Connections timeout after 5 minutes due to IPv6 DNS queries failing on IPv6-disabled networks

[bugfix] Distinguish authenticator errors by credential spent (#6176 ) (#6192 )
* distinguish authenticator errors by credential spent * nitpicking fixes * fix CI to see those changes * error naming Co-authored-by: Simon Wicky <simon@nymtech.net>
2025-11-14 11:55:38 +01:00 · 2025-11-12 14:13:09 +02:00 · 2025-11-12 12:47:46 +01:00 · 2025-11-12 12:06:37 +01:00 · 2025-11-06 17:35:58 -07:00 · 2025-11-06 17:08:33 -07:00
2928 changed files with 120974 additions and 261238 deletions
@@ -1,2 +0,0 @@
-[target.wasm32-unknown-unknown]
-rustflags = ["--cfg=getrandom_backend=\"wasm_js\""]
@@ -3,5 +3,4 @@
 .gitignore
 **/node_modules
 **/target
-target-otel
 dist
@@ -1,5 +1,2 @@
 nym-validator-rewarder/.sqlx/** diff=nodiff
 nym-node-status-api/nym-node-status-api/.sqlx/** diff=nodiff
-
-# Use bd merge for beads JSONL files
-.beads/beads.jsonl merge=beads
@@ -25,7 +25,7 @@ Steps to reproduce the behaviour, if you're familiar with BDD syntax, please wri

 *An example:*
 - Given I was setting up a mix-node following the instructions in the docs
- And I successfully bonded my node via the wallet
+- And I successfully bonded my node via the the wallet
 - When I went to start my mixnode
 - Then I was presented with an error

@@ -9,7 +9,7 @@ jobs:

    steps:
      - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Set up Build Environment
        run: sudo apt-get update && sudo apt-get install -y make dpkg-dev
@@ -25,14 +25,14 @@ jobs:
          echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV

      - name: Upload nym-repo-setup
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.file1 }}
          path: ppa/packages/nym-repo-setup*.deb
          retention-days: 10

      - name: Upload nym-vpn
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.file2 }}
          path: ppa/packages/nym-vpn*.deb
@@ -6,48 +6,41 @@ on:
 jobs:
  build:
    runs-on: arc-ubuntu-22.04
-    env:
-      NEXT_PUBLIC_SITE_URL: https://nym.com/docs
    defaults:
      run:
        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
+      - name: Install pip3
+        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
-        run: sudo apt install -y python3-pandas python3-tabulate
+        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
+        uses: pnpm/action-setup@v4.1.0
        with:
-          version: 11.1.2
+          version: 9
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
-      - name: Install Rust toolchain
+          node-version: 20
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --workspace --release

-      - name: Verify doc versions
-        run: ${{ github.workspace }}/documentation/scripts/verify-doc-versions.sh
-        working-directory: ${{ github.workspace }}
      - name: Install project dependencies
        run: pnpm i
-      - name: Generate llms-full.txt
-        run: pnpm run generate:llms
      - name: Build project
        run: pnpm run build
-      - name: Generate sitemap
-        run: npx next-sitemap
      - name: Move files to /dist/
        run: ../scripts/move-to-dist.sh

@@ -37,16 +37,16 @@ jobs:

    runs-on: ${{ matrix.platform }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install jq vim libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
        continue-on-error: true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Branch name
        run: echo running on branch ${GITHUB_REF##*/}
@@ -12,21 +12,18 @@ jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
    - name: Install rsync
      run: sudo apt-get install rsync
      continue-on-error: true
    - uses: rlespinasse/github-slug-action@v3.x
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v5.0.0
-      with:
-        version: 11.1.2
    - uses: actions/setup-node@v4
      with:
-        node-version: 24
-        cache: pnpm
+        node-version: 20
+    - name: Setup yarn
+      run: npm install -g yarn
    - name: Build
-      run: pnpm install && pnpm build && pnpm build:ci:storybook
+      run: yarn && yarn build && yarn build:ci:storybook
    - name: Deploy branch to CI www (storybook)
      continue-on-error: true
      uses: easingthemes/ssh-deploy@main
@@ -3,28 +3,13 @@ name: ci-build-upload-binaries
 on:
  workflow_dispatch:
    inputs:
-      feature_profile:
-        description: "Select a predefined cargo feature profile"
-        required: false
-        default: "none"
-        type: choice
-        options:
-          - none
-          - tokio-console
-          - otel
-          - otel,tokio-console
-      extra_features:
-        description: "Additional comma-separated cargo features (e.g. feat1,feat2)"
-        required: false
-        default: ""
-        type: string
      add_tokio_unstable:
-        description: 'Force RUSTFLAGS="--cfg tokio_unstable" (auto-set when tokio-console is selected)'
-        required: false
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
        default: false
        type: boolean
      enable_deb:
-        description: "Enable cargo-deb installation and .deb package building"
+        description: "True to enable cargo-deb installation and .deb package building"
        required: false
        default: false
        type: boolean
@@ -36,14 +21,14 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [arc-ubuntu-22.04]
+        platform: [ arc-linux-latest ]

    runs-on: ${{ matrix.platform }}
    env:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -51,66 +36,42 @@ jobs:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
        run: |
          rm -rf ci-builds || true
-          mkdir -p "$OUTPUT_DIR"
-          echo "$OUTPUT_DIR"
-
+          mkdir -p $OUTPUT_DIR
+          echo $OUTPUT_DIR
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libudev-dev

-      - name: Resolve cargo features and RUSTFLAGS
-        if: github.event_name == 'workflow_dispatch'
-        shell: bash
+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
        run: |
-          FEATURES=""
-          PROFILE="${{ inputs.feature_profile }}"
-          EXTRA="${{ inputs.extra_features }}"
-
-          if [[ "$PROFILE" != "none" && -n "$PROFILE" ]]; then
-            FEATURES="$PROFILE"
-          fi
-
-          if [[ -n "$EXTRA" ]]; then
-            if [[ -n "$FEATURES" ]]; then
-              FEATURES="${FEATURES},${EXTRA}"
-            else
-              FEATURES="$EXTRA"
-            fi
-          fi
-
-          if [[ -n "$FEATURES" ]]; then
-            echo "CARGO_FEATURES=--features ${FEATURES}" >> "$GITHUB_ENV"
-            echo "::notice::Selected cargo features: $FEATURES"
-          else
-            echo "::notice::No additional cargo features selected"
-          fi
-
-          if [[ "$FEATURES" == *"tokio-console"* ]] || [[ "${{ inputs.add_tokio_unstable }}" == "true" ]]; then
-            echo "RUSTFLAGS=--cfg tokio_unstable" >> "$GITHUB_ENV"
-            echo "::notice::Enabled RUSTFLAGS --cfg tokio_unstable"
-          fi
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+          echo "RUSTFLAGS=--cfg tokio_unstable" >> $GITHUB_ENV
+          echo "CARGO_FEATURES=--features tokio-console" >> $GITHUB_ENV
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Build all binaries
-        shell: bash
-        run: cargo build --workspace --release ${{ env.CARGO_FEATURES }}
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --workspace --release ${{ env.CARGO_FEATURES }}

      - name: Install cargo-deb
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-deb
        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
-        shell: bash
-        run: cargo install cargo-deb

      - name: Build deb packages
-        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true
        shell: bash
        run: make deb
+        if: github.event_name == 'workflow_dispatch' && inputs.enable_deb == true

      - name: Upload Artifact
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: nym-binaries-artifacts
          path: |
@@ -123,22 +84,24 @@ jobs:
            target/release/nym-node
          retention-days: 30

+      # If this was a pull_request or nightly, upload to build server
+
      - name: Prepare build output
+        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
        shell: bash
        env:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
        run: |
-          cp target/release/nym-client "$OUTPUT_DIR"
-          cp target/release/nym-socks5-client "$OUTPUT_DIR"
-          cp target/release/nym-api "$OUTPUT_DIR"
-          cp target/release/nym-network-requester "$OUTPUT_DIR"
-          cp target/release/nymvisor "$OUTPUT_DIR"
-          cp target/release/nym-node "$OUTPUT_DIR"
-          cp target/release/nym-cli "$OUTPUT_DIR"
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.enable_deb }}" == "true" ]]; then
-            cp target/debian/*.deb "$OUTPUT_DIR"
+          cp target/release/nym-client $OUTPUT_DIR
+          cp target/release/nym-socks5-client $OUTPUT_DIR
+          cp target/release/nym-api $OUTPUT_DIR
+          cp target/release/nym-network-requester $OUTPUT_DIR
+          cp target/release/nymvisor $OUTPUT_DIR
+          cp target/release/nym-node $OUTPUT_DIR
+          cp target/release/nym-cli $OUTPUT_DIR
+          if [ ${{ github.event_name == 'workflow_dispatch' && inputs.enable_deb == true }} = true ]; then
+            cp target/debian/*.deb $OUTPUT_DIR
          fi
-
      - name: Deploy branch to CI www
        continue-on-error: true
        uses: easingthemes/ssh-deploy@main
@@ -1,63 +0,0 @@
-name: ci-build-upload-network-monitor-agent
-
-on:
-  workflow_dispatch:
-
-jobs:
-  build-and-upload:
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [arc-ubuntu-22.04]
-
-    runs-on: ${{ matrix.platform }}
-    env:
-      CARGO_TERM_COLOR: always
-      RUSTUP_PERMIT_COPY_RENAME: 1
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Prepare build output directory
-        shell: bash
-        env:
-          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
-        run: |
-          rm -rf ci-builds || true
-          mkdir -p "$OUTPUT_DIR"
-
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libudev-dev
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-
-      - name: Build nym-network-monitor-agent
-        shell: bash
-        run: cargo build -p nym-network-monitor-agent --release
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v6
-        with:
-          name: nym-network-monitor-agent
-          path: target/release/nym-network-monitor-agent
-          retention-days: 30
-
-      - name: Prepare build output
-        shell: bash
-        env:
-          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
-        run: cp target/release/nym-network-monitor-agent "$OUTPUT_DIR"
-
-      - name: Deploy to CI www
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-avzr"
-          SOURCE: "ci-builds/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/
-          EXCLUDE: "/dist/, /node_modules/"
@@ -0,0 +1,42 @@
+name: ci-build-vpn-api-wasm
+
+on:
+  pull_request:
+    paths:
+      - 'common/**'
+      - 'nym-credential-proxy/**'
+      - '.github/workflows/ci-build-vpn-api-wasm.yml'
+
+jobs:
+  wasm:
+    runs-on: arc-linux-latest
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTUP_PERMIT_COPY_RENAME: 1
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          target: wasm32-unknown-unknown
+          override: true
+          components: rustfmt, clippy
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'
+
+      - name: Install wasm-bindgen-cli
+        run: cargo install wasm-bindgen-cli
+
+      - name: "Build"
+        run: make
+        working-directory: nym-credential-proxy/vpn-api-lib-wasm
@@ -10,7 +10,6 @@ on:
      - 'nym-api/**'
      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
-      - 'nym-gateway-probe/**'
      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
@@ -23,6 +22,7 @@ on:
      - 'sdk/ffi/**'
      - 'sdk/rust/**'
      - 'service-providers/**'
+      - 'nym-browser-extension/storage/**'
      - 'tools/**'
      - 'wasm/**'
      - 'Cargo.toml'
@@ -54,13 +54,13 @@ jobs:
        if: contains(matrix.os, 'linux')

      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -89,7 +89,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client -- -D warnings
+          args: --workspace --all-targets --exclude nym-gateway-probe -- -D warnings

      - name: Clippy (non-macos)
        if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
@@ -103,15 +103,6 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client
-
-        # Build Go FFI-dependent crates separately (requires Go, only available on Linux CI)
-      - name: Build nym-node-status-api and nym-node-status-agent (linux only)
-        if: runner.os == 'Linux'
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: -p nym-node-status-api -p nym-node-status-agent

      - name: Build all examples
        if: contains(matrix.os, 'linux')
@@ -17,7 +17,7 @@ jobs:
          - licenses bans sources

    steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
    - uses: EmbarkStudios/cargo-deny-action@v2
      with:
        log-level: warn
@@ -3,7 +3,7 @@ name: ci-check-ns-api-version
 on:
  pull_request:
    paths:
-      - "nym-node-status-api/nym-node-status-api/**"
+      - "nym-node-status-api/**"

 env:
  WORKING_DIRECTORY: "nym-node-status-api/nym-node-status-api"
@@ -13,10 +13,10 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -10,13 +10,13 @@ env:

 jobs:
  check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -16,12 +16,12 @@ jobs:
      CARGO_TERM_COLOR: always
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Generate the schema
        run: make contract-schema
@@ -17,7 +17,7 @@ jobs:
    env:
      CARGO_TERM_COLOR: always
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -22,7 +22,7 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Setup rust
        uses: actions-rs/toolchain@v1
@@ -35,7 +35,7 @@ jobs:
          components: rustfmt, clippy

      - name: Install cosmwasm-check
-        run: cargo install cosmwasm-check --locked
+        run: cargo install cosmwasm-check

      - name: Install wasm-opt
        uses: ./.github/actions/install-wasm-opt
@@ -1,19 +0,0 @@
-name: ci-crates-preflight
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'Cargo.toml'
-      - '**/Cargo.toml'
-      - 'tools/internal/check_publish_preflight.py'
-      - '.github/workflows/ci-crates-preflight.yml'
-
-jobs:
-  preflight:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Preflight publish checks
-        run: python3 tools/internal/check_publish_preflight.py
@@ -1,123 +0,0 @@
-name: Publish to crates.io (dry run)
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish (e.g. 1.21.0)"
-        required: true
-        type: string
-
-env:
-  CI_BOT_AUTHOR: "Nym bot"
-  CI_BOT_EMAIL: "nym-bot@users.noreply.github.com"
-
-jobs:
-  publish-dry-run:
-    runs-on: arc-linux-latest
-    timeout-minutes: 35
-    env:
-      RUSTUP_PERMIT_COPY_RENAME: 1
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Configure git identity
-        run: |
-          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
-          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Validate version format
-        run: |
-          if ! npx semver "${{ inputs.version }}"; then
-            echo "Error: '${{ inputs.version }}' is not valid semver"
-            exit 1
-          fi
-
-      - name: Get current version
-        id: current_version
-        run: |
-          VERSION=$(grep -oP '^\s*version\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Cargo.toml | head -1)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update workspace dependencies
-        run: |
-          # Match any semver version on lines with `path = `, not just the current workspace version.
-          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
-
-      - name: Bump versions (local only)
-        run: |
-          cargo workspaces version custom ${{ inputs.version }} \
-            --no-git-commit \
-            --yes
-
-      - name: Preflight publish checks
-        run: |
-          python3 tools/internal/check_publish_preflight.py
-
-      # Dry run may show cascading dependency errors because packages aren't
-      # actually uploaded - these are expected and ignored. We check for real
-      # errors like packaging failures, missing metadata, or invalid Cargo.toml.
-      - name: Publish (dry run)
-        run: |
-          set +e
-          publish_status=1
-          max_attempts=2
-          attempt=1
-          rm -f /tmp/publish-dry-run.log
-
-          while [ "$attempt" -le "$max_attempts" ]; do
-            echo "Dry-run publish attempt ${attempt}/${max_attempts}"
-            cargo workspaces publish --dry-run --allow-dirty 2>&1 | tee /tmp/publish-dry-run.log
-            publish_status=${PIPESTATUS[0]}
-
-            if [ "$publish_status" -eq 0 ]; then
-              break
-            fi
-
-            # Retry once for interruption/runner issues.
-            if [ "$attempt" -lt "$max_attempts" ] && \
-              { [ "$publish_status" -eq 130 ] || [ "$publish_status" -eq 137 ]; }; then
-              echo "Publish dry-run interrupted (exit ${publish_status}), retrying in 10s..."
-              sleep 10
-              attempt=$((attempt + 1))
-              continue
-            fi
-
-            break
-          done
-          set -e
-
-          if grep -Eiq \
-            "failed to verify manifest|failed to parse manifest|invalid Cargo.toml|error: package .* has no (description|license|repository)" \
-            /tmp/publish-dry-run.log; then
-            echo "Detected real packaging/manifest errors"
-            exit 1
-          fi
-
-          # In dry-run mode, non-zero publish status is expected due to
-          # dependency-cascade failures against crates.io index.
-          if [ "$publish_status" -ne 0 ]; then
-            echo "Dry-run publish returned non-zero (${publish_status}) but no real manifest blockers were detected."
-          fi
-
-          echo "Only expected dry-run dependency cascade errors detected (if any)."
-
-      # Show the list of packages published
-      - name: Show package versions
-        run: cargo workspaces list --long
@@ -1,61 +0,0 @@
-# This is in case, for whatever reason, a publication run fails, and we need to restart halfway down the list, of unbumped/unpublished crates.
-name: Resume crates.io publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      resume_after:
-        description: "Last successfully published crate (will start from the next one)"
-        required: true
-        type: string
-      publish_interval:
-        description: "Seconds to wait between publishes"
-        required: false
-        default: "600"
-        type: string
-
-jobs:
-  publish:
-    runs-on: arc-linux-latest
-    env:
-      RUSTUP_PERMIT_COPY_RENAME: 1
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces
-
-      # Get crates in publish order, skip up to and including resume_after
-      - name: Publish remaining crates
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          CRATES=$(cargo workspaces plan 2>/dev/null | sed -n '/^${{ inputs.resume_after }}$/,$p' | tail -n +2)
-
-          if [ -z "$CRATES" ]; then
-            echo "Error: No crates found after '${{ inputs.resume_after }}'"
-            echo "Check the crate name matches exactly from 'cargo workspaces plan'"
-            exit 1
-          fi
-
-          echo "Will publish the following crates:"
-          echo "$CRATES"
-          echo ""
-
-          echo "$CRATES" | while read crate; do
-            echo "Publishing $crate..."
-            cargo publish -p "$crate" --allow-dirty
-            echo "Waiting ${{ inputs.publish_interval }}s before next publish..."
-            sleep ${{ inputs.publish_interval }}
-          done
-
-      - name: Show package versions
-        run: cargo workspaces list --long
@@ -1,92 +0,0 @@
-name: Publish crates to crates.io
-
-on:
-  workflow_dispatch:
-    inputs:
-      publish_interval:
-        description: "Seconds to wait between publishes (600 for first publish, 60 after)"
-        required: false
-        default: "600"
-        type: string
-      backup_author:
-        description: "Second team member added as owner of the crate"
-        required: false
-        default: "jstuczyn"
-        type: string
-
-jobs:
-  publish:
-    runs-on: arc-linux-latest
-    env:
-      RUSTUP_PERMIT_COPY_RENAME: 1
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces
-
-      - name: Preflight publish checks
-        run: |
-          python3 tools/internal/check_publish_preflight.py
-
-      # --publish-as-is skips version bumping since that's done in a separate CI job.
-      - name: Publish
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          cargo workspaces publish \
-            --publish-as-is \
-            --publish-interval ${{ inputs.publish_interval }}
-
-      - name: Show package versions
-        run: cargo workspaces list --long
-
-      - name: Add team as crate owners
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          TEAM="github:nymtech:core"
-          echo "Checking and adding $TEAM as owner to workspace crates..."
-
-          cargo workspaces list | while read crate; do
-            echo "Checking $crate..."
-
-            if cargo owner --list "$crate" 2>/dev/null | grep -q "$TEAM"; then
-              echo "  $TEAM already owns $crate, skipping"
-            else
-              echo "  Adding $TEAM as owner of $crate..."
-              cargo owner --add "$TEAM" "$crate"
-              sleep 2
-            fi
-          done
-
-          echo "Done!"
-
-      - name: Add secondary member as crate owner
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          TEAM_MEMBER="${{ inputs.backup_author }}"
-          echo "Checking and adding $TEAM_MEMBER as owner to workspace crates..."
-
-          cargo workspaces list | while read crate; do
-            echo "Checking $crate..."
-
-            if cargo owner --list "$crate" 2>/dev/null | grep -q "$TEAM_MEMBER"; then
-              echo "  $TEAM_MEMBER already owns $crate, skipping"
-            else
-              echo "  Adding $TEAM_MEMBER as owner of $crate..."
-              cargo owner --add "$TEAM_MEMBER" "$crate"
-              sleep 2
-            fi
-          done
-
-          echo "Done!"
@@ -1,103 +0,0 @@
-name: Bump crate versions
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to set (e.g. 1.21.0)"
-        required: true
-        type: string
-
-env:
-  CI_BOT_AUTHOR: "Nym bot"
-  CI_BOT_EMAIL: "nym-bot@users.noreply.github.com"
-
-jobs:
-  version-bump:
-    runs-on: arc-linux-latest
-    env:
-      RUSTUP_PERMIT_COPY_RENAME: 1
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Configure git identity
-        run: |
-          git config --global user.name "${{ env.CI_BOT_AUTHOR }}"
-          git config --global user.email "${{ env.CI_BOT_EMAIL }}"
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Validate version format
-        run: |
-          if ! npx semver "${{ inputs.version }}"; then
-            echo "Error: '${{ inputs.version }}' is not valid semver"
-            exit 1
-          fi
-
-      - name: Get current version
-        id: current_version
-        run: |
-          VERSION=$(grep -oP '^\s*version\s*=\s*"\K[0-9]+\.[0-9]+\.[0-9]+' Cargo.toml | head -1)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update workspace dependencies
-        run: |
-          # Match any semver version on lines with `path = `, not just the current workspace version.
-          # This catches entries whose version has drifted (e.g. nym-sqlx-pool-guard at 1.2.0).
-          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
-
-      - name: Bump versions
-        run: |
-          cargo workspaces version custom ${{ inputs.version }} \
-            --no-git-commit \
-            --yes
-
-      - name: Commit and push version bump
-        run: |
-          set -euo pipefail
-          BASE_BRANCH="${GITHUB_REF_NAME}"
-          PR_BRANCH="ci/crates-version-bump-${{ inputs.version }}-${GITHUB_RUN_ID}"
-
-          git checkout -b "$PR_BRANCH"
-          git add -A
-          git commit -m "crates release: bump version to ${{ inputs.version }}"
-          git push -u origin "$PR_BRANCH"
-
-          cat > /tmp/crates-version-bump-pr-body.md <<'EOF'
-          This PR was created by CI because direct pushes to the release branch are blocked by branch protection rules.
-
-          ## Summary
-          - Bump workspace crate versions to the requested release version.
-          - Update workspace dependency versions accordingly.
-
-          ## Notes
-          - Merge this PR to proceed with crates.io publishing.
-          EOF
-
-          gh pr create \
-            --base "$BASE_BRANCH" \
-            --head "$PR_BRANCH" \
-            --title "crates release: bump version to ${{ inputs.version }}" \
-            --body-file /tmp/crates-version-bump-pr-body.md
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Show package versions
-        run: cargo workspaces list --long
@@ -1,21 +0,0 @@
-name: ci-docs-linkcheck
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - "documentation/docs/**"
-      - ".github/workflows/ci-docs-linkcheck.yml"
-      - "lychee.toml"
-
-jobs:
-  linkcheck:
-    runs-on: arc-linux-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Check links
-        uses: lycheeverse/lychee-action@v2
-        with:
-          args: ${{ github.workspace }}/documentation/docs/ --config ${{ github.workspace }}/lychee.toml --root-dir ${{ github.workspace }}/documentation/docs/pages/
-          fail: true
@@ -6,11 +6,6 @@ on:
    branches-ignore: [master]
    paths:
      - "documentation/docs/**"
-      - "sdk/typescript/packages/sdk/src/**"
-      - "sdk/typescript/packages/mix-tunnel/src/**"
-      - "sdk/typescript/packages/mix-fetch/src/**"
-      - "sdk/typescript/packages/mix-dns/src/**"
-      - "sdk/typescript/packages/mix-websocket/src/**"
      - ".github/workflows/ci-docs.yml"

 jobs:
@@ -22,62 +17,37 @@ jobs:
      run:
        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
+      - name: Install pip3
+        run: sudo apt install -y python3-pip
      - name: Install Python3 modules
-        run: sudo apt install -y python3-pandas python3-tabulate
+        run: sudo pip3 install pandas tabulate
      - name: Install rsync
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
+        uses: pnpm/action-setup@v4.1.0
        with:
-          version: 11.1.2
+          version: 9
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
-      - name: Install Rust toolchain
+          node-version: 20
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --workspace --release

-      - name: Check if TypeScript SDK source changed
-        id: check-ts-sdk
-        run: |
-          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -qE '^sdk/typescript/packages/(sdk|mix-tunnel|mix-fetch|mix-dns|mix-websocket)/src/'; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ github.workspace }}
-
-      - name: Regenerate TypeDoc API reference
-        if: steps.check-ts-sdk.outputs.changed == 'true'
-        run: |
-          npm install -g typedoc@0.25.13 typedoc-plugin-markdown@4.0.3
-          cd ${{ github.workspace }}/sdk/typescript/packages/sdk          && typedoc --skipErrorChecking
-          cd ${{ github.workspace }}/sdk/typescript/packages/mix-tunnel   && typedoc --skipErrorChecking
-          cd ${{ github.workspace }}/sdk/typescript/packages/mix-fetch    && typedoc --skipErrorChecking
-          cd ${{ github.workspace }}/sdk/typescript/packages/mix-dns      && typedoc --skipErrorChecking
-          cd ${{ github.workspace }}/sdk/typescript/packages/mix-websocket && typedoc --skipErrorChecking
-
-      - name: Verify doc versions
-        run: ${{ github.workspace }}/documentation/scripts/verify-doc-versions.sh
-        working-directory: ${{ github.workspace }}
      - name: Install project dependencies
        run: pnpm i
-      - name: Generate llms-full.txt
-        run: pnpm run generate:llms
      - name: Build project
        run: pnpm run build
-      - name: Generate sitemap
-        run: npx next-sitemap
      - name: Move files to /dist/
        run: ../scripts/move-to-dist.sh

@@ -6,58 +6,53 @@ on:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
+      - "nym-connect/desktop/src/**"
+      - "nym-connect/desktop/package.json"
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
-      - "explorer-v2/**"
+      - "explorer/**"
      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: rlespinasse/github-slug-action@v3.x

-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
-        with:
-          version: 11.1.2
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
-          cache: pnpm
+          node-version: 20
+      - name: Setup yarn
+        run: npm install -g yarn

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Install wasm-opt
-        run: cargo install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'

-      # Produce wasm/smolmix/pkg/package.json before any pnpm step. The
-      # `pnpm dev:on` in `prebuild:ci` adds wasm/smolmix/pkg to the dynamic
-      # workspace; mix-tunnel's `workspace:*` lookup against @nymproject/
-      # smolmix-wasm needs the package.json to be present.
-      - name: Build smolmix wasm
-        run: make -C wasm/smolmix
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.7"

      - name: Install
-        run: pnpm i
+        run: yarn

      - name: Build packages
-        run: pnpm build:ci
-
-      - name: Install again
-        run: pnpm i
+        run: yarn build:ci

      - name: Lint
-        run: pnpm lint
-
+        run: yarn lint
      - name: Typecheck with tsc
-        run: pnpm tsc
+        run: yarn tsc
@@ -1,46 +0,0 @@
-name: ci-nym-wallet-frontend
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'nym-wallet/**'
-      - '.github/workflows/ci-nym-wallet-frontend.yml'
-
-jobs:
-  types-lint:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
-        with:
-          version: 11.1.2
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: nym-wallet/.nvmrc
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Build TypeScript packages (wallet depends on @nymproject/types, etc.)
-        run: pnpm build:types
-
-      - name: Build @nymproject/mui-theme and @nymproject/react (wallet imports subpaths)
-        run: pnpm build:packages
-
-      - name: Typecheck nym-wallet
-        run: pnpm --filter @nymproject/nym-wallet-app tsc
-
-      - name: Lint nym-wallet
-        run: pnpm --filter @nymproject/nym-wallet-app lint
-
-      - name: pnpm audit (workspace lockfile; informational)
-        run: pnpm audit --audit-level critical
-        continue-on-error: true
-
-      - name: Unit tests (nym-wallet)
-        run: pnpm --filter @nymproject/nym-wallet-app test
@@ -25,13 +25,13 @@ jobs:
        continue-on-error: true

      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -41,9 +41,6 @@ jobs:
          sed -i.bak '1s/^/\[profile.dev\]\ndebug = false\n\n/' Cargo.toml
          git diff

-      - name: Ensure nym-wallet/dist exists for Tauri
-        run: mkdir -p nym-wallet/dist
-
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -74,16 +71,3 @@ jobs:
        with:
          command: clippy
          args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features --all-targets -- -D warnings
-
-      - name: Install cargo-audit
-        uses: actions-rs/cargo@v1
-        with:
-          command: install
-          args: cargo-audit --locked
-
-      - name: Cargo audit (nym-wallet workspace)
-        uses: actions-rs/cargo@v1
-        with:
-          command: audit
-        working-directory: nym-wallet
-        continue-on-error: true
@@ -0,0 +1,75 @@
+name: ci-nym-wallet-storybook
+
+on:
+  pull_request:
+    paths:
+      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-storybook.yml'
+
+jobs:
+  build:
+    runs-on: custom-linux
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install rsync
+        run: sudo apt-get install rsync
+        continue-on-error: true
+
+      - uses: rlespinasse/github-slug-action@v3.x
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Setup yarn
+        run: npm install -g yarn
+
+      - name: Install Rust stable
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Build dependencies
+        run: yarn && yarn build
+
+      - name: Build storybook
+        run: yarn storybook:build
+        working-directory: ./nym-wallet
+
+      - name: Deploy branch to CI www (storybook)
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-rltgoDzvO --delete"
+          SOURCE: "nym-wallet/storybook-static/"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
+          EXCLUDE: "/dist/, /node_modules/"
+
+      - name: Matrix - Node Install
+        run: npm install
+        working-directory: .github/workflows/support-files
+
+      - name: Matrix - Send Notification
+        env:
+          NYM_NOTIFICATION_KIND: nym-wallet
+          NYM_PROJECT_NAME: "nym-wallet"
+          NYM_CI_WWW_BASE: "${{ secrets.NYM_CI_WWW_BASE }}"
+          NYM_CI_WWW_LOCATION: "wallet-${{ env.GITHUB_REF_SLUG }}"
+          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+          GIT_BRANCH: "${GITHUB_REF##*/}"
+          IS_SUCCESS: "${{ job.status == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -16,20 +16,25 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 20

      - uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy

+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.24.6"
+
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

@@ -8,12 +8,12 @@ on:
 jobs:
  sonarqube:
    name: SonarQube
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v7
+        uses: SonarSource/sonarqube-scan-action@v5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -30,11 +30,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Setup Pages
        uses: actions/configure-pages@v5
      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v3
        with:
          # Upload entire repository
          path: './ppa'
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v3
      with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        issue_message: 'Thank you for raising this issue'
-        pr_message: 'Thank you for making this first PR'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: 'Thank you for raising this issue'
+        pr-message: 'Thank you for making this first PR'
@@ -2,14 +2,16 @@ name: nightly-build

 on:
  workflow_dispatch:
+  schedule:
+    - cron: '14 1 * * *'

 jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
-        rust: [ stable, beta ]
-        os: [ ubuntu-22.04, windows-latest, macos-latest ]
+        rust: [stable, beta]
+        os: [ubuntu-22.04, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
@@ -17,7 +19,7 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
@@ -91,3 +93,38 @@ jobs:
        with:
          command: clippy
          args: --workspace --all-targets -- -D warnings
+
+  notification:
+    needs: build
+    runs-on: custom-linux
+    steps:
+      - name: Collect jobs status
+        uses: technote-space/workflow-conclusion-action@v3
+      - name: Check out repository code
+        uses: actions/checkout@v4
+      - name: install npm
+        uses: actions/setup-node@v4
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 20
+      - name: Matrix - Node Install
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        run: npm install
+        working-directory: .github/workflows/support-files
+      - name: Matrix - Send Notification
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        env:
+          NYM_NOTIFICATION_KIND: nightly
+          NYM_PROJECT_NAME: "Nym nightly build"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+          GIT_BRANCH: "${GITHUB_REF##*/}"
+          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -15,7 +15,7 @@ jobs:
      output1: ${{ steps.step2.outputs.latest_release }}
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set output variable to latest release branch
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -47,7 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -10,7 +10,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ ubuntu-22.04, macos-latest, windows-latest ]
+        os: [ubuntu-22.04, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
@@ -18,17 +18,17 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
        if: matrix.os == 'ubuntu-22.04'

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -55,3 +55,38 @@ jobs:
        with:
          command: clippy
          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
+
+  notification:
+    needs: build
+    runs-on: custom-linux
+    steps:
+      - name: Collect jobs status
+        uses: technote-space/workflow-conclusion-action@v3
+      - name: Check out repository code
+        uses: actions/checkout@v4
+      - name: install npm
+        uses: actions/setup-node@v4
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 20
+      - name: Matrix - Node Install
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        run: npm install
+        working-directory: .github/workflows/support-files
+      - name: Matrix - Send Notification
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        env:
+          NYM_NOTIFICATION_KIND: nightly
+          NYM_PROJECT_NAME: "nym-wallet-nightly-build"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+          GIT_BRANCH: "${GITHUB_REF##*/}"
+          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -8,11 +8,11 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Install cargo deny
        run: cargo install --locked cargo-deny
      - name: Run cargo deny
@@ -20,7 +20,38 @@ jobs:
          find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
            advisories -A advisory-not-detected  --hide-inclusion-graph \; &> \
            >(uniq  &> .github/workflows/support-files/notifications/deny.message )
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
        with:
          name: report
          path: .github/workflows/support-files/notifications/deny.message
+  notification:
+    needs: cargo-deny
+    runs-on: custom-linux
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+      - name: Download report from previous job
+        uses: actions/download-artifact@v5
+        with:
+          name: report
+          path: .github/workflows/support-files/notifications
+      - name: install npm
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Matrix - Node Install
+        run: npm install
+        working-directory: .github/workflows/support-files
+      - name: Matrix - Send Notification
+        env:
+          NYM_NOTIFICATION_KIND: security
+          NYM_PROJECT_NAME: "Daily security report"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_AUDIT }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -9,18 +9,18 @@ on:

 jobs:
  integration-tests:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    env:
      API_BASE_URL: http://localhost:8000

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true

      - name: Install dependencies
@@ -23,7 +23,7 @@ env:
 jobs:
  check-milestone:
    name: Check Milestone
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-latest
    steps:
      - if: github.event.pull_request.milestone == null && contains( env.LABELS, 'no-milestone' ) == false
        run: exit 1
@@ -21,7 +21,7 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: arc-ubuntu-22.04
+          - os: arc-linux-latest
            target: x86_64-unknown-linux-gnu
    runs-on:  ${{ matrix.os }}

@@ -42,7 +42,7 @@ jobs:
      cli_version: ${{ steps.binary-versions.outputs.cli_version }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install ripgrep libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
@@ -53,10 +53,10 @@ jobs:
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: 1.88.0
          override: true

      - name: Build all binaries
@@ -66,7 +66,7 @@ jobs:
          args: --workspace --release ${{ env.CARGO_FEATURES }}
  
      - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: my-artifact
          path: |
@@ -9,12 +9,11 @@ jobs:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-contracts-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
          target: wasm32-unknown-unknown
          override: true

@@ -27,14 +26,14 @@ jobs:
        run: make contracts

      - name: Upload Mixnet Contract Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: mixnet_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
          retention-days: 5

      - name: Upload Vesting Contract Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: vesting_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
@@ -21,20 +21,17 @@ jobs:
      release_tag: ${{ github.ref_name }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
+      - name: Node
+        uses: actions/setup-node@v4
        with:
-          version: 11.1.2
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
+          node-version: 21
          
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          
      - name: Add Rust target for x86_64-apple-darwin
        run: rustup target add x86_64-apple-darwin
@@ -71,17 +68,17 @@ jobs:
          fileName: '.env'
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}

-      - name: pnpm cache clean
+      - name: Yarn cache clean
        shell: bash
-        run: cd .. && pnpm cache delete
+        run: cd .. && yarn cache clean

      - name: Install project dependencies
        shell: bash
-        run: cd .. && pnpm i
+        run: cd .. && yarn --network-timeout 100000

-      - name: Build
+      - name: Yarn build
        shell: bash
-        run: cd .. && pnpm build
+        run: cd .. && yarn build

      - name: Install dependencies and build it
        env:
@@ -100,7 +97,7 @@ jobs:
          TAURI_NOTARIZATION_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          TAURI_NOTARIZATION_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
-          pnpm build-macx86 
+          yarn build-macx86 

      - name: Create app tarball
        run: |
@@ -111,7 +108,7 @@ jobs:
          cd -

      - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet.app.tar.gz
          path: nym-wallet/target/x86_64-apple-darwin/release/bundle/macos/nym-wallet.app.tar.gz
@@ -18,7 +18,7 @@ jobs:
      release_tag: ${{ github.ref_name }}
      
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      
      - name: Install system dependencies
        run: |
@@ -26,29 +26,24 @@ jobs:
            libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev jq \
            libgtk-3-dev squashfs-tools libayatana-appindicator3-dev make libfuse2 unzip librsvg2-dev file \
            libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
-        with:
-          version: 11.1.2
-
+      
      - name: Node
        uses: actions/setup-node@v4
        with:
-          node-version: 24
-          cache: 'pnpm'
+          node-version: 21
+          cache: 'yarn'
      
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      
      - name: Install project dependencies
        shell: bash
-        run: cd .. && pnpm i
+        run: cd .. && yarn --network-timeout 100000
      
      - name: Install app dependencies
-        run: pnpm i
+        run: yarn
      
      - name: Create env file
        uses: timheuer/base64-to-file@v1.2
@@ -57,7 +52,7 @@ jobs:
          encodedString: ${{ secrets.WALLET_ADMIN_ADDRESS }}
      
      - name: Build app
-        run: pnpm build
+        run: yarn build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
@@ -77,41 +72,6 @@ jobs:
            find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
            find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
          fi
-
-      - name: Inspect AppImage (hook + bundled graphics libs)
-        shell: bash
-        run: |
-          set -euo pipefail
-          APPIMAGE_REL=$(find target/release/bundle -name '*.AppImage' | head -n 1)
-          if [ -z "${APPIMAGE_REL}" ]; then
-            echo "No AppImage under target/release/bundle"
-            exit 1
-          fi
-          APPIMAGE_ABS="${GITHUB_WORKSPACE}/nym-wallet/${APPIMAGE_REL}"
-          chmod +x "${APPIMAGE_ABS}"
-          EXTRACT_DIR=$(mktemp -d)
-          cd "${EXTRACT_DIR}"
-          "${APPIMAGE_ABS}" --appimage-extract
-          # Tauri only stages appimage "files" under /usr/ into the AppDir; paths like /apprun-hooks/ never reach the image.
-          # Wayland + WEBKIT_DISABLE_DMABUF_RENDERER defaults are applied in main() instead (see configure_linux_wayland_defaults).
-          HOOK=$(find squashfs-root -name '99-nym-wayland.sh' 2>/dev/null | head -n 1)
-          if [ -n "${HOOK}" ]; then
-            echo "Found legacy apprun hook at ${HOOK}"
-          else
-            echo "No apprun-hooks/99-nym-wayland.sh (expected): Wayland defaults are set in-process."
-          fi
-          find squashfs-root/usr/lib -maxdepth 6 \
-            \( -name 'libwayland-client.so*' -o -name 'libEGL.so*' -o -name 'libgbm.so*' \) \
-            2>/dev/null | sort > "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
-          wc -l "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
-          head -50 "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt" || true
-
-      - name: Upload AppImage graphics lib inventory
-        uses: actions/upload-artifact@v6
-        with:
-          name: nym-wallet-appimage-lib-inventory
-          path: nym-wallet/appimage-bundled-graphics-libs.txt
-          retention-days: 30
      
      - name: Create AppImage tarball if needed
        run: |
@@ -137,7 +97,7 @@ jobs:
          fi
      
      - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet-appimage.tar.gz
          path: |
@@ -26,100 +26,66 @@ jobs:
    outputs:
      release_tag: ${{ github.ref_name }}

-    env:
-      SIGN_WINDOWS: ${{ github.event_name == 'release' || inputs.sign }}
-
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Setup MSBuild.exe
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@v2

-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
+      - name: Node
+        uses: actions/setup-node@v4
        with:
-          version: 11.1.2
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-
-      - name: Strip Authenticode thumbprint (avoid signtool on runner)
-        working-directory: nym-wallet/src-tauri
-        if: ${{ env.SIGN_WINDOWS == 'true' || (github.event_name == 'workflow_dispatch' && !inputs.sign) }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          if ! command -v yq >/dev/null 2>&1; then
-            echo "yq is required on this runner to edit tauri.conf.json"
-            exit 1
-          fi
-          yq eval --inplace '
-            del(.bundle.windows.certificateThumbprint) |
-            del(.bundle.windows.digestAlgorithm) |
-            del(.bundle.windows.timestampUrl)
-          ' tauri.conf.json
+          node-version: 21

      - name: Download EV CodeSignTool from ssl.com
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        shell: bash
        run: |
          curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
          unzip codesigntool.zip
      - name: Get EV certificate credential id
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        id: get_credential_ids
        shell: bash
        run: |
          echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
      - name: Add custom sign command to tauri.conf.json
        working-directory: nym-wallet/src-tauri
-        if: env.SIGN_WINDOWS == 'true'
+        if: ${{ inputs.sign }}
        shell: bash
-        env:
-          SSL_SIGN_USER: ${{ secrets.SSL_COM_USERNAME }}
-          SSL_SIGN_PASS: ${{ secrets.SSL_COM_PASSWORD }}
-          SSL_SIGN_CRED: ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_SIGN_TOTP: ${{ secrets.SSL_COM_TOTP_SECRET }}
        run: |
-          set -euo pipefail
-          if ! command -v cygpath >/dev/null 2>&1; then
-            echo "cygpath not found; install Git for Windows or use bash from Git SDK"
-            exit 1
-          fi
-          export SCRIPT_UNIX="$(cygpath -u "$GITHUB_WORKSPACE/nym-wallet/src-tauri/CodeSignTool.sh")"
-          yq eval --inplace '
-            .bundle.windows += {
-              "signCommand": {
-                "cmd": "C:/Program Files/Git/bin/bash.exe",
-                "args": [
-                  strenv(SCRIPT_UNIX),
-                  "sign",
-                  ("-username " + strenv(SSL_SIGN_USER)),
-                  ("-password " + strenv(SSL_SIGN_PASS)),
-                  ("-credential_id " + strenv(SSL_SIGN_CRED)),
-                  ("-totp_secret " + strenv(SSL_SIGN_TOTP)),
-                  "-program_name NymWallet",
-                  "-input_file_path",
-                  "%1",
-                  "-override"
-                ]
-              }
+          yq eval --inplace '.bundle.windows +=
+          {
+            "signCommand": {
+              "cmd": "C:\Program Files\Git\bin\bash.EXE",
+              "args": [
+                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
+                "sign",
+                "-username ${{ secrets.SSL_COM_USERNAME }}",
+                "-password ${{ secrets.SSL_COM_PASSWORD }}",
+                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
+                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
+                "-program_name NymWallet",
+                "-input_file_path",
+                "%1",
+                "-override"
+              ]
            }
-          ' tauri.conf.json
+          }' tauri.conf.json
      - name: Install project dependencies
        shell: bash
-        run: cd .. && pnpm i
+        run: cd .. && yarn --network-timeout 100000

      - name: Install app dependencies
        shell: bash
-        run: pnpm i
+        run: yarn --network-timeout 100000

      - name: Build and sign it
        shell: bash
@@ -127,13 +93,13 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          SSL_COM_USERNAME: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_USERNAME }}
-          SSL_COM_PASSWORD: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_PASSWORD }}
-          SSL_COM_CREDENTIAL_ID: ${{ env.SIGN_WINDOWS == 'true' && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_COM_TOTP_SECRET: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_TOTP_SECRET }}
+          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
+          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
        run: |
          echo "Starting build process..."
-          pnpm build
+          yarn build

      - name: Check bundle directory
        shell: bash
@@ -162,7 +128,7 @@ jobs:
          find . -name "*.msi" -type f

      - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet.msi
          path: |
@@ -201,4 +167,4 @@ jobs:
    needs: publish-tauri
    with:
      release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
-    secrets: inherit
+    secrets: inherit
@@ -22,7 +22,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Java
        uses: actions/setup-java@v5
@@ -76,7 +76,7 @@ jobs:
            apk/nyms5-arch64-release.apk

      - name: Upload APKs
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v4
        with:
          name: nyms5-apk-arch64
          path: |
@@ -89,9 +89,9 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Download binary artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v5
        with:
          name: nyms5-apk-arch64
          path: apk
@@ -1,44 +1,26 @@
 name: publish-sdk-npm
 on:
  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Rehearse the publish (pnpm publish --dry-run, no tarballs uploaded). Untick to publish for real."
-        type: boolean
-        default: true
-      dist_tag:
-        description: "Tag mode. 'auto' picks per package: new packages and same-major releases -> latest; a breaking major (e.g. mix-fetch v2 over v1) -> next, promote later with `npm dist-tag add`. 'next'/'latest' force that tag on all four."
-        type: choice
-        options:
-          - auto
-          - next
-          - latest
-        default: auto

 jobs:
  publish:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04
    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v5.0.0
-        with:
-          version: 11.1.2
+      - uses: actions/checkout@v4

      - name: Install Node
        uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 20
          registry-url: "https://registry.npmjs.org"

-      - name: Install rust toolchain
+      - name: Setup yarn
+        run: npm install -g yarn
+
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-          override: true
-          components: rustfmt, clippy
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -46,15 +28,18 @@ jobs:
      - name: Install wasm-opt
        run: cargo install wasm-opt

+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.7"
+
      - name: Install dependencies
-        run: pnpm i
+        run: yarn

      - name: Build WASM and Typescript SDK
-        run: pnpm sdk:build
+        run: yarn sdk:build

      - name: Publish to NPM
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
-          DRY_RUN: ${{ inputs.dry_run && '1' || '0' }}
-          NPM_DIST_TAG: ${{ inputs.dist_tag }}
        run: ./sdk/typescript/scripts/publish.sh
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
@@ -8,17 +8,17 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -1,61 +0,0 @@
-name: Build and upload Network Monitor Agent container to harbor.nymte.ch
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_image:
-        description: 'Tag image as a release (prefix with golden-)'
-        required: true
-        default: false
-        type: boolean
-
-env:
-  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-agent"
-  CONTAINER_NAME: "network-monitor-agent"
-
-jobs:
-  build-container:
-    runs-on: arc-linux-latest-dind
-    steps:
-      - name: Login to Harbor
-        uses: docker/login-action@v3
-        with:
-          registry: harbor.nymte.ch
-          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
-          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
-
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Configure git identity
-        run: |
-          git config --global user.email "lawrence@nymtech.net"
-          git config --global user.name "Lawrence Stalder"
-
-      - name: Get version from Cargo.toml
-        id: get_version
-        run: |
-          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
-          echo "result=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Set GIT_TAG variable
-        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
- 
-      - name: Initialize RELEASE_TAG
-        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
-
-      - name: Set RELEASE_TAG for release
-        if: github.event.inputs.release_image == 'true'
-        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
-
-      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
-
-      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
-
-      - name: Build and push image to Harbor
-        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
-          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
-          
@@ -1,57 +0,0 @@
-name: Build and upload Network Monitor Orchestrator container to harbor.nymte.ch
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_image:
-        description: 'Tag image as a release (prefix with golden-)'
-        required: true
-        default: false
-        type: boolean
-
-env:
-  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-orchestrator"
-  CONTAINER_NAME: "network-monitor-orchestrator"
-
-jobs:
-  build-container:
-    runs-on: arc-linux-latest-dind
-    steps:
-      - name: Login to Harbor
-        uses: docker/login-action@v3
-        with:
-          registry: harbor.nymte.ch
-          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
-          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
-
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Configure git identity
-        run: |
-          git config --global user.email "lawrence@nymtech.net"
-          git config --global user.name "Lawrence Stalder"
-
-      - name: Get version from Cargo.toml
-        id: get_version
-        run: |
-          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
-          echo "result=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Initialize RELEASE_TAG
-        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
-
-      - name: Set RELEASE_TAG for release
-        if: github.event.inputs.release_image == 'true'
-        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
-
-      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
-
-      - name: Log image name
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
-
-      - name: Build and push image to Harbor
-        run: |
-          docker build  -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
-          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
@@ -18,14 +18,14 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -17,14 +17,14 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -8,17 +8,17 @@ env:

 jobs:
  build-container:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -11,14 +11,14 @@ jobs:
    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: harbor.nymte.ch
          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.52.4
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -20,17 +20,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 20
      - uses: nymtech/nym/.github/actions/nym-hash-releases@develop
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          release-tag-or-name-or-id: ${{ inputs.release_tag }}

-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v4
        with:
          name: Asset Hashes
          path: hashes.json
@@ -1,45 +0,0 @@
-name: Resume publish to crates.io
-
-on:
-  workflow_dispatch:
-    inputs:
-      resume_after:
-        description: "Last successfully published crate (will start from the next one)"
-        required: true
-        type: string
-
-jobs:
-  publish:
-    runs-on: arc-linux-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v6
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-
-      - name: Install cargo-workspaces
-        run: cargo install cargo-workspaces
-
-      - name: Preflight publish checks
-        run: |
-          python3 tools/internal/check_publish_preflight.py
-
-      - name: Publish remaining crates
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        run: |
-          # Get crates in publish order, skip up to and including resume_after
-          cargo workspaces plan 2>/dev/null | sed -n '/^${{ inputs.resume_after }}$/,$p' | tail -n +2 | while read crate; do
-            echo "Publishing $crate..."
-            cargo publish -p "$crate" --allow-dirty
-            echo "Waiting 600s before next publish..."
-            sleep 600
-          done
-
-      - name: Show package versions
-        run: cargo workspaces list --long
@@ -4,23 +4,51 @@ This is a collection of scripts and files to support GitHub Actions.

 ## Sending Notifications

-These scripts send CI notifications to Matrix by creating messages from templates and env vars passed from GitHub
-Actions.
+These scripts send CI notifications to Matrix by creating messages from templates and env vars passed from GitHub Actions.
+
+### Adding notifications to a GitHub Action
+
+```
+jobs:
+  build:
+    ...
+    - name: Notifications - Node Install
+      run: npm install
+      working-directory: .github/workflows/support-files/notifications
+    - name: Notifications - Send
+      env:
+        NYM_NOTIFICATION_KIND: "my-component"
+        GIT_BRANCH: "${GITHUB_REF##*/}"
+        MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+        MATRIX_ROOM: "${{ secrets.MATRIX_ROOM }}"
+        MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+        MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+        MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        IS_SUCCESS: "${{ job.status == 'success' }}"
+      uses: docker://keybaseio/client:stable-node
+      with:
+        args: .github/workflows/support-files/notifications/entry_point.sh
+```
+
+Notifications are run by adding the snippet above to a GitHub Action, and:
+
+1. Installing node packages needed at run time
+2. Set the env vars as required:
+    - `NYM_NOTIFICATION_KIND` matches the directory in `.github/workflows/support-files/${NYM_NOTIFICATION_KIND}` to provide the templates and extra scripting in `index.js`
+    - Matrix credentials, room and other env vars for the status of the build and repo
+3. Replacing the default entry point shell script on the `keybaseio/client:stable-node` docker image to run `.github/workflows/support-files/notifications/entry_point.sh`

 ### Running locally

 You will need:
-
 - Node 16 LTS
 - npm

-Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Matrix
-credentials.
+Copy `.github/workflows/support-files/.env.example` to `.github/workflows/support-files/.env` and valid Matrix credentials.

 Then run `npm install` to get dependencies.

-Start development mode for the notification type you want either by passing the value as an env var called
-`NYM_NOTIFICATION_KIND` or set the `.env` file values correctly.
+Start development mode for the notification type you want either by passing the value as an env var called `NYM_NOTIFICATION_KIND` or set the `.env` file values correctly.

 ```bash
 cd .github/workflows/support-files
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# pass exit codes out to GitHub Actions
+set -euxo pipefail
+
+# change to the directory that contains this script
+cd "${0%/*}"
+
+# run the node script
+node send_message.js
@@ -0,0 +1,126 @@
+require('dotenv').config();
+
+const { sendMatrixMessage } = require('./send_message_to_matrix');
+
+let context = {
+  kinds: ['nym-wallet', 'ts-packages', 'network-explorer', 'nightly', 'nym-connect','security','ci-docs','cd-docs','ci-dev','cd-dev'],
+};
+
+/**
+ * Validate that all required env and context vars are available
+ */
+function validateContext() {
+  if (!context.env.NYM_NOTIFICATION_KIND) {
+    throw new Error(
+      'Please set env var NYM_NOTIFICATION_KIND with the project kind that matches a directory in ".github/workflows/support-files"',
+    );
+  }
+  if (!context.kinds.includes(context.env.NYM_NOTIFICATION_KIND)) {
+    throw new Error(`Env var NYM_NOTIFICATION_KIND is not in ${context.kinds}`);
+  }
+  if (!context.env.NYM_PROJECT_NAME) {
+    throw new Error(
+      'Please set env var NYM_PROJECT_NAME with the project name for displaying in notification messages',
+    );
+  }
+  if (context.env.MATRIX_ROOM) {
+    if (!context.env.MATRIX_SERVER) {
+      throw new Error(
+        'Matrix server is not defined. Please set env var MATRIX_SERVER',
+      );
+    }
+    if (!context.env.MATRIX_USER_ID) {
+      throw new Error(
+        'Matrix user id is not defined. Please set env var MATRIX_USER_ID',
+      );
+    }
+    if (!context.env.MATRIX_TOKEN) {
+      throw new Error(
+        'Matrix token is not defined. Please set env var MATRIX_TOKEN',
+      );
+    }
+    if (!context.env.MATRIX_DEVICE_ID) {
+      throw new Error(
+        'Matrix device id is not defined. Please set env var MATRIX_DEVICE_ID',
+      );
+    }
+  }
+}
+
+/**
+ * Creates a context that will be available in the templates for rendering notifications
+ */
+function createTemplateContext() {
+  const options = { dateStyle: 'full', timeStyle: 'long' };
+  context.timestamp = new Date().toLocaleString(undefined, options);
+
+  // add environment to template context and validate
+  context.env = process.env;
+  try {
+    validateContext();
+  } catch (e) {
+    if(process.env.SHOW_DEBUG) {
+      // recursively print the context for easy debugging and rethrow the error
+      console.dir({ context }, { depth: null });
+    }
+    throw e;
+  }
+
+  context.kind = context.env.NYM_NOTIFICATION_KIND;
+
+  if (!context.env.GIT_BRANCH_NAME) {
+    context.env.GIT_BRANCH_NAME = context.env.GITHUB_REF.split('/')
+      .slice(2)
+      .join('/');
+  }
+
+  context.status = process.env.IS_SUCCESS === 'true' ? 'success' : 'failure';
+}
+
+/**
+ * Uses the `kind` set in the context to process the context and generate a notification message
+ * @returns {Promise<string>} A string notification message body
+ */
+async function processKindScript() {
+  const script = require(`../${context.kind}`);
+  if (!script.addToContextAndValidate) {
+    throw new Error(
+      `"./${context.kind}/index.js" does not export a method called "async addToContextAndValidate(context)"`,
+    );
+  }
+  if (!script.getMessageBody) {
+    throw new Error(
+      `"./${context.kind}/index.js" does not export a method called "async getMessageBody(context)"`,
+    );
+  }
+
+  // call the script to modify and validate the context
+  await script.addToContextAndValidate(context);
+
+  // let the script create a message body and return the result as a string for sending
+  return await script.getMessageBody(context);
+}
+
+/**
+ * The main function, as async so that await syntax is available
+ */
+async function main() {
+  createTemplateContext();
+  console.log(`Sending notification for kind "${context.kind}"...`);
+  const messageBody = await processKindScript();
+  if(process.env.SHOW_DEBUG) {
+    console.log('-----------------------------------------');
+    console.log(messageBody);
+    console.log('-----------------------------------------');
+  }
+  if(context.env.MATRIX_ROOM) {
+    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM)
+  }
+  if(context.env.MATRIX_ROOM_OF_SHAME && context.env.IS_SUCCESS !== 'true') {
+    // when a job fails
+    await sendMatrixMessage(context, messageBody, context.env.MATRIX_ROOM_OF_SHAME)
+  }
+}
+
+// call main function and let NodeJS handle the promise
+main();
@@ -0,0 +1,67 @@
+const sdk = require('matrix-js-sdk');
+global.Olm = require('olm');
+const { LocalStorage } = require('node-localstorage');
+const localStorage = new LocalStorage('./scratch');
+const {
+  LocalStorageCryptoStore,
+} = require('matrix-js-sdk/lib/crypto/store/localStorage-crypto-store');
+var showdown  = require('showdown');
+
+// hide all matrix client output
+console.error = (error) => console.log('❌ error: ', error);
+process.stderr.write = () => {};
+process.stdout.write = () => {};
+
+
+function createClient(context, room, message) {
+  const server = context.env.MATRIX_SERVER;
+  const token = context.env.MATRIX_TOKEN;
+  const deviceId = context.env.MATRIX_DEVICE_ID;
+  const userId = context.env.MATRIX_USER_ID;
+
+  const client = sdk.createClient({
+    baseUrl: server,
+    accessToken: token,
+    userId,
+    deviceId,
+    sessionStore: new sdk.WebStorageSessionStore(localStorage),
+    cryptoStore: new LocalStorageCryptoStore(localStorage),
+  });
+
+  client.on('sync', async function(state, prevState, res) {
+    if (state !== 'PREPARED') return;
+    client.setGlobalErrorOnUnknownDevices(false);
+    try {
+      await client.joinRoom(room);
+      await client.sendEvent(
+        room,
+        'm.room.message',
+        {
+          msgtype: 'm.text',
+          format: 'org.matrix.custom.html',
+          body: message,
+          formatted_body: message,
+        },
+        '',
+      );
+    } catch (error) {
+      console.error('Job failed: ' + error.message);
+    }
+    client.stopClient();
+    process.exit(0);
+  });
+
+  return client;
+}
+
+async function sendMatrixMessage(contextArg, messageAsMarkdown, roomId) {
+  const converter = new showdown.Converter();
+  const messageAsHtml = converter.makeHtml(messageAsMarkdown);
+  const client = createClient(contextArg, roomId, messageAsHtml);
+  await client.initCrypto();
+  await client.startClient({ initialSyncLimit: 1 });
+}
+
+module.exports = {
+  sendMatrixMessage,
+};
@@ -27,7 +27,6 @@ v6-topology.json
 /explorer/public/downloads/mixmining.json
 /explorer/public/downloads/topology.json
 /nym-wallet/dist/*
-/nym-wallet/appimage-bundled-graphics-libs.txt
 /clients/validator/examples/nym-driver-example/current-contract.txt
 validator-api/v4.json
 validator-api/v6.json
@@ -64,25 +63,3 @@ nym-api/redocly/formatted-openapi.json

 **/settings.sql
 **/enter_db.sh
-
-*.profraw
-.beads
-CLAUDE.md
-.claude
-.superego
-
-# Superego (machine-specific paths)
-.superego/
-.claude/hooks/superego/
-.claude/settings.json
-
-/notes
-/target-otel
-test-tutorials/
-
-# pnpm
-.pnpm-store/
-
-tmp/
-# operator tools
-scripts/nym-node-setup/auto-bond/nodes.csv
@@ -1,9 +0,0 @@
-shamefully-hoist=false
-prefer-workspace-packages=true
-hoist-pattern[]=*eslint*
-hoist-pattern[]=*prettier*
-hoist-pattern[]=*typescript*
-hoist-pattern[]=*@types*
-
-auto-install-peers=true
-strict-peer-dependencies=false
@@ -4,600 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2026.11-xynomizithra] (2026-06-08)
-
- bugfix: allow re-inviting expired members ([#6863])
- feat: disable Nagle's algorithm for LP between nym-nodes ([#6857])
- Keep peer in wg table when updating psk ([#6856])
- chore: minor nym-node improvements ([#6850])
- chore: LP registration adjustments ([#6845])
- crates release: bump version to 1.21.1 ([#6844])
- fix gateways being penalised for no stress testing ([#6843])
- fix score inflation for throttled nodes ([#6842])
- Bugfix/cherry pick/waterloo stres testing floats ([#6841])
- bugfix: NMv3 race condition ([#6837])
- feat: implement UpdateFamily for the node families contract ([#6834])
- Bugfix/cherry pick/waterloo ns api ([#6833])
- experiment: attempt to retroactively generate specs for node families and ecash contracts ([#6813])
- moving lp packets in lp-data crate ([#6810])
- upgrade axum to 0.8.9 (and side deps) ([#6808])
- chore: expose admin method for migrating vesting delegations/mixnodes ([#6795])
- [chore] fix clippy 1.95 lints for future version update ([#6794])
- Handle Rate Limit Challenge Response ([#6786])
- NYM-583: Avoid corrupted database on Windows. ([#6785])
- Max/smolmix wasm ([#6784])
- Chore/bugfixes ([#6783])
- Switch from yarn to pnpm ([#6779])
- feat: Node Families: expose stake information inside DVpnGateway ([#6778])
- feat: Node Families: expose family information for NS API consumers ([#6777])
- feat: Node Families: cache and expose family data within nym API ([#6774])
- Re-order default API urls for network details ([#6767])
- add ci for NM agent binary ([#6764])
- feat/refactor: introduce shared contract caches within Nym API ([#6760])
- chore: removed dead code for redundant mixnet-vesting integration tests ([#6759])
- feat: Node Families: remove nodes upon unbonding ([#6752])
- feat: Node Families: contract transactions ([#6750])
- feat: Node Families: contract queries ([#6731])
- feat: Node Families: initial contract storage ([#6717])
- start node families topic branch ([#6715])
- Bump rand from 0.8.5 to 0.8.6 in /contracts ([#6702])
- Testing port checks in NS Agents ([#6694])
- build(deps): bump microsoft/setup-msbuild from 2 to 3 ([#6602])
- build(deps): bump tar from 0.4.44 to 0.4.45 ([#6595])
- build(deps): bump quinn-proto from 0.11.12 to 0.11.14 ([#6549])
- build(deps): bump docker/login-action from 3 to 4 ([#6518])
- build(deps): bump actions/download-artifact from 7 to 8 ([#6497])
- build(deps): bump actions/upload-artifact from 6 to 7 ([#6496])
-
-[#6863]: https://github.com/nymtech/nym/pull/6863
-[#6857]: https://github.com/nymtech/nym/pull/6857
-[#6856]: https://github.com/nymtech/nym/pull/6856
-[#6850]: https://github.com/nymtech/nym/pull/6850
-[#6845]: https://github.com/nymtech/nym/pull/6845
-[#6844]: https://github.com/nymtech/nym/pull/6844
-[#6843]: https://github.com/nymtech/nym/pull/6843
-[#6842]: https://github.com/nymtech/nym/pull/6842
-[#6841]: https://github.com/nymtech/nym/pull/6841
-[#6837]: https://github.com/nymtech/nym/pull/6837
-[#6834]: https://github.com/nymtech/nym/pull/6834
-[#6833]: https://github.com/nymtech/nym/pull/6833
-[#6813]: https://github.com/nymtech/nym/pull/6813
-[#6810]: https://github.com/nymtech/nym/pull/6810
-[#6808]: https://github.com/nymtech/nym/pull/6808
-[#6795]: https://github.com/nymtech/nym/pull/6795
-[#6794]: https://github.com/nymtech/nym/pull/6794
-[#6786]: https://github.com/nymtech/nym/pull/6786
-[#6785]: https://github.com/nymtech/nym/pull/6785
-[#6784]: https://github.com/nymtech/nym/pull/6784
-[#6783]: https://github.com/nymtech/nym/pull/6783
-[#6779]: https://github.com/nymtech/nym/pull/6779
-[#6778]: https://github.com/nymtech/nym/pull/6778
-[#6777]: https://github.com/nymtech/nym/pull/6777
-[#6774]: https://github.com/nymtech/nym/pull/6774
-[#6767]: https://github.com/nymtech/nym/pull/6767
-[#6764]: https://github.com/nymtech/nym/pull/6764
-[#6760]: https://github.com/nymtech/nym/pull/6760
-[#6759]: https://github.com/nymtech/nym/pull/6759
-[#6752]: https://github.com/nymtech/nym/pull/6752
-[#6750]: https://github.com/nymtech/nym/pull/6750
-[#6731]: https://github.com/nymtech/nym/pull/6731
-[#6717]: https://github.com/nymtech/nym/pull/6717
-[#6715]: https://github.com/nymtech/nym/pull/6715
-[#6702]: https://github.com/nymtech/nym/pull/6702
-[#6694]: https://github.com/nymtech/nym/pull/6694
-[#6602]: https://github.com/nymtech/nym/pull/6602
-[#6595]: https://github.com/nymtech/nym/pull/6595
-[#6549]: https://github.com/nymtech/nym/pull/6549
-[#6518]: https://github.com/nymtech/nym/pull/6518
-[#6497]: https://github.com/nymtech/nym/pull/6497
-[#6496]: https://github.com/nymtech/nym/pull/6496
-
-## [2026.10-waterloo] (2026-05-27)
-
- Re-order default API urls for network details - Waterloo release ([#6799])
- [bugfix] IPR v8<->v9 mismatch on Waterloo ([#6772])
- Migrate to hickory 0.26.1 ([#6751])
- add workflows for NM3 ([#6729])
- credential proxy pool ([#6726])
- chore: made sphinx version threshold assertion a compile time check ([#6718])
- Feat/nmv3 updated performance calculation ([#6714])
- feat: NMv3: submission of stress testing result into nym-api ([#6709])
- feat: NMv3: Prometheus metrics for network monitor ([#6693])
- feat: NMv3: add read-only results API to orchestrator ([#6689])
- feat: NMv3: Eviction of stale testrun data ([#6685])
- feat: NMv3: Wire up testrun assignment and result submission flow ([#6680])
- feat: NMv3: Support multiple network monitor agents per host ([#6679])
- Feat/nmv3 agent announcement ([#6673])
- add node refresher for periodic scraping of bonded nym-node details ([#6626])
- Feat/nmv3 orchestrator queue ([#6597])
- feat: network monitor agent - standalone node stress-testing ([#6582])
- [feat] propagate NM agent noise keys to nym-node routing ([#6577])
- start mix stress testing topic branch ([#6575])
- Feat/nmv3 agents subscription ([#6567])
- Feat/nmv3 agents contract ([#6555])
-
-[#6799]: https://github.com/nymtech/nym/pull/6799
-[#6772]: https://github.com/nymtech/nym/pull/6772
-[#6751]: https://github.com/nymtech/nym/pull/6751
-[#6729]: https://github.com/nymtech/nym/pull/6729
-[#6726]: https://github.com/nymtech/nym/pull/6726
-[#6718]: https://github.com/nymtech/nym/pull/6718
-[#6714]: https://github.com/nymtech/nym/pull/6714
-[#6709]: https://github.com/nymtech/nym/pull/6709
-[#6693]: https://github.com/nymtech/nym/pull/6693
-[#6689]: https://github.com/nymtech/nym/pull/6689
-[#6685]: https://github.com/nymtech/nym/pull/6685
-[#6680]: https://github.com/nymtech/nym/pull/6680
-[#6679]: https://github.com/nymtech/nym/pull/6679
-[#6673]: https://github.com/nymtech/nym/pull/6673
-[#6626]: https://github.com/nymtech/nym/pull/6626
-[#6597]: https://github.com/nymtech/nym/pull/6597
-[#6582]: https://github.com/nymtech/nym/pull/6582
-[#6577]: https://github.com/nymtech/nym/pull/6577
-[#6575]: https://github.com/nymtech/nym/pull/6575
-[#6567]: https://github.com/nymtech/nym/pull/6567
-[#6555]: https://github.com/nymtech/nym/pull/6555
-
-## [2026.9-venaco] (2026-05-06)
-
- Fix for v9 IPR  ([#6710])
- Only init SHARED_CLIENT if requested ([#6708])
- Fixes to crates and CI ([#6686])
- Return ipv6 addresses as well ([#6684])
- Fix invalid ticket spend ([#6683])
- Block non-public IPR/NR checks ([#6670])
-
-[#6710]: https://github.com/nymtech/nym/pull/6710
-[#6708]: https://github.com/nymtech/nym/pull/6708
-[#6686]: https://github.com/nymtech/nym/pull/6686
-[#6684]: https://github.com/nymtech/nym/pull/6684
-[#6683]: https://github.com/nymtech/nym/pull/6683
-[#6670]: https://github.com/nymtech/nym/pull/6670
-
-## [2026.8-urda] (2026-04-20)
-
- Include all gateways in the returned list ([#6649])
- Optimize GW probe in NS agent ([#6636])
- Max/sdk docrs ([#6566])
- Max/sdk stream wrapper ([#6320])
-
-[#6649]: https://github.com/nymtech/nym/pull/6649
-[#6636]: https://github.com/nymtech/nym/pull/6636
-[#6566]: https://github.com/nymtech/nym/pull/6566
-[#6320]: https://github.com/nymtech/nym/pull/6320
-
-## [2026.7-tola] (2026-04-07)
-
- Simon/ecash contract serde fix ([#6634])
- Update Fallback IP for Nym API ([#6622])
- Nym Node spam logging ([#6621])
- feat: multiple deposit prices ([#6608])
- move format_debug_bytes in common crate ([#6580])
- bugfix: make sure client keys are generated before requesting credentials ([#6579])
- Fix socks5 GW probe regression ([#6576])
- Max/lp stream framing ([#6573])
- HTTP domain rotation conditions ([#6570])
-
-[#6634]: https://github.com/nymtech/nym/pull/6634
-[#6622]: https://github.com/nymtech/nym/pull/6622
-[#6621]: https://github.com/nymtech/nym/pull/6621
-[#6608]: https://github.com/nymtech/nym/pull/6608
-[#6580]: https://github.com/nymtech/nym/pull/6580
-[#6579]: https://github.com/nymtech/nym/pull/6579
-[#6576]: https://github.com/nymtech/nym/pull/6576
-[#6573]: https://github.com/nymtech/nym/pull/6573
-[#6570]: https://github.com/nymtech/nym/pull/6570
-
-## [2026.6-stilton] (2026-03-25)
-
- lp fixes ([#6601])
- bugfix: allow deserialisation of LP data from either snake_case or lowercase ([#6586])
- bugfix: make sure to run cargo install cosmwasm-check with --locked flag during CI ([#6568])
- Add LP to NS UI ([#6562])
- feat: nyxd watcher ([#6561])
- Additional ticket for agent ([#6551])
- bugfix: make sure to use old values from metrics debug config during v12 migration (#6546) ([#6547])
- typo ([#6543])
- rng changes for a Send variant ([#6541])
- Add LP fields ([#6535])
- enable LP registration in registration client ([#6534])
- chore: rename LpMessage to LpFrame ([#6530])
- chore: LP improvements ([#6526])
- Remove dep leak of strum iterator ([#6522])
- chore: update ts-rs dep ([#6517])
- addressing LP PR comments ([#6513])
- remove redundant LP state machine in favour of in place processing ([#6512])
- chore: split up lp listener ([#6507])
- feat: enable mutual KKT exchange ([#6505])
- feat: introduce /v3/unstable/nym-nodes/semi-skimmed to aggregate LP information ([#6499])
- Max/asyncread asyncwrite nym client ([#6318])
- feat: localnet v2 ([#6277])
-
-[#6601]: https://github.com/nymtech/nym/pull/6601
-[#6586]: https://github.com/nymtech/nym/pull/6586
-[#6568]: https://github.com/nymtech/nym/pull/6568
-[#6562]: https://github.com/nymtech/nym/pull/6562
-[#6561]: https://github.com/nymtech/nym/pull/6561
-[#6551]: https://github.com/nymtech/nym/pull/6551
-[#6547]: https://github.com/nymtech/nym/pull/6547
-[#6543]: https://github.com/nymtech/nym/pull/6543
-[#6541]: https://github.com/nymtech/nym/pull/6541
-[#6535]: https://github.com/nymtech/nym/pull/6535
-[#6534]: https://github.com/nymtech/nym/pull/6534
-[#6530]: https://github.com/nymtech/nym/pull/6530
-[#6526]: https://github.com/nymtech/nym/pull/6526
-[#6522]: https://github.com/nymtech/nym/pull/6522
-[#6517]: https://github.com/nymtech/nym/pull/6517
-[#6513]: https://github.com/nymtech/nym/pull/6513
-[#6512]: https://github.com/nymtech/nym/pull/6512
-[#6507]: https://github.com/nymtech/nym/pull/6507
-[#6505]: https://github.com/nymtech/nym/pull/6505
-[#6499]: https://github.com/nymtech/nym/pull/6499
-[#6318]: https://github.com/nymtech/nym/pull/6318
-[#6277]: https://github.com/nymtech/nym/pull/6277
-
-## [2026.5-raclette] (2026-03-10)
-
- bugfix: correctly populate gateway probe LP data ([#6533])
- chore: introduce additional prometheus metrics for registration times ([#6532])
- bugfix: lp information to have proper snake_case on API endpoints ([#6531])
- removed redundant LP states ([#6509])
- chore: removed all matrix notifications from github actions ([#6495])
- feat: Lewes Protocol with PSQv2 ([#6491])
- build(deps): bump minimatch from 3.1.2 to 3.1.4 in /documentation/docs ([#6486])
- build(deps): bump bn.js from 4.12.2 to 4.12.3 in /documentation/docs ([#6484])
- build(deps): bump bn.js from 4.12.2 to 4.12.3 ([#6483])
- build(deps): bump ajv from 8.17.1 to 8.18.0 in /clients/native/examples/js-examples/websocket ([#6478])
- build(deps): bump ajv from 6.12.6 to 6.14.0 in /documentation/docs ([#6477])
- build(deps): bump minimatch and glob in /documentation/scripts/post-process ([#6476])
- build(deps): bump hono from 4.11.9 to 4.12.0 ([#6475])
- build(deps): bump keccak from 0.1.5 to 0.1.6 ([#6472])
- build(deps-dev): bump qs from 6.14.1 to 6.14.2 in /clients/native/examples/js-examples/websocket ([#6466])
- build(deps): bump mikefarah/yq from 4.52.2 to 4.52.4 ([#6465])
- Otel minimal v2 ([#6464])
- build(deps): bump qs and express in /wasm/client/internal-dev ([#6461])
- bugfix: restore 'latest_measurement' field for nym-node /verloc endpoint ([#6452])
- build(deps-dev): bump webpack from 5.77.0 to 5.104.1 in /wasm/node-tester/internal-dev ([#6451])
- Max/mixfetch concurrent test ([#6417])
-
-[#6533]: https://github.com/nymtech/nym/pull/6533
-[#6532]: https://github.com/nymtech/nym/pull/6532
-[#6531]: https://github.com/nymtech/nym/pull/6531
-[#6509]: https://github.com/nymtech/nym/pull/6509
-[#6495]: https://github.com/nymtech/nym/pull/6495
-[#6491]: https://github.com/nymtech/nym/pull/6491
-[#6486]: https://github.com/nymtech/nym/pull/6486
-[#6484]: https://github.com/nymtech/nym/pull/6484
-[#6483]: https://github.com/nymtech/nym/pull/6483
-[#6478]: https://github.com/nymtech/nym/pull/6478
-[#6477]: https://github.com/nymtech/nym/pull/6477
-[#6476]: https://github.com/nymtech/nym/pull/6476
-[#6475]: https://github.com/nymtech/nym/pull/6475
-[#6472]: https://github.com/nymtech/nym/pull/6472
-[#6466]: https://github.com/nymtech/nym/pull/6466
-[#6465]: https://github.com/nymtech/nym/pull/6465
-[#6464]: https://github.com/nymtech/nym/pull/6464
-[#6461]: https://github.com/nymtech/nym/pull/6461
-[#6452]: https://github.com/nymtech/nym/pull/6452
-[#6451]: https://github.com/nymtech/nym/pull/6451
-[#6417]: https://github.com/nymtech/nym/pull/6417
-
-## [2026.4-quark] (2026-02-24)
-
- Enhance CI workflow with feature inputs ([#6462])
- Chore/revert 6433 ([#6445])
- Lp/stateless handshake ([#6437])
- build(deps-dev): bump webpack from 5.98.0 to 5.105.0 in /wasm/client/internal-dev ([#6435])
- build(deps-dev): bump webpack from 5.102.1 to 5.104.1 ([#6432])
- build(deps-dev): bump webpack from 5.98.0 to 5.105.0 in /wasm/mix-fetch/internal-dev ([#6431])
- build(deps-dev): bump webpack from 5.94.0 to 5.104.1 in /nym-credential-proxy/vpn-api-lib-wasm/internal-dev ([#6430])
- build(deps-dev): bump webpack from 5.77.0 to 5.104.1 in /wasm/zknym-lib/internal-dev ([#6429])
- build(deps-dev): bump webpack from 5.76.0 to 5.105.0 in /clients/native/examples/js-examples/websocket ([#6428])
- HTTP & DNS Improvements ([#6423])
- Endpoint for  exit GW IPs ([#6418])
- build(deps): bump bytes from 1.6.0 to 1.11.1 in /contracts ([#6416])
- build(deps): bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 ([#6415])
- build(deps): bump bytes from 1.11.0 to 1.11.1 ([#6414])
- build(deps): bump mikefarah/yq from 4.50.1 to 4.52.2 ([#6407])
- build(deps-dev): bump eslint from 8.57.1 to 9.26.0 ([#6405])
- Update reqwest to v0.13.1 ([#6401])
- build(deps): bump next from 15.5.9 to 16.1.5 in /documentation/docs ([#6387])
- build(deps): bump next from 15.4.10 to 16.1.5 in /nym-node-status-api/nym-node-status-ui ([#6385])
- build(deps): bump lodash from 4.17.21 to 4.17.23 ([#6369])
- build(deps): bump lodash-es from 4.17.21 to 4.17.23 ([#6360])
- build(deps-dev): bump lodash from 4.17.21 to 4.17.23 in /sdk/typescript/codegen/contract-clients ([#6359])
- build(deps): bump lodash from 4.17.21 to 4.17.23 in /sdk/typescript/packages/nodejs-client ([#6354])
- build(deps): bump lodash from 4.17.21 to 4.17.23 in /documentation/docs ([#6353])
- build(deps): bump lodash from 4.17.21 to 4.17.23 in /clients/native/examples/js-examples/websocket ([#6351])
- build(deps): bump lodash-es from 4.17.21 to 4.17.23 in /documentation/docs ([#6350])
- build(deps): bump diff from 5.2.0 to 5.2.2 in /documentation/docs ([#6345])
- Max/crates publishing tweaks ([#6343])
- build(deps): bump h3 from 1.15.4 to 1.15.5 ([#6339])
- build(deps): bump h3 from 1.15.4 to 1.15.5 in /documentation/docs ([#6332])
- build(deps): bump undici from 6.21.3 to 6.23.0 in /documentation/docs ([#6325])
- build(deps): bump rsa from 0.9.8 to 0.9.10 ([#6311])
- build(deps): bump qs and express in /wasm/mix-fetch/internal-dev ([#6308])
- build(deps): bump qs and express in /clients/native/examples/js-examples/websocket ([#6307])
- feat: introduce on-disk cache persistance for major nym-api caches ([#6302])
- Fix migrations in the Data Observatory ([#6271])
-
-[#6462]: https://github.com/nymtech/nym/pull/6462
-[#6445]: https://github.com/nymtech/nym/pull/6445
-[#6437]: https://github.com/nymtech/nym/pull/6437
-[#6435]: https://github.com/nymtech/nym/pull/6435
-[#6432]: https://github.com/nymtech/nym/pull/6432
-[#6431]: https://github.com/nymtech/nym/pull/6431
-[#6430]: https://github.com/nymtech/nym/pull/6430
-[#6429]: https://github.com/nymtech/nym/pull/6429
-[#6428]: https://github.com/nymtech/nym/pull/6428
-[#6423]: https://github.com/nymtech/nym/pull/6423
-[#6418]: https://github.com/nymtech/nym/pull/6418
-[#6416]: https://github.com/nymtech/nym/pull/6416
-[#6415]: https://github.com/nymtech/nym/pull/6415
-[#6414]: https://github.com/nymtech/nym/pull/6414
-[#6407]: https://github.com/nymtech/nym/pull/6407
-[#6405]: https://github.com/nymtech/nym/pull/6405
-[#6401]: https://github.com/nymtech/nym/pull/6401
-[#6387]: https://github.com/nymtech/nym/pull/6387
-[#6385]: https://github.com/nymtech/nym/pull/6385
-[#6369]: https://github.com/nymtech/nym/pull/6369
-[#6360]: https://github.com/nymtech/nym/pull/6360
-[#6359]: https://github.com/nymtech/nym/pull/6359
-[#6354]: https://github.com/nymtech/nym/pull/6354
-[#6353]: https://github.com/nymtech/nym/pull/6353
-[#6351]: https://github.com/nymtech/nym/pull/6351
-[#6350]: https://github.com/nymtech/nym/pull/6350
-[#6345]: https://github.com/nymtech/nym/pull/6345
-[#6343]: https://github.com/nymtech/nym/pull/6343
-[#6339]: https://github.com/nymtech/nym/pull/6339
-[#6332]: https://github.com/nymtech/nym/pull/6332
-[#6325]: https://github.com/nymtech/nym/pull/6325
-[#6311]: https://github.com/nymtech/nym/pull/6311
-[#6308]: https://github.com/nymtech/nym/pull/6308
-[#6307]: https://github.com/nymtech/nym/pull/6307
-[#6302]: https://github.com/nymtech/nym/pull/6302
-[#6271]: https://github.com/nymtech/nym/pull/6271
-
-## [2026.3-parmigiano] (2026-02-10)
-
- chore: disable LP on parmigiano branch ([#6422])
- revert mixnet-based client fautly changes from LP ([#6420])
- [LP fix] Registration client with fallback ([#6419])
- Lp/ip pool fixes ([#6412])
- [LP-fix] expose wg psk for the vpn-client ([#6411])
- LP-fix : configurable LP timeouts ([#6409])
- LP-fix : add LP x25519 key to the description ([#6408])
- use rng that is Send ([#6404])
- use local kem key instead of local x25519 ([#6402])
- [LP Gateway Probe] CLI and behavior improvements  ([#6400])
- lp: attempt to negotiate (and use) protocol version ([#6399])
- bugfix: use correct reserved bytes when parsing LpHeader ([#6398])
- Lp/bugfix/share ip allocation ([#6395])
- feat: use hex-encoding for lp key digests ([#6394])
- Add socks5 test to gateway-probe ([#6393])
- [LP Gateway probe] Improve file structure ([#6391])
- Reduce the size of `HttpClientError` ([#6390])
- Lp/two step dvpn reg ([#6386])
- Add extra configured nym api url to env ([#6382])
- Lp/dvpn psk injection ([#6378])
- LP: include signing key digests to LP responses ([#6373])
- Lp/use noise x25519 ([#6372])
- Topology fallback ([#6363])
- NS API socks5 support ([#6361])
- LP: modified LPRemotePeer to dynamically choose required KEM key hash ([#6358])
- Fix KKT Integration into LP ([#6357])
- LP: mixnet reg fixes ([#6356])
- LP: announced KEM key hashes ([#6349])
- revert faulty drop changes ([#6346])
- small qol changes ([#6340])
- Apply configured api urls via env ([#6337])
- lp chore: make sure to take reserved bytes straight from the header ([#6336])
- LP: x25519/ed22519 cleanup round ([#6335])
- Lp/encrypted kkt ([#6331])
- ensure packets with incompatible versions are rejected ([#6326])
- standarise lp serialisation: ([#6324])
- Upgrade to def_guard_wireguard v0.8.0 ([#6315])
- Max/crates io prep v2 ([#6270])
-
-[#6422]: https://github.com/nymtech/nym/pull/6422
-[#6420]: https://github.com/nymtech/nym/pull/6420
-[#6419]: https://github.com/nymtech/nym/pull/6419
-[#6412]: https://github.com/nymtech/nym/pull/6412
-[#6411]: https://github.com/nymtech/nym/pull/6411
-[#6409]: https://github.com/nymtech/nym/pull/6409
-[#6408]: https://github.com/nymtech/nym/pull/6408
-[#6404]: https://github.com/nymtech/nym/pull/6404
-[#6402]: https://github.com/nymtech/nym/pull/6402
-[#6400]: https://github.com/nymtech/nym/pull/6400
-[#6399]: https://github.com/nymtech/nym/pull/6399
-[#6398]: https://github.com/nymtech/nym/pull/6398
-[#6395]: https://github.com/nymtech/nym/pull/6395
-[#6394]: https://github.com/nymtech/nym/pull/6394
-[#6393]: https://github.com/nymtech/nym/pull/6393
-[#6391]: https://github.com/nymtech/nym/pull/6391
-[#6390]: https://github.com/nymtech/nym/pull/6390
-[#6386]: https://github.com/nymtech/nym/pull/6386
-[#6382]: https://github.com/nymtech/nym/pull/6382
-[#6378]: https://github.com/nymtech/nym/pull/6378
-[#6373]: https://github.com/nymtech/nym/pull/6373
-[#6372]: https://github.com/nymtech/nym/pull/6372
-[#6363]: https://github.com/nymtech/nym/pull/6363
-[#6361]: https://github.com/nymtech/nym/pull/6361
-[#6358]: https://github.com/nymtech/nym/pull/6358
-[#6357]: https://github.com/nymtech/nym/pull/6357
-[#6356]: https://github.com/nymtech/nym/pull/6356
-[#6349]: https://github.com/nymtech/nym/pull/6349
-[#6346]: https://github.com/nymtech/nym/pull/6346
-[#6340]: https://github.com/nymtech/nym/pull/6340
-[#6337]: https://github.com/nymtech/nym/pull/6337
-[#6336]: https://github.com/nymtech/nym/pull/6336
-[#6335]: https://github.com/nymtech/nym/pull/6335
-[#6331]: https://github.com/nymtech/nym/pull/6331
-[#6326]: https://github.com/nymtech/nym/pull/6326
-[#6324]: https://github.com/nymtech/nym/pull/6324
-[#6315]: https://github.com/nymtech/nym/pull/6315
-[#6270]: https://github.com/nymtech/nym/pull/6270
-
-## [2026.2-oscypek] (2026-01-27)
-
- bugfix: downgrade gateway protocol to clients proposed version ([#6377])
- bugfix: ack fix ([#6364])
- Cherry pick/api urls oscypek ([#6348])
- Update nix to v0.30.1 ([#6316])
- Deriving Serialize for GatewayData ([#6314])
- chore: remove repetitive words in comment ([#6313])
- [bugfix] Sqlite transaction escalation was causing errors  ([#6299])
- DNS static table pre-resolve ([#6297])
- Add Copy+Clone to nym_api_provider::Config ([#6296])
- [chore] clippy fixes and use fixed rust version from REQUIRED_RUSTC_VERSION ([#6295])
- build(deps): bump SonarSource/sonarqube-scan-action from 6 to 7 ([#6294])
- build(deps): bump mikefarah/yq from 4.49.2 to 4.50.1 ([#6293])
- build(deps): bump actions/upload-artifact from 5 to 6 ([#6292])
- build(deps): bump actions/download-artifact from 6 to 7 ([#6291])
- build(deps): bump js-yaml from 3.14.1 to 3.14.2 in /documentation/docs ([#6290])
- build(deps): bump next from 15.4.9 to 15.4.10 in /nym-node-status-api/nym-node-status-ui ([#6289])
- build(deps): bump next from 14.2.33 to 14.2.35 ([#6288])
- LP Registration + Telescoping + Gateway Probe Localnet Mode ([#6286])
- build(deps): bump next from 15.5.7 to 15.5.9 in /documentation/docs ([#6285])
- build(deps): bump next from 15.4.7 to 15.4.9 in /nym-node-status-api/nym-node-status-ui ([#6284])
- Minor DNS improvements ([#6283])
- HTTP client without default features ([#6281])
- DNS: reduce number of attempts ([#6278])
- [bugfix] use proper mixing delay instead of poisson delay in cover traffic ([#6269])
- build(deps): bump node-forge from 1.3.1 to 1.3.3 in /wasm/zknym-lib/internal-dev ([#6261])
- build(deps-dev): bump node-forge from 1.3.1 to 1.3.3 in /wasm/mix-fetch/internal-dev ([#6260])
- build(deps-dev): bump node-forge from 1.3.1 to 1.3.2 in /wasm/client/internal-dev ([#6251])
- build(deps): bump node-forge from 1.3.1 to 1.3.2 in /nym-credential-proxy/vpn-api-lib-wasm/internal-dev ([#6250])
- [Feature] Fallback gateway listener and remove legacy key support ([#6249])
- build(deps-dev): bump node-forge from 1.3.0 to 1.3.2 in /clients/native/examples/js-examples/websocket ([#6248])
- build(deps): bump node-forge from 1.3.1 to 1.3.2 ([#6246])
- build(deps): bump pnpm/action-setup from 4.1.0 to 4.2.0 ([#6245])
- build(deps): bump actions/download-artifact from 5 to 6 ([#6244])
- build(deps): bump actions/checkout from 4 to 6 ([#6243])
- build(deps): bump mikefarah/yq from 4.48.1 to 4.49.2 ([#6242])
- build(deps): bump actions/upload-artifact from 4 to 5 ([#6241])
- fix: fix assertion ([#6238])
- Initial changes to support extra configurable parameters and to print… ([#6237])
- Data Observatory ([#6172])
-
-[#6377]: https://github.com/nymtech/nym/pull/6377
-[#6364]: https://github.com/nymtech/nym/pull/6364
-[#6348]: https://github.com/nymtech/nym/pull/6348
-[#6316]: https://github.com/nymtech/nym/pull/6316
-[#6314]: https://github.com/nymtech/nym/pull/6314
-[#6313]: https://github.com/nymtech/nym/pull/6313
-[#6299]: https://github.com/nymtech/nym/pull/6299
-[#6297]: https://github.com/nymtech/nym/pull/6297
-[#6296]: https://github.com/nymtech/nym/pull/6296
-[#6295]: https://github.com/nymtech/nym/pull/6295
-[#6294]: https://github.com/nymtech/nym/pull/6294
-[#6293]: https://github.com/nymtech/nym/pull/6293
-[#6292]: https://github.com/nymtech/nym/pull/6292
-[#6291]: https://github.com/nymtech/nym/pull/6291
-[#6290]: https://github.com/nymtech/nym/pull/6290
-[#6289]: https://github.com/nymtech/nym/pull/6289
-[#6288]: https://github.com/nymtech/nym/pull/6288
-[#6286]: https://github.com/nymtech/nym/pull/6286
-[#6285]: https://github.com/nymtech/nym/pull/6285
-[#6284]: https://github.com/nymtech/nym/pull/6284
-[#6283]: https://github.com/nymtech/nym/pull/6283
-[#6281]: https://github.com/nymtech/nym/pull/6281
-[#6278]: https://github.com/nymtech/nym/pull/6278
-[#6269]: https://github.com/nymtech/nym/pull/6269
-[#6261]: https://github.com/nymtech/nym/pull/6261
-[#6260]: https://github.com/nymtech/nym/pull/6260
-[#6251]: https://github.com/nymtech/nym/pull/6251
-[#6250]: https://github.com/nymtech/nym/pull/6250
-[#6249]: https://github.com/nymtech/nym/pull/6249
-[#6248]: https://github.com/nymtech/nym/pull/6248
-[#6246]: https://github.com/nymtech/nym/pull/6246
-[#6245]: https://github.com/nymtech/nym/pull/6245
-[#6244]: https://github.com/nymtech/nym/pull/6244
-[#6243]: https://github.com/nymtech/nym/pull/6243
-[#6242]: https://github.com/nymtech/nym/pull/6242
-[#6241]: https://github.com/nymtech/nym/pull/6241
-[#6238]: https://github.com/nymtech/nym/pull/6238
-[#6237]: https://github.com/nymtech/nym/pull/6237
-[#6172]: https://github.com/nymtech/nym/pull/6172
-
-## [2026.1-niolo] (2026-01-13)
-
- bugfix: mozzarella -> niolo config migration ([#6259])
- chore: remove run DKG migration ([#6253])
- bugfix: reexposed 'derive_extended_private_key' ([#6247])
- Bump js-yaml from 3.14.1 to 3.14.2 in /sdk/typescript/codegen/contract-clients ([#6231])
- Statistics API v2 ([#6227])
- Bump golang.org/x/crypto from 0.39.0 to 0.45.0 in /nym-gateway-probe/netstack_ping ([#6220])
- Update chain registry link ([#6219])
- Bump glob from 10.3.4 to 10.5.0 in /documentation/scripts/post-process ([#6216])
- Bump js-yaml from 4.1.0 to 4.1.1 in /sdk/typescript/tests/integration-tests/mix-fetch ([#6215])
- gateway-probe fixes for run-local ([#6212])
- chore: updated default endpoint for retrieving attestation.json ([#6207])
- chore: remove support for legacy mixnode within the performance contract ([#6205])
- feat: upgrade mode: VPN adjustments ([#6189])
- Bump min-document from 2.19.0 to 2.19.1 ([#6181])
- Bump next from 15.4.1 to 15.4.7 in /nym-node-status-api/nym-node-status-ui ([#6180])
- feat: merge intermediate upgrade mode changes ([#6174])
- Add weighted scoring to NS API ([#6144])
- build(deps): bump mikefarah/yq from 4.47.1 to 4.48.1 ([#6107])
- build(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows ([#6068])
- build(deps): bump tar-fs from 3.0.9 to 3.1.1 in /sdk/typescript/tests/integration-tests/mix-fetch ([#6063])
- build(deps): bump ammonia from 4.1.1 to 4.1.2 ([#6057])
- build(deps): bump tower-http from 0.5.2 to 0.6.6 ([#6030])
- build(deps): bump actions/setup-go from 5 to 6 ([#6013])
- build(deps): bump next from 14.2.28 to 14.2.32 ([#5996])
- build(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 ([#5993])
- build(deps): bump actions/upload-pages-artifact from 3 to 4 ([#5992])
-
-[#6259]: https://github.com/nymtech/nym/pull/6259
-[#6253]: https://github.com/nymtech/nym/pull/6253
-[#6247]: https://github.com/nymtech/nym/pull/6247
-[#6231]: https://github.com/nymtech/nym/pull/6231
-[#6227]: https://github.com/nymtech/nym/pull/6227
-[#6220]: https://github.com/nymtech/nym/pull/6220
-[#6219]: https://github.com/nymtech/nym/pull/6219
-[#6216]: https://github.com/nymtech/nym/pull/6216
-[#6215]: https://github.com/nymtech/nym/pull/6215
-[#6212]: https://github.com/nymtech/nym/pull/6212
-[#6207]: https://github.com/nymtech/nym/pull/6207
-[#6205]: https://github.com/nymtech/nym/pull/6205
-[#6189]: https://github.com/nymtech/nym/pull/6189
-[#6181]: https://github.com/nymtech/nym/pull/6181
-[#6180]: https://github.com/nymtech/nym/pull/6180
-[#6174]: https://github.com/nymtech/nym/pull/6174
-[#6144]: https://github.com/nymtech/nym/pull/6144
-[#6107]: https://github.com/nymtech/nym/pull/6107
-[#6068]: https://github.com/nymtech/nym/pull/6068
-[#6063]: https://github.com/nymtech/nym/pull/6063
-[#6057]: https://github.com/nymtech/nym/pull/6057
-[#6030]: https://github.com/nymtech/nym/pull/6030
-[#6013]: https://github.com/nymtech/nym/pull/6013
-[#5996]: https://github.com/nymtech/nym/pull/5996
-[#5993]: https://github.com/nymtech/nym/pull/5993
-[#5992]: https://github.com/nymtech/nym/pull/5992
-
-## [2025.21-mozzarella] (2025-11-25)
-
- [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
- bugfix: fix credential proxy upgrade mode attestation url arg ([#6202])
- HTTP API resilience enable & domain rotation conditions ([#6200])
- Remove debug feature from http-macro spec in gateway probe ([#6195])
- DNS relibility and troubleshooting  ([#6179])
- [bugfix] Distinguish authenticator errors by credential spent ([#6176])
- Typescript SDK 1.4.1 ([#6146])
- Enable URL rotation and retries for mixnet gateway init ([#6126])
- Feature/credential proxy jwt ([#5957])
-
-[#6225]: https://github.com/nymtech/nym/pull/6225
-[#6202]: https://github.com/nymtech/nym/pull/6202
-[#6200]: https://github.com/nymtech/nym/pull/6200
-[#6195]: https://github.com/nymtech/nym/pull/6195
-[#6179]: https://github.com/nymtech/nym/pull/6179
-[#6176]: https://github.com/nymtech/nym/pull/6176
-[#6146]: https://github.com/nymtech/nym/pull/6146
-[#6126]: https://github.com/nymtech/nym/pull/6126
-[#5957]: https://github.com/nymtech/nym/pull/5957
-
 ## [2025.20-leerdammer] (2025-11-12)

 - Max/tweak ts sdk actions ([#6185])
@@ -0,0 +1,686 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Nym is a privacy platform that uses mixnet technology to protect against metadata surveillance. The platform consists of several key components:
+- Mixnet nodes (mixnodes) for packet mixing
+- Gateways (entry/exit points for the network)
+- Clients for interacting with the network
+- Network monitoring tools
+- Validators for network consensus
+- Various service providers and integrations
+
+## Build Commands
+
+### Rust Components
+
+```bash
+# Default build (debug)
+cargo build
+
+# Release build
+cargo build --release
+
+# Build a specific package
+cargo build -p <package-name>
+
+# Build main components
+make build
+
+# Build release versions of main binaries and contracts
+make build-release
+
+# Build specific binaries
+make build-nym-cli
+cargo build -p nym-node --release
+cargo build -p nym-api --release
+```
+
+### Testing
+
+```bash
+# Run clippy, unit tests, and formatting
+make test
+
+# Run all tests including slow tests
+make test-all
+
+# Run clippy on all workspaces
+make clippy
+
+# Run unit tests for a specific package
+cargo test -p <package-name>
+
+# Run only expensive/ignored tests
+cargo test --workspace -- --ignored
+
+# Run API tests
+dotenv -f envs/sandbox.env -- cargo test --test public-api-tests
+
+# Run tests with specific log level
+RUST_LOG=debug cargo test -p <package-name>
+
+# Run specific test scripts
+./nym-node/tests/test_apis.sh
+./scripts/wireguard-exit-policy/exit-policy-tests.sh
+```
+
+### Linting and Formatting
+
+```bash
+# Run rustfmt on all code
+make fmt
+
+# Check formatting without modifying
+cargo fmt --all -- --check
+
+# Run clippy with all targets
+cargo clippy --workspace --all-targets -- -D warnings
+
+# TypeScript linting
+yarn lint
+yarn lint:fix
+yarn types:lint:fix
+
+# Check dependencies for security/licensing issues
+cargo deny check
+```
+
+### WASM Components
+
+```bash
+# Build all WASM components
+make sdk-wasm-build
+
+# Build TypeScript SDK
+yarn build:sdk
+npx lerna run --scope @nymproject/sdk build --stream
+
+# Build and test WASM components
+make sdk-wasm
+
+# Build specific WASM packages
+cd wasm/client && make
+cd wasm/mix-fetch && make
+cd wasm/node-tester && make
+```
+
+### Contract Development
+
+```bash
+# Build all contracts
+make contracts
+
+# Build contracts in release mode
+make build-release-contracts
+
+# Generate contract schemas
+make contract-schema
+
+# Run wasm-opt on contracts
+make wasm-opt-contracts
+
+# Check contracts with cosmwasm-check
+make cosmwasm-check-contracts
+```
+
+### Running Components
+
+```bash
+# Run nym-node as a mixnode
+cargo run -p nym-node -- run --mode mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway
+
+# Run the network monitor
+cargo run -p nym-network-monitor
+
+# Run the API server
+cargo run -p nym-api
+
+# Run with specific environment
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Start a local network
+./scripts/localnet_start.sh
+```
+
+## Architecture
+
+The Nym platform consists of various components organized as a monorepo:
+
+1. **Core Mixnet Infrastructure**:
+   - `nym-node`: Core binary supporting mixnode and gateway modes
+   - `common/nymsphinx`: Implementation of the Sphinx packet format
+   - `common/topology`: Network topology management
+   - `common/types`: Shared data types across components
+
+2. **Network Monitoring**:
+   - `nym-network-monitor`: Monitors the network's reliability and performance
+   - `nym-api`: API server for network stats and monitoring data
+   - Metrics tracking for nodes, routes, and overall network health
+
+3. **Client Implementations**:
+   - `clients/native`: Native Rust client implementation
+   - `clients/socks5`: SOCKS5 proxy client for standard applications
+   - `wasm`: WebAssembly client implementations (for browsers)
+   - `nym-connect`: Desktop and mobile clients
+
+4. **Blockchain & Smart Contracts**:
+   - `common/cosmwasm-smart-contracts`: Smart contract implementations
+   - `contracts`: CosmWasm contracts for the Nym network
+   - `common/ledger`: Blockchain integration
+
+5. **Utilities & Tools**:
+   - `tools`: Various CLI tools and utilities
+   - `sdk`: SDKs for different languages and platforms
+   - `documentation`: Documentation generation and management
+
+## Packet System
+
+Nym uses a modified Sphinx packet format for its mixnet:
+
+1. **Message Chunking**:
+   - Messages are divided into "sets" and "fragments"
+   - Each fragment fits in a single Sphinx packet
+   - The `common/nymsphinx/chunking` module handles message fragmentation
+
+2. **Routing**:
+   - Packets traverse through 3 layers of mixnodes
+   - Routing information is encrypted in layers (onion routing)
+   - The final gateway receives and processes the messages
+
+3. **Monitoring**:
+   - Monitoring system tracks packet delivery through the network
+   - Routes are analyzed for reliability statistics
+   - Node performance metrics are collected
+
+## Network Protocol
+
+Nym implements the Loopix mixnet design with several key privacy features:
+
+1. **Continuous-time Mixing**:
+   - Each mixnode delays messages independently with an exponential distribution
+   - This creates random reordering of packets, destroying timing correlations
+   - Offers better anonymity properties than batch mixing approaches
+
+2. **Cover Traffic**:
+   - Clients and nodes generate dummy "loop" packets that circulate through the network
+   - These packets are indistinguishable from real traffic
+   - Creates a baseline level of traffic that hides actual communication patterns
+   - Provides unobservability (hiding when and how much real traffic is being sent)
+
+3. **Stratified Network Architecture**:
+   - Traffic flows through Entry Gateway → 3 Mixnode Layers → Exit Gateway
+   - Path selection is independent per-message (unlike Tor)
+   - Each node connects only to adjacent layers
+
+4. **Anonymous Replies**:
+   - Single-Use Reply Blocks (SURBs) allow receiving messages without revealing identity
+   - Enables bidirectional communication while maintaining privacy
+
+## Network Monitoring Architecture
+
+The network monitoring system is a core component that measures mixnet reliability:
+
+1. The `nym-network-monitor` sends test packets through the network
+2. These packets follow predefined routes through multiple mixnodes
+3. Metrics are collected about:
+   - Successful and failed packet deliveries
+   - Node reliability (percentage of successful packet handling)
+   - Route reliability (which specific route combinations work best)
+4. Results are stored in the database and used by `nym-api` to:
+   - Present node performance statistics
+   - Determine network rewards
+   - Provide route selection guidance to clients
+
+In the current branch, metrics collection is being enhanced with a fanout approach to submit to multiple API endpoints.
+
+## Development Environment
+
+### Required Dependencies
+
+- Rust toolchain (stable, 1.80+)
+- Node.js (v20+) and yarn for TypeScript components
+- SQLite for local database development
+- PostgreSQL for API database (optional, for full API functionality)
+- CosmWasm tools for contract development
+- For building contracts: `wasm-opt` tool from `binaryen`
+- Python 3.8+ for some scripts
+- Docker (optional, for containerized development)
+- protoc (Protocol Buffers compiler) for some components
+
+### Environment Configurations
+
+The `envs/` directory contains pre-configured environments:
+
+#### Available Environments
+
+- **`local.env`**: Local development environment
+  - Points to local services (localhost)
+  - Uses test mnemonics and keys
+  - Ideal for testing without external dependencies
+
+- **`sandbox.env`**: Sandbox test network
+  - Public test network with real nodes
+  - Test tokens available from faucet
+  - Contract addresses for sandbox deployment
+  - API: https://sandbox-nym-api1.nymtech.net
+
+- **`mainnet.env`**: Production mainnet
+  - Real network with real tokens
+  - Production contract addresses
+  - API: https://validator.nymtech.net
+  - Use with caution!
+
+- **`canary.env`**: Canary deployment
+  - Pre-release testing environment
+  - Tests new features before mainnet
+
+- **`mainnet-local-api.env`**: Hybrid environment
+  - Uses mainnet contracts but local API
+  - Useful for API development against mainnet data
+
+#### Key Environment Variables
+
+```bash
+# Network configuration
+NETWORK_NAME=sandbox              # Network identifier
+BECH32_PREFIX=n                   # Address prefix (n for sandbox, n for mainnet)
+NYM_API=https://sandbox-nym-api1.nymtech.net/api
+NYXD=https://rpc.sandbox.nymtech.net
+NYM_API_NETWORK=sandbox
+
+# Contract addresses (network-specific)
+MIXNET_CONTRACT_ADDRESS=n1xr3rq8yvd7qplsw5yx90ftsr2zdhg4e9z60h5duusgxpv72hud3sjkxkav
+VESTING_CONTRACT_ADDRESS=n1unyuj8qnmygvzuex3dwmg9yzt9alhvyeat0uu0jedg2wj33efl5qackslz
+# ... other contract addresses
+
+# Mnemonic for testing (NEVER use in production)
+MNEMONIC="clutch captain shoe salt awake harvest setup primary inmate ugly among become"
+
+# API Keys and tokens
+IPINFO_API_TOKEN=your_token_here
+AUTHENTICATOR_PASSWORD=password_here
+
+# Logging
+RUST_LOG=info                    # Options: error, warn, info, debug, trace
+RUST_BACKTRACE=1                # Enable backtraces
+
+# Database
+DATABASE_URL=postgresql://user:pass@localhost/nym_api
+```
+
+#### Using Environment Files
+
+```bash
+# Load environment and run command
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Export to shell
+source envs/sandbox.env
+
+# Use with make targets
+dotenv -f envs/sandbox.env -- make run-api-tests
+```
+
+## Initial Setup
+
+### First Time Setup
+
+1. **Install Prerequisites**
+   ```bash
+   # Install Rust
+   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+   
+   # Install Node.js and yarn
+   # Via nvm (recommended):
+   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+   nvm install 20
+   npm install -g yarn
+   
+   # Install build tools
+   # Ubuntu/Debian:
+   sudo apt-get install build-essential pkg-config libssl-dev protobuf-compiler libpq-dev
+   
+   # macOS:
+   brew install protobuf postgresql
+   
+   # Install wasm-opt for contract builds
+   npm install -g wasm-opt
+   
+   # Add wasm target for Rust
+   rustup target add wasm32-unknown-unknown
+   ```
+
+2. **Clone and Setup Repository**
+   ```bash
+   git clone https://github.com/nymtech/nym.git
+   cd nym/nym
+   
+   # Install JavaScript dependencies
+   yarn install
+   
+   # Build the project
+   make build
+   ```
+
+3. **Database Setup (Optional, for API development)**
+   ```bash
+   # Install PostgreSQL
+   # Create database
+   createdb nym_api
+   
+   # Run migrations (from nym-api directory)
+   cd nym-api
+   sqlx migrate run
+   ```
+
+### Quick Start
+
+```bash
+# Run a mixnode locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run a gateway locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode gateway --id my-gateway
+
+# Run the API server
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Run a client
+cargo run -p nym-client -- init --id my-client
+cargo run -p nym-client -- run --id my-client
+```
+
+## CI/CD Pipeline
+
+The project uses GitHub Actions for CI/CD with several key workflows:
+
+1. **Build and Test**:
+   - `ci-build.yml`: Main build workflow for Rust components
+   - Tests are run on multiple platforms (Linux, Windows, macOS)
+   - Includes formatting check (rustfmt) and linting (clippy)
+
+2. **Release Process**:
+   - Binary artifacts are published on release tags
+   - Multiple platform builds are created
+
+3. **Documentation**:
+   - Documentation is automatically built and deployed
+
+## Database Structure
+
+The system uses SQLite databases with tables like:
+- `mixnode_status`: Status information about mixnodes
+- `gateway_status`: Status information about gateways
+- `routes`: Route performance information (success/failure of specific paths)
+- `monitor_run`: Information about monitoring test runs
+
+## Development Workflows
+
+### Running a Node
+
+To run the mixnode or gateway:
+
+```bash
+# Run nym-node as a mixnode with specified identity
+cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway --id my-gateway
+```
+
+### Configuration
+
+Nodes can be configured with files in various locations:
+- Command-line arguments
+- Environment variables
+- `.env` files specified with `--config-env-file`
+
+### Monitoring
+
+To monitor the health of your node:
+- View logs for real-time information
+- Use the node's HTTP API for status information
+- Check the explorer for public node statistics
+
+## Common Libraries
+
+- `common/types`: Shared data types across all components
+- `common/crypto`: Cryptographic primitives and wrappers
+- `common/client-core`: Core client functionality
+- `common/gateway-client`: Client-gateway communication
+- `common/task`: Task management and concurrency utilities
+- `common/nymsphinx`: Sphinx packet implementation for mixnet
+- `common/topology`: Network topology management
+- `common/credentials`: Credential system for privacy-preserving authentication
+- `common/bandwidth-controller`: Bandwidth management and accounting
+
+## Code Conventions
+
+- Error handling: Use anyhow/thiserror for structured error handling
+- Logging: Use the tracing framework for logging and diagnostics
+- State management: Generally use Tokio/futures for async code
+- Configuration: Use the config crate and env vars with defaults
+- Database: Use sqlx for type-safe database queries
+- Follow clippy recommendations and rustfmt formatting
+- Use semantic commit messages: feat, fix, docs, refactor, test, chore
+
+## When Making Changes
+
+- Run `make test` before submitting PRs
+- Follow Rust naming conventions
+- Use `clippy` to check for common issues
+- Update SQLx query caches when modifying DB queries: `cargo sqlx prepare`
+- Consider backward compatibility for protocol changes
+- Use lefthook pre-commit hooks for TypeScript formatting
+- Run `cargo deny check` to verify dependency compliance
+- Test against both sandbox and local environments when possible
+- Update relevant documentation and CHANGELOG.md
+
+## Development Tools
+
+### Useful Cargo Commands
+
+```bash
+# Check for outdated dependencies
+cargo outdated
+
+# Analyze binary size
+cargo bloat --release -p nym-node
+
+# Generate dependency graph
+cargo tree -p nym-api
+
+# Run with instrumentation
+cargo run --features profiling -p nym-node
+
+# Check for security advisories
+cargo audit
+```
+
+### Database Tools
+
+```bash
+# SQLx CLI for migrations
+cargo install sqlx-cli
+
+# Create new migration
+cd nym-api && sqlx migrate add <migration_name>
+
+# Prepare query metadata for offline compilation
+cargo sqlx prepare --workspace
+
+# View database schema
+./nym-api/enter_db.sh
+```
+
+### Development Scripts
+
+- `scripts/build_topology.py`: Generate network topology files
+- `scripts/node_api_check.py`: Verify node API endpoints
+- `scripts/network_tunnel_manager.sh`: Manage network tunnels
+- `scripts/localnet_start.sh`: Start a local test network
+- Various deployment scripts in `deployment/` for different environments
+
+## Debugging
+
+- Enable more verbose logging with the RUST_LOG environment variable:
+  ```
+  RUST_LOG=debug,nym_node=trace cargo run -p nym-node -- run --mode mixnode
+  ```
+- Use the HTTP API endpoints for status information
+- Check monitoring data in the database for network performance metrics
+- For complex issues, use tracing tools to follow packet flow
+- Enable backtraces: `RUST_BACKTRACE=full`
+- For WASM debugging: Use browser developer tools with source maps
+
+## Deployment and Advanced Configurations
+
+### Deployment Structure
+
+The `deployment/` directory contains Ansible playbooks and configurations for various deployment scenarios:
+
+- **`aws/`**: AWS-specific deployment configurations
+- **`mixnode/`**: Mixnode deployment playbooks
+- **`gateway/`**: Gateway deployment playbooks
+- **`validator/`**: Validator node deployment
+- **`sandbox-v2/`**: Complete sandbox environment setup
+- **`big-dipper-2/`**: Block explorer deployment
+
+### Sandbox V2 Deployment
+
+The sandbox-v2 deployment (`deployment/sandbox-v2/`) provides a complete test environment:
+
+```bash
+# Key playbooks:
+- deploy.yaml              # Main deployment orchestrator
+- deploy-mixnodes.yaml    # Deploy mixnodes
+- deploy-gateways.yaml    # Deploy gateways
+- deploy-validators.yaml  # Deploy validator nodes
+- deploy-nym-api.yaml     # Deploy API services
+```
+
+### Custom Environment Setup
+
+To create a custom environment:
+
+1. Copy an existing env file: `cp envs/sandbox.env envs/custom.env`
+2. Modify the network endpoints and contract addresses
+3. Update the `NETWORK_NAME` to your identifier
+4. Set appropriate mnemonics and keys (use fresh ones for production!)
+
+### Contract Addresses
+
+Contract addresses are network-specific and defined in environment files:
+- Mixnet contract: Manages mixnode/gateway registry
+- Vesting contract: Handles token vesting schedules
+- Coconut contracts: Privacy-preserving credentials
+- Name service: Human-readable address mapping
+- Ecash contract: Electronic cash functionality
+
+### Local Network Setup
+
+For a completely local network:
+```bash
+# Start local chain
+./scripts/localnet_start.sh
+
+# Deploy contracts
+cd contracts
+make deploy-local
+
+# Start nodes with local config
+dotenv -f envs/local.env -- cargo run -p nym-node -- run --mode mixnode
+```
+
+## Common Issues and Troubleshooting
+
+### Database Issues
+
+- When modifying database queries, you must update SQLx query caches:
+  ```bash
+  cargo sqlx prepare
+  ```
+- If you see SQLx errors about missing query files, this is likely the cause
+- For "database is locked" errors with SQLite, ensure only one process accesses the DB
+- For PostgreSQL connection issues, verify DATABASE_URL and that the server is running
+
+### API Connection Issues
+
+- Check the environment variables pointing to the APIs (NYM_API, NYXD)
+- Verify network connectivity and API health endpoints
+- For authentication issues, check node keys and credentials
+- Common endpoints to verify:
+  - API health: `$NYM_API/health`
+  - Chain status: `$NYXD/status`
+  - Contract info: `$NYXD/cosmwasm/wasm/v1/contract/$CONTRACT_ADDRESS`
+
+### Build Problems
+
+- Clean dependencies with `cargo clean` for a fresh build
+- Check for compatible Rust version (1.80+ recommended)
+- For smart contract builds, ensure wasm-opt is installed: `npm install -g wasm-opt`
+- For cross-compilation issues, check target-specific dependencies
+- WASM build issues: Ensure wasm32-unknown-unknown target is installed:
+  ```bash
+  rustup target add wasm32-unknown-unknown
+  ```
+- For "cannot find -lpq" errors, install PostgreSQL development files:
+  ```bash
+  # Ubuntu/Debian
+  sudo apt-get install libpq-dev
+  # macOS
+  brew install postgresql
+  ```
+
+### Environment Issues
+
+- Contract address mismatches: Ensure you're using the correct environment file
+- "Account sequence mismatch": The account nonce is out of sync, wait and retry
+- Token decimal issues: Sandbox uses different decimal places than mainnet
+- API version mismatches: Ensure your local API version matches the network
+- "Insufficient funds": Get test tokens from faucet (sandbox) or check balance
+- Gateway/mixnode bonding issues: Verify minimum stake requirements
+
+## Working with Routes and Monitoring
+
+1. Route monitoring metrics are stored in a `routes` table with:
+   - Layer node IDs (layer1, layer2, layer3, gw)
+   - Success flag (boolean)
+   - Timestamp
+
+2. To analyze routes:
+   - Check `NetworkAccount` and `AccountingRoute` in `nym-network-monitor/src/accounting.rs`
+   - View monitoring logic in `common/nymsphinx/chunking/monitoring.rs`
+   - Observe how routes are submitted to the database in the `submit_accounting_routes_to_db` function
+
+## Performance Optimization
+
+### Profiling and Benchmarking
+
+```bash
+# Run benchmarks
+cargo bench -p nym-node
+
+# Profile with perf (Linux)
+cargo build --release --features profiling
+perf record --call-graph=dwarf ./target/release/nym-node run --mode mixnode
+perf report
+
+# Generate flamegraph
+cargo install flamegraph
+cargo flamegraph --bin nym-node -- run --mode mixnode
+```
+
+### Common Performance Considerations
+
+- Use bounded channels for backpressure
+- Batch database operations where possible
+- Monitor memory usage with `RUST_LOG=nym_node::metrics=debug`
+- Use connection pooling for database connections
+- Consider using `jemalloc` for better memory allocation performance
@@ -31,6 +31,7 @@ members = [
    "common/client-libs/mixnet-client",
    "common/client-libs/validator-client",
    "common/commands",
+    "common/nym-common",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
@@ -40,11 +41,9 @@ members = [
    "common/cosmwasm-smart-contracts/group-contract",
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
-    "common/cosmwasm-smart-contracts/node-families-contract",
    "common/cosmwasm-smart-contracts/nym-performance-contract",
    "common/cosmwasm-smart-contracts/nym-pool-contract",
    "common/cosmwasm-smart-contracts/vesting-contract",
-    "common/cosmwasm-smart-contracts/network-monitors-contract",
    "common/credential-proxy",
    "common/credential-storage",
    "common/credential-utils",
@@ -71,15 +70,8 @@ members = [
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
    "common/nym-cache",
-    "common/nym-common",
    "common/nym-connection-monitor",
    "common/nym-id",
-    "common/nym-kcp",
-    "common/nym-kkt",
-    "common/nym-kkt-ciphersuite",
-    "common/nym-kkt-context",
-    "common/nym-lp",
-    "common/nym-lp-data",
    "common/nym-metrics",
    "common/nym_offline_compact_ecash",
    "common/nymnoise",
@@ -95,9 +87,7 @@ members = [
    "common/nymsphinx/params",
    "common/nymsphinx/routing",
    "common/nymsphinx/types",
-    "common/nyxd-scraper-psql",
-    "common/nyxd-scraper-shared",
-    "common/nyxd-scraper-sqlite",
+    "common/nyxd-scraper",
    "common/pemstore",
    "common/registration",
    "common/serde-helpers",
@@ -127,14 +117,13 @@ members = [
    "common/zulip-client",
    "documentation/autodoc",
    "gateway",
-    "integration-tests",
    "nym-api",
    "nym-api/nym-api-requests",
    "nym-authenticator-client",
+    "nym-browser-extension/storage",
    "nym-credential-proxy/nym-credential-proxy",
    "nym-credential-proxy/nym-credential-proxy-requests",
-    "nym-data-observatory",
-    "nym-gateway-probe",
+    "nym-credential-proxy/vpn-api-lib-wasm",
    "nym-ip-packet-client",
    "nym-network-monitor",
    "nym-node",
@@ -146,7 +135,6 @@ members = [
    "nym-outfox",
    "nym-registration-client",
    "nym-signers-monitor",
-    "nym-sqlx-pool-guard",
    "nym-statistics-api",
    "nym-validator-rewarder",
    "nyx-chain-watcher",
@@ -157,47 +145,43 @@ members = [
    "service-providers/common",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
-    "smolmix/core",
+    "sqlx-pool-guard",
    "tools/echo-server",
    "tools/internal/contract-state-importer/importer-cli",
    "tools/internal/contract-state-importer/importer-contract",
-    "tools/internal/localnet-orchestrator",
-    "tools/internal/localnet-orchestrator/dkg-bypass-contract",
    "tools/internal/mixnet-connectivity-check",
-    #    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/internal/validator-status-check",
    "tools/nym-cli",
    "tools/nym-id-cli",
-    "tools/nym-lp-client",
    "tools/nym-nr-query",
    "tools/nymvisor",
    "tools/ts-rs-cli",
    "wasm/client",
-    "wasm/smolmix",
+    # "wasm/full-nym-wasm",  # If we uncomment this again, remember to also uncomment the profile settings below
+    "wasm/mix-fetch",
+    "wasm/node-tester",
    "wasm/zknym-lib",
-    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
-    "nym-network-monitor-v3/nym-network-monitor-agent",
-    "nym-network-monitor-v3/nym-network-monitor-orchestrator-requests",
+    "nym-gateway-probe"
 ]

 default-members = [
    "clients/native",
    "clients/socks5",
    "nym-api",
-    "nym-authenticator-client",
    "nym-credential-proxy/nym-credential-proxy",
    "nym-node",
-    "nym-registration-client",
+    "nym-node-status-api/nym-node-status-agent",
+    "nym-node-status-api/nym-node-status-api",
    "nym-statistics-api",
    "nym-validator-rewarder",
    "nyx-chain-watcher",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
-    "tools/internal/localnet-orchestrator",
    "tools/nymvisor",
-    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
-    "nym-network-monitor-v3/nym-network-monitor-agent",
 ]

 exclude = ["contracts", "nym-wallet", "cpu-cycles"]
@@ -209,9 +193,8 @@ homepage = "https://nymtech.net"
 documentation = "https://nymtech.net"
 edition = "2024"
 license = "Apache-2.0"
-rust-version = "1.87.0"
+rust-version = "1.85"
 readme = "README.md"
-version = "1.21.1"

 [workspace.dependencies]
 addr = "0.15.6"
@@ -220,27 +203,24 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 ammonia = "4"
-ansi_term = "0.12"
 anyhow = "1.0.98"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
 async-trait = "0.1.88"
-async-tungstenite = { version = "0.24", default-features = false }
-axum = "0.8.9"
-axum-client-ip = "1.3.1"
-axum-extra = "0.12.6"
-axum-test = "20.0.0"
+axum = "0.7.5"
+axum-client-ip = "0.6.1"
+axum-extra = "0.9.4"
+axum-test = "16.2.0"
 base64 = "0.22.1"
 base85rs = "0.1.3"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 bitvec = "1.0.0"
-blake3 = ">=1.7, <1.8.4"  # blake3 1.8.4+ requires digest 0.11; workspace is on 0.10
+blake3 = "1.7.0"
 bloomfilter = "3.0.1"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.11.1"
-cargo-edit = "0.13.8"
+bytes = "1.10.1"
 cargo_metadata = "0.19.2"
 celes = "2.6.0"
 cfg-if = "1.0.0"
@@ -254,7 +234,7 @@ clap_complete_fig = "4.5"
 colored = "2.2"
 comfy-table = "7.1.4"
 console = "0.16.0"
-console-subscriber = "0.5.0"
+console-subscriber = "0.4.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
 const_format = "0.2.34"
@@ -262,9 +242,9 @@ criterion = "0.5"
 csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
-curve25519-dalek = "4.1.3"
 dashmap = "5.5.3"
-defguard_wireguard_rs = "0.8.0"
+# We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
+defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
 dirs = "6.0"
 dotenvy = "0.15.6"
@@ -279,27 +259,21 @@ eyre = "0.6.9"
 fastrand = "2.1.1"
 flate2 = "1.1.1"
 futures = "0.3.31"
-futures-rustls = { version = "0.26", default-features = false }
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getrandom03 = { package = "getrandom", version = "=0.3.3" }
-getrandom04 = { package = "getrandom", version = "0.4" }
-glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-proto = { version = "0.26.1", default-features = false }
-hickory-resolver = "0.26.1"
+hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
 http-body-util = "0.1"
-httparse = "1.10"
 httpcodec = "0.2.3"
 human-repr = "1.1.0"
 humantime = "2.2.0"
 humantime-serde = "1.1.1"
-hyper = { version = "1.6.0", default-features = false }
+hyper = "1.6.0"
 hyper-util = "0.1"
 indicatif = "0.18.0"
 inquire = "0.6.2"
@@ -307,25 +281,19 @@ inventory = "0.3.21"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
-jwt-simple = { version = "0.12.12", default-features = false, features = [
-    "pure-rust",
-] }
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
 mime = "0.3.17"
-mock_instant = "0.6.0"
 moka = { version = "0.12", features = ["future"] }
-nix = "0.30.1"
+nix = "0.27.1"
 notify = "5.1.0"
-num_enum = "0.7.5"
 once_cell = "1.21.3"
-opentelemetry = "0.31.0"
-opentelemetry_sdk = "0.31.0"
-opentelemetry-otlp = "0.31.0"
-tonic = "0.14.4"
+opentelemetry = "0.19.0"
+opentelemetry-jaeger = "0.18.0"
 parking_lot = "0.12.3"
 pem = "0.8"
 petgraph = "0.6.5"
@@ -334,215 +302,81 @@ pnet_packet = "0.35.0"
 publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
 quote = "1"
-rand = "0.8.6"
-rand09 = { package = "rand", version = "=0.9.2" }
+rand = "0.8.5"
 rand_chacha = "0.3"
-rand_chacha09 = { package = "rand_chacha", version = "=0.9.0" }
 rand_core = "0.6.3"
 rand_distr = "0.4"
 rayon = "1.5.1"
 regex = "1.10.6"
-reqwest = { version = "0.13.1", default-features = false }
+reqwest = { version = "0.12.15", default-features = false }
 rs_merkle = "1.5.0"
-rustls = { version = "0.23.37", default-features = false }
-rustls-pki-types = "1"
-rustls-rustcrypto = "0.0.2-alpha"
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
 serde_bytes = "0.11.17"
 serde_derive = "1.0"
-serde_json = { version = "1.0.140", features = ["float_roundtrip"] }
+serde_json = "1.0.140"
 serde_json_path = "0.7.2"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
-sha2 = "0.10.3"
+sha2 = "0.10.9"
 si-scale = "0.2.3"
-simple-dns = "0.7"
-smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.8.6"
-strum = "0.28.0"
-strum_macros = "0.28.0"
+strum = "0.27.2"
+strum_macros = "0.27.2"
 subtle-encoding = "0.5"
 syn = "2"
-sysinfo = "0.38.4"
+sysinfo = "0.37.0"
 tap = "1.0.1"
-tar = "0.4.45"
+tar = "0.4.44"
 test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
-tls_codec = "0.4.1"
 tokio = "1.47"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
-tokio-rustls = "0.26"
-tokio-smoltcp = "0.5"
-tokio-tungstenite = "0.20.1"
+tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
 tower = "0.5.2"
-tower-http = "0.6.6"
+tower-http = "0.5.2"
 tracing = "0.1.41"
 tracing-log = "0.2"
-tracing-opentelemetry = "0.32.1"
-tracing-subscriber = "0.3.20"
+tracing-opentelemetry = "0.19.0"
+tracing-subscriber = "0.3.19"
+tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
-ts-rs = "12.0.1"
+ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
 typed-builder = "0.23.0"
 uniffi = "0.29.2"
 uniffi_build = "0.29.0"
 url = "2.5"
 utoipa = "5.2"
-utoipa-swagger-ui = "9.0.2"
+utoipa-swagger-ui = "8.1"
 utoipauto = "0.2"
-uuid = "1.19.0"
+uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }
+vergen-gitcl = { version = "1.0.8", default-features = false }
 walkdir = "2"
 x25519-dalek = "2.0.0"
 zeroize = "1.7.0"

 prometheus = { version = "0.14.0" }

-# recreating lioness
-# we don't care about particular versions - just pull whatever is used by sphinx
-lioness = "*"
-arrayref = "*"
-
-# libcrux
-libcrux-kem = "0.0.7"
-libcrux-ecdh = "0.0.6"
-libcrux-curve25519 = "0.0.6"
-libcrux-chacha20poly1305 = "0.0.7"
-libcrux-psq = "0.0.8"
-libcrux-ml-kem = "0.0.8"
-libcrux-sha3 = "0.0.8"
-libcrux-traits = "0.0.6"
-
-# Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
-nym-api-requests = { version = "1.21.1", path = "nym-api/nym-api-requests" }
-nym-authenticator-requests = { version = "1.21.1", path = "common/authenticator-requests" }
-nym-async-file-watcher = { version = "1.21.1", path = "common/async-file-watcher" }
-nym-authenticator-client = { version = "1.21.1", path = "nym-authenticator-client" }
-nym-bandwidth-controller = { version = "1.21.1", path = "common/bandwidth-controller" }
-nym-bin-common = { version = "1.21.1", path = "common/bin-common" }
-nym-cache = { version = "1.21.1", path = "common/nym-cache" }
-nym-client-core = { version = "1.21.1", path = "common/client-core", default-features = false }
-nym-client-core-config-types = { version = "1.21.1", path = "common/client-core/config-types" }
-nym-client-core-gateways-storage = { version = "1.21.1", path = "common/client-core/gateways-storage" }
-nym-client-core-surb-storage = { version = "1.21.1", path = "common/client-core/surb-storage" }
-nym-client-websocket-requests = { version = "1.21.1", path = "clients/native/websocket-requests" }
-nym-common = { version = "1.21.1", path = "common/nym-common" }
-nym-compact-ecash = { version = "1.21.1", path = "common/nym_offline_compact_ecash" }
-nym-config = { version = "1.21.1", path = "common/config" }
-nym-contracts-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/contracts-common" }
-nym-coconut-dkg-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
-nym-credential-storage = { version = "1.21.1", path = "common/credential-storage" }
-nym-credential-utils = { version = "1.21.1", path = "common/credential-utils" }
-nym-credential-proxy-lib = { version = "1.21.1", path = "common/credential-proxy" }
-nym-credentials = { version = "1.21.1", path = "common/credentials", default-features = false }
-nym-credentials-interface = { version = "1.21.1", path = "common/credentials-interface" }
-nym-credential-proxy-requests = { version = "1.21.1", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
-nym-credential-verification = { version = "1.21.1", path = "common/credential-verification" }
-nym-crypto = { version = "1.21.1", path = "common/crypto", default-features = false }
-nym-dkg = { version = "1.21.1", path = "common/dkg" }
-nym-ecash-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/ecash-contract" }
-nym-ecash-signer-check = { version = "1.21.1", path = "common/ecash-signer-check" }
-nym-ecash-signer-check-types = { version = "1.21.1", path = "common/ecash-signer-check-types" }
-nym-ecash-time = { version = "1.21.1", path = "common/ecash-time" }
-nym-exit-policy = { version = "1.21.1", path = "common/exit-policy" }
-nym-ffi-shared = { version = "1.21.1", path = "sdk/ffi/shared" }
-nym-gateway-client = { version = "1.21.1", path = "common/client-libs/gateway-client", default-features = false }
-nym-gateway-probe = { version = "1.21.1", path = "nym-gateway-probe" }
-nym-gateway-requests = { version = "1.21.1", path = "common/gateway-requests" }
-nym-gateway-storage = { version = "1.21.1", path = "common/gateway-storage" }
-nym-gateway-stats-storage = { version = "1.21.1", path = "common/gateway-stats-storage" }
-nym-group-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/group-contract" }
-nym-http-api-client = { version = "1.21.1", path = "common/http-api-client" }
-nym-http-api-client-macro = { version = "1.21.1", path = "common/http-api-client-macro" }
-nym-http-api-common = { version = "1.21.1", path = "common/http-api-common", default-features = false }
-nym-id = { version = "1.21.1", path = "common/nym-id" }
-nym-ip-packet-client = { version = "1.21.1", path = "nym-ip-packet-client" }
-nym-ip-packet-requests = { version = "1.21.1", path = "common/ip-packet-requests" }
-nym-lp = { version = "1.21.1", path = "common/nym-lp" }
-nym-lp-data = { version = "1.21.1", path = "common/nym-lp-data" }
-nym-kkt = { version = "1.21.1", path = "common/nym-kkt" }
-nym-kkt-ciphersuite = { version = "1.21.1", path = "common/nym-kkt-ciphersuite" }
-nym-kkt-context = { version = "1.21.1", path = "common/nym-kkt-context" }
-nym-metrics = { version = "1.21.1", path = "common/nym-metrics" }
-nym-mixnet-client = { version = "1.21.1", path = "common/client-libs/mixnet-client" }
-nym-mixnet-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
-nym-multisig-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/multisig-contract" }
-nym-network-defaults = { version = "1.21.1", path = "common/network-defaults" }
-nym-node-tester-utils = { version = "1.21.1", path = "common/node-tester-utils" }
-nym-noise = { version = "1.21.1", path = "common/nymnoise" }
-nym-noise-keys = { version = "1.21.1", path = "common/nymnoise/keys" }
-nym-nonexhaustive-delayqueue = { version = "1.21.1", path = "common/nonexhaustive-delayqueue" }
-nym-node-requests = { version = "1.21.1", path = "nym-node/nym-node-requests", default-features = false }
-nym-node-metrics = { version = "1.21.1", path = "nym-node/nym-node-metrics" }
-nym-node-families-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/node-families-contract" }
-nym-ordered-buffer = { version = "1.21.1", path = "common/socks5/ordered-buffer" }
-nym-outfox = { version = "1.21.1", path = "nym-outfox" }
-nym-registration-common = { version = "1.21.1", path = "common/registration" }
-nym-pemstore = { version = "1.21.1", path = "common/pemstore" }
-nym-performance-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
-nym-sdk = { version = "1.21.1", path = "sdk/rust/nym-sdk" }
-nym-serde-helpers = { version = "1.21.1", path = "common/serde-helpers" }
-nym-service-providers-common = { version = "1.21.1", path = "service-providers/common" }
-nym-service-provider-requests-common = { version = "1.21.1", path = "common/service-provider-requests-common" }
-nym-socks5-client-core = { version = "1.21.1", path = "common/socks5-client-core" }
-nym-socks5-proxy-helpers = { version = "1.21.1", path = "common/socks5/proxy-helpers" }
-nym-socks5-requests = { version = "1.21.1", path = "common/socks5/requests" }
-nym-sphinx = { version = "1.21.1", path = "common/nymsphinx" }
-nym-sphinx-acknowledgements = { version = "1.21.1", path = "common/nymsphinx/acknowledgements" }
-nym-sphinx-addressing = { version = "1.21.1", path = "common/nymsphinx/addressing" }
-nym-sphinx-anonymous-replies = { version = "1.21.1", path = "common/nymsphinx/anonymous-replies" }
-nym-sphinx-chunking = { version = "1.21.1", path = "common/nymsphinx/chunking" }
-nym-sphinx-cover = { version = "1.21.1", path = "common/nymsphinx/cover" }
-nym-sphinx-forwarding = { version = "1.21.1", path = "common/nymsphinx/forwarding" }
-nym-sphinx-framing = { version = "1.21.1", path = "common/nymsphinx/framing" }
-nym-sphinx-params = { version = "1.21.1", path = "common/nymsphinx/params" }
-nym-sphinx-routing = { version = "1.21.1", path = "common/nymsphinx/routing" }
-nym-sphinx-types = { version = "1.21.1", path = "common/nymsphinx/types" }
-nym-statistics-common = { version = "1.21.1", path = "common/statistics" }
-nym-store-cipher = { version = "1.21.1", path = "common/store-cipher" }
-nym-task = { version = "1.21.1", path = "common/task" }
-nym-tun = { version = "1.21.1", path = "common/tun" }
-nym-test-utils = { version = "1.21.1", path = "common/test-utils" }
-nym-ticketbooks-merkle = { version = "1.21.1", path = "common/ticketbooks-merkle" }
-nym-topology = { version = "1.21.1", path = "common/topology" }
-nym-types = { version = "1.21.1", path = "common/types" }
-nym-upgrade-mode-check = { version = "1.21.1", path = "common/upgrade-mode-check" }
-nym-validator-client = { version = "1.21.1", path = "common/client-libs/validator-client", default-features = false }
-nym-vesting-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/vesting-contract" }
-nym-network-monitors-contract-common = { version = "1.21.1", path = "common/cosmwasm-smart-contracts/network-monitors-contract" }
-nym-verloc = { version = "1.21.1", path = "common/verloc" }
-nym-wireguard = { version = "1.21.1", path = "common/wireguard" }
-nym-wireguard-types = { version = "1.21.1", path = "common/wireguard-types" }
-nym-wireguard-private-metadata-shared = { version = "1.21.1", path = "common/wireguard-private-metadata/shared" }
-nym-wireguard-private-metadata-client = { version = "1.21.1", path = "common/wireguard-private-metadata/client" }
-nym-wireguard-private-metadata-server = { version = "1.21.1", path = "common/wireguard-private-metadata/server" }
-nym-sqlx-pool-guard = { version = "1.21.1", path = "nym-sqlx-pool-guard" }
-nym-wasm-client-core = { version = "1.21.1", path = "common/wasm/client-core" }
-nym-wasm-storage = { version = "1.21.1", path = "common/wasm/storage" }
-nym-wasm-utils = { version = "1.21.1", path = "common/wasm/utils", default-features = false }
-nyxd-scraper-shared = { version = "1.21.1", path = "common/nyxd-scraper-shared" }
-
-smolmix = { version = "1.21.1", path = "smolmix/core" }
-
 # coconut/DKG related
-# unfortunately until https://github.com/zkcrypto/nym-bls12_381-fork/issues/10 is resolved, we have to rely on the fork
+# unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-# plus to make our live easier we need serde support from https://github.com/zkcrypto/nym-bls12_381-fork/pull/125
-nym-bls12_381-fork = { version = "0.8.0-forked", default-features = false }
+# plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect-updated" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.1", default-features = false }
 subtle = "2.5.0"
@@ -563,9 +397,7 @@ cw-multi-test = "=2.3.2"
 bip32 = { version = "0.5.3", default-features = false }


-cosmrs = { version = "0.22.0" }
-cosmos-sdk-proto = { version = "0.27.0" }
-ibc-proto = { version = "0.52.0" }
+cosmrs = { version = "0.21.1" }
 tendermint = "0.40.4"
 tendermint-rpc = "0.40.4"
 prost = { version = "0.13", default-features = false }
@@ -584,7 +416,6 @@ wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
-webpki-roots = "0.26"
 web-sys = "0.3.76"

 # for local development:
@@ -603,7 +434,18 @@ opt-level = 3
 # lto = true
 opt-level = 'z'

-[profile.release.package.smolmix-wasm]
+[profile.release.package.nym-node-tester-wasm]
+# lto = true
+opt-level = 'z'
+
+# Commented out since the crate is also commented out from the inclusion in the
+# workspace above. We should uncomment this if we re-include it in the
+# workspace
+#[profile.release.package.nym-wasm-sdk]
+## lto = true
+#opt-level = 'z'
+
+[profile.release.package.mix-fetch-wasm]
 # lto = true
 opt-level = 'z'

@@ -611,11 +453,6 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }

 [workspace.lints.clippy]
-suspicious = "deny"
-complexity = "deny"
-perf = "deny"
-style = "deny"
-
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"
@@ -104,30 +104,29 @@ $(eval $(call add_cargo_workspace,wallet,nym-wallet))
 sdk-wasm: sdk-wasm-build sdk-wasm-test sdk-wasm-lint

 sdk-wasm-build:
+	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
-	$(MAKE) -C wasm/smolmix
-# 	$(MAKE) -C wasm/zknym-lib
+	$(MAKE) -C wasm/node-tester
+	# $(MAKE) -C wasm/mix-fetch
+	$(MAKE) -C wasm/zknym-lib
+	# $(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
-#
-# `mix-tunnel` must build before the three feature packages — they import it
-# via `workspace:*` and the lerna topological sort will respect that as long
-# as we keep them in the same `--scope` invocation.
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	npx lerna run --scope '{@nymproject/mix-tunnel,@nymproject/mix-fetch,@nymproject/mix-dns,@nymproject/mix-websocket}' build --stream
-	pnpm --pwd sdk/typescript/codegen/contract-clients build
+	# npx lerna run --scope @nymproject/mix-fetch build --stream
+	# npx lerna run --scope @nymproject/node-tester build --stream
+	# yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
-
-WASM_CRATES = nym-client-wasm
+WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib

 sdk-wasm-test:
 	#cargo test $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings

 sdk-wasm-lint:
-	RUSTFLAGS='--cfg getrandom_backend="wasm_js"' cargo clippy $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
-	$(MAKE) -C wasm/smolmix check-fmt
+	cargo clippy $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
+	$(MAKE) -C wasm/mix-fetch check-fmt

 # Add to top-level targets
 build: sdk-wasm-build
@@ -223,7 +222,7 @@ build-nym-cli:

 generate-typescript:
 	cd tools/ts-rs-cli && cargo run && cd ../..
-	pnpm types:lint:fix
+	yarn types:lint:fix

 # Run the integration tests for public nym-api endpoints
 run-api-tests:
@@ -30,11 +30,8 @@ client ───► Gateway ──┘  mix  │  mix  ┌─►mix ───►

 ```

-<!-- This is broken 
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
-->

-> This project integrates with the Midnight Network

 ### Building

@@ -74,9 +71,9 @@ Nym Node Operators and Validators Terms and Conditions can be found [here](https
 ## Getting Started

 ```bash
-pnpm install
+yarn install
 ```

 ```bash
-pnpm build
+yarn build
 ```
@@ -1,191 +0,0 @@
-# config file for ansible -- http://ansible.com/
-# ==============================================
-
-# nearly all parameters can be overridden in ansible-playbook 
-# or with command line flags. ansible will read ANSIBLE_CONFIG,
-# ansible.cfg in the current working directory, .ansible.cfg in
-# the home directory or /etc/ansible/ansible.cfg, whichever it
-# finds first
-
-[defaults]
-# some basic default values...
-
-inventory       = inventory/all
-#library        = /usr/share/my_modules/
-remote_tmp     = $HOME/.ansible/tmp
-pattern        = *
-forks          = 5
-poll_interval  = 15
-transport      = smart
-remote_port    = 22
-module_lang    = C
-
-# plays will gather facts by default, which contain information about
-# the remote system.
-#
-# smart - gather by default, but don't regather if already gathered
-# implicit - gather by default, turn off with gather_facts: False
-# explicit - do not gather by default, must say gather_facts: True
-gathering = implicit
-
-# additional paths to search for roles in, colon separated
-roles_path    = ../roles
-
-# uncomment this to disable SSH key host checking
-host_key_checking = False
-
-# what flags to pass to sudo
-#sudo_flags = -H
-
-# SSH timeout
-timeout = 100
-
-# default user to use for playbooks if user is not specified
-# (/usr/bin/ansible will use current user as default)
-#remote_user = root
-
-# logging is off by default unless this path is defined
-# if so defined, consider logrotate
-#log_path = /var/log/ansible.log
-
-# default module name for /usr/bin/ansible
-#module_name = command
-
-# use this shell for commands executed under sudo
-# you may need to change this to bin/bash in rare instances
-# if sudo is constrained
-#executable = /bin/sh
-
-# if inventory variables overlap, does the higher precedence one win
-# or are hash values merged together?  The default is 'replace' but
-# this can also be set to 'merge'.
-#hash_behaviour = replace
-
-# list any Jinja2 extensions to enable here:
-#jinja2_extensions = jinja2.ext.do,jinja2.ext.i18n
-
-# if set, always use this private key file for authentication, same as 
-# if passing --private -key to ansible or ansible-playbook
-#private_key_file = /path/to/file
-
-# format of string {{ ansible_managed }} available within Jinja2 
-# templates indicates to users editing templates files will be replaced.
-# replacing {file}, {host} and {uid} and strftime codes with proper values.
-ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}
-
-# by default, ansible-playbook will display "Skipping [host]" if it determines a task
-# should not be run on a host.  Set this to "False" if you don't want to see these "Skipping" 
-# messages. NOTE: the task header will still be shown regardless of whether or not the 
-# task is skipped.
-#display_skipped_hosts = True
-
-# by default (as of 1.3), Ansible will raise errors when attempting to dereference 
-# Jinja2 variables that are not set in templates or action lines. Uncomment this line
-# to revert the behavior to pre-1.3.
-#error_on_undefined_vars = False
-
-# by default (as of 1.6), Ansible may display warnings based on the configuration of the
-# system running ansible itself. This may include warnings about 3rd party packages or
-# other conditions that should be resolved if possible.
-# to disable these warnings, set the following value to False:
-#system_warnings = True
-
-# by default (as of 1.4), Ansible may display deprecation warnings for language
-# features that should no longer be used and will be removed in future versions.
-# to disable these warnings, set the following value to False:
-#deprecation_warnings = True
-
-# (as of 1.8), Ansible can optionally warn when usage of the shell and
-# command module appear to be simplified by using a default Ansible module
-# instead.  These warnings can be silenced by adjusting the following
-# setting or adding warn=yes or warn=no to the end of the command line 
-# parameter string.  This will for example suggest using the git module
-# instead of shelling out to the git command.
-# command_warnings = False
-
-
-# set plugin path directories here, separate with colons
-action_plugins     = ../../other/plugins/action
-callback_plugins   = ../../other/plugins/callback
-connection_plugins = ../../other/plugins/connection
-lookup_plugins     = ../../other/plugins/lookup
-vars_plugins       = ../../other/plugins/vars
-filter_plugins     = ../../other/plugins/filter
-
-# by default callbacks are not loaded for /bin/ansible, enable this if you
-# want, for example, a notification or logging callback to also apply to 
-# /bin/ansible runs
-#bin_ansible_callbacks = False
-
-
-# don't like cows?  that's unfortunate.
-# set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1 
-#nocows = 1
-
-# don't like colors either?
-# set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1
-#nocolor = 1
-
-# the CA certificate path used for validating SSL certs. This path 
-# should exist on the controlling node, not the target nodes
-# common locations:
-# RHEL/CentOS: /etc/pki/tls/certs/ca-bundle.crt
-# Fedora     : /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
-# Ubuntu     : /usr/share/ca-certificates/cacert.org/cacert.org.crt
-#ca_file_path = 
-
-# the http user-agent string to use when fetching urls. Some web server
-# operators block the default urllib user agent as it is frequently used
-# by malicious attacks/scripts, so we set it to something unique to 
-# avoid issues.
-#http_user_agent = ansible-agent
-
-# if set to a persistant type (not 'memory', for example 'redis') fact values
-# from previous runs in Ansible will be stored.  This may be useful when
-# wanting to use, for example, IP information from one group of servers
-# without having to talk to them in the same playbook run to get their
-# current IP information.
-fact_caching = memory
-
-[paramiko_connection]
-
-# uncomment this line to cause the paramiko connection plugin to not record new host
-# keys encountered.  Increases performance on new host additions.  Setting works independently of the
-# host key checking setting above.
-#record_host_keys=False
-
-# by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this
-# line to disable this behaviour.
-#pty=False
-
-[ssh_connection]
-
-# ssh arguments to use
-# Leaving off ControlPersist will result in poor performance, so use 
-# paramiko on older platforms rather than removing it
-#ssh_args = -o ControlMaster=auto -o ControlPersist=60s
-
-# The path to use for the ControlPath sockets. This defaults to
-# "%(directory)s/ansible-ssh-%%h-%%p-%%r", however on some systems with
-# very long hostnames or very long path names (caused by long user names or 
-# deeply nested home directories) this can exceed the character limit on
-# file socket names (108 characters for most platforms). In that case, you 
-# may wish to shorten the string below.
-# 
-# Example: 
-# control_path = %(directory)s/%%h-%%r
-#control_path = %(directory)s/ansible-ssh-%%h-%%p-%%r
-
-# Enabling pipelining reduces the number of SSH operations required to 
-# execute a module on the remote server. This can result in a significant 
-# performance improvement when enabled, however when using "sudo:" you must 
-# first disable 'requiretty' in /etc/sudoers
-#
-# By default, this option is disabled to preserve compatibility with
-# sudoers configurations that have requiretty (the default on many distros).
-# 
-#pipelining = False
-
-# if True, make ansible use scp if the connection type is ssh 
-# (default is sftp)
-scp_if_ssh = True
@@ -1,8 +0,0 @@
---
- name: Nym node auto-bonding
-  hosts: all
-  gather_facts: false
-  serial: 1
-
-  roles:
-    - role: postinstall-auto
@@ -1,8 +0,0 @@
---
- name: Nym node bonding / post-installation
-  hosts: all    # or a specific host/group
-  gather_facts: false
-  serial: 1  
-
-  roles:
-    - role: postinstall
@@ -1,10 +0,0 @@
---
- name: "Deploy Nym node"
-  hosts: all    # or a specific host/group
-  become: true
-  roles:
-    - base
-    - nym
-    - nginx
-    - tunnel # comment out for mixnode
-    - quic   # comment out for mixnode or non-wireguard gateway
@@ -1,111 +0,0 @@
---
-###############################################################################
-## GLOBAL VARS
-## These values will be used globally unless overwritten per node in inventory/all
-## Set these vars only if you want them globally for all nodes
-## Per node changes in inventory/all will overwrite these global vars
-###############################################################################
-
-## MANDATORY - uncomment & define
-
-## --SSH--
-#ansible_user: root                                  # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net`
-# ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>    
-
-## --Operator info--
-# email: "<EMAIL>"                                  # used in certbot, description.toml and landing page
-# website: "<WEBSITE>"                              # it is used in the description.toml
-# description: "<NODE_PUBLIC_DESCRIPTION>"          # or define per node in inventory/all
-# moniker: "<MONIKER>" 
-
-## --Node defaults (can override per node in inventory/all)--
-# accept_operator_terms: true                       # controls --accept-operator-terms-and-conditions, read: https://nym.com/docs/operators/nodes/nym-node/setup#terms--conditions
-# mode: exit-gateway                                # entry-gateway/exit-gateway/mixnode
-# wireguard_enabled: true                           # true/false
-hostname: ""                                        # keep this fallback, keep it and setup hostname per node in inventory/all
-
-## OPTIONAL - uncomment & define
-
-# operator_name: "<OPERATOR_NAME>"          # used in landing page if provided
-# nym_version: "nym-binaries-v2026.7-tola"  # to use particular version instead of Latest, provide in such form: 
-
-## alternative SSH key var setting, instead of a hardcoded path
-## useful if the playbook is shared in a repo by more admins with each having own local key
-# ansible_ssh_private_key_file: "{{ lookup('env', '<YOUR_ANSIBLE SSH_KEY_ENV_VAR>') }}"
-
-###############################################################################
-## GLOBAL PACKAGES & URLs
-## These will be installed during deployment
-###############################################################################
-
-nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
-tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh"
-quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
-
-packages:
-  - tmux
-  - speedtest-cli
-  - nano
-  - htop
-  - git
-  - zip
-  - nala
-  - curl
-  - neovim
-  - ca-certificates
-  - jq
-  - wget
-  - ufw
-
-
-###############################################################################
-## SYSTEM MAINTENANCE PLAYBOOK KNOBS
-###############################################################################
-
-## JOURNALD LIMITS
-
-# journald_system_max_use: "100M"        # max persistent journal size
-# journald_runtime_max_use: "50M"        # max runtime journal size
-# journald_system_max_file_size: "25M"   # max single journal file
-# journald_runtime_max_file_size: "10M"  # max runtime journal file
-# journald_max_retention_sec: "3day"     # retention time
-
-# journald_rate_limit_interval: "30s"    # rate limit window
-# journald_rate_limit_burst: "1000"      # rate limit burst
-
-
-## NYM-NODE LOG CONTROL
-
-# nymnode_log_level_max: "warning"       # drop INFO logs
-# nymnode_rate_limit_interval: "30s"     # per nym-node rate limit window
-# nymnode_rate_limit_burst: "200"        # per nym-node rate limit burst
-
-
-## JOURNAL VACUUM TARGETS
-
-# journal_vacuum_size: "100M"
-# journal_vacuum_time: "3days"
-
-
-## RSYSLOG
-
-# disable_rsyslog: true
-
-
-## FSTRIM SCHEDULE
-
-# fstrim_every_calendar: "*:0/15"        # Aggressive
-# fstrim_every_calendar: "hourly"        # Less aggressive
-
-
-## OPTIONAL CLEANUPS
-
-# enable_apt_cleanup: true
-# enable_snap_cleanup: true
-
-
-## WRITEBACK TUNING
-
-# enable_writeback_tuning: true
-# writeback_dirty_writeback_centisecs: 1500
-# writeback_dirty_expire_centisecs: 6000
@@ -1,39 +0,0 @@
-[nym_nodes]
-## READ CONFIGURATION GUIDE:
-## https://nym.com/docs/operators/orchestration/ansible#configuration
-
-##############
-## TEMPLATE ##
-##############
-## uncomment and exchange the <VARIABLES> with your real values for each node without the <> brackets
-
-# node1 ansible_host=<YOUR_SERVER_IP> ansible_user=<USER> hostname=<HOSTNAME> location=<LOCATION> email=<EMAIL> mode=<MODE> wireguard_enabled=<true/false> moniker=<MONIKER> description=<DESCRIPTION>
-
-####################
-## VARIABLES INFO ##
-####################
-
-## --REQUIRED VARS--
-## required per node: 
-## ansible_host, hostname, location
-
-## --OPTIONAL VARS--
-## can be set in the group_vars/all.yml or per node here:
-## email, ansible_user, moniker, description,  mode, wireguard_enabled
-
-## --PRIORITY ORDER--
-## anything setup globaly can be overwritten in this file per node  
-## if provided here, it takes priority over the global setting
-
-## --EXAMPLES--
-## exit + wireguard gateway:
-# node2 ansible_host=11.12.13.14 hostname=nym-exit.ch-1.mydomain.net mode=exit-gateway location=CH wireguard_enabled=true
-
-## entry gateway, no wireguard:
-# node3 ansible_host=12.13.14.15 hostname=nym-entry.ch-2.mydomain.net mode=entry-gateway location=CH wireguard_enabled=false
-
-## mixnode (comment out tunnel+quic roles in deploy.yml for these)
-# mix-de-1   ansible_host=13.14.15.16  hostname=nym-mix.de-1.example.net  location=DE  mode=mixnode  wireguard_enabled=false
-
-## NOTE:
-## all examples above don't have defined user, email nor description as we use global vars from playbooks/group_vars/all.yml
@@ -1,42 +0,0 @@
-# Mitigation playbook for CopyFail (CVE-2026-31431) and DirtyFrag (CVE-2026-43284 / CVE-2026-43500)
-# This playbook applies interim module blacklists only
-# Kernel patches are not yet available (May 2026)
-# Once patched kernels ship, use remove_kernel_CVE_mitigations.yml to reverse everything
-# This playbook is idempotent - safe to re-run if mitigations were already applied
-
- name: Mitigate Copy Fail + Dirty Frag
-  hosts: all
-  become: true
-  tasks:
-    - name: Blacklist algif_aead (Copy Fail)
-      copy:
-        dest: /etc/modprobe.d/disable-algif_aead.conf
-        content: "install algif_aead /bin/false\n"
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Blacklist esp4, esp6, rxrpc (Dirty Frag)
-      copy:
-        dest: /etc/modprobe.d/dirtyfrag.conf
-        content: |
-          install esp4 /bin/false
-          install esp6 /bin/false
-          install rxrpc /bin/false
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Unload all affected modules
-      modprobe:
-        name: "{{ item }}"
-        state: absent
-      loop:
-        - algif_aead
-        - esp4
-        - esp6
-        - rxrpc
-      ignore_errors: true
-
-    - name: Drop page cache to clear any contamination
-      shell: echo 3 > /proc/sys/vm/drop_caches
@@ -1,111 +0,0 @@
-############################################################################################
-############################################################################################
-############################################################################################
-#### THIS PLAYBOOK IS NOT MEANT TO BE RUN YET, IT IS NOT REFERRED IN ANY DOCUMENTATION! ####
-############################################################################################
-############################################################################################
-############################################################################################
-#
-# Reversal playbook for mitigate_kernel_CVE.yml (CopyFail CVE-2026-31431 / DirtyFrag CVE-2026-43284 / CVE-2026-43500).
-#
-# Run this AFTER your distro has shipped the patched kernel.
-# This playbook:
-#   1. Updates the kernel via apt
-#   2. Reboots and waits for reconnect
-#   3. Verifies the running kernel is newer than the pre-patch version
-#   4. Removes the interim module blacklists
-#   5. Re-enables the affected modules live (no second reboot needed)
-#
-# Debian family only (Debian, Ubuntu). Tested on Debian 11, Debian 12, Ubuntu 20.04, 22.04, 24.04.
-#
-# For exit-gateway nodes with --wireguard-enabled true:
-# After this playbook completes, run the networking restore step on each node via:
-#   ansible-playbook deploy.yml -t ntm
-# See the CVE patch documentation for details.
-
- name: Remove CVE mitigations and apply patched kernel
-  hosts: all
-  become: true
-
-  tasks:
-    - name: Verify OS is Debian family
-      assert:
-        that:
-          - ansible_os_family == "Debian"
-        fail_msg: "This playbook supports Debian-family distros only (Debian, Ubuntu). For other distros, apply the kernel update and mitigation removal manually."
-
-    - name: Update apt cache
-      apt:
-        update_cache: true
-        cache_valid_time: 0
-
-    - name: Upgrade kernel packages
-      apt:
-        upgrade: full
-        only_upgrade: false
-      register: apt_upgrade_result
-
-    - name: Record pre-reboot kernel version
-      command: uname -r
-      register: kernel_before
-      changed_when: false
-
-    - name: Reboot to load patched kernel
-      reboot:
-        msg: "Rebooting to apply patched kernel (CVE-2026-31431 / CVE-2026-43284 / CVE-2026-43500)"
-        reboot_timeout: 300
-        pre_reboot_delay: 5
-        post_reboot_delay: 15
-
-    - name: Record post-reboot kernel version
-      command: uname -r
-      register: kernel_after
-      changed_when: false
-
-    - name: Show kernel versions before and after reboot
-      debug:
-        msg:
-          - "Kernel before reboot: {{ kernel_before.stdout }}"
-          - "Kernel after reboot:  {{ kernel_after.stdout }}"
-
-    - name: Warn if kernel did not change after reboot
-      debug:
-        msg: >
-          WARNING: kernel version did not change after reboot ({{ kernel_after.stdout }}).
-          The patched kernel may not have been selected by GRUB, or no kernel update was available.
-          Do NOT remove the interim mitigations until you have confirmed the running kernel is patched.
-          Check: apt-cache policy linux-image-amd64   # Debian
-          Check: apt-cache policy linux-image-generic  # Ubuntu
-      when: kernel_before.stdout == kernel_after.stdout
-
-    - name: Remove algif_aead blacklist
-      file:
-        path: /etc/modprobe.d/disable-algif_aead.conf
-        state: absent
-
-    - name: Remove DirtyFrag blacklist (esp4, esp6, rxrpc)
-      file:
-        path: /etc/modprobe.d/dirtyfrag.conf
-        state: absent
-
-    - name: Re-enable affected modules live
-      modprobe:
-        name: "{{ item }}"
-        state: present
-      loop:
-        - esp4
-        - esp6
-        - rxrpc
-        - algif_aead
-      ignore_errors: true
-
-    - name: Confirm nym-node service is still running
-      systemd:
-        name: nym-node
-        state: started
-      register: nym_node_status
-      failed_when: false
-
-    - name: Show nym-node status
-      debug:
-        msg: "nym-node service state: {{ nym_node_status.state | default('unknown - service may not exist on this node') }}"
@@ -1,38 +0,0 @@
---
- name: Restrict logging, vacuum journals, and enable periodic trim
-  hosts: all
-  become: true
-  gather_facts: false
-
-  # global knobs - override in inventory/group_vars/host_vars as needed
-  vars:
-    journald_system_max_use: "100M"
-    journald_runtime_max_use: "50M"
-    journald_system_max_file_size: "25M"
-    journald_runtime_max_file_size: "10M"
-    journald_max_retention_sec: "3day"
-    journald_rate_limit_interval: "30s"
-    journald_rate_limit_burst: "1000"
-
-    # per nym-node rate limit + level cap
-    nymnode_log_level_max: "warning"
-    nymnode_rate_limit_interval: "30s"
-    nymnode_rate_limit_burst: "200"
-
-    # journal vacuum targets
-    journal_vacuum_size: "100M"
-    journal_vacuum_time: "3days"
-
-    # fstrim cadence (note: the systemd override uses cron-like calendar)
-    fstrim_every_calendar: "*:0/15"
-
-  roles:
-    - role: journald_limits
-    - role: nymnode_logging
-    - role: rsyslog_disable
-    - role: journal_vacuum
-    - role: classic_log_cleanup
-    - role: apt_cleanup
-    - role: snap_cleanup
-    - role: fstrim_15min
-    - role: report
@@ -1,9 +0,0 @@
---
- name: "Upgrade Nym node"
-  hosts: all    # or a specific host/group or limit via -l on CLI (ansible-playbook playbooks/upgrade.yml -l mynode1)
-  become: true
-  serial: 1
-  
-  roles:
-    - base
-    - upgrade
@@ -1,21 +0,0 @@
---
- name: Clean apt cache
-  command: apt-get clean
-  ignore_errors: true
-
- name: Autoremove unused packages
-  command: apt-get -y autoremove
-  ignore_errors: true
-
- name: Remove apt lists to reclaim space (they will be re-fetched on update)
-  file:
-    path: /var/lib/apt/lists
-    state: absent
-  ignore_errors: true
-
- name: Recreate apt lists directory
-  file:
-    path: /var/lib/apt/lists
-    state: directory
-    mode: "0755"
-  ignore_errors: true
@@ -1,23 +0,0 @@
---
- name: Set hostname
-  hostname:
-    name: "{{ hostname }}"
-  when: hostname is defined and hostname | length > 0
-
- name: Install aptitude
-  apt:
-    name: aptitude
-    update_cache: yes
-    state: present
-    force_apt_get: yes
-
- name: Update packages
-  apt:
-    update_cache: yes
-    upgrade: yes
-
- name: Install essential packages
-  package:
-    name: "{{ packages }}"
-    state: latest
-    update_cache: yes
@@ -1,20 +0,0 @@
---
- name: Remove classic /var/log files if present (optional)
-  file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - /var/log/syslog
-    - /var/log/syslog.1
-    - /var/log/kern.log
-    - /var/log/kern.log.1
-    - /var/log/auth.log
-    - /var/log/auth.log.1
-    - /var/log/ufw.log
-    - /var/log/ufw.log.1
-  ignore_errors: true
-
-# This is best-effort and may still fail if other packages' postrotate scripts assume services exist.
- name: Force logrotate (best-effort)
-  command: "logrotate --force /etc/logrotate.conf"
-  ignore_errors: true
@@ -1,3 +0,0 @@
---
-fstrim_timer_dropin_dir: "/etc/systemd/system/fstrim.timer.d"
-fstrim_every_calendar: "*:0/15"
@@ -1,31 +0,0 @@
---
- name: Ensure systemd drop-in dir for fstrim.timer exists
-  file:
-    path: "{{ fstrim_timer_dropin_dir }}"
-    state: directory
-    mode: "0755"
-
- name: Override fstrim.timer schedule
-  copy:
-    dest: "{{ fstrim_timer_dropin_dir }}/override.conf"
-    mode: "0644"
-    content: |
-      [Timer]
-      OnCalendar=
-      OnCalendar={{ fstrim_every_calendar }}
-      Persistent=true
-      RandomizedDelaySec=0
-
- name: Reload systemd after fstrim override
-  systemd:
-    daemon_reload: true
-
- name: Enable and start fstrim timer
-  systemd:
-    name: fstrim.timer
-    enabled: true
-    state: started
-
- name: Run fstrim now (best-effort)
-  command: fstrim -av
-  ignore_errors: true
@@ -1,3 +0,0 @@
---
-journal_vacuum_size: "100M"
-journal_vacuum_time: "3days"
@@ -1,6 +0,0 @@
---
- name: Vacuum journal to size cap (hard)
-  command: "journalctl --vacuum-size={{ journal_vacuum_size }}"
-
- name: Vacuum journal older than retention window (time)
-  command: "journalctl --vacuum-time={{ journal_vacuum_time }}"
@@ -1,8 +0,0 @@
---
-journald_system_max_use: "100M"
-journald_runtime_max_use: "50M"
-journald_system_max_file_size: "25M"
-journald_runtime_max_file_size: "10M"
-journald_max_retention_sec: "3day"
-journald_rate_limit_interval: "30s"
-journald_rate_limit_burst: "1000"
@@ -1,5 +0,0 @@
---
- name: Restart journald
-  systemd:
-    name: systemd-journald
-    state: restarted
@@ -1,20 +0,0 @@
---
- name: Configure journald limits (persistent, capped, rate-limited)
-  copy:
-    dest: /etc/systemd/journald.conf
-    mode: "0644"
-    content: |
-      [Journal]
-      Storage=persistent
-      Compress=yes
-      Seal=yes
-
-      SystemMaxUse={{ journald_system_max_use }}
-      RuntimeMaxUse={{ journald_runtime_max_use }}
-      SystemMaxFileSize={{ journald_system_max_file_size }}
-      RuntimeMaxFileSize={{ journald_runtime_max_file_size }}
-      MaxRetentionSec={{ journald_max_retention_sec }}
-
-      RateLimitIntervalSec={{ journald_rate_limit_interval }}
-      RateLimitBurst={{ journald_rate_limit_burst }}
-  notify: Restart journald
@@ -1,10 +0,0 @@
---
- name: Reload nginx
-  service:
-    name: nginx
-    state: reloaded
-
- name: Restart nginx
-  service:
-    name: nginx
-    state: restarted
@@ -1,167 +0,0 @@
---
- name: Install nginx and certbot
-  apt:
-    name:
-      - nginx
-      - certbot
-      - python3-certbot-nginx
-    state: present
-    update_cache: yes
-
- name: Ensure nginx snippets directory exists
-  file:
-    path: /etc/nginx/snippets
-    state: directory
-    mode: "0755"
-
-# own SSL defaults - don't rely on certbot files
- name: Install Nym SSL options snippet
-  copy:
-    dest: /etc/nginx/snippets/nym-ssl-options.conf
-    mode: "0644"
-    content: |
-      ssl_session_cache shared:NYMSSL:10m;
-      ssl_session_timeout 1d;
-      ssl_session_tickets off;
-
-      ssl_protocols TLSv1.2 TLSv1.3;
-      ssl_prefer_server_ciphers off;
-
-      # Reasonable modern cipher set (works across Ubuntu nginx builds)
-      ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305";
-
-      # OCSP stapling is nice but can break if resolver isn't set; keep minimal here.
-  notify: Restart nginx
-
- name: Ensure web root directory exists
-  file:
-    path: "/var/www/{{ hostname }}"
-    state: directory
-    mode: "0755"
-
- name: Deploy landing page
-  template:
-    src: landing.html.j2
-    dest: "/var/www/{{ hostname }}/index.html"
-    mode: "0644"
-  notify: Restart nginx
-
-# remove default site - safe on fresh + redeploy
- name: Disable default nginx site symlink
-  file:
-    path: /etc/nginx/sites-enabled/default
-    state: absent
-  notify: Restart nginx
-
- name: Remove default nginx site definition if present
-  file:
-    path: /etc/nginx/sites-available/default
-    state: absent
-  notify: Restart nginx
-
-# always deploy/enable HTTP vhost
- name: Deploy HTTP vhost
-  template:
-    src: nginx-site.conf.j2
-    dest: "/etc/nginx/sites-available/{{ hostname }}"
-    mode: "0644"
-  notify: Restart nginx
-
- name: Enable HTTP vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/{{ hostname }}"
-    dest: "/etc/nginx/sites-enabled/{{ hostname }}"
-    state: link
-    force: true
-  notify: Restart nginx
-
-# detect if cert exists already
- name: Check whether certificate exists
-  stat:
-    path: "/etc/letsencrypt/live/{{ hostname }}/fullchain.pem"
-  register: le_cert
-
-# if cert does NOT exist yet, ensure SSL/WSS are NOT enabled
- name: Ensure SSL and WSS vhosts are disabled until cert exists
-  file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - "/etc/nginx/sites-enabled/{{ hostname }}-ssl"
-    - "/etc/nginx/sites-enabled/nym-wss-config"
-  notify: Restart nginx
-
- name: Ensure nginx is enabled and running (needed for ACME http-01)
-  service:
-    name: nginx
-    state: started
-    enabled: yes
-
- name: Validate nginx configuration (HTTP stage)
-  command: nginx -t
-  changed_when: false
-
- name: Flush handlers (ensure HTTP is active before certbot)
-  meta: flush_handlers
-
-# certbot strategy:
-# - if cert exists: webroot - doesn't touch nginx
-# - else:  --nginx works first-time; may touch nginx
- name: Obtain/renew certificate
-  command:
-    cmd: >-
-      certbot certonly --nginx
-      --non-interactive --agree-tos --keep-until-expiring
-      -m {{ email }} -d {{ hostname }}
-  register: certbot_result
-  failed_when: false  
-  
-  
-
-# re-check cert after certbot attempt
- name: Re-check whether certificate exists after certbot
-  stat:
-    path: "/etc/letsencrypt/live/{{ hostname }}/fullchain.pem"
-  register: le_cert_after
-
-# only deploy/enable SSL & WSS if cert exists
- name: Deploy HTTPS vhost for {{ hostname }}
-  template:
-    src: nginx-site-ssl.conf.j2
-    dest: "/etc/nginx/sites-available/{{ hostname }}-ssl"
-    mode: "0644"
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Enable HTTPS vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/{{ hostname }}-ssl"
-    dest: "/etc/nginx/sites-enabled/{{ hostname }}-ssl"
-    state: link
-    force: true
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Deploy WSS vhost
-  template:
-    src: wss-config.conf.j2
-    dest: "/etc/nginx/sites-available/nym-wss-config"
-    mode: "0644"
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Enable WSS vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/nym-wss-config"
-    dest: "/etc/nginx/sites-enabled/nym-wss-config"
-    state: link
-    force: true
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Validate nginx configuration (final)
-  command: nginx -t
-  changed_when: false
-
- name: Flush handlers (apply restart after successful tests)
-  meta: flush_handlers
@@ -1,218 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-<meta charset="UTF-8">
-<title>This is a NYM Exit Gateway</title>
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<link rel="icon" type="image/png" href="">
-
-<style>
-:root {
-  /* font + theme tokens */
-  font-family: Consolas, "Ubuntu Mono", Menlo, "DejaVu Sans Mono", monospace;
-  --background-color: #242B2D;
-  --text-color: #FFFFFF;
-  --link-color: #07ff94;
-  --title-color: #07ff94;
-}
-
-html {
-  background: var(--background-color);
-}
-
-body {
-  margin-left: auto;
-  margin-right: auto;
-  padding-left: 5vw;
-  padding-right: 5vw;
-  max-width: 1000px;
-  color: var(--text-color); /* default text color */
-}
-
-h1 {
-  font-size: 55px;
-  text-align: center;
-  color: var(--title-color);
-}
-
-p {
-  color: var(--text-color);
-}
-
-p, a {
-  font-size: 20px;
-}
-
-a {
-  color: var(--link-color);
-  text-decoration: none;
-}
-
-a:hover {
-  filter: brightness(.8);
-  text-decoration: underline;
-}
-
-.links {
-  display: flex;
-  flex-wrap: wrap;
-  justify-content: space-evenly;
-}
-
-.links > a {
-  margin: 10px;
-  white-space: nowrap;
-}
-</style>
-</head>
-
-<body>
-<main>
-  <h1>This is a NYM Exit Gateway</h1>
-
-
-  <p>
-    You are most likely accessing this website because you've had some issue with
-    the traffic coming from this IP. This router is part of the <a
-    href="https://nym.com/">NYM project</a>, which is
-    dedicated to <a href="https://nym.com/about/mission">create</a> outstanding
-    privacy software that is legally compliant without sacrificing integrity or
-    having any backdoors.
-    This router IP should be generating no other traffic, unless it has been
-    compromised.
-  </p>
-
-  <p><strong>
-    If you are a representative of a company who feels that this router is being
-    used to violate the DMCA, please be aware that this machine does not host or
-    contain any illegal content. Also be aware that network infrastructure
-    maintainers are not liable for the type of content that passes over their
-    equipment, in accordance with <a
-    href="https://www.law.cornell.edu/uscode/text/17/512">DMCA
-    "safe harbor" provisions</a>. In other words, you will have just as much luck
-    sending a takedown notice to the Internet backbone providers.
-  </strong></p>
-
-  <p>
-    Nym Network is operated by a decentralised community of node operators
-    and stakers. Nym Network is trustless, meaning that no parts of the system
-    nor its operators have access to information that might compromise the privacy
-    of users. Nym software enacts a strict principle of data minimisation and has
-    no back doors. The Nym mixnet works by encrypting packets in several layers
-    and relaying those through a multi-layered network called a mixnet,  eventually
-    letting the traffic exit the Nym mixnet through an exit gateway like this one.
-    This design makes it impossible for a service to know which user is connecting to it,
-    since it can only see the IP-address of the Nym exit gateway:
-  </p>
-
-  <p style="text-align:center;margin:40px 0">
-    <svg xmlns="http://www.w3.org/2000/svg" width="500" viewBox="0 0 490.28 293.73" style="width:100%;max-width:600px" role="img" aria-label="Diagram of how a user connects through the Nym network">
-      <desc>Illustration showing how a user might connect to a service through the Nym Network. The user first sends their data through three daisy-chained encrypted Nym nodes that exist on three different continents. Then the last Nym node in the chain connects to the target service over the normal internet.</desc>
-      <defs>
-        <style>
-          .t {
-            fill: var(--text-color);
-            stroke: var(--text-color);
-          }
-        </style>
-      </defs>
-      <!-- (SVG content left unchanged) -->
-      <path fill="#6fc8b7" d="M257.89 69.4c-6.61-6.36-10.62-7.73-18.36-8.62-7.97-1.83-20.06-7.99-24.17-.67-3.29 5.85-18.2 12.3-16.87 2.08.92-7.03 11.06-13.28 17-17.37 8.69-5.99 24.97-2.87 26.1-10.28 1.04-6.86-8.33-13.22-8.55-2.3-.38 12.84-19.62 2.24-8.73-6.2 8.92-6.9 16.05-9.02 25.61-6.15 12.37 4.83 25.58-2.05 33.73-.71 12.37-2.01 24.69-5.25 37.39-3.96 13 .43 24.08-.14 37.06.63 9.8 1.58 16.5 2.87 26.37 3.6 6.6.48 17.68-.82 24.3 1.9 8.3 4.24.44 10.94-6.89 11.8-8.79 1.05-23.59-1.19-26.6 1.86-5.8 7.41 10.75 5.68 11.27 14.54.57 9.45-5.42 9.38-8.72 16-2.7 4.2.3 13.93-1.18 18.45-1.85 5.64-19.64 4.47-14.7 14.4 4.16 8.34 1.17 19.14-10.33 12.02-5.88-3.65-9.85-22.04-15.66-21.9-11.06.27-11.37 13.18-12.7 17.52-1.3 4.27-3.79 2.33-6-.63-3.54-4.76-7.75-14.22-12.01-17.32-6.12-4.46-10.75-1.17-15.55 2.83-5.63 4.69-8.78 7.82-7.46 16.5.78 9.1-12.9 15.84-14.98 24.09-2.61 10.32-2.57 22.12-8.81 31.47-4 5.98-14.03 20.12-21.27 14.97-7.5-5.34-7.22-14.6-9.56-23.08-2.5-9.02.6-17.35-2.57-26.2-2.45-6.82-6.23-14.54-13.01-13.24-6.5.92-15.08 1.38-19.23-2.97-5.65-5.93-6-10.1-6.61-18.56 1.65-6.94 5.79-12.64 10.38-18.63 3.4-4.42 17.45-10.39 25.26-7.83 10.35 3.38 17.43 10.5 28.95 8.57 3.12-.53 9.14-4.65 7.1-6.62zm-145.6 37.27c-4.96-1.27-11.57 1.13-11.8 6.94-1.48 5.59-4.82 10.62-5.8 16.32.56 6.42 4.34 12.02 8.18 16.97 3.72 3.85 8.58 7.37 9.3 13.1 1.24 5.88 1.6 11.92 2.28 17.87.34 9.37.95 19.67 7.29 27.16 4.26 3.83 8.4-2.15 6.52-6.3-.54-4.54-.6-9.11 1.01-13.27 4.2-6.7 7.32-10.57 12.44-16.64 5.6-7.16 12.74-11.75 14-20.9.56-4.26 5.72-13.86 1.7-16.72-3.14-2.3-15.83-4-18.86-6.49-2.36-1.71-3.86-9.2-9.86-12.07-4.91-3.1-10.28-6.73-16.4-5.97zm11.16-49.42c6.13-2.93 10.58-4.77 14.61-10.25 3.5-4.28 2.46-12.62-2.59-15.45-7.27-3.22-13.08 5.78-18.81 8.71-5.96 4.2-12.07-5.48-6.44-10.6 5.53-4.13.38-9.2-5.66-8.48-6.12.8-12.48-1.45-18.6-1.73-5.3-.7-10.13-1-15.45-1.37-5.37-.05-16.51-2.23-25.13.87-5.42 1.79-12.5 5.3-16.73 9.06-4.85 4.2.2 7.56 5.54 7.45 5.3-.22 16.8-5.36 20.16.98 3.68 8.13-5.82 18.29-5.2 26.69.1 6.2 3.37 11 4.74 16.98 1.62 5.94 6.17 10.45 10 15.14 4.7 5.06 13.06 6.3 19.53 8.23 7.46.14 3.34-9.23 3.01-14.11 1.77-7.15 8.49-7.82 12.68-13.5 7.14-7.72 16.41-13.4 24.34-18.62zM190.88 3.1c-4.69 0-13.33.04-18.17-.34-7.65.12-13.1-.62-19.48-1.09-3.67.39-9.09 3.34-5.28 7.04 3.8.94 7.32 4.92 7.1 9.31 1.32 4.68 1.2 11.96 6.53 13.88 4.76-.2 7.12-7.6 11.93-8.25 6.85-2.05 12.5-4.58 17.87-9.09 2.48-2.76 7.94-6.38 5.26-10.33-1.55-1.31-2.18-.64-5.76-1.13zm178.81 157.37c-2.66 10.08-5.88 24.97 9.4 15.43 7.97-5.72 12.58-2.02 17.47 1.15.5.43 2.65 9.2 7.19 8.53 5.43-2.1 11.55-5.1 14.96-11.2 2.6-4.62 3.6-12.39 2.76-13.22-3.18-3.43-6.24-11.03-7.7-15.1-.76-2.14-2.24-2.6-2.74-.4-2.82 12.85-6.04 1.22-10.12-.05-8.2-1.67-29.62 7.17-31.22 14.86z"/>
-      <g fill="none">
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M135.2 140.58c61.4-3.82 115.95-118.83 151.45-103.33"/>
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M74.43 46.66c38.15 8.21 64.05 42.26 60.78 93.92M286.65 37.25c-9.6 39.44-3.57 57.12-35.64 91.98"/>
-        <path stroke="#e4c101" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M397.92 162.52c-31.38 1.26-90.89-53.54-148.3-36.17"/>
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.77" d="M17.6 245.88c14.35 0 14.4.05 28-.03"/>
-        <path stroke="#e3bf01" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M46.26 274.14c-17.52-.12-16.68.08-30.34.07"/>
-      </g>
-      <g transform="translate(120.8 -35.81)">
-        <circle cx="509.78" cy="68.74" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="440.95" cy="251.87" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="212.62" cy="272.19" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="92.12" cy="87.56" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="730.88" cy="315.83" r="18.12" fill="#67727b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="-102.85" cy="282.18" r="9.18" fill="#240a3b"/>
-        <circle cx="-102.85" cy="309.94" r="9.18" fill="#67727b"/>
-      </g>
-      <g class="t">
-        <text xml:space="preserve" x="-24.76" y="10.37" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="-24.76" y="10.37">The user</tspan></text>
-        <text xml:space="preserve" x="150.63" y="196.62" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="150.63" y="196.62">This server</tspan></text>
-        <text xml:space="preserve" x="346.39" y="202.63" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="346.39" y="202.63">Your service</tspan></text>
-        <text xml:space="preserve" x="34.52" y="249.07" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.52" y="249.07">Nym network link</tspan></text>
-        <text xml:space="preserve" x="34.13" y="276.05" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.13" y="276.05">Unencrypted link</tspan></text>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M222.6 184.1c-2.6-15.27 8.95-23.6 18.43-38.86m186.75 45.61c-.68-10.17-9.4-17.68-18.08-23.49"/>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M240.99 153.41c.35-3.41 1.19-6.17.04-8.17m-7.15 5.48c1.83-2.8 4.58-4.45 7.15-5.48"/>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M412.43 173.21c-2.2-3.15-2.54-3.85-2.73-5.85m0 0c2.46-.65 3.85.01 6.67 1.24M61.62 40.8C48.89 36.98 36.45 27.54 36.9 18.96M61.62 40.8c.05-2.58-3.58-4.8-5.25-5.26m-2.65 6.04c1.8.54 6.8 1.31 7.9-.78"/>
-        <path fill="none" stroke-linecap="round" stroke-linejoin="round" stroke-width="2.44" d="M1.22 229.4h247.74v63.1H1.22z"/>
-      </g>
-    </svg>
-  </p>
-
-  <p><a href="https://nym.com/about/mixnet">Read more about how Nym works.</a></p>
-
-  <p>
-    Nym relies on a growing ecosystem of users, developers and researcher partners
-    aligned with the mission to make sure Nym software is running, remains usable
-    and solves real problems. While Nym is not designed for malicious computer
-    users, it is true that they can use the network for malicious ends. This
-    is largely because criminals and hackers have significantly better access to
-    privacy and anonymity than do the regular users whom they prey upon. Criminals
-    can and do build, sell, and trade far larger and more powerful networks than
-    Nym on a daily basis. Thus, in the mind of this operator, the social need for
-    easily accessible censorship-resistant private, anonymous communication trumps
-    the risk of unskilled bad actors, who are almost always more easily uncovered
-    by traditional police work than by extensive monitoring and surveillance anyway.
-  </p>
-
-  <p>
-    In terms of applicable law, the best way to understand Nym is to consider it a
-    network of routers operating as common carriers, much like the Internet
-    backbone. However, unlike the Internet backbone routers, Nym mixnodes do not
-    contain identifiable routing information about the source of a packet and do
-    mix the user internet traffic with that of other users, making communications
-    private and protecting not just the user content but the metadata
-    (user's IP address, who the user talks to, when, where, from what device and
-    more) and no single Nym node can determine both the origin and destination
-    of a given transmission.
-  </p>
-
-  <p>
-    As such, there is nothing the operator of this Exit Gateway can do to help you
-    track the connection further. This Exit Gateway maintains no logs of any of the
-    Nym Network, so there is little that can be done to trace either legitimate or
-    illegitimate traffic and most importantly the operator cannot tell apart one from
-    the other because of the cryptography design making such selection impossible
-    for the operator. Attempts to seize this router will accomplish nothing.
-  </p>
-
-  <p>
-    To decentralise and enable privacy for a broad range of services, this
-    Exit Gateway adopts an <a href="https://nymtech.net/.wellknown/network-requester/exit-policy.txt">Exit Policy</a>
-    serving as a safeguard.
-  </p>
-
-  <p>
-    That being said, if you still have a complaint about the router, you may email the
-    <a href="mailto:{{ email }}">maintainer</a>. If complaints are related to a particular service that is being abused,
-    the maintainer will submit that to the NYM Operators Community in order to add it to the Exit Policy cited above.
-    The community governance can only blacklist entire IP:port destinations across the entire network.
-  </p>
-
-  <p>
-    You also have the option of blocking this IP address and others on the Nym network if you so desire.
-    The Nym project provides a <a href="https://nym.com/explorer">
-    web service</a> to fetch a list of all IP addresses of Nym Gateway Exit nodes that allow exiting to a
-    specified IP:port combination. Please be considerate when using these options.
-  </p>
-  <p style="text-align:center">
-    <img
-      class="logo"
-      src="https://raw.githubusercontent.com/nymtech/websites/main/www/nym.com/public/images/Nym_meta_Image.png"
-      alt=""
-      style="max-width:320px;width:100%;height:auto"
-      onerror="this.onerror=null;this.src='/images/nym_logo.png';"
-    />
-  </p>
-</main>
-</body>
-</html>
@@ -1,17 +0,0 @@
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
-    server_name {{ hostname }};
-
-    ssl_certificate     /etc/letsencrypt/live/{{ hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem;
-    include /etc/nginx/snippets/nym-ssl-options.conf;
-
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}
@@ -1,18 +0,0 @@
-server {
-    listen 80;
-    listen [::]:80;
-
-    server_name {{ hostname }};
-
-    root /var/www/{{ hostname }};
-    index index.html;
-
-    location ^~ /.well-known/acme-challenge/ {
-        default_type "text/plain";
-        try_files $uri =404;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
@@ -1,34 +0,0 @@
-server {
-    listen 9001 ssl http2;
-    listen [::]:9001 ssl http2;
-
-    server_name {{ hostname }};
-
-    ssl_certificate     /etc/letsencrypt/live/{{ hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem;
-    include /etc/nginx/snippets/nym-ssl-options.conf;
-
-    access_log /var/log/nginx/access.log;
-    error_log  /var/log/nginx/error.log;
-
-    location /favicon.ico {
-        return 204;
-        access_log off;
-        log_not_found off;
-    }
-
-    location / {
-        add_header 'Access-Control-Allow-Origin' '*' always;
-        add_header 'Access-Control-Allow-Credentials' 'true' always;
-        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD' always;
-        add_header 'Access-Control-Allow-Headers' '*' always;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-        proxy_set_header X-Forwarded-For $remote_addr;
-
-        proxy_pass http://localhost:9000;
-        proxy_intercept_errors on;
-    }
-}
@@ -1,36 +0,0 @@
---
-# Where binaries live
-nym_install_dir: /root/nym-binaries
-
-# nym-node run arguments (defaults, can be overridden per host/group)
-http_bind_address: "0.0.0.0:8080"        # maps to --http-bind-address
-mixnet_bind_address: "0.0.0.0:1789"      # maps to --mixnet-bind-address
-
-# Landing page base dir, hostname is appended in the task
-landing_page_assets_base_dir: "/var/www"
-
-# Flag toggles
-accept_operator_terms: false             # override in group_vars or inventory
-nym_write_flag: true                     # controls -w
-nym_init_only_flag: true                 # controls --init-only
-wss_port: 9001                           # controlls --announce-wss-port
-
-# Optional: extra flags if you want to append more later
-nym_extra_flags: ""
-
-# CLI URL
-nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
-
-# UFW
-nym_ufw_enable: true
-
-nym_ufw_rules:
-  - { port: 22,    proto: tcp }
-  - { port: 80,    proto: tcp }
-  - { port: 443,   proto: tcp }
-  - { port: 1789,  proto: tcp }
-  - { port: 1790,  proto: tcp }
-  - { port: 8080,  proto: tcp }
-  - { port: 9000,  proto: tcp }
-  - { port: 9001,  proto: tcp }
-  - { port: 51822, proto: udp }
@@ -1 +0,0 @@
-#!/bin/bash
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Tommy Verrall	afc37988e3	Connections timeout after 5 minutes due to IPv6 DNS queries failing on IPv6-disabled networks	2025-11-14 11:55:38 +01:00
Bogdan-Ștefan Neacşu	18b0943846	[bugfix] Distinguish authenticator errors by credential spent (#6176 ) (#6192 ) * distinguish authenticator errors by credential spent * nitpicking fixes * fix CI to see those changes * error naming Co-authored-by: Simon Wicky <simon@nymtech.net>	2025-11-12 14:13:09 +02:00
Tommy Verrall	15223fb19f	Merge pull request #6190 from nymtech/dns-debug-fig Dns debug fig	2025-11-12 12:47:46 +01:00
Tommy Verrall	90886091ee	Fix clippy	2025-11-12 12:06:37 +01:00
jmwample	fc2bd74d75	fix change in interface	2025-11-06 17:35:58 -07:00
Jack Wampler	b21c43b106	Implement Static DNS fallback (#6178 )	2025-11-06 17:08:33 -07:00
Jack Wampler	f7a9e22cf3	DNS Reliability Fixes (#6175 )	2025-11-06 17:08:33 -07:00
Tommy Verrall	1ecc2a8dda	Merge pull request #6158 from nymtech/simon/registration_fail [bugfix] Disconnect mixnet client if registration fails	2025-10-31 10:05:41 +01:00
Simon Wicky	f9659ef42c	disconnect mixnet client if registration fails	2025-10-30 16:06:53 +01:00