[DOCs/operators]: Release notes for v2025.19 kase (#6157 )

* add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix
change migration and bump version
2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00
392 changed files with 11184 additions and 10162 deletions
@@ -27,10 +27,10 @@ jobs:
      - uses: actions/setup-node@v4
        with:
          node-version: 20
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -43,10 +43,10 @@ jobs:
        run: sudo apt-get update && sudo apt-get -y install jq vim libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
        continue-on-error: true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Branch name
        run: echo running on branch ${GITHUB_REF##*/}
@@ -46,10 +46,10 @@ jobs:
        run: |
          echo "RUSTFLAGS=--cfg tokio_unstable" >> $GITHUB_ENV
          echo "CARGO_FEATURES=--features tokio-console" >> $GITHUB_ENV
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Build all binaries
        uses: actions-rs/cargo@v1
@@ -21,7 +21,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy
@@ -8,13 +8,10 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'nym-api/**'
-      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
-      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
      - 'nym-node-status-api/**'
-      - 'nym-registration-client/**'
      - 'nym-statistics-api/**'
      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
@@ -60,7 +57,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -10,7 +10,7 @@ env:

 jobs:
  check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
@@ -21,7 +21,7 @@ jobs:
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Generate the schema
        run: make contract-schema
@@ -34,10 +34,10 @@ jobs:
      - uses: actions/setup-node@v4
        with:
          node-version: 20
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -6,14 +6,16 @@ on:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
+      - "nym-connect/desktop/src/**"
+      - "nym-connect/desktop/package.json"
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
-      - "explorer-v2/**"
+      - "explorer/**"
      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
@@ -23,25 +25,26 @@ jobs:
      - uses: actions/setup-node@v4
        with:
          node-version: 20
-
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Install wasm-opt
-        run: cargo install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"

      - name: Install
        run: yarn
@@ -49,11 +52,7 @@ jobs:
      - name: Build packages
        run: yarn build:ci

-      - name: Install again
-        run: yarn
-
      - name: Lint
        run: yarn lint
-
      - name: Typecheck with tsc
        run: yarn tsc
@@ -31,7 +31,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -8,7 +8,7 @@ on:

 jobs:
  build:
-    runs-on: arc-linux-latest-dind
+    runs-on: custom-linux
    steps:
      - uses: actions/checkout@v4

@@ -25,10 +25,10 @@ jobs:
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -25,7 +25,7 @@ jobs:
      - uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v3
      with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        issue_message: 'Thank you for raising this issue'
-        pr_message: 'Thank you for making this first PR'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: 'Thank you for raising this issue'
+        pr-message: 'Thank you for making this first PR'
@@ -28,7 +28,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -12,7 +12,7 @@ jobs:
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Install cargo deny
        run: cargo install --locked cargo-deny
      - name: Run cargo deny
@@ -20,7 +20,7 @@ jobs:
      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true

      - name: Install dependencies
@@ -53,10 +53,10 @@ jobs:
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: 1.88.0
          override: true

      - name: Build all binaries
@@ -11,10 +11,9 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
          target: wasm32-unknown-unknown
          override: true

@@ -28,10 +28,10 @@ jobs:
        with:
          node-version: 21
          
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          
      - name: Add Rust target for x86_64-apple-darwin
        run: rustup target add x86_64-apple-darwin
@@ -33,10 +33,10 @@ jobs:
          node-version: 21
          cache: 'yarn'
      
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      
      - name: Install project dependencies
        shell: bash
@@ -29,10 +29,10 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Setup MSBuild.exe
        uses: microsoft/setup-msbuild@v2
@@ -4,7 +4,7 @@ on:

 jobs:
  publish:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

@@ -17,13 +17,10 @@ jobs:
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-          override: true
-          components: rustfmt, clippy
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -32,9 +29,9 @@ jobs:
        run: cargo install wasm-opt

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"

      - name: Install dependencies
        run: yarn
@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -38,6 +43,16 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -46,12 +61,24 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,100 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.21-mozzarella] (2025-11-25)
-
- [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
- bugfix: fix credential proxy upgrade mode attestation url arg ([#6202])
- HTTP API resilience enable & domain rotation conditions ([#6200])
- Remove debug feature from http-macro spec in gateway probe ([#6195])
- DNS relibility and troubleshooting  ([#6179])
- [bugfix] Distinguish authenticator errors by credential spent ([#6176])
- Typescript SDK 1.4.1 ([#6146])
- Enable URL rotation and retries for mixnet gateway init ([#6126])
- Feature/credential proxy jwt ([#5957])
-
-[#6225]: https://github.com/nymtech/nym/pull/6225
-[#6202]: https://github.com/nymtech/nym/pull/6202
-[#6200]: https://github.com/nymtech/nym/pull/6200
-[#6195]: https://github.com/nymtech/nym/pull/6195
-[#6179]: https://github.com/nymtech/nym/pull/6179
-[#6176]: https://github.com/nymtech/nym/pull/6176
-[#6146]: https://github.com/nymtech/nym/pull/6146
-[#6126]: https://github.com/nymtech/nym/pull/6126
-[#5957]: https://github.com/nymtech/nym/pull/5957
-
-## [2025.20-leerdammer] (2025-11-12)
-
- Max/tweak ts sdk actions ([#6185])
- chore: resolve clippy 1.91 warnings ([#6168])
- [chore] Remove unused dependencies ([#6151])
- Use typed-builder for registration client builder config ([#6150])
- tommy is too quick ([#6149])
- configurable mixnet client startup timeout ([#6148])
- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
- Bugfix: Add circuit breaker ([#6143])
- bugfix: update internal owner address in transferred share ([#6139])
- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
- bugfix: update stored epoch share when changing ownership ([#6135])
- Domain fronting ([#6134])
- bugfix: update stored epoch share when changing announce address ([#6131])
-
-[#6185]: https://github.com/nymtech/nym/pull/6185
-[#6168]: https://github.com/nymtech/nym/pull/6168
-[#6151]: https://github.com/nymtech/nym/pull/6151
-[#6150]: https://github.com/nymtech/nym/pull/6150
-[#6149]: https://github.com/nymtech/nym/pull/6149
-[#6148]: https://github.com/nymtech/nym/pull/6148
-[#6145]: https://github.com/nymtech/nym/pull/6145
-[#6143]: https://github.com/nymtech/nym/pull/6143
-[#6139]: https://github.com/nymtech/nym/pull/6139
-[#6138]: https://github.com/nymtech/nym/pull/6138
-[#6136]: https://github.com/nymtech/nym/pull/6136
-[#6135]: https://github.com/nymtech/nym/pull/6135
-[#6134]: https://github.com/nymtech/nym/pull/6134
-[#6131]: https://github.com/nymtech/nym/pull/6131
-
-## [2025.19-kase] (2025-10-30)
-
- update ns agent workflow ([#6154])
- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
- bugfix: nym-credential-proxy query params parsing regression ([#6121])
- bugfix: revert some dep updates introduced in #6043 ([#6120])
- Skip ipv6 metadata endpoint request ([#6118])
- update to no longer use 1mb files ([#6117])
- chore: restore pending dkg contract state migration ([#6116])
- Revert "Propagate cancel token to mixnet client" ([#6115])
- Update dirs to 6.0 ([#6109])
- Propagate cancel token to mixnet client ([#6105])
- bugfix: retrieve and update ticketbook in the same query ([#6101])
- bugfix: include network name in the default gateway probe config path ([#6100])
- Bugfix/incompatibility fixes ([#6099])
- [DOCs/operators] QUIC deployment script & docs ([#6098])
- bugfix: testnet manager 02sql migration ([#6096])
- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
- bugfix: use custom topology provider for list of init gateways ([#6092])
- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)

 - ns-api: add descriptions to dVPN gateway responses ([#6102])
@@ -2579,7 +2579,7 @@ dependencies = [

 [[package]]
 name = "extension-storage"
-version = "1.4.1"
+version = "1.4.0-rc.0"
 dependencies = [
 "bip39",
 "console_error_panic_hook",
@@ -4478,7 +4478,7 @@ dependencies = [

 [[package]]
 name = "mix-fetch-wasm"
-version = "1.4.1"
+version = "1.4.0-rc.0"
 dependencies = [
 "async-trait",
 "futures",
@@ -4488,7 +4488,6 @@ dependencies = [
 "nym-ordered-buffer",
 "nym-service-providers-common",
 "nym-socks5-requests",
- "nym-validator-client",
 "rand 0.8.5",
 "serde",
 "serde-wasm-bindgen 0.6.5",
@@ -4825,7 +4824,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.70"
+version = "1.1.67"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -5051,7 +5050,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.67"
+version = "1.1.64"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5134,7 +5133,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.67"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -5251,8 +5250,8 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "async-trait",
+ "cosmrs",
 "nym-crypto",
- "nym-gateway-client",
 "nym-gateway-requests",
 "serde",
 "sqlx",
@@ -5284,7 +5283,7 @@ dependencies = [

 [[package]]
 name = "nym-client-wasm"
-version = "1.4.1"
+version = "1.4.0-rc.0"
 dependencies = [
 "anyhow",
 "futures",
@@ -5463,11 +5462,8 @@ dependencies = [
 "nym-crypto",
 "nym-ecash-contract-common",
 "nym-ecash-signer-check",
- "nym-http-api-client",
 "nym-http-api-common",
 "nym-network-defaults",
- "nym-pemstore",
- "nym-upgrade-mode-check",
 "nym-validator-client",
 "rand 0.8.5",
 "reqwest 0.12.22",
@@ -5538,7 +5534,6 @@ dependencies = [
 "nym-http-api-client",
 "nym-http-api-common",
 "nym-serde-helpers",
- "nym-upgrade-mode-check",
 "reqwest 0.12.22",
 "schemars 0.8.22",
 "serde",
@@ -5666,7 +5661,6 @@ dependencies = [
 "aead",
 "aes",
 "aes-gcm-siv",
- "anyhow",
 "base64 0.22.1",
 "blake3",
 "bs58",
@@ -5680,12 +5674,10 @@ dependencies = [
 "jwt-simple",
 "nym-pemstore",
 "nym-sphinx-types",
- "nym-test-utils",
 "rand 0.8.5",
 "rand_chacha 0.3.1",
 "serde",
 "serde_bytes",
- "serde_json",
 "sha2 0.10.9",
 "subtle-encoding",
 "thiserror 2.0.12",
@@ -6058,7 +6050,6 @@ dependencies = [
 "thiserror 2.0.12",
 "tokio",
 "tracing",
- "tracing-subscriber",
 "url",
 "wasmtimer",
 ]
@@ -6363,7 +6354,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.68"
+version = "1.1.65"
 dependencies = [
 "addr",
 "anyhow",
@@ -6413,7 +6404,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.22.0"
+version = "1.19.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6651,7 +6642,7 @@ dependencies = [

 [[package]]
 name = "nym-node-tester-wasm"
-version = "1.3.1"
+version = "1.3.0-rc.0"
 dependencies = [
 "futures",
 "js-sys",
@@ -6940,7 +6931,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.67"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -7200,7 +7191,7 @@ dependencies = [

 [[package]]
 name = "nym-statistics-api"
-version = "0.3.1"
+version = "0.2.1"
 dependencies = [
 "anyhow",
 "axum",
@@ -7214,6 +7205,7 @@ dependencies = [
 "nym-statistics-common",
 "nym-task",
 "nym-validator-client",
+ "serde",
 "serde_json",
 "sqlx",
 "time",
@@ -7386,21 +7378,18 @@ dependencies = [
 "jwt-simple",
 "nym-crypto",
 "nym-http-api-client",
- "nym-test-utils",
 "reqwest 0.12.22",
 "serde",
 "serde_json",
 "thiserror 2.0.12",
 "time",
 "tracing",
- "utoipa",
 ]

 [[package]]
 name = "nym-validator-client"
 version = "0.1.0"
 dependencies = [
- "anyhow",
 "async-trait",
 "base64 0.22.1",
 "bip32",
@@ -7681,7 +7670,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.32"
+version = "0.1.29"
 dependencies = [
 "anyhow",
 "bytes",
@@ -7835,9 +7824,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"

 [[package]]
 name = "openssl-sys"
-version = "0.9.110"
+version = "0.9.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a9f0075ba3c21b09f8e8b2026584b1d18d49388648f2fbbf3c97ea8deced8e2"
+checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
 dependencies = [
 "cc",
 "libc",
@@ -150,7 +150,7 @@ members = [
    "tools/internal/contract-state-importer/importer-cli",
    "tools/internal/contract-state-importer/importer-contract",
    "tools/internal/mixnet-connectivity-check",
-#    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
@@ -264,7 +264,7 @@ generic-array = "0.14.7"
 getrandom = "0.2.10"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-resolver = "0.25.2"
+hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -453,11 +453,6 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }

 [workspace.lints.clippy]
-suspicious = "deny"
-complexity = "deny"
-perf = "deny"
-style = "deny"
-
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"
@@ -107,16 +107,16 @@ sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
-	$(MAKE) -C wasm/mix-fetch
+	# $(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
 	# $(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	npx lerna run --scope @nymproject/mix-fetch build --stream
-	npx lerna run --scope @nymproject/node-tester build --stream
-	yarn --cwd sdk/typescript/codegen/contract-clients build
+	# npx lerna run --scope @nymproject/mix-fetch build --stream
+	# npx lerna run --scope @nymproject/node-tester build --stream
+	# yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
 WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -6,14 +6,14 @@
      {
        "name": "exists",
        "ordinal": 0,
-        "type_info": "Integer"
+        "type_info": "Int"
      }
    ],
    "parameters": {
      "Right": 1
    },
    "nullable": [
-      false
+      null
    ]
  },
  "hash": "06e743d143fcc4be20ca2af5e99b19f15d22fff72490473587a14cdc046fda32"
@@ -0,0 +1,44 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "gateway_id_bs58",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_owner_address",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "gateway_listener",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes128_ctr_blake3_hmac_keys_bs58",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "derived_aes256_gcm_siv_key",
+        "ordinal": 4,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "0e85ec18da67cf4e3df04ad80136571f6e920eb2290f20b1b8c5b0ab4b489985"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                UPDATE remote_gateway_details\n                SET\n                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,\n                    derived_aes256_gcm_siv_key = ?\n                WHERE gateway_id_bs58 = ?\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "0f1dfb89f1eb39f4a58787af0f53a7a93afb7e4d2e54e2d38fd79d31c8575a54"
+}
@@ -1,38 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT\n                rgd.gateway_id_bs58,\n                derived_aes256_gcm_siv_key,\n                gateway_listener,\n                fallback_listener\n            FROM\n                remote_gateway_details AS rgd\n            INNER JOIN\n                remote_gateway_shared_keys AS rgsk\n            ON\n                rgd.gateway_id_bs58 = rgsk.gateway_id_bs58\n            WHERE\n                rgd.gateway_id_bs58 = ?",
-  "describe": {
-    "columns": [
-      {
-        "name": "gateway_id_bs58",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "derived_aes256_gcm_siv_key",
-        "ordinal": 1,
-        "type_info": "Blob"
-      },
-      {
-        "name": "gateway_listener",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "fallback_listener",
-        "ordinal": 3,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "4b739e12ea8d917cb17580337caeabb05f0e3ddbec04fdfa111d0fc86ba75505"
-}
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_shared_keys(gateway_id_bs58, derived_aes256_gcm_siv_key)\n                VALUES (?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "700a75acbcd90c74baa7823c40739a8ff8a26400c1d2bd45a689970bf1ba0e66"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "SQLite",
-  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type)\n                VALUES (?, ?, ?)\n            ",
+  "query": "\n                INSERT INTO registered_gateway(gateway_id_bs58, registration_timestamp, gateway_type) \n                VALUES (?, ?, ?)\n            ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -8,5 +8,5 @@
    },
    "nullable": []
  },
-  "hash": "727598e516090da6d26e36d09062b60ccb76d6468f359891428c0bfb96ddd7ef"
+  "hash": "8909fd329e7e5fb16c4989b15b3d3a12bba1569520e01f6f074178e23d6ee89e"
 }
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, gateway_listener, fallback_listener)\n                VALUES (?, ?, ?)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "a64a557ba87d4b2c7457857afa7ebc7d4f895fc4991da18ec02c9e250bea0fe0"
-}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)\n                VALUES (?, ?, ?, ?, ?)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 5
+    },
+    "nullable": []
+  },
+  "hash": "a6939bea03b10cde810a9a099bd597b4f51092e30a41c4085a8f8668f039f7c0"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "SQLite",
-  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data)\n                VALUES (?, ?)\n            ",
+  "query": "\n                INSERT INTO custom_gateway_details(gateway_id_bs58, data) \n                VALUES (?, ?)\n            ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -8,5 +8,5 @@
    },
    "nullable": []
  },
-  "hash": "2c113b37864f9fec7e64c0f8fdd38edcdf149acfd38c56a4db3bbf97bdb13210"
+  "hash": "b059bc3688b6b7f83f47048db9897720fd4e6f3211bf74030a9638f7bf6738e4"
 }
@@ -9,6 +9,7 @@ rust-version.workspace = true

 [dependencies]
 async-trait.workspace = true
+cosmrs.workspace = true
 serde = { workspace = true, features = ["derive"] }
 thiserror.workspace = true
 time.workspace = true
@@ -19,7 +20,6 @@ zeroize = { workspace = true, features = ["zeroize_derive"] }

 nym-crypto = { path = "../../crypto", features = ["asymmetric"] }
 nym-gateway-requests = { path = "../../gateway-requests" }
-nym-gateway-client = { path = "../../client-libs/gateway-client" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
@@ -1,22 +0,0 @@
-/*
- * Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
- * SPDX-License-Identifier: Apache-2.0
- */
-
-CREATE TABLE remote_gateway_details_temp
-(
-    gateway_id_bs58                          TEXT NOT NULL UNIQUE PRIMARY KEY REFERENCES registered_gateway (gateway_id_bs58),
-    derived_aes256_gcm_siv_key               BLOB NOT NULL,
-    gateway_listener                         TEXT NOT NULL,
-    fallback_listener                        TEXT,
-    expiration_timestamp                     DATETIME NOT NULL
-);
-
-- keep only registrations with a non null aes256 key
-INSERT INTO remote_gateway_details_temp SELECT gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, NULL, datetime(0, 'unixepoch') FROM remote_gateway_details WHERE derived_aes256_gcm_siv_key IS NOT NULL;
-
-DROP TABLE remote_gateway_details;
-ALTER TABLE remote_gateway_details_temp RENAME TO remote_gateway_details;
-
-- delete registrations with no key
-DELETE FROM registered_gateway WHERE gateway_id_bs58 NOT IN ( SELECT gateway_id_bs58 FROM remote_gateway_details);
@@ -6,7 +6,6 @@ use crate::{
    types::{
        RawActiveGateway, RawCustomGatewayDetails, RawRegisteredGateway, RawRemoteGatewayDetails,
    },
-    RawGatewayPublishedData,
 };
 use sqlx::{
    sqlite::{SqliteAutoVacuum, SqliteSynchronous},
@@ -145,11 +144,13 @@ impl StorageManager {
        &self,
        gateway_id: &str,
    ) -> Result<RawRemoteGatewayDetails, sqlx::Error> {
-        // query_as! macro doesn't use fromRow
-        sqlx::query_as("SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?")
-            .bind(gateway_id)
-            .fetch_one(&self.connection_pool)
-            .await
+        sqlx::query_as!(
+            RawRemoteGatewayDetails,
+            "SELECT * FROM remote_gateway_details WHERE gateway_id_bs58 = ?",
+            gateway_id
+        )
+        .fetch_one(&self.connection_pool)
+        .await
    }

    pub(crate) async fn set_remote_gateway_details(
@@ -158,36 +159,41 @@ impl StorageManager {
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes256_gcm_siv_key, gateway_listener, fallback_listener, expiration_timestamp)
+                INSERT INTO remote_gateway_details(gateway_id_bs58, derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key, gateway_owner_address, gateway_listener)
                VALUES (?, ?, ?, ?, ?)
            "#,
            remote.gateway_id_bs58,
+            remote.derived_aes128_ctr_blake3_hmac_keys_bs58,
            remote.derived_aes256_gcm_siv_key,
-            remote.published_data.gateway_listener,
-            remote.published_data.fallback_listener,
-            remote.published_data.expiration_timestamp
+            remote.gateway_owner_address,
+            remote.gateway_listener,
        )
            .execute(&self.connection_pool)
            .await?;
        Ok(())
    }

-    pub(crate) async fn update_remote_gateway_published_data(
+    pub(crate) async fn update_remote_gateway_key(
        &self,
        gateway_id_bs58: &str,
-        published_data: &RawGatewayPublishedData,
+        derived_aes128_ctr_blake3_hmac_keys_bs58: Option<&str>,
+        derived_aes256_gcm_siv_key: Option<&[u8]>,
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                UPDATE remote_gateway_details SET gateway_listener = ?, fallback_listener = ?, expiration_timestamp = ? WHERE gateway_id_bs58 = ?
+                UPDATE remote_gateway_details
+                SET
+                    derived_aes128_ctr_blake3_hmac_keys_bs58 = ?,
+                    derived_aes256_gcm_siv_key = ?
+                WHERE gateway_id_bs58 = ?
            "#,
-            published_data.gateway_listener,
-            published_data.fallback_listener,
-            published_data.expiration_timestamp,
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
            gateway_id_bs58
        )
-            .execute(&self.connection_pool)
-            .await?;
+        .execute(&self.connection_pool)
+        .await?;
+
        Ok(())
    }

@@ -2,16 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::{
-    ActiveGateway, BadGateway, GatewayDetails, GatewayPublishedData, GatewayRegistration,
-    GatewayType, GatewaysDetailsStore, StorageError,
+    ActiveGateway, BadGateway, GatewayDetails, GatewayRegistration, GatewayType,
+    GatewaysDetailsStore, StorageError,
 };
 use async_trait::async_trait;
 use manager::StorageManager;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::path::Path;

 pub mod error;
 mod manager;
+mod models;

 #[derive(Clone)]
 pub struct OnDiskGatewaysDetails {
@@ -132,15 +134,16 @@ impl GatewaysDetailsStore for OnDiskGatewaysDetails {
        Ok(())
    }

-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
        &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
    ) -> Result<(), Self::StorageError> {
        self.manager
-            .update_remote_gateway_published_data(
+            .update_remote_gateway_key(
                &gateway_id.to_base58_string(),
-                &published_data.into(),
+                None,
+                Some(updated_key.as_bytes()),
            )
            .await?;
        Ok(())
@@ -0,0 +1,2 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
@@ -2,9 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::types::{ActiveGateway, GatewayRegistration};
-use crate::{BadGateway, GatewayDetails, GatewayPublishedData, GatewaysDetailsStore};
+use crate::{BadGateway, GatewayDetails, GatewaysDetailsStore};
 use async_trait::async_trait;
-use nym_crypto::asymmetric::ed25519;
+use nym_crypto::asymmetric::ed25519::PublicKey;
+use nym_gateway_requests::{SharedGatewayKey, SharedSymmetricKey};
 use std::collections::HashMap;
 use std::sync::Arc;
 use thiserror::Error;
@@ -95,17 +96,26 @@ impl GatewaysDetailsStore for InMemGatewaysDetails {
        Ok(())
    }

-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
        &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: PublicKey,
+        updated_key: &SharedSymmetricKey,
    ) -> Result<(), Self::StorageError> {
        let mut guard = self.inner.write().await;
-        if let Some(gateway) = guard.gateways.get_mut(&gateway_id.to_base58_string()) {
-            if let GatewayDetails::Remote(ref mut remote_details) = gateway.details {
-                remote_details.published_data = published_data.clone();
-            }
+
+        #[allow(clippy::unwrap_used)]
+        if let Some(target) = guard.gateways.get_mut(&gateway_id.to_string()) {
+            let GatewayDetails::Remote(details) = &mut target.details else {
+                return Ok(());
+            };
+            assert_eq!(Arc::strong_count(&details.shared_key), 1);
+
+            // eh. that's nasty, but it's only ever used for ephemeral clients so should be fine for now...
+            details.shared_key = Arc::new(SharedGatewayKey::Current(
+                SharedSymmetricKey::try_from_bytes(updated_key.as_bytes()).unwrap(),
+            ))
        }
+
        Ok(())
    }

@@ -18,6 +18,16 @@ pub enum BadGateway {
        source: Ed25519RecoveryError,
    },

+    #[error("the account owner of gateway {gateway_id} ({raw_owner}) is malformed: {source}")]
+    MalformedGatewayOwnerAccountAddress {
+        gateway_id: String,
+
+        raw_owner: String,
+
+        #[source]
+        source: cosmrs::ErrorReport,
+    },
+
    #[error("the shared keys provided for gateway {gateway_id} are malformed: {source}")]
    MalformedSharedKeys {
        gateway_id: String,
@@ -40,12 +50,4 @@ pub enum BadGateway {
        #[source]
        source: url::ParseError,
    },
-
-    #[error("the listening address ({raw_listener}) is malformed: {source}")]
-    MalformedListenerNoId {
-        raw_listener: String,
-
-        #[source]
-        source: url::ParseError,
-    },
 }
@@ -6,6 +6,7 @@

 use async_trait::async_trait;
 use nym_crypto::asymmetric::ed25519;
+use nym_gateway_requests::SharedSymmetricKey;
 use std::error::Error;

 pub mod backend;
@@ -59,11 +60,10 @@ pub trait GatewaysDetailsStore {
        details: &GatewayRegistration,
    ) -> Result<(), Self::StorageError>;

-    /// Update the gateway details
-    async fn update_gateway_published_data(
+    async fn upgrade_stored_remote_gateway_key(
        &self,
-        gateway_id: &ed25519::PublicKey,
-        published_data: &GatewayPublishedData,
+        gateway_id: ed25519::PublicKey,
+        updated_key: &SharedSymmetricKey,
    ) -> Result<(), Self::StorageError>;

    /// Remove given gateway details from the underlying store.
@@ -2,21 +2,20 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::BadGateway;
+use cosmrs::AccountId;
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::GatewayListeners;
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
+use std::ops::Deref;
 use std::str::FromStr;
 use std::sync::Arc;
-use time::Duration;
 use time::OffsetDateTime;
 use url::Url;
 use zeroize::{Zeroize, ZeroizeOnDrop};

 pub const REMOTE_GATEWAY_TYPE: &str = "remote";
 pub const CUSTOM_GATEWAY_TYPE: &str = "custom";
-const GATEWAY_DETAILS_TTL: Duration = Duration::days(7);

 #[derive(Debug, Clone, Default)]
 pub struct ActiveGateway {
@@ -66,13 +65,15 @@ impl From<GatewayDetails> for GatewayRegistration {
 impl GatewayDetails {
    pub fn new_remote(
        gateway_id: ed25519::PublicKey,
-        shared_key: Arc<SharedSymmetricKey>,
-        published_data: GatewayPublishedData,
+        shared_key: Arc<SharedGatewayKey>,
+        gateway_owner_address: Option<AccountId>,
+        gateway_listener: Url,
    ) -> Self {
        GatewayDetails::Remote(RemoteGatewayDetails {
            gateway_id,
            shared_key,
-            published_data,
+            gateway_owner_address,
+            gateway_listener,
        })
    }

@@ -87,20 +88,13 @@ impl GatewayDetails {
        }
    }

-    pub fn shared_key(&self) -> Option<&SharedSymmetricKey> {
+    pub fn shared_key(&self) -> Option<&SharedGatewayKey> {
        match self {
            GatewayDetails::Remote(details) => Some(&details.shared_key),
            GatewayDetails::Custom(_) => None,
        }
    }

-    pub fn details_exipration(&self) -> Option<OffsetDateTime> {
-        match self {
-            GatewayDetails::Remote(details) => Some(details.published_data.expiration_timestamp),
-            GatewayDetails::Custom(_) => None,
-        }
-    }
-
    pub fn is_custom(&self) -> bool {
        matches!(self, GatewayDetails::Custom(..))
    }
@@ -170,78 +164,14 @@ pub struct RegisteredGateway {
    pub gateway_type: GatewayType,
 }

-#[derive(Debug, Clone)]
-pub struct GatewayPublishedData {
-    pub listeners: GatewayListeners,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl GatewayPublishedData {
-    pub fn new(listeners: GatewayListeners) -> GatewayPublishedData {
-        GatewayPublishedData {
-            listeners,
-            expiration_timestamp: OffsetDateTime::now_utc() + GATEWAY_DETAILS_TTL,
-        }
-    }
-}
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-#[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
-pub struct RawGatewayPublishedData {
-    pub gateway_listener: String,
-    pub fallback_listener: Option<String>,
-    pub expiration_timestamp: OffsetDateTime,
-}
-
-impl<'a> From<&'a GatewayPublishedData> for RawGatewayPublishedData {
-    fn from(value: &'a GatewayPublishedData) -> Self {
-        Self {
-            gateway_listener: value.listeners.primary.to_string(),
-            fallback_listener: value.listeners.fallback.as_ref().map(|uri| uri.to_string()),
-            expiration_timestamp: value.expiration_timestamp,
-        }
-    }
-}
-
-impl TryFrom<RawGatewayPublishedData> for GatewayPublishedData {
-    type Error = BadGateway;
-
-    fn try_from(value: RawGatewayPublishedData) -> Result<Self, Self::Error> {
-        let gateway_listener: Url = Url::parse(&value.gateway_listener).map_err(|source| {
-            BadGateway::MalformedListenerNoId {
-                raw_listener: value.gateway_listener.clone(),
-                source,
-            }
-        })?;
-        let fallback_listener = value
-            .fallback_listener
-            .as_ref()
-            .map(|uri| {
-                Url::parse(uri).map_err(|source| BadGateway::MalformedListenerNoId {
-                    raw_listener: uri.to_owned(),
-                    source,
-                })
-            })
-            .transpose()?;
-
-        Ok(GatewayPublishedData {
-            listeners: GatewayListeners {
-                primary: gateway_listener,
-                fallback: fallback_listener,
-            },
-            expiration_timestamp: value.expiration_timestamp,
-        })
-    }
-}
-
 #[derive(Debug, Zeroize, ZeroizeOnDrop, Serialize, Deserialize)]
 #[cfg_attr(feature = "sqlx", derive(sqlx::FromRow))]
 pub struct RawRemoteGatewayDetails {
    pub gateway_id_bs58: String,
-    pub derived_aes256_gcm_siv_key: Vec<u8>,
-    #[zeroize(skip)]
-    #[cfg_attr(feature = "sqlx", sqlx(flatten))]
-    pub published_data: RawGatewayPublishedData,
+    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
+    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
+    pub gateway_owner_address: Option<String>,
+    pub gateway_listener: String,
 }

 impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
@@ -256,26 +186,81 @@ impl TryFrom<RawRemoteGatewayDetails> for RemoteGatewayDetails {
                }
            })?;

-        let shared_key = SharedSymmetricKey::try_from_bytes(&value.derived_aes256_gcm_siv_key)
-            .map_err(|source| BadGateway::MalformedSharedKeys {
+        let shared_key =
+            match (
+                &value.derived_aes256_gcm_siv_key,
+                &value.derived_aes128_ctr_blake3_hmac_keys_bs58,
+            ) {
+                (None, None) => {
+                    return Err(BadGateway::MissingSharedKey {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                    })
+                }
+                (Some(aes256gcm_siv), _) => {
+                    let current_key =
+                        SharedSymmetricKey::try_from_bytes(aes256gcm_siv).map_err(|source| {
+                            BadGateway::MalformedSharedKeys {
+                                gateway_id: value.gateway_id_bs58.clone(),
+                                source,
+                            }
+                        })?;
+                    SharedGatewayKey::Current(current_key)
+                }
+                (None, Some(aes128ctr_hmac)) => {
+                    let legacy_key = LegacySharedKeys::try_from_base58_string(aes128ctr_hmac)
+                        .map_err(|source| BadGateway::MalformedSharedKeys {
+                            gateway_id: value.gateway_id_bs58.clone(),
+                            source,
+                        })?;
+                    SharedGatewayKey::Legacy(legacy_key)
+                }
+            };
+
+        let gateway_owner_address = value
+            .gateway_owner_address
+            .as_ref()
+            .map(|raw_owner| {
+                AccountId::from_str(raw_owner).map_err(|source| {
+                    BadGateway::MalformedGatewayOwnerAccountAddress {
+                        gateway_id: value.gateway_id_bs58.clone(),
+                        raw_owner: raw_owner.clone(),
+                        source,
+                    }
+                })
+            })
+            .transpose()?;
+
+        let gateway_listener = Url::parse(&value.gateway_listener).map_err(|source| {
+            BadGateway::MalformedListener {
                gateway_id: value.gateway_id_bs58.clone(),
+                raw_listener: value.gateway_listener.clone(),
                source,
-            })?;
+            }
+        })?;

        Ok(RemoteGatewayDetails {
            gateway_id,
            shared_key: Arc::new(shared_key),
-            published_data: value.published_data.clone().try_into()?,
+            gateway_owner_address,
+            gateway_listener,
        })
    }
 }

 impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
    fn from(value: &'a RemoteGatewayDetails) -> Self {
+        let (derived_aes128_ctr_blake3_hmac_keys_bs58, derived_aes256_gcm_siv_key) =
+            match value.shared_key.deref() {
+                SharedGatewayKey::Current(key) => (None, Some(key.to_bytes())),
+                SharedGatewayKey::Legacy(key) => (Some(key.to_base58_string()), None),
+            };
+
        RawRemoteGatewayDetails {
            gateway_id_bs58: value.gateway_id.to_base58_string(),
-            derived_aes256_gcm_siv_key: value.shared_key.to_bytes(),
-            published_data: (&value.published_data).into(),
+            derived_aes128_ctr_blake3_hmac_keys_bs58,
+            derived_aes256_gcm_siv_key,
+            gateway_owner_address: value.gateway_owner_address.as_ref().map(|o| o.to_string()),
+            gateway_listener: value.gateway_listener.to_string(),
        }
    }
 }
@@ -284,9 +269,11 @@ impl<'a> From<&'a RemoteGatewayDetails> for RawRemoteGatewayDetails {
 pub struct RemoteGatewayDetails {
    pub gateway_id: ed25519::PublicKey,

-    pub shared_key: Arc<SharedSymmetricKey>,
+    pub shared_key: Arc<SharedGatewayKey>,

-    pub published_data: GatewayPublishedData,
+    pub gateway_owner_address: Option<AccountId>,
+
+    pub gateway_listener: Url,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -87,7 +87,6 @@ where
        user_chosen_gateway_id.map(|id| id.to_base58_string()),
        Some(common_args.latency_based_selection),
        common_args.force_tls_gateway,
-        false,
    );
    tracing::debug!("Gateway selection specification: {selection_spec:?}");

@@ -168,7 +167,6 @@ where
        identity: gateway_details.gateway_id,
        active: common_args.set_active,
        typ: gateway_registration.details.typ().to_string(),
-        endpoint: Some(gateway_details.published_data.listeners.primary.clone()),
-        fallback_endpoint: gateway_details.published_data.listeners.fallback.clone(),
+        endpoint: Some(gateway_details.gateway_listener.clone()),
    })
 }
@@ -136,7 +136,6 @@ where
        user_chosen_gateway_id.map(|id| id.to_base58_string()),
        Some(common_args.latency_based_selection),
        common_args.force_tls_gateway,
-        false,
    );
    tracing::debug!("Gateway selection specification: {selection_spec:?}");

@@ -56,8 +56,7 @@ where
                identity: remote_details.gateway_id,
                active: active_gateway == Some(remote_details.gateway_id),
                typ: GatewayType::Remote.to_string(),
-                endpoint: Some(remote_details.published_data.listeners.primary.clone()),
-                fallback_endpoint: remote_details.published_data.listeners.fallback.clone(),
+                endpoint: Some(remote_details.gateway_listener),
            }),
            GatewayDetails::Custom(_) => info.push(GatewayInfo {
                registration: gateway.registration_timestamp,
@@ -65,7 +64,6 @@ where
                active: active_gateway == Some(gateway.details.gateway_id()),
                typ: gateway.details.typ().to_string(),
                endpoint: None,
-                fallback_endpoint: None,
            }),
        };
    }
@@ -15,7 +15,6 @@ pub struct GatewayInfo {

    pub typ: String,
    pub endpoint: Option<Url>,
-    pub fallback_endpoint: Option<Url>,
 }

 impl Display for GatewayInfo {
@@ -31,9 +30,6 @@ impl Display for GatewayInfo {
        if let Some(endpoint) = &self.endpoint {
            write!(f, " endpoint: {endpoint}")?;
        }
-        if let Some(fallback_endpoint) = &self.fallback_endpoint {
-            write!(f, " fallback: {fallback_endpoint}")?;
-        }
        Ok(())
    }
 }
@@ -529,6 +529,7 @@ where
        config: &Config,
        initialisation_result: InitialisationResult,
        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -554,7 +555,14 @@ where
                    shutdown_tracker.clone_shutdown_token(),
                )
            } else {
-                let cfg = GatewayConfig::new(details.gateway_id, details.published_data.listeners);
+                let cfg = GatewayConfig::new(
+                    details.gateway_id,
+                    details
+                        .gateway_owner_address
+                        .as_ref()
+                        .map(|o| o.to_string()),
+                    details.gateway_listener.to_string(),
+                );
                GatewayClient::new(
                    GatewayClientConfig::new_default()
                        .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
@@ -584,13 +592,32 @@ where
        // the gateway client startup procedure is slightly more complicated now
        // we need to:
        // - perform handshake (reg or auth)
+        // - check for key upgrade
+        // - maybe perform another upgrade handshake
        // - check for bandwidth
        // - start background tasks
-        let _ = gateway_client
+        let auth_res = gateway_client
            .perform_initial_authentication()
            .await
            .map_err(gateway_failure)?;

+        if auth_res.requires_key_upgrade {
+            // drop the shared_key arc because we don't need it and we can't hold it for the purposes of upgrade
+            drop(auth_res);
+
+            let updated_key = gateway_client
+                .upgrade_key_authenticated()
+                .await
+                .map_err(gateway_failure)?;
+
+            details_store
+                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
+                .await.map_err(|err| {
+                tracing::error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
+            })?
+        }
+
        gateway_client
            .claim_initial_bandwidth()
            .await
@@ -609,6 +636,7 @@ where
        config: &Config,
        initialisation_result: InitialisationResult,
        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        details_store: &S::GatewaysDetailsStore,
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -639,6 +667,7 @@ where
            config,
            initialisation_result,
            bandwidth_controller,
+            details_store,
            packet_router,
            stats_reporter,
            #[cfg(unix)]
@@ -946,7 +975,8 @@ where
        )
        .await?;

-        let (reply_storage_backend, credential_store, _) = self.client_store.into_runtime_stores();
+        let (reply_storage_backend, credential_store, details_store) =
+            self.client_store.into_runtime_stores();

        // channels for inter-component communication
        // TODO: make the channels be internally created by the relevant components
@@ -1039,6 +1069,7 @@ where
            &self.config,
            init_res,
            bandwidth_controller,
+            &details_store,
            gateway_packet_router,
            stats_reporter.clone(),
            #[cfg(unix)]
@@ -4,9 +4,7 @@
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::error::ClientCoreError;
-use nym_client_core_gateways_storage::{
-    ActiveGateway, GatewayPublishedData, GatewayRegistration, GatewaysDetailsStore,
-};
+use nym_client_core_gateways_storage::{ActiveGateway, GatewayRegistration, GatewaysDetailsStore};
 use nym_crypto::asymmetric::ed25519;

 // helpers for error wrapping
@@ -87,23 +85,6 @@ where
        })
 }

-pub async fn update_stored_published_data_gateway<D>(
-    details_store: &D,
-    gateway_id: &ed25519::PublicKey,
-    published_data: &GatewayPublishedData,
-) -> Result<(), ClientCoreError>
-where
-    D: GatewaysDetailsStore,
-    D::StorageError: Send + Sync + 'static,
-{
-    details_store
-        .update_gateway_published_data(gateway_id, published_data)
-        .await
-        .map_err(|source| ClientCoreError::GatewaysDetailsStoreError {
-            source: Box::new(source),
-        })
-}
-
 pub async fn load_active_gateway_details<D>(
    details_store: &D,
 ) -> Result<ActiveGateway, ClientCoreError>
@@ -2,18 +2,210 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod v1_1_33 {
+    use crate::client::base_client::{
+        non_wasm_helpers::setup_fs_gateways_storage,
+        storage::helpers::{set_active_gateway, store_gateway_details},
+    };
    use crate::config::disk_persistence::old_v1_1_33::CommonClientPathsV1_1_33;
    use crate::config::disk_persistence::CommonClientPaths;
    use crate::config::old_config_v1_1_33::OldGatewayEndpointConfigV1_1_33;
    use crate::error::ClientCoreError;
+    use nym_client_core_gateways_storage::{
+        CustomGatewayDetails, GatewayDetails, GatewayRegistration, RemoteGatewayDetails,
+    };
+    use nym_gateway_requests::shared_key::LegacySharedKeys;
+    use serde::{Deserialize, Serialize};
+    use sha2::{digest::Digest, Sha256};
+    use std::ops::Deref;
+    use std::path::Path;
+    use std::sync::Arc;
+    use zeroize::Zeroizing;
+
+    mod base64 {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+        use serde::{Deserialize, Deserializer, Serializer};
+
+        pub fn serialize<S: Serializer>(bytes: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
+            serializer.serialize_str(&STANDARD.encode(bytes))
+        }
+
+        pub fn deserialize<'de, D: Deserializer<'de>>(
+            deserializer: D,
+        ) -> Result<Vec<u8>, D::Error> {
+            let s = <String>::deserialize(deserializer)?;
+            STANDARD.decode(s).map_err(serde::de::Error::custom)
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    #[serde(untagged)]
+    enum PersistedGatewayDetails {
+        /// Standard details of a remote gateway
+        Default(PersistedGatewayConfig),
+
+        /// Custom gateway setup, such as for a client embedded inside gateway itself
+        Custom(PersistedCustomGatewayDetails),
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+    struct PersistedGatewayConfig {
+        /// The hash of the shared keys to ensure the correct ones are used with those gateway details.
+        #[serde(with = "base64")]
+        key_hash: Vec<u8>,
+
+        /// Actual gateway details being persisted.
+        details: OldGatewayEndpointConfigV1_1_33,
+    }
+
+    impl PersistedGatewayConfig {
+        fn verify(&self, shared_key: &LegacySharedKeys) -> bool {
+            let key_bytes = Zeroizing::new(shared_key.to_bytes());
+
+            let mut key_hasher = Sha256::new();
+            key_hasher.update(&key_bytes);
+            let key_hash = key_hasher.finalize();
+
+            self.key_hash == key_hash.deref()
+        }
+    }
+
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    struct PersistedCustomGatewayDetails {
+        gateway_id: String,
+    }
+
+    fn load_shared_key<P: AsRef<Path>>(path: P) -> Result<LegacySharedKeys, ClientCoreError> {
+        // the shared key was a simple pem file
+        Ok(nym_pemstore::load_key(path)?)
+    }
+
+    fn gateway_details_from_raw(
+        gateway_id: String,
+        gateway_owner: String,
+        gateway_listener: String,
+        gateway_shared_key: LegacySharedKeys,
+    ) -> Result<GatewayDetails, ClientCoreError> {
+        Ok(GatewayDetails::Remote(RemoteGatewayDetails {
+            gateway_id: gateway_id
+                .parse()
+                .map_err(|err| ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway id was malformed: {err}"),
+                })?,
+            shared_key: Arc::new(gateway_shared_key.into()),
+            gateway_owner_address: Some(gateway_owner.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway owner address was malformed: {err}"),
+                }
+            })?),
+            gateway_listener: gateway_listener.parse().map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!("the stored gateway listener address was malformed: {err}"),
+                }
+            })?,
+        }))
+    }
+
+    // helper to extract shared key and gateway details into the new GatewayRegistration
+    fn extract_gateway_registration(
+        storage_paths: &CommonClientPathsV1_1_33,
+    ) -> Result<GatewayRegistration, ClientCoreError> {
+        let details_file = std::fs::File::open(&storage_paths.gateway_details).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!(
+                    "failed to open gateway details file at {}: {err}",
+                    storage_paths.gateway_details.display()
+                ),
+            }
+        })?;
+
+        // in v1.1.33 of the clients, the gateway details struct was saved as json
+        let details: PersistedGatewayDetails =
+            serde_json::from_reader(details_file).map_err(|err| {
+                ClientCoreError::UpgradeFailure {
+                    message: format!(
+                        "failed to deserialize gateway details from {}: {err}",
+                        storage_paths.gateway_details.display()
+                    ),
+                }
+            })?;
+
+        let details = match details {
+            PersistedGatewayDetails::Default(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&storage_paths.keys.gateway_shared_key_file)?;
+                if !config.verify(&gateway_shared_key) {
+                    return Err(ClientCoreError::UpgradeFailure {
+                        message: "failed to verify consistency of the existing gateway details"
+                            .to_string(),
+                    });
+                }
+                gateway_details_from_raw(
+                    config.details.gateway_id,
+                    config.details.gateway_owner,
+                    config.details.gateway_listener,
+                    gateway_shared_key,
+                )?
+            }
+            PersistedGatewayDetails::Custom(custom) => {
+                GatewayDetails::Custom(CustomGatewayDetails {
+                    gateway_id: custom.gateway_id.parse().map_err(|err| {
+                        ClientCoreError::UpgradeFailure {
+                            message: format!("the stored gateway id was malformed: {err}"),
+                        }
+                    })?,
+                    data: None,
+                })
+            }
+        };
+
+        Ok(details.into())
+    }
+
+    // it's responsibility of the caller to ensure this is called **after** new registration has already been saved
+    fn remove_old_gateway_details(storage_paths: &CommonClientPathsV1_1_33) -> std::io::Result<()> {
+        std::fs::remove_file(&storage_paths.gateway_details)?;
+
+        if storage_paths.keys.gateway_shared_key_file.exists() {
+            std::fs::remove_file(&storage_paths.keys.gateway_shared_key_file)?;
+        }
+        Ok(())
+    }

    pub async fn migrate_gateway_details(
-        _old_storage_paths: &CommonClientPathsV1_1_33,
-        _new_storage_paths: &CommonClientPaths,
-        _preloaded_config: Option<OldGatewayEndpointConfigV1_1_33>,
+        old_storage_paths: &CommonClientPathsV1_1_33,
+        new_storage_paths: &CommonClientPaths,
+        preloaded_config: Option<OldGatewayEndpointConfigV1_1_33>,
    ) -> Result<(), ClientCoreError> {
-        Err(ClientCoreError::UnsupportedMigration(
-            "migration of legacy keys has been removed and is no longer supported".into(),
-        ))
+        let gateway_registration = match preloaded_config {
+            Some(config) => {
+                let gateway_shared_key =
+                    load_shared_key(&old_storage_paths.keys.gateway_shared_key_file)?;
+                gateway_details_from_raw(
+                    config.gateway_id,
+                    config.gateway_owner,
+                    config.gateway_listener,
+                    gateway_shared_key,
+                )?
+                .into()
+            }
+            None => extract_gateway_registration(old_storage_paths)?,
+        };
+
+        // since we're migrating to a brand new store, the store should be empty
+        // and thus set the 'new' gateway as the active one
+        let details_store =
+            setup_fs_gateways_storage(&new_storage_paths.gateway_registrations).await?;
+        store_gateway_details(&details_store, &gateway_registration).await?;
+        set_active_gateway(
+            &details_store,
+            &gateway_registration.details.gateway_id().to_base58_string(),
+        )
+        .await?;
+
+        remove_old_gateway_details(old_storage_paths).map_err(|err| {
+            ClientCoreError::UpgradeFailure {
+                message: format!("failed to remove old data: {err}"),
+            }
+        })
    }
 }
@@ -32,12 +32,9 @@ where
    /// Key used to encrypt and decrypt content of an ACK packet.
    ack_key: Arc<AckKey>,

-    /// Average delay an acknowledgement packet is going to get delayed at a single mixnode.
+    /// Average delay an acknowledgement packet is going to get delay at a single mixnode.
    average_ack_delay: Duration,

-    /// Average delay a forward packet is going to get delayed at a single mixnode.
-    average_packet_delay: Duration,
-
    /// Defines configuration options related to cover traffic.
    cover_traffic: config::CoverTraffic,

@@ -125,7 +122,6 @@ impl LoopCoverTrafficStream<OsRng> {
        LoopCoverTrafficStream {
            ack_key,
            average_ack_delay,
-            average_packet_delay: traffic_config.average_packet_delay,
            cover_traffic: cover_config,
            next_delay,
            mix_tx,
@@ -191,7 +187,7 @@ impl LoopCoverTrafficStream<OsRng> {
            &self.ack_key,
            &self.our_full_destination,
            self.average_ack_delay,
-            self.average_packet_delay,
+            self.cover_traffic.loop_cover_traffic_average_delay,
            cover_traffic_packet_size,
            self.packet_type,
        ) {
@@ -6,7 +6,7 @@ use nym_crypto::{
    asymmetric::{ed25519, x25519},
    hkdf::{DerivationMaterial, InvalidLength},
 };
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use nym_sphinx::acknowledgements::AckKey;
 use rand::{CryptoRng, RngCore};
 use std::sync::Arc;
@@ -106,5 +106,7 @@ fn _assert_keys_zeroize_on_drop() {
    _assert_zeroize_on_drop::<ed25519::KeyPair>();
    _assert_zeroize_on_drop::<x25519::KeyPair>();
    _assert_zeroize_on_drop::<AckKey>();
+    _assert_zeroize_on_drop::<LegacySharedKeys>();
    _assert_zeroize_on_drop::<SharedSymmetricKey>();
+    _assert_zeroize_on_drop::<SharedGatewayKey>();
 }
@@ -13,7 +13,7 @@ use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use thiserror::Error;
-use tracing::debug;
+use tracing::{debug, error};

 #[cfg(not(target_arch = "wasm32"))]
 use futures::channel::oneshot;
@@ -8,6 +8,7 @@ use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx::anonymous_replies::ReplySurbWithKeyRotation;
 use nym_task::connections::{ConnectionId, TransmissionLane};
 use std::sync::Weak;
+use tracing::error;

 pub(crate) fn new_control_channels() -> (ReplyControllerSender, ReplyControllerReceiver) {
    let (tx, rx) = mpsc::unbounded();
@@ -16,9 +16,6 @@ use std::path::PathBuf;

 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
-    #[error("could not perform the state migration: {0}")]
-    UnsupportedMigration(String),
-
    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

@@ -46,12 +43,9 @@ pub enum ClientCoreError {
    #[error("Invalid URL: {0}")]
    InvalidUrl(String),

-    #[error("node doesn't advertise ip addresses : {0}")]
-    MissingIpAddress(String),
-
    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),

    #[error("no gateways on network")]
    NoGatewaysOnNetwork,
@@ -169,9 +163,6 @@ pub enum ClientCoreError {
    #[error("custom selection of gateway was expected")]
    CustomGatewaySelectionExpected,

-    #[error("custom selection of gateway was unexpected")]
-    UnexpectedCustomGatewaySelection,
-
    #[error("the persisted gateway details were set for a custom setup")]
    UnexpectedPersistedCustomGatewayDetails,

@@ -5,7 +5,6 @@ use crate::error::ClientCoreError;
 use crate::init::types::RegistrationResult;
 use futures::{SinkExt, StreamExt};
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::GatewayListeners;
 use nym_gateway_client::GatewayClient;
 use nym_topology::node::RoutingNode;
 use nym_validator_client::client::{IdentityKeyRef, NymApiClientExt};
@@ -380,12 +379,12 @@ pub(super) fn get_specified_gateway(

 pub(super) async fn register_with_gateway(
    gateway_id: ed25519::PublicKey,
-    gateway_listeners: GatewayListeners,
+    gateway_listener: Url,
    our_identity: Arc<ed25519::KeyPair>,
    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
 ) -> Result<RegistrationResult, ClientCoreError> {
    let mut gateway_client = GatewayClient::new_init(
-        gateway_listeners,
+        gateway_listener,
        gateway_id,
        our_identity.clone(),
        #[cfg(unix)]
@@ -410,6 +409,14 @@ pub(super) async fn register_with_gateway(
            }
        })?;

+    // this should NEVER happen, if it did, it means the function was misused,
+    // because for any fresh **registration**, the derived key is always up to date
+    if auth_response.requires_key_upgrade {
+        return Err(ClientCoreError::UnexpectedKeyUpgrade {
+            gateway_id: gateway_id.to_base58_string(),
+        });
+    }
+
    Ok(RegistrationResult {
        shared_keys: auth_response.initial_shared_key,
        authenticated_ephemeral_client: gateway_client,
@@ -434,7 +441,7 @@ mod tests {

    #[test]
    fn test_multiple_urls_prepared_for_retries() {
-        let urls = [
+        let urls = vec![
            Url::parse("https://api1.nym.com").unwrap(),
            Url::parse("https://api2.nym.com").unwrap(),
            Url::parse("https://api3.nym.com").unwrap(),
@@ -5,7 +5,7 @@

 use crate::client::base_client::storage::helpers::{
    has_gateway_details, load_active_gateway_details, load_client_keys, load_gateway_details,
-    store_gateway_details, update_stored_published_data_gateway,
+    store_gateway_details,
 };
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
@@ -16,8 +16,8 @@ use crate::init::helpers::{
 use crate::init::types::{
    GatewaySelectionSpecification, GatewaySetup, InitialisationResult, SelectedGateway,
 };
+use nym_client_core_gateways_storage::GatewaysDetailsStore;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewayRegistration};
-use nym_client_core_gateways_storage::{GatewayPublishedData, GatewaysDetailsStore};
 use nym_gateway_client::client::InitGatewayClient;
 use nym_topology::node::RoutingNode;
 use rand::rngs::OsRng;
@@ -71,28 +71,21 @@ where
    let mut rng = OsRng;

    let selected_gateway = match selection_specification {
-        GatewaySelectionSpecification::UniformRemote {
-            must_use_tls,
-            no_hostname,
-        } => {
+        GatewaySelectionSpecification::UniformRemote { must_use_tls } => {
            let gateway = uniformly_random_gateway(&mut rng, &available_gateways, must_use_tls)?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
        }
-        GatewaySelectionSpecification::RemoteByLatency {
-            must_use_tls,
-            no_hostname,
-        } => {
+        GatewaySelectionSpecification::RemoteByLatency { must_use_tls } => {
            let gateway =
                choose_gateway_by_latency(&mut rng, &available_gateways, must_use_tls).await?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
        }
        GatewaySelectionSpecification::Specified {
            must_use_tls,
-            no_hostname,
            identity,
        } => {
            let gateway = get_specified_gateway(&identity, &available_gateways, must_use_tls)?;
-            SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?
+            SelectedGateway::from_topology_node(gateway, must_use_tls)?
        }
        GatewaySelectionSpecification::Custom {
            gateway_identity,
@@ -112,15 +105,15 @@ where
    let (gateway_details, authenticated_ephemeral_client) = match selected_gateway {
        SelectedGateway::Remote {
            gateway_id,
-
-            gateway_listeners,
+            gateway_owner_address,
+            gateway_listener,
        } => {
            // if we're using a 'normal' gateway setup, do register
            let our_identity = client_keys.identity_keypair();

            let registration = helpers::register_with_gateway(
                gateway_id,
-                gateway_listeners.clone(),
+                gateway_listener.clone(),
                our_identity,
                #[cfg(unix)]
                connection_fd_callback,
@@ -130,7 +123,8 @@ where
                GatewayDetails::new_remote(
                    gateway_id,
                    registration.shared_keys,
-                    GatewayPublishedData::new(gateway_listeners),
+                    gateway_owner_address,
+                    gateway_listener,
                ),
                Some(registration.authenticated_ephemeral_client),
            )
@@ -156,46 +150,6 @@ where
    })
 }

-pub async fn refresh_gateway_published_data<D>(
-    details_store: &D,
-    registration: GatewayRegistration,
-    available_gateways: Vec<RoutingNode>,
-    must_use_tls: bool,
-    no_hostname: bool,
-) -> Result<(), ClientCoreError>
-where
-    D: GatewaysDetailsStore,
-    D::StorageError: Send + Sync + 'static,
-{
-    let gateway_id = registration.gateway_id().to_base58_string();
-    tracing::trace!("Updating gateway details : {gateway_id}");
-
-    let gateway = get_specified_gateway(&gateway_id, &available_gateways, must_use_tls)?;
-    let selected_gateway = SelectedGateway::from_topology_node(gateway, must_use_tls, no_hostname)?;
-
-    let new_gateway_listeners = match selected_gateway {
-        SelectedGateway::Remote {
-            gateway_listeners, ..
-        } => gateway_listeners,
-        SelectedGateway::Custom { .. } => {
-            // this should not happen, as `from_topology_node` returns a Remote
-            Err(ClientCoreError::UnexpectedCustomGatewaySelection)?
-        }
-    };
-
-    let new_published_data = GatewayPublishedData::new(new_gateway_listeners);
-
-    // update gateway details
-    update_stored_published_data_gateway(
-        details_store,
-        &registration.gateway_id(),
-        &new_published_data,
-    )
-    .await?;
-
-    Ok(())
-}
-
 async fn use_loaded_gateway_details<K, D>(
    key_store: &K,
    details_store: &D,
@@ -10,11 +10,12 @@ use nym_client_core_gateways_storage::{
    GatewayRegistration, GatewaysDetailsStore, RemoteGatewayDetails,
 };
 use nym_crypto::asymmetric::ed25519;
-use nym_gateway_client::client::{GatewayListeners, InitGatewayClient};
-use nym_gateway_client::SharedSymmetricKey;
+use nym_gateway_client::client::InitGatewayClient;
+use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_topology::node::RoutingNode;
 use nym_validator_client::client::IdentityKey;
+use nym_validator_client::nyxd::AccountId;
 use serde::Serialize;
 use std::fmt::{Debug, Display};
 #[cfg(unix)]
@@ -27,7 +28,9 @@ pub enum SelectedGateway {
    Remote {
        gateway_id: ed25519::PublicKey,

-        gateway_listeners: GatewayListeners,
+        gateway_owner_address: Option<AccountId>,
+
+        gateway_listener: Url,
    },
    Custom {
        gateway_id: ed25519::PublicKey,
@@ -39,40 +42,24 @@ impl SelectedGateway {
    pub fn from_topology_node(
        node: RoutingNode,
        must_use_tls: bool,
-        no_hostname: bool,
    ) -> Result<Self, ClientCoreError> {
        // for now, let's use 'old' behaviour, if you want to change it, you can pass it up the enum stack yourself : )
        let prefer_ipv6 = false;

-        let (gateway_listener, fallback_listener) = if must_use_tls {
-            // WSS main, no fallback
-            let primary =
-                node.ws_entry_address_tls()
-                    .ok_or(ClientCoreError::UnsupportedWssProtocol {
-                        gateway: node.identity_key.to_base58_string(),
-                    })?;
-            (primary, None)
+        let gateway_listener = if must_use_tls {
+            node.ws_entry_address_tls()
+                .ok_or(ClientCoreError::UnsupportedWssProtocol {
+                    gateway: node.identity_key.to_base58_string(),
+                })?
        } else {
-            let (maybe_primary, fallback) =
-                node.ws_entry_address_with_fallback(prefer_ipv6, no_hostname);
-            (
-                maybe_primary.ok_or(ClientCoreError::UnsupportedEntry {
+            node.ws_entry_address(prefer_ipv6)
+                .ok_or(ClientCoreError::UnsupportedEntry {
                    id: node.node_id,
                    identity: node.identity_key.to_base58_string(),
-                })?,
-                fallback,
-            )
+                })?
        };

-        let fallback_listener_url = fallback_listener.and_then(|address| {
-            Url::parse(&address)
-                .inspect_err(|err| {
-                    tracing::warn!("Malformed fallback listener, none will be used : {err}")
-                })
-                .ok()
-        });
-
-        let gateway_listener_url =
+        let gateway_listener =
            Url::parse(&gateway_listener).map_err(|source| ClientCoreError::MalformedListener {
                gateway_id: node.identity_key.to_base58_string(),
                raw_listener: gateway_listener,
@@ -81,10 +68,8 @@ impl SelectedGateway {

        Ok(SelectedGateway::Remote {
            gateway_id: node.identity_key,
-            gateway_listeners: GatewayListeners {
-                primary: gateway_listener_url,
-                fallback: fallback_listener_url,
-            },
+            gateway_owner_address: None,
+            gateway_listener,
        })
    }

@@ -113,7 +98,7 @@ impl SelectedGateway {
 /// - shared keys derived between ourselves and the node
 /// - an authenticated handle of an ephemeral handle created for the purposes of registration
 pub struct RegistrationResult {
-    pub shared_keys: Arc<SharedSymmetricKey>,
+    pub shared_keys: Arc<SharedGatewayKey>,
    pub authenticated_ephemeral_client: InitGatewayClient,
 }

@@ -160,36 +145,20 @@ impl InitialisationResult {
    pub fn gateway_id(&self) -> ed25519::PublicKey {
        self.gateway_registration.details.gateway_id()
    }
-
-    // indicates if the remote gateway details TTL has expired
-    pub fn exipred_details(&self) -> bool {
-        if let Some(expiration_timestamp) = self.gateway_registration.details.details_exipration() {
-            OffsetDateTime::now_utc() > expiration_timestamp
-        } else {
-            false
-        }
-    }
 }

 #[derive(Clone, Debug)]
 pub enum GatewaySelectionSpecification {
    /// Uniformly choose a random remote gateway.
-    UniformRemote {
-        must_use_tls: bool,
-        no_hostname: bool,
-    },
+    UniformRemote { must_use_tls: bool },

    /// Should the new, remote, gateway be selected based on latency.
-    RemoteByLatency {
-        must_use_tls: bool,
-        no_hostname: bool,
-    },
+    RemoteByLatency { must_use_tls: bool },

    /// Gateway with this specific identity should be chosen.
    // JS: I don't really like the name of this enum variant but couldn't think of anything better at the time
    Specified {
        must_use_tls: bool,
-        no_hostname: bool,
        identity: IdentityKey,
    },

@@ -205,7 +174,6 @@ impl Default for GatewaySelectionSpecification {
    fn default() -> Self {
        GatewaySelectionSpecification::UniformRemote {
            must_use_tls: false,
-            no_hostname: false,
        }
    }
 }
@@ -215,24 +183,16 @@ impl GatewaySelectionSpecification {
        gateway_identity: Option<String>,
        latency_based_selection: Option<bool>,
        must_use_tls: bool,
-        no_hostname: bool,
    ) -> Self {
        if let Some(identity) = gateway_identity {
            GatewaySelectionSpecification::Specified {
                identity,
                must_use_tls,
-                no_hostname,
            }
        } else if let Some(true) = latency_based_selection {
-            GatewaySelectionSpecification::RemoteByLatency {
-                must_use_tls,
-                no_hostname,
-            }
+            GatewaySelectionSpecification::RemoteByLatency { must_use_tls }
        } else {
-            GatewaySelectionSpecification::UniformRemote {
-                must_use_tls,
-                no_hostname,
-            }
+            GatewaySelectionSpecification::UniformRemote { must_use_tls }
        }
    }
 }
@@ -355,7 +315,6 @@ pub struct InitResults {
    pub encryption_key: String,
    pub gateway_id: String,
    pub gateway_listener: String,
-    pub fallback_listener: Option<String>,
    pub gateway_registration: OffsetDateTime,
    pub address: Recipient,
 }
@@ -373,13 +332,7 @@ impl InitResults {
            identity_key: address.identity().to_base58_string(),
            encryption_key: address.encryption_key().to_base58_string(),
            gateway_id: gateway.gateway_id.to_base58_string(),
-            gateway_listener: gateway.published_data.listeners.primary.to_string(),
-            fallback_listener: gateway
-                .published_data
-                .listeners
-                .fallback
-                .as_ref()
-                .map(|uri| uri.to_string()),
+            gateway_listener: gateway.gateway_listener.to_string(),
            gateway_registration: registration,
            address,
        }
@@ -30,6 +30,7 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
+                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -20,9 +20,9 @@ use nym_credentials_interface::TicketType;
 use nym_crypto::asymmetric::ed25519;
 use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
-    BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersion,
-    GatewayProtocolVersionExt, GatewayRequestsError, ServerResponse, SharedSymmetricKey,
-    CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
+    BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersionExt,
+    GatewayRequestsError, SensitiveServerResponse, ServerResponse, SharedGatewayKey,
+    SharedSymmetricKey, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
 };
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_statistics_common::clients::connection::ConnectionStatsEvent;
@@ -47,39 +47,43 @@ use std::os::raw::c_int as RawFd;
 use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
 use wasmtimer::tokio::sleep;
+use zeroize::Zeroizing;

 pub mod config;

 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) mod websockets;
 #[cfg(not(target_arch = "wasm32"))]
-use crate::client::websockets::connect_async_with_fallback;
+use websockets::connect_async;

 pub struct GatewayConfig {
    pub gateway_identity: ed25519::PublicKey,

-    pub gateway_listeners: GatewayListeners,
+    // currently a dead field
+    pub gateway_owner: Option<String>,
+
+    pub gateway_listener: String,
 }

 impl GatewayConfig {
-    pub fn new(gateway_identity: ed25519::PublicKey, gateway_listeners: GatewayListeners) -> Self {
+    pub fn new(
+        gateway_identity: ed25519::PublicKey,
+        gateway_owner: Option<String>,
+        gateway_listener: String,
+    ) -> Self {
        GatewayConfig {
            gateway_identity,
-            gateway_listeners,
+            gateway_owner,
+            gateway_listener,
        }
    }
 }

-#[derive(Debug, Clone)]
-pub struct GatewayListeners {
-    pub primary: Url,
-    pub fallback: Option<Url>,
-}
-
 #[must_use]
 #[derive(Debug)]
 pub struct AuthenticationResponse {
-    pub initial_shared_key: Arc<SharedSymmetricKey>,
+    pub initial_shared_key: Arc<SharedGatewayKey>,
+    pub requires_key_upgrade: bool,
 }

 // TODO: this should be refactored into a state machine that keeps track of its authentication state
@@ -88,16 +92,17 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {

    authenticated: bool,
    bandwidth: ClientBandwidth,
-    gateway_addresses: GatewayListeners,
+    gateway_address: String,
    gateway_identity: ed25519::PublicKey,
    local_identity: Arc<ed25519::KeyPair>,
-    shared_key: Option<Arc<SharedSymmetricKey>>,
+    shared_key: Option<Arc<SharedGatewayKey>>,
    connection: SocketState,
    packet_router: PacketRouter,
    bandwidth_controller: Option<BandwidthController<C, St>>,
    stats_reporter: ClientStatsSender,

-    negotiated_protocol: Option<GatewayProtocolVersion>,
+    // currently unused (but populated)
+    negotiated_protocol: Option<u8>,

    // Callback on the fd as soon as the connection has been established
    #[cfg(unix)]
@@ -114,7 +119,7 @@ impl<C, St> GatewayClient<C, St> {
        gateway_config: GatewayConfig,
        local_identity: Arc<ed25519::KeyPair>,
        // TODO: make it mandatory. if you don't want to pass it, use `new_init`
-        shared_key: Option<Arc<SharedSymmetricKey>>,
+        shared_key: Option<Arc<SharedGatewayKey>>,
        packet_router: PacketRouter,
        bandwidth_controller: Option<BandwidthController<C, St>>,
        stats_reporter: ClientStatsSender,
@@ -125,7 +130,7 @@ impl<C, St> GatewayClient<C, St> {
            cfg,
            authenticated: false,
            bandwidth: ClientBandwidth::new_empty(),
-            gateway_addresses: gateway_config.gateway_listeners,
+            gateway_address: gateway_config.gateway_listener,
            gateway_identity: gateway_config.gateway_identity,
            local_identity,
            shared_key,
@@ -144,7 +149,7 @@ impl<C, St> GatewayClient<C, St> {
        self.gateway_identity
    }

-    pub fn shared_key(&self) -> Option<Arc<SharedSymmetricKey>> {
+    pub fn shared_key(&self) -> Option<Arc<SharedGatewayKey>> {
        self.shared_key.clone()
    }

@@ -161,12 +166,10 @@ impl<C, St> GatewayClient<C, St> {
    }

    #[cfg(not(target_arch = "wasm32"))]
-    #[allow(clippy::unreachable)]
    async fn _close_connection(&mut self) -> Result<(), GatewayClientError> {
        match std::mem::replace(&mut self.connection, SocketState::NotConnected) {
            SocketState::Available(mut socket) => Ok((*socket).close(None).await?),
            SocketState::PartiallyDelegated(_) => {
-                // SAFETY: this is only called after the caller has already recovered the connection
                unreachable!("this branch should have never been reached!")
            }
            _ => Ok(()), // no need to do anything in those cases
@@ -174,7 +177,6 @@ impl<C, St> GatewayClient<C, St> {
    }

    #[cfg(target_arch = "wasm32")]
-    #[allow(clippy::unreachable)]
    async fn _close_connection(&mut self) -> Result<(), GatewayClientError> {
        match std::mem::replace(&mut self.connection, SocketState::NotConnected) {
            SocketState::Available(socket) => {
@@ -182,7 +184,6 @@ impl<C, St> GatewayClient<C, St> {
                Ok(())
            }
            SocketState::PartiallyDelegated(_) => {
-                // SAFETY: this is only called after the caller has already recovered the connection
                unreachable!("this branch should have never been reached!")
            }
            _ => Ok(()), // no need to do anything in those cases
@@ -199,19 +200,12 @@ impl<C, St> GatewayClient<C, St> {

    #[cfg(not(target_arch = "wasm32"))]
    pub async fn establish_connection(&mut self) -> Result<(), GatewayClientError> {
-        if let Some(fallback_url) = &self.gateway_addresses.fallback {
-            debug!(
-                "Attempting to establish connection to gateway at: {}, with fallback at: {fallback_url}",
-                self.gateway_addresses.primary
-            );
-        } else {
-            debug!(
-                "Attempting to establish connection to gateway at: {}",
-                self.gateway_addresses.primary
-            );
-        }
-        let (ws_stream, _) = connect_async_with_fallback(
-            &self.gateway_addresses,
+        debug!(
+            "Attempting to establish connection to gateway at: {}",
+            self.gateway_address
+        );
+        let (ws_stream, _) = connect_async(
+            &self.gateway_address,
            #[cfg(unix)]
            self.connection_fd_callback.clone(),
        )
@@ -224,7 +218,7 @@ impl<C, St> GatewayClient<C, St> {

    #[cfg(target_arch = "wasm32")]
    pub async fn establish_connection(&mut self) -> Result<(), GatewayClientError> {
-        let ws_stream = match JSWebsocket::new(self.gateway_addresses.primary.as_ref()) {
+        let ws_stream = match JSWebsocket::new(&self.gateway_address) {
            Ok(ws_stream) => ws_stream,
            Err(e) => {
                return Err(GatewayClientError::NetworkErrorWasm(e));
@@ -277,7 +271,7 @@ impl<C, St> GatewayClient<C, St> {
        message: ClientRequest,
    ) -> Result<(), GatewayClientError> {
        if let Some(shared_key) = self.shared_key() {
-            let encrypted = message.encrypt(&shared_key)?;
+            let encrypted = message.encrypt(&*shared_key)?;
            Box::pin(self.send_websocket_message_without_response(encrypted)).await?;
            Ok(())
        } else {
@@ -464,28 +458,61 @@ impl<C, St> GatewayClient<C, St> {
        }
    }

+    fn check_gateway_protocol(
+        &self,
+        gateway_protocol: Option<u8>,
+    ) -> Result<(), GatewayClientError> {
+        debug!("gateway protocol: {gateway_protocol:?}, ours: {CURRENT_PROTOCOL_VERSION}");
+
+        // right now there are no failure cases here, but this might change in the future
+        match gateway_protocol {
+            None => {
+                warn!("the gateway we're connected to has not specified its protocol version. It's probably running version < 1.1.X, but that's still fine for now. It will become a hard error in 1.2.0");
+                // note: in +1.2.0 we will have to return a hard error here
+                Ok(())
+            }
+            Some(v) if v > CURRENT_PROTOCOL_VERSION => {
+                let err = GatewayClientError::IncompatibleProtocol {
+                    gateway: Some(v),
+                    current: CURRENT_PROTOCOL_VERSION,
+                };
+                error!("{err}");
+                Err(err)
+            }
+
+            Some(_) => {
+                debug!("the gateway is using exactly the same (or older) protocol version as we are. We're good to continue!");
+                Ok(())
+            }
+        }
+    }
+
    async fn register(
        &mut self,
-        supported_gateway_protocol: GatewayProtocolVersion,
+        derive_aes256_gcm_siv_key: bool,
    ) -> Result<(), GatewayClientError> {
        if !self.connection.is_established() {
            return Err(GatewayClientError::ConnectionNotEstablished);
        }

        debug_assert!(self.connection.is_available());
-        log::debug!("registering with gateway");
+        log::debug!(
+            "registering with gateway. using legacy key derivation: {}",
+            !derive_aes256_gcm_siv_key
+        );

        // it's fine to instantiate it here as it's only used once (during authentication or registration)
        // and putting it into the GatewayClient struct would be a hassle
        let mut rng = OsRng;

-        let handshake_result = match &mut self.connection {
+        let shared_key = match &mut self.connection {
            SocketState::Available(ws_stream) => client_handshake(
                &mut rng,
                ws_stream,
                self.local_identity.as_ref(),
                self.gateway_identity,
-                supported_gateway_protocol,
+                self.cfg.bandwidth.require_tickets,
+                derive_aes256_gcm_siv_key,
                #[cfg(not(target_arch = "wasm32"))]
                self.shutdown_token.clone(),
            )
@@ -494,26 +521,99 @@ impl<C, St> GatewayClient<C, St> {
            _ => return Err(GatewayClientError::ConnectionInInvalidState),
        }?;

-        let authentication_status = match self.read_control_response().await? {
-            ServerResponse::Register { status, .. } => status,
+        let (authentication_status, gateway_protocol) = match self.read_control_response().await? {
+            ServerResponse::Register {
+                protocol_version,
+                status,
+            } => (status, protocol_version),
            ServerResponse::Error { message } => {
                return Err(GatewayClientError::GatewayError(message))
            }
            other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
        };

+        self.check_gateway_protocol(gateway_protocol)?;
        self.authenticated = authentication_status;

        if self.authenticated {
-            self.shared_key = Some(Arc::new(handshake_result.derived_key));
+            self.shared_key = Some(Arc::new(shared_key));
        }

        // populate the negotiated protocol for future uses
-        self.negotiated_protocol = Some(handshake_result.negotiated_protocol);
+        self.negotiated_protocol = gateway_protocol;

        Ok(())
    }

+    pub async fn upgrade_key_authenticated(
+        &mut self,
+    ) -> Result<Zeroizing<SharedSymmetricKey>, GatewayClientError> {
+        info!("*** STARTING AES128CTR-HMAC KEY UPGRADE INTO AES256GCM-SIV***");
+
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+
+        if !self.authenticated {
+            return Err(GatewayClientError::NotAuthenticated);
+        }
+
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        if !shared_key.is_legacy() {
+            return Err(GatewayClientError::KeyAlreadyUpgraded);
+        }
+
+        // make sure we have the only reference, so we could safely swap it
+        if Arc::strong_count(shared_key) != 1 {
+            return Err(GatewayClientError::KeyAlreadyInUse);
+        }
+
+        assert!(shared_key.is_legacy());
+        let legacy_key = shared_key.unwrap_legacy();
+        let (updated_key, hkdf_salt) = legacy_key.upgrade();
+        let derived_key_digest = updated_key.digest();
+
+        let upgrade_request = ClientRequest::UpgradeKey {
+            hkdf_salt,
+            derived_key_digest,
+        }
+        .encrypt(legacy_key)?;
+
+        info!("sending upgrade request and awaiting the acknowledgement back");
+        let (ciphertext, nonce) = match self
+            .send_websocket_message_with_response(upgrade_request)
+            .await?
+        {
+            ServerResponse::EncryptedResponse { ciphertext, nonce } => (ciphertext, nonce),
+            ServerResponse::Error { message } => {
+                return Err(GatewayClientError::GatewayError(message))
+            }
+            other => return Err(GatewayClientError::UnexpectedResponse { name: other.name() }),
+        };
+
+        // attempt to decrypt it using NEW key
+        let Ok(response) = SensitiveServerResponse::decrypt(&ciphertext, &nonce, &updated_key)
+        else {
+            return Err(GatewayClientError::FatalKeyUpgradeFailure);
+        };
+
+        match response {
+            SensitiveServerResponse::KeyUpgradeAck { .. } => {
+                info!("received key upgrade acknowledgement")
+            }
+            _ => return Err(GatewayClientError::FatalKeyUpgradeFailure),
+        }
+
+        // perform in memory swap and make a copy for updating storage
+        let zeroizing_updated_key = updated_key.zeroizing_clone();
+        self.shared_key = Some(Arc::new(updated_key.into()));
+
+        Ok(zeroizing_updated_key)
+    }
+
    async fn send_authenticate_request_and_handle_response(
        &mut self,
        msg: ClientControlRequest,
@@ -524,14 +624,11 @@ impl<C, St> GatewayClient<C, St> {
                status,
                bandwidth_remaining,
            } => {
-                if protocol_version.is_future_version() {
-                    error!("the gateway insists on using v{protocol_version} protocol which is not supported by this client");
-                    return Err(GatewayClientError::AuthenticationFailure);
-                }
+                self.check_gateway_protocol(protocol_version)?;
                self.authenticated = status;
                self.bandwidth.update_and_maybe_log(bandwidth_remaining);

-                self.negotiated_protocol = Some(protocol_version);
+                self.negotiated_protocol = protocol_version;
                log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");

                Ok(())
@@ -541,42 +638,56 @@ impl<C, St> GatewayClient<C, St> {
        }
    }

-    async fn authenticate_v2(
-        &mut self,
-        requested_protocol_version: GatewayProtocolVersion,
-    ) -> Result<(), GatewayClientError> {
-        debug!("using v2 authentication");
+    async fn authenticate_v1(&mut self) -> Result<(), GatewayClientError> {
+        debug!("using v1 authentication");
+
        let Some(shared_key) = self.shared_key.as_ref() else {
            return Err(GatewayClientError::NoSharedKeyAvailable);
        };

-        let msg = ClientControlRequest::new_authenticate_v2(
+        let self_address = self
+            .local_identity
+            .public_key()
+            .derive_destination_address();
+
+        let msg = ClientControlRequest::new_authenticate(
+            self_address,
            shared_key,
-            &self.local_identity,
-            requested_protocol_version,
+            self.cfg.bandwidth.require_tickets,
        )?;
        self.send_authenticate_request_and_handle_response(msg)
            .await
    }

-    async fn authenticate(
-        &mut self,
-        requested_protocol_version: GatewayProtocolVersion,
-    ) -> Result<(), GatewayClientError> {
+    async fn authenticate_v2(&mut self) -> Result<(), GatewayClientError> {
+        debug!("using v2 authentication");
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        let msg = ClientControlRequest::new_authenticate_v2(shared_key, &self.local_identity)?;
+        self.send_authenticate_request_and_handle_response(msg)
+            .await
+    }
+
+    async fn authenticate(&mut self, use_v2: bool) -> Result<(), GatewayClientError> {
        if !self.connection.is_established() {
            return Err(GatewayClientError::ConnectionNotEstablished);
        }
        debug!("authenticating with gateway");

-        // use the highest possible protocol version the gateway has announced support for
-        self.authenticate_v2(requested_protocol_version).await
+        if use_v2 {
+            self.authenticate_v2().await
+        } else {
+            self.authenticate_v1().await
+        }
    }

    /// Helper method to either call register or authenticate based on self.shared_key value
    #[instrument(skip_all,
        fields(
            gateway = %self.gateway_identity,
-            gateway_address = %self.gateway_addresses.primary
+            gateway_address = %self.gateway_address
        )
    )]
    pub async fn perform_initial_authentication(
@@ -587,11 +698,15 @@ impl<C, St> GatewayClient<C, St> {
        }

        // 1. check gateway's protocol version
-        // if we failed to get this request resolved, it means the gateway is on an old version
-        // that definitely does not support auth v2 or aes256gcm, so we bail
-        let gw_protocol = self.get_gateway_protocol().await?;
-
-        debug!("supported gateway protocol: {gw_protocol:?}");
+        let gw_protocol = match self.get_gateway_protocol().await {
+            Ok(protocol) => Some(protocol),
+            Err(_) => {
+                // if we failed to send the request, it means the gateway is running the old binary,
+                // so it has reset our connection - we have to reconnect
+                self.establish_connection().await?;
+                None
+            }
+        };

        let supports_aes_gcm_siv = gw_protocol.supports_aes256_gcm_siv();
        let supports_auth_v2 = gw_protocol.supports_authenticate_v2();
@@ -603,32 +718,16 @@ impl<C, St> GatewayClient<C, St> {
        if !supports_auth_v2 {
            warn!("this gateway is on an old version that doesn't support authentication v2")
        }
-
-        // Dropping v1 support
-        if !supports_auth_v2 || !supports_aes_gcm_siv {
-            // we can't continue
-            return Err(GatewayClientError::IncompatibleProtocol {
-                gateway: gw_protocol,
-                current: CURRENT_PROTOCOL_VERSION,
-            });
-        }
-
        if !supports_key_rotation_info {
            warn!("this gateway is on an old version that doesn't support key rotation packets")
        }

-        let gw_protocol = if gw_protocol.is_future_version() {
-            warn!("we're running outdated software as gateway is announcing protocol {gw_protocol:?} whilst we're using {}. we're going to attempt to downgrade", GatewayProtocolVersion::CURRENT);
-            GatewayProtocolVersion::CURRENT
-        } else {
-            gw_protocol
-        };
-
        if self.authenticated {
            debug!("Already authenticated");
            return if let Some(shared_key) = &self.shared_key {
                Ok(AuthenticationResponse {
                    initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade: shared_key.is_legacy() && supports_aes_gcm_siv,
                })
            } else {
                Err(GatewayClientError::AuthenticationFailureWithPreexistingSharedKey)
@@ -636,30 +735,32 @@ impl<C, St> GatewayClient<C, St> {
        }

        if self.shared_key.is_some() {
-            self.authenticate(gw_protocol).await?;
+            self.authenticate(supports_auth_v2).await?;

            if self.authenticated {
                // if we are authenticated it means we MUST have an associated shared_key
-                #[allow(clippy::unwrap_used)]
                let shared_key = self.shared_key.as_ref().unwrap();

+                let requires_key_upgrade = shared_key.is_legacy() && supports_aes_gcm_siv;
+
                Ok(AuthenticationResponse {
                    initial_shared_key: Arc::clone(shared_key),
+                    requires_key_upgrade,
                })
            } else {
                Err(GatewayClientError::AuthenticationFailure)
            }
        } else {
-            self.register(gw_protocol).await?;
+            self.register(supports_aes_gcm_siv).await?;

            // if registration didn't return an error, we MUST have an associated shared key
-            #[allow(clippy::unwrap_used)]
            let shared_key = self.shared_key.as_ref().unwrap();

            // we're always registering with the highest supported protocol,
            // so no upgrades are required
            Ok(AuthenticationResponse {
                initial_shared_key: Arc::clone(shared_key),
+                requires_key_upgrade: false,
            })
        }
    }
@@ -727,8 +828,6 @@ impl<C, St> GatewayClient<C, St> {
    }

    fn unchecked_bandwidth_controller(&self) -> &BandwidthController<C, St> {
-        // this is an unchecked method
-        #[allow(clippy::unwrap_used)]
        self.bandwidth_controller.as_ref().unwrap()
    }

@@ -820,7 +919,6 @@ impl<C, St> GatewayClient<C, St> {
            BinaryRequest::ForwardSphinx { packet }
        };

-        #[allow(clippy::expect_used)]
        req.into_ws_message(
            self.shared_key
                .as_ref()
@@ -927,8 +1025,6 @@ impl<C, St> GatewayClient<C, St> {
        self.send_with_reconnection_on_failure(msg).await
    }

-    // SAFETY: this method is only called when the connection is in `PartiallyDelegated` state
-    #[allow(clippy::unreachable)]
    async fn recover_socket_connection(&mut self) -> Result<(), GatewayClientError> {
        if self.connection.is_available() {
            return Ok(());
@@ -958,7 +1054,6 @@ impl<C, St> GatewayClient<C, St> {
            return Err(GatewayClientError::ConnectionInInvalidState);
        }

-        #[allow(clippy::expect_used)]
        let partially_delegated =
            match std::mem::replace(&mut self.connection, SocketState::Invalid) {
                SocketState::Available(conn) => {
@@ -974,13 +1069,7 @@ impl<C, St> GatewayClient<C, St> {
                        self.shutdown_token.clone(),
                    )
                }
-                other => {
-                    error!(
-                        "attempted to start mixnet listener whilst the connection is in {} state!",
-                        other.name()
-                    );
-                    return Err(GatewayClientError::ConnectionInInvalidState);
-                }
+                _ => unreachable!(),
            };

        self.connection = SocketState::PartiallyDelegated(partially_delegated);
@@ -993,12 +1082,8 @@ impl<C, St> GatewayClient<C, St> {
        }

        // if we're reconnecting, because we lost connection, we need to re-authenticate the connection
-        if let Some(negotiated_protocol) = self.negotiated_protocol {
-            self.authenticate(negotiated_protocol).await?;
-        } else {
-            // This should never happen, because it would mean we're not registered
-            return Err(GatewayClientError::NotRegistered);
-        }
+        self.authenticate(self.negotiated_protocol.supports_authenticate_v2())
+            .await?;

        // this call is NON-blocking
        self.start_listening_for_mixnet_messages()?;
@@ -1043,7 +1128,7 @@ pub struct InitOnly;
 impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
    // for initialisation we do not need credential storage. Though it's still a bit weird we have to set the generic...
    pub fn new_init(
-        gateway_listeners: GatewayListeners,
+        gateway_listener: Url,
        gateway_identity: ed25519::PublicKey,
        local_identity: Arc<ed25519::KeyPair>,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
@@ -1062,7 +1147,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            cfg: GatewayClientConfig::default().with_disabled_credentials_mode(true),
            authenticated: false,
            bandwidth: ClientBandwidth::new_empty(),
-            gateway_addresses: gateway_listeners,
+            gateway_address: gateway_listener.to_string(),
            gateway_identity,
            local_identity,
            shared_key: None,
@@ -1094,7 +1179,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            cfg: self.cfg,
            authenticated: self.authenticated,
            bandwidth: self.bandwidth,
-            gateway_addresses: self.gateway_addresses,
+            gateway_address: self.gateway_address,
            gateway_identity: self.gateway_identity,
            local_identity: self.local_identity,
            shared_key: self.shared_key,
@@ -1,5 +1,3 @@
-#[cfg(not(target_arch = "wasm32"))]
-use crate::client::GatewayListeners;
 use crate::error::GatewayClientError;

 use nym_http_api_client::HickoryDnsResolver;
@@ -41,6 +39,7 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
+                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -87,35 +86,3 @@ pub(crate) async fn connect_async(
            source: Box::new(error),
        })
 }
-
-#[cfg(not(target_arch = "wasm32"))]
-pub(crate) async fn connect_async_with_fallback(
-    endpoints: &GatewayListeners,
-    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
-) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), GatewayClientError> {
-    match connect_async(
-        endpoints.primary.as_ref(),
-        #[cfg(unix)]
-        connection_fd_callback.clone(),
-    )
-    .await
-    {
-        Ok(inner) => Ok(inner),
-        Err(e) => {
-            if let Some(fallback) = &endpoints.fallback {
-                tracing::warn!(
-                    "Main endpoint failed {} : {e}, trying fallback : {fallback}",
-                    endpoints.primary
-                );
-                connect_async(
-                    fallback.as_ref(),
-                    #[cfg(unix)]
-                    connection_fd_callback,
-                )
-                .await
-            } else {
-                Err(e)
-            }
-        }
-    }
-}
@@ -54,7 +54,7 @@ pub enum GatewayClientError {

    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),

    #[error("No shared key was provided or obtained")]
    NoSharedKeyAvailable,
@@ -83,9 +83,6 @@ pub enum GatewayClientError {
    #[error("Client is not authenticated")]
    NotAuthenticated,

-    #[error("Client is not registered")]
-    NotRegistered,
-
    #[error("Client does not have enough bandwidth: estimated {0}, remaining: {1}")]
    NotEnoughBandwidth(i64, i64),

@@ -119,8 +116,8 @@ pub enum GatewayClientError {
    #[error("Failed to send mixnet message")]
    MixnetMsgSenderFailedToSend,

-    #[error("Attempted to negotiate connection with gateway using incompatible protocol version. Ours is {current} and the gateway reports {gateway}")]
-    IncompatibleProtocol { gateway: u8, current: u8 },
+    #[error("Attempted to negotiate connection with gateway using incompatible protocol version. Ours is {current} and the gateway reports {gateway:?}")]
+    IncompatibleProtocol { gateway: Option<u8>, current: u8 },

    #[error(
        "The packet router hasn't been set - are you sure you started up the client correctly?"
@@ -7,7 +7,9 @@ use tracing::{error, warn};
 use tungstenite::{protocol::Message, Error as WsError};

 pub use client::{config::GatewayClientConfig, GatewayClient, GatewayConfig};
-pub use nym_gateway_requests::shared_key::SharedSymmetricKey;
+pub use nym_gateway_requests::shared_key::{
+    LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey,
+};
 pub use packet_router::{
    AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
    PacketRouter,
@@ -45,7 +47,7 @@ pub(crate) fn cleanup_socket_messages(

 pub(crate) fn try_decrypt_binary_message(
    bin_msg: Vec<u8>,
-    shared_keys: &SharedSymmetricKey,
+    shared_keys: &SharedGatewayKey,
 ) -> Option<Vec<u8>> {
    match BinaryResponse::try_from_encrypted_tagged_bytes(bin_msg, shared_keys) {
        Ok(bin_response) => match bin_response {
@@ -9,7 +9,7 @@ use crate::{cleanup_socket_messages, try_decrypt_binary_message};
 use futures::channel::oneshot;
 use futures::stream::{SplitSink, SplitStream};
 use futures::{SinkExt, StreamExt};
-use nym_gateway_requests::shared_key::SharedSymmetricKey;
+use nym_gateway_requests::shared_key::SharedGatewayKey;
 use nym_gateway_requests::{SensitiveServerResponse, ServerResponse, SimpleGatewayRequestsError};
 use nym_task::ShutdownToken;
 use si_scale::helpers::bibytes2;
@@ -63,7 +63,7 @@ pub(crate) struct PartiallyDelegatedHandle {

 struct PartiallyDelegatedRouter {
    packet_router: PacketRouter,
-    shared_key: Arc<SharedSymmetricKey>,
+    shared_key: Arc<SharedGatewayKey>,
    client_bandwidth: ClientBandwidth,

    stream_return: SplitStreamSender,
@@ -73,7 +73,7 @@ struct PartiallyDelegatedRouter {
 impl PartiallyDelegatedRouter {
    fn new(
        packet_router: PacketRouter,
-        shared_key: Arc<SharedSymmetricKey>,
+        shared_key: Arc<SharedGatewayKey>,
        client_bandwidth: ClientBandwidth,
        stream_return: SplitStreamSender,
        stream_return_requester: oneshot::Receiver<()>,
@@ -197,6 +197,11 @@ impl PartiallyDelegatedRouter {
                        SensitiveServerResponse::RememberMeAck {} => {
                            info!("received remember me acknowledgement");
                        }
+                        SensitiveServerResponse::KeyUpgradeAck {} => {
+                            warn!(
+                                    "received illegal key upgrade acknowledgement in an authenticated client"
+                                );
+                        }
                        _ => {
                            warn!("received unknown SensitiveServerResponse");
                        }
@@ -272,7 +277,7 @@ impl PartiallyDelegatedHandle {
    pub(crate) fn split_and_listen_for_mixnet_messages(
        conn: WsConn,
        packet_router: PacketRouter,
-        shared_key: Arc<SharedSymmetricKey>,
+        shared_key: Arc<SharedGatewayKey>,
        client_bandwidth: ClientBandwidth,
        shutdown: ShutdownToken,
    ) -> Self {
@@ -322,7 +327,6 @@ impl PartiallyDelegatedHandle {
        Ok(self.sink_half.send_all(&mut send_stream).await?)
    }

-    #[allow(clippy::panic)]
    pub(crate) async fn merge(self) -> Result<WsConn, GatewayClientError> {
        let (mut stream_receiver, notify) = self.delegated_stream;

@@ -351,10 +355,8 @@ impl PartiallyDelegatedHandle {
            // in receive_res
            .map_err(|_| GatewayClientError::ConnectionAbruptlyClosed)?;
        let stream = stream_results?;
-
        // the error is thrown when trying to reunite sink and stream that did not originate
        // from the same split which is impossible to happen here
-        #[allow(clippy::unwrap_used)]
        Ok(self.sink_half.reunite(stream).unwrap())
    }
 }
@@ -385,13 +387,4 @@ impl SocketState {
            SocketState::Available(_) | SocketState::PartiallyDelegated(_)
        )
    }
-
-    pub(crate) fn name(&self) -> &'static str {
-        match self {
-            SocketState::Available(_) => "available",
-            SocketState::PartiallyDelegated(_) => "partially delegated",
-            SocketState::NotConnected => "not connected",
-            SocketState::Invalid => "invalid",
-        }
-    }
 }
@@ -75,7 +75,6 @@ workspace = true
 features = ["json", "rustls-tls"]

 [dev-dependencies]
-anyhow = { workspace = true }
 bip39 = { workspace = true }
 cosmrs = { workspace = true, features = ["bip32"] }
 ts-rs = { workspace = true }
@@ -7,7 +7,6 @@ use cosmrs::{tx, AccountId, Coin, Denom};
 use nym_validator_client::http_client;
 use nym_validator_client::nyxd::CosmWasmClient;
 use nym_validator_client::signing::direct_wallet::DirectSecp256k1HdWallet;
-use nym_validator_client::signing::signer::OfflineSigner;
 use nym_validator_client::signing::tx_signer::TxSigner;
 use nym_validator_client::signing::SignerData;

@@ -20,8 +19,8 @@ async fn main() {
    let validator = "https://rpc.sandbox.nymtech.net";
    let to_address: AccountId = "n1pefc2utwpy5w78p2kqdsfmpjxfwmn9d39k5mqa".parse().unwrap();

-    let signer = DirectSecp256k1HdWallet::checked_from_mnemonic(prefix, signer_mnemonic).unwrap();
-    let signer_address = signer.signer_addresses()[0].clone();
+    let signer = DirectSecp256k1HdWallet::from_mnemonic(prefix, signer_mnemonic);
+    let signer_address = signer.try_derive_accounts().unwrap()[0].address().clone();

    // local 'client' ONLY signing messages
    let tx_signer = signer;
@@ -58,15 +57,9 @@ async fn main() {
        100000u32,
    );

-    let tx_raw = TxSigner::sign_direct(
-        &tx_signer,
-        &signer_address,
-        vec![send_msg],
-        fee,
-        memo,
-        signer_data,
-    )
-    .unwrap();
+    let tx_raw = tx_signer
+        .sign_direct(&signer_address, vec![send_msg], fee, memo, signer_data)
+        .unwrap();
    let tx_bytes = tx_raw.to_bytes().unwrap();

    // compare balances from before and after the tx
@@ -5,7 +5,8 @@ use crate::nyxd::{self, NyxdClient};
 use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
 use crate::signing::signer::{NoSigner, OfflineSigner};
 use crate::{
-    DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient, ValidatorClientError,
+    DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient, ReqwestRpcClient,
+    ValidatorClientError,
 };
 use nym_api_requests::ecash::models::{
    AggregatedCoinIndicesSignatureResponse, AggregatedExpirationDateSignatureResponse,
@@ -163,7 +164,7 @@ impl Client<HttpRpcClient, DirectSecp256k1HdWallet> {
    ) -> Result<DirectSigningHttpRpcValidatorClient, ValidatorClientError> {
        let rpc_client = http_client(config.nyxd_url.as_str())?;
        let prefix = &config.nyxd_config.chain_details.bech32_account_prefix;
-        let wallet = DirectSecp256k1HdWallet::checked_from_mnemonic(prefix, mnemonic)?;
+        let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);

        Ok(Self::new_signing_with_rpc_client(
            config, rpc_client, wallet,
@@ -176,13 +177,12 @@ impl Client<HttpRpcClient, DirectSecp256k1HdWallet> {
    }
 }

-#[allow(deprecated)]
-impl Client<crate::ReqwestRpcClient, DirectSecp256k1HdWallet> {
+impl Client<ReqwestRpcClient, DirectSecp256k1HdWallet> {
    pub fn new_reqwest_signing(
        config: Config,
        mnemonic: bip39::Mnemonic,
    ) -> DirectSigningReqwestRpcValidatorClient {
-        let rpc_client = crate::ReqwestRpcClient::new(config.nyxd_url.clone());
+        let rpc_client = ReqwestRpcClient::new(config.nyxd_url.clone());
        let prefix = &config.nyxd_config.chain_details.bech32_account_prefix;
        let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);

@@ -203,10 +203,9 @@ impl Client<HttpRpcClient> {
    }
 }

-#[allow(deprecated)]
-impl Client<crate::ReqwestRpcClient> {
+impl Client<ReqwestRpcClient> {
    pub fn new_reqwest_query(config: Config) -> QueryReqwestRpcValidatorClient {
-        let rpc_client = crate::ReqwestRpcClient::new(config.nyxd_url.clone());
+        let rpc_client = ReqwestRpcClient::new(config.nyxd_url.clone());
        Self::new_with_rpc_client(config, rpc_client)
    }
 }
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::nym_api;
-use crate::signing::direct_wallet::DirectSecp256k1HdWalletError;
 pub use tendermint_rpc::error::Error as TendermintRpcError;
 use thiserror::Error;

@@ -27,12 +26,6 @@ pub enum ValidatorClientError {

    #[error("No validator API url has been provided")]
    NoAPIUrlAvailable,
-
-    #[error("failed to derive signing accounts: {source}")]
-    AccountDerivationFailure {
-        #[from]
-        source: DirectSecp256k1HdWalletError,
-    },
 }

 impl From<nym_api::error::NymAPIError> for ValidatorClientError {
@@ -12,7 +12,6 @@ pub mod rpc;
 pub mod signing;

 pub use crate::error::ValidatorClientError;
-#[allow(deprecated)]
 pub use crate::rpc::reqwest::ReqwestRpcClient;
 pub use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
 pub use client::{Client, Config, EcashApiClient};
@@ -39,13 +38,9 @@ pub type DirectSigningHttpRpcValidatorClient = Client<HttpRpcClient, DirectSecp2
 #[cfg(feature = "http-client")]
 pub type DirectSigningHttpRpcNyxdClient = nyxd::NyxdClient<HttpRpcClient, DirectSecp256k1HdWallet>;

-#[allow(deprecated)]
 pub type QueryReqwestRpcValidatorClient = Client<ReqwestRpcClient>;
-#[allow(deprecated)]
 pub type QueryReqwestRpcNyxdClient = nyxd::NyxdClient<ReqwestRpcClient>;

-#[allow(deprecated)]
 pub type DirectSigningReqwestRpcValidatorClient = Client<ReqwestRpcClient, DirectSecp256k1HdWallet>;
-#[allow(deprecated)]
 pub type DirectSigningReqwestRpcNyxdClient =
    nyxd::NyxdClient<ReqwestRpcClient, DirectSecp256k1HdWallet>;
@@ -178,7 +178,7 @@ where
            .ok_or_else(|| NyxdError::unavailable_contract_address("dkg contract"))?;

        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];

        self.execute(signer_address, dkg_contract_address, &msg, fee, memo, funds)
            .await
@@ -99,7 +99,7 @@ where
            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;

        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];

        self.execute(
            signer_address,
@@ -95,7 +95,7 @@ where

        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));

-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];
        self.execute(
            signer_address,
            group_contract_address,
@@ -667,7 +667,7 @@ where
        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
        let memo = msg.default_memo();

-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];
        self.execute(
            signer_address,
            mixnet_contract_address,
@@ -133,7 +133,7 @@ where

        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));

-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];
        self.execute(
            signer_address,
            multisig_contract_address,
@@ -165,7 +165,7 @@ where

        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));

-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];
        self.execute(
            signer_address,
            performance_contract_address,
@@ -375,7 +375,7 @@ where
        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
        let memo = msg.name().to_string();

-        let signer_address = &self.signer_addresses()[0];
+        let signer_address = &self.signer_addresses()?[0];
        self.execute(
            signer_address,
            vesting_contract_address,
@@ -324,7 +324,7 @@ where
 {
    type Error = S::Error;

-    fn get_accounts(&self) -> &[AccountData] {
+    fn get_accounts(&self) -> Result<Vec<AccountData>, Self::Error> {
        self.signer.get_accounts()
    }

@@ -19,7 +19,7 @@ use crate::signing::signer::NoSigner;
 use crate::signing::signer::OfflineSigner;
 use crate::signing::tx_signer::TxSigner;
 use crate::signing::AccountData;
-use crate::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient};
+use crate::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient, ReqwestRpcClient};
 use async_trait::async_trait;
 use cosmrs::tendermint::{abci, evidence::Evidence, Genesis};
 use cosmrs::tx::{Raw, SignDoc};
@@ -158,13 +158,12 @@ impl NyxdClient<HttpClient> {
    }
 }

-#[allow(deprecated)]
-impl NyxdClient<crate::ReqwestRpcClient> {
+impl NyxdClient<ReqwestRpcClient> {
    pub fn connect_reqwest(
        config: Config,
        endpoint: Url,
    ) -> Result<QueryReqwestRpcNyxdClient, NyxdError> {
-        let client = crate::ReqwestRpcClient::new(endpoint);
+        let client = ReqwestRpcClient::new(endpoint);

        Ok(NyxdClient {
            client: MaybeSigningClient::new(client, (&config).into()),
@@ -196,19 +195,18 @@ impl NyxdClient<HttpClient, DirectSecp256k1HdWallet> {
        let client = http_client(endpoint)?;

        let prefix = &config.chain_details.bech32_account_prefix;
-        let wallet = DirectSecp256k1HdWallet::checked_from_mnemonic(prefix, mnemonic)?;
+        let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);
        Ok(Self::connect_with_signer(config, client, wallet))
    }
 }

-#[allow(deprecated)]
-impl NyxdClient<crate::ReqwestRpcClient, DirectSecp256k1HdWallet> {
+impl NyxdClient<ReqwestRpcClient, DirectSecp256k1HdWallet> {
    pub fn connect_reqwest_with_mnemonic(
        config: Config,
        endpoint: Url,
        mnemonic: bip39::Mnemonic,
    ) -> DirectSigningReqwestRpcNyxdClient {
-        let client = crate::ReqwestRpcClient::new(endpoint);
+        let client = ReqwestRpcClient::new(endpoint);

        let prefix = &config.chain_details.bech32_account_prefix;
        let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);
@@ -393,12 +391,17 @@ where
    S: OfflineSigner + Send + Sync,
    NyxdError: From<<S as OfflineSigner>::Error>,
 {
-    pub fn signing_account(&self) -> Result<&AccountData, NyxdError> {
+    pub fn signing_account(&self) -> Result<AccountData, NyxdError> {
        Ok(self.find_account(&self.address())?)
    }

    pub fn address(&self) -> AccountId {
-        self.client.signer_addresses()[0].clone()
+        match self.client.signer_addresses() {
+            Ok(addresses) => addresses[0].clone(),
+            Err(_) => {
+                panic!("key derivation failure")
+            }
+        }
    }

    pub fn mix_coin(&self, amount: u128) -> Coin {
@@ -864,7 +867,7 @@ where
 {
    type Error = S::Error;

-    fn get_accounts(&self) -> &[AccountData] {
+    fn get_accounts(&self) -> Result<Vec<AccountData>, Self::Error> {
        self.client.get_accounts()
    }

@@ -42,15 +42,12 @@ macro_rules! perform_with_compat {
    }};
 }

-// the separate implementation is now completely redundant
-#[deprecated(note = "use HttpClient directly instead")]
 pub struct ReqwestRpcClient {
    compat: CompatMode,
    inner: reqwest::Client,
    url: Url,
 }

-#[allow(deprecated)]
 impl ReqwestRpcClient {
    pub fn new(url: Url) -> Self {
        ReqwestRpcClient {
@@ -134,7 +131,6 @@ impl TendermintRpcErrorMap for reqwest::Error {
    }
 }

-#[allow(deprecated)]
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl TendermintRpcClient for ReqwestRpcClient {
@@ -2,18 +2,18 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::signing::signer::{OfflineSigner, SigningError};
-use crate::signing::{
-    derive_extended_private_key, derive_keypair, AccountData, Secp256k1Derivation, Secp256k1Keypair,
-};
-use bip32::XPrv;
-use cosmrs::bip32::DerivationPath;
+use crate::signing::{AccountData, Secp256k1Derivation};
+use cosmrs::bip32::{DerivationPath, XPrv};
+use cosmrs::crypto::secp256k1::SigningKey;
+use cosmrs::crypto::PublicKey;
 use cosmrs::tx;
 use cosmrs::tx::SignDoc;
 use nym_config::defaults;
-use std::borrow::Cow;
 use thiserror::Error;
 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};

+type Secp256k1Keypair = (SigningKey, PublicKey);
+
 #[derive(Debug, Error)]
 pub enum DirectSecp256k1HdWalletError {
    #[error(transparent)]
@@ -36,22 +36,28 @@ pub enum DirectSecp256k1HdWalletError {
 }

 // TODO: maybe lock this one behind feature flag?
-#[derive(Zeroize, ZeroizeOnDrop)]
+#[derive(Debug, Clone, Zeroize, ZeroizeOnDrop)]
 pub struct DirectSecp256k1HdWallet {
    /// Base secret
    secret: bip39::Mnemonic,

-    /// Derived accounts
+    /// BIP39 seed
+    seed: [u8; 64],
+
+    // An unfortunate result of immature rust async story is that async traits (only available in the separate package)
+    // can't yet figure out everything and if we stored our derived account data on the struct,
+    // that would include the secret key which is a dyn EcdsaSigner and hence not Sync making the wallet
+    // not Sync and if used on the signing client in an async trait, it wouldn't be Send
+    /// Derivation instructions
    #[zeroize(skip)]
-    // unfortunately `dyn EcdsaSigner` does not guarantee Zeroize
-    accounts: Vec<AccountData>,
+    accounts: Vec<Secp256k1Derivation>,
 }

 impl OfflineSigner for DirectSecp256k1HdWallet {
    type Error = DirectSecp256k1HdWalletError;

-    fn get_accounts(&self) -> &[AccountData] {
-        &self.accounts
+    fn get_accounts(&self) -> Result<Vec<AccountData>, Self::Error> {
+        self.try_derive_accounts()
    }

    fn sign_direct_with_account(
@@ -71,27 +77,55 @@ impl DirectSecp256k1HdWallet {
    }

    /// Restores a wallet from the given BIP39 mnemonic using default options.
-    #[deprecated(
-        note = "this function can potentially panic if accounts can't be derived correctly. please use .checked_from_mnemonic() instead"
-    )]
    pub fn from_mnemonic(prefix: &str, mnemonic: bip39::Mnemonic) -> Self {
-        // unfortunately due to backwards compatibility requirements,
-        // we can't change signature of this method
-        #[allow(deprecated)]
        DirectSecp256k1HdWalletBuilder::new(prefix).build(mnemonic)
    }

-    /// Restores a wallet from the given BIP39 mnemonic using default options.
-    pub fn checked_from_mnemonic(
-        prefix: &str,
-        mnemonic: bip39::Mnemonic,
-    ) -> Result<Self, DirectSecp256k1HdWalletError> {
-        DirectSecp256k1HdWalletBuilder::new(prefix).try_build(mnemonic)
-    }
-
    pub fn generate(prefix: &str, word_count: usize) -> Result<Self, DirectSecp256k1HdWalletError> {
        let mneomonic = bip39::Mnemonic::generate(word_count)?;
-        Self::checked_from_mnemonic(prefix, mneomonic)
+        Ok(Self::from_mnemonic(prefix, mneomonic))
+    }
+
+    fn derive_keypair(
+        &self,
+        hd_path: &DerivationPath,
+    ) -> Result<Secp256k1Keypair, DirectSecp256k1HdWalletError> {
+        let extended_private_key = XPrv::derive_from_path(self.seed, hd_path)?;
+
+        let private_key: SigningKey = extended_private_key.into();
+        let public_key = private_key.public_key();
+
+        Ok((private_key, public_key))
+    }
+
+    pub fn derive_extended_private_key(
+        &self,
+        hd_path: &DerivationPath,
+    ) -> Result<XPrv, DirectSecp256k1HdWalletError> {
+        Ok(XPrv::derive_from_path(self.seed, hd_path)?)
+    }
+
+    pub fn try_derive_accounts(&self) -> Result<Vec<AccountData>, DirectSecp256k1HdWalletError> {
+        let mut accounts = Vec::with_capacity(self.accounts.len());
+        for derivation_info in &self.accounts {
+            let keypair = self.derive_keypair(&derivation_info.hd_path)?;
+
+            // it seems this can only fail if the provided account prefix is invalid
+            let address = keypair
+                .1
+                .account_id(&derivation_info.prefix)
+                .map_err(
+                    |source| DirectSecp256k1HdWalletError::AccountDerivationError { source },
+                )?;
+
+            accounts.push(AccountData {
+                address,
+                public_key: keypair.1,
+                private_key: keypair.0,
+            })
+        }
+
+        Ok(accounts)
    }

    pub fn secret(&self) -> &bip39::Mnemonic {
@@ -108,43 +142,6 @@ impl DirectSecp256k1HdWallet {
    pub fn mnemonic_string(&self) -> Zeroizing<String> {
        Zeroizing::new(self.secret.to_string())
    }
-
-    pub fn account_seed<'a, P: Into<Cow<'a, str>>>(
-        &self,
-        bip39_password: P,
-    ) -> Zeroizing<[u8; 64]> {
-        Zeroizing::new(self.secret.to_seed(bip39_password))
-    }
-
-    /// Derive an extended private key from the stored account secret assuming no bip39 password
-    #[deprecated(
-        note = "use derive_extended_private_key_with_password to ensure correct derivation if used bip39 password"
-    )]
-    pub fn derive_extended_private_key(
-        &self,
-        hd_path: &DerivationPath,
-    ) -> Result<XPrv, DirectSecp256k1HdWalletError> {
-        let seed = self.account_seed("");
-        derive_extended_private_key(seed, hd_path)
-    }
-
-    pub fn derive_keypair<'a, P: Into<Cow<'a, str>>>(
-        &self,
-        hd_path: &DerivationPath,
-        bip39_password: P,
-    ) -> Result<Secp256k1Keypair, DirectSecp256k1HdWalletError> {
-        let seed = self.account_seed(bip39_password);
-        derive_keypair(seed, hd_path)
-    }
-
-    pub fn derive_extended_private_key_with_password<'a, P: Into<Cow<'a, str>>>(
-        &self,
-        hd_path: &DerivationPath,
-        bip39_password: P,
-    ) -> Result<XPrv, DirectSecp256k1HdWalletError> {
-        let seed = self.account_seed(bip39_password);
-        derive_extended_private_key(seed, hd_path)
-    }
 }

 #[must_use]
@@ -191,39 +188,23 @@ impl DirectSecp256k1HdWalletBuilder {
        self
    }

-    #[deprecated(
-        note = "this function can potentially panic if accounts can't be derived correctly. please use .try_build() instead"
-    )]
    pub fn build(self, mnemonic: bip39::Mnemonic) -> DirectSecp256k1HdWallet {
-        // unfortunately due to backwards compatibility requirements,
-        // we can't change signature of this method
-        #[allow(clippy::expect_used)]
-        self.try_build(mnemonic)
-            .expect("account derivation failure")
-    }
-
-    pub fn try_build(
-        self,
-        mnemonic: bip39::Mnemonic,
-    ) -> Result<DirectSecp256k1HdWallet, DirectSecp256k1HdWalletError> {
-        let seed = Zeroizing::new(mnemonic.to_seed(&self.bip39_password));
+        let seed = mnemonic.to_seed(&self.bip39_password);
        let prefix = self.prefix.clone();
        let accounts = self
            .hd_paths
            .iter()
-            .map(|hd_path| {
-                Secp256k1Derivation {
-                    hd_path: hd_path.clone(),
-                    prefix: prefix.clone(),
-                }
-                .try_derive_account(&seed)
+            .map(|hd_path| Secp256k1Derivation {
+                hd_path: hd_path.clone(),
+                prefix: prefix.clone(),
            })
-            .collect::<Result<_, _>>()?;
+            .collect();

-        Ok(DirectSecp256k1HdWallet {
+        DirectSecp256k1HdWallet {
            accounts,
+            seed,
            secret: mnemonic,
-        })
+        }
    }
 }

@@ -234,7 +215,7 @@ mod tests {
    use super::*;

    #[test]
-    fn generating_account_addresses() -> anyhow::Result<()> {
+    fn generating_account_addresses() {
        // test vectors produced from our js wallet
        let mnemonics = ["crush minute paddle tobacco message debate cabin peace bar jacket execute twenty winner view sure mask popular couch penalty fragile demise fresh pizza stove",
            "acquire rebel spot skin gun such erupt pull swear must define ill chief turtle today flower chunk truth battle claw rigid detail gym feel",
@@ -249,10 +230,11 @@ mod tests {
            "n17n9flp6jflljg6fp05dsy07wcprf2uuu8g40rf",
        ];
        for (idx, mnemonic) in mnemonics.iter().enumerate() {
-            let wallet =
-                DirectSecp256k1HdWallet::checked_from_mnemonic(&prefix, mnemonic.parse()?)?;
-            assert_eq!(wallet.signer_addresses()[0], addrs[idx].parse().unwrap());
+            let wallet = DirectSecp256k1HdWallet::from_mnemonic(&prefix, mnemonic.parse().unwrap());
+            assert_eq!(
+                wallet.try_derive_accounts().unwrap()[0].address,
+                addrs[idx].parse().unwrap()
+            )
        }
-        Ok(())
    }
 }
@@ -1,8 +1,6 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::signing::direct_wallet::DirectSecp256k1HdWalletError;
-use bip32::XPrv;
 use cosmrs::bip32::DerivationPath;
 use cosmrs::crypto::secp256k1::SigningKey;
 use cosmrs::crypto::PublicKey;
@@ -14,64 +12,14 @@ pub mod direct_wallet;
 pub mod signer;
 pub mod tx_signer;

-pub(crate) type Secp256k1Keypair = (SigningKey, PublicKey);
-
 /// Derivation information required to derive a keypair and an address from a mnemonic.
 #[derive(Debug, Clone)]
-pub(crate) struct Secp256k1Derivation {
+struct Secp256k1Derivation {
    hd_path: DerivationPath,
    prefix: String,
 }

-impl Secp256k1Derivation {
-    pub(crate) fn try_derive_account<S>(
-        &self,
-        seed: S,
-    ) -> Result<AccountData, DirectSecp256k1HdWalletError>
-    where
-        S: AsRef<[u8]>,
-    {
-        let keypair = derive_keypair(seed, &self.hd_path)?;
-
-        // it seems this can only fail if the provided account prefix is invalid
-        let address = keypair
-            .1
-            .account_id(&self.prefix)
-            .map_err(|source| DirectSecp256k1HdWalletError::AccountDerivationError { source })?;
-
-        Ok(AccountData {
-            address,
-            public_key: keypair.1,
-            private_key: keypair.0,
-        })
-    }
-}
-
-pub fn derive_keypair<S>(
-    seed: S,
-    hd_path: &DerivationPath,
-) -> Result<Secp256k1Keypair, DirectSecp256k1HdWalletError>
-where
-    S: AsRef<[u8]>,
-{
-    let extended_private_key = derive_extended_private_key(seed, hd_path)?;
-
-    let private_key: SigningKey = extended_private_key.into();
-    let public_key = private_key.public_key();
-
-    Ok((private_key, public_key))
-}
-
-pub fn derive_extended_private_key<S>(
-    seed: S,
-    hd_path: &DerivationPath,
-) -> Result<XPrv, DirectSecp256k1HdWalletError>
-where
-    S: AsRef<[u8]>,
-{
-    Ok(XPrv::derive_from_path(seed, hd_path)?)
-}
-
+// TODO: is this struct going to be derivable with other signer types?
 pub struct AccountData {
    pub address: AccountId,

@@ -33,18 +33,23 @@ pub enum SignerType {
 pub trait OfflineSigner {
    type Error: From<SigningError>;

-    fn signer_addresses(&self) -> Vec<AccountId> {
-        self.get_accounts()
-            .iter()
-            .map(|account| account.address.clone())
-            .collect()
+    // I really dislike existence of this function because it makes you re-derive your key **twice** for each contract transaction
+    fn signer_addresses(&self) -> Result<Vec<AccountId>, Self::Error> {
+        let derived_addresses = self
+            .get_accounts()?
+            .into_iter()
+            .map(|account| account.address)
+            .collect();
+        Ok(derived_addresses)
    }

-    fn get_accounts(&self) -> &[AccountData];
+    fn get_accounts(&self) -> Result<Vec<AccountData>, Self::Error>;

-    fn find_account(&self, signer_address: &AccountId) -> Result<&AccountData, Self::Error> {
-        self.get_accounts()
-            .iter()
+    fn find_account(&self, signer_address: &AccountId) -> Result<AccountData, Self::Error> {
+        // TODO: we could really use some zeroize action here
+        let accounts = self.get_accounts()?;
+        accounts
+            .into_iter()
            .find(|account| &account.address == signer_address)
            .ok_or_else(|| {
                SigningError::AccountNotFound {
@@ -71,7 +76,7 @@ pub trait OfflineSigner {
        message: M,
    ) -> Result<Signature, Self::Error> {
        let signer = self.find_account(signer_address)?;
-        self.sign_raw_with_account(signer, message)
+        self.sign_raw_with_account(&signer, message)
    }

    fn sign_direct(
@@ -80,7 +85,7 @@ pub trait OfflineSigner {
        sign_doc: SignDoc,
    ) -> Result<tx::Raw, Self::Error> {
        let signer = self.find_account(signer_address)?;
-        self.sign_direct_with_account(signer, sign_doc)
+        self.sign_direct_with_account(&signer, sign_doc)
    }

    // unless explicitly defined, each signing method is unsupported
@@ -117,7 +122,7 @@ pub struct NoSigner;
 // impl OfflineSigner for NoSigner {
 //     type Error = SignerUnavailable;
 //
-//     fn get_accounts(&self) -> &[AccountData] {
+//     fn get_accounts(&self) -> Result<Vec<AccountData>, Self::Error> {
 //         return Err(SignerUnavailable);
 //     }
 // }
@@ -50,7 +50,7 @@ pub trait TxSigner: OfflineSigner {
        )
        .map_err(|source| SigningError::SignDocFailure { source })?;

-        self.sign_direct_with_account(account_from_signer, sign_doc)
+        self.sign_direct_with_account(&account_from_signer, sign_doc)
    }
 }

@@ -3,7 +3,6 @@

 use clap::Parser;
 use nym_validator_client::signing::direct_wallet::DirectSecp256k1HdWallet;
-use nym_validator_client::signing::signer::OfflineSigner;

 #[derive(Debug, Parser)]
 pub struct Args {
@@ -16,10 +15,9 @@ pub fn create_account(args: Args, prefix: &str) {
    let word_count = args.word_count.unwrap_or(24);
    let mnemonic = bip39::Mnemonic::generate(word_count).expect("failed to generate mnemonic!");

-    let wallet = DirectSecp256k1HdWallet::checked_from_mnemonic(prefix, mnemonic)
-        .expect("failed to derive accounts!");
+    let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);

    // Output address and mnemonics into separate lines for easier parsing
    println!("{}", wallet.mnemonic_string().as_str());
-    println!("{}", wallet.signer_addresses()[0]);
+    println!("{}", wallet.try_derive_accounts().unwrap()[0].address());
 }
@@ -1,13 +1,13 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::context::QueryClient;
-use crate::utils::show_error;
 use clap::Parser;
 use log::{error, info};
 use nym_validator_client::nyxd::{AccountId, CosmWasmClient};
 use nym_validator_client::signing::direct_wallet::DirectSecp256k1HdWallet;
-use nym_validator_client::signing::signer::OfflineSigner;
+
+use crate::context::QueryClient;
+use crate::utils::show_error;

 #[derive(Debug, Parser)]
 pub struct Args {
@@ -50,19 +50,20 @@ pub async fn get_pubkey(
 }

 pub fn get_pubkey_from_mnemonic(address: AccountId, prefix: &str, mnemonic: bip39::Mnemonic) {
-    let wallet = match DirectSecp256k1HdWallet::checked_from_mnemonic(prefix, mnemonic) {
-        Ok(wallet) => wallet,
-        Err(err) => {
-            error!("Failed to derive accounts. {err}");
-            return;
+    let wallet = DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic);
+    match wallet.try_derive_accounts() {
+        Ok(accounts) => match accounts.iter().find(|a| *a.address() == address) {
+            Some(account) => {
+                println!("{}", account.public_key().to_string());
+            }
+            None => {
+                error!("Could not derive key that matches {address}")
+            }
+        },
+        Err(e) => {
+            error!("Failed to derive accounts. {e}");
        }
-    };
-
-    let Ok(account) = wallet.find_account(&address) else {
-        error!("Could not derive key that matches {address}");
-        return;
-    };
-    println!("{}", account.public_key().to_string());
+    }
 }

 pub async fn get_pubkey_from_chain(address: AccountId, client: &QueryClient) {
@@ -36,35 +36,32 @@ pub fn sign(args: Args, prefix: &str, mnemonic: Option<bip39::Mnemonic>) {
        return;
    }

-    let wallet = match DirectSecp256k1HdWallet::checked_from_mnemonic(
-        prefix,
-        mnemonic.expect("mnemonic not set"),
-    ) {
-        Ok(wallet) => wallet,
-        Err(err) => {
-            error!("Could not derive an account key from the mnemonic: {err}");
-            return;
-        }
-    };
-    match wallet.get_accounts().first() {
-        Some(account) => {
-            let msg = args.message.into_bytes();
-            match wallet.sign_raw_with_account(account, msg) {
-                Ok(signature) => {
-                    let output = SignatureOutputJson {
-                        account_id: account.address().to_string(),
-                        public_key: account.public_key(),
-                        signature_as_hex: signature.to_string(),
-                    };
-                    println!("{}", json!(output));
-                }
-                Err(e) => {
-                    error!("Failed to sign message. {e}");
+    let wallet =
+        DirectSecp256k1HdWallet::from_mnemonic(prefix, mnemonic.expect("mnemonic not set"));
+    match wallet.try_derive_accounts() {
+        Ok(accounts) => match accounts.first() {
+            Some(account) => {
+                let msg = args.message.into_bytes();
+                match wallet.sign_raw_with_account(account, msg) {
+                    Ok(signature) => {
+                        let output = SignatureOutputJson {
+                            account_id: account.address().to_string(),
+                            public_key: account.public_key(),
+                            signature_as_hex: signature.to_string(),
+                        };
+                        println!("{}", json!(output));
+                    }
+                    Err(e) => {
+                        error!("Failed to sign message. {e}");
+                    }
                }
            }
-        }
-        None => {
-            error!("Could not derive an account key from the mnemonic",)
+            None => {
+                error!("Could not derive an account key from the mnemonic",)
+            }
+        },
+        Err(e) => {
+            error!("Failed to derive accounts. {e}");
        }
    }
 }
@@ -241,28 +241,23 @@ impl Epoch {
 //
 // Note: It's important that the variant ordering is not changed otherwise it would mess up the derived `PartialOrd`
 #[cw_serde]
-#[derive(Copy, Default)]
+#[derive(Copy)]
 pub enum EpochState {
-    #[default]
    WaitingInitialisation,
-    PublicKeySubmission {
-        resharing: bool,
-    },
-    DealingExchange {
-        resharing: bool,
-    },
-    VerificationKeySubmission {
-        resharing: bool,
-    },
-    VerificationKeyValidation {
-        resharing: bool,
-    },
-    VerificationKeyFinalization {
-        resharing: bool,
-    },
+    PublicKeySubmission { resharing: bool },
+    DealingExchange { resharing: bool },
+    VerificationKeySubmission { resharing: bool },
+    VerificationKeyValidation { resharing: bool },
+    VerificationKeyFinalization { resharing: bool },
    InProgress,
 }

+impl Default for EpochState {
+    fn default() -> Self {
+        Self::WaitingInitialisation
+    }
+}
+
 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
@@ -8,7 +8,7 @@ async fn main() -> anyhow::Result<()> {
    use sqlx::{Connection, SqliteConnection};
    use std::env;

-    let out_dir = env::var("OUT_DIR").context("missing OUT_DIR env variable")?;
+    let out_dir = env::var("OUT_DIR")?;
    let database_path = format!("{out_dir}/nym-credential-proxy-example.sqlite");

    // remove the db file if it already existed from previous build
@@ -127,13 +127,6 @@ pub enum CredentialProxyError {
    #[error("failed to create deposit")]
    DepositFailure,

-    #[error("failed to load jwt signing key from {path}: {err}")]
-    JWTSigningKeyLoadFailure {
-        path: String,
-        #[source]
-        err: std::io::Error,
-    },
-
    #[error("can't obtain sufficient number of credential shares due to unavailable quorum")]
    UnavailableSigningQuorum,

@@ -168,14 +161,6 @@ pub enum CredentialProxyError {
        device_id: String,
        credential_id: String,
    },
-
-    #[error(
-        "the attestation check url has not been provided through either the CLI nor the default .env config"
-    )]
-    AttestationCheckUrlNotSet,
-
-    #[error("the provided attestation check url is malformed: {source}")]
-    MalformedAttestationCheckUrl { source: url::ParseError },
 }

 impl From<NymAPIError> for CredentialProxyError {
@@ -7,9 +7,9 @@ use crate::ticketbook_manager::TicketbookManager;
 use nym_compact_ecash::Base58;
 use nym_credential_proxy_requests::api::v1::ticketbook::models::{
    CurrentEpochResponse, DepositResponse, GlobalDataParams, MasterVerificationKeyResponse,
-    ObtainTicketBookSharesAsyncResponse, PartialVerificationKey, PartialVerificationKeysResponse,
-    TicketbookAsyncRequest, TicketbookObtainParams, TicketbookRequest,
-    TicketbookWalletSharesAsyncResponse, TicketbookWalletSharesResponse,
+    PartialVerificationKey, PartialVerificationKeysResponse, TicketbookAsyncRequest,
+    TicketbookObtainParams, TicketbookRequest, TicketbookWalletSharesAsyncResponse,
+    TicketbookWalletSharesResponse,
 };
 use time::OffsetDateTime;
 use tracing::{Instrument, Level, error, info, span, warn};
@@ -65,7 +65,7 @@ impl TicketbookManager {
        uuid: Uuid,
        request: TicketbookAsyncRequest,
        params: TicketbookObtainParams,
-    ) -> Result<ObtainTicketBookSharesAsyncResponse, CredentialProxyError> {
+    ) -> Result<TicketbookWalletSharesAsyncResponse, CredentialProxyError> {
        let requested_on = OffsetDateTime::now_utc();
        let span = span!(Level::INFO, "[async] obtain ticketboook", uuid = %uuid);
        async move {
@@ -110,7 +110,7 @@ impl TicketbookManager {
            }

            // 4. in the meantime, return the id to the user
-            Ok(TicketbookWalletSharesAsyncResponse { id, uuid }.into())
+            Ok(TicketbookWalletSharesAsyncResponse { id, uuid })
        }
        .instrument(span)
        .await
@@ -39,11 +39,8 @@ impl SqliteEcashTicketbookManager {
        Ok(())
    }

-    /// Starts a write (IMMEDIATE) transaction, to prevent issue when upgrading from a read one to a write one
-    pub(crate) async fn begin_storage_write_tx(
-        &self,
-    ) -> Result<Transaction<'_, Sqlite>, sqlx::Error> {
-        self.connection_pool.begin_with("BEGIN IMMEDIATE").await
+    pub(crate) async fn begin_storage_tx(&self) -> Result<Transaction<'_, Sqlite>, sqlx::Error> {
+        self.connection_pool.begin().await
    }

    pub(crate) async fn insert_pending_ticketbook(
@@ -246,7 +246,7 @@ mod tests {
        let _exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[signing_keys.secret_key()],
-            &[signing_keys.verification_key()],
+            &vec![signing_keys.verification_key()],
            &signing_keys.verification_key(),
            &[1],
        )?;
@@ -263,7 +263,7 @@ mod tests {

        let wallet = issuance.aggregate_signature_shares(
            &signing_keys.verification_key(),
-            &[partial_wallet],
+            &vec![partial_wallet],
            sig_req,
        )?;

@@ -243,7 +243,7 @@ impl Storage for PersistentStorage {
        tickets: u32,
    ) -> Result<Option<RetrievedTicketbook>, Self::StorageError> {
        let deadline = ecash_today().ecash_date();
-        let mut tx = self.storage_manager.begin_storage_write_tx().await?;
+        let mut tx = self.storage_manager.begin_storage_tx().await?;

        // we don't want ticketbooks with expiration in the past
        let Some(raw) =
@@ -36,11 +36,7 @@ nym-sphinx-types = { path = "../nymsphinx/types", version = "0.2.0", default-fea
 nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }

 [dev-dependencies]
-anyhow = { workspace = true }
 rand_chacha = { workspace = true }
-serde_json = { workspace = true }
-nym-test-utils = { path = "../test-utils" }
-

 [features]
 default = []
@@ -17,51 +17,6 @@ pub mod bs58_ed25519_pubkey {
    }
 }

-pub mod vec_bs58_ed25519_pubkey {
-    use super::*;
-    use serde::{Deserialize, Deserializer, Serializer, ser::SerializeSeq};
-
-    pub fn serialize<S: Serializer>(
-        keys: &Vec<PublicKey>,
-        serializer: S,
-    ) -> Result<S::Ok, S::Error> {
-        let mut seq = serializer.serialize_seq(Some(keys.len()))?;
-        for key in keys {
-            seq.serialize_element(&Bs58KeyWrapper(*key))?;
-        }
-        seq.end()
-    }
-
-    pub fn deserialize<'de, D: Deserializer<'de>>(
-        deserializer: D,
-    ) -> Result<Vec<PublicKey>, D::Error> {
-        let wrapped = Vec::<Bs58KeyWrapper>::deserialize(deserializer)?;
-        Ok(wrapped.into_iter().map(|k| k.0).collect())
-    }
-
-    struct Bs58KeyWrapper(PublicKey);
-
-    impl serde::Serialize for Bs58KeyWrapper {
-        fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-        where
-            S: Serializer,
-        {
-            bs58_ed25519_pubkey::serialize(&self.0, serializer)
-        }
-    }
-
-    impl<'de> Deserialize<'de> for Bs58KeyWrapper {
-        fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-        where
-            D: Deserializer<'de>,
-        {
-            Ok(Bs58KeyWrapper(bs58_ed25519_pubkey::deserialize(
-                deserializer,
-            )?))
-        }
-    }
-}
-
 pub mod bs58_ed25519_signature {
    use crate::asymmetric::ed25519::Signature;
    use serde::{Deserialize, Deserializer, Serializer};
@@ -78,53 +33,3 @@ pub mod bs58_ed25519_signature {
        Signature::from_base58_string(s).map_err(serde::de::Error::custom)
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use jwt_simple::reexports::{anyhow, serde_json};
-    use nym_test_utils::helpers::deterministic_rng;
-    use serde::{Deserialize, Serialize};
-
-    #[test]
-    fn vec_bs58_ed25519_pubkey_json() -> anyhow::Result<()> {
-        #[derive(Serialize, Deserialize, Debug, PartialEq)]
-        struct KeysWrapper(#[serde(with = "vec_bs58_ed25519_pubkey")] Vec<PublicKey>);
-
-        use crate::asymmetric::ed25519;
-        let mut rng = deterministic_rng();
-        let empty = KeysWrapper(vec![]);
-        let single_key = KeysWrapper(vec![PublicKey::from_base58_string(
-            "Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt",
-        )?]);
-        let three_keys = KeysWrapper(vec![
-            ed25519::KeyPair::new(&mut rng).public_key,
-            ed25519::KeyPair::new(&mut rng).public_key,
-            ed25519::KeyPair::new(&mut rng).public_key,
-        ]);
-
-        let se_empty = serde_json::to_string(&empty)?;
-        let se_single_key = serde_json::to_string(&single_key)?;
-        let se_three_keys = serde_json::to_string(&three_keys)?;
-
-        assert_eq!(se_empty, r#"[]"#);
-        assert_eq!(
-            se_single_key,
-            r#"["Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt"]"#
-        );
-        assert_eq!(
-            se_three_keys,
-            r#"["HmgHDV79LpnEaSUp8QZQwSroxVvS4RewF7yM9e7qu8y3","311xRh859qCd5MVqoPRCoNx26eYhLknGwtjzkkTJFGhf","A5BMp8WJ6Uk91U4JpWRv2Bc6X35AaRaSEy8QEWeAkaBv"]"#
-        );
-
-        let empty_de = serde_json::from_str::<KeysWrapper>(&se_empty)?;
-        let single_key_de = serde_json::from_str::<KeysWrapper>(&se_single_key)?;
-        let three_keys_de = serde_json::from_str::<KeysWrapper>(&se_three_keys)?;
-
-        assert_eq!(empty, empty_de);
-        assert_eq!(single_key, single_key_de);
-        assert_eq!(three_keys, three_keys_de);
-
-        Ok(())
-    }
-}
@@ -0,0 +1,73 @@
+// Copyright 2020-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::shared_key::{SharedGatewayKey, SharedKeyUsageError};
+use nym_sphinx::DestinationAddressBytes;
+use thiserror::Error;
+
+/// Replacement for what used to be an `AuthToken`.
+///
+/// Replacement for what used to be an `AuthToken`. We used to be generating an `AuthToken` based on
+/// local secret and remote address in order to allow for authentication. Due to changes in registration
+/// and the fact we are deriving a shared key, we are encrypting remote's address with the previously
+/// derived shared key. If the value is as expected, then authentication is successful.
+#[derive(Debug, PartialEq, Eq, Hash, Clone)]
+// this is no longer constant size due to the differences in ciphertext between aes128ctr and aes256gcm-siv (inclusion of tag)
+pub struct EncryptedAddressBytes(Vec<u8>);
+
+impl From<Vec<u8>> for EncryptedAddressBytes {
+    fn from(encrypted_address: Vec<u8>) -> Self {
+        EncryptedAddressBytes(encrypted_address)
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum EncryptedAddressConversionError {
+    #[error("Failed to decode the encrypted address - {0}")]
+    DecodeError(#[from] bs58::decode::Error),
+}
+
+impl EncryptedAddressBytes {
+    pub fn new(
+        address: &DestinationAddressBytes,
+        key: &SharedGatewayKey,
+        nonce: &[u8],
+    ) -> Result<Self, SharedKeyUsageError> {
+        let ciphertext = key.encrypt_naive(address.as_bytes_ref(), Some(nonce))?;
+
+        Ok(EncryptedAddressBytes(ciphertext))
+    }
+
+    pub fn verify(
+        &self,
+        address: &DestinationAddressBytes,
+        key: &SharedGatewayKey,
+        nonce: &[u8],
+    ) -> bool {
+        let Ok(reconstructed) = Self::new(address, key, nonce) else {
+            return false;
+        };
+        self == &reconstructed
+    }
+
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.0
+    }
+
+    pub fn try_from_base58_string<S: Into<String>>(
+        val: S,
+    ) -> Result<Self, EncryptedAddressConversionError> {
+        let decoded = bs58::decode(val.into()).into_vec()?;
+        Ok(EncryptedAddressBytes(decoded))
+    }
+
+    pub fn to_base58_string(self) -> String {
+        bs58::encode(self.0).into_string()
+    }
+}
+
+impl From<EncryptedAddressBytes> for String {
+    fn from(val: EncryptedAddressBytes) -> Self {
+        val.to_base58_string()
+    }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
import this	340960d957	[DOCs/operators]: Release notes for v2025.19 kase (#6157 ) * add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix	2025-10-31 09:02:13 +00:00
Mark Sinclair	554e446208	change migration and bump version	2025-10-31 09:02:13 +00:00
Mark Sinclair	a6325b922a	bump version to rc	2025-10-31 09:02:13 +00:00
Mark Sinclair	fae4768b99	add tracing output	2025-10-31 09:02:13 +00:00
Mark Sinclair	2689a4dbd8	clippy	2025-10-31 09:02:13 +00:00
Mark Sinclair	02e40ccaef	save custom_http_port to db	2025-10-31 09:02:13 +00:00
Mark Sinclair	b216338364	allow NS API to run once for scraping for troubleshooting and debugging	2025-10-31 09:02:13 +00:00
Mark Sinclair	4a83bb9ba8	wip	2025-10-31 09:02:13 +00:00
Mark Sinclair	66ec3b037f	ns-api: fix scraping bug when operator specifies custom node HTTP API port in bond	2025-10-31 09:02:13 +00:00
import this	168baa5071	[Feature/operators]: QUIC bridge deployment script v2 (#6145 ) * new quick deployment script * docs tweak * update script to use .deb postinst * final clean - ready to go * correct nym-node config dir search with a fallback	2025-10-31 09:02:13 +00:00
Simon Wicky	7aef468839	remove unused deps (#6151 )	2025-10-31 09:02:12 +00:00
Simon Wicky	cb3ccd7f7e	use typed builder (#6150 )	2025-10-31 09:02:12 +00:00
Simon Wicky	16509dbace	allow overwriting existing sdk shutdown manager	2025-10-31 09:02:12 +00:00
Simon Wicky	b907ccbd5b	typo	2025-10-31 09:02:12 +00:00
Simon Wicky	7b3194d7d2	calling for shutdown from the MixTrafficController	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	0b81edfc66	using same hierarchy of trackers for client shutdown control	2025-10-31 09:02:12 +00:00
Tommy Verrall	8c6150e5ef	Internal comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	46164a389a	Fix comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	96d256b48f	Better message to come in the PR description	2025-10-31 09:02:12 +00:00
Simon Wicky	f98b93f60e	tommy is too quick	2025-10-31 09:02:12 +00:00
Simon Wicky	0f6c356f39	configurable mixnet client startup timeout	2025-10-31 09:02:12 +00:00
p17o	cf3f5d9a53	Update quic_bridge_deployment.sh for IPv4 and .deb package (#6138 ) Updated ping commands to explicitly use IPv4 and adjusted file permission checks with sudo. Changed the forward address prompt to specify IPv4 and modified the binary download process to fetch and install the latest .deb release URL automatically.	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	2f47e6349a	bugfix: update internal owner address in transferred share (#6139 )	2025-10-31 09:02:12 +00:00
Tommy Verrall	4b2b5390d3	Last failing test - fix	2025-10-31 09:02:12 +00:00
Tommy Verrall	734ff63f6d	Use explicit Vec<ApiUrl> handling in BaseClientBuilder - Replace NymNetworkDetails with explicit API URL handling - Fix deprecated from_network() usage and improve fallback logic - Add URL validation and remove unused backwards compatibility	2025-10-31 09:02:11 +00:00
Tommy Verrall	910c24e7da	Actually commit the recommended changes	2025-10-31 09:02:11 +00:00
Tommy Verrall	c96b73172a	Fix broken tests in CI	2025-10-31 09:02:11 +00:00
Tommy Verrall	823c2c7262	Replace deprecated from_network() with new_with_fronted_urls()	2025-10-31 09:02:11 +00:00
Jędrzej Stuczyński	03d1b72a9e	feat: expose more explicit new_with_fronted_urls builder for http API client (#6136 )	2025-10-31 09:02:10 +00:00
Jędrzej Stuczyński	066669440f	bugfix: update stored epoch share when changing ownership (#6135 )	2025-10-31 09:01:27 +00:00
Jędrzej Stuczyński	9fb3443fd1	bugfix: update stored epoch share when changing announce address (#6131 ) * bugfix: update stored epoch share when changing announce address * chore: remove placeholder legacy mixnode bonding test [mixnet contract]	2025-10-31 09:01:27 +00:00
Tommy Verrall	cd89a590b5	Fix new_from_env() to populate nym_api_urls for domain fronting	2025-10-31 09:01:27 +00:00
Tommy Verrall	06cb8bd969	fix all clippy messages	2025-10-31 09:01:27 +00:00
Tommy Verrall	c72fef169c	Add more tests for retry logic	2025-10-31 09:01:27 +00:00
Tommy Verrall	3c27eb41b8	Fix confusing tracing logs	2025-10-31 09:01:27 +00:00
Tommy Verrall	2428374fe7	Fix retries - this is working	2025-10-31 09:01:27 +00:00
Tommy Verrall	5a491f0a7e	Add configuration-based domain fronting support Changes: - Add network_details field to BaseClientBuilder (optional, backwards compatible) - Add with_network_details() method for opt-in domain fronting - Update construct_nym_api_client() to use from_network() when network_details provided - Enable network-defaults feature in nym-client-core Cargo.toml - SDK passes network_details to BaseClientBuilder	2025-10-31 09:01:27 +00:00
Tommy Verrall	530f9ccb6f	Fix CI issues	2025-10-31 09:01:26 +00:00
Tommy Verrall	2228a81d43	Allow clippy::enum_variant_names for BuilderConfigError	2025-10-31 09:01:26 +00:00
Tommy Verrall	c8a1b53071	Improve error handling Changes: - Replace String error with BuilderConfigError enum in BuilderConfigBuilder - Update tests to use pattern matching instead of string assertions	2025-10-31 09:01:26 +00:00
Tommy Verrall	b896aaaed1	- Add DEFAULT_NYM_API_RETRIES constant (replaces magic number 3) - Run cargo fmt on all affected packages - All clippy warnings resolved	2025-10-31 09:01:26 +00:00
Tommy Verrall	828ffc6710	not sure what happened but it's fixed	2025-10-31 09:01:26 +00:00
Andy Duplain	05cdb27029	VPN-4262: Update `Url` to return `url` and `front` fields. The VPN client is using the `Url` type alot now and in order to avoid double URL-parsing we would like the content of the `Url` type exposed.	2025-10-31 09:01:26 +00:00
Tommy Verrall	3f29d3eba5	Add accessor methods for Url internals Add inner_url() and fronts() accessor methods to nym_http_api_client::Url for VPN client integration	2025-10-31 09:01:22 +00:00
Tommy Verrall	aa2c41dc41	Merge resolution	2025-10-31 09:01:02 +00:00
Tommy Verrall	048de771ab	Remove tests for removed with_nym_api_client method These tests were referencing with_nym_api_client() which was removed when cleaning domain fronting code from this branch	2025-10-31 09:01:02 +00:00
Tommy Verrall	e1b06f02f3	Add optional builder pattern for BuilderConfig (non-breaking) Addresses @jstuczyn's feedback about too many arguments by adding BuilderConfigBuilder as an alternative to the existing new() method.	2025-10-31 09:01:02 +00:00
Tommy Verrall	b5b8b8f224	fix conversion type && make the retry count configurable	2025-10-31 09:01:02 +00:00
Tommy Verrall	2d7141dfb1	Revert node filtering changes per Andrew's feedback Andrew clarified that get_basic_entry_assigned_nodes_v2() already filters by supported_roles.entry	2025-10-31 09:01:02 +00:00
Tommy Verrall	a07522258f	Remove domain fronting code to keep gateway changes only This branch now contains only gateway registration improvements: - Multiple URL fallback support in gateways_for_init() - Get all entry-capable nodes for registration - Performance and code quality improvements	2025-10-31 09:00:17 +00:00
Tommy Verrall	547a441002	Address PR feedback: simplify code and reduce log noise - Reverted all changes to topology_control/nym_api_provider.rs - Changed info/warn logs to debug for custom client messages - Removed unused _rng parameter from gateways_for_init() - Simplified URL builder to always use new_with_urls()	2025-10-31 09:00:17 +00:00
Tommy Verrall	93208fb5e0	Fix clippy warnings: use arrays instead of vec! in tests	2025-10-31 09:00:17 +00:00
Bogdan-Ștefan Neacşu	c9b50dd979	Introduce event backchannel (#6119 ) * Introduce even backchannel * Rust fmt * Rename Event to MixnetClientEvent * Use unbounded_send for events * Remove unused file * Remove mut borrow * Event hierarchy and mixnet client intermediary * Export MixTrafficEvent in sdk	2025-10-31 09:00:15 +00:00
Jędrzej Stuczyński	74cdfd5d94	Merge pull request #6099 from nymtech/bugfix/incompatibility-fixes Bugfix/incompatibility fixes	2025-10-31 08:59:40 +00:00
Jędrzej Stuczyński	953e813f0e	Bugfix/bloomfilters purge (#6089 ) * remove all old bloomfilters upon starting binary * remove old bloomfilter file upon purging secondary data	2025-10-31 08:59:38 +00:00
Tommy Verrall	29cf5058a6	feat: pass custom HTTP client through SDK stack for domain fronting - Add with_nym_api_client() to BaseClientBuilder, MixnetClientBuilder, and RegistrationClientBuilderConfig - Modify nym_api_provider to fetch all nodes then filter by supported_roles.entry (fixes metadata inconsistency) - Update helpers.rs to build HTTP client with all nym_apis URLs and retries for fallback support - Fix SDK to use entry_capable_nodes() instead of entry_gateways() for broader gateway selection This enables domain fronting and URL rotation throughout the entire SDK stack, improving censorship resistance and connection reliability. All changes are backward compatible - custom client is optional.	2025-10-31 08:57:08 +00:00
Tommy Verrall	a2856552d8	enable URL rotation and retries for mixnet gateway init	2025-10-31 08:57:08 +00:00
Andrej Mihajlov	a33c603471	Update dirs to 6.0	2025-10-31 08:57:08 +00:00
Jędrzej Stuczyński	a9f9266992	bugfix: nym-credential-proxy query params parsing regression (#6121 )	2025-10-31 08:57:08 +00:00
Tommy Verrall	cf34d0d24a	Skip ipv6 metadata endpoint request (#6118 ) Co-authored-by: Tommy Verrall <tommy@nymtech.net>	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	5fa7b0a709	bugfix: revert some dep updates introduced in #6043 (#6120 )	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	e232b4fd24	Revert "Propagate cancel token to mixnet client" This reverts commit `50a259d454`.	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	609f174e8d	chore: restore pending dkg contract state migration (#6116 ) since it has not yet been run on mainnet	2025-10-31 08:57:07 +00:00
benedetta davico	a0f4627647	Update lib.go	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	258f8f5f5d	bugfix: retrieve and update ticketbook in the same query (#6101 ) * bugfix: retrieve and update ticketbook in the same query * bump up NS version * Update Cargo.toml * remove SKIP LOCKED part of the query --------- Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:07 +00:00
mfahampshire	38220e05f1	DOCS Jarlsberg Release (#6111 ) * First pass release notes * build info	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	6250ebe235	Propagate cancel token to mixnet client	2025-10-31 08:57:07 +00:00
mfahampshire	a55323c0e2	Patch for operators to open wg metadata port (#6106 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	baa8ac3610	bugfix: use custom topology provider for list of init gateways (#6092 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	933da11e8f	bugfix: include network name in the default gateway probe config path (#6100 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	0469036da4	feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet (#6083 ) * feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet * updated getters for stringified mnemonic	2025-10-31 08:57:07 +00:00
Georgio Nicolas	63f9a856fa	Another offering for Clippy	2025-10-31 08:57:07 +00:00
Georgio Nicolas	c068948c62	Offerings for clippy	2025-10-31 08:57:06 +00:00
Georgio Nicolas	0105f9fa5e	Precompute BSGS table	2025-10-31 08:57:06 +00:00
Georgio Nicolas	004c737965	Use LazyLock to precompute generators	2025-10-31 08:57:06 +00:00
Georgio Nicolas	549121ca32	Fix clippy suggestion	2025-10-31 08:57:06 +00:00
Georgio Nicolas	3f2278dafc	Fix zeroization	2025-10-31 08:57:06 +00:00
Georgio Nicolas	25ce0ac814	replace unsafe static values by function calls	2025-10-31 08:57:06 +00:00
Mark Sinclair	38d313a101	ns-api: add descriptions to dVPN gateway responses (#6102 ) * ns-api: add descriptions to dVPN gateway responses * clippy * fmt --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
import this	f67bc0ead5	[DOCs/operators] QUIC deployment script & docs (#6098 ) * add quic_bridge_deployment.sh * create a snippet with quick install steps * add quic deployment to changelog * add quic deployment to node config page * add version compatibility callout * last edits and scraped stats update * correct name of QUIC snippet * fix naming * fix naming * re-run python-prebuild.sh aka time-now updated * attempt to fix vercel build the hard way * rerun npm * build with pnpm * restore lock file and rebuild w pnpm * chore: update pnpm lockfile * attempt to fix build * attempt to fix runtime builds * update ci-docs run OS	2025-10-31 08:57:06 +00:00
Mark Sinclair	90aaa3572d	Update ci-docs.yml	2025-10-31 08:57:06 +00:00
Mark Sinclair	ecc61e4a4a	NS API: use new probe download filesize and milliseconds field (#6097 ) * use milliseconds field * change score thresholds * bump to version 4.0.8 * NS API: adjust score categories (#6103) * testing scores * test version * Update Cargo.toml --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com> Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	22ac4919e5	bugfix: testnet manager 02sql migration (#6096 )	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	a1e7cc8e87	chore: remove unnecessary closure in 'calculate_score' inside node-status-api	2025-10-31 08:57:06 +00:00
Mark Sinclair	57df00637c	ns-api: use download files size from probes instead of parsing filenames	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	c7eb3bdb7b	moved nym-gateway-probe to monorepo and updated rust-edition to 2024 (#6094 ) dont build netstack in CI additional rust 2024 fixes fixes removed temp.rs first round of cleanup removed duplicated NS types moved gateway probe to the monorepo	2025-10-31 08:57:05 +00:00
Mark Sinclair	8f9b704541	ns-api: add new fields for probe output for query_metadata and download file size and duration in ms (#6091 ) Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
Mark Sinclair	6a956c790a	NS API: clamp `load` to `offline` when score is `offline` and add `mixnet_score` field to preformance_v2 (#6076 ) * ns-api: when `score` is `Offline`, clamp `load` to `Offline` * ns-api: bump version * ns-api: add mixnet score field to performance_v2 struct --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
mfahampshire	2ff5c7221a	Max/fix wasm client + build commands (#6043 ) * Debug logging * Yield based logging * Reintroduce non-dummy task manager, try add counting for BatchMessageSender, a couple of compiler target introductions on use statements. * Fixed time runtime err * Uncomment forgetme/rememberme * remove diffs from debug * missed commented out forgetme * yet more forgetme comments * * Added missing clientreqestsender clone to wasm client to stop premature drop & busyloop * Removed hacky mem::forget fix * Remove debug panic_hook * Conditional import + use of wasm_utils::console_log * add wasm_util dep * Commenting out or removing debug logging * Remove missed comment * cleanup gitignore * clippy * update go version in ci * removed unused deps * add clippy ignore * remove mixfetch from ci build * add minifetch fix * comment out unused ts builds * stop contract clients killing ci for the moment * wasm target locking for imports * Either remove console_log! macro or introduce cfg(debug_assertions) * downgrade netlink * debug assertions for console_log import * modify config logging (debug -> normal) * remove clone for client_request_sender + grab directly in struct creation * reintroduce debug print for config in debug mode * remove ood / unused custom topology from worker example file * clippy * clippy - ignore todo() tests * modified humantime test in line with new parsing rules	2025-10-31 08:56:49 +00:00