PR feedback WIP

Query full history
epoch paged
2026-01-13 10:51:20 +01:00 · 2026-01-13 10:51:20 +01:00 · 2026-01-13 10:51:20 +01:00 · 2026-01-13 10:51:20 +01:00 · 2026-01-13 10:51:20 +01:00
1799 changed files with 48100 additions and 150945 deletions
@@ -3,5 +3,4 @@
 .gitignore
 **/node_modules
 **/target
 target-otel
 dist
@@ -1,5 +1,2 @@
 nym-validator-rewarder/.sqlx/** diff=nodiff
 nym-node-status-api/nym-node-status-api/.sqlx/** diff=nodiff
 # Use bd merge for beads JSONL files
 .beads/beads.jsonl merge=beads
@@ -6,8 +6,6 @@ on:
 jobs:
  build:
    runs-on: arc-ubuntu-22.04
    env:
      NEXT_PUBLIC_SITE_URL: https://nym.com/docs
    defaults:
      run:
        working-directory: documentation/docs
@@ -15,8 +13,10 @@ jobs:
      - uses: actions/checkout@v6
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
-        run: sudo apt install -y python3-pandas python3-tabulate
+        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
@@ -39,12 +39,8 @@ jobs:
      - name: Install project dependencies
        run: pnpm i
      - name: Generate llms-full.txt
        run: pnpm run generate:llms
      - name: Build project
        run: pnpm run build
      - name: Generate sitemap
        run: npx next-sitemap
      - name: Move files to /dist/
        run: ../scripts/move-to-dist.sh
@@ -3,28 +3,13 @@ name: ci-build-upload-binaries
 on:
  workflow_dispatch:
    inputs:
      feature_profile:
        description: "Select a predefined cargo feature profile"
        required: false
        default: "none"
        type: choice
        options:
          - none
          - tokio-console
          - otel
          - otel,tokio-console
      extra_features:
        description: "Additional comma-separated cargo features (e.g. feat1,feat2)"
        required: false
        default: ""
        type: string
      add_tokio_unstable:
-        description: 'Force RUSTFLAGS="--cfg tokio_unstable" (auto-set when tokio-console is selected)'
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
-        required: false
+        required: true
        default: false
        type: boolean
      enable_deb:
-        description: "Enable cargo-deb installation and .deb package building"
+        description: "True to enable cargo-deb installation and .deb package building"
        required: false
        default: false
        type: boolean
@@ -36,7 +21,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [arc-ubuntu-22.04]
+        platform: [ arc-linux-latest ]
    runs-on: ${{ matrix.platform }}
    env:
@@ -51,62 +36,38 @@ jobs:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
        run: |
          rm -rf ci-builds || true
-          mkdir -p "$OUTPUT_DIR"
+          mkdir -p $OUTPUT_DIR
-          echo "$OUTPUT_DIR"
+          echo $OUTPUT_DIR
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libudev-dev
-      - name: Resolve cargo features and RUSTFLAGS
+      - name: Sets env vars for tokio if set in manual dispatch inputs
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
        shell: bash
        run: |
-          FEATURES=""
+          echo "RUSTFLAGS=--cfg tokio_unstable" >> $GITHUB_ENV
-          PROFILE="${{ inputs.feature_profile }}"
+          echo "CARGO_FEATURES=--features tokio-console" >> $GITHUB_ENV
          EXTRA="${{ inputs.extra_features }}"
          if [[ "$PROFILE" != "none" && -n "$PROFILE" ]]; then
            FEATURES="$PROFILE"
          fi
          if [[ -n "$EXTRA" ]]; then
            if [[ -n "$FEATURES" ]]; then
              FEATURES="${FEATURES},${EXTRA}"
            else
              FEATURES="$EXTRA"
            fi
          fi
          if [[ -n "$FEATURES" ]]; then
            echo "CARGO_FEATURES=--features ${FEATURES}" >> "$GITHUB_ENV"
            echo "::notice::Selected cargo features: $FEATURES"
          else
            echo "::notice::No additional cargo features selected"
          fi
          if [[ "$FEATURES" == *"tokio-console"* ]] || [[ "${{ inputs.add_tokio_unstable }}" == "true" ]]; then
            echo "RUSTFLAGS=--cfg tokio_unstable" >> "$GITHUB_ENV"
            echo "::notice::Enabled RUSTFLAGS --cfg tokio_unstable"
          fi
      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
      - name: Build all binaries
-        shell: bash
+        uses: actions-rs/cargo@v1
-        run: cargo build --workspace --release ${{ env.CARGO_FEATURES }}
+        with:
          command: build
          args: --workspace --release ${{ env.CARGO_FEATURES }}
      - name: Install cargo-deb
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: cargo-deb
        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
        shell: bash
        run: cargo install cargo-deb
      - name: Build deb packages
        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
        shell: bash
        run: make deb
        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
      - name: Upload Artifact
        if: github.event_name == 'workflow_dispatch'
@@ -123,22 +84,24 @@ jobs:
            target/release/nym-node
          retention-days: 30
      # If this was a pull_request or nightly, upload to build server
      - name: Prepare build output
        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
        shell: bash
        env:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
        run: |
-          cp target/release/nym-client "$OUTPUT_DIR"
+          cp target/release/nym-client $OUTPUT_DIR
-          cp target/release/nym-socks5-client "$OUTPUT_DIR"
+          cp target/release/nym-socks5-client $OUTPUT_DIR
-          cp target/release/nym-api "$OUTPUT_DIR"
+          cp target/release/nym-api $OUTPUT_DIR
-          cp target/release/nym-network-requester "$OUTPUT_DIR"
+          cp target/release/nym-network-requester $OUTPUT_DIR
-          cp target/release/nymvisor "$OUTPUT_DIR"
+          cp target/release/nymvisor $OUTPUT_DIR
-          cp target/release/nym-node "$OUTPUT_DIR"
+          cp target/release/nym-node $OUTPUT_DIR
-          cp target/release/nym-cli "$OUTPUT_DIR"
+          cp target/release/nym-cli $OUTPUT_DIR
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.enable_deb }}" == "true" ]]; then
+          if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
-            cp target/debian/*.deb "$OUTPUT_DIR"
+            cp target/debian/*.deb $OUTPUT_DIR
          fi
      - name: Deploy branch to CI www
        continue-on-error: true
        uses: easingthemes/ssh-deploy@main
@@ -0,0 +1,42 @@
 name: ci-build-vpn-api-wasm
 on:
  pull_request:
    paths:
      - 'common/**'
      - 'nym-credential-proxy/**'
      - '.github/workflows/ci-build-vpn-api-wasm.yml'
 jobs:
  wasm:
    runs-on: arc-linux-latest
    env:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Check out repository code
        uses: actions/checkout@v6
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
      - name: Install wasm-opt
        uses: ./.github/actions/install-wasm-opt
        with:
          version: '116'
      - name: Install wasm-bindgen-cli
        run: cargo install wasm-bindgen-cli
      - name: "Build"
        run: make
        working-directory: nym-credential-proxy/vpn-api-lib-wasm
@@ -10,7 +10,6 @@ on:
      - 'nym-api/**'
      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
      - 'nym-gateway-probe/**'
      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
@@ -90,7 +89,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client -- -D warnings
+          args: --workspace --all-targets --exclude nym-gateway-probe -- -D warnings
      - name: Clippy (non-macos)
        if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
@@ -104,15 +103,6 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --workspace --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client
        # Build Go FFI-dependent crates separately (requires Go, only available on Linux CI)
      - name: Build nym-node-status-api and nym-node-status-agent (linux only)
        if: runner.os == 'Linux'
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: -p nym-node-status-api -p nym-node-status-agent
      - name: Build all examples
        if: contains(matrix.os, 'linux')
@@ -3,7 +3,7 @@ name: ci-check-ns-api-version
 on:
  pull_request:
    paths:
-      - "nym-node-status-api/nym-node-status-api/**"
+      - "nym-node-status-api/**"
 env:
  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-api"
@@ -16,7 +16,7 @@ jobs:
        uses: actions/checkout@v6
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -16,7 +16,7 @@ jobs:
        uses: actions/checkout@v6
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -35,7 +35,7 @@ jobs:
          components: rustfmt, clippy
      - name: Install cosmwasm-check
-        run: cargo install cosmwasm-check --locked
+        run: cargo install cosmwasm-check
      - name: Install wasm-opt
        uses: ./.github/actions/install-wasm-opt
@@ -1,122 +0,0 @@
 name: Publish to crates.io (dry run)
 on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to publish (e.g. 1.21.0)"
        required: true
        type: string
 env:
  CI_BOT_AUTHOR: "Nym bot"
  CI_BOT_EMAIL: "nym-bot@users.noreply.github.com"
 jobs:
  publish-dry-run:
    runs-on: arc-linux-latest
    timeout-minutes: 35
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Configure git identity
        run: |
          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - name: Install cargo-workspaces
        run: cargo install cargo-workspaces
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Validate version format
        run: |
          if ! npx semver "${{ inputs.version }}"; then
            echo "Error: '${{ inputs.version }}' is not valid semver"
            exit 1
          fi
      - name: Get current version
        id: current_version
        run: |
          VERSION=$(grep -oP '^\s*version\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Cargo.toml | head -1)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
      - name: Update workspace dependencies
        run: |
          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
      - name: Bump versions (local only)
        run: |
          cargo workspaces version custom ${{ inputs.version }} \
            --no-git-commit \
            --yes
      - name: Preflight publish checks
        run: |
          python3 tools/internal/check_publish_preflight.py
      # Dry run may show cascading dependency errors because packages aren't
      # actually uploaded - these are expected and ignored. We check for real
      # errors like packaging failures, missing metadata, or invalid Cargo.toml.
      - name: Publish (dry run)
        run: |
          set +e
          publish_status=1
          max_attempts=2
          attempt=1
          rm -f /tmp/publish-dry-run.log
          while [ "$attempt" -le "$max_attempts" ]; do
            echo "Dry-run publish attempt ${attempt}/${max_attempts}"
            cargo workspaces publish --dry-run --allow-dirty 2>&1 | tee /tmp/publish-dry-run.log
            publish_status=${PIPESTATUS[0]}
            if [ "$publish_status" -eq 0 ]; then
              break
            fi
            # Retry once for interruption/runner issues.
            if [ "$attempt" -lt "$max_attempts" ] && \
              { [ "$publish_status" -eq 130 ] || [ "$publish_status" -eq 137 ]; }; then
              echo "Publish dry-run interrupted (exit ${publish_status}), retrying in 10s..."
              sleep 10
              attempt=$((attempt + 1))
              continue
            fi
            break
          done
          set -e
          if grep -Eiq \
            "failed to verify manifest|failed to parse manifest|invalid Cargo.toml|error: package .* has no (description|license|repository)" \
            /tmp/publish-dry-run.log; then
            echo "Detected real packaging/manifest errors"
            exit 1
          fi
          # In dry-run mode, non-zero publish status is expected due to
          # dependency-cascade failures against crates.io index.
          if [ "$publish_status" -ne 0 ]; then
            echo "Dry-run publish returned non-zero (${publish_status}) but no real manifest blockers were detected."
          fi
          echo "Only expected dry-run dependency cascade errors detected (if any)."
      # Show the list of packages published
      - name: Show package versions
        run: cargo workspaces list --long
@@ -1,61 +0,0 @@
 # This is in case, for whatever reason, a publication run fails, and we need to restart halfway down the list, of unbumped/unpublished crates.
 name: Resume crates.io publish
 on:
  workflow_dispatch:
    inputs:
      resume_after:
        description: "Last successfully published crate (will start from the next one)"
        required: true
        type: string
      publish_interval:
        description: "Seconds to wait between publishes"
        required: false
        default: "600"
        type: string
 jobs:
  publish:
    runs-on: arc-linux-latest
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - name: Install cargo-workspaces
        run: cargo install cargo-workspaces
      # Get crates in publish order, skip up to and including resume_after
      - name: Publish remaining crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          CRATES=$(cargo workspaces plan 2>/dev/null | sed -n '/^${{ inputs.resume_after }}$/,$p' | tail -n +2)
          if [ -z "$CRATES" ]; then
            echo "Error: No crates found after '${{ inputs.resume_after }}'"
            echo "Check the crate name matches exactly from 'cargo workspaces plan'"
            exit 1
          fi
          echo "Will publish the following crates:"
          echo "$CRATES"
          echo ""
          echo "$CRATES" | while read crate; do
            echo "Publishing $crate..."
            cargo publish -p "$crate" --allow-dirty
            echo "Waiting ${{ inputs.publish_interval }}s before next publish..."
            sleep ${{ inputs.publish_interval }}
          done
      - name: Show package versions
        run: cargo workspaces list --long
@@ -1,88 +0,0 @@
 name: Publish crates to crates.io
 on:
  workflow_dispatch:
    inputs:
      publish_interval:
        description: "Seconds to wait between publishes (600 for first publish, 60 after)"
        required: false
        default: "600"
        type: string
      backup_author:
        description: "Second team member added as owner of the crate"
        required: false
        default: "jstuczyn"
        type: string
 jobs:
  publish:
    runs-on: arc-linux-latest
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - name: Install cargo-workspaces
        run: cargo install cargo-workspaces
      # `--publish-as-is` skips version bumping since that's done in a separate CI job.
      - name: Publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          cargo workspaces publish \
            --publish-as-is \
            --publish-interval ${{ inputs.publish_interval }}
      - name: Show package versions
        run: cargo workspaces list --long
      - name: Add team as crate owners
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          TEAM="github:nymtech:core"
          echo "Checking and adding $TEAM as owner to workspace crates..."
          cargo workspaces list | while read crate; do
            echo "Checking $crate..."
            if cargo owner --list "$crate" 2>/dev/null | grep -q "$TEAM"; then
              echo "  $TEAM already owns $crate, skipping"
            else
              echo "  Adding $TEAM as owner of $crate..."
              cargo owner --add "$TEAM" "$crate"
              sleep 2
            fi
          done
          echo "Done!"
      - name: Add secondary member as crate owner
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          TEAM_MEMBER="${{ inputs.backup_author }}"
          echo "Checking and adding $TEAM_MEMBER as owner to workspace crates..."
          cargo workspaces list | while read crate; do
            echo "Checking $crate..."
            if cargo owner --list "$crate" 2>/dev/null | grep -q "$TEAM_MEMBER"; then
              echo "  $TEAM_MEMBER already owns $crate, skipping"
            else
              echo "  Adding $TEAM_MEMBER as owner of $crate..."
              cargo owner --add "$TEAM_MEMBER" "$crate"
              sleep 2
            fi
          done
          echo "Done!"
@@ -1,76 +0,0 @@
 name: Bump crate versions
 on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to set (e.g. 1.21.0)"
        required: true
        type: string
 env:
  CI_BOT_AUTHOR: "Nym bot"
  CI_BOT_EMAIL: "nym-bot@users.noreply.github.com"
 jobs:
  version-bump:
    runs-on: arc-linux-latest
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    permissions:
      contents: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Configure git identity
        run: |
          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - name: Install cargo-workspaces
        run: cargo install cargo-workspaces
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Validate version format
        run: |
          if ! npx semver "${{ inputs.version }}"; then
            echo "Error: '${{ inputs.version }}' is not valid semver"
            exit 1
          fi
      - name: Get current version
        id: current_version
        run: |
          VERSION=$(grep -oP '^\s*version\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Cargo.toml | head -1)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
      - name: Update workspace dependencies
        run: |
          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
      - name: Bump versions
        run: |
          cargo workspaces version custom ${{ inputs.version }} \
            --no-git-commit \
            --yes
      - name: Commit and push version bump
        run: |
          git add -A
          git commit -m "crates release: bump version to ${{ inputs.version }}"
          git push
      - name: Show package versions
        run: cargo workspaces list --long
@@ -1,21 +0,0 @@
 name: ci-docs-linkcheck
 on:
  workflow_dispatch:
  push:
    paths:
      - "documentation/docs/**"
      - ".github/workflows/ci-docs-linkcheck.yml"
      - "lychee.toml"
 jobs:
  linkcheck:
    runs-on: arc-linux-latest
    steps:
      - uses: actions/checkout@v6
      - name: Check links
        uses: lycheeverse/lychee-action@v2
        with:
          args: ${{ github.workspace }}/documentation/docs/ --config ${{ github.workspace }}/lychee.toml --root-dir ${{ github.workspace }}/documentation/docs/pages/
          fail: true
@@ -6,8 +6,6 @@ on:
    branches-ignore: [master]
    paths:
      - "documentation/docs/**"
      - "sdk/typescript/packages/sdk/src/**"
      - "sdk/typescript/packages/mix-fetch/src/**"
      - ".github/workflows/ci-docs.yml"
 jobs:
@@ -22,8 +20,10 @@ jobs:
      - uses: actions/checkout@v6
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
-        run: sudo apt install -y python3-pandas python3-tabulate
+        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
@@ -44,31 +44,10 @@ jobs:
          command: build
          args: --workspace --release
      - name: Check if TypeScript SDK source changed
        id: check-ts-sdk
        run: |
          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -qE '^sdk/typescript/packages/(sdk|mix-fetch)/src/'; then
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "changed=false" >> $GITHUB_OUTPUT
          fi
        working-directory: ${{ github.workspace }}
      - name: Regenerate TypeDoc API reference
        if: steps.check-ts-sdk.outputs.changed == 'true'
        run: |
          npm install -g typedoc@0.25.13 typedoc-plugin-markdown@4.0.3
          cd ${{ github.workspace }}/sdk/typescript/packages/sdk && typedoc --skipErrorChecking
          cd ${{ github.workspace }}/sdk/typescript/packages/mix-fetch && typedoc --skipErrorChecking
      - name: Install project dependencies
        run: pnpm i
      - name: Generate llms-full.txt
        run: pnpm run generate:llms
      - name: Build project
        run: pnpm run build
      - name: Generate sitemap
        run: npx next-sitemap
      - name: Move files to /dist/
        run: ../scripts/move-to-dist.sh
@@ -1,41 +0,0 @@
 name: ci-nym-wallet-frontend
 on:
  pull_request:
    paths:
      - 'nym-wallet/**'
      - '.github/workflows/ci-nym-wallet-frontend.yml'
 jobs:
  types-lint:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v4
        with:
          node-version-file: nym-wallet/.nvmrc
          cache: yarn
          cache-dependency-path: yarn.lock
      - name: Install dependencies
        run: yarn install --network-timeout 100000
      - name: Build TypeScript packages (wallet depends on @nymproject/types, etc.)
        run: yarn build:types
      - name: Build @nymproject/mui-theme and @nymproject/react (wallet imports subpaths)
        run: yarn build:packages
      - name: Typecheck nym-wallet
        run: yarn --cwd nym-wallet tsc
      - name: Lint nym-wallet
        run: yarn --cwd nym-wallet lint
      - name: Yarn audit (workspace lockfile; informational)
        run: yarn audit --level critical
        continue-on-error: true
      - name: Unit tests (nym-wallet)
        run: yarn --cwd nym-wallet test
@@ -41,9 +41,6 @@ jobs:
          sed -i.bak '1s/^/\[profile.dev\]\ndebug = false\n\n/' Cargo.toml
          git diff
      - name: Ensure nym-wallet/dist exists for Tauri
        run: mkdir -p nym-wallet/dist
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -74,16 +71,3 @@ jobs:
        with:
          command: clippy
          args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features --all-targets -- -D warnings
      - name: Install cargo-audit
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: cargo-audit --locked
      - name: Cargo audit (nym-wallet workspace)
        uses: actions-rs/cargo@v1
        with:
          command: audit
        working-directory: nym-wallet
        continue-on-error: true
@@ -0,0 +1,75 @@
 name: ci-nym-wallet-storybook
 on:
  pull_request:
    paths:
      - 'nym-wallet/**'
      - '.github/workflows/ci-nym-wallet-storybook.yml'
 jobs:
  build:
    runs-on: arc-linux-latest-dind
    steps:
      - uses: actions/checkout@v6
      - name: Install rsync
        run: sudo apt-get install rsync
        continue-on-error: true
      - uses: rlespinasse/github-slug-action@v3.x
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Setup yarn
        run: npm install -g yarn
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
      - name: Build dependencies
        run: yarn && yarn build
      - name: Build storybook
        run: yarn storybook:build
        working-directory: ./nym-wallet
      - name: Deploy branch to CI www (storybook)
        continue-on-error: true
        uses: easingthemes/ssh-deploy@main
        env:
          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
          ARGS: "-rltgoDzvO --delete"
          SOURCE: "nym-wallet/storybook-static/"
          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
          EXCLUDE: "/dist/, /node_modules/"
      - name: Matrix - Node Install
        run: npm install
        working-directory: .github/workflows/support-files
      - name: Matrix - Send Notification
        env:
          NYM_NOTIFICATION_KIND: nym-wallet
          NYM_PROJECT_NAME: "nym-wallet"
          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
          NYM_CI_WWW_LOCATION: "wallet-${{ env.GITHUB_REF_SLUG }}"
          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
          GIT_BRANCH: "${GITHUB_REF##*/}"
          IS_SUCCESS: "${{ job.status == 'success' }}"
          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -8,7 +8,7 @@ on:
 jobs:
  sonarqube:
    name: SonarQube
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
@@ -2,14 +2,16 @@ name: nightly-build
 on:
  workflow_dispatch:
  schedule:
    - cron: '14 1 * * *'
 jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
-        rust: [ stable, beta ]
+        rust: [stable, beta]
-        os: [ ubuntu-22.04, windows-latest, macos-latest ]
+        os: [ubuntu-22.04, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
@@ -91,3 +93,38 @@ jobs:
        with:
          command: clippy
          args: --workspace --all-targets -- -D warnings
  notification:
    needs: build
    runs-on: custom-linux
    steps:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
        uses: actions/checkout@v6
      - name: install npm
        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
        with:
          node-version: 20
      - name: Matrix - Node Install
        if: env.WORKFLOW_CONCLUSION == 'failure'
        run: npm install
        working-directory: .github/workflows/support-files
      - name: Matrix - Send Notification
        if: env.WORKFLOW_CONCLUSION == 'failure'
        env:
          NYM_NOTIFICATION_KIND: nightly
          NYM_PROJECT_NAME: "Nym nightly build"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
          GIT_BRANCH: "${GITHUB_REF##*/}"
          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -10,7 +10,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ ubuntu-22.04, macos-latest, windows-latest ]
+        os: [ubuntu-22.04, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
@@ -21,7 +21,7 @@ jobs:
        uses: actions/checkout@v6
      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
        if: matrix.os == 'ubuntu-22.04'
      - name: Install rust toolchain
@@ -55,3 +55,38 @@ jobs:
        with:
          command: clippy
          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
  notification:
    needs: build
    runs-on: custom-linux
    steps:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
        uses: actions/checkout@v6
      - name: install npm
        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
        with:
          node-version: 20
      - name: Matrix - Node Install
        if: env.WORKFLOW_CONCLUSION == 'failure'
        run: npm install
        working-directory: .github/workflows/support-files
      - name: Matrix - Send Notification
        if: env.WORKFLOW_CONCLUSION == 'failure'
        env:
          NYM_NOTIFICATION_KIND: nightly
          NYM_PROJECT_NAME: "nym-wallet-nightly-build"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
          GIT_BRANCH: "${GITHUB_REF##*/}"
          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -24,3 +24,34 @@ jobs:
        with:
          name: report
          path: .github/workflows/support-files/notifications/deny.message
  notification:
    needs: cargo-deny
    runs-on: custom-linux
    steps:
      - name: Check out repository code
        uses: actions/checkout@v6
      - name: Download report from previous job
        uses: actions/download-artifact@v7
        with:
          name: report
          path: .github/workflows/support-files/notifications
      - name: install npm
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Matrix - Node Install
        run: npm install
        working-directory: .github/workflows/support-files
      - name: Matrix - Send Notification
        env:
          NYM_NOTIFICATION_KIND: security
          NYM_PROJECT_NAME: "Daily security report"
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_AUDIT }}"
          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        uses: docker://keybaseio/client:stable-node
        with:
          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -9,7 +9,7 @@ on:
 jobs:
  integration-tests:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    env:
      API_BASE_URL: http://localhost:8000
@@ -23,7 +23,7 @@ env:
 jobs:
  check-milestone:
    name: Check Milestone
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    steps:
      - if: github.event.pull_request.milestone == null && contains( env.LABELS, 'no-milestone' ) == false
        run: exit 1
@@ -21,7 +21,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: arc-ubuntu-22.04
+          - os: arc-linux-latest
            target: x86_64-unknown-linux-gnu
    runs-on:  ${{ matrix.os }}
@@ -26,7 +26,7 @@ jobs:
      - name: Node
        uses: actions/setup-node@v4
        with:
-          node-version: 22.13.0
+          node-version: 21
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
@@ -30,7 +30,7 @@ jobs:
      - name: Node
        uses: actions/setup-node@v4
        with:
-          node-version: 22.13.0
+          node-version: 21
          cache: 'yarn'
      - name: Install Rust toolchain
@@ -72,41 +72,6 @@ jobs:
            find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
            find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
          fi
      - name: Inspect AppImage (hook + bundled graphics libs)
        shell: bash
        run: |
          set -euo pipefail
          APPIMAGE_REL=$(find target/release/bundle -name '*.AppImage' | head -n 1)
          if [ -z "${APPIMAGE_REL}" ]; then
            echo "No AppImage under target/release/bundle"
            exit 1
          fi
          APPIMAGE_ABS="${GITHUB_WORKSPACE}/nym-wallet/${APPIMAGE_REL}"
          chmod +x "${APPIMAGE_ABS}"
          EXTRACT_DIR=$(mktemp -d)
          cd "${EXTRACT_DIR}"
          "${APPIMAGE_ABS}" --appimage-extract
          # Tauri only stages appimage "files" under /usr/ into the AppDir; paths like /apprun-hooks/ never reach the image.
          # Wayland + WEBKIT_DISABLE_DMABUF_RENDERER defaults are applied in main() instead (see configure_linux_wayland_defaults).
          HOOK=$(find squashfs-root -name '99-nym-wayland.sh' 2>/dev/null | head -n 1)
          if [ -n "${HOOK}" ]; then
            echo "Found legacy apprun hook at ${HOOK}"
          else
            echo "No apprun-hooks/99-nym-wayland.sh (expected): Wayland defaults are set in-process."
          fi
          find squashfs-root/usr/lib -maxdepth 6 \
            \( -name 'libwayland-client.so*' -o -name 'libEGL.so*' -o -name 'libgbm.so*' \) \
            2>/dev/null | sort > "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
          wc -l "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
          head -50 "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt" || true
      - name: Upload AppImage graphics lib inventory
        uses: actions/upload-artifact@v6
        with:
          name: nym-wallet-appimage-lib-inventory
          path: nym-wallet/appimage-bundled-graphics-libs.txt
          retention-days: 30
      - name: Create AppImage tarball if needed
        run: |
@@ -26,9 +26,6 @@ jobs:
    outputs:
      release_tag: ${{ github.ref_name }}
    env:
      SIGN_WINDOWS: ${{ github.event_name == 'release' || inputs.sign }}
    steps:
      - uses: actions/checkout@v6
@@ -40,82 +37,48 @@ jobs:
      - name: Setup MSBuild.exe
        uses: microsoft/setup-msbuild@v2
      # No cache:yarn here: setup-node needs yarn on PATH to populate the cache, but this runner
      # only gets yarn from the step below.
      - name: Node
        uses: actions/setup-node@v4
        with:
-          node-version: 22.13.0
+          node-version: 21
      - name: Install Yarn (classic)
        shell: bash
        run: npm install -g yarn@1.22.22
      - name: Strip Authenticode thumbprint (avoid signtool on runner)
        working-directory: nym-wallet/src-tauri
        if: ${{ env.SIGN_WINDOWS == 'true' || (github.event_name == 'workflow_dispatch' && !inputs.sign) }}
        shell: bash
        run: |
          set -euo pipefail
          if ! command -v yq >/dev/null 2>&1; then
            echo "yq is required on this runner to edit tauri.conf.json"
            exit 1
          fi
          yq eval --inplace '
            del(.bundle.windows.certificateThumbprint) |
            del(.bundle.windows.digestAlgorithm) |
            del(.bundle.windows.timestampUrl)
          ' tauri.conf.json
      - name: Download EV CodeSignTool from ssl.com
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        shell: bash
        run: |
          curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
          unzip codesigntool.zip
      - name: Get EV certificate credential id
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        id: get_credential_ids
        shell: bash
        run: |
          echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
      - name: Add custom sign command to tauri.conf.json
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        shell: bash
        env:
          SSL_SIGN_USER: ${{ secrets.SSL_COM_USERNAME }}
          SSL_SIGN_PASS: ${{ secrets.SSL_COM_PASSWORD }}
          SSL_SIGN_CRED: ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
          SSL_SIGN_TOTP: ${{ secrets.SSL_COM_TOTP_SECRET }}
        run: |
-          set -euo pipefail
+          yq eval --inplace '.bundle.windows +=
-          if ! command -v cygpath >/dev/null 2>&1; then
+          {
-            echo "cygpath not found; install Git for Windows or use bash from Git SDK"
+            "signCommand": {
-            exit 1
+              "cmd": "C:\Program Files\Git\bin\bash.EXE",
-          fi
+              "args": [
-          export SCRIPT_UNIX="$(cygpath -u "$GITHUB_WORKSPACE/nym-wallet/src-tauri/CodeSignTool.sh")"
+                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
-          yq eval --inplace '
+                "sign",
-            .bundle.windows += {
+                "-username ${{ secrets.SSL_COM_USERNAME }}",
-              "signCommand": {
+                "-password ${{ secrets.SSL_COM_PASSWORD }}",
-                "cmd": "C:/Program Files/Git/bin/bash.exe",
+                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
-                "args": [
+                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
-                  strenv(SCRIPT_UNIX),
+                "-program_name NymWallet",
-                  "sign",
+                "-input_file_path",
-                  ("-username " + strenv(SSL_SIGN_USER)),
+                "%1",
-                  ("-password " + strenv(SSL_SIGN_PASS)),
+                "-override"
-                  ("-credential_id " + strenv(SSL_SIGN_CRED)),
+              ]
                  ("-totp_secret " + strenv(SSL_SIGN_TOTP)),
                  "-program_name NymWallet",
                  "-input_file_path",
                  "%1",
                  "-override"
                ]
              }
            }
-          ' tauri.conf.json
+          }' tauri.conf.json
      - name: Install project dependencies
        shell: bash
        run: cd .. && yarn --network-timeout 100000
@@ -130,10 +93,10 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          SSL_COM_USERNAME: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_USERNAME }}
+          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
-          SSL_COM_PASSWORD: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
-          SSL_COM_CREDENTIAL_ID: ${{ env.SIGN_WINDOWS == 'true' && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_COM_TOTP_SECRET: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_TOTP_SECRET }}
+          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
        run: |
          echo "Starting build process..."
          yarn build
@@ -204,4 +167,4 @@ jobs:
    needs: publish-tauri
    with:
      release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
-    secrets: inherit
+    secrets: inherit
@@ -36,9 +36,6 @@ jobs:
        with:
          go-version: "1.24.6"
      - name: Update root CA certificate bundle
        run: ./wasm/mix-fetch/go-mix-conn/scripts/update-root-certs.sh
      - name: Install dependencies
        run: yarn
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -1,61 +0,0 @@
 name: Build and upload Network Monitor Agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
      release_image:
        description: 'Tag image as a release (prefix with golden-)'
        required: true
        default: false
        type: boolean
 env:
  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-agent"
  CONTAINER_NAME: "network-monitor-agent"
 jobs:
  build-container:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Configure git identity
        run: |
          git config --global user.email "lawrence@nymtech.net"
          git config --global user.name "Lawrence Stalder"
      - name: Get version from Cargo.toml
        id: get_version
        run: |
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT
      - name: Set GIT_TAG variable
        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      - name: Set RELEASE_TAG for release
        if: github.event.inputs.release_image == 'true'
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      - name: Set IMAGE_NAME_AND_TAGS variable
        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
      - name: New env vars
        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
      - name: Build and push image to Harbor
        run: |
          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -1,57 +0,0 @@
 name: Build and upload Network Monitor Orchestrator container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
      release_image:
        description: 'Tag image as a release (prefix with golden-)'
        required: true
        default: false
        type: boolean
 env:
  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-orchestrator"
  CONTAINER_NAME: "network-monitor-orchestrator"
 jobs:
  build-container:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Configure git identity
        run: |
          git config --global user.email "lawrence@nymtech.net"
          git config --global user.name "Lawrence Stalder"
      - name: Get version from Cargo.toml
        id: get_version
        run: |
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      - name: Set RELEASE_TAG for release
        if: github.event.inputs.release_image == 'true'
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      - name: Set IMAGE_NAME_AND_TAGS variable
        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
      - name: Log image name
        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
      - name: Build and push image to Harbor
        run: |
          docker build  -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -8,7 +8,7 @@ env:
 jobs:
  build-container:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"
      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.50.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -1,45 +0,0 @@
 name: Resume publish to crates.io
 on:
  workflow_dispatch:
    inputs:
      resume_after:
        description: "Last successfully published crate (will start from the next one)"
        required: true
        type: string
 jobs:
  publish:
    runs-on: arc-linux-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
      - name: Install cargo-workspaces
        run: cargo install cargo-workspaces
      - name: Preflight publish checks
        run: |
          python3 tools/internal/check_publish_preflight.py
      - name: Publish remaining crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          # Get crates in publish order, skip up to and including resume_after
          cargo workspaces plan 2>/dev/null | sed -n '/^${{ inputs.resume_after }}$/,$p' | tail -n +2 | while read crate; do
            echo "Publishing $crate..."
            cargo publish -p "$crate" --allow-dirty
            echo "Waiting 600s before next publish..."
            sleep 600
          done
      - name: Show package versions
        run: cargo workspaces list --long
@@ -4,23 +4,51 @@ This is a collection of scripts and files to support GitHub Actions.
 ## Sending Notifications
-These scripts send CI notifications to Matrix by creating messages from templates and env vars passed from GitHub
+These scripts send CI notifications to Matrix by creating messages from templates and env vars passed from GitHub Actions.
-Actions.
+
 ### Adding notifications to a GitHub Action
 ```
 jobs:
  build:
    ...
    - name: Notifications - Node Install
      run: npm install
      working-directory: .github/workflows/support-files/notifications
    - name: Notifications - Send
      env:
        NYM_NOTIFICATION_KIND: "my-component"
        GIT_BRANCH: "${GITHUB_REF##*/}"
        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
        IS_SUCCESS: "${{ job.status == 'success' }}"
      uses: docker://keybaseio/client:stable-node
      with:
        args: .github/workflows/support-files/notifications/entry_point.sh
 ```
 Notifications are run by adding the snippet above to a GitHub Action, and:
 1. Installing node packages needed at run time
 2. Set the env vars as required:
    - `NYM_NOTIFICATION_KIND` matches the directory in `.github/workflows/support-files/${NYM_NOTIFICATION_KIND}` to provide the templates and extra scripting in `index.js`
    - Matrix credentials, room and other env vars for the status of the build and repo
 3. Replacing the default entry point shell script on the `keybaseio/client:stable-node` docker image to run `.github/workflows/support-files/notifications/entry_point.sh`
 ### Running locally
 You will need:
 - Node 16 LTS
 - npm
-Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Matrix
+Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Matrix credentials.
 credentials.
 Then run `npm install` to get dependencies.
-Start development mode for the notification type you want either by passing the value as an env var called
+Start development mode for the notification type you want either by passing the value as an env var called `NYM_NOTIFICATION_KIND` or set the `.env` file values correctly.
 `NYM_NOTIFICATION_KIND` or set the `.env` file values correctly.
 ```bash
 cd .github/workflows/support-files
@@ -0,0 +1,10 @@
 #!/usr/bin/env bash
 # pass exit codes out to GitHub Actions
 set -euxo pipefail
 # change to the directory that contains this script
 cd "${0%/*}"
 # run the node script
 node send_message.js
@@ -0,0 +1,126 @@
 require('dotenv').config();
 const { sendMatrixMessage } = require('./send_message_to_matrix');
 let context = {
  kinds: ['nym-wallet', 'ts-packages', 'network-explorer', 'nightly', 'nym-connect','security','ci-docs','cd-docs','ci-dev','cd-dev'],
 };
 /**
 * Validate that all required env and context vars are available
 */
 function validateContext() {
  if (!context.env.NYM_NOTIFICATION_KIND) {
    throw new Error(
      'Please set env var NYM_NOTIFICATION_KIND with the project kind that matches a directory in ".github/workflows/support-files"',
    );
  }
  if (!context.kinds.includes(context.env.NYM_NOTIFICATION_KIND)) {
    throw new Error(`Env var NYM_NOTIFICATION_KIND is not in ${context.kinds}`);
  }
  if (!context.env.NYM_PROJECT_NAME) {
    throw new Error(
      'Please set env var NYM_PROJECT_NAME with the project name for displaying in notification messages',
    );
  }
  if (context.env.MATRIX_ROOM) {
    if (!context.env.MATRIX_SERVER) {
      throw new Error(
        'Matrix server is not defined. Please set env var MATRIX_SERVER',
      );
    }
    if (!context.env.MATRIX_USER_ID) {
      throw new Error(
        'Matrix user id is not defined. Please set env var MATRIX_USER_ID',
      );
    }
    if (!context.env.MATRIX_TOKEN) {
      throw new Error(
        'Matrix token is not defined. Please set env var MATRIX_TOKEN',
      );
    }
    if (!context.env.MATRIX_DEVICE_ID) {
      throw new Error(
        'Matrix device id is not defined. Please set env var MATRIX_DEVICE_ID',
      );
    }
  }
 }
 /**
 * Creates a context that will be available in the templates for rendering notifications
 */
 function createTemplateContext() {
  const options = { dateStyle: 'full', timeStyle: 'long' };
  context.timestamp = new Date().toLocaleString(undefined, options);
  // add environment to template context and validate
  context.env = process.env;
  try {
    validateContext();
  } catch (e) {
    if(process.env.SHOW_DEBUG) {
      // recursively print the context for easy debugging and rethrow the error
      console.dir({ context }, { depth: null });
    }
    throw e;
  }
  context.kind = context.env.NYM_NOTIFICATION_KIND;
  if (!context.env.GIT_BRANCH_NAME) {
    context.env.GIT_BRANCH_NAME = context.env.GITHUB_REF.split('/')
      .slice(2)
      .join('/');
  }
  context.status = process.env.IS_SUCCESS === 'true' ? 'success' : 'failure';
 }
 /**
 * Uses the `kind` set in the context to process the context and generate a notification message
 * @returns {Promise<string>} A string notification message body
 */
 async function processKindScript() {
  const script = require(`../${context.kind}`);
  if (!script.addToContextAndValidate) {
    throw new Error(
      `"./${context.kind}/index.js" does not export a method called "async addToContextAndValidate(context)"`,
    );
  }
  if (!script.getMessageBody) {
    throw new Error(
      `"./${context.kind}/index.js" does not export a method called "async getMessageBody(context)"`,
    );
  }
  // call the script to modify and validate the context
  await script.addToContextAndValidate(context);
  // let the script create a message body and return the result as a string for sending
  return await script.getMessageBody(context);
 }
 /**
 * The main function, as async so that await syntax is available
 */
 async function main() {
  createTemplateContext();
  console.log(`Sending notification for kind "${context.kind}"...`);
  const messageBody = await processKindScript();
  if(process.env.SHOW_DEBUG) {
    console.log('-----------------------------------------');
    console.log(messageBody);
    console.log('-----------------------------------------');
  }
  if(context.env.MATRIX_ROOM) {
    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM)
  }
  if(context.env.MATRIX_ROOM_OF_SHAME && context.env.IS_SUCCESS !== 'true') {
    // when a job fails
    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM_OF_SHAME)
  }
 }
 // call main function and let NodeJS handle the promise
 main();
@@ -0,0 +1,67 @@
 const sdk = require('matrix-js-sdk');
 global.Olm = require('olm');
 const { LocalStorage } = require('node-localstorage');
 const localStorage = new LocalStorage('./scratch');
 const {
  LocalStorageCryptoStore,
 } = require('matrix-js-sdk/lib/crypto/store/localStorage-crypto-store');
 var showdown  = require('showdown');
 // hide all matrix client output
 console.error = (error) => console.log('❌ error: ', error);
 process.stderr.write = () => {};
 process.stdout.write = () => {};
 function createClient(context, room, message) {
  const server = context.env.MATRIX_SERVER;
  const token = context.env.MATRIX_TOKEN;
  const deviceId = context.env.MATRIX_DEVICE_ID;
  const userId = context.env.MATRIX_USER_ID;
  const client = sdk.createClient({
    baseUrl: server,
    accessToken: token,
    userId,
    deviceId,
    sessionStore: new sdk.WebStorageSessionStore(localStorage),
    cryptoStore: new LocalStorageCryptoStore(localStorage),
  });
  client.on('sync', async function(state, prevState, res) {
    if (state !== 'PREPARED') return;
    client.setGlobalErrorOnUnknownDevices(false);
    try {
      await client.joinRoom(room);
      await client.sendEvent(
        room,
        'm.room.message',
        {
          msgtype: 'm.text',
          format: 'org.matrix.custom.html',
          body: message,
          formatted_body: message,
        },
        '',
      );
    } catch (error) {
      console.error('Job failed: ' + error.message);
    }
    client.stopClient();
    process.exit(0);
  });
  return client;
 }
 async function sendMatrixMessage(contextArg, messageAsMarkdown, roomId) {
  const converter = new showdown.Converter();
  const messageAsHtml = converter.makeHtml(messageAsMarkdown);
  const client = createClient(contextArg, roomId, messageAsHtml);
  await client.initCrypto();
  await client.startClient({ initialSyncLimit: 1 });
 }
 module.exports = {
  sendMatrixMessage,
 };
@@ -27,7 +27,6 @@ v6-topology.json
 /explorer/public/downloads/mixmining.json
 /explorer/public/downloads/topology.json
 /nym-wallet/dist/*
 /nym-wallet/appimage-bundled-graphics-libs.txt
 /clients/validator/examples/nym-driver-example/current-contract.txt
 validator-api/v4.json
 validator-api/v6.json
@@ -65,16 +64,4 @@ nym-api/redocly/formatted-openapi.json
 **/settings.sql
 **/enter_db.sh
-*.profraw
+*.profraw
 .beads
 CLAUDE.md
 .claude
 .superego
 # Superego (machine-specific paths)
 .superego/
 .claude/hooks/superego/
 .claude/settings.json
 /notes
 /target-otel
@@ -4,490 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 ## [Unreleased]
 ## [2026.10-waterloo] (2026-05-27)
 - Re-order default API urls for network details - Waterloo release ([#6799])
 - [bugfix] IPR v8<->v9 mismatch on Waterloo ([#6772])
 - Migrate to hickory 0.26.1 ([#6751])
 - add workflows for NM3 ([#6729])
 - credential proxy pool ([#6726])
 - chore: made sphinx version threshold assertion a compile time check ([#6718])
 - Feat/nmv3 updated performance calculation ([#6714])
 - feat: NMv3: submission of stress testing result into nym-api ([#6709])
 - feat: NMv3: Prometheus metrics for network monitor ([#6693])
 - feat: NMv3: add read-only results API to orchestrator ([#6689])
 - feat: NMv3: Eviction of stale testrun data ([#6685])
 - feat: NMv3: Wire up testrun assignment and result submission flow ([#6680])
 - feat: NMv3: Support multiple network monitor agents per host ([#6679])
 - Feat/nmv3 agent announcement ([#6673])
 - add node refresher for periodic scraping of bonded nym-node details ([#6626])
 - Feat/nmv3 orchestrator queue ([#6597])
 - feat: network monitor agent - standalone node stress-testing ([#6582])
 - [feat] propagate NM agent noise keys to nym-node routing ([#6577])
 - start mix stress testing topic branch ([#6575])
 - Feat/nmv3 agents subscription ([#6567])
 - Feat/nmv3 agents contract ([#6555])
 [#6799]: https://github.com/nymtech/nym/pull/6799
 [#6772]: https://github.com/nymtech/nym/pull/6772
 [#6751]: https://github.com/nymtech/nym/pull/6751
 [#6729]: https://github.com/nymtech/nym/pull/6729
 [#6726]: https://github.com/nymtech/nym/pull/6726
 [#6718]: https://github.com/nymtech/nym/pull/6718
 [#6714]: https://github.com/nymtech/nym/pull/6714
 [#6709]: https://github.com/nymtech/nym/pull/6709
 [#6693]: https://github.com/nymtech/nym/pull/6693
 [#6689]: https://github.com/nymtech/nym/pull/6689
 [#6685]: https://github.com/nymtech/nym/pull/6685
 [#6680]: https://github.com/nymtech/nym/pull/6680
 [#6679]: https://github.com/nymtech/nym/pull/6679
 [#6673]: https://github.com/nymtech/nym/pull/6673
 [#6626]: https://github.com/nymtech/nym/pull/6626
 [#6597]: https://github.com/nymtech/nym/pull/6597
 [#6582]: https://github.com/nymtech/nym/pull/6582
 [#6577]: https://github.com/nymtech/nym/pull/6577
 [#6575]: https://github.com/nymtech/nym/pull/6575
 [#6567]: https://github.com/nymtech/nym/pull/6567
 [#6555]: https://github.com/nymtech/nym/pull/6555
 ## [2026.9-venaco] (2026-05-06)
 - Fix for v9 IPR  ([#6710])
 - Only init SHARED_CLIENT if requested ([#6708])
 - Fixes to crates and CI ([#6686])
 - Return ipv6 addresses as well ([#6684])
 - Fix invalid ticket spend ([#6683])
 - Block non-public IPR/NR checks ([#6670])
 [#6710]: https://github.com/nymtech/nym/pull/6710
 [#6708]: https://github.com/nymtech/nym/pull/6708
 [#6686]: https://github.com/nymtech/nym/pull/6686
 [#6684]: https://github.com/nymtech/nym/pull/6684
 [#6683]: https://github.com/nymtech/nym/pull/6683
 [#6670]: https://github.com/nymtech/nym/pull/6670
 ## [2026.8-urda] (2026-04-20)
 - Include all gateways in the returned list ([#6649])
 - Optimize GW probe in NS agent ([#6636])
 - Max/sdk docrs ([#6566])
 - Max/sdk stream wrapper ([#6320])
 [#6649]: https://github.com/nymtech/nym/pull/6649
 [#6636]: https://github.com/nymtech/nym/pull/6636
 [#6566]: https://github.com/nymtech/nym/pull/6566
 [#6320]: https://github.com/nymtech/nym/pull/6320
 ## [2026.7-tola] (2026-04-07)
 - Simon/ecash contract serde fix ([#6634])
 - Update Fallback IP for Nym API ([#6622])
 - Nym Node spam logging ([#6621])
 - feat: multiple deposit prices ([#6608])
 - move format_debug_bytes in common crate ([#6580])
 - bugfix: make sure client keys are generated before requesting credentials ([#6579])
 - Fix socks5 GW probe regression ([#6576])
 - Max/lp stream framing ([#6573])
 - HTTP domain rotation conditions ([#6570])
 [#6634]: https://github.com/nymtech/nym/pull/6634
 [#6622]: https://github.com/nymtech/nym/pull/6622
 [#6621]: https://github.com/nymtech/nym/pull/6621
 [#6608]: https://github.com/nymtech/nym/pull/6608
 [#6580]: https://github.com/nymtech/nym/pull/6580
 [#6579]: https://github.com/nymtech/nym/pull/6579
 [#6576]: https://github.com/nymtech/nym/pull/6576
 [#6573]: https://github.com/nymtech/nym/pull/6573
 [#6570]: https://github.com/nymtech/nym/pull/6570
 ## [2026.6-stilton] (2026-03-25)
 - lp fixes ([#6601])
 - bugfix: allow deserialisation of LP data from either snake_case or lowercase ([#6586])
 - bugfix: make sure to run cargo install cosmwasm-check with --locked flag during CI ([#6568])
 - Add LP to NS UI ([#6562])
 - feat: nyxd watcher ([#6561])
 - Additional ticket for agent ([#6551])
 - bugfix: make sure to use old values from metrics debug config during v12 migration (#6546) ([#6547])
 - typo ([#6543])
 - rng changes for a Send variant ([#6541])
 - Add LP fields ([#6535])
 - enable LP registration in registration client ([#6534])
 - chore: rename LpMessage to LpFrame ([#6530])
 - chore: LP improvements ([#6526])
 - Remove dep leak of strum iterator ([#6522])
 - chore: update ts-rs dep ([#6517])
 - addressing LP PR comments ([#6513])
 - remove redundant LP state machine in favour of in place processing ([#6512])
 - chore: split up lp listener ([#6507])
 - feat: enable mutual KKT exchange ([#6505])
 - feat: introduce /v3/unstable/nym-nodes/semi-skimmed to aggregate LP information ([#6499])
 - Max/asyncread asyncwrite nym client ([#6318])
 - feat: localnet v2 ([#6277])
 [#6601]: https://github.com/nymtech/nym/pull/6601
 [#6586]: https://github.com/nymtech/nym/pull/6586
 [#6568]: https://github.com/nymtech/nym/pull/6568
 [#6562]: https://github.com/nymtech/nym/pull/6562
 [#6561]: https://github.com/nymtech/nym/pull/6561
 [#6551]: https://github.com/nymtech/nym/pull/6551
 [#6547]: https://github.com/nymtech/nym/pull/6547
 [#6543]: https://github.com/nymtech/nym/pull/6543
 [#6541]: https://github.com/nymtech/nym/pull/6541
 [#6535]: https://github.com/nymtech/nym/pull/6535
 [#6534]: https://github.com/nymtech/nym/pull/6534
 [#6530]: https://github.com/nymtech/nym/pull/6530
 [#6526]: https://github.com/nymtech/nym/pull/6526
 [#6522]: https://github.com/nymtech/nym/pull/6522
 [#6517]: https://github.com/nymtech/nym/pull/6517
 [#6513]: https://github.com/nymtech/nym/pull/6513
 [#6512]: https://github.com/nymtech/nym/pull/6512
 [#6507]: https://github.com/nymtech/nym/pull/6507
 [#6505]: https://github.com/nymtech/nym/pull/6505
 [#6499]: https://github.com/nymtech/nym/pull/6499
 [#6318]: https://github.com/nymtech/nym/pull/6318
 [#6277]: https://github.com/nymtech/nym/pull/6277
 ## [2026.5-raclette] (2026-03-10)
 - bugfix: correctly populate gateway probe LP data ([#6533])
 - chore: introduce additional prometheus metrics for registration times ([#6532])
 - bugfix: lp information to have proper snake_case on API endpoints ([#6531])
 - removed redundant LP states ([#6509])
 - chore: removed all matrix notifications from github actions ([#6495])
 - feat: Lewes Protocol with PSQv2 ([#6491])
 - build(deps): bump minimatch from 3.1.2 to 3.1.4 in /documentation/docs ([#6486])
 - build(deps): bump bn.js from 4.12.2 to 4.12.3 in /documentation/docs ([#6484])
 - build(deps): bump bn.js from 4.12.2 to 4.12.3 ([#6483])
 - build(deps): bump ajv from 8.17.1 to 8.18.0 in /clients/native/examples/js-examples/websocket ([#6478])
 - build(deps): bump ajv from 6.12.6 to 6.14.0 in /documentation/docs ([#6477])
 - build(deps): bump minimatch and glob in /documentation/scripts/post-process ([#6476])
 - build(deps): bump hono from 4.11.9 to 4.12.0 ([#6475])
 - build(deps): bump keccak from 0.1.5 to 0.1.6 ([#6472])
 - build(deps-dev): bump qs from 6.14.1 to 6.14.2 in /clients/native/examples/js-examples/websocket ([#6466])
 - build(deps): bump mikefarah/yq from 4.52.2 to 4.52.4 ([#6465])
 - Otel minimal v2 ([#6464])
 - build(deps): bump qs and express in /wasm/client/internal-dev ([#6461])
 - bugfix: restore 'latest_measurement' field for nym-node /verloc endpoint ([#6452])
 - build(deps-dev): bump webpack from 5.77.0 to 5.104.1 in /wasm/node-tester/internal-dev ([#6451])
 - Max/mixfetch concurrent test ([#6417])
 [#6533]: https://github.com/nymtech/nym/pull/6533
 [#6532]: https://github.com/nymtech/nym/pull/6532
 [#6531]: https://github.com/nymtech/nym/pull/6531
 [#6509]: https://github.com/nymtech/nym/pull/6509
 [#6495]: https://github.com/nymtech/nym/pull/6495
 [#6491]: https://github.com/nymtech/nym/pull/6491
 [#6486]: https://github.com/nymtech/nym/pull/6486
 [#6484]: https://github.com/nymtech/nym/pull/6484
 [#6483]: https://github.com/nymtech/nym/pull/6483
 [#6478]: https://github.com/nymtech/nym/pull/6478
 [#6477]: https://github.com/nymtech/nym/pull/6477
 [#6476]: https://github.com/nymtech/nym/pull/6476
 [#6475]: https://github.com/nymtech/nym/pull/6475
 [#6472]: https://github.com/nymtech/nym/pull/6472
 [#6466]: https://github.com/nymtech/nym/pull/6466
 [#6465]: https://github.com/nymtech/nym/pull/6465
 [#6464]: https://github.com/nymtech/nym/pull/6464
 [#6461]: https://github.com/nymtech/nym/pull/6461
 [#6452]: https://github.com/nymtech/nym/pull/6452
 [#6451]: https://github.com/nymtech/nym/pull/6451
 [#6417]: https://github.com/nymtech/nym/pull/6417
 ## [2026.4-quark] (2026-02-24)
 - Enhance CI workflow with feature inputs ([#6462])
 - Chore/revert 6433 ([#6445])
 - Lp/stateless handshake ([#6437])
 - build(deps-dev): bump webpack from 5.98.0 to 5.105.0 in /wasm/client/internal-dev ([#6435])
 - build(deps-dev): bump webpack from 5.102.1 to 5.104.1 ([#6432])
 - build(deps-dev): bump webpack from 5.98.0 to 5.105.0 in /wasm/mix-fetch/internal-dev ([#6431])
 - build(deps-dev): bump webpack from 5.94.0 to 5.104.1 in /nym-credential-proxy/vpn-api-lib-wasm/internal-dev ([#6430])
 - build(deps-dev): bump webpack from 5.77.0 to 5.104.1 in /wasm/zknym-lib/internal-dev ([#6429])
 - build(deps-dev): bump webpack from 5.76.0 to 5.105.0 in /clients/native/examples/js-examples/websocket ([#6428])
 - HTTP & DNS Improvements ([#6423])
 - Endpoint for  exit GW IPs ([#6418])
 - build(deps): bump bytes from 1.6.0 to 1.11.1 in /contracts ([#6416])
 - build(deps): bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 ([#6415])
 - build(deps): bump bytes from 1.11.0 to 1.11.1 ([#6414])
 - build(deps): bump mikefarah/yq from 4.50.1 to 4.52.2 ([#6407])
 - build(deps-dev): bump eslint from 8.57.1 to 9.26.0 ([#6405])
 - Update reqwest to v0.13.1 ([#6401])
 - build(deps): bump next from 15.5.9 to 16.1.5 in /documentation/docs ([#6387])
 - build(deps): bump next from 15.4.10 to 16.1.5 in /nym-node-status-api/nym-node-status-ui ([#6385])
 - build(deps): bump lodash from 4.17.21 to 4.17.23 ([#6369])
 - build(deps): bump lodash-es from 4.17.21 to 4.17.23 ([#6360])
 - build(deps-dev): bump lodash from 4.17.21 to 4.17.23 in /sdk/typescript/codegen/contract-clients ([#6359])
 - build(deps): bump lodash from 4.17.21 to 4.17.23 in /sdk/typescript/packages/nodejs-client ([#6354])
 - build(deps): bump lodash from 4.17.21 to 4.17.23 in /documentation/docs ([#6353])
 - build(deps): bump lodash from 4.17.21 to 4.17.23 in /clients/native/examples/js-examples/websocket ([#6351])
 - build(deps): bump lodash-es from 4.17.21 to 4.17.23 in /documentation/docs ([#6350])
 - build(deps): bump diff from 5.2.0 to 5.2.2 in /documentation/docs ([#6345])
 - Max/crates publishing tweaks ([#6343])
 - build(deps): bump h3 from 1.15.4 to 1.15.5 ([#6339])
 - build(deps): bump h3 from 1.15.4 to 1.15.5 in /documentation/docs ([#6332])
 - build(deps): bump undici from 6.21.3 to 6.23.0 in /documentation/docs ([#6325])
 - build(deps): bump rsa from 0.9.8 to 0.9.10 ([#6311])
 - build(deps): bump qs and express in /wasm/mix-fetch/internal-dev ([#6308])
 - build(deps): bump qs and express in /clients/native/examples/js-examples/websocket ([#6307])
 - feat: introduce on-disk cache persistance for major nym-api caches ([#6302])
 - Fix migrations in the Data Observatory ([#6271])
 [#6462]: https://github.com/nymtech/nym/pull/6462
 [#6445]: https://github.com/nymtech/nym/pull/6445
 [#6437]: https://github.com/nymtech/nym/pull/6437
 [#6435]: https://github.com/nymtech/nym/pull/6435
 [#6432]: https://github.com/nymtech/nym/pull/6432
 [#6431]: https://github.com/nymtech/nym/pull/6431
 [#6430]: https://github.com/nymtech/nym/pull/6430
 [#6429]: https://github.com/nymtech/nym/pull/6429
 [#6428]: https://github.com/nymtech/nym/pull/6428
 [#6423]: https://github.com/nymtech/nym/pull/6423
 [#6418]: https://github.com/nymtech/nym/pull/6418
 [#6416]: https://github.com/nymtech/nym/pull/6416
 [#6415]: https://github.com/nymtech/nym/pull/6415
 [#6414]: https://github.com/nymtech/nym/pull/6414
 [#6407]: https://github.com/nymtech/nym/pull/6407
 [#6405]: https://github.com/nymtech/nym/pull/6405
 [#6401]: https://github.com/nymtech/nym/pull/6401
 [#6387]: https://github.com/nymtech/nym/pull/6387
 [#6385]: https://github.com/nymtech/nym/pull/6385
 [#6369]: https://github.com/nymtech/nym/pull/6369
 [#6360]: https://github.com/nymtech/nym/pull/6360
 [#6359]: https://github.com/nymtech/nym/pull/6359
 [#6354]: https://github.com/nymtech/nym/pull/6354
 [#6353]: https://github.com/nymtech/nym/pull/6353
 [#6351]: https://github.com/nymtech/nym/pull/6351
 [#6350]: https://github.com/nymtech/nym/pull/6350
 [#6345]: https://github.com/nymtech/nym/pull/6345
 [#6343]: https://github.com/nymtech/nym/pull/6343
 [#6339]: https://github.com/nymtech/nym/pull/6339
 [#6332]: https://github.com/nymtech/nym/pull/6332
 [#6325]: https://github.com/nymtech/nym/pull/6325
 [#6311]: https://github.com/nymtech/nym/pull/6311
 [#6308]: https://github.com/nymtech/nym/pull/6308
 [#6307]: https://github.com/nymtech/nym/pull/6307
 [#6302]: https://github.com/nymtech/nym/pull/6302
 [#6271]: https://github.com/nymtech/nym/pull/6271
 ## [2026.3-parmigiano] (2026-02-10)
 - chore: disable LP on parmigiano branch ([#6422])
 - revert mixnet-based client fautly changes from LP ([#6420])
 - [LP fix] Registration client with fallback ([#6419])
 - Lp/ip pool fixes ([#6412])
 - [LP-fix] expose wg psk for the vpn-client ([#6411])
 - LP-fix : configurable LP timeouts ([#6409])
 - LP-fix : add LP x25519 key to the description ([#6408])
 - use rng that is Send ([#6404])
 - use local kem key instead of local x25519 ([#6402])
 - [LP Gateway Probe] CLI and behavior improvements  ([#6400])
 - lp: attempt to negotiate (and use) protocol version ([#6399])
 - bugfix: use correct reserved bytes when parsing LpHeader ([#6398])
 - Lp/bugfix/share ip allocation ([#6395])
 - feat: use hex-encoding for lp key digests ([#6394])
 - Add socks5 test to gateway-probe ([#6393])
 - [LP Gateway probe] Improve file structure ([#6391])
 - Reduce the size of `HttpClientError` ([#6390])
 - Lp/two step dvpn reg ([#6386])
 - Add extra configured nym api url to env ([#6382])
 - Lp/dvpn psk injection ([#6378])
 - LP: include signing key digests to LP responses ([#6373])
 - Lp/use noise x25519 ([#6372])
 - Topology fallback ([#6363])
 - NS API socks5 support ([#6361])
 - LP: modified LPRemotePeer to dynamically choose required KEM key hash ([#6358])
 - Fix KKT Integration into LP ([#6357])
 - LP: mixnet reg fixes ([#6356])
 - LP: announced KEM key hashes ([#6349])
 - revert faulty drop changes ([#6346])
 - small qol changes ([#6340])
 - Apply configured api urls via env ([#6337])
 - lp chore: make sure to take reserved bytes straight from the header ([#6336])
 - LP: x25519/ed22519 cleanup round ([#6335])
 - Lp/encrypted kkt ([#6331])
 - ensure packets with incompatible versions are rejected ([#6326])
 - standarise lp serialisation: ([#6324])
 - Upgrade to def_guard_wireguard v0.8.0 ([#6315])
 - Max/crates io prep v2 ([#6270])
 [#6422]: https://github.com/nymtech/nym/pull/6422
 [#6420]: https://github.com/nymtech/nym/pull/6420
 [#6419]: https://github.com/nymtech/nym/pull/6419
 [#6412]: https://github.com/nymtech/nym/pull/6412
 [#6411]: https://github.com/nymtech/nym/pull/6411
 [#6409]: https://github.com/nymtech/nym/pull/6409
 [#6408]: https://github.com/nymtech/nym/pull/6408
 [#6404]: https://github.com/nymtech/nym/pull/6404
 [#6402]: https://github.com/nymtech/nym/pull/6402
 [#6400]: https://github.com/nymtech/nym/pull/6400
 [#6399]: https://github.com/nymtech/nym/pull/6399
 [#6398]: https://github.com/nymtech/nym/pull/6398
 [#6395]: https://github.com/nymtech/nym/pull/6395
 [#6394]: https://github.com/nymtech/nym/pull/6394
 [#6393]: https://github.com/nymtech/nym/pull/6393
 [#6391]: https://github.com/nymtech/nym/pull/6391
 [#6390]: https://github.com/nymtech/nym/pull/6390
 [#6386]: https://github.com/nymtech/nym/pull/6386
 [#6382]: https://github.com/nymtech/nym/pull/6382
 [#6378]: https://github.com/nymtech/nym/pull/6378
 [#6373]: https://github.com/nymtech/nym/pull/6373
 [#6372]: https://github.com/nymtech/nym/pull/6372
 [#6363]: https://github.com/nymtech/nym/pull/6363
 [#6361]: https://github.com/nymtech/nym/pull/6361
 [#6358]: https://github.com/nymtech/nym/pull/6358
 [#6357]: https://github.com/nymtech/nym/pull/6357
 [#6356]: https://github.com/nymtech/nym/pull/6356
 [#6349]: https://github.com/nymtech/nym/pull/6349
 [#6346]: https://github.com/nymtech/nym/pull/6346
 [#6340]: https://github.com/nymtech/nym/pull/6340
 [#6337]: https://github.com/nymtech/nym/pull/6337
 [#6336]: https://github.com/nymtech/nym/pull/6336
 [#6335]: https://github.com/nymtech/nym/pull/6335
 [#6331]: https://github.com/nymtech/nym/pull/6331
 [#6326]: https://github.com/nymtech/nym/pull/6326
 [#6324]: https://github.com/nymtech/nym/pull/6324
 [#6315]: https://github.com/nymtech/nym/pull/6315
 [#6270]: https://github.com/nymtech/nym/pull/6270
 ## [2026.2-oscypek] (2026-01-27)
 - bugfix: downgrade gateway protocol to clients proposed version ([#6377])
 - bugfix: ack fix ([#6364])
 - Cherry pick/api urls oscypek ([#6348])
 - Update nix to v0.30.1 ([#6316])
 - Deriving Serialize for GatewayData ([#6314])
 - chore: remove repetitive words in comment ([#6313])
 - [bugfix] Sqlite transaction escalation was causing errors  ([#6299])
 - DNS static table pre-resolve ([#6297])
 - Add Copy+Clone to nym_api_provider::Config ([#6296])
 - [chore] clippy fixes and use fixed rust version from REQUIRED_RUSTC_VERSION ([#6295])
 - build(deps): bump SonarSource/sonarqube-scan-action from 6 to 7 ([#6294])
 - build(deps): bump mikefarah/yq from 4.49.2 to 4.50.1 ([#6293])
 - build(deps): bump actions/upload-artifact from 5 to 6 ([#6292])
 - build(deps): bump actions/download-artifact from 6 to 7 ([#6291])
 - build(deps): bump js-yaml from 3.14.1 to 3.14.2 in /documentation/docs ([#6290])
 - build(deps): bump next from 15.4.9 to 15.4.10 in /nym-node-status-api/nym-node-status-ui ([#6289])
 - build(deps): bump next from 14.2.33 to 14.2.35 ([#6288])
 - LP Registration + Telescoping + Gateway Probe Localnet Mode ([#6286])
 - build(deps): bump next from 15.5.7 to 15.5.9 in /documentation/docs ([#6285])
 - build(deps): bump next from 15.4.7 to 15.4.9 in /nym-node-status-api/nym-node-status-ui ([#6284])
 - Minor DNS improvements ([#6283])
 - HTTP client without default features ([#6281])
 - DNS: reduce number of attempts ([#6278])
 - [bugfix] use proper mixing delay instead of poisson delay in cover traffic ([#6269])
 - build(deps): bump node-forge from 1.3.1 to 1.3.3 in /wasm/zknym-lib/internal-dev ([#6261])
 - build(deps-dev): bump node-forge from 1.3.1 to 1.3.3 in /wasm/mix-fetch/internal-dev ([#6260])
 - build(deps-dev): bump node-forge from 1.3.1 to 1.3.2 in /wasm/client/internal-dev ([#6251])
 - build(deps): bump node-forge from 1.3.1 to 1.3.2 in /nym-credential-proxy/vpn-api-lib-wasm/internal-dev ([#6250])
 - [Feature] Fallback gateway listener and remove legacy key support ([#6249])
 - build(deps-dev): bump node-forge from 1.3.0 to 1.3.2 in /clients/native/examples/js-examples/websocket ([#6248])
 - build(deps): bump node-forge from 1.3.1 to 1.3.2 ([#6246])
 - build(deps): bump pnpm/action-setup from 4.1.0 to 4.2.0 ([#6245])
 - build(deps): bump actions/download-artifact from 5 to 6 ([#6244])
 - build(deps): bump actions/checkout from 4 to 6 ([#6243])
 - build(deps): bump mikefarah/yq from 4.48.1 to 4.49.2 ([#6242])
 - build(deps): bump actions/upload-artifact from 4 to 5 ([#6241])
 - fix: fix assertion ([#6238])
 - Initial changes to support extra configurable parameters and to print… ([#6237])
 - Data Observatory ([#6172])
 [#6377]: https://github.com/nymtech/nym/pull/6377
 [#6364]: https://github.com/nymtech/nym/pull/6364
 [#6348]: https://github.com/nymtech/nym/pull/6348
 [#6316]: https://github.com/nymtech/nym/pull/6316
 [#6314]: https://github.com/nymtech/nym/pull/6314
 [#6313]: https://github.com/nymtech/nym/pull/6313
 [#6299]: https://github.com/nymtech/nym/pull/6299
 [#6297]: https://github.com/nymtech/nym/pull/6297
 [#6296]: https://github.com/nymtech/nym/pull/6296
 [#6295]: https://github.com/nymtech/nym/pull/6295
 [#6294]: https://github.com/nymtech/nym/pull/6294
 [#6293]: https://github.com/nymtech/nym/pull/6293
 [#6292]: https://github.com/nymtech/nym/pull/6292
 [#6291]: https://github.com/nymtech/nym/pull/6291
 [#6290]: https://github.com/nymtech/nym/pull/6290
 [#6289]: https://github.com/nymtech/nym/pull/6289
 [#6288]: https://github.com/nymtech/nym/pull/6288
 [#6286]: https://github.com/nymtech/nym/pull/6286
 [#6285]: https://github.com/nymtech/nym/pull/6285
 [#6284]: https://github.com/nymtech/nym/pull/6284
 [#6283]: https://github.com/nymtech/nym/pull/6283
 [#6281]: https://github.com/nymtech/nym/pull/6281
 [#6278]: https://github.com/nymtech/nym/pull/6278
 [#6269]: https://github.com/nymtech/nym/pull/6269
 [#6261]: https://github.com/nymtech/nym/pull/6261
 [#6260]: https://github.com/nymtech/nym/pull/6260
 [#6251]: https://github.com/nymtech/nym/pull/6251
 [#6250]: https://github.com/nymtech/nym/pull/6250
 [#6249]: https://github.com/nymtech/nym/pull/6249
 [#6248]: https://github.com/nymtech/nym/pull/6248
 [#6246]: https://github.com/nymtech/nym/pull/6246
 [#6245]: https://github.com/nymtech/nym/pull/6245
 [#6244]: https://github.com/nymtech/nym/pull/6244
 [#6243]: https://github.com/nymtech/nym/pull/6243
 [#6242]: https://github.com/nymtech/nym/pull/6242
 [#6241]: https://github.com/nymtech/nym/pull/6241
 [#6238]: https://github.com/nymtech/nym/pull/6238
 [#6237]: https://github.com/nymtech/nym/pull/6237
 [#6172]: https://github.com/nymtech/nym/pull/6172
 ## [2026.1-niolo] (2026-01-13)
 - bugfix: mozzarella -> niolo config migration ([#6259])
 - chore: remove run DKG migration ([#6253])
 - bugfix: reexposed 'derive_extended_private_key' ([#6247])
 - Bump js-yaml from 3.14.1 to 3.14.2 in /sdk/typescript/codegen/contract-clients ([#6231])
 - Statistics API v2 ([#6227])
 - Bump golang.org/x/crypto from 0.39.0 to 0.45.0 in /nym-gateway-probe/netstack_ping ([#6220])
 - Update chain registry link ([#6219])
 - Bump glob from 10.3.4 to 10.5.0 in /documentation/scripts/post-process ([#6216])
 - Bump js-yaml from 4.1.0 to 4.1.1 in /sdk/typescript/tests/integration-tests/mix-fetch ([#6215])
 - gateway-probe fixes for run-local ([#6212])
 - chore: updated default endpoint for retrieving attestation.json ([#6207])
 - chore: remove support for legacy mixnode within the performance contract ([#6205])
 - feat: upgrade mode: VPN adjustments ([#6189])
 - Bump min-document from 2.19.0 to 2.19.1 ([#6181])
 - Bump next from 15.4.1 to 15.4.7 in /nym-node-status-api/nym-node-status-ui ([#6180])
 - feat: merge intermediate upgrade mode changes ([#6174])
 - Add weighted scoring to NS API ([#6144])
 - build(deps): bump mikefarah/yq from 4.47.1 to 4.48.1 ([#6107])
 - build(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows ([#6068])
 - build(deps): bump tar-fs from 3.0.9 to 3.1.1 in /sdk/typescript/tests/integration-tests/mix-fetch ([#6063])
 - build(deps): bump ammonia from 4.1.1 to 4.1.2 ([#6057])
 - build(deps): bump tower-http from 0.5.2 to 0.6.6 ([#6030])
 - build(deps): bump actions/setup-go from 5 to 6 ([#6013])
 - build(deps): bump next from 14.2.28 to 14.2.32 ([#5996])
 - build(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 ([#5993])
 - build(deps): bump actions/upload-pages-artifact from 3 to 4 ([#5992])
 [#6259]: https://github.com/nymtech/nym/pull/6259
 [#6253]: https://github.com/nymtech/nym/pull/6253
 [#6247]: https://github.com/nymtech/nym/pull/6247
 [#6231]: https://github.com/nymtech/nym/pull/6231
 [#6227]: https://github.com/nymtech/nym/pull/6227
 [#6220]: https://github.com/nymtech/nym/pull/6220
 [#6219]: https://github.com/nymtech/nym/pull/6219
 [#6216]: https://github.com/nymtech/nym/pull/6216
 [#6215]: https://github.com/nymtech/nym/pull/6215
 [#6212]: https://github.com/nymtech/nym/pull/6212
 [#6207]: https://github.com/nymtech/nym/pull/6207
 [#6205]: https://github.com/nymtech/nym/pull/6205
 [#6189]: https://github.com/nymtech/nym/pull/6189
 [#6181]: https://github.com/nymtech/nym/pull/6181
 [#6180]: https://github.com/nymtech/nym/pull/6180
 [#6174]: https://github.com/nymtech/nym/pull/6174
 [#6144]: https://github.com/nymtech/nym/pull/6144
 [#6107]: https://github.com/nymtech/nym/pull/6107
 [#6068]: https://github.com/nymtech/nym/pull/6068
 [#6063]: https://github.com/nymtech/nym/pull/6063
 [#6057]: https://github.com/nymtech/nym/pull/6057
 [#6030]: https://github.com/nymtech/nym/pull/6030
 [#6013]: https://github.com/nymtech/nym/pull/6013
 [#5996]: https://github.com/nymtech/nym/pull/5996
 [#5993]: https://github.com/nymtech/nym/pull/5993
 [#5992]: https://github.com/nymtech/nym/pull/5992
 ## [2025.21-mozzarella] (2025-11-25)
 - [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
@@ -0,0 +1,686 @@
 # CLAUDE.md
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 ## Project Overview
 Nym is a privacy platform that uses mixnet technology to protect against metadata surveillance. The platform consists of several key components:
 - Mixnet nodes (mixnodes) for packet mixing
 - Gateways (entry/exit points for the network)
 - Clients for interacting with the network
 - Network monitoring tools
 - Validators for network consensus
 - Various service providers and integrations
 ## Build Commands
 ### Rust Components
 ```bash
 # Default build (debug)
 cargo build
 # Release build
 cargo build --release
 # Build a specific package
 cargo build -p <package-name>
 # Build main components
 make build
 # Build release versions of main binaries and contracts
 make build-release
 # Build specific binaries
 make build-nym-cli
 cargo build -p nym-node --release
 cargo build -p nym-api --release
 ```
 ### Testing
 ```bash
 # Run clippy, unit tests, and formatting
 make test
 # Run all tests including slow tests
 make test-all
 # Run clippy on all workspaces
 make clippy
 # Run unit tests for a specific package
 cargo test -p <package-name>
 # Run only expensive/ignored tests
 cargo test --workspace -- --ignored
 # Run API tests
 dotenv -f envs/sandbox.env -- cargo test --test public-api-tests
 # Run tests with specific log level
 RUST_LOG=debug cargo test -p <package-name>
 # Run specific test scripts
 ./nym-node/tests/test_apis.sh
 ./scripts/wireguard-exit-policy/exit-policy-tests.sh
 ```
 ### Linting and Formatting
 ```bash
 # Run rustfmt on all code
 make fmt
 # Check formatting without modifying
 cargo fmt --all -- --check
 # Run clippy with all targets
 cargo clippy --workspace --all-targets -- -D warnings
 # TypeScript linting
 yarn lint
 yarn lint:fix
 yarn types:lint:fix
 # Check dependencies for security/licensing issues
 cargo deny check
 ```
 ### WASM Components
 ```bash
 # Build all WASM components
 make sdk-wasm-build
 # Build TypeScript SDK
 yarn build:sdk
 npx lerna run --scope @nymproject/sdk build --stream
 # Build and test WASM components
 make sdk-wasm
 # Build specific WASM packages
 cd wasm/client && make
 cd wasm/mix-fetch && make
 cd wasm/node-tester && make
 ```
 ### Contract Development
 ```bash
 # Build all contracts
 make contracts
 # Build contracts in release mode
 make build-release-contracts
 # Generate contract schemas
 make contract-schema
 # Run wasm-opt on contracts
 make wasm-opt-contracts
 # Check contracts with cosmwasm-check
 make cosmwasm-check-contracts
 ```
 ### Running Components
 ```bash
 # Run nym-node as a mixnode
 cargo run -p nym-node -- run --mode mixnode
 # Run nym-node as a gateway
 cargo run -p nym-node -- run --mode gateway
 # Run the network monitor
 cargo run -p nym-network-monitor
 # Run the API server
 cargo run -p nym-api
 # Run with specific environment
 dotenv -f envs/sandbox.env -- cargo run -p nym-api
 # Start a local network
 ./scripts/localnet_start.sh
 ```
 ## Architecture
 The Nym platform consists of various components organized as a monorepo:
 1. **Core Mixnet Infrastructure**:
   - `nym-node`: Core binary supporting mixnode and gateway modes
   - `common/nymsphinx`: Implementation of the Sphinx packet format
   - `common/topology`: Network topology management
   - `common/types`: Shared data types across components
 2. **Network Monitoring**:
   - `nym-network-monitor`: Monitors the network's reliability and performance
   - `nym-api`: API server for network stats and monitoring data
   - Metrics tracking for nodes, routes, and overall network health
 3. **Client Implementations**:
   - `clients/native`: Native Rust client implementation
   - `clients/socks5`: SOCKS5 proxy client for standard applications
   - `wasm`: WebAssembly client implementations (for browsers)
   - `nym-connect`: Desktop and mobile clients
 4. **Blockchain & Smart Contracts**:
   - `common/cosmwasm-smart-contracts`: Smart contract implementations
   - `contracts`: CosmWasm contracts for the Nym network
   - `common/ledger`: Blockchain integration
 5. **Utilities & Tools**:
   - `tools`: Various CLI tools and utilities
   - `sdk`: SDKs for different languages and platforms
   - `documentation`: Documentation generation and management
 ## Packet System
 Nym uses a modified Sphinx packet format for its mixnet:
 1. **Message Chunking**:
   - Messages are divided into "sets" and "fragments"
   - Each fragment fits in a single Sphinx packet
   - The `common/nymsphinx/chunking` module handles message fragmentation
 2. **Routing**:
   - Packets traverse through 3 layers of mixnodes
   - Routing information is encrypted in layers (onion routing)
   - The final gateway receives and processes the messages
 3. **Monitoring**:
   - Monitoring system tracks packet delivery through the network
   - Routes are analyzed for reliability statistics
   - Node performance metrics are collected
 ## Network Protocol
 Nym implements the Loopix mixnet design with several key privacy features:
 1. **Continuous-time Mixing**:
   - Each mixnode delays messages independently with an exponential distribution
   - This creates random reordering of packets, destroying timing correlations
   - Offers better anonymity properties than batch mixing approaches
 2. **Cover Traffic**:
   - Clients and nodes generate dummy "loop" packets that circulate through the network
   - These packets are indistinguishable from real traffic
   - Creates a baseline level of traffic that hides actual communication patterns
   - Provides unobservability (hiding when and how much real traffic is being sent)
 3. **Stratified Network Architecture**:
   - Traffic flows through Entry Gateway → 3 Mixnode Layers → Exit Gateway
   - Path selection is independent per-message (unlike Tor)
   - Each node connects only to adjacent layers
 4. **Anonymous Replies**:
   - Single-Use Reply Blocks (SURBs) allow receiving messages without revealing identity
   - Enables bidirectional communication while maintaining privacy
 ## Network Monitoring Architecture
 The network monitoring system is a core component that measures mixnet reliability:
 1. The `nym-network-monitor` sends test packets through the network
 2. These packets follow predefined routes through multiple mixnodes
 3. Metrics are collected about:
   - Successful and failed packet deliveries
   - Node reliability (percentage of successful packet handling)
   - Route reliability (which specific route combinations work best)
 4. Results are stored in the database and used by `nym-api` to:
   - Present node performance statistics
   - Determine network rewards
   - Provide route selection guidance to clients
 In the current branch, metrics collection is being enhanced with a fanout approach to submit to multiple API endpoints.
 ## Development Environment
 ### Required Dependencies
 - Rust toolchain (stable, 1.80+)
 - Node.js (v20+) and yarn for TypeScript components
 - SQLite for local database development
 - PostgreSQL for API database (optional, for full API functionality)
 - CosmWasm tools for contract development
 - For building contracts: `wasm-opt` tool from `binaryen`
 - Python 3.8+ for some scripts
 - Docker (optional, for containerized development)
 - protoc (Protocol Buffers compiler) for some components
 ### Environment Configurations
 The `envs/` directory contains pre-configured environments:
 #### Available Environments
 - **`local.env`**: Local development environment
  - Points to local services (localhost)
  - Uses test mnemonics and keys
  - Ideal for testing without external dependencies
 - **`sandbox.env`**: Sandbox test network
  - Public test network with real nodes
  - Test tokens available from faucet
  - Contract addresses for sandbox deployment
  - API: https://sandbox-nym-api1.nymtech.net
 - **`mainnet.env`**: Production mainnet
  - Real network with real tokens
  - Production contract addresses
  - API: https://validator.nymtech.net
  - Use with caution!
 - **`canary.env`**: Canary deployment
  - Pre-release testing environment
  - Tests new features before mainnet
 - **`mainnet-local-api.env`**: Hybrid environment
  - Uses mainnet contracts but local API
  - Useful for API development against mainnet data
 #### Key Environment Variables
 ```bash
 # Network configuration
 NETWORK_NAME=sandbox              # Network identifier
 BECH32_PREFIX=n                   # Address prefix (n for sandbox, n for mainnet)
 NYM_API=https://sandbox-nym-api1.nymtech.net/api
 NYXD=https://rpc.sandbox.nymtech.net
 NYM_API_NETWORK=sandbox
 # Contract addresses (network-specific)
 MIXNET_CONTRACT_ADDRESS=n1xr3rq8yvd7qplsw5yx90ftsr2zdhg4e9z60h5duusgxpv72hud3sjkxkav
 VESTING_CONTRACT_ADDRESS=n1unyuj8qnmygvzuex3dwmg9yzt9alhvyeat0uu0jedg2wj33efl5qackslz
 # ... other contract addresses
 # Mnemonic for testing (NEVER use in production)
 MNEMONIC="clutch captain shoe salt awake harvest setup primary inmate ugly among become"
 # API Keys and tokens
 IPINFO_API_TOKEN=your_token_here
 AUTHENTICATOR_PASSWORD=password_here
 # Logging
 RUST_LOG=info                    # Options: error, warn, info, debug, trace
 RUST_BACKTRACE=1                # Enable backtraces
 # Database
 DATABASE_URL=postgresql://user:pass@localhost/nym_api
 ```
 #### Using Environment Files
 ```bash
 # Load environment and run command
 dotenv -f envs/sandbox.env -- cargo run -p nym-api
 # Export to shell
 source envs/sandbox.env
 # Use with make targets
 dotenv -f envs/sandbox.env -- make run-api-tests
 ```
 ## Initial Setup
 ### First Time Setup
 1. **Install Prerequisites**
   ```bash
   # Install Rust
   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
   # Install Node.js and yarn
   # Via nvm (recommended):
   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
   nvm install 20
   npm install -g yarn
   # Install build tools
   # Ubuntu/Debian:
   sudo apt-get install build-essential pkg-config libssl-dev protobuf-compiler libpq-dev
   # macOS:
   brew install protobuf postgresql
   # Install wasm-opt for contract builds
   npm install -g wasm-opt
   # Add wasm target for Rust
   rustup target add wasm32-unknown-unknown
   ```
 2. **Clone and Setup Repository**
   ```bash
   git clone https://github.com/nymtech/nym.git
   cd nym/nym
   # Install JavaScript dependencies
   yarn install
   # Build the project
   make build
   ```
 3. **Database Setup (Optional, for API development)**
   ```bash
   # Install PostgreSQL
   # Create database
   createdb nym_api
   # Run migrations (from nym-api directory)
   cd nym-api
   sqlx migrate run
   ```
 ### Quick Start
 ```bash
 # Run a mixnode locally
 dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode mixnode --id my-mixnode
 # Run a gateway locally
 dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode gateway --id my-gateway
 # Run the API server
 dotenv -f envs/sandbox.env -- cargo run -p nym-api
 # Run a client
 cargo run -p nym-client -- init --id my-client
 cargo run -p nym-client -- run --id my-client
 ```
 ## CI/CD Pipeline
 The project uses GitHub Actions for CI/CD with several key workflows:
 1. **Build and Test**:
   - `ci-build.yml`: Main build workflow for Rust components
   - Tests are run on multiple platforms (Linux, Windows, macOS)
   - Includes formatting check (rustfmt) and linting (clippy)
 2. **Release Process**:
   - Binary artifacts are published on release tags
   - Multiple platform builds are created
 3. **Documentation**:
   - Documentation is automatically built and deployed
 ## Database Structure
 The system uses SQLite databases with tables like:
 - `mixnode_status`: Status information about mixnodes
 - `gateway_status`: Status information about gateways
 - `routes`: Route performance information (success/failure of specific paths)
 - `monitor_run`: Information about monitoring test runs
 ## Development Workflows
 ### Running a Node
 To run the mixnode or gateway:
 ```bash
 # Run nym-node as a mixnode with specified identity
 cargo run -p nym-node -- run --mode mixnode --id my-mixnode
 # Run nym-node as a gateway
 cargo run -p nym-node -- run --mode gateway --id my-gateway
 ```
 ### Configuration
 Nodes can be configured with files in various locations:
 - Command-line arguments
 - Environment variables
 - `.env` files specified with `--config-env-file`
 ### Monitoring
 To monitor the health of your node:
 - View logs for real-time information
 - Use the node's HTTP API for status information
 - Check the explorer for public node statistics
 ## Common Libraries
 - `common/types`: Shared data types across all components
 - `common/crypto`: Cryptographic primitives and wrappers
 - `common/client-core`: Core client functionality
 - `common/gateway-client`: Client-gateway communication
 - `common/task`: Task management and concurrency utilities
 - `common/nymsphinx`: Sphinx packet implementation for mixnet
 - `common/topology`: Network topology management
 - `common/credentials`: Credential system for privacy-preserving authentication
 - `common/bandwidth-controller`: Bandwidth management and accounting
 ## Code Conventions
 - Error handling: Use anyhow/thiserror for structured error handling
 - Logging: Use the tracing framework for logging and diagnostics
 - State management: Generally use Tokio/futures for async code
 - Configuration: Use the config crate and env vars with defaults
 - Database: Use sqlx for type-safe database queries
 - Follow clippy recommendations and rustfmt formatting
 - Use semantic commit messages: feat, fix, docs, refactor, test, chore
 ## When Making Changes
 - Run `make test` before submitting PRs
 - Follow Rust naming conventions
 - Use `clippy` to check for common issues
 - Update SQLx query caches when modifying DB queries: `cargo sqlx prepare`
 - Consider backward compatibility for protocol changes
 - Use lefthook pre-commit hooks for TypeScript formatting
 - Run `cargo deny check` to verify dependency compliance
 - Test against both sandbox and local environments when possible
 - Update relevant documentation and CHANGELOG.md
 ## Development Tools
 ### Useful Cargo Commands
 ```bash
 # Check for outdated dependencies
 cargo outdated
 # Analyze binary size
 cargo bloat --release -p nym-node
 # Generate dependency graph
 cargo tree -p nym-api
 # Run with instrumentation
 cargo run --features profiling -p nym-node
 # Check for security advisories
 cargo audit
 ```
 ### Database Tools
 ```bash
 # SQLx CLI for migrations
 cargo install sqlx-cli
 # Create new migration
 cd nym-api && sqlx migrate add <migration_name>
 # Prepare query metadata for offline compilation
 cargo sqlx prepare --workspace
 # View database schema
 ./nym-api/enter_db.sh
 ```
 ### Development Scripts
 - `scripts/build_topology.py`: Generate network topology files
 - `scripts/node_api_check.py`: Verify node API endpoints
 - `scripts/network_tunnel_manager.sh`: Manage network tunnels
 - `scripts/localnet_start.sh`: Start a local test network
 - Various deployment scripts in `deployment/` for different environments
 ## Debugging
 - Enable more verbose logging with the RUST_LOG environment variable:
  ```
  RUST_LOG=debug,nym_node=trace cargo run -p nym-node -- run --mode mixnode
  ```
 - Use the HTTP API endpoints for status information
 - Check monitoring data in the database for network performance metrics
 - For complex issues, use tracing tools to follow packet flow
 - Enable backtraces: `RUST_BACKTRACE=full`
 - For WASM debugging: Use browser developer tools with source maps
 ## Deployment and Advanced Configurations
 ### Deployment Structure
 The `deployment/` directory contains Ansible playbooks and configurations for various deployment scenarios:
 - **`aws/`**: AWS-specific deployment configurations
 - **`mixnode/`**: Mixnode deployment playbooks
 - **`gateway/`**: Gateway deployment playbooks
 - **`validator/`**: Validator node deployment
 - **`sandbox-v2/`**: Complete sandbox environment setup
 - **`big-dipper-2/`**: Block explorer deployment
 ### Sandbox V2 Deployment
 The sandbox-v2 deployment (`deployment/sandbox-v2/`) provides a complete test environment:
 ```bash
 # Key playbooks:
 - deploy.yaml              # Main deployment orchestrator
 - deploy-mixnodes.yaml    # Deploy mixnodes
 - deploy-gateways.yaml    # Deploy gateways
 - deploy-validators.yaml  # Deploy validator nodes
 - deploy-nym-api.yaml     # Deploy API services
 ```
 ### Custom Environment Setup
 To create a custom environment:
 1. Copy an existing env file: `cp envs/sandbox.env envs/custom.env`
 2. Modify the network endpoints and contract addresses
 3. Update the `NETWORK_NAME` to your identifier
 4. Set appropriate mnemonics and keys (use fresh ones for production!)
 ### Contract Addresses
 Contract addresses are network-specific and defined in environment files:
 - Mixnet contract: Manages mixnode/gateway registry
 - Vesting contract: Handles token vesting schedules
 - Coconut contracts: Privacy-preserving credentials
 - Name service: Human-readable address mapping
 - Ecash contract: Electronic cash functionality
 ### Local Network Setup
 For a completely local network:
 ```bash
 # Start local chain
 ./scripts/localnet_start.sh
 # Deploy contracts
 cd contracts
 make deploy-local
 # Start nodes with local config
 dotenv -f envs/local.env -- cargo run -p nym-node -- run --mode mixnode
 ```
 ## Common Issues and Troubleshooting
 ### Database Issues
 - When modifying database queries, you must update SQLx query caches:
  ```bash
  cargo sqlx prepare
  ```
 - If you see SQLx errors about missing query files, this is likely the cause
 - For "database is locked" errors with SQLite, ensure only one process accesses the DB
 - For PostgreSQL connection issues, verify DATABASE_URL and that the server is running
 ### API Connection Issues
 - Check the environment variables pointing to the APIs (NYM_API, NYXD)
 - Verify network connectivity and API health endpoints
 - For authentication issues, check node keys and credentials
 - Common endpoints to verify:
  - API health: `$NYM_API/health`
  - Chain status: `$NYXD/status`
  - Contract info: `$NYXD/cosmwasm/wasm/v1/contract/$CONTRACT_ADDRESS`
 ### Build Problems
 - Clean dependencies with `cargo clean` for a fresh build
 - Check for compatible Rust version (1.80+ recommended)
 - For smart contract builds, ensure wasm-opt is installed: `npm install -g wasm-opt`
 - For cross-compilation issues, check target-specific dependencies
 - WASM build issues: Ensure wasm32-unknown-unknown target is installed:
  ```bash
  rustup target add wasm32-unknown-unknown
  ```
 - For "cannot find -lpq" errors, install PostgreSQL development files:
  ```bash
  # Ubuntu/Debian
  sudo apt-get install libpq-dev
  # macOS
  brew install postgresql
  ```
 ### Environment Issues
 - Contract address mismatches: Ensure you're using the correct environment file
 - "Account sequence mismatch": The account nonce is out of sync, wait and retry
 - Token decimal issues: Sandbox uses different decimal places than mainnet
 - API version mismatches: Ensure your local API version matches the network
 - "Insufficient funds": Get test tokens from faucet (sandbox) or check balance
 - Gateway/mixnode bonding issues: Verify minimum stake requirements
 ## Working with Routes and Monitoring
 1. Route monitoring metrics are stored in a `routes` table with:
   - Layer node IDs (layer1, layer2, layer3, gw)
   - Success flag (boolean)
   - Timestamp
 2. To analyze routes:
   - Check `NetworkAccount` and `AccountingRoute` in `nym-network-monitor/src/accounting.rs`
   - View monitoring logic in `common/nymsphinx/chunking/monitoring.rs`
   - Observe how routes are submitted to the database in the `submit_accounting_routes_to_db` function
 ## Performance Optimization
 ### Profiling and Benchmarking
 ```bash
 # Run benchmarks
 cargo bench -p nym-node
 # Profile with perf (Linux)
 cargo build --release --features profiling
 perf record --call-graph=dwarf ./target/release/nym-node run --mode mixnode
 perf report
 # Generate flamegraph
 cargo install flamegraph
 cargo flamegraph --bin nym-node -- run --mode mixnode
 ```
 ### Common Performance Considerations
 - Use bounded channels for backpressure
 - Batch database operations where possible
 - Monitor memory usage with `RUST_LOG=nym_node::metrics=debug`
 - Use connection pooling for database connections
 - Consider using `jemalloc` for better memory allocation performance
@@ -34,6 +34,7 @@ members = [
    "common/nym-common",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "contracts/performance",
    "common/cosmwasm-smart-contracts/contracts-common",
    "common/cosmwasm-smart-contracts/contracts-common-testing",
    "common/cosmwasm-smart-contracts/easy_addr",
@@ -44,7 +45,6 @@ members = [
    "common/cosmwasm-smart-contracts/nym-performance-contract",
    "common/cosmwasm-smart-contracts/nym-pool-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
    "common/cosmwasm-smart-contracts/network-monitors-contract",
    "common/credential-proxy",
    "common/credential-storage",
    "common/credential-utils",
@@ -73,9 +73,6 @@ members = [
    "common/nym-cache",
    "common/nym-connection-monitor",
    "common/nym-id",
    "common/nym-kcp",
    "common/nym-lp",
    "common/nym-kkt",
    "common/nym-metrics",
    "common/nym_offline_compact_ecash",
    "common/nymnoise",
@@ -129,6 +126,7 @@ members = [
    "nym-browser-extension/storage",
    "nym-credential-proxy/nym-credential-proxy",
    "nym-credential-proxy/nym-credential-proxy-requests",
    "nym-credential-proxy/vpn-api-lib-wasm",
    "nym-data-observatory",
    "nym-ip-packet-client",
    "nym-network-monitor",
@@ -148,23 +146,21 @@ members = [
    "sdk/ffi/go",
    "sdk/ffi/shared",
    "sdk/rust/nym-sdk",
    "smolmix/core",
    "service-providers/common",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
-    "nym-sqlx-pool-guard",
+    "sqlx-pool-guard",
    "tools/echo-server",
    "tools/internal/contract-state-importer/importer-cli",
    "tools/internal/contract-state-importer/importer-contract",
    "tools/internal/mixnet-connectivity-check",
-    #    "tools/internal/sdk-version-bump",
+#    "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
-    "tools/internal/localnet-orchestrator",
+    "tools/internal/testnet-manager",
-    "tools/internal/localnet-orchestrator/dkg-bypass-contract",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/internal/validator-status-check",
    "tools/nym-cli",
    "tools/nym-id-cli",
    "tools/nym-lp-client",
    "tools/nym-nr-query",
    "tools/nymvisor",
    "tools/ts-rs-cli",
@@ -173,12 +169,7 @@ members = [
    "wasm/mix-fetch",
    "wasm/node-tester",
    "wasm/zknym-lib",
-    "nym-gateway-probe",
+    "nym-gateway-probe"
    "integration-tests",
    "common/nym-kkt-ciphersuite",
    "common/nym-kkt-context",
    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
    "nym-network-monitor-v3/nym-network-monitor-agent", "nym-network-monitor-v3/nym-network-monitor-orchestrator-requests",
 ]
 default-members = [
@@ -188,16 +179,14 @@ default-members = [
    "nym-api",
    "nym-credential-proxy/nym-credential-proxy",
    "nym-node",
    "nym-node-status-api/nym-node-status-agent",
    "nym-node-status-api/nym-node-status-api",
    "nym-statistics-api",
    "nym-validator-rewarder",
    "nyx-chain-watcher",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
    "tools/nymvisor",
    "nym-registration-client",
    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
    "nym-network-monitor-v3/nym-network-monitor-agent",
    "tools/internal/localnet-orchestrator"
 ]
 exclude = ["contracts", "nym-wallet", "cpu-cycles"]
@@ -209,9 +198,8 @@ homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
 edition = "2024"
 license = "Apache-2.0"
-rust-version = "1.87.0"
+rust-version = "1.85"
 readme = "README.md"
 version = "1.20.4"
 [workspace.dependencies]
 addr = "0.15.6"
@@ -220,7 +208,6 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 ammonia = "4"
 ansi_term = "0.12"
 anyhow = "1.0.98"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
@@ -238,8 +225,7 @@ blake3 = "1.7.0"
 bloomfilter = "3.0.1"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.11.1"
+bytes = "1.10.1"
 cargo-edit = "0.13.8"
 cargo_metadata = "0.19.2"
 celes = "2.6.0"
 cfg-if = "1.0.0"
@@ -261,9 +247,9 @@ criterion = "0.5"
 csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
 curve25519-dalek = "4.1.3"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.8.0"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
 defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
 dirs = "6.0"
 dotenvy = "0.15.6"
@@ -281,12 +267,10 @@ futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
 getrandom03 = { package = "getrandom", version = "=0.3.3" }
 glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-proto = "0.26.1"
+hickory-resolver = "0.25.2"
 hickory-resolver = "0.26.1"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -303,25 +287,19 @@ inventory = "0.3.21"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
-jwt-simple = { version = "0.12.12", default-features = false, features = [
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
    "pure-rust",
 ] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
 mime = "0.3.17"
 mock_instant = "0.6.0"
 moka = { version = "0.12", features = ["future"] }
 nix = "0.30.1"
 notify = "5.1.0"
 num_enum = "0.7.5"
 once_cell = "1.21.3"
-opentelemetry = "0.31.0"
+opentelemetry = "0.19.0"
-opentelemetry_sdk = "0.31.0"
+opentelemetry-jaeger = "0.18.0"
 opentelemetry-otlp = "0.31.0"
 tonic = "0.14.4"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
@@ -331,16 +309,13 @@ publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
 quote = "1"
 rand = "0.8.5"
 rand09 = { package = "rand", version = "=0.9.2" }
 rand_chacha = "0.3"
 rand_chacha09 = { package = "rand_chacha", version = "=0.9.0" }
 rand_core = "0.6.3"
 rand_distr = "0.4"
 rayon = "1.5.1"
 regex = "1.10.6"
-reqwest = { version = "0.13.1", default-features = false }
+reqwest = { version = "0.12.15", default-features = false }
 rs_merkle = "1.5.0"
 rustls = { version = "0.23.37", default-features = false }
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
@@ -352,15 +327,13 @@ serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
-sha2 = "0.10.3"
+sha2 = "0.10.9"
 si-scale = "0.2.3"
 smolmix = { version = "0.0.1", path = "smolmix/core" }
 smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.8.6"
-strum = "0.28.0"
+strum = "0.27.2"
-strum_macros = "0.28.0"
+strum_macros = "0.27.2"
 subtle-encoding = "0.5"
 syn = "2"
 sysinfo = "0.37.0"
@@ -370,14 +343,11 @@ test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
 tls_codec = "0.4.1"
 tokio = "1.47"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
 tokio-rustls = "0.26"
 tokio-smoltcp = "0.5"
 tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
@@ -385,11 +355,12 @@ tower = "0.5.2"
 tower-http = "0.6.6"
 tracing = "0.1.41"
 tracing-log = "0.2"
-tracing-opentelemetry = "0.32.1"
+tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.20"
 tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
-ts-rs = "12.0.1"
+ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
 typed-builder = "0.23.0"
 uniffi = "0.29.2"
@@ -398,7 +369,7 @@ url = "2.5"
 utoipa = "5.2"
 utoipa-swagger-ui = "8.1"
 utoipauto = "0.2"
-uuid = "1.19.0"
+uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
 vergen-gitcl = { version = "1.0.8", default-features = false }
 walkdir = "2"
@@ -407,133 +378,11 @@ zeroize = "1.7.0"
 prometheus = { version = "0.14.0" }
 # recreating lioness
 # we don't care about particular versions - just pull whatever is used by sphinx
 lioness = "*"
 arrayref = "*"
 # libcrux
 libcrux-kem = "0.0.7"
 libcrux-ecdh = "0.0.6"
 libcrux-curve25519 = "0.0.6"
 libcrux-chacha20poly1305 = "0.0.7"
 libcrux-psq = "0.0.8"
 libcrux-ml-kem = "0.0.8"
 libcrux-sha3 = "0.0.8"
 libcrux-traits = "0.0.6"
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
 nym-api-requests = { version = "1.20.4", path = "nym-api/nym-api-requests" }
 nym-authenticator-requests = { version = "1.20.4", path = "common/authenticator-requests" }
 nym-async-file-watcher = { version = "1.20.4", path = "common/async-file-watcher" }
 nym-authenticator-client = { version = "1.20.4", path = "nym-authenticator-client" }
 nym-bandwidth-controller = { version = "1.20.4", path = "common/bandwidth-controller" }
 nym-bin-common = { version = "1.20.4", path = "common/bin-common" }
 nym-cache = { version = "1.20.4", path = "common/nym-cache" }
 nym-client-core = { version = "1.20.4", path = "common/client-core", default-features = false }
 nym-client-core-config-types = { version = "1.20.4", path = "common/client-core/config-types" }
 nym-client-core-gateways-storage = { version = "1.20.4", path = "common/client-core/gateways-storage" }
 nym-client-core-surb-storage = { version = "1.20.4", path = "common/client-core/surb-storage" }
 nym-client-websocket-requests = { version = "1.20.4", path = "clients/native/websocket-requests" }
 nym-common = { version = "1.20.4", path = "common/nym-common" }
 nym-compact-ecash = { version = "1.20.4", path = "common/nym_offline_compact_ecash" }
 nym-config = { version = "1.20.4", path = "common/config" }
 nym-contracts-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/contracts-common" }
 nym-coconut-dkg-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
 nym-credential-storage = { version = "1.20.4", path = "common/credential-storage" }
 nym-credential-utils = { version = "1.20.4", path = "common/credential-utils" }
 nym-credential-proxy-lib = { version = "1.20.4", path = "common/credential-proxy" }
 nym-credentials = { version = "1.20.4", path = "common/credentials", default-features = false }
 nym-credentials-interface = { version = "1.20.4", path = "common/credentials-interface" }
 nym-credential-proxy-requests = { version = "1.20.4", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
 nym-credential-verification = { version = "1.20.4", path = "common/credential-verification" }
 nym-crypto = { version = "1.20.4", path = "common/crypto", default-features = false }
 nym-dkg = { version = "1.20.4", path = "common/dkg" }
 nym-ecash-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/ecash-contract" }
 nym-ecash-signer-check = { version = "1.20.4", path = "common/ecash-signer-check" }
 nym-ecash-signer-check-types = { version = "1.20.4", path = "common/ecash-signer-check-types" }
 nym-ecash-time = { version = "1.20.4", path = "common/ecash-time" }
 nym-exit-policy = { version = "1.20.4", path = "common/exit-policy" }
 nym-ffi-shared = { version = "1.20.4", path = "sdk/ffi/shared" }
 nym-gateway-client = { version = "1.20.4", path = "common/client-libs/gateway-client", default-features = false }
 nym-gateway-probe = { version = "1.18.0", path = "nym-gateway-probe" }
 nym-gateway-requests = { version = "1.20.4", path = "common/gateway-requests" }
 nym-gateway-storage = { version = "1.20.4", path = "common/gateway-storage" }
 nym-gateway-stats-storage = { version = "1.20.4", path = "common/gateway-stats-storage" }
 nym-group-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/group-contract" }
 nym-http-api-client = { version = "1.20.4", path = "common/http-api-client" }
 nym-http-api-client-macro = { version = "1.20.4", path = "common/http-api-client-macro" }
 nym-http-api-common = { version = "1.20.4", path = "common/http-api-common", default-features = false }
 nym-id = { version = "1.20.4", path = "common/nym-id" }
 nym-ip-packet-client = { version = "1.20.4", path = "nym-ip-packet-client" }
 nym-ip-packet-requests = { version = "1.20.4", path = "common/ip-packet-requests" }
 nym-lp = { version = "1.20.4", path = "common/nym-lp" }
 nym-kkt = { version = "0.1.0", path = "common/nym-kkt" }
 nym-kkt-ciphersuite = { version = "1.20.4", path = "common/nym-kkt-ciphersuite" }
 nym-kkt-context = { version = "1.20.4", path = "common/nym-kkt-context" }
 nym-metrics = { version = "1.20.4", path = "common/nym-metrics" }
 nym-mixnet-client = { version = "1.20.4", path = "common/client-libs/mixnet-client" }
 nym-mixnet-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
 nym-multisig-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/multisig-contract" }
 nym-network-defaults = { version = "1.20.4", path = "common/network-defaults" }
 nym-node-tester-utils = { version = "1.20.4", path = "common/node-tester-utils" }
 nym-noise = { version = "1.20.4", path = "common/nymnoise" }
 nym-noise-keys = { version = "1.20.4", path = "common/nymnoise/keys" }
 nym-nonexhaustive-delayqueue = { version = "1.20.4", path = "common/nonexhaustive-delayqueue" }
 nym-node-requests = { version = "1.20.4", path = "nym-node/nym-node-requests", default-features = false }
 nym-node-metrics = { version = "1.20.4", path = "nym-node/nym-node-metrics" }
 nym-ordered-buffer = { version = "1.20.4", path = "common/socks5/ordered-buffer" }
 nym-outfox = { version = "1.20.4", path = "nym-outfox" }
 nym-registration-common = { version = "1.20.4", path = "common/registration" }
 nym-pemstore = { version = "1.20.4", path = "common/pemstore" }
 nym-performance-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
 nym-sdk = { version = "1.20.4", path = "sdk/rust/nym-sdk" }
 nym-serde-helpers = { version = "1.20.4", path = "common/serde-helpers" }
 nym-service-providers-common = { version = "1.20.4", path = "service-providers/common" }
 nym-service-provider-requests-common = { version = "1.20.4", path = "common/service-provider-requests-common" }
 nym-socks5-client-core = { version = "1.20.4", path = "common/socks5-client-core" }
 nym-socks5-proxy-helpers = { version = "1.20.4", path = "common/socks5/proxy-helpers" }
 nym-socks5-requests = { version = "1.20.4", path = "common/socks5/requests" }
 nym-sphinx = { version = "1.20.4", path = "common/nymsphinx" }
 nym-sphinx-acknowledgements = { version = "1.20.4", path = "common/nymsphinx/acknowledgements" }
 nym-sphinx-addressing = { version = "1.20.4", path = "common/nymsphinx/addressing" }
 nym-sphinx-anonymous-replies = { version = "1.20.4", path = "common/nymsphinx/anonymous-replies" }
 nym-sphinx-chunking = { version = "1.20.4", path = "common/nymsphinx/chunking" }
 nym-sphinx-cover = { version = "1.20.4", path = "common/nymsphinx/cover" }
 nym-sphinx-forwarding = { version = "1.20.4", path = "common/nymsphinx/forwarding" }
 nym-sphinx-framing = { version = "1.20.4", path = "common/nymsphinx/framing" }
 nym-sphinx-params = { version = "1.20.4", path = "common/nymsphinx/params" }
 nym-sphinx-routing = { version = "1.20.4", path = "common/nymsphinx/routing" }
 nym-sphinx-types = { version = "1.20.4", path = "common/nymsphinx/types" }
 nym-statistics-common = { version = "1.20.4", path = "common/statistics" }
 nym-store-cipher = { version = "1.20.4", path = "common/store-cipher" }
 nym-task = { version = "1.20.4", path = "common/task" }
 nym-tun = { version = "1.20.4", path = "common/tun" }
 nym-test-utils = { version = "1.20.4", path = "common/test-utils" }
 nym-ticketbooks-merkle = { version = "1.20.4", path = "common/ticketbooks-merkle" }
 nym-topology = { version = "1.20.4", path = "common/topology" }
 nym-types = { version = "1.20.4", path = "common/types" }
 nym-upgrade-mode-check = { version = "1.20.4", path = "common/upgrade-mode-check" }
 nym-validator-client = { version = "1.20.4", path = "common/client-libs/validator-client", default-features = false }
 nym-vesting-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/vesting-contract" }
 nym-network-monitors-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/network-monitors-contract" }
 nym-verloc = { version = "1.20.4", path = "common/verloc" }
 nym-wireguard = { version = "1.20.4", path = "common/wireguard" }
 nym-wireguard-types = { version = "1.20.4", path = "common/wireguard-types" }
 nym-wireguard-private-metadata-shared = { version = "1.20.4", path = "common/wireguard-private-metadata/shared" }
 nym-wireguard-private-metadata-client = { version = "1.20.4", path = "common/wireguard-private-metadata/client" }
 nym-wireguard-private-metadata-server = { version = "1.20.4", path = "common/wireguard-private-metadata/server" }
 nym-sqlx-pool-guard = { version = "1.2.0", path = "nym-sqlx-pool-guard" }
 nym-wasm-client-core = { version = "1.20.4", path = "common/wasm/client-core" }
 nym-wasm-storage = { version = "1.20.4", path = "common/wasm/storage" }
 nym-wasm-utils = { version = "1.20.4", path = "common/wasm/utils", default-features = false }
 nyxd-scraper-shared = { version = "1.20.4", path = "common/nyxd-scraper-shared" }
 # coconut/DKG related
-# unfortunately until https://github.com/zkcrypto/nym-bls12_381-fork/issues/10 is resolved, we have to rely on the fork
+# unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-# plus to make our live easier we need serde support from https://github.com/zkcrypto/nym-bls12_381-fork/pull/125
+# plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
-nym-bls12_381-fork = { version = "0.8.0-forked", default-features = false }
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect-updated" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.1", default-features = false }
 subtle = "2.5.0"
@@ -575,7 +424,6 @@ wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
 webpki-roots = "0.26"
 web-sys = "0.3.76"
 # for local development:
@@ -104,11 +104,11 @@ $(eval $(call add_cargo_workspace,wallet,nym-wallet))
 sdk-wasm: sdk-wasm-build sdk-wasm-test sdk-wasm-lint
 sdk-wasm-build:
-# 	$(MAKE) -C nym-browser-extension/storage wasm-pack
+	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
 	$(MAKE) -C wasm/mix-fetch
-# 	$(MAKE) -C wasm/zknym-lib
+	$(MAKE) -C wasm/zknym-lib
 	# $(MAKE) -C wasm/full-nym-wasm
 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
@@ -119,14 +119,13 @@ sdk-typescript-build:
 	yarn --cwd sdk/typescript/codegen/contract-clients build
 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
-# WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
+WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
 WASM_CRATES = nym-client-wasm nym-node-tester-wasm
 sdk-wasm-test:
 	#cargo test $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
 sdk-wasm-lint:
-	RUSTFLAGS='--cfg getrandom_backend="wasm_js"' cargo clippy $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
+	cargo clippy $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
 	$(MAKE) -C wasm/mix-fetch check-fmt
 # Add to top-level targets
@@ -30,11 +30,8 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►
 ```
 <!-- This is broken 
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
 -->
 > This project integrates with the Midnight Network
 ### Building
@@ -1,38 +1,32 @@
 ---
 ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>
 # nym_version: "v2025.21-mozzarella"
 #
 # NOTE:
 # if you want to pin Nym to a specific version instead of using the
 # latest release from GitHub in /tasks/main.yml then
 # uncomment the line above and set the tag
 cli_url: "https://github.com/nymtech/nym/releases/download/nym-binaries-{{ nym_version }}/nym-cli"
 tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh"
 quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
-###############################################################################
+# NOTE: These values will be used globally unless overwritten per node in inventory/all
 ## GLOBAL VARS
 ## These values will be used globally unless overwritten per node in inventory/all
 ###############################################################################
 ansible_user: root                         # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net`
 email: "<EMAIL>"                           # used in certbot, description.toml and landing page
 website: "<WEBSITE>"                       # it is used in the description.toml
 description: "<NODE_PUBLIC_DESCRIPTION>"   # or define per node in inventory/all
 # operator_name: "<OPERATOR_NAME>"         # used in landing page if provided
 ###############################################################################
 ## GLOBAL VARS
 ## These values will be used globally unless overwritten per node in inventory/all
 ## Set these vars only if you want them globally for all nodes
 ## Per node changes in inventory/all will overwrite these global vars
 ###############################################################################
 # NOTE: Set these vars if you want them globally for all nodes
 # Per node changes in inventory/all will overwrite these global ones:
 hostname: ""                                # this is a fallback, keep it and setup hostname per node in inventory/all
 # moniker: "<MONIKER>"                      # if not setup here not in inventory/all it get's derived from the hostname
 # mode: <MODE>                              # entry-gateway/exit-gateway/mixnode
 # wireguard_enabled: <WIREGUARD_ENABLED>    # true/false
 hostname: ""                                # this is a fallback, keep it and setup hostname per node in inventory/all
 ###############################################################################
 ## GLOBAL PACKAGES
 ## These will be installed during deployment
 ###############################################################################
 # NOTE: Possible vars to incule on landing page, etc.
 # operator_name: "<OPERATOR_NAME>"
 packages:
  - tmux
@@ -48,74 +42,3 @@ packages:
  - jq
  - wget
  - ufw
 ###############################################################################
 ## OPTIONAL OVERRIDES
 ## All values below already have defaults in the playbook/roles
 ## Uncomment only if you want to override them
 ###############################################################################
 ###############################################################################
 ## SYSTEM MAINTENANCE PLAYBOOK KNOBS
 ###############################################################################
 # To use particular version instead of Latest, provide in such form: 
 # nym_version: "nym-binaries-v2026.7-tola"
 ## NOTE:
 ## if you want to pin Nym to a specific version instead of using the
 ## latest release from GitHub in /tasks/main.yml then
 ## uncomment the line above and set the tag
 ###############################################################################
 ## SYSTEM MAINTENANCE PLAYBOOK KNOBS
 ###############################################################################
 ## JOURNALD LIMITS
 # journald_system_max_use: "100M"        # max persistent journal size
 # journald_runtime_max_use: "50M"        # max runtime journal size
 # journald_system_max_file_size: "25M"   # max single journal file
 # journald_runtime_max_file_size: "10M"  # max runtime journal file
 # journald_max_retention_sec: "3day"     # retention time
 # journald_rate_limit_interval: "30s"    # rate limit window
 # journald_rate_limit_burst: "1000"      # rate limit burst
 ## NYM-NODE LOG CONTROL
 # nymnode_log_level_max: "warning"       # drop INFO logs
 # nymnode_rate_limit_interval: "30s"     # per nym-node rate limit window
 # nymnode_rate_limit_burst: "200"        # per nym-node rate limit burst
 ## JOURNAL VACUUM TARGETS
 # journal_vacuum_size: "100M"
 # journal_vacuum_time: "3days"
 ## RSYSLOG
 # disable_rsyslog: true
 ## FSTRIM SCHEDULE
 # fstrim_every_calendar: "*:0/15"        # Aggressive
 # fstrim_every_calendar: "hourly"        # Less aggressive
 ## OPTIONAL CLEANUPS
 # enable_apt_cleanup: true
 # enable_snap_cleanup: true
 ## WRITEBACK TUNING
 # enable_writeback_tuning: true
 # writeback_dirty_writeback_centisecs: 1500
 # writeback_dirty_expire_centisecs: 6000
@@ -1,38 +0,0 @@
 ---
 - name: Restrict logging, vacuum journals, and enable periodic trim
  hosts: all
  become: true
  gather_facts: false
  # global knobs - override in inventory/group_vars/host_vars as needed
  vars:
    journald_system_max_use: "100M"
    journald_runtime_max_use: "50M"
    journald_system_max_file_size: "25M"
    journald_runtime_max_file_size: "10M"
    journald_max_retention_sec: "3day"
    journald_rate_limit_interval: "30s"
    journald_rate_limit_burst: "1000"
    # per nym-node rate limit + level cap
    nymnode_log_level_max: "warning"
    nymnode_rate_limit_interval: "30s"
    nymnode_rate_limit_burst: "200"
    # journal vacuum targets
    journal_vacuum_size: "100M"
    journal_vacuum_time: "3days"
    # fstrim cadence (note: the systemd override uses cron-like calendar)
    fstrim_every_calendar: "*:0/15"
  roles:
    - role: journald_limits
    - role: nymnode_logging
    - role: rsyslog_disable
    - role: journal_vacuum
    - role: classic_log_cleanup
    - role: apt_cleanup
    - role: snap_cleanup
    - role: fstrim_15min
    - role: report
@@ -1,21 +0,0 @@
 ---
 - name: Clean apt cache
  command: apt-get clean
  ignore_errors: true
 - name: Autoremove unused packages
  command: apt-get -y autoremove
  ignore_errors: true
 - name: Remove apt lists to reclaim space (they will be re-fetched on update)
  file:
    path: /var/lib/apt/lists
    state: absent
  ignore_errors: true
 - name: Recreate apt lists directory
  file:
    path: /var/lib/apt/lists
    state: directory
    mode: "0755"
  ignore_errors: true
@@ -1,20 +0,0 @@
 ---
 - name: Remove classic /var/log files if present (optional)
  file:
    path: "{{ item }}"
    state: absent
  loop:
    - /var/log/syslog
    - /var/log/syslog.1
    - /var/log/kern.log
    - /var/log/kern.log.1
    - /var/log/auth.log
    - /var/log/auth.log.1
    - /var/log/ufw.log
    - /var/log/ufw.log.1
  ignore_errors: true
 # This is best-effort and may still fail if other packages' postrotate scripts assume services exist.
 - name: Force logrotate (best-effort)
  command: "logrotate --force /etc/logrotate.conf"
  ignore_errors: true
@@ -1,3 +0,0 @@
 ---
 fstrim_timer_dropin_dir: "/etc/systemd/system/fstrim.timer.d"
 fstrim_every_calendar: "*:0/15"
@@ -1,31 +0,0 @@
 ---
 - name: Ensure systemd drop-in dir for fstrim.timer exists
  file:
    path: "{{ fstrim_timer_dropin_dir }}"
    state: directory
    mode: "0755"
 - name: Override fstrim.timer schedule
  copy:
    dest: "{{ fstrim_timer_dropin_dir }}/override.conf"
    mode: "0644"
    content: |
      [Timer]
      OnCalendar=
      OnCalendar={{ fstrim_every_calendar }}
      Persistent=true
      RandomizedDelaySec=0
 - name: Reload systemd after fstrim override
  systemd:
    daemon_reload: true
 - name: Enable and start fstrim timer
  systemd:
    name: fstrim.timer
    enabled: true
    state: started
 - name: Run fstrim now (best-effort)
  command: fstrim -av
  ignore_errors: true
@@ -1,3 +0,0 @@
 ---
 journal_vacuum_size: "100M"
 journal_vacuum_time: "3days"
@@ -1,6 +0,0 @@
 ---
 - name: Vacuum journal to size cap (hard)
  command: "journalctl --vacuum-size={{ journal_vacuum_size }}"
 - name: Vacuum journal older than retention window (time)
  command: "journalctl --vacuum-time={{ journal_vacuum_time }}"
@@ -1,8 +0,0 @@
 ---
 journald_system_max_use: "100M"
 journald_runtime_max_use: "50M"
 journald_system_max_file_size: "25M"
 journald_runtime_max_file_size: "10M"
 journald_max_retention_sec: "3day"
 journald_rate_limit_interval: "30s"
 journald_rate_limit_burst: "1000"
@@ -1,5 +0,0 @@
 ---
 - name: Restart journald
  systemd:
    name: systemd-journald
    state: restarted
@@ -1,20 +0,0 @@
 ---
 - name: Configure journald limits (persistent, capped, rate-limited)
  copy:
    dest: /etc/systemd/journald.conf
    mode: "0644"
    content: |
      [Journal]
      Storage=persistent
      Compress=yes
      Seal=yes
      SystemMaxUse={{ journald_system_max_use }}
      RuntimeMaxUse={{ journald_runtime_max_use }}
      SystemMaxFileSize={{ journald_system_max_file_size }}
      RuntimeMaxFileSize={{ journald_runtime_max_file_size }}
      MaxRetentionSec={{ journald_max_retention_sec }}
      RateLimitIntervalSec={{ journald_rate_limit_interval }}
      RateLimitBurst={{ journald_rate_limit_burst }}
  notify: Restart journald
@@ -1,7 +0,0 @@
 ---
 nymnode_log_level_max: "warning"
 nymnode_rate_limit_interval: "30s"
 nymnode_rate_limit_burst: "200"
 nymnode_unit_name: "nym-node"   # set to "nym-node.service" if your distro expects it
 nymnode_dropin_dir: "/etc/systemd/system/nym-node.service.d"
 nymnode_dropin_file: "10-logging.conf"
@@ -1,26 +0,0 @@
 ---
 - name: Ensure systemd drop-in dir for nym-node exists
  file:
    path: "{{ nymnode_dropin_dir }}"
    state: directory
    mode: "0755"
 - name: Cap nym-node logs + apply per-unit rate limiting
  copy:
    dest: "{{ nymnode_dropin_dir }}/{{ nymnode_dropin_file }}"
    mode: "0644"
    content: |
      [Service]
      LogLevelMax={{ nymnode_log_level_max }}
      LogRateLimitIntervalSec={{ nymnode_rate_limit_interval }}
      LogRateLimitBurst={{ nymnode_rate_limit_burst }}
 - name: Reload systemd after nym-node drop-in
  systemd:
    daemon_reload: true
 - name: Restart nym-node to apply new logging limits (best-effort)
  systemd:
    name: "{{ nymnode_unit_name }}"
    state: restarted
  ignore_errors: true
@@ -1,8 +0,0 @@
 ---
 - name: Show journal disk usage
  command: journalctl --disk-usage
  register: journal_usage
  changed_when: false
 - debug:
    var: journal_usage.stdout
@@ -1,13 +0,0 @@
 ---
 - name: Stop/disable rsyslog if installed (best-effort)
  systemd:
    name: rsyslog
    state: stopped
    enabled: false
  ignore_errors: true
 - name: Remove rsyslog logrotate stanza if present (prevents logrotate failures)
  file:
    path: /etc/logrotate.d/rsyslog
    state: absent
  ignore_errors: true
@@ -1,10 +0,0 @@
 ---
 - name: Remove disabled snap revisions (best-effort)
  shell: |
    set -euo pipefail
    snap list --all | awk '/disabled/{print $1, $3}' | while read -r name rev; do
      snap remove "$name" --revision="$rev" || true
    done
  args:
    executable: /bin/bash
  ignore_errors: true
@@ -1,30 +1,11 @@
 ---
- name: Ensure nym binaries directory exists
+- name: Configure tunnel manager
  file:
    path: /root/nym-binaries
    state: directory
    mode: "0755"
  tags:
    - tunnel
    - network_tunnel_manager
-    - ntm
+  become: true
-
+  command:
- name: Download network tunnel manager
+    cmd: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
  get_url:
    url: "{{ tunnel_manager_url }}"
    dest: /root/nym-binaries/network-tunnel-manager.sh
    mode: "0755"
    force: yes
  tags:
    - tunnel
    - network_tunnel_manager
    - ntm
 - name: Run network tunnel manager
  command: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
  loop:
    - complete_networking_configuration
-  tags:
+  register: tunnel_mgr
-    - tunnel
+  failed_when: false
    - network_tunnel_manager
    - ntm
@@ -9,7 +9,7 @@
  changed_when: false
  when: not ansible_check_mode
-# show the full stdout
+# show the full stdout so we don’t depend on regex parsing at all
 # show full upgraded version output, line by line
 - name: Show upgraded nym-node version info
  debug:
@@ -1,12 +1,11 @@
 [package]
 name = "nym-client"
-description = "Implementation of the Nym Client"
+version = "1.1.67"
 version = "1.1.77"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
 license.workspace = true
 rust-version = "1.85"
-publish = false
+license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -43,32 +42,32 @@ tokio-tungstenite = { workspace = true }
 zeroize = { workspace = true }
 ## internal
-nym-bandwidth-controller = { workspace = true }
+nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
-nym-bin-common = { workspace = true, features = [
+nym-bin-common = { path = "../../common/bin-common", features = [
    "output_format",
    "clap",
    "basic_tracing",
 ] }
-nym-client-core = { workspace = true, features = [
+nym-client-core = { path = "../../common/client-core", features = [
    "fs-credentials-storage",
    "fs-surb-storage",
    "fs-gateways-storage",
    "cli",
 ] }
-nym-config = { workspace = true }
+nym-config = { path = "../../common/config" }
-nym-credential-storage = { workspace = true }
+nym-credential-storage = { path = "../../common/credential-storage" }
-nym-credentials = { workspace = true }
+nym-credentials = { path = "../../common/credentials" }
-nym-crypto = { workspace = true }
+nym-crypto = { path = "../../common/crypto" }
-nym-gateway-requests = { workspace = true }
+nym-gateway-requests = { path = "../../common/gateway-requests" }
-nym-network-defaults = { workspace = true }
+nym-network-defaults = { path = "../../common/network-defaults" }
-nym-sphinx = { workspace = true }
+nym-sphinx = { path = "../../common/nymsphinx" }
-nym-pemstore = { workspace = true }
+nym-pemstore = { path = "../../common/pemstore" }
-nym-task = { workspace = true }
+nym-task = { path = "../../common/task" }
-nym-topology = { workspace = true }
+nym-topology = { path = "../../common/topology" }
-nym-validator-client = { workspace = true, features = [
+nym-validator-client = { path = "../../common/client-libs/validator-client", features = [
    "http-client",
 ] }
-nym-client-websocket-requests = { workspace = true }
+nym-client-websocket-requests = { path = "websocket-requests" }
-nym-id = { workspace = true }
+nym-id = { path = "../../common/nym-id" }
 [dev-dependencies]
@@ -19,7 +19,7 @@
  "license": "Apache-2.0",
  "devDependencies": {
    "clean-webpack-plugin": "^4.0.0",
-    "webpack": "^5.105.0",
+    "webpack": "^5.76.0",
    "webpack-cli": "^4.9.2",
    "webpack-dev-server": "^4.7.4"
  },
@@ -1,16 +1,9 @@
 [package]
 name = "nym-client-websocket-requests"
-description = "Request and response definitions for Nym client websocket connections"
+version = "0.1.0"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -18,4 +11,4 @@ publish = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-nym-sphinx = { workspace = true }
+nym-sphinx = { path = "../../../common/nymsphinx" }
@@ -1,12 +1,11 @@
 [package]
 name = "nym-socks5-client"
-description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
+version = "1.1.67"
 version = "1.1.77"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
 license.workspace = true
 rust-version = "1.85"
-publish = false
+license.workspace = true
 [dependencies]
 bs58 = { workspace = true }
@@ -25,30 +24,30 @@ url = { workspace = true }
 zeroize = { workspace = true }
 # internal
-nym-bin-common = { workspace = true, features = [
+nym-bin-common = { path = "../../common/bin-common", features = [
    "output_format",
    "clap",
    "basic_tracing",
 ] }
-nym-client-core = { workspace = true, features = [
+nym-client-core = { path = "../../common/client-core", features = [
    "fs-credentials-storage",
    "fs-surb-storage",
    "fs-gateways-storage",
    "cli",
 ] }
-nym-config = { workspace = true }
+nym-config = { path = "../../common/config" }
-nym-credential-storage = { workspace = true }
+nym-credential-storage = { path = "../../common/credential-storage" }
-nym-credentials = { workspace = true }
+nym-credentials = { path = "../../common/credentials" }
-nym-crypto = { workspace = true }
+nym-crypto = { path = "../../common/crypto" }
-nym-gateway-requests = { workspace = true }
+nym-gateway-requests = { path = "../../common/gateway-requests" }
-nym-id = { workspace = true }
+nym-id = { path = "../../common/nym-id" }
-nym-network-defaults = { workspace = true }
+nym-network-defaults = { path = "../../common/network-defaults" }
-nym-ordered-buffer = { workspace = true }
+nym-ordered-buffer = { path = "../../common/socks5/ordered-buffer" }
-nym-pemstore = { workspace = true }
+nym-pemstore = { path = "../../common/pemstore" }
-nym-socks5-client-core = { workspace = true }
+nym-socks5-client-core = { path = "../../common/socks5-client-core" }
-nym-sphinx = { workspace = true }
+nym-sphinx = { path = "../../common/nymsphinx" }
-nym-topology = { workspace = true }
+nym-topology = { path = "../../common/topology" }
-nym-validator-client = { workspace = true, features = [
+nym-validator-client = { path = "../../common/client-libs/validator-client", features = [
    "http-client",
 ] }
@@ -1,16 +1,8 @@
 [package]
 name = "nym-async-file-watcher"
-description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
+version = "0.1.0"
 version.workspace = true
 authors.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -1,16 +1,12 @@
 [package]
 name = "nym-authenticator-requests"
-description = "Crate defining requests and responses for the Nym authenticator client"
+version = "0.1.0"
 version.workspace = true
 authors.workspace = true
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-rust-version.workspace = true
+edition.workspace = true
-readme.workspace = true
+license.workspace = true
 publish = true
 [dependencies]
 base64 = { workspace = true }
@@ -22,12 +18,12 @@ strum_macros = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }
-nym-credentials-interface = { workspace = true }
+nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { workspace = true, features = ["asymmetric"] }
+nym-crypto = { path = "../crypto", features = ["asymmetric"] }
-nym-network-defaults = { workspace = true }
+nym-network-defaults = { path = "../network-defaults" }
-nym-service-provider-requests-common = { workspace = true }
+nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
-nym-sphinx = { workspace = true }
+nym-sphinx = { path = "../nymsphinx" }
-nym-wireguard-types = { workspace = true }
+nym-wireguard-types = { path = "../wireguard-types" }
 ## verify:
 hmac = { workspace = true, optional = true }
@@ -35,7 +31,7 @@ sha2 = { workspace = true, optional = true }
 x25519-dalek = { workspace = true, features = ["static_secrets"] }
 [dev-dependencies]
-nym-test-utils = { workspace = true }
+nym-test-utils = { path = "../test-utils" }
 [features]
 default = ["verify"]
@@ -43,4 +39,4 @@ default = ["verify"]
 verify = ["hmac", "sha2"]
 [lints]
-workspace = true
+workspace = true
@@ -18,7 +18,6 @@ mod util;
 mod version;
 pub use error::Error;
 pub use util::{authenticator_ipv4_to_ipv6, authenticator_ipv6_to_ipv4};
 pub use v6 as latest;
 pub use version::AuthenticatorVersion;
@@ -7,7 +7,6 @@ use crate::traits::{
    TopUpBandwidthResponse, UpgradeModeStatus,
 };
 use crate::{v2, v3, v4, v5, v6};
 use nym_sphinx::addressing::Recipient;
 #[derive(Debug)]
 pub enum AuthenticatorResponse {
@@ -18,17 +17,6 @@ pub enum AuthenticatorResponse {
    UpgradeMode(Box<dyn UpgradeModeStatus + Send + Sync + 'static>),
 }
 pub struct SerialisedResponse {
    pub bytes: Vec<u8>,
    pub reply_to: Option<Recipient>,
 }
 impl SerialisedResponse {
    pub fn new(bytes: Vec<u8>, reply_to: Option<Recipient>) -> Self {
        Self { bytes, reply_to }
    }
 }
 impl UpgradeModeStatus for AuthenticatorResponse {
    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
        match self {
@@ -1,38 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 use nym_network_defaults::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use std::net::{Ipv4Addr, Ipv6Addr};
 pub fn authenticator_ipv6_to_ipv4(addr: Ipv6Addr) -> Ipv4Addr {
    let before_last_byte = addr.octets()[14];
    let last_byte = addr.octets()[15];
    Ipv4Addr::new(
        WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
        WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
        before_last_byte,
        last_byte,
    )
 }
 pub fn authenticator_ipv4_to_ipv6(addr: Ipv4Addr) -> Ipv6Addr {
    let before_last_byte = addr.octets()[2];
    let last_byte = addr.octets()[3];
    let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
    Ipv6Addr::new(
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
        WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
        last_bytes,
    )
 }
 #[cfg(test)]
 pub(crate) mod tests {
    pub(crate) const CREDENTIAL_BYTES: [u8; 1245] = [
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 use crate::error::Error;
 use crate::util::{authenticator_ipv4_to_ipv6, authenticator_ipv6_to_ipv4};
 use base64::{Engine, engine::general_purpose};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -56,11 +56,27 @@ impl fmt::Display for IpPair {
 impl From<IpAddr> for IpPair {
    fn from(value: IpAddr) -> Self {
-        let (ipv4, ipv6) = match value {
+        let (before_last_byte, last_byte) = match value {
-            IpAddr::V4(ipv4) => (ipv4, authenticator_ipv4_to_ipv6(ipv4)),
+            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            IpAddr::V6(ipv6_addr) => (authenticator_ipv6_to_ipv4(ipv6_addr), ipv6_addr),
+            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
        };
-
+        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
        let ipv4 = Ipv4Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
            before_last_byte,
            last_byte,
        );
        let ipv6 = Ipv6Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
            last_bytes,
        );
        IpPair::new(ipv4, ipv6)
    }
 }
@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 use crate::error::Error;
 use crate::util::{authenticator_ipv4_to_ipv6, authenticator_ipv6_to_ipv4};
 use base64::{Engine, engine::general_purpose};
 use nym_credentials_interface::CredentialSpendingData;
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -54,11 +54,27 @@ impl fmt::Display for IpPair {
 impl From<IpAddr> for IpPair {
    fn from(value: IpAddr) -> Self {
-        let (ipv4, ipv6) = match value {
+        let (before_last_byte, last_byte) = match value {
-            IpAddr::V4(ipv4) => (ipv4, authenticator_ipv4_to_ipv6(ipv4)),
+            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            IpAddr::V6(ipv6_addr) => (authenticator_ipv6_to_ipv4(ipv6_addr), ipv6_addr),
+            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
        };
-
+        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
        let ipv4 = Ipv4Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
            before_last_byte,
            last_byte,
        );
        let ipv6 = Ipv6Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
            last_bytes,
        );
        IpPair::new(ipv4, ipv6)
    }
 }
@@ -3,12 +3,13 @@
 use crate::error::Error;
 use crate::models::BandwidthClaim;
 use crate::util::{authenticator_ipv4_to_ipv6, authenticator_ipv6_to_ipv4};
 use base64::{Engine, engine::general_purpose};
 use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
 use nym_wireguard_types::PeerPublicKey;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 use std::time::SystemTime;
 use std::{fmt, ops::Deref, str::FromStr};
 #[cfg(feature = "verify")]
@@ -19,11 +20,13 @@ use nym_crypto::asymmetric::x25519::{PrivateKey, PublicKey};
 use sha2::Sha256;
 pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
 pub type PrivateIPs = HashMap<IpPair, Taken>;
 #[cfg(feature = "verify")]
 pub type HmacSha256 = Hmac<Sha256>;
 pub type Nonce = u64;
 pub type Taken = Option<SystemTime>;
 #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct IpPair {
@@ -51,11 +54,27 @@ impl fmt::Display for IpPair {
 impl From<IpAddr> for IpPair {
    fn from(value: IpAddr) -> Self {
-        let (ipv4, ipv6) = match value {
+        let (before_last_byte, last_byte) = match value {
-            IpAddr::V4(ipv4) => (ipv4, authenticator_ipv4_to_ipv6(ipv4)),
+            IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            IpAddr::V6(ipv6_addr) => (authenticator_ipv6_to_ipv4(ipv6_addr), ipv6_addr),
+            IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
        };
-
+        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
        let ipv4 = Ipv4Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
            before_last_byte,
            last_byte,
        );
        let ipv6 = Ipv6Addr::new(
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
            last_bytes,
        );
        IpPair::new(ipv4, ipv6)
    }
 }
@@ -1,16 +1,8 @@
 [package]
 name = "nym-bandwidth-controller"
-description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
+version = "0.1.0"
 version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -20,14 +12,14 @@ log = { workspace = true }
 rand = { workspace = true }
 thiserror = { workspace = true }
-nym-credential-storage = { workspace = true }
+nym-credential-storage = { path = "../credential-storage" }
-nym-credentials = { workspace = true }
+nym-credentials = { path = "../credentials" }
-nym-credentials-interface = { workspace = true }
+nym-credentials-interface = { path = "../credentials-interface" }
-nym-crypto = { workspace = true, features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
+nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "stream_cipher", "aes", "hashing"] }
-nym-ecash-time = { workspace = true }
+nym-ecash-time = { path = "../ecash-time" }
-nym-task = { workspace = true }
+nym-task = { path = "../task" }
-nym-validator-client = { workspace = true }
+nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
-workspace = true
+path = "../client-libs/validator-client"
 features = ["http-client"]
@@ -34,7 +34,7 @@ where
    let signing_key = ed25519::PrivateKey::new(&mut rng);
    let expiration = expiration.unwrap_or_else(ecash_default_expiration_date);
-    let deposit_amount = client.get_default_deposit_amount().await?;
+    let deposit_amount = client.get_required_deposit_amount().await?;
    info!("we'll need to deposit {deposit_amount} to obtain the ticketbook");
    let result = client
        .make_ticketbook_deposit(
@@ -28,7 +28,6 @@ pub use traits::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND};
 pub mod acquire;
 pub mod error;
 mod event;
 pub mod mock;
 mod traits;
 mod utils;
@@ -1,124 +0,0 @@
 // Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 #![allow(clippy::expect_used)]
 use crate::error::BandwidthControllerError;
 use crate::{BandwidthTicketProvider, PreparedCredential, PreparedCredentialMetadata};
 use async_trait::async_trait;
 use nym_credentials_interface::{CredentialSpendingData, TicketType};
 use nym_crypto::asymmetric::ed25519::PublicKey;
 use nym_ecash_time::OffsetDateTime;
 #[derive(Default)]
 pub struct MockBandwidthController {
    // TODO: inject proper bls381 keys and just sign credentials
    //
 }
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl BandwidthTicketProvider for MockBandwidthController {
    async fn get_ecash_ticket(
        &self,
        ticket_type: TicketType,
        _gateway_id: PublicKey,
        tickets_to_spend: u32,
    ) -> Result<PreparedCredential, BandwidthControllerError> {
        assert_eq!(tickets_to_spend, 1);
        // This is a valid serialized CredentialSpendingData taken from integration tests
        // See: common/wireguard-private-metadata/tests/src/lib.rs:CREDENTIAL_BYTES
        const CREDENTIAL_BYTES: [u8; 1245] = [
            0, 0, 4, 133, 96, 179, 223, 185, 136, 23, 213, 166, 59, 203, 66, 69, 209, 181, 227,
            254, 16, 102, 98, 237, 59, 119, 170, 111, 31, 194, 51, 59, 120, 17, 115, 229, 79, 91,
            11, 139, 154, 2, 212, 23, 68, 70, 167, 3, 240, 54, 224, 171, 221, 1, 69, 48, 60, 118,
            119, 249, 123, 35, 172, 227, 131, 96, 232, 209, 187, 123, 4, 197, 102, 90, 96, 45, 125,
            135, 140, 99, 1, 151, 17, 131, 143, 157, 97, 107, 139, 232, 212, 87, 14, 115, 253, 255,
            166, 167, 186, 43, 90, 96, 173, 105, 120, 40, 10, 163, 250, 224, 214, 200, 178, 4, 160,
            16, 130, 59, 76, 193, 39, 240, 3, 101, 141, 209, 183, 226, 186, 207, 56, 210, 187, 7,
            164, 240, 164, 205, 37, 81, 184, 214, 193, 195, 90, 205, 238, 225, 195, 104, 12, 123,
            203, 57, 233, 243, 215, 145, 195, 196, 57, 38, 125, 172, 18, 47, 63, 165, 110, 219,
            180, 40, 58, 116, 92, 254, 160, 98, 48, 92, 254, 232, 107, 184, 80, 234, 60, 160, 235,
            249, 76, 41, 38, 165, 28, 40, 136, 74, 48, 166, 50, 245, 23, 201, 140, 101, 79, 93,
            235, 128, 186, 146, 126, 180, 134, 43, 13, 186, 19, 195, 48, 168, 201, 29, 216, 95,
            176, 198, 132, 188, 64, 39, 212, 150, 32, 52, 53, 38, 228, 199, 122, 226, 217, 75, 40,
            191, 151, 48, 164, 242, 177, 79, 14, 122, 105, 151, 85, 88, 199, 162, 17, 96, 103, 83,
            178, 128, 9, 24, 30, 74, 108, 241, 85, 240, 166, 97, 241, 85, 199, 11, 198, 226, 234,
            70, 107, 145, 28, 208, 114, 51, 12, 234, 108, 101, 202, 112, 48, 185, 22, 159, 67, 109,
            49, 27, 149, 90, 109, 32, 226, 112, 7, 201, 208, 209, 104, 31, 97, 134, 204, 145, 27,
            181, 206, 181, 106, 32, 110, 136, 115, 249, 201, 111, 5, 245, 203, 71, 121, 169, 126,
            151, 178, 236, 59, 221, 195, 48, 135, 115, 6, 50, 227, 74, 97, 107, 107, 213, 90, 2,
            203, 154, 138, 47, 128, 52, 134, 128, 224, 51, 65, 240, 90, 8, 55, 175, 180, 178, 204,
            206, 168, 110, 51, 57, 189, 169, 48, 169, 136, 121, 99, 51, 170, 178, 214, 74, 1, 96,
            151, 167, 25, 173, 180, 171, 155, 10, 55, 142, 234, 190, 113, 90, 79, 80, 244, 71, 166,
            30, 235, 113, 150, 133, 1, 218, 17, 109, 111, 223, 24, 216, 177, 41, 2, 204, 65, 221,
            212, 207, 236, 144, 6, 65, 224, 55, 42, 1, 1, 161, 134, 118, 127, 111, 220, 110, 127,
            240, 71, 223, 129, 12, 93, 20, 220, 60, 56, 71, 146, 184, 95, 132, 69, 28, 56, 53, 192,
            213, 22, 119, 230, 152, 225, 182, 188, 163, 219, 37, 175, 247, 73, 14, 247, 38, 72,
            243, 1, 48, 131, 59, 8, 13, 96, 143, 185, 127, 241, 161, 217, 24, 149, 193, 40, 16, 30,
            202, 151, 28, 119, 240, 153, 101, 156, 61, 193, 72, 245, 199, 181, 12, 231, 65, 166,
            67, 142, 121, 207, 202, 58, 197, 113, 188, 248, 42, 124, 105, 48, 161, 241, 55, 209,
            36, 194, 27, 63, 233, 144, 189, 85, 117, 234, 9, 139, 46, 31, 206, 114, 95, 131, 29,
            240, 13, 81, 142, 140, 133, 33, 30, 41, 141, 37, 80, 217, 95, 221, 76, 115, 86, 201,
            165, 51, 252, 9, 28, 209, 1, 48, 150, 74, 248, 212, 187, 222, 66, 210, 3, 200, 19, 217,
            171, 184, 42, 148, 53, 150, 57, 50, 6, 227, 227, 62, 49, 42, 148, 148, 157, 82, 191,
            58, 24, 34, 56, 98, 120, 89, 105, 176, 85, 15, 253, 241, 41, 153, 195, 136, 1, 48, 142,
            126, 213, 101, 223, 79, 133, 230, 105, 38, 161, 149, 2, 21, 136, 150, 42, 72, 218, 85,
            146, 63, 223, 58, 108, 186, 183, 248, 62, 20, 47, 34, 113, 160, 177, 204, 181, 16, 24,
            212, 224, 35, 84, 51, 168, 56, 136, 11, 1, 48, 135, 242, 62, 149, 230, 178, 32, 224,
            119, 26, 234, 163, 237, 224, 114, 95, 112, 140, 170, 150, 96, 125, 136, 221, 180, 78,
            18, 11, 12, 184, 2, 198, 217, 119, 43, 69, 4, 172, 109, 55, 183, 40, 131, 172, 161, 88,
            183, 101, 1, 48, 173, 216, 22, 73, 42, 255, 211, 93, 249, 87, 159, 115, 61, 91, 55,
            130, 17, 216, 60, 34, 122, 55, 8, 244, 244, 153, 151, 57, 5, 144, 178, 55, 249, 64,
            211, 168, 34, 148, 56, 89, 92, 203, 70, 124, 219, 152, 253, 165, 0, 32, 203, 116, 63,
            7, 240, 222, 82, 86, 11, 149, 167, 72, 224, 55, 190, 66, 201, 65, 168, 184, 96, 47,
            194, 241, 168, 124, 7, 74, 214, 250, 37, 76, 32, 218, 69, 122, 103, 215, 145, 169, 24,
            212, 229, 168, 106, 10, 144, 31, 13, 25, 178, 242, 250, 106, 159, 40, 48, 163, 165, 61,
            130, 57, 146, 4, 73, 32, 254, 233, 125, 135, 212, 29, 111, 4, 177, 114, 15, 210, 170,
            82, 108, 110, 62, 166, 81, 209, 106, 176, 156, 14, 133, 242, 60, 127, 120, 242, 28, 97,
            0, 1, 32, 103, 93, 109, 89, 240, 91, 1, 84, 150, 50, 206, 157, 203, 49, 220, 120, 234,
            175, 234, 150, 126, 225, 94, 163, 164, 199, 138, 114, 62, 99, 106, 112, 1, 32, 171, 40,
            220, 82, 241, 203, 76, 146, 111, 139, 182, 179, 237, 182, 115, 75, 128, 201, 107, 43,
            214, 0, 135, 217, 160, 68, 150, 232, 144, 114, 237, 98, 32, 30, 134, 232, 59, 93, 163,
            253, 244, 13, 202, 52, 147, 168, 83, 121, 123, 95, 21, 210, 209, 225, 223, 143, 49, 10,
            205, 238, 1, 22, 83, 81, 70, 1, 32, 26, 76, 6, 234, 160, 50, 139, 102, 161, 232, 155,
            106, 130, 171, 226, 210, 233, 178, 85, 247, 71, 123, 55, 53, 46, 67, 148, 137, 156,
            207, 208, 107, 1, 32, 102, 31, 4, 98, 110, 156, 144, 61, 229, 140, 198, 84, 196, 238,
            128, 35, 131, 182, 137, 125, 241, 95, 69, 131, 170, 27, 2, 144, 75, 72, 242, 102, 3,
            32, 121, 80, 45, 173, 56, 65, 218, 27, 40, 251, 197, 32, 169, 104, 123, 110, 90, 78,
            153, 166, 38, 9, 129, 228, 99, 8, 1, 116, 142, 233, 162, 69, 32, 216, 169, 159, 116,
            95, 12, 63, 176, 195, 6, 183, 123, 135, 75, 61, 112, 106, 83, 235, 176, 41, 27, 248,
            48, 71, 165, 170, 12, 92, 103, 103, 81, 32, 58, 74, 75, 145, 192, 94, 153, 69, 80, 128,
            241, 3, 16, 117, 192, 86, 161, 103, 44, 174, 211, 196, 182, 124, 55, 11, 107, 142, 49,
            88, 6, 41, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
            6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
            6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 0, 37, 139, 240, 0, 0, 0, 0, 0,
            0, 0, 1,
        ];
        let mut credential = CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES)
            .expect("Failed to deserialize test credential - this is a bug in the test harness");
        // change the ticket type to the requested ticket
        // note that verification outside mocks is going to fail
        credential.payment.t_type = ticket_type.to_repr() as u8;
        // Update spend_date to today to pass validation
        credential.spend_date = OffsetDateTime::now_utc().date();
        Ok(PreparedCredential {
            data: credential,
            epoch_id: 0,
            metadata: PreparedCredentialMetadata {
                ticketbook_id: 0,
                tickets_withdrawn: 1,
                used_tickets: 0,
            },
        })
    }
    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError> {
        Ok(None)
    }
 }
@@ -57,22 +57,3 @@ where
        Ok(Some(token))
    }
 }
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl<T: BandwidthTicketProvider + ?Sized + Send> BandwidthTicketProvider for Box<T> {
    async fn get_ecash_ticket(
        &self,
        ticket_type: TicketType,
        gateway_id: ed25519::PublicKey,
        tickets_to_spend: u32,
    ) -> Result<PreparedCredential, BandwidthControllerError> {
        (**self)
            .get_ecash_ticket(ticket_type, gateway_id, tickets_to_spend)
            .await
    }
    async fn get_upgrade_mode_token(&self) -> Result<Option<String>, BandwidthControllerError> {
        (**self).get_upgrade_mode_token().await
    }
 }
@@ -1,16 +1,11 @@
 [package]
 name = "nym-bin-common"
 version = "0.6.0"
 description = "Common code for nym binaries"
 version.workspace = true
 authors = { workspace = true }
 edition = { workspace = true }
 authors = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 [dependencies]
 clap = { workspace = true, features = ["derive"], optional = true }
@@ -24,15 +19,12 @@ serde_json = { workspace = true, optional = true }
 ## tracing
 tracing-subscriber = { workspace = true, features = ["env-filter"], optional = true }
 tracing-tree = { workspace = true, optional = true }
 tracing = { workspace = true, optional = true }
 opentelemetry-jaeger = { workspace = true, features = ["rt-tokio", "collector_client", "isahc_collector_client"], optional = true }
 tracing-opentelemetry = { workspace = true, optional = true }
 utoipa = { workspace = true, optional = true }
-opentelemetry = { workspace = true, features = ["trace"], optional = true }
+opentelemetry = { workspace = true, features = ["rt-tokio"], optional = true }
 ## otel-otlp (modern OTLP export to SigNoz/any OTLP collector)
 opentelemetry_sdk = { workspace = true, features = ["trace"], optional = true }
 opentelemetry-otlp = { workspace = true, features = ["grpc-tonic", "trace", "tls-roots"], optional = true }
 tonic = { workspace = true, optional = true }
 [build-dependencies]
@@ -43,15 +35,13 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json", "dep:clap"]
 bin_info_schema = ["schemars"]
-ip_check = []
+basic_tracing = ["dep:tracing", "tracing-subscriber"]
-basic_tracing = ["dep:tracing", "dep:tracing-subscriber"]
+tracing = [
 otel-otlp = [
    "basic_tracing",
-    "dep:opentelemetry",
+    "tracing-tree",
-    "dep:opentelemetry_sdk",
+    "opentelemetry-jaeger",
-    "dep:opentelemetry-otlp",
+    "tracing-opentelemetry",
-    "dep:tracing-opentelemetry",
+    "opentelemetry",
    "dep:tonic",
 ]
 clap = ["dep:clap", "dep:clap_complete", "dep:clap_complete_fig"]
 models = []
@@ -124,10 +124,6 @@ impl BinaryBuildInformation {
    }
 }
 // to whoever is thinking of modifying this struct.
 // you MUST NOT change its structure in any way - adding, removing or changing fields
 // otherwise, it will break old clients as bincode serialisation is not backwards compatible
 // even if you put `#[serde(default)]` all over the place
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 #[cfg_attr(feature = "bin_info_schema", derive(schemars::JsonSchema))]
@@ -9,6 +9,3 @@ pub mod completions;
 #[cfg(feature = "output_format")]
 pub mod output_format;
 #[cfg(feature = "ip_check")]
 pub mod ip_check;
@@ -4,9 +4,16 @@
 use serde::{Deserialize, Serialize};
 use std::io::IsTerminal;
-// Re-export tracing_subscriber for consumers that need to compose layers
+#[cfg(feature = "tracing")]
-#[cfg(feature = "basic_tracing")]
+pub use opentelemetry;
 #[cfg(feature = "tracing")]
 pub use opentelemetry_jaeger;
 #[cfg(feature = "tracing")]
 pub use tracing_opentelemetry;
 #[cfg(feature = "tracing")]
 pub use tracing_subscriber;
 #[cfg(feature = "tracing")]
 pub use tracing_tree;
 #[derive(Debug, Default, Copy, Clone, Deserialize, PartialEq, Eq, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -62,106 +69,40 @@ pub fn setup_tracing_logger() {
    build_tracing_logger().init()
 }
-/// Initialize an OpenTelemetry tracing layer that exports spans via OTLP/gRPC.
+// TODO: This has to be a macro, running it as a function does not work for the file_appender for some reason
-///
+#[cfg(feature = "tracing")]
-/// This produces a layer compatible with `tracing_subscriber::registry()` that
+#[macro_export]
-/// sends traces to any OTLP-compatible collector (SigNoz, Grafana Tempo, etc).
+macro_rules! setup_tracing {
-///
+    ($service_name: expr) => {
-/// Returns both the tracing layer and the [`SdkTracerProvider`] so the caller
+        use nym_bin_common::logging::tracing_subscriber::layer::SubscriberExt;
-/// can invoke [`SdkTracerProvider::shutdown`] for graceful flush on exit.
+        use nym_bin_common::logging::tracing_subscriber::util::SubscriberInitExt;
 ///
 /// # Arguments
 /// * `service_name` - The service name reported to the collector (e.g. "nym-node")
 /// * `endpoint` - The OTLP/gRPC collector endpoint (e.g. "http://localhost:4317"
 ///   or "https://ingest.eu.signoz.cloud:443" for SigNoz Cloud)
 /// * `ingestion_key` - Optional SigNoz Cloud ingestion key. When provided, it is
 ///   sent as the `signoz-ingestion-key` gRPC metadata header on every export.
 /// * `environment` - Deployment environment label (e.g. "sandbox", "mainnet", "canary").
 ///   Attached as the `deployment.environment` OTel resource attribute.
 /// * `sample_ratio` - Trace sampling ratio in 0.0..=1.0 (e.g. 0.1 = 10% of traces).
 ///   Used to limit cost when exporting from many nodes; clamped to [0.0, 1.0].
 /// * `export_timeout_secs` - Timeout in seconds for each OTLP export batch. Prevents
 ///   unbounded blocking if the collector is slow or unreachable.
 #[cfg(feature = "otel-otlp")]
 pub fn init_otel_layer<S>(
    service_name: &str,
    endpoint: &str,
    ingestion_key: Option<&str>,
    environment: &str,
    sample_ratio: f64,
    export_timeout_secs: u64,
 ) -> Result<
    (
        tracing_opentelemetry::OpenTelemetryLayer<S, opentelemetry_sdk::trace::SdkTracer>,
        opentelemetry_sdk::trace::SdkTracerProvider,
    ),
    Box<dyn std::error::Error + Send + Sync>,
 >
 where
    S: tracing::Subscriber + for<'a> tracing_subscriber::registry::LookupSpan<'a>,
 {
    use opentelemetry::trace::TracerProvider as _;
    use opentelemetry_otlp::WithExportConfig;
    use opentelemetry_otlp::WithTonicConfig;
    use opentelemetry_sdk::trace::Sampler;
    use std::time::Duration;
-    // Validate endpoint URI early to fail with a clear message
+        let registry = nym_bin_common::logging::tracing_subscriber::Registry::default()
-    if !endpoint.starts_with("http://") && !endpoint.starts_with("https://") {
+            .with(nym_bin_common::logging::tracing_subscriber::EnvFilter::from_default_env())
-        return Err(format!(
+            .with(
-            "invalid OTLP endpoint URI: {endpoint} (must start with http:// or https://)"
+                nym_bin_common::logging::tracing_tree::HierarchicalLayer::new(4)
-        )
+                    .with_targets(true)
-        .into());
+                    .with_bracketed_fields(true),
-    }
+            );
-    let sample_ratio_clamped = sample_ratio.clamp(0.0, 1.0);
+        let tracer = nym_bin_common::logging::opentelemetry_jaeger::new_collector_pipeline()
            .with_endpoint("http://44.199.230.10:14268/api/traces")
            .with_service_name($service_name)
            .with_isahc()
            .with_trace_config(
                nym_bin_common::logging::opentelemetry::sdk::trace::config().with_sampler(
                    nym_bin_common::logging::opentelemetry::sdk::trace::Sampler::TraceIdRatioBased(
                        0.1,
                    ),
                ),
            )
            .install_batch(nym_bin_common::logging::opentelemetry::runtime::Tokio)
            .expect("Could not init tracer");
-    let mut builder = opentelemetry_otlp::SpanExporter::builder()
+        let telemetry = nym_bin_common::logging::tracing_opentelemetry::layer().with_tracer(tracer);
        .with_tonic()
        .with_endpoint(endpoint)
        .with_timeout(Duration::from_secs(export_timeout_secs));
-    // Explicitly configure TLS when the endpoint uses HTTPS
+        registry.with(telemetry).init();
-    if endpoint.starts_with("https://") {
+    };
        builder =
            builder.with_tls_config(tonic::transport::ClientTlsConfig::new().with_native_roots());
    }
    if let Some(key) = ingestion_key {
        let mut metadata = tonic::metadata::MetadataMap::new();
        metadata.insert(
            "signoz-ingestion-key",
            key.parse()
                .map_err(|_| "invalid ingestion key format (value redacted)")?,
        );
        builder = builder.with_metadata(metadata);
    }
    let exporter = builder
        .build()
        .map_err(|e| format!("failed to build OTLP exporter for endpoint {endpoint}: {e}"))?;
    let tracer_provider = opentelemetry_sdk::trace::SdkTracerProvider::builder()
        .with_sampler(Sampler::TraceIdRatioBased(sample_ratio_clamped))
        .with_batch_exporter(exporter)
        .with_resource(
            opentelemetry_sdk::Resource::builder()
                .with_service_name(service_name.to_owned())
                .with_attribute(opentelemetry::KeyValue::new(
                    "deployment.environment",
                    environment.to_owned(),
                ))
                .build(),
        )
        .build();
    opentelemetry::global::set_tracer_provider(tracer_provider.clone());
    let tracer = tracer_provider.tracer(service_name.to_owned());
    Ok((
        tracing_opentelemetry::layer().with_tracer(tracer),
        tracer_provider,
    ))
 }
 pub fn banner(crate_name: &str, crate_version: &str) -> String {
@@ -1,16 +1,10 @@
 [package]
 name = "nym-client-core"
-description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
+version = "1.1.15"
 version.workspace = true
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
-edition = "2024"
+edition = "2021"
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version = "1.85"
-readme.workspace = true
+license.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -37,32 +31,32 @@ tracing = { workspace = true }
 zeroize = { workspace = true }
 # internal
-nym-id = { workspace = true }
+nym-id = { path = "../nym-id" }
-nym-bandwidth-controller = { workspace = true }
+nym-bandwidth-controller = { path = "../bandwidth-controller" }
-nym-crypto = { workspace = true }
+nym-crypto = { path = "../crypto" }
-nym-gateway-client = { workspace = true }
+nym-gateway-client = { path = "../client-libs/gateway-client" }
-nym-gateway-requests = { workspace = true }
+nym-gateway-requests = { path = "../gateway-requests" }
-nym-http-api-client = { workspace = true, features = ["network-defaults"] }
+nym-http-api-client = { path = "../http-api-client", features = ["network-defaults"] }
-nym-nonexhaustive-delayqueue = { workspace = true }
+nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
-nym-sphinx = { workspace = true }
+nym-sphinx = { path = "../nymsphinx" }
-nym-statistics-common = { workspace = true }
+nym-statistics-common = { path = "../statistics" }
-nym-pemstore = { workspace = true }
+nym-pemstore = { path = "../pemstore" }
-nym-topology = { workspace = true, features = ["persistence"] }
+nym-topology = { path = "../topology", features = ["persistence"] }
-nym-validator-client = { workspace = true }
+nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
-nym-task = { workspace = true }
+nym-task = { path = "../task" }
-nym-credentials-interface = { workspace = true }
+nym-credentials-interface = { path = "../credentials-interface" }
-nym-credential-storage = { workspace = true }
+nym-credential-storage = { path = "../credential-storage" }
-nym-network-defaults = { workspace = true }
+nym-network-defaults = { path = "../network-defaults" }
-nym-client-core-config-types = { workspace = true, features = [
+nym-client-core-config-types = { path = "./config-types", features = [
    "disk-persistence",
 ] }
-nym-client-core-surb-storage = { workspace = true }
+nym-client-core-surb-storage = { path = "./surb-storage" }
-nym-client-core-gateways-storage = { workspace = true }
+nym-client-core-gateways-storage = { path = "./gateways-storage" }
-nym-ecash-time = { workspace = true }
+nym-ecash-time = { path = "../ecash-time" }
-nym-mixnet-contract-common = { workspace = true }
+nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies]
-nym-mixnet-client = { workspace = true }
+nym-mixnet-client = { path = "../client-libs/mixnet-client", default-features = false }
 ### For serving prometheus metrics
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
@@ -111,8 +105,8 @@ features = ["tokio"]
 workspace = true
 features = ["futures"]
-[target."cfg(target_arch = \"wasm32\")".dependencies.nym-wasm-utils]
+[target."cfg(target_arch = \"wasm32\")".dependencies.wasm-utils]
-workspace = true
+path = "../wasm/utils"
 features = ["websocket"]
 [target."cfg(target_arch = \"wasm32\")".dependencies.time]
@@ -123,10 +117,6 @@ features = ["wasm-bindgen"]
 workspace = true
 features = ["full"]
 [target."cfg(target_arch = \"wasm32\")".dependencies.getrandom03]
 workspace = true
 features = ["wasm_js"]
 [dev-dependencies]
 tempfile = { workspace = true }
@@ -1,16 +1,8 @@
 [package]
 name = "nym-client-core-config-types"
-description = "Low level configs and constants used by Nym clients and nodes"
+version = "0.1.0"
 version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -20,14 +12,14 @@ serde = { workspace = true, features = ["derive"] }
 thiserror.workspace = true
 url = { workspace = true, features = ["serde"] }
-nym-config = { workspace = true }
+nym-config = { path = "../../config" }
-nym-pemstore = { workspace = true , optional = true }
+nym-pemstore = { path = "../../pemstore", optional = true }
 # those are pulling so many deps T.T
-nym-sphinx-params = { workspace = true }
+nym-sphinx-params = { path = "../../nymsphinx/params" }
-nym-sphinx-addressing = { workspace = true }
+nym-sphinx-addressing = { path = "../../nymsphinx/addressing" }
-nym-statistics-common = { workspace = true }
+nym-statistics-common = { path = "../../statistics" }
 [features]
@@ -32,7 +32,6 @@ const DEFAULT_MIN_MIXNODE_PERFORMANCE: u8 = 50;
 const DEFAULT_MIN_GATEWAY_PERFORMANCE: u8 = 50;
 const DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD: Duration = Duration::from_secs(70 * 60); // 70min -> full epoch (1h) + a bit of overhead
 const DEFAULT_MAX_STARTUP_TOPOLOGY_WAITING_PERIOD: Duration = Duration::from_secs(70 * 60); // 70min -> full epoch (1h) + a bit of overhead
 // Set this to a high value for now, so that we don't risk sporadic timeouts that might cause
 // bought bandwidth tokens to not have time to be spent; Once we remove the gateway from the
@@ -556,11 +555,6 @@ pub struct Topology {
    #[serde(with = "humantime_serde")]
    pub max_startup_gateway_waiting_period: Duration,
    /// Defines how long the client is going to wait on startup for minimal topology to become online,
    /// before abandoning the procedure.
    #[serde(with = "humantime_serde")]
    pub max_startup_network_waiting_period: Duration,
    /// Specifies a minimum performance of a mixnode that is used on route construction.
    /// This setting is only applicable when `NymApi` topology is used.
    pub minimum_mixnode_performance: u8,
@@ -589,7 +583,6 @@ impl Default for Topology {
            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
            disable_refreshing: false,
            max_startup_gateway_waiting_period: DEFAULT_MAX_STARTUP_GATEWAY_WAITING_PERIOD,
            max_startup_network_waiting_period: DEFAULT_MAX_STARTUP_TOPOLOGY_WAITING_PERIOD,
            minimum_mixnode_performance: DEFAULT_MIN_MIXNODE_PERFORMANCE,
            minimum_gateway_performance: DEFAULT_MIN_GATEWAY_PERFORMANCE,
            use_extended_topology: false,
@@ -159,7 +159,6 @@ impl From<ConfigV6> for Config {
                    use_extended_topology: value.debug.topology.use_extended_topology,
                    ignore_egress_epoch_role: value.debug.topology.ignore_egress_epoch_role,
                    ignore_ingress_epoch_role: value.debug.topology.ignore_ingress_epoch_role,
                    ..Default::default()
                },
                reply_surbs: ReplySurbs {
                    minimum_reply_surb_storage_threshold: value
@@ -1,16 +1,9 @@
 [package]
 name = "nym-client-core-gateways-storage"
-description = "Functionality for Nym clients to store and retrive Gateway connections"
+version = "0.1.0"
 version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
 rust-version.workspace = true
 readme.workspace = true
 publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -24,9 +17,9 @@ tracing.workspace = true
 url.workspace = true
 zeroize = { workspace = true, features = ["zeroize_derive"] }
-nym-crypto = { workspace = true, features = ["asymmetric"] }
+nym-crypto = { path = "../../crypto", features = ["asymmetric"] }
-nym-gateway-requests = { workspace = true}
+nym-gateway-requests = { path = "../../gateway-requests" }
-nym-gateway-client = { workspace = true}
+nym-gateway-client = { path = "../../client-libs/gateway-client" }
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
@@ -160,10 +160,7 @@ where
        )
        .await?;
    } else {
-        info!(
+        info!("registered with new gateway {} (under address {address}), but this will not be our default address", gateway_details.gateway_id);
            "registered with new gateway {} (under address {address}), but this will not be our default address",
            gateway_details.gateway_id
        );
    }
    Ok(GatewayInfo {
@@ -4,13 +4,13 @@
 use super::mix_traffic::ClientRequestSender;
 use super::received_buffer::ReceivedBufferMessage;
 use super::statistics_control::StatisticsControl;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
 use crate::client::event_control::EventControl;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
 use crate::client::key_manager::ClientKeys;
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController, MixTrafficEvent};
 use crate::client::real_messages_control;
@@ -52,12 +52,12 @@ use nym_sphinx::addressing::nodes::NodeIdentity;
 use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_statistics_common::clients::ClientStatsSender;
 use nym_statistics_common::generate_client_stats_id;
 use nym_task::ShutdownTracker;
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
-use nym_topology::HardcodedTopologyProvider;
+use nym_task::ShutdownTracker;
 use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nym_api::NymApiClientExt;
-use nym_validator_client::{UserAgent, nyxd::contract_traits::DkgQueryClient};
+use nym_validator_client::{nyxd::contract_traits::DkgQueryClient, UserAgent};
 use rand::prelude::SliceRandom;
 use rand::rngs::OsRng;
 use rand::thread_rng;
@@ -71,7 +71,7 @@ use url::Url;
 #[cfg(target_arch = "wasm32")]
 #[cfg(debug_assertions)]
-use nym_wasm_utils::console_log;
+use wasm_utils::console_log;
 /// Default number of retries for Nym API requests when using network details with domain fronting.
 /// This allows the client to try alternative URLs if the primary endpoint is unavailable.
@@ -220,7 +220,6 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
    nym_api_urls: Option<Vec<nym_network_defaults::ApiUrl>>,
    wait_for_gateway: bool,
    wait_for_initial_topology: bool,
    custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
    custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
    shutdown: Option<ShutdownTracker>,
@@ -251,7 +250,6 @@ where
            dkg_query_client,
            nym_api_urls: None,
            wait_for_gateway: false,
            wait_for_initial_topology: false,
            custom_topology_provider: None,
            custom_gateway_transceiver: None,
            shutdown: None,
@@ -307,12 +305,6 @@ where
        self
    }
    #[must_use]
    pub fn with_wait_for_initial_topology(mut self, wait_for_initial_topology: bool) -> Self {
        self.wait_for_initial_topology = wait_for_initial_topology;
        self
    }
    #[must_use]
    pub fn with_topology_provider(
        mut self,
@@ -682,7 +674,6 @@ where
        topology_accessor: TopologyAccessor,
        local_gateway: NodeIdentity,
        wait_for_gateway: bool,
        wait_for_initial_topology: bool,
        shutdown_tracker: &ShutdownTracker,
    ) -> Result<(), ClientCoreError> {
        let topology_refresher_config =
@@ -703,46 +694,6 @@ where
        tracing::info!("Obtaining initial network topology");
        topology_refresher.try_refresh().await;
        // 1. wait for the minimum topology (if applicable)
        if topology_refresher
            .ensure_topology_is_routable()
            .await
            .is_err()
            && wait_for_initial_topology
        {
            if let Err(err) = topology_refresher
                .wait_for_initial_network(topology_config.max_startup_network_waiting_period)
                .await
            {
                tracing::error!(
                    "the network did not come become online within the specified timeout: {err}"
                );
                return Err(err.into());
            }
        }
        // 2. wait for our gateway (if applicable)
        if topology_refresher
            .ensure_contains_routable_egress(local_gateway)
            .await
            .is_err()
            && wait_for_gateway
        {
            if let Err(err) = topology_refresher
                .wait_for_gateway(
                    local_gateway,
                    topology_config.max_startup_gateway_waiting_period,
                )
                .await
            {
                tracing::error!(
                    "the gateway did not come back online within the specified timeout: {err}"
                );
                return Err(err.into());
            }
        }
        // 3. check if the topology is routable (in case we were NOT waiting for it)
        if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
            tracing::error!(
                "The current network topology seem to be insufficient to route any packets through \
@@ -751,15 +702,30 @@ where
            return Err(ClientCoreError::InsufficientNetworkTopology(err));
        }
-        // 4. check if the gateway exists (in case we were NOT waiting for it)
+        let gateway_wait_timeout = if wait_for_gateway {
            Some(topology_config.max_startup_gateway_waiting_period)
        } else {
            None
        };
        if let Err(err) = topology_refresher
            .ensure_contains_routable_egress(local_gateway)
            .await
        {
-            tracing::error!(
+            if let Some(waiting_timeout) = gateway_wait_timeout {
-                "the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}"
+                if let Err(err) = topology_refresher
-            );
+                    .wait_for_gateway(local_gateway, waiting_timeout)
-            return Err(err.into());
+                    .await
                {
                    tracing::error!(
                        "the gateway did not come back online within the specified timeout: {err}"
                    );
                    return Err(err.into());
                }
            } else {
                tracing::error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
                return Err(err.into());
            }
        }
        if !topology_config.disable_refreshing {
@@ -1058,7 +1024,6 @@ where
            shared_topology_accessor.clone(),
            self_address.gateway(),
            self.wait_for_gateway,
            self.wait_for_initial_topology,
            &shutdown_tracker.clone(),
        )
        .await?;
@@ -1230,11 +1195,9 @@ mod tests {
        ]);
        assert_eq!(network_details.nym_api_urls.as_ref().unwrap().len(), 2);
-        assert!(
+        assert!(network_details.nym_api_urls.as_ref().unwrap()[1]
-            network_details.nym_api_urls.as_ref().unwrap()[1]
+            .front_hosts
-                .front_hosts
+            .is_some());
                .is_some()
        );
    }
    #[test]
@@ -1247,13 +1210,11 @@ mod tests {
        assert_eq!(api_url.url, "https://nym-frontdoor.vercel.app/api/");
        assert_eq!(api_url.front_hosts.as_ref().unwrap().len(), 2);
-        assert!(
+        assert!(api_url
-            api_url
+            .front_hosts
-                .front_hosts
+            .as_ref()
-                .as_ref()
+            .unwrap()
-                .unwrap()
+            .contains(&"vercel.app".to_string()));
                .contains(&"vercel.app".to_string())
        );
    }
    #[test]
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 use crate::{
-    client::replies::reply_storage::{CombinedReplyStorage, ReplyStorageBackend, fs_backend},
+    client::replies::reply_storage::{fs_backend, CombinedReplyStorage, ReplyStorageBackend},
    config,
    config::Config,
    error::ClientCoreError,
@@ -10,7 +10,7 @@ use crate::{
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::OnDiskGatewaysDetails;
 use nym_credential_storage::storage::Storage as CredentialStorage;
-use nym_validator_client::{QueryHttpRpcNyxdClient, nyxd};
+use nym_validator_client::{nyxd, QueryHttpRpcNyxdClient};
 use std::{io, path::Path};
 use time::OffsetDateTime;
 use tracing::{error, info, trace};
@@ -24,9 +24,7 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
    let mut storage_backend = match fs_backend::Backend::init(db_path).await {
        Ok(backend) => backend,
        Err(err) => {
-            error!(
+            error!("setup_fresh_backend: Failed to setup persistent storage backend for our reply needs: {err}");
                "setup_fresh_backend: Failed to setup persistent storage backend for our reply needs: {err}"
            );
            return Err(ClientCoreError::SurbStorageError {
                source: Box::new(err),
            });
@@ -95,9 +93,7 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
        match fs_backend::Backend::try_load(db_path).await {
            Ok(backend) => Ok(backend),
            Err(err) => {
-                error!(
+                error!("setup_fs_reply_surb_backend: Failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
                    "setup_fs_reply_surb_backend: Failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future"
                );
                archive_corrupted_database(db_path).await?;
                setup_fresh_backend(db_path, surb_config).await
            }
@@ -1,8 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 use crate::client::key_manager::ClientKeys;
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::error::ClientCoreError;
 use nym_client_core_gateways_storage::{
    ActiveGateway, GatewayPublishedData, GatewayRegistration, GatewaysDetailsStore,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dynco-nym	5102df3bd3	PR feedback WIP	2026-01-13 10:51:20 +01:00
dynco-nym	7d0d5cb81e	Query full history	2026-01-13 10:51:20 +01:00
dynco-nym	dcc0ef0e47	epoch paged try_load_performance returns per kind load_measurement_kind & unit test Naming stale submission unit test & note	2026-01-13 10:51:20 +01:00
dynco-nym	df93356a23	Unit tests & minor tweaks	2026-01-13 10:51:20 +01:00
dynco-nym	b80f9de18d	Mostly everything	2026-01-13 10:51:20 +01:00