migrations/20240304120000_create_initial_tables.sql

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+CREATE TABLE active_gateway
+(
+    id                     INTEGER PRIMARY KEY CHECK (id = 0),
+    active_gateway_id_bs58 TEXT REFERENCES registered_gateway (gateway_id_bs58)
+);
+
+CREATE TABLE registered_gateway
+(
+    gateway_id_bs58        TEXT                                                NOT NULL UNIQUE PRIMARY KEY,
+    registration_timestamp TIMESTAMP WITHOUT TIME ZONE                         NOT NULL,
+    gateway_type           TEXT CHECK ( gateway_type IN ('remote', 'custom') ) NOT NULL DEFAULT 'remote'
+);
+
+-- TODO: perhaps keep additional metadata such as bandwidth, credential usage, etc
+
+
+CREATE TABLE remote_gateway_details
+(
+    gateway_id_bs58                          TEXT NOT NULL UNIQUE PRIMARY KEY REFERENCES registered_gateway (gateway_id_bs58),
+    derived_aes128_ctr_blake3_hmac_keys_bs58 TEXT NOT NULL,
+    gateway_owner_address                    TEXT NOT NULL,
+    gateway_listener                         TEXT NOT NULL,
+    wg_tun_address                           TEXT
+);
+
+CREATE TABLE custom_gateway_details
+(
+    gateway_id_bs58 TEXT NOT NULL UNIQUE PRIMARY KEY REFERENCES registered_gateway (gateway_id_bs58),
+    data            BLOB
+);
+
+
+INSERT INTO active_gateway(id, active_gateway_id_bs58)
+values (0, NULL);

common/client-core/gateways-storage/src/backend/fs_backend/error.rs

@@ -0,0 +1,45 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::BadGateway;
+use std::io;
+use std::path::PathBuf;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum StorageError {
+    #[error("the provided database path doesn't have a filename defined")]
+    DatabasePathWithoutFilename { provided_path: PathBuf },
+
+    #[error("unable to create the directory for the database at {}: {source}", provided_path.display())]
+    DatabasePathUnableToCreateParentDirectory {
+        provided_path: PathBuf,
+        source: io::Error,
+    },
+
+    #[error("failed to perform sqlx migration: {source}")]
+    MigrationError {
+        #[source]
+        #[from]
+        source: sqlx::migrate::MigrateError,
+    },
+
+    #[error("failed to connect to the underlying connection pool: {source}")]
+    DatabaseConnectionError {
+        #[source]
+        source: sqlx::error::Error,
+    },
+
+    #[error("failed to run the SQL query: {source}")]
+    QueryError {
+        #[source]
+        #[from]
+        source: sqlx::error::Error,
+    },
+
+    #[error(transparent)]
+    MalformedGateway(#[from] BadGateway),
+
+    #[error("gateway {gateway_id} does not exist in the storage")]
+    GatewayDoesNotExist { gateway_id: String },
+}

common/client-core/gateways-storage/src/backend/fs_backend/manager.rs

@@ -0,0 +1,234 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    backend::fs_backend::error::StorageError,
+    types::{
+        RawActiveGateway, RawCustomGatewayDetails, RawRegisteredGateway, RawRemoteGatewayDetails,
+    },
+};
+use log::{debug, error};
+use sqlx::ConnectOptions;
+use std::path::Path;
+
+#[derive(Debug, Clone)]
+pub struct StorageManager {
+    pub connection_pool: sqlx::SqlitePool,
+}
+
+// all SQL goes here
+impl StorageManager {
+    pub async fn init<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+        // ensure the whole directory structure exists
+        if let Some(parent_dir) = database_path.as_ref().parent() {
+            std::fs::create_dir_all(parent_dir).map_err(|source| {
+                StorageError::DatabasePathUnableToCreateParentDirectory {
+                    provided_path: database_path.as_ref().to_path_buf(),
+                    source,
+                }
+            })?;
+        }
+
+        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .filename(database_path)
+            .create_if_missing(true);
+
+        opts.disable_statement_logging();
+
+        let connection_pool = sqlx::SqlitePool::connect_with(opts)
+            .await
+            .map_err(|source| {
+                error!("Failed to connect to SQLx database: {source}");
+                StorageError::DatabaseConnectionError { source }
+            })?;
+
+        sqlx::migrate!("./fs_gateways_migrations")
+            .run(&connection_pool)
+            .await
+            .inspect_err(|err| {
+                error!("Failed to initialize SQLx database: {err}");
+            })?;
+
+        debug!("Database migration finished!");
+        Ok(StorageManager { connection_pool })
+    }
+
+    pub(crate) async fn get_active_gateway(&self) -> Result<RawActiveGateway, sqlx::Error> {
+        sqlx::query_as!(
+            RawActiveGateway,
+            "SELECT active_gateway_id_bs58 FROM active_gateway"
+        )
+        .fetch_one(&self.connection_pool)
+        .await
+    }
+
+    pub(crate) async fn set_active_gateway(
+        &self,
+        gateway_id: Option<&str>,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "UPDATE active_gateway SET active_gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn has_registered_gateway(
+        &self,
+        gateway_id: &str,
+    ) -> Result<bool, sqlx::Error> {
+        sqlx::query!("SELECT EXISTS (SELECT 1 FROM registered_gateway WHERE gateway_id_bs58 = ?) AS 'exists'", gateway_id)
+            .fetch_one(&self.connection_pool)
+            .await
+            .map(|result| result.exists == 1)
+    }
+
+    pub(crate) async fn maybe_get_registered_gateway(
+        &self,
+        gateway_id: &str,
+    ) -> Result<Option<RawRegisteredGateway>, sqlx::Error> {
+        sqlx::query_as("SELECT * FROM registered_gateway WHERE gateway_id_bs58 = ?")
+            .bind(gateway_id)
+            .fetch_optional(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn must_get_registered_gateway(
+        &self,
+        gateway_id: &str,
+    ) -> Result<RawRegisteredGateway, sqlx::Error> {
+        sqlx::query_as("SELECT * FROM registered_gateway WHERE gateway_id_bs58 = ?")
+            .bind(gateway_id)
+            .fetch_one(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn set_registered_gateway(
+        &self,
+        registered_gateway: &RawRegisteredGateway,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) 
+                VALUES (?, ?, ?)
+            "#,
+            registered_gateway.gateway_id_bs58,
+            registered_gateway.registration_timestamp,
+            registered_gateway.gateway_type,
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn remove_registered_gateway(
+        &self,
+        gateway_id: &str,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "DELETE FROM registered_gateway WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_remote_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<RawRemoteGatewayDetails, sqlx::Error> {
+        sqlx::query_as!(
+            RawRemoteGatewayDetails,
+            "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .fetch_one(&self.connection_pool)
+        .await
+    }
+
+    pub(crate) async fn set_remote_gateway_details(
+        &self,
+        remote: &RawRemoteGatewayDetails,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, gateway_owner_address, gateway_listener, wg_tun_address) 
+                VALUES (?, ?, ?, ?, ?)
+            "#,
+            remote.gateway_id_bs58,
+            remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            remote.gateway_owner_address,
+            remote.gateway_listener,
+            remote.wg_tun_address,
+        )
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn remove_remote_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "DELETE FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_custom_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<RawCustomGatewayDetails, sqlx::Error> {
+        sqlx::query_as!(
+            RawCustomGatewayDetails,
+            "SELECT * FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .fetch_one(&self.connection_pool)
+        .await
+    }
+
+    pub(crate) async fn set_custom_gateway_details(
+        &self,
+        custom: &RawCustomGatewayDetails,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO custom_gateway_details(gateway_id_bs58, data) 
+                VALUES (?, ?)
+            "#,
+            custom.gateway_id_bs58,
+            custom.data,
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn remove_custom_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "DELETE FROM custom_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn registered_gateways(&self) -> Result<Vec<String>, sqlx::Error> {
+        sqlx::query!("SELECT gateway_id_bs58 FROM registered_gateway")
+            .fetch_all(&self.connection_pool)
+            .await
+            .map(|records| records.into_iter().map(|r| r.gateway_id_bs58).collect())
+    }
+}

common/client-core/gateways-storage/src/backend/fs_backend/mod.rs

@@ -0,0 +1,155 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    ActiveGateway, BadGateway, GatewayDetails, GatewayRegistration, GatewayType,
+    GatewaysDetailsStore, StorageError,
+};
+use async_trait::async_trait;
+use manager::StorageManager;
+use nym_crypto::asymmetric::identity::PublicKey;
+use std::path::Path;
+
+pub mod error;
+mod manager;
+mod models;
+
+pub struct OnDiskGatewaysDetails {
+    manager: StorageManager,
+}
+
+impl OnDiskGatewaysDetails {
+    pub async fn init<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+        Ok(OnDiskGatewaysDetails {
+            manager: StorageManager::init(database_path).await?,
+        })
+    }
+}
+
+#[async_trait]
+impl GatewaysDetailsStore for OnDiskGatewaysDetails {
+    type StorageError = error::StorageError;
+
+    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
+        Ok(self
+            .manager
+            .maybe_get_registered_gateway(gateway_id)
+            .await?
+            .is_some())
+    }
+
+    async fn active_gateway(&self) -> Result<ActiveGateway, Self::StorageError> {
+        let raw_active = self.manager.get_active_gateway().await?;
+        let registration = match raw_active.active_gateway_id_bs58 {
+            None => None,
+            Some(gateway_id) => Some(self.load_gateway_details(&gateway_id).await?),
+        };
+
+        Ok(ActiveGateway { registration })
+    }
+
+    async fn set_active_gateway(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
+        if !self.manager.has_registered_gateway(gateway_id).await? {
+            return Err(StorageError::GatewayDoesNotExist {
+                gateway_id: gateway_id.to_string(),
+            });
+        }
+        Ok(self.manager.set_active_gateway(Some(gateway_id)).await?)
+    }
+
+    async fn all_gateways(&self) -> Result<Vec<GatewayRegistration>, Self::StorageError> {
+        let identities = self.manager.registered_gateways().await?;
+        let mut registered = Vec::with_capacity(identities.len());
+        for gateway_id in identities {
+            registered.push(self.load_gateway_details(&gateway_id).await?)
+        }
+
+        Ok(registered)
+    }
+
+    async fn all_gateways_identities(&self) -> Result<Vec<PublicKey>, Self::StorageError> {
+        Ok(self
+            .manager
+            .registered_gateways()
+            .await?
+            .into_iter()
+            .map(|gateway_id| {
+                gateway_id
+                    .as_str()
+                    .parse()
+                    .map_err(|source| BadGateway::MalformedGatewayIdentity { gateway_id, source })
+            })
+            .collect::<Result<_, _>>()?)
+    }
+
+    async fn load_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<GatewayRegistration, Self::StorageError> {
+        let raw_registration = self.manager.must_get_registered_gateway(gateway_id).await?;
+        let typ: GatewayType = raw_registration.gateway_type.parse()?;
+
+        let details = match typ {
+            GatewayType::Remote => {
+                let raw_details = self.manager.get_remote_gateway_details(gateway_id).await?;
+                GatewayDetails::Remote(raw_details.try_into()?)
+            }
+            GatewayType::Custom => {
+                let raw_details = self.manager.get_custom_gateway_details(gateway_id).await?;
+                GatewayDetails::Custom(raw_details.try_into()?)
+            }
+        };
+
+        Ok(GatewayRegistration {
+            details,
+            registration_timestamp: raw_registration.registration_timestamp,
+        })
+    }
+
+    async fn store_gateway_details(
+        &self,
+        details: &GatewayRegistration,
+    ) -> Result<(), Self::StorageError> {
+        let raw_registration = details.into();
+        self.manager
+            .set_registered_gateway(&raw_registration)
+            .await?;
+
+        match &details.details {
+            GatewayDetails::Remote(remote_details) => {
+                let raw_details = remote_details.into();
+                self.manager
+                    .set_remote_gateway_details(&raw_details)
+                    .await?;
+            }
+            GatewayDetails::Custom(custom_details) => {
+                let raw_details = custom_details.into();
+                self.manager
+                    .set_custom_gateway_details(&raw_details)
+                    .await?;
+            }
+        }
+        Ok(())
+    }
+
+    // ideally all of those should be run under a storage tx to ensure storage consistency,
+    // but at that point it's fine
+    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
+        let active = self.manager.get_active_gateway().await?;
+        if let Some(currently_active) = &active.active_gateway_id_bs58 {
+            if currently_active == gateway_id {
+                self.manager.set_active_gateway(None).await?;
+            }
+        }
+
+        // just try remove it from all tables even if it doesn't actually exist
+        self.manager.remove_registered_gateway(gateway_id).await?;
+        self.manager
+            .remove_remote_gateway_details(gateway_id)
+            .await?;
+        self.manager
+            .remove_custom_gateway_details(gateway_id)
+            .await?;
+        Ok(())
+    }
+}

common/client-core/gateways-storage/src/backend/fs_backend/models.rs

@@ -0,0 +1,2 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0

common/client-core/gateways-storage/src/backend/mem_backend.rs

@@ -0,0 +1,108 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::types::{ActiveGateway, GatewayRegistration};
+use crate::{BadGateway, GatewaysDetailsStore};
+use async_trait::async_trait;
+use std::collections::HashMap;
+use std::sync::Arc;
+use thiserror::Error;
+use tokio::sync::RwLock;
+
+#[derive(Debug, Error)]
+pub enum InMemStorageError {
+    #[error("gateway {gateway_id} does not exist")]
+    GatewayDoesNotExist { gateway_id: String },
+
+    #[error(transparent)]
+    MalformedGateway(#[from] BadGateway),
+}
+
+#[derive(Debug, Default)]
+pub struct InMemGatewaysDetails {
+    inner: Arc<RwLock<InMemStorageInner>>,
+}
+
+#[derive(Debug, Default)]
+struct InMemStorageInner {
+    active_gateway: Option<String>,
+    gateways: HashMap<String, GatewayRegistration>,
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl GatewaysDetailsStore for InMemGatewaysDetails {
+    type StorageError = InMemStorageError;
+
+    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError> {
+        Ok(self.inner.read().await.gateways.contains_key(gateway_id))
+    }
+
+    async fn active_gateway(&self) -> Result<ActiveGateway, Self::StorageError> {
+        let guard = self.inner.read().await;
+
+        let registration = guard.active_gateway.as_ref().map(|id| {
+            // SAFETY: if particular gateway is set as active, its details MUST exist
+            #[allow(clippy::unwrap_used)]
+            guard.gateways.get(id).unwrap().clone()
+        });
+
+        Ok(ActiveGateway { registration })
+    }
+
+    async fn set_active_gateway(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
+        // ensure the gateway with provided id exists
+        let mut guard = self.inner.write().await;
+
+        if !guard.gateways.contains_key(gateway_id) {
+            return Err(InMemStorageError::GatewayDoesNotExist {
+                gateway_id: gateway_id.to_string(),
+            });
+        }
+
+        guard.active_gateway = Some(gateway_id.to_string());
+        Ok(())
+    }
+
+    async fn all_gateways(&self) -> Result<Vec<GatewayRegistration>, Self::StorageError> {
+        Ok(self.inner.read().await.gateways.values().cloned().collect())
+    }
+
+    async fn load_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<GatewayRegistration, Self::StorageError> {
+        self.inner
+            .read()
+            .await
+            .gateways
+            .get(gateway_id)
+            .cloned()
+            .ok_or(InMemStorageError::GatewayDoesNotExist {
+                gateway_id: gateway_id.to_string(),
+            })
+    }
+
+    async fn store_gateway_details(
+        &self,
+        details: &GatewayRegistration,
+    ) -> Result<(), Self::StorageError> {
+        self.inner.write().await.gateways.insert(
+            details.details.gateway_id().to_base58_string(),
+            details.clone(),
+        );
+        Ok(())
+    }
+
+    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError> {
+        let mut guard = self.inner.write().await;
+        if let Some(active) = guard.active_gateway.as_ref() {
+            if active == gateway_id {
+                guard.active_gateway = None
+            }
+        }
+        guard.gateways.remove(gateway_id);
+
+        Ok(())
+    }
+}

common/client-core/gateways-storage/src/backend/mod.rs

@@ -0,0 +1,7 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#[cfg(all(not(target_arch = "wasm32"), feature = "fs-gateways-storage"))]
+pub mod fs_backend;
+
+pub mod mem_backend;

common/client-core/gateways-storage/src/error.rs

@@ -0,0 +1,50 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
+use nym_gateway_requests::registration::handshake::shared_key::SharedKeyConversionError;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum BadGateway {
+    #[error("{typ} is not a valid gateway type")]
+    InvalidGatewayType { typ: String },
+
+    #[error("the provided gateway identity {gateway_id} is malformed: {source}")]
+    MalformedGatewayIdentity {
+        gateway_id: String,
+
+        #[source]
+        source: Ed25519RecoveryError,
+    },
+
+    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {source}")]
+    MalformedGatewayOwnerAccountAddress {
+        gateway_id: String,
+
+        raw_owner: String,
+
+        #[source]
+        source: cosmrs::ErrorReport,
+    },
+
+    #[error("the shared keys provided for gateway {gateway_id} are malformed: {source}")]
+    MalformedSharedKeys {
+        gateway_id: String,
+
+        #[source]
+        source: SharedKeyConversionError,
+    },
+
+    #[error(
+        "the listening address of gateway {gateway_id} ({raw_listener}) is malformed: {source}"
+    )]
+    MalformedListener {
+        gateway_id: String,
+
+        raw_listener: String,
+
+        #[source]
+        source: url::ParseError,
+    },
+}

common/client-core/gateways-storage/src/lib.rs

@@ -0,0 +1,66 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+
+use async_trait::async_trait;
+use std::error::Error;
+
+pub mod backend;
+pub mod error;
+pub mod types;
+
+// todo: export port types
+pub use crate::types::*;
+pub use backend::mem_backend::{InMemGatewaysDetails, InMemStorageError};
+pub use error::BadGateway;
+
+#[cfg(all(not(target_arch = "wasm32"), feature = "fs-gateways-storage"))]
+pub use backend::fs_backend::{error::StorageError, OnDiskGatewaysDetails};
+use nym_crypto::asymmetric::identity;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait GatewaysDetailsStore {
+    type StorageError: Error + From<error::BadGateway>;
+
+    /// Returns details of the currently active gateway, if available.
+    async fn active_gateway(&self) -> Result<ActiveGateway, Self::StorageError>;
+
+    /// Set the provided gateway as the currently active gateway.
+    async fn set_active_gateway(&self, gateway_id: &str) -> Result<(), Self::StorageError>;
+
+    /// Returns details of all registered gateways.
+    async fn all_gateways(&self) -> Result<Vec<GatewayRegistration>, Self::StorageError>;
+
+    /// Return identity keys of all registered gateways.
+    async fn all_gateways_identities(
+        &self,
+    ) -> Result<Vec<identity::PublicKey>, Self::StorageError> {
+        Ok(self
+            .all_gateways()
+            .await?
+            .into_iter()
+            .map(|gateway| gateway.details.gateway_id())
+            .collect())
+    }
+
+    /// Check if the gateway with the provided id already exists in the store.
+    async fn has_gateway_details(&self, gateway_id: &str) -> Result<bool, Self::StorageError>;
+
+    /// Returns details of the particular gateway.
+    async fn load_gateway_details(
+        &self,
+        gateway_id: &str,
+    ) -> Result<GatewayRegistration, Self::StorageError>;
+
+    /// Store the provided gateway details.
+    async fn store_gateway_details(
+        &self,
+        details: &GatewayRegistration,
+    ) -> Result<(), Self::StorageError>;
+
+    /// Remove given gateway details from the underlying store.
+    async fn remove_gateway_details(&self, gateway_id: &str) -> Result<(), Self::StorageError>;
+}

common/client-core/gateways-storage/src/types.rs

@@ -0,0 +1,300 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::BadGateway;
+use cosmrs::AccountId;
+use nym_crypto::asymmetric::identity;
+use nym_gateway_requests::registration::handshake::SharedKeys;
+use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+use std::str::FromStr;
+use std::sync::Arc;
+use time::OffsetDateTime;
+use url::Url;
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+pub const REMOTE_GATEWAY_TYPE: &str = "remote";
+pub const CUSTOM_GATEWAY_TYPE: &str = "custom";
+
+#[derive(Debug, Clone, Default)]
+pub struct ActiveGateway {
+    pub registration: Option<GatewayRegistration>,
+}
+
+#[derive(Debug, Clone)]
+pub struct GatewayRegistration {
+    pub details: GatewayDetails,
+    pub registration_timestamp: OffsetDateTime,
+}
+
+impl<'a> From<&'a GatewayRegistration> for RawRegisteredGateway {
+    fn from(value: &'a GatewayRegistration) -> Self {
+        RawRegisteredGateway {
+            gateway_id_bs58: value.details.gateway_id().to_base58_string(),
+            registration_timestamp: value.registration_timestamp,
+            gateway_type: value.details.typ().to_string(),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum GatewayDetails {
+    /// Standard details of a remote gateway
+    Remote(RemoteGatewayDetails),
+
+    /// Custom gateway setup, such as for a client embedded inside gateway itself
+    Custom(CustomGatewayDetails),
+}
+
+impl From<GatewayDetails> for GatewayRegistration {
+    fn from(details: GatewayDetails) -> Self {
+        GatewayRegistration {
+            details,
+            registration_timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
+
+impl GatewayDetails {
+    pub fn new_remote(
+        gateway_id: identity::PublicKey,
+        derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+        gateway_owner_address: AccountId,
+        gateway_listener: Url,
+        wg_tun_address: Option<Url>,
+    ) -> Self {
+        GatewayDetails::Remote(RemoteGatewayDetails {
+            gateway_id,
+            derived_aes128_ctr_blake3_hmac_keys,
+            gateway_owner_address,
+            gateway_listener,
+            wg_tun_address,
+        })
+    }
+
+    pub fn new_custom(gateway_id: identity::PublicKey, data: Option<Vec<u8>>) -> Self {
+        GatewayDetails::Custom(CustomGatewayDetails { gateway_id, data })
+    }
+
+    pub fn gateway_id(&self) -> identity::PublicKey {
+        match self {
+            GatewayDetails::Remote(details) => details.gateway_id,
+            GatewayDetails::Custom(details) => details.gateway_id,
+        }
+    }
+
+    pub fn shared_key(&self) -> Option<&SharedKeys> {
+        match self {
+            GatewayDetails::Remote(details) => Some(&details.derived_aes128_ctr_blake3_hmac_keys),
+            GatewayDetails::Custom(_) => None,
+        }
+    }
+
+    pub fn is_custom(&self) -> bool {
+        matches!(self, GatewayDetails::Custom(..))
+    }
+
+    pub fn typ(&self) -> GatewayType {
+        match self {
+            GatewayDetails::Remote(_) => GatewayType::Remote,
+            GatewayDetails::Custom(_) => GatewayType::Custom,
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone, Default)]
+pub enum GatewayType {
+    #[default]
+    Remote,
+
+    Custom,
+}
+
+impl FromStr for GatewayType {
+    type Err = BadGateway;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            REMOTE_GATEWAY_TYPE => Ok(GatewayType::Remote),
+            CUSTOM_GATEWAY_TYPE => Ok(GatewayType::Custom),
+            other => Err(BadGateway::InvalidGatewayType {
+                typ: other.to_string(),
+            }),
+        }
+    }
+}
+
+impl Display for GatewayType {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            GatewayType::Remote => REMOTE_GATEWAY_TYPE.fmt(f),
+            GatewayType::Custom => CUSTOM_GATEWAY_TYPE.fmt(f),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
+pub struct RawActiveGateway {
+    pub active_gateway_id_bs58: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
+pub struct RawRegisteredGateway {
+    pub gateway_id_bs58: String,
+
+    // not necessarily needed but is nice for display purposes
+    pub registration_timestamp: OffsetDateTime,
+
+    pub gateway_type: String,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct RegisteredGateway {
+    pub gateway_id: identity::PublicKey,
+
+    pub registration_timestamp: OffsetDateTime,
+
+    pub gateway_type: GatewayType,
+}
+
+#[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
+#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
+pub struct RawRemoteGatewayDetails {
+    pub gateway_id_bs58: String,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: String,
+    pub gateway_owner_address: String,
+    pub gateway_listener: String,
+    pub wg_tun_address: Option<String>,
+}
+
+impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
+    type Error = BadGateway;
+
+    fn try_from(value: RawRemoteGatewayDetails) -> Result<Self, Self::Error> {
+        let gateway_id =
+            identity::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
+                BadGateway::MalformedGatewayIdentity {
+                    gateway_id: value.gateway_id_bs58.clone(),
+                    source,
+                }
+            })?;
+
+        let derived_aes128_ctr_blake3_hmac_keys = Arc::new(
+            SharedKeys::try_from_base58_string(&value.derived_aes128_ctr_blake3_hmac_keys_bs58)
+                .map_err(|source| BadGateway::MalformedSharedKeys {
+                    gateway_id: value.gateway_id_bs58.clone(),
+                    source,
+                })?,
+        );
+
+        let gateway_owner_address =
+            AccountId::from_str(&value.gateway_owner_address).map_err(|source| {
+                BadGateway::MalformedGatewayOwnerAccountAddress {
+                    gateway_id: value.gateway_id_bs58.clone(),
+                    raw_owner: value.gateway_owner_address.clone(),
+                    source,
+                }
+            })?;
+
+        let gateway_listener = Url::parse(&value.gateway_listener).map_err(|source| {
+            BadGateway::MalformedListener {
+                gateway_id: value.gateway_id_bs58.clone(),
+                raw_listener: value.gateway_listener.clone(),
+                source,
+            }
+        })?;
+
+        let wg_tun_address = value
+            .wg_tun_address
+            .as_ref()
+            .map(|addr| {
+                Url::parse(addr).map_err(|source| BadGateway::MalformedListener {
+                    gateway_id: value.gateway_id_bs58.clone(),
+                    raw_listener: addr.clone(),
+                    source,
+                })
+            })
+            .transpose()?;
+
+        Ok(RemoteGatewayDetails {
+            gateway_id,
+            derived_aes128_ctr_blake3_hmac_keys,
+            gateway_owner_address,
+            gateway_listener,
+            wg_tun_address,
+        })
+    }
+}
+
+impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
+    fn from(value: &'a RemoteGatewayDetails) -> Self {
+        RawRemoteGatewayDetails {
+            gateway_id_bs58: value.gateway_id.to_base58_string(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58: value
+                .derived_aes128_ctr_blake3_hmac_keys
+                .to_base58_string(),
+            gateway_owner_address: value.gateway_owner_address.to_string(),
+            gateway_listener: value.gateway_listener.to_string(),
+            wg_tun_address: value.wg_tun_address.as_ref().map(|addr| addr.to_string()),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct RemoteGatewayDetails {
+    pub gateway_id: identity::PublicKey,
+
+    // note: `SharedKeys` implement ZeroizeOnDrop, meaning when `RemoteGatewayDetails` is dropped,
+    // the keys will be zeroized
+    pub derived_aes128_ctr_blake3_hmac_keys: Arc<SharedKeys>,
+
+    pub gateway_owner_address: AccountId,
+
+    pub gateway_listener: Url,
+
+    pub wg_tun_address: Option<Url>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
+pub struct RawCustomGatewayDetails {
+    pub gateway_id_bs58: String,
+    pub data: Option<Vec<u8>>,
+}
+
+impl TryFrom<RawCustomGatewayDetails> for CustomGatewayDetails {
+    type Error = BadGateway;
+
+    fn try_from(value: RawCustomGatewayDetails) -> Result<Self, Self::Error> {
+        let gateway_id =
+            identity::PublicKey::from_base58_string(&value.gateway_id_bs58).map_err(|source| {
+                BadGateway::MalformedGatewayIdentity {
+                    gateway_id: value.gateway_id_bs58.clone(),
+                    source,
+                }
+            })?;
+
+        Ok(CustomGatewayDetails {
+            gateway_id,
+            data: value.data,
+        })
+    }
+}
+
+impl<'a> From<&'a CustomGatewayDetails> for RawCustomGatewayDetails {
+    fn from(value: &'a CustomGatewayDetails) -> Self {
+        RawCustomGatewayDetails {
+            gateway_id_bs58: value.gateway_id.to_base58_string(),
+            // I don't know what to feel about that clone here given it might contain possibly sensitive data
+            data: value.data.clone(),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CustomGatewayDetails {
+    pub gateway_id: identity::PublicKey,
+    pub data: Option<Vec<u8>>,
+}

common/client-core/src/cli_helpers/client_add_gateway.rs

@@ -0,0 +1,162 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::types::GatewayInfo;
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use crate::client::base_client::non_wasm_helpers::setup_fs_gateways_storage;
+use crate::{
+    client::{
+        base_client::storage::helpers::{get_all_registered_identities, set_active_gateway},
+        key_manager::persistence::OnDiskKeys,
+    },
+    error::ClientCoreError,
+    init::types::{GatewaySelectionSpecification, GatewaySetup},
+};
+use log::info;
+use nym_client_core_gateways_storage::GatewayDetails;
+use nym_crypto::asymmetric::identity;
+use nym_topology::NymTopology;
+use std::path::PathBuf;
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonClientAddGatewayArgs {
+    /// Id of client we want to add gateway for.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Explicitly specify id of the gateway to register with.
+    /// If unspecified, a random gateway will be chosen instead.
+    #[cfg_attr(feature = "cli", clap(long, alias = "gateway"))]
+    pub gateway_id: Option<identity::PublicKey>,
+
+    /// Specifies whether the client will attempt to enforce tls connection to the desired gateway.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub force_tls_gateway: bool,
+
+    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
+    /// uniformly.
+    #[cfg_attr(feature = "cli", clap(long, conflicts_with = "gateway_id"))]
+    pub latency_based_selection: bool,
+
+    /// Specify whether this new gateway should be set as the active one
+    #[cfg_attr(feature = "cli", clap(long, default_value_t = true))]
+    pub set_active: bool,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[cfg_attr(
+        feature = "cli",
+        clap(
+            long,
+            alias = "api_validators",
+            value_delimiter = ',',
+            group = "network"
+        )
+    )]
+    pub nym_apis: Option<Vec<url::Url>>,
+
+    /// Path to .json file containing custom network specification.
+    #[cfg_attr(feature = "cli", clap(long, group = "network", hide = true))]
+    pub custom_mixnet: Option<PathBuf>,
+}
+
+pub async fn add_gateway<C, A>(args: A) -> Result<GatewayInfo, C::Error>
+where
+    A: AsRef<CommonClientAddGatewayArgs>,
+    C: CliClient,
+{
+    let common_args = args.as_ref();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let core = config.core_config();
+    let paths = config.common_paths();
+
+    let key_store = OnDiskKeys::new(paths.keys.clone());
+    let details_store = setup_fs_gateways_storage(&paths.gateway_registrations).await?;
+
+    // Attempt to use a user-provided gateway, if possible
+    let user_chosen_gateway_id = common_args.gateway_id;
+    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+
+    let selection_spec = GatewaySelectionSpecification::new(
+        user_chosen_gateway_id.map(|id| id.to_base58_string()),
+        Some(common_args.latency_based_selection),
+        common_args.force_tls_gateway,
+    );
+    log::debug!("Gateway selection specification: {selection_spec:?}");
+
+    let registered_gateways = get_all_registered_identities(&details_store).await?;
+
+    // if user provided gateway id (and we can't overwrite data), make sure we're not trying to register
+    // with a known gateway
+    if let Some(user_chosen) = user_chosen_gateway_id {
+        if registered_gateways.contains(&user_chosen) {
+            return Err(ClientCoreError::AlreadyRegistered {
+                gateway_id: user_chosen.to_base58_string(),
+            }
+            .into());
+        }
+    }
+
+    // Setup gateway by either registering a new one, or creating a new config from the selected
+    // one but with keys kept, or reusing the gateway configuration.
+    let available_gateways = if let Some(custom_mixnet) = common_args.custom_mixnet.as_ref() {
+        let hardcoded_topology = NymTopology::new_from_file(custom_mixnet).map_err(|source| {
+            ClientCoreError::CustomTopologyLoadFailure {
+                file_path: custom_mixnet.clone(),
+                source,
+            }
+        })?;
+        hardcoded_topology.get_gateways()
+    } else {
+        let mut rng = rand::thread_rng();
+        crate::init::helpers::current_gateways(&mut rng, &core.client.nym_api_urls).await?
+    };
+
+    // since we're registering with a brand new gateway,
+    // make sure the list of available gateways doesn't overlap the list of known gateways
+    let available_gateways = available_gateways
+        .into_iter()
+        .filter(|g| !registered_gateways.contains(g.identity()))
+        .collect::<Vec<_>>();
+
+    if available_gateways.is_empty() {
+        return Err(ClientCoreError::NoNewGatewaysAvailable.into());
+    }
+
+    let gateway_setup = GatewaySetup::New {
+        specification: selection_spec,
+        available_gateways,
+        wg_tun_address: None,
+    };
+
+    let init_details =
+        crate::init::setup_gateway(gateway_setup, &key_store, &details_store).await?;
+
+    let address = init_details.client_address();
+
+    let gateway_registration = init_details.gateway_registration;
+    let GatewayDetails::Remote(ref gateway_details) = gateway_registration.details else {
+        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
+    };
+
+    if common_args.set_active {
+        set_active_gateway(
+            &details_store,
+            &gateway_details.gateway_id.to_base58_string(),
+        )
+        .await?;
+    } else {
+        info!("registered with new gateway {} (under address {address}), but this will not be our default address", gateway_details.gateway_id);
+    }
+
+    Ok(GatewayInfo {
+        registration: gateway_registration.registration_timestamp,
+        identity: gateway_details.gateway_id,
+        active: common_args.set_active,
+        typ: gateway_registration.details.typ().to_string(),
+        endpoint: Some(gateway_details.gateway_listener.clone()),
+        wg_tun_address: gateway_details.wg_tun_address.clone(),
+    })
+}

common/client-core/src/cli_helpers/client_import_credential.rs

@@ -0,0 +1,59 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use std::fs;
+use std::path::PathBuf;
+
+#[cfg(feature = "cli")]
+fn parse_encoded_credential_data(raw: &str) -> bs58::decode::Result<Vec<u8>> {
+    bs58::decode(raw).into_vec()
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[cfg_attr(feature = "cli", clap(group(clap::ArgGroup::new("cred_data").required(true))))]
+#[derive(Debug, Clone)]
+pub struct CommonClientImportCredentialArgs {
+    /// Id of client that is going to import the credential
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Explicitly provide the encoded credential data (as base58)
+    #[cfg_attr(feature = "cli", clap(long, group = "cred_data", value_parser = parse_encoded_credential_data))]
+    pub(crate) credential_data: Option<Vec<u8>>,
+
+    /// Specifies the path to file containing binary credential data
+    #[cfg_attr(feature = "cli", clap(long, group = "cred_data"))]
+    pub(crate) credential_path: Option<PathBuf>,
+
+    // currently hidden as there exists only a single serialization standard
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub(crate) version: Option<u8>,
+}
+
+pub async fn import_credential<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: Into<CommonClientImportCredentialArgs>,
+    C: CliClient,
+    C::Error: From<std::io::Error> + From<nym_id::NymIdError>,
+{
+    let common_args = args.into();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+
+    let raw_credential = match common_args.credential_data {
+        Some(data) => data,
+        None => {
+            // SAFETY: one of those arguments must have been set
+            fs::read(common_args.credential_path.unwrap())?
+        }
+    };
+
+    nym_id::import_credential(credentials_store, raw_credential, common_args.version).await?;
+    Ok(())
+}

common/client-core/src/cli_helpers/client_init.rs

@@ -1,27 +1,28 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::config::disk_persistence::CommonClientPaths;
+use crate::cli_helpers::traits::{CliClient, CliClientConfig};
 use crate::error::ClientCoreError;
 use crate::{
     client::{
-        base_client::storage::gateway_details::OnDiskGatewayDetails,
+        base_client::{
+            non_wasm_helpers::setup_fs_gateways_storage, storage::helpers::set_active_gateway,
+        },
         key_manager::persistence::OnDiskKeys,
     },
-    init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup, InitResults},
+    init::types::{GatewaySelectionSpecification, GatewaySetup, InitResults},
 };
 use log::info;
+use nym_client_core_gateways_storage::GatewayDetails;
 use nym_crypto::asymmetric::identity;
 use nym_topology::NymTopology;
-use std::path::{Path, PathBuf};
+use rand::rngs::OsRng;
+use std::path::PathBuf;
 
-pub trait InitialisableClient {
-    const NAME: &'static str;
-    type Error: From<ClientCoreError>;
+// we can suppress this warning (as suggested by linter itself) since we're only using it in our own code
+#[allow(async_fn_in_trait)]
+pub trait InitialisableClient: CliClient {
     type InitArgs: AsRef<CommonClientInitArgs>;
-    type Config: ClientConfig;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error>;
 
     fn initialise_storage_paths(id: &str) -> Result<(), Self::Error>;
 
@@ -30,16 +31,6 @@ pub trait InitialisableClient {
     fn construct_config(init_args: &Self::InitArgs) -> Self::Config;
 }
 
-pub trait ClientConfig {
-    fn common_paths(&self) -> &CommonClientPaths;
-
-    fn core_config(&self) -> &crate::config::Config;
-
-    fn default_store_location(&self) -> PathBuf;
-
-    fn save_to<P: AsRef<Path>>(&self, path: P) -> std::io::Result<()>;
-}
-
 #[cfg_attr(feature = "cli", derive(clap::Args))]
 #[derive(Debug, Clone)]
 pub struct CommonClientInitArgs {
@@ -51,16 +42,15 @@ pub struct CommonClientInitArgs {
     #[cfg_attr(feature = "cli", clap(long))]
     pub gateway: Option<identity::PublicKey>,
 
+    /// Specifies whether the client will attempt to enforce tls connection to the desired gateway.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub force_tls_gateway: bool,
+
     /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
     /// uniformly.
     #[cfg_attr(feature = "cli", clap(long, conflicts_with = "gateway"))]
     pub latency_based_selection: bool,
 
-    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
-    /// potentially causing loss of access.
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub force_register_gateway: bool,
-
     /// Comma separated list of rest endpoints of the nyxd validators
     #[cfg_attr(
         feature = "cli",
@@ -109,53 +99,60 @@ pub async fn initialise_client<C>(
 ) -> Result<InitResultsWithConfig<C::Config>, C::Error>
 where
     C: InitialisableClient,
+    <C as CliClient>::Config: std::fmt::Debug,
+    <C as InitialisableClient>::InitArgs: std::fmt::Debug,
 {
     info!("initialising {} client", C::NAME);
 
     let common_args = init_args.as_ref();
     let id = &common_args.id;
 
-    let already_init = if C::default_config_path(id).exists() {
-        // in case we're using old config, try to upgrade it
-        // (if we're using the current version, it's a no-op)
-        C::try_upgrade_outdated_config(id)?;
+    if C::default_config_path(id).exists() {
         eprintln!("{} client \"{id}\" was already initialised before", C::NAME);
-        true
-    } else {
-        C::initialise_storage_paths(id)?;
-        false
-    };
-
-    // Usually you only register with the gateway on the first init, however you can force
-    // re-registering if wanted.
-    let user_wants_force_register = common_args.force_register_gateway;
-    if user_wants_force_register {
-        eprintln!("Instructed to force registering gateway. This might overwrite keys!");
+        return Err(ClientCoreError::AlreadyInitialised {
+            client_id: id.to_string(),
+        }
+        .into());
     }
 
-    // If the client was already initialized, don't generate new keys and don't re-register with
-    // the gateway (because this would create a new shared key).
-    // Unless the user really wants to.
-    let register_gateway = !already_init || user_wants_force_register;
+    C::initialise_storage_paths(id)?;
 
     // Attempt to use a user-provided gateway, if possible
     let user_chosen_gateway_id = common_args.gateway;
+    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+
     let selection_spec = GatewaySelectionSpecification::new(
         user_chosen_gateway_id.map(|id| id.to_base58_string()),
         Some(common_args.latency_based_selection),
-        false,
+        common_args.force_tls_gateway,
     );
+    log::debug!("Gateway selection specification: {selection_spec:?}");
 
     // Load and potentially override config
+    log::debug!("Init arguments: {init_args:#?}");
     let config = C::construct_config(&init_args);
+    log::debug!("Constructed config: {config:#?}");
     let paths = config.common_paths();
     let core = config.core_config();
 
+    log::info!(
+        "Using nym-api: {}",
+        core.client
+            .nym_api_urls
+            .iter()
+            .map(|url| url.as_str())
+            .collect::<Vec<&str>>()
+            .join(",")
+    );
+
+    let key_store = OnDiskKeys::new(paths.keys.clone());
+    let details_store = setup_fs_gateways_storage(&paths.gateway_registrations).await?;
+
+    let mut rng = OsRng;
+    crate::init::generate_new_client_keys(&mut rng, &key_store).await?;
+
     // Setup gateway by either registering a new one, or creating a new config from the selected
     // one but with keys kept, or reusing the gateway configuration.
-    let key_store = OnDiskKeys::new(paths.keys.clone());
-    let details_store = OnDiskGatewayDetails::new(&paths.gateway_details);
-
     let available_gateways = if let Some(custom_mixnet) = common_args.custom_mixnet.as_ref() {
         let hardcoded_topology = NymTopology::new_from_file(custom_mixnet).map_err(|source| {
             ClientCoreError::CustomTopologyLoadFailure {
@@ -172,14 +169,13 @@ where
     let gateway_setup = GatewaySetup::New {
         specification: selection_spec,
         available_gateways,
-        overwrite_data: register_gateway,
+        wg_tun_address: None,
     };
 
     let init_details =
         crate::init::setup_gateway(gateway_setup, &key_store, &details_store).await?;
 
     // TODO: ask the service provider we specified for its interface version and set it in the config
-
     let config_save_location = config.default_store_location();
     if let Err(err) = config.save_to(&config_save_location) {
         return Err(ClientCoreError::ConfigSaveFailure {
@@ -196,12 +192,20 @@ where
         config_save_location.display()
     );
 
-    let address = init_details.client_address()?;
+    let address = init_details.client_address();
 
-    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
+    let GatewayDetails::Remote(gateway_details) = init_details.gateway_registration.details else {
         return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
     };
-    let init_results = InitResults::new(config.core_config(), address, &gateway_details);
+
+    let init_results = InitResults::new(
+        config.core_config(),
+        address,
+        &gateway_details,
+        init_details.gateway_registration.registration_timestamp,
+    );
+
+    set_active_gateway(&details_store, &init_results.gateway_id).await?;
 
     Ok(InitResultsWithConfig {
         config,

common/client-core/src/cli_helpers/client_list_gateways.rs

@@ -0,0 +1,74 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use super::types::GatewayInfo;
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use crate::client::base_client::non_wasm_helpers::setup_fs_gateways_storage;
+use crate::client::base_client::storage::helpers::{
+    get_active_gateway_identity, get_gateway_registrations,
+};
+use nym_client_core_gateways_storage::{GatewayDetails, GatewayType};
+use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonClientListGatewaysArgs {
+    /// Id of client we want to list gateways for.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct RegisteredGateways(Vec<GatewayInfo>);
+
+impl Display for RegisteredGateways {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        for (i, gateway) in self.0.iter().enumerate() {
+            writeln!(f, "[{i}]: {gateway}")?;
+        }
+        Ok(())
+    }
+}
+
+pub async fn list_gateways<C, A>(args: A) -> Result<RegisteredGateways, C::Error>
+where
+    A: AsRef<CommonClientListGatewaysArgs>,
+    C: CliClient,
+{
+    let common_args = args.as_ref();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let details_store = setup_fs_gateways_storage(&paths.gateway_registrations).await?;
+
+    let active_gateway = get_active_gateway_identity(&details_store).await?;
+
+    let gateways = get_gateway_registrations(&details_store).await?;
+    let mut info = Vec::with_capacity(gateways.len());
+    for gateway in gateways {
+        match gateway.details {
+            GatewayDetails::Remote(remote_details) => info.push(GatewayInfo {
+                registration: gateway.registration_timestamp,
+                identity: remote_details.gateway_id,
+                active: active_gateway == Some(remote_details.gateway_id),
+                typ: GatewayType::Remote.to_string(),
+                endpoint: Some(remote_details.gateway_listener),
+                wg_tun_address: remote_details.wg_tun_address,
+            }),
+            GatewayDetails::Custom(_) => info.push(GatewayInfo {
+                registration: gateway.registration_timestamp,
+                identity: gateway.details.gateway_id(),
+                active: active_gateway == Some(gateway.details.gateway_id()),
+                typ: gateway.details.typ().to_string(),
+                endpoint: None,
+                wg_tun_address: None,
+            }),
+        };
+    }
+
+    Ok(RegisteredGateways(info))
+}

common/client-core/src/cli_helpers/client_switch_gateway.rs

@@ -0,0 +1,37 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use crate::client::base_client::non_wasm_helpers::setup_fs_gateways_storage;
+use crate::client::base_client::storage::helpers::set_active_gateway;
+use nym_crypto::asymmetric::identity;
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonClientSwitchGatewaysArgs {
+    /// Id of client we want to list gateways for.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Id of the gateway we want to switch to.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub gateway_id: identity::PublicKey,
+}
+
+pub async fn switch_gateway<C, A>(args: A) -> Result<(), C::Error>
+where
+    A: AsRef<CommonClientSwitchGatewaysArgs>,
+    C: CliClient,
+{
+    let common_args = args.as_ref();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let details_store = setup_fs_gateways_storage(&paths.gateway_registrations).await?;
+
+    set_active_gateway(&details_store, &common_args.gateway_id.to_base58_string()).await?;
+
+    Ok(())
+}

common/client-core/src/cli_helpers/mod.rs

@@ -1,5 +1,14 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+pub mod client_add_gateway;
+pub mod client_import_credential;
 pub mod client_init;
+pub mod client_list_gateways;
 pub mod client_run;
+pub mod client_switch_gateway;
+pub mod traits;
+mod types;
+
+pub use client_init::InitialisableClient;
+pub use traits::{CliClient, CliClientConfig};

common/client-core/src/cli_helpers/traits.rs

@@ -0,0 +1,28 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::config::disk_persistence::CommonClientPaths;
+use crate::error::ClientCoreError;
+use std::path::{Path, PathBuf};
+
+// we can suppress this warning (as suggested by linter itself) since we're only using it in our own code
+#[allow(async_fn_in_trait)]
+pub trait CliClient {
+    const NAME: &'static str;
+    type Error: From<ClientCoreError>;
+    type Config: CliClientConfig;
+
+    async fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error>;
+
+    async fn try_load_current_config(id: &str) -> Result<Self::Config, Self::Error>;
+}
+
+pub trait CliClientConfig {
+    fn common_paths(&self) -> &CommonClientPaths;
+
+    fn core_config(&self) -> &crate::config::Config;
+
+    fn default_store_location(&self) -> PathBuf;
+
+    fn save_to<P: AsRef<Path>>(&self, path: P) -> std::io::Result<()>;
+}

common/client-core/src/cli_helpers/types.rs

@@ -0,0 +1,40 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_crypto::asymmetric::identity;
+use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+use time::OffsetDateTime;
+use url::Url;
+
+#[derive(Serialize, Deserialize)]
+pub struct GatewayInfo {
+    pub registration: OffsetDateTime,
+    pub identity: identity::PublicKey,
+    pub active: bool,
+
+    pub typ: String,
+    pub endpoint: Option<Url>,
+    pub wg_tun_address: Option<Url>,
+}
+
+impl Display for GatewayInfo {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        if self.active {
+            write!(f, "[ACTIVE] ")?;
+        }
+        write!(
+            f,
+            "{} gateway '{}' registered at: {}",
+            self.typ, self.identity, self.registration
+        )?;
+        if let Some(endpoint) = &self.endpoint {
+            write!(f, " endpoint: {endpoint}")?;
+        }
+
+        if let Some(wg_tun_address) = &self.wg_tun_address {
+            write!(f, " wg tun address: {wg_tun_address}")?;
+        }
+        Ok(())
+    }
+}

common/client-core/src/client/base_client/mod.rs

@@ -1,15 +1,18 @@
 // Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use super::packet_statistics_control::PacketStatisticsReporter;
 use super::received_buffer::ReceivedBufferMessage;
 use super::topology_control::geo_aware_provider::GeoAwareTopologyProvider;
-use crate::client::base_client::storage::gateway_details::GatewayDetailsStore;
+use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
 use crate::client::key_manager::persistence::KeyStore;
+use crate::client::key_manager::ClientKeys;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
+use crate::client::packet_statistics_control::PacketStatisticsControl;
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -28,17 +31,19 @@ use crate::config::{Config, DebugConfig};
 use crate::error::ClientCoreError;
 use crate::init::{
     setup_gateway,
-    types::{GatewayDetails, GatewaySetup, InitialisationResult},
+    types::{GatewaySetup, InitialisationResult},
 };
 use crate::{config, spawn_future};
 use futures::channel::mpsc;
-use log::{debug, error, info};
+use log::{debug, error, info, warn};
 use nym_bandwidth_controller::BandwidthController;
+use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::encryption;
 use nym_gateway_client::{
-    AcknowledgementReceiver, GatewayClient, MixnetMessageReceiver, PacketRouter,
+    AcknowledgementReceiver, GatewayClient, GatewayConfig, MixnetMessageReceiver, PacketRouter,
 };
+use nym_network_defaults::{DEFAULT_CLIENT_LISTENING_PORT, WG_TUN_DEVICE_ADDRESS};
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::addressing::nodes::NodeIdentity;
@@ -49,12 +54,18 @@ use nym_task::{TaskClient, TaskHandle};
 use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
+use rand::rngs::OsRng;
 use std::fmt::Debug;
+use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
 use url::Url;
 
-#[cfg(all(not(target_arch = "wasm32"), feature = "fs-surb-storage"))]
+#[cfg(all(
+    not(target_arch = "wasm32"),
+    feature = "fs-surb-storage",
+    feature = "fs-gateways-storage"
+))]
 pub mod non_wasm_helpers;
 
 pub mod helpers;
@@ -101,6 +112,12 @@ pub struct ClientState {
     pub shared_lane_queue_lengths: LaneQueueLengths,
     pub reply_controller_sender: ReplyControllerSender,
     pub topology_accessor: TopologyAccessor,
+    pub gateway_connection: GatewayConnection,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct GatewayConnection {
+    pub gateway_ws_fd: Option<RawFd>,
 }
 
 pub enum ClientInputStatus {
@@ -163,6 +180,7 @@ pub struct BaseClientBuilder<'a, C, S: MixnetClientStorage> {
     dkg_query_client: Option<C>,
 
     wait_for_gateway: bool,
+    wireguard_connection: bool,
     custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
     custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
     shutdown: Option<TaskClient>,
@@ -185,10 +203,11 @@ where
             client_store,
             dkg_query_client,
             wait_for_gateway: false,
+            wireguard_connection: false,
             custom_topology_provider: None,
             custom_gateway_transceiver: None,
             shutdown: None,
-            setup_method: GatewaySetup::MustLoad,
+            setup_method: GatewaySetup::MustLoad { gateway_id: None },
         }
     }
 
@@ -204,6 +223,12 @@ where
         self
     }
 
+    #[must_use]
+    pub fn with_wireguard_connection(mut self, wireguard_connection: bool) -> Self {
+        self.wireguard_connection = wireguard_connection;
+        self
+    }
+
     #[must_use]
     pub fn with_topology_provider(
         mut self,
@@ -237,13 +262,7 @@ where
     // note: do **NOT** make this method public as its only valid usage is from within `start_base`
     // because it relies on the crypto keys being already loaded
     fn mix_address(details: &InitialisationResult) -> Recipient {
-        Recipient::new(
-            *details.managed_keys.identity_public_key(),
-            *details.managed_keys.encryption_public_key(),
-            // TODO: below only works under assumption that gateway address == gateway id
-            // (which currently is true)
-            NodeIdentity::from_base58_string(details.gateway_details.gateway_id()).unwrap(),
-        )
+        details.client_address()
     }
 
     // future constantly pumping loop cover traffic at some specified average rate
@@ -254,6 +273,7 @@ where
         self_address: Recipient,
         topology_accessor: TopologyAccessor,
         mix_tx: BatchMixMessageSender,
+        stats_tx: PacketStatisticsReporter,
         shutdown: TaskClient,
     ) {
         info!("Starting loop cover traffic stream...");
@@ -266,6 +286,7 @@ where
             topology_accessor,
             debug_config.traffic,
             debug_config.cover_traffic,
+            stats_tx,
         );
 
         stream.start_with_shutdown(shutdown);
@@ -285,6 +306,7 @@ where
         client_connection_rx: ConnectionCommandReceiver,
         shutdown: TaskClient,
         packet_type: PacketType,
+        stats_tx: PacketStatisticsReporter,
     ) {
         info!("Starting real traffic stream...");
 
@@ -299,6 +321,7 @@ where
             reply_controller_receiver,
             lane_queue_lengths,
             client_connection_rx,
+            stats_tx,
         )
         .start_with_shutdown(shutdown, packet_type);
     }
@@ -312,6 +335,7 @@ where
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
         shutdown: TaskClient,
+        packet_statistics_control: PacketStatisticsReporter,
     ) {
         info!("Starting received messages buffer controller...");
         let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
@@ -321,12 +345,14 @@ where
                 mixnet_receiver,
                 reply_key_storage,
                 reply_controller_sender,
+                packet_statistics_control,
             );
         controller.start_with_shutdown(shutdown)
     }
 
     async fn start_gateway_client(
         config: &Config,
+        wireguard_connection: bool,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
         packet_router: PacketRouter,
@@ -336,50 +362,65 @@ where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
         <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
     {
-        let managed_keys = initialisation_result.managed_keys;
-        let GatewayDetails::Configured(gateway_config) = initialisation_result.gateway_details
+        let managed_keys = initialisation_result.client_keys;
+        let GatewayDetails::Remote(details) = initialisation_result.gateway_registration.details
         else {
             return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails);
         };
 
-        let mut gateway_client =
-            if let Some(existing_client) = initialisation_result.authenticated_ephemeral_client {
-                existing_client.upgrade(packet_router, bandwidth_controller, shutdown)
+        let mut gateway_client = if let Some(existing_client) =
+            initialisation_result.authenticated_ephemeral_client
+        {
+            existing_client.upgrade(packet_router, bandwidth_controller, shutdown)
+        } else {
+            let gateway_listener = if wireguard_connection {
+                if let Some(tun_address) = details.wg_tun_address {
+                    tun_address.to_string()
+                } else {
+                    let default =
+                        format!("ws://{WG_TUN_DEVICE_ADDRESS}:{DEFAULT_CLIENT_LISTENING_PORT}");
+                    warn!("gateway {} does not have tun device address set. defaulting to '{default}'", details.gateway_id);
+                    default
+                }
             } else {
-                let cfg = gateway_config.try_into()?;
-                GatewayClient::new(
-                    cfg,
-                    managed_keys.identity_keypair(),
-                    Some(managed_keys.must_get_gateway_shared_key()),
-                    packet_router,
-                    bandwidth_controller,
-                    shutdown,
-                )
-                .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
-                .with_response_timeout(config.debug.gateway_connection.gateway_response_timeout)
+                details.gateway_listener.to_string()
             };
 
-        let gateway_id = gateway_client.gateway_identity();
+            let cfg = GatewayConfig::new(
+                details.gateway_id,
+                Some(details.gateway_owner_address.to_string()),
+                gateway_listener,
+            );
+            GatewayClient::new(
+                cfg,
+                managed_keys.identity_keypair(),
+                Some(details.derived_aes128_ctr_blake3_hmac_keys),
+                packet_router,
+                bandwidth_controller,
+                shutdown,
+            )
+            .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
+            .with_response_timeout(config.debug.gateway_connection.gateway_response_timeout)
+        };
 
-        let shared_key = gateway_client
+        gateway_client
             .authenticate_and_start()
             .await
             .map_err(|err| {
                 log::error!("Could not authenticate and start up the gateway connection - {err}");
                 ClientCoreError::GatewayClientError {
-                    gateway_id: gateway_id.to_base58_string(),
+                    gateway_id: details.gateway_id.to_base58_string(),
                     source: err,
                 }
             })?;
 
-        managed_keys.ensure_gateway_key(Some(shared_key));
-
         Ok(gateway_client)
     }
 
     async fn setup_gateway_transceiver(
         custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
         config: &Config,
+        wireguard_connection: bool,
         initialisation_result: InitialisationResult,
         bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
         packet_router: PacketRouter,
@@ -391,7 +432,11 @@ where
     {
         // if we have setup custom gateway sender and persisted details agree with it, return it
         if let Some(mut custom_gateway_transceiver) = custom_gateway_transceiver {
-            return if !initialisation_result.gateway_details.is_custom() {
+            return if !initialisation_result
+                .gateway_registration
+                .details
+                .is_custom()
+            {
                 Err(ClientCoreError::CustomGatewaySelectionExpected)
             } else {
                 // and make sure to invalidate the task client so we wouldn't cause premature shutdown
@@ -404,6 +449,7 @@ where
         // otherwise, setup normal gateway client, etc
         let gateway_client = Self::start_gateway_client(
             config,
+            wireguard_connection,
             initialisation_result,
             bandwidth_controller,
             packet_router,
@@ -506,6 +552,13 @@ where
         Ok(())
     }
 
+    fn start_packet_statistics_control(shutdown: TaskClient) -> PacketStatisticsReporter {
+        info!("Starting packet statistics control...");
+        let (packet_statistics_control, packet_stats_reporter) = PacketStatisticsControl::new();
+        packet_statistics_control.start_with_shutdown(shutdown);
+        packet_stats_reporter
+    }
+
     fn start_mix_traffic_controller(
         gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
         shutdown: TaskClient,
@@ -547,12 +600,20 @@ where
     async fn initialise_keys_and_gateway(
         setup_method: GatewaySetup,
         key_store: &S::KeyStore,
-        details_store: &S::GatewayDetailsStore,
+        details_store: &S::GatewaysDetailsStore,
     ) -> Result<InitialisationResult, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Sync + Send,
-        <S::GatewayDetailsStore as GatewayDetailsStore>::StorageError: Sync + Send,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
     {
+        // if client keys do not exist already, create and persist them
+        if key_store.load_keys().await.is_err() {
+            info!("could not find valid client keys - a new set will be generated");
+            let mut rng = OsRng;
+            let keys = ClientKeys::generate_new(&mut rng);
+            store_client_keys(keys, key_store).await?;
+        }
+
         setup_gateway(setup_method, key_store, details_store).await
     }
 
@@ -562,7 +623,7 @@ where
         <S::KeyStore as KeyStore>::StorageError: Send + Sync,
         <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
         <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
-        <S::GatewayDetailsStore as GatewayDetailsStore>::StorageError: Sync + Send,
+        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
     {
         info!("Starting nym client");
 
@@ -607,8 +668,8 @@ where
             reply_controller::requests::new_control_channels();
 
         let self_address = Self::mix_address(&init_res);
-        let ack_key = init_res.managed_keys.ack_key();
-        let encryption_keys = init_res.managed_keys.encryption_keypair();
+        let ack_key = init_res.client_keys.ack_key();
+        let encryption_keys = init_res.client_keys.encryption_keypair();
 
         // the components are started in very specific order. Unless you know what you are doing,
         // do not change that.
@@ -633,6 +694,9 @@ where
         )
         .await?;
 
+        let packet_stats_reporter =
+            Self::start_packet_statistics_control(shutdown.fork("packet_statistics_control"));
+
         let gateway_packet_router = PacketRouter::new(
             ack_sender,
             mixnet_messages_sender,
@@ -642,12 +706,14 @@ where
         let gateway_transceiver = Self::setup_gateway_transceiver(
             self.custom_gateway_transceiver,
             self.config,
+            self.wireguard_connection,
             init_res,
             bandwidth_controller,
             gateway_packet_router,
             shutdown.fork("gateway_transceiver"),
         )
         .await?;
+        let gateway_ws_fd = gateway_transceiver.ws_fd();
 
         let reply_storage = Self::setup_persistent_reply_storage(
             reply_storage_backend,
@@ -662,6 +728,7 @@ where
             reply_storage.key_storage(),
             reply_controller_sender.clone(),
             shutdown.fork("received_messages_buffer"),
+            packet_stats_reporter.clone(),
         );
 
         // The message_sender is the transmitter for any component generating sphinx packets
@@ -700,6 +767,7 @@ where
             client_connection_rx,
             shutdown.fork("real_traffic_controller"),
             self.config.debug.traffic.packet_type,
+            packet_stats_reporter.clone(),
         );
 
         if !self
@@ -714,6 +782,7 @@ where
                 self_address,
                 shared_topology_accessor.clone(),
                 message_sender,
+                packet_stats_reporter,
                 shutdown.fork("cover_traffic_stream"),
             );
         }
@@ -738,6 +807,7 @@ where
                 shared_lane_queue_lengths,
                 reply_controller_sender,
                 topology_accessor: shared_topology_accessor,
+                gateway_connection: GatewayConnection { gateway_ws_fd },
             },
             task_handle: shutdown,
         })

common/client-core/src/client/base_client/non_wasm_helpers.rs

@@ -1,4 +1,4 @@
-// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::replies::reply_storage::{
@@ -7,8 +7,9 @@ use crate::client::replies::reply_storage::{
 use crate::config;
 use crate::config::Config;
 use crate::error::ClientCoreError;
-use log::{error, info};
+use log::{error, info, trace};
 use nym_bandwidth_controller::BandwidthController;
+use nym_client_core_gateways_storage::OnDiskGatewaysDetails;
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_validator_client::nyxd;
 use nym_validator_client::QueryHttpRpcNyxdClient;
@@ -101,6 +102,17 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
     }
 }
 
+pub async fn setup_fs_gateways_storage<P: AsRef<Path>>(
+    db_path: P,
+) -> Result<OnDiskGatewaysDetails, ClientCoreError> {
+    trace!("setting up gateways details storage");
+    OnDiskGatewaysDetails::init(db_path)
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+}
+
 pub fn create_bandwidth_controller<St: CredentialStorage>(
     config: &Config,
     storage: St,

common/client-core/src/client/base_client/storage/gateway_details.rs

@@ -1,296 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::config::GatewayEndpointConfig;
-use crate::error::ClientCoreError;
-use crate::init::types::{EmptyCustomDetails, GatewayDetails};
-use async_trait::async_trait;
-use log::error;
-use nym_gateway_requests::registration::handshake::SharedKeys;
-use serde::de::DeserializeOwned;
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-use std::error::Error;
-use std::ops::Deref;
-use tokio::sync::Mutex;
-use zeroize::Zeroizing;
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait GatewayDetailsStore<T = EmptyCustomDetails> {
-    type StorageError: Error;
-
-    async fn load_gateway_details(&self) -> Result<PersistedGatewayDetails<T>, Self::StorageError>
-    where
-        T: DeserializeOwned + Send + Sync;
-
-    async fn store_gateway_details(
-        &self,
-        details: &PersistedGatewayDetails<T>,
-    ) -> Result<(), Self::StorageError>
-    where
-        T: Serialize + Send + Sync;
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum PersistedGatewayDetails<T = EmptyCustomDetails> {
-    /// Standard details of a remote gateway
-    Default(PersistedGatewayConfig),
-
-    /// Custom gateway setup, such as for a client embedded inside gateway itself
-    Custom(PersistedCustomGatewayDetails<T>),
-}
-
-impl<T> PersistedGatewayDetails<T> {
-    // TODO: this should probably allow for custom verification over T
-    pub fn validate(&self, shared_key: Option<&SharedKeys>) -> Result<(), ClientCoreError> {
-        match self {
-            PersistedGatewayDetails::Default(details) => {
-                if !details.verify(shared_key.ok_or(ClientCoreError::UnavailableSharedKey)?) {
-                    Err(ClientCoreError::MismatchedGatewayDetails {
-                        gateway_id: details.details.gateway_id.clone(),
-                    })
-                } else {
-                    Ok(())
-                }
-            }
-            PersistedGatewayDetails::Custom(_) => {
-                if shared_key.is_some() {
-                    error!("using custom persisted gateway setup with shared key present - are you sure that's what you want?");
-                    // but technically we could still continue. just ignore the key
-                }
-                Ok(())
-            }
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
-pub struct PersistedGatewayConfig {
-    // TODO: should we also verify correctness of the details themselves?
-    // i.e. we could include a checksum or tag (via the shared keys)
-    // counterargument: if we wanted to modify, say, the host information in the stored file on disk,
-    // in order to actually use it, we'd have to recompute the whole checksum which would be a huge pain.
-    /// The hash of the shared keys to ensure the correct ones are used with those gateway details.
-    #[serde(with = "base64")]
-    key_hash: Vec<u8>,
-
-    /// Actual gateway details being persisted.
-    pub details: GatewayEndpointConfig,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PersistedCustomGatewayDetails<T> {
-    // whatever custom method is used, gateway's identity must be known
-    pub gateway_id: String,
-
-    #[serde(flatten)]
-    pub additional_data: T,
-}
-
-impl PersistedGatewayConfig {
-    pub fn new(details: GatewayEndpointConfig, shared_key: &SharedKeys) -> Self {
-        let key_bytes = Zeroizing::new(shared_key.to_bytes());
-
-        let mut key_hasher = Sha256::new();
-        key_hasher.update(&key_bytes);
-        let key_hash = key_hasher.finalize().to_vec();
-
-        PersistedGatewayConfig { key_hash, details }
-    }
-
-    pub fn verify(&self, shared_key: &SharedKeys) -> bool {
-        let key_bytes = Zeroizing::new(shared_key.to_bytes());
-
-        let mut key_hasher = Sha256::new();
-        key_hasher.update(&key_bytes);
-        let key_hash = key_hasher.finalize();
-
-        self.key_hash == key_hash.deref()
-    }
-}
-
-impl<T> PersistedGatewayDetails<T> {
-    pub fn new(
-        details: GatewayDetails<T>,
-        shared_key: Option<&SharedKeys>,
-    ) -> Result<Self, ClientCoreError> {
-        match details {
-            GatewayDetails::Configured(cfg) => {
-                let shared_key = shared_key.ok_or(ClientCoreError::UnavailableSharedKey)?;
-                Ok(PersistedGatewayDetails::Default(
-                    PersistedGatewayConfig::new(cfg, shared_key),
-                ))
-            }
-            GatewayDetails::Custom(custom) => Ok(PersistedGatewayDetails::Custom(custom.into())),
-        }
-    }
-
-    pub fn is_custom(&self) -> bool {
-        matches!(self, PersistedGatewayDetails::Custom(..))
-    }
-
-    pub fn matches(&self, other: &GatewayDetails<T>) -> bool
-    where
-        T: PartialEq,
-    {
-        match self {
-            PersistedGatewayDetails::Default(default) => {
-                if let GatewayDetails::Configured(other_configured) = other {
-                    &default.details == other_configured
-                } else {
-                    false
-                }
-            }
-            PersistedGatewayDetails::Custom(custom) => {
-                if let GatewayDetails::Custom(other_custom) = other {
-                    custom.gateway_id == other_custom.gateway_id
-                        && custom.additional_data == other_custom.additional_data
-                } else {
-                    false
-                }
-            }
-        }
-    }
-}
-
-// helper to make Vec<u8> serialization use base64 representation to make it human readable
-// so that it would be easier for users to copy contents from the disk if they wanted to use it elsewhere
-mod base64 {
-    use base64::{engine::general_purpose::STANDARD, Engine as _};
-    use serde::{Deserialize, Deserializer, Serializer};
-
-    pub fn serialize<S: Serializer>(bytes: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
-        serializer.serialize_str(&STANDARD.encode(bytes))
-    }
-
-    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Vec<u8>, D::Error> {
-        let s = <String>::deserialize(deserializer)?;
-        STANDARD.decode(s).map_err(serde::de::Error::custom)
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-#[derive(Debug, thiserror::Error)]
-pub enum OnDiskGatewayDetailsError {
-    #[error("JSON failure: {0}")]
-    SerializationFailure(#[from] serde_json::Error),
-
-    #[error("failed to store gateway details to {path}: {err}")]
-    StoreFailure {
-        path: String,
-        #[source]
-        err: std::io::Error,
-    },
-
-    #[error("failed to load gateway details from {path}: {err}")]
-    LoadFailure {
-        path: String,
-        #[source]
-        err: std::io::Error,
-    },
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-pub struct OnDiskGatewayDetails {
-    file_location: std::path::PathBuf,
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-impl OnDiskGatewayDetails {
-    pub fn new<P: AsRef<std::path::Path>>(path: P) -> Self {
-        OnDiskGatewayDetails {
-            file_location: path.as_ref().to_owned(),
-        }
-    }
-
-    pub fn load_from_disk<T>(&self) -> Result<PersistedGatewayDetails<T>, OnDiskGatewayDetailsError>
-    where
-        T: DeserializeOwned,
-    {
-        let file = std::fs::File::open(&self.file_location).map_err(|err| {
-            OnDiskGatewayDetailsError::LoadFailure {
-                path: self.file_location.display().to_string(),
-                err,
-            }
-        })?;
-
-        Ok(serde_json::from_reader(file)?)
-    }
-
-    pub fn store_to_disk<T>(
-        &self,
-        details: &PersistedGatewayDetails<T>,
-    ) -> Result<(), OnDiskGatewayDetailsError>
-    where
-        T: Serialize,
-    {
-        // ensure the whole directory structure exists
-        if let Some(parent_dir) = &self.file_location.parent() {
-            std::fs::create_dir_all(parent_dir).map_err(|err| {
-                OnDiskGatewayDetailsError::StoreFailure {
-                    path: self.file_location.display().to_string(),
-                    err,
-                }
-            })?
-        }
-
-        let file = std::fs::File::create(&self.file_location).map_err(|err| {
-            OnDiskGatewayDetailsError::StoreFailure {
-                path: self.file_location.display().to_string(),
-                err,
-            }
-        })?;
-
-        Ok(serde_json::to_writer_pretty(file, details)?)
-    }
-}
-
-#[cfg(not(target_arch = "wasm32"))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl GatewayDetailsStore for OnDiskGatewayDetails {
-    type StorageError = OnDiskGatewayDetailsError;
-
-    async fn load_gateway_details(&self) -> Result<PersistedGatewayDetails, Self::StorageError> {
-        self.load_from_disk()
-    }
-
-    async fn store_gateway_details(
-        &self,
-        gateway_details: &PersistedGatewayDetails,
-    ) -> Result<(), Self::StorageError> {
-        self.store_to_disk(gateway_details)
-    }
-}
-
-#[derive(Default)]
-pub struct InMemGatewayDetails<T = EmptyCustomDetails> {
-    details: Mutex<Option<PersistedGatewayDetails<T>>>,
-}
-
-#[derive(Debug, thiserror::Error)]
-#[error("old ephemeral gateway details can't be loaded from storage")]
-pub struct EphemeralGatewayDetailsError;
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl GatewayDetailsStore for InMemGatewayDetails {
-    type StorageError = EphemeralGatewayDetailsError;
-
-    async fn load_gateway_details(&self) -> Result<PersistedGatewayDetails, Self::StorageError> {
-        self.details
-            .lock()
-            .await
-            .clone()
-            .ok_or(EphemeralGatewayDetailsError)
-    }
-
-    async fn store_gateway_details(
-        &self,
-        gateway_details: &PersistedGatewayDetails,
-    ) -> Result<(), Self::StorageError> {
-        *self.details.lock().await = Some(gateway_details.clone());
-        Ok(())
-    }
-}

common/client-core/src/client/base_client/storage/helpers.rs

@@ -0,0 +1,157 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::key_manager::persistence::KeyStore;
+use crate::client::key_manager::ClientKeys;
+use crate::error::ClientCoreError;
+use nym_client_core_gateways_storage::{ActiveGateway, GatewayRegistration, GatewaysDetailsStore};
+use nym_crypto::asymmetric::identity;
+
+// helpers for error wrapping
+pub async fn set_active_gateway<D>(
+    details_store: &D,
+    gateway_id: &str,
+) -> Result<(), ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .set_active_gateway(gateway_id)
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+}
+
+pub async fn get_active_gateway_identity<D>(
+    details_store: &D,
+) -> Result<Option<identity::PublicKey>, ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .active_gateway()
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+        .map(|a| a.registration.map(|r| r.details.gateway_id()))
+}
+
+pub async fn get_all_registered_identities<D>(
+    details_store: &D,
+) -> Result<Vec<identity::PublicKey>, ClientCoreError>
+where
+    D: GatewaysDetailsStore + Sync,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .all_gateways_identities()
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+}
+
+pub async fn get_gateway_registrations<D>(
+    details_store: &D,
+) -> Result<Vec<GatewayRegistration>, ClientCoreError>
+where
+    D: GatewaysDetailsStore + Sync,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store.all_gateways().await.map_err(|source| {
+        ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        }
+    })
+}
+
+pub async fn store_gateway_details<D>(
+    details_store: &D,
+    details: &GatewayRegistration,
+) -> Result<(), ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .store_gateway_details(details)
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+}
+
+pub async fn load_active_gateway_details<D>(
+    details_store: &D,
+) -> Result<ActiveGateway, ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store.active_gateway().await.map_err(|source| {
+        ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        }
+    })
+}
+
+pub async fn load_gateway_details<D>(
+    details_store: &D,
+    gateway_id: &str,
+) -> Result<GatewayRegistration, ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .load_gateway_details(gateway_id)
+        .await
+        .map_err(|source| ClientCoreError::UnavailableGatewayDetails {
+            gateway_id: gateway_id.to_string(),
+            source: Box::new(source),
+        })
+}
+
+pub async fn has_gateway_details<D>(
+    details_store: &D,
+    gateway_id: &str,
+) -> Result<bool, ClientCoreError>
+where
+    D: GatewaysDetailsStore,
+    D::StorageError: Send + Sync + 'static,
+{
+    details_store
+        .has_gateway_details(gateway_id)
+        .await
+        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
+            source: Box::new(source),
+        })
+}
+
+pub async fn load_client_keys<K>(key_store: &K) -> Result<ClientKeys, ClientCoreError>
+where
+    K: KeyStore,
+    K::StorageError: Send + Sync + 'static,
+{
+    ClientKeys::load_keys(key_store)
+        .await
+        .map_err(|source| ClientCoreError::KeyStoreError {
+            source: Box::new(source),
+        })
+}
+
+pub async fn store_client_keys<K>(keys: ClientKeys, key_store: &K) -> Result<(), ClientCoreError>
+where
+    K: KeyStore,
+    K::StorageError: Send + Sync + 'static,
+{
+    keys.persist_keys(key_store)
+        .await
+        .map_err(|source| ClientCoreError::KeyStoreError {
+            source: Box::new(source),
+        })
+}

common/client-core/src/client/base_client/storage/migration_helpers.rs

@@ -0,0 +1,212 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod v1_1_33 {
+    use crate::client::base_client::{
+        non_wasm_helpers::setup_fs_gateways_storage,
+        storage::helpers::{set_active_gateway, store_gateway_details},
+    };
+    use crate::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
+    use crate::config::disk_persistence::CommonClientPaths;
+    use crate::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
+    use crate::error::ClientCoreError;
+    use nym_client_core_gateways_storage::{
+        CustomGatewayDetails, GatewayDetails, GatewayRegistration, RemoteGatewayDetails,
+    };
+    use nym_gateway_requests::registration::handshake::SharedKeys;
+    use serde::{Deserialize, Serialize};
+    use sha2::{digest::Digest, Sha256};
+    use std::ops::Deref;
+    use std::path::Path;
+    use std::sync::Arc;
+    use zeroize::Zeroizing;
+
+    mod base64 {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+        use serde::{Deserialize, Deserializer, Serializer};
+
+        pub fn serialize<S: Serializer>(bytes: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
+            serializer.serialize_str(&STANDARD.encode(bytes))
+        }
+
+        pub fn deserialize<'de, D: Deserializer<'de>>(
+            deserializer: D,
+        ) -> Result<Vec<u8>, D::Error> {
+            let s = <String>::deserialize(deserializer)?;
+            STANDARD.decode(s).map_err(serde::de::Error::custom)
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    #[serde(untagged)]
+    enum PersistedGatewayDetails {
+        /// Standard details of a remote gateway
+        Default(PersistedGatewayConfig),
+
+        /// Custom gateway setup, such as for a client embedded inside gateway itself
+        Custom(PersistedCustomGatewayDetails),
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+    struct PersistedGatewayConfig {
+        /// The hash of the shared keys to ensure the correct ones are used with those gateway details.
+        #[serde(with = "base64")]
+        key_hash: Vec<u8>,
+
+        /// Actual gateway details being persisted.
+        details: OldGatewayEndpointConfigV1_1_33,
+    }
+
+    impl PersistedGatewayConfig {
+        fn verify(&self, shared_key: &SharedKeys) -> bool {
+            let key_bytes = Zeroizing::new(shared_key.to_bytes());
+
+            let mut key_hasher = Sha256::new();
+            key_hasher.update(&key_bytes);
+            let key_hash = key_hasher.finalize();
+
+            self.key_hash == key_hash.deref()
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    struct PersistedCustomGatewayDetails {
+        gateway_id: String,
+    }
+
+    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<SharedKeys, ClientCoreError> {
+        // the shared key was a simple pem file
+        Ok(nym_pemstore::load_key(path)?)
+    }
+
+    fn gateway_details_from_raw(
+        gateway_id: String,
+        gateway_owner: String,
+        gateway_listener: String,
+        gateway_shared_key: SharedKeys,
+    ) -> Result<GatewayDetails, ClientCoreError> {
+        Ok(GatewayDetails::Remote(RemoteGatewayDetails {
+            gateway_id: gateway_id
+                .parse()
+                .map_err(|err| ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway id was malformed: {err}"),
+                })?,
+            derived_aes128_ctr_blake3_hmac_keys: Arc::new(gateway_shared_key),
+            gateway_owner_address: gateway_owner.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway owner address was malformed: {err}"),
+                }
+            })?,
+            gateway_listener: gateway_listener.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway listener address was malformed: {err}"),
+                }
+            })?,
+            wg_tun_address: None,
+        }))
+    }
+
+    // helper to extract shared key and gateway details into the new GatewayRegistration
+    fn extract_gateway_registration(
+        storage_paths: &CommonClientPathsV1_1_33,
+    ) -> Result<GatewayRegistration, ClientCoreError> {
+        let details_file = std::fs::File::open(&storage_paths.gateway_details).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!(
+                    "failed to open gateway details file at {}: {err}",
+                    storage_paths.gateway_details.display()
+                ),
+            }
+        })?;
+
+        // in v1.1.33 of the clients, the gateway details struct was saved as json
+        let details: PersistedGatewayDetails =
+            serde_json::from_reader(details_file).map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!(
+                        "failed to deserialize gateway details from {}: {err}",
+                        storage_paths.gateway_details.display()
+                    ),
+                }
+            })?;
+
+        let details = match details {
+            PersistedGatewayDetails::Default(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&storage_paths.keys.gateway_shared_key_file)?;
+                if !config.verify(&gateway_shared_key) {
+                    return Err(ClientCoreError::UpgradeFailure {
+                        message: "failed to verify consistency of the existing gateway details"
+                            .to_string(),
+                    });
+                }
+                gateway_details_from_raw(
+                    config.details.gateway_id,
+                    config.details.gateway_owner,
+                    config.details.gateway_listener,
+                    gateway_shared_key,
+                )?
+            }
+            PersistedGatewayDetails::Custom(custom) => {
+                GatewayDetails::Custom(CustomGatewayDetails {
+                    gateway_id: custom.gateway_id.parse().map_err(|err| {
+                        ClientCoreError::UpgradeFailure {
+                            message: format!("the stored gateway id was malformed: {err}"),
+                        }
+                    })?,
+                    data: None,
+                })
+            }
+        };
+
+        Ok(details.into())
+    }
+
+    // it's responsibility of the caller to ensure this is called **after** new registration has already been saved
+    fn remove_old_gateway_details(storage_paths: &CommonClientPathsV1_1_33) -> std::io::Result<()> {
+        std::fs::remove_file(&storage_paths.gateway_details)?;
+
+        if storage_paths.keys.gateway_shared_key_file.exists() {
+            std::fs::remove_file(&storage_paths.keys.gateway_shared_key_file)?;
+        }
+        Ok(())
+    }
+
+    pub async fn migrate_gateway_details(
+        old_storage_paths: &CommonClientPathsV1_1_33,
+        new_storage_paths: &CommonClientPaths,
+        preloaded_config: Option<OldGatewayEndpointConfigV1_1_33>,
+    ) -> Result<(), ClientCoreError> {
+        let gateway_registration = match preloaded_config {
+            Some(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&old_storage_paths.keys.gateway_shared_key_file)?;
+                gateway_details_from_raw(
+                    config.gateway_id,
+                    config.gateway_owner,
+                    config.gateway_listener,
+                    gateway_shared_key,
+                )?
+                .into()
+            }
+            None => extract_gateway_registration(old_storage_paths)?,
+        };
+
+        // since we're migrating to a brand new store, the store should be empty
+        // and thus set the 'new' gateway as the active one
+        let details_store =
+            setup_fs_gateways_storage(&new_storage_paths.gateway_registrations).await?;
+        store_gateway_details(&details_store, &gateway_registration).await?;
+        set_active_gateway(
+            &details_store,
+            &gateway_registration.details.gateway_id().to_base58_string(),
+        )
+        .await?;
+
+        remove_old_gateway_details(old_storage_paths).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!("failed to remove old data: {err}"),
+            }
+        })
+    }
+}