chore: nym-node version bump

* Squashing the mix stress testing branch (#6575)

reduced chain watcher per block log severity

update network monitors contract semver to 1.0.0

fix build issues

fix mixnet client dropping initial packet on egress reconnection

adjusted logs for network monitor agent

changed default testing interval to 2h

refresh NM contract information

explicit return type for batch submission

for mixnet listener task to get scheduled before beginning connectivity test

make sure to always use canonical ip for network monitor noise keys

feat: NMv3: make agents decide egress port (#6746)

add config v12->v13 config migration for nym nodes

fix formatting in wallet types

simplified client config creation

remove other swagger redirect

removed swagger redirect on /swagger/ route

log version info on startup

add workflows, contract address, and dockerfile

bugfix: use correct endpoints when setting up orchestrator (#6733)

clippy

adjust DEFAULT_MIN_STRESS_TESTED_NODES ratio

expose route with new performance metrics

fixes and additional docs

use stress testing scores

stub for usage of stress testing scores

stub traits

added new fields to nym-api config controlling usage of stress test data

guard against duplicate packets

prevent usage of chain_authorisation_check_max_attempts with value of 0

make sure duplicate results cant be inserted into the db

submit test results from orchestrator on an interval

docs and fixes

nym-api side of handling result submission

stubs for submitting results

NM orchestrator verifying nym-api result submission permissions

NM orchestrator to update announced key on startup

allow NM orchestrator to announce its identity key to the contract

stubs within nym-api for accepting NMv3 results

added additional metrics

docs

bugfixes + making sure to only assign mixnode testruns

fixed node refresher to only retrieve mixnodes and add additional metrics

topology metrics

defined basic prometheus metrics

authorised endpoint for returning prometheus data

create initial stub for prometheus metrics

post rebasing fixes

adjusted routes

missing implementation for storage getters

a lot of new stubs and db accessors

stubs for results endpoints

update utoipa tags for agent rountes

shared auth between metrics and results

moved stale results eviction into the interval.tick branch

refactor and comments

create background process to evict stale data

include sphinx packet delay as part of the stats

fix mock construction

add median to the calculated latency distribution

remove unused imports

cleanup

performing testrun and submitting the results

assigning testruns to requesting agents

basic stub for http server for the NMv3 orchestrator

chore: rename existing 'NetworkMonitorAgent' to 'NodeStressTester'

make sure to use canonical ips within the noise config

fixed contract tests

cargo fmt

additional comments and unit tests

contract and nym-node support of NM agents being run on the same host

basic unit tests

refactoring

make agents retrieve mix port assignment from the orchestrator

provide sensible defaults to CLI arguments

stub the initial structure for the agent

chore: remove redundant import

missed tick behaviour

removed redundant mutex

removed redundant try_get_client

reuse existing constant for default nymnode port

add node refresher for periodic scraping of bonded nym-node details

- NodeRefresher periodically queries the mixnet contract for all bonded
  nodes and probes each node's HTTP API for host information, sphinx keys,
  noise keys, and key rotation IDs
- Extract NymNodeApiClientRetriever into nym-node-requests with port
  probing, identity verification, and host information signature checking
- Add clone_query_client on NyxdClient so the refresher can hold its own
  query client without locking the signing client
- Batch upsert for nym_node rows (single transaction instead of per-row)
- Reuse the new helpers in nym-api's node_describe_cache

ensure assignment of testrun begins an IMMEDIATE tx

construction of the orchestrator struct

initial set of cli args

make sure to not assign testable nodes too often

very initial database structure and cli

fixed construction of RoutableNetworkMonitors

remove redundant constructor for NoiseNode

forbid 0-nonsense config values

add type safety for test route construction

moved lioness and arrayref to workspace deps

fixed dockerfile build

always use canonical addresses in RoutableNetworkMonitors

fixed old contract formatting issues

removed redundant into() call

network monitor agent fixes

additional logs

config unit tests

more docs

standalone stress testing invocation

further refactoring and changes

refactor testing loop and return valid test result upon completion

initial sending/receiving test loop

generating reusable sphinx headers

additional structure for receiving ingress packets

initial scaffolding for NMv3 agent

added validation of x25519 noise key

removed unstable call to 'is_multiple_of'

remove calls to from_octets as they're unavailable in pre 1.91

additional docs/comments

propagating noise information about NM for mixnet routing

pass full socket address of the agent into the contract storage

feat: store noise keys alongside ip addresses within the contract

removed redundant comment

ensure NM packets can only go to NM

PR review comments

added additional docs

allow NM to replay packets + fix replay prometheus metrics

propagate information about nm agent to connection handler

updated nym-node config migration

feat: introduced nym-node websocket subscription for keeping updated list of NM agents

allow admin to also revoke monitor agents

remove agents upon orchestrator removal

fixed schema generation and regenerated the contract schema

removed rustc restriction on contracts-common

added client methods for interacting with the contract

added unit tests for contract methods

implemented logic of the network monitors contract

create initial structure for network monitors contract

start mix stress testing topic branch

* make nym-node default to the new blockstream rpc/ws node cluster

* reduced mixnet-client log severity

* set network monitors contract address for mainnet

.github/workflows/cd-docs.yml

@@ -39,6 +39,8 @@ jobs:
 
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
       - name: Generate sitemap

.github/workflows/ci-build-upload-binaries.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [ubuntu-22.04]
+        platform: [arc-ubuntu-22.04]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-build-upload-network-monitor-agent.yml

@@ -0,0 +1,63 @@
+name: ci-build-upload-network-monitor-agent
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-upload:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [arc-ubuntu-22.04]
+
+    runs-on: ${{ matrix.platform }}
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTUP_PERMIT_COPY_RENAME: 1
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Prepare build output directory
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: |
+          rm -rf ci-builds || true
+          mkdir -p "$OUTPUT_DIR"
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install libudev-dev
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+
+      - name: Build nym-network-monitor-agent
+        shell: bash
+        run: cargo build -p nym-network-monitor-agent --release
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: nym-network-monitor-agent
+          path: target/release/nym-network-monitor-agent
+          retention-days: 30
+
+      - name: Prepare build output
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
+        run: cp target/release/nym-network-monitor-agent "$OUTPUT_DIR"
+
+      - name: Deploy to CI www
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "ci-builds/"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/
+          EXCLUDE: "/dist/, /node_modules/"

.github/workflows/ci-build.yml

@@ -90,7 +90,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api -- -D warnings
+          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client -- -D warnings
 
       - name: Clippy (non-macos)
         if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
@@ -104,14 +104,15 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
+          args: --workspace --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client
 
-        # only build on linux because of wg FFI bindings of its dependency (network probe)
-      - name: Build nym-node-status-api (linux only)
+        # Build Go FFI-dependent crates separately (requires Go, only available on Linux CI)
+      - name: Build nym-node-status-api and nym-node-status-agent (linux only)
         if: runner.os == 'Linux'
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: -p nym-node-status-api
+          args: -p nym-node-status-api -p nym-node-status-agent
 
       - name: Build all examples
         if: contains(matrix.os, 'linux')

.github/workflows/ci-crates-publish-dry-run.yml

@@ -15,6 +15,9 @@ env:
 jobs:
   publish-dry-run:
     runs-on: arc-linux-latest
+    timeout-minutes: 35
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -59,20 +62,60 @@ jobs:
       - name: Bump versions (local only)
         run: |
           cargo workspaces version custom ${{ inputs.version }} \
-            --allow-branch ${{ github.ref_name }} \
             --no-git-commit \
+            --yes
+
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
 
       # Dry run may show cascading dependency errors because packages aren't
       # actually uploaded - these are expected and ignored. We check for real
       # errors like packaging failures, missing metadata, or invalid Cargo.toml.
       - name: Publish (dry run)
         run: |
-          output=$(cargo workspaces publish --dry-run --allow-dirty 2>&1) || true
-          echo "$output"
+          set +e
+          publish_status=1
+          max_attempts=2
+          attempt=1
+          rm -f /tmp/publish-dry-run.log
 
-          # Check for real errors (not cascading dependency errors)
-          # Cascading errors mention "crates.io index", real errors mention "Cargo.toml"
-          echo "$output" | grep -i "Cargo.toml" && exit 1 || true
+          while [ "$attempt" -le "$max_attempts" ]; do
+            echo "Dry-run publish attempt ${attempt}/${max_attempts}"
+            cargo workspaces publish --dry-run --allow-dirty 2>&1 | tee /tmp/publish-dry-run.log
+            publish_status=${PIPESTATUS[0]}
+
+            if [ "$publish_status" -eq 0 ]; then
+              break
+            fi
+
+            # Retry once for interruption/runner issues.
+            if [ "$attempt" -lt "$max_attempts" ] && \
+              { [ "$publish_status" -eq 130 ] || [ "$publish_status" -eq 137 ]; }; then
+              echo "Publish dry-run interrupted (exit ${publish_status}), retrying in 10s..."
+              sleep 10
+              attempt=$((attempt + 1))
+              continue
+            fi
+
+            break
+          done
+          set -e
+
+          if grep -Eiq \
+            "failed to verify manifest|failed to parse manifest|invalid Cargo.toml|error: package .* has no (description|license|repository)" \
+            /tmp/publish-dry-run.log; then
+            echo "Detected real packaging/manifest errors"
+            exit 1
+          fi
+
+          # In dry-run mode, non-zero publish status is expected due to
+          # dependency-cascade failures against crates.io index.
+          if [ "$publish_status" -ne 0 ]; then
+            echo "Dry-run publish returned non-zero (${publish_status}) but no real manifest blockers were detected."
+          fi
+
+          echo "Only expected dry-run dependency cascade errors detected (if any)."
 
       # Show the list of packages published
       - name: Show package versions

.github/workflows/ci-crates-publish-resume.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6

.github/workflows/ci-crates-publish.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6

.github/workflows/ci-crates-version-bump.yml

@@ -15,8 +15,11 @@ env:
 jobs:
   version-bump:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -64,11 +67,20 @@ jobs:
             --no-git-commit \
             --yes
 
-      - name: Commit and push version bump
-        run: |
-          git add -A
-          git commit -m "crates release: bump version to ${{ inputs.version }}"
-          git push
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: "chore/bump-version-${{ inputs.version }}"
+          base: ${{ github.ref_name }}
+          commit-message: "crates release: bump version to ${{ inputs.version }}"
+          title: "chore: bump crate versions to ${{ inputs.version }}"
+          body: |
+            Automated version bump from `${{ steps.current_version.outputs.version }}` → `${{ inputs.version }}`.
+
+            Triggered by @${{ github.actor }} via workflow dispatch.
+          labels: "automated, crates-version-bump"
+          delete-branch: true
 
       - name: Show package versions
-        run: cargo workspaces list --long
+        run: cargo workspaces list --long

.github/workflows/ci-docs.yml

@@ -6,6 +6,8 @@ on:
     branches-ignore: [master]
     paths:
       - "documentation/docs/**"
+      - "sdk/typescript/packages/sdk/src/**"
+      - "sdk/typescript/packages/mix-fetch/src/**"
       - ".github/workflows/ci-docs.yml"
 
 jobs:
@@ -42,8 +44,27 @@ jobs:
           command: build
           args: --workspace --release
 
+      - name: Check if TypeScript SDK source changed
+        id: check-ts-sdk
+        run: |
+          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -qE '^sdk/typescript/packages/(sdk|mix-fetch)/src/'; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+        working-directory: ${{ github.workspace }}
+
+      - name: Regenerate TypeDoc API reference
+        if: steps.check-ts-sdk.outputs.changed == 'true'
+        run: |
+          npm install -g typedoc@0.25.13 typedoc-plugin-markdown@4.0.3
+          cd ${{ github.workspace }}/sdk/typescript/packages/sdk && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-fetch && typedoc --skipErrorChecking
+
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
       - name: Generate sitemap

.github/workflows/ci-nym-wallet-frontend.yml

@@ -0,0 +1,41 @@
+name: ci-nym-wallet-frontend
+
+on:
+  pull_request:
+    paths:
+      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-frontend.yml'
+
+jobs:
+  types-lint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: nym-wallet/.nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --network-timeout 100000
+
+      - name: Build TypeScript packages (wallet depends on @nymproject/types, etc.)
+        run: yarn build:types
+
+      - name: Build @nymproject/mui-theme and @nymproject/react (wallet imports subpaths)
+        run: yarn build:packages
+
+      - name: Typecheck nym-wallet
+        run: yarn --cwd nym-wallet tsc
+
+      - name: Lint nym-wallet
+        run: yarn --cwd nym-wallet lint
+
+      - name: Yarn audit (workspace lockfile; informational)
+        run: yarn audit --level critical
+        continue-on-error: true
+
+      - name: Unit tests (nym-wallet)
+        run: yarn --cwd nym-wallet test

.github/workflows/ci-nym-wallet-rust.yml

@@ -41,6 +41,9 @@ jobs:
           sed -i.bak '1s/^/\[profile.dev\]\ndebug = false\n\n/' Cargo.toml
           git diff
 
+      - name: Ensure nym-wallet/dist exists for Tauri
+        run: mkdir -p nym-wallet/dist
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
@@ -71,3 +74,16 @@ jobs:
         with:
           command: clippy
           args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features --all-targets -- -D warnings
+
+      - name: Install cargo-audit
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-audit --locked
+
+      - name: Cargo audit (nym-wallet workspace)
+        uses: actions-rs/cargo@v1
+        with:
+          command: audit
+        working-directory: nym-wallet
+        continue-on-error: true

.github/workflows/ci-nym-wallet-storybook.yml

@@ -1,53 +0,0 @@
-name: ci-nym-wallet-storybook
-
-on:
-  pull_request:
-    paths:
-      - 'nym-wallet/**'
-      - '.github/workflows/ci-nym-wallet-storybook.yml'
-
-jobs:
-  build:
-    runs-on: arc-linux-latest-dind
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-
-      - uses: rlespinasse/github-slug-action@v3.x
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Build dependencies
-        run: yarn && yarn build
-
-      - name: Build storybook
-        run: yarn storybook:build
-        working-directory: ./nym-wallet
-
-      - name: Deploy branch to CI www (storybook)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "nym-wallet/storybook-static/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"

.github/workflows/nightly-nym-wallet-build.yml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
         if: matrix.os == 'ubuntu-22.04'
 
       - name: Install rust toolchain

.github/workflows/publish-nym-binaries.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-22.04
+          - os: arc-ubuntu-22.04
             target: x86_64-unknown-linux-gnu
     runs-on:  ${{ matrix.os }}
 

.github/workflows/publish-nym-wallet-macos.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
           
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
           cache: 'yarn'
       
       - name: Install Rust toolchain
@@ -72,6 +72,41 @@ jobs:
             find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
             find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
           fi
+
+      - name: Inspect AppImage (hook + bundled graphics libs)
+        shell: bash
+        run: |
+          set -euo pipefail
+          APPIMAGE_REL=$(find target/release/bundle -name '*.AppImage' | head -n 1)
+          if [ -z "${APPIMAGE_REL}" ]; then
+            echo "No AppImage under target/release/bundle"
+            exit 1
+          fi
+          APPIMAGE_ABS="${GITHUB_WORKSPACE}/nym-wallet/${APPIMAGE_REL}"
+          chmod +x "${APPIMAGE_ABS}"
+          EXTRACT_DIR=$(mktemp -d)
+          cd "${EXTRACT_DIR}"
+          "${APPIMAGE_ABS}" --appimage-extract
+          # Tauri only stages appimage "files" under /usr/ into the AppDir; paths like /apprun-hooks/ never reach the image.
+          # Wayland + WEBKIT_DISABLE_DMABUF_RENDERER defaults are applied in main() instead (see configure_linux_wayland_defaults).
+          HOOK=$(find squashfs-root -name '99-nym-wayland.sh' 2>/dev/null | head -n 1)
+          if [ -n "${HOOK}" ]; then
+            echo "Found legacy apprun hook at ${HOOK}"
+          else
+            echo "No apprun-hooks/99-nym-wayland.sh (expected): Wayland defaults are set in-process."
+          fi
+          find squashfs-root/usr/lib -maxdepth 6 \
+            \( -name 'libwayland-client.so*' -o -name 'libEGL.so*' -o -name 'libgbm.so*' \) \
+            2>/dev/null | sort > "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          wc -l "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          head -50 "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt" || true
+
+      - name: Upload AppImage graphics lib inventory
+        uses: actions/upload-artifact@v6
+        with:
+          name: nym-wallet-appimage-lib-inventory
+          path: nym-wallet/appimage-bundled-graphics-libs.txt
+          retention-days: 30
       
       - name: Create AppImage tarball if needed
         run: |

.github/workflows/publish-nym-wallet-win11.yml

@@ -26,6 +26,9 @@ jobs:
     outputs:
       release_tag: ${{ github.ref_name }}
 
+    env:
+      SIGN_WINDOWS: ${{ github.event_name == 'release' || inputs.sign }}
+
     steps:
       - uses: actions/checkout@v6
 
@@ -37,48 +40,82 @@ jobs:
       - name: Setup MSBuild.exe
         uses: microsoft/setup-msbuild@v2
 
+      # No cache:yarn here: setup-node needs yarn on PATH to populate the cache, but this runner
+      # only gets yarn from the step below.
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
+
+      - name: Install Yarn (classic)
+        shell: bash
+        run: npm install -g yarn@1.22.22
+
+      - name: Strip Authenticode thumbprint (avoid signtool on runner)
+        working-directory: nym-wallet/src-tauri
+        if: ${{ env.SIGN_WINDOWS == 'true' || (github.event_name == 'workflow_dispatch' && !inputs.sign) }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v yq >/dev/null 2>&1; then
+            echo "yq is required on this runner to edit tauri.conf.json"
+            exit 1
+          fi
+          yq eval --inplace '
+            del(.bundle.windows.certificateThumbprint) |
+            del(.bundle.windows.digestAlgorithm) |
+            del(.bundle.windows.timestampUrl)
+          ' tauri.conf.json
 
       - name: Download EV CodeSignTool from ssl.com
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
         run: |
           curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
           unzip codesigntool.zip
       - name: Get EV certificate credential id
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         id: get_credential_ids
         shell: bash
         run: |
           echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
       - name: Add custom sign command to tauri.conf.json
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
+        env:
+          SSL_SIGN_USER: ${{ secrets.SSL_COM_USERNAME }}
+          SSL_SIGN_PASS: ${{ secrets.SSL_COM_PASSWORD }}
+          SSL_SIGN_CRED: ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_SIGN_TOTP: ${{ secrets.SSL_COM_TOTP_SECRET }}
         run: |
-          yq eval --inplace '.bundle.windows +=
-          {
-            "signCommand": {
-              "cmd": "C:\Program Files\Git\bin\bash.EXE",
-              "args": [
-                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
-                "sign",
-                "-username ${{ secrets.SSL_COM_USERNAME }}",
-                "-password ${{ secrets.SSL_COM_PASSWORD }}",
-                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
-                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
-                "-program_name NymWallet",
-                "-input_file_path",
-                "%1",
-                "-override"
-              ]
+          set -euo pipefail
+          if ! command -v cygpath >/dev/null 2>&1; then
+            echo "cygpath not found; install Git for Windows or use bash from Git SDK"
+            exit 1
+          fi
+          export SCRIPT_UNIX="$(cygpath -u "$GITHUB_WORKSPACE/nym-wallet/src-tauri/CodeSignTool.sh")"
+          yq eval --inplace '
+            .bundle.windows += {
+              "signCommand": {
+                "cmd": "C:/Program Files/Git/bin/bash.exe",
+                "args": [
+                  strenv(SCRIPT_UNIX),
+                  "sign",
+                  ("-username " + strenv(SSL_SIGN_USER)),
+                  ("-password " + strenv(SSL_SIGN_PASS)),
+                  ("-credential_id " + strenv(SSL_SIGN_CRED)),
+                  ("-totp_secret " + strenv(SSL_SIGN_TOTP)),
+                  "-program_name NymWallet",
+                  "-input_file_path",
+                  "%1",
+                  "-override"
+                ]
+              }
             }
-          }' tauri.conf.json
+          ' tauri.conf.json
       - name: Install project dependencies
         shell: bash
         run: cd .. && yarn --network-timeout 100000
@@ -93,10 +130,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
-          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
-          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
+          SSL_COM_USERNAME: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_USERNAME }}
+          SSL_COM_PASSWORD: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_CREDENTIAL_ID: ${{ env.SIGN_WINDOWS == 'true' && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_TOTP_SECRET: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_TOTP_SECRET }}
         run: |
           echo "Starting build process..."
           yarn build
@@ -167,4 +204,4 @@ jobs:
     needs: publish-tauri
     with:
       release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/push-network-monitor-agent.yaml

@@ -0,0 +1,61 @@
+name: Build and upload Network Monitor Agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-agent"
+  CONTAINER_NAME: "network-monitor-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+ 
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: New env vars
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
+          

.github/workflows/push-network-monitor-orchestrator.yaml

@@ -0,0 +1,57 @@
+name: Build and upload Network Monitor Orchestrator container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-orchestrator"
+  CONTAINER_NAME: "network-monitor-orchestrator"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: Log image name
+        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build  -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/resume-publish-crates-io.yml

@@ -25,6 +25,10 @@ jobs:
       - name: Install cargo-workspaces
         run: cargo install cargo-workspaces
 
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
+
       - name: Publish remaining crates
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.gitignore

@@ -27,6 +27,7 @@ v6-topology.json
 /explorer/public/downloads/mixmining.json
 /explorer/public/downloads/topology.json
 /nym-wallet/dist/*
+/nym-wallet/appimage-bundled-graphics-libs.txt
 /clients/validator/examples/nym-driver-example/current-contract.txt
 validator-api/v4.json
 validator-api/v6.json

CHANGELOG.md

@@ -4,6 +4,102 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2026.10-waterloo] (2026-05-27)
+
+- Re-order default API urls for network details - Waterloo release ([#6799])
+- [bugfix] IPR v8<->v9 mismatch on Waterloo ([#6772])
+- Migrate to hickory 0.26.1 ([#6751])
+- add workflows for NM3 ([#6729])
+- credential proxy pool ([#6726])
+- chore: made sphinx version threshold assertion a compile time check ([#6718])
+- Feat/nmv3 updated performance calculation ([#6714])
+- feat: NMv3: submission of stress testing result into nym-api ([#6709])
+- feat: NMv3: Prometheus metrics for network monitor ([#6693])
+- feat: NMv3: add read-only results API to orchestrator ([#6689])
+- feat: NMv3: Eviction of stale testrun data ([#6685])
+- feat: NMv3: Wire up testrun assignment and result submission flow ([#6680])
+- feat: NMv3: Support multiple network monitor agents per host ([#6679])
+- Feat/nmv3 agent announcement ([#6673])
+- add node refresher for periodic scraping of bonded nym-node details ([#6626])
+- Feat/nmv3 orchestrator queue ([#6597])
+- feat: network monitor agent - standalone node stress-testing ([#6582])
+- [feat] propagate NM agent noise keys to nym-node routing ([#6577])
+- start mix stress testing topic branch ([#6575])
+- Feat/nmv3 agents subscription ([#6567])
+- Feat/nmv3 agents contract ([#6555])
+
+[#6799]: https://github.com/nymtech/nym/pull/6799
+[#6772]: https://github.com/nymtech/nym/pull/6772
+[#6751]: https://github.com/nymtech/nym/pull/6751
+[#6729]: https://github.com/nymtech/nym/pull/6729
+[#6726]: https://github.com/nymtech/nym/pull/6726
+[#6718]: https://github.com/nymtech/nym/pull/6718
+[#6714]: https://github.com/nymtech/nym/pull/6714
+[#6709]: https://github.com/nymtech/nym/pull/6709
+[#6693]: https://github.com/nymtech/nym/pull/6693
+[#6689]: https://github.com/nymtech/nym/pull/6689
+[#6685]: https://github.com/nymtech/nym/pull/6685
+[#6680]: https://github.com/nymtech/nym/pull/6680
+[#6679]: https://github.com/nymtech/nym/pull/6679
+[#6673]: https://github.com/nymtech/nym/pull/6673
+[#6626]: https://github.com/nymtech/nym/pull/6626
+[#6597]: https://github.com/nymtech/nym/pull/6597
+[#6582]: https://github.com/nymtech/nym/pull/6582
+[#6577]: https://github.com/nymtech/nym/pull/6577
+[#6575]: https://github.com/nymtech/nym/pull/6575
+[#6567]: https://github.com/nymtech/nym/pull/6567
+[#6555]: https://github.com/nymtech/nym/pull/6555
+
+## [2026.9-venaco] (2026-05-06)
+
+- Fix for v9 IPR  ([#6710])
+- Only init SHARED_CLIENT if requested ([#6708])
+- Fixes to crates and CI ([#6686])
+- Return ipv6 addresses as well ([#6684])
+- Fix invalid ticket spend ([#6683])
+- Block non-public IPR/NR checks ([#6670])
+
+[#6710]: https://github.com/nymtech/nym/pull/6710
+[#6708]: https://github.com/nymtech/nym/pull/6708
+[#6686]: https://github.com/nymtech/nym/pull/6686
+[#6684]: https://github.com/nymtech/nym/pull/6684
+[#6683]: https://github.com/nymtech/nym/pull/6683
+[#6670]: https://github.com/nymtech/nym/pull/6670
+
+## [2026.8-urda] (2026-04-20)
+
+- Include all gateways in the returned list ([#6649])
+- Optimize GW probe in NS agent ([#6636])
+- Max/sdk docrs ([#6566])
+- Max/sdk stream wrapper ([#6320])
+
+[#6649]: https://github.com/nymtech/nym/pull/6649
+[#6636]: https://github.com/nymtech/nym/pull/6636
+[#6566]: https://github.com/nymtech/nym/pull/6566
+[#6320]: https://github.com/nymtech/nym/pull/6320
+
+## [2026.7-tola] (2026-04-07)
+
+- Simon/ecash contract serde fix ([#6634])
+- Update Fallback IP for Nym API ([#6622])
+- Nym Node spam logging ([#6621])
+- feat: multiple deposit prices ([#6608])
+- move format_debug_bytes in common crate ([#6580])
+- bugfix: make sure client keys are generated before requesting credentials ([#6579])
+- Fix socks5 GW probe regression ([#6576])
+- Max/lp stream framing ([#6573])
+- HTTP domain rotation conditions ([#6570])
+
+[#6634]: https://github.com/nymtech/nym/pull/6634
+[#6622]: https://github.com/nymtech/nym/pull/6622
+[#6621]: https://github.com/nymtech/nym/pull/6621
+[#6608]: https://github.com/nymtech/nym/pull/6608
+[#6580]: https://github.com/nymtech/nym/pull/6580
+[#6579]: https://github.com/nymtech/nym/pull/6579
+[#6576]: https://github.com/nymtech/nym/pull/6576
+[#6573]: https://github.com/nymtech/nym/pull/6573
+[#6570]: https://github.com/nymtech/nym/pull/6570
+
 ## [2026.6-stilton] (2026-03-25)
 
 - lp fixes ([#6601])

Cargo.toml

@@ -44,6 +44,7 @@ members = [
     "common/cosmwasm-smart-contracts/nym-performance-contract",
     "common/cosmwasm-smart-contracts/nym-pool-contract",
     "common/cosmwasm-smart-contracts/vesting-contract",
+    "common/cosmwasm-smart-contracts/network-monitors-contract",
     "common/credential-proxy",
     "common/credential-storage",
     "common/credential-utils",
@@ -147,6 +148,7 @@ members = [
     "sdk/ffi/go",
     "sdk/ffi/shared",
     "sdk/rust/nym-sdk",
+    "smolmix/core",
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
@@ -175,6 +177,8 @@ members = [
     "integration-tests",
     "common/nym-kkt-ciphersuite",
     "common/nym-kkt-context",
+    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
+    "nym-network-monitor-v3/nym-network-monitor-agent", "nym-network-monitor-v3/nym-network-monitor-orchestrator-requests",
 ]
 
 default-members = [
@@ -184,7 +188,6 @@ default-members = [
     "nym-api",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-node",
-    "nym-node-status-api/nym-node-status-agent",
     "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
@@ -192,6 +195,8 @@ default-members = [
     "service-providers/network-requester",
     "tools/nymvisor",
     "nym-registration-client",
+    "nym-network-monitor-v3/nym-network-monitor-orchestrator",
+    "nym-network-monitor-v3/nym-network-monitor-agent",
     "tools/internal/localnet-orchestrator"
 ]
 
@@ -280,7 +285,8 @@ getrandom03 = { package = "getrandom", version = "=0.3.3" }
 glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-resolver = "0.25.2"
+hickory-proto = "0.26.1"
+hickory-resolver = "0.26.1"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -348,6 +354,8 @@ serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
 sha2 = "0.10.3"
 si-scale = "0.2.3"
+smolmix = { version = "0.0.1", path = "smolmix/core" }
+smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.8.6"
@@ -368,6 +376,8 @@ tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
+tokio-rustls = "0.26"
+tokio-smoltcp = "0.5"
 tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
@@ -397,16 +407,20 @@ zeroize = "1.7.0"
 
 prometheus = { version = "0.14.0" }
 
+# recreating lioness
+# we don't care about particular versions - just pull whatever is used by sphinx
+lioness = "*"
+arrayref = "*"
 
 # libcrux
-libcrux-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-ecdh = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-curve25519 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-chacha20poly1305 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-psq = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-ml-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-sha3 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-traits = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-kem = "0.0.7"
+libcrux-ecdh = "0.0.6"
+libcrux-curve25519 = "0.0.6"
+libcrux-chacha20poly1305 = "0.0.7"
+libcrux-psq = "0.0.8"
+libcrux-ml-kem = "0.0.8"
+libcrux-sha3 = "0.0.8"
+libcrux-traits = "0.0.6"
 
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
 nym-api-requests = { version = "1.20.4", path = "nym-api/nym-api-requests" }
@@ -502,6 +516,7 @@ nym-types = { version = "1.20.4", path = "common/types" }
 nym-upgrade-mode-check = { version = "1.20.4", path = "common/upgrade-mode-check" }
 nym-validator-client = { version = "1.20.4", path = "common/client-libs/validator-client", default-features = false }
 nym-vesting-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/vesting-contract" }
+nym-network-monitors-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/network-monitors-contract" }
 nym-verloc = { version = "1.20.4", path = "common/verloc" }
 nym-wireguard = { version = "1.20.4", path = "common/wireguard" }
 nym-wireguard-types = { version = "1.20.4", path = "common/wireguard-types" }
@@ -560,6 +575,7 @@ wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
+webpki-roots = "0.26"
 web-sys = "0.3.76"
 
 # for local development:

ansible/nym-node/playbooks/group_vars/all.yml

@@ -60,7 +60,8 @@ packages:
 ## SYSTEM MAINTENANCE PLAYBOOK KNOBS
 ###############################################################################
 
-# nym_version: "v2025.21-mozzarella"
+# To use particular version instead of Latest, provide in such form: 
+# nym_version: "nym-binaries-v2026.7-tola"
 
 ## NOTE:
 ## if you want to pin Nym to a specific version instead of using the
@@ -117,4 +118,4 @@ packages:
 
 # enable_writeback_tuning: true
 # writeback_dirty_writeback_centisecs: 1500
-# writeback_dirty_expire_centisecs: 6000
+# writeback_dirty_expire_centisecs: 6000

ansible/nym-node/roles/tunnel/tasks/main.yml

@@ -1,11 +1,30 @@
 ---
-- name: Configure tunnel manager
+- name: Ensure nym binaries directory exists
+  file:
+    path: /root/nym-binaries
+    state: directory
+    mode: "0755"
   tags:
+    - tunnel
     - network_tunnel_manager
-  become: true
-  command:
-    cmd: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
+    - ntm
+
+- name: Download network tunnel manager
+  get_url:
+    url: "{{ tunnel_manager_url }}"
+    dest: /root/nym-binaries/network-tunnel-manager.sh
+    mode: "0755"
+    force: yes
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm
+    
+- name: Run network tunnel manager
+  command: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
   loop:
     - complete_networking_configuration
-  register: tunnel_mgr
-  failed_when: false
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm

clients/native/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-client"
-version = "1.1.73"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
+version = "1.1.77"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

clients/native/websocket-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-websocket-requests"
+description = "Request and response definitions for Nym client websocket connections"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Request and response definitions for Nym client websocket connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

clients/socks5/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.73"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
+version = "1.1.77"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 [dependencies]

common/async-file-watcher/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-async-file-watcher"
+description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 version.workspace = true
+authors.workspace = true
 edition.workspace = true
 license.workspace = true
-description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/authenticator-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-authenticator-requests"
+description = "Crate defining requests and responses for the Nym authenticator client"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Crate defining requests and responses for the Nym authenticator client"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 base64 = { workspace = true }

common/bandwidth-controller/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-bandwidth-controller"
+description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/bin-common/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-bin-common"
-version.workspace = true
 description = "Common code for nym binaries"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 clap = { workspace = true, features = ["derive"], optional = true }
@@ -38,6 +43,7 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json", "dep:clap"]
 bin_info_schema = ["schemars"]
+ip_check = []
 basic_tracing = ["dep:tracing", "dep:tracing-subscriber"]
 otel-otlp = [
     "basic_tracing",

common/bin-common/src/ip_check/mod.rs

@@ -1,29 +1,12 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
-// use `ip` feature without nightly
-// issue: https://github.com/rust-lang/rust/issues/27709
-pub(crate) const fn is_global_ip(ip: &IpAddr) -> bool {
+pub const fn is_global_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(addr) => is_global_ipv4(addr),
         IpAddr::V6(addr) => is_global_ipv6(addr),
     }
 }
 
-const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
-}
-
-const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
-}
-
-const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
-}
-
 const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
     !(ip.octets()[0] == 0 // "This network"
         || ip.is_private()
@@ -42,6 +25,18 @@ const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
         || ip.is_broadcast())
 }
 
+const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
+}
+
+const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
+}
+
+const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
+}
+
 const fn is_documentation_ipv6(ip: &Ipv6Addr) -> bool {
     (ip.segments()[0] == 0x2001) && (ip.segments()[1] == 0xdb8)
 }

common/bin-common/src/lib.rs

@@ -9,3 +9,6 @@ pub mod completions;
 
 #[cfg(feature = "output_format")]
 pub mod output_format;
+
+#[cfg(feature = "ip_check")]
+pub mod ip_check;

common/client-core/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-client-core"
+description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 version.workspace = true
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2024"
-rust-version = "1.85"
 license.workspace = true
-description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/config-types/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-client-core-config-types"
+description = "Low level configs and constants used by Nym clients and nodes"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Low level configs and constants used by Nym clients and nodes"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/gateways-storage/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-core-gateways-storage"
+description = "Functionality for Nym clients to store and retrive Gateway connections"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-rust-version.workspace = true
-description = "Functionality for Nym clients to store and retrive Gateway connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/src/client/mix_traffic/transceiver.rs

@@ -240,7 +240,7 @@ mod nonwasm_sealed {
     impl GatewaySender for LocalGateway {
         async fn send_mix_packet(&mut self, packet: MixPacket) -> Result<(), ErasedGatewayError> {
             self.packet_forwarder
-                .forward_packet(packet)
+                .forward_client_packet_without_delay(packet)
                 .map_err(erase_err)
         }
     }

common/client-core/surb-storage/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-client-core-surb-storage"
+description = "Functionality for Nym clients to generate and use Single Use Reply Blocks (SURBs)"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Functionality for Nym clients to generate and use Single Use Reply Blocks (SURBs)"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/gateway-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-gateway-client"
+description = "Functions and types for Nym client <> Gateway connections"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Functions and types for Nym client <> Gateway connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/mixnet-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-mixnet-client"
+description = "Client for Mix Node <> Mix Node & Mix Node <> Gateway communication"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Client for Mix Node <> Mix Node & Mix Node <> Gateway communication"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -31,3 +34,4 @@ client = ["tokio-util", "nym-task", "tokio/net", "tokio/rt"]
 [dev-dependencies]
 nym-crypto = { workspace = true }
 rand = { workspace = true }
+tokio = { workspace = true, features = ["macros", "io-util", "rt", "rt-multi-thread"] }

common/client-libs/mixnet-client/src/client.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use dashmap::DashMap;
-use futures::StreamExt;
+use futures::{SinkExt, StreamExt};
 use nym_noise::config::NoiseConfig;
 use nym_noise::upgrade_noise_initiator;
 use nym_sphinx::forwarding::packet::MixPacket;
@@ -14,6 +14,7 @@ use std::ops::Deref;
 use std::sync::atomic::{AtomicU32, AtomicUsize, Ordering};
 use std::sync::Arc;
 use std::time::Duration;
+use tokio::io::{AsyncRead, AsyncWrite};
 use tokio::net::TcpStream;
 use tokio::sync::mpsc;
 use tokio::sync::mpsc::error::TrySendError;
@@ -90,13 +91,17 @@ impl Deref for ActiveConnections {
 pub struct ConnectionSender {
     channel: mpsc::Sender<FramedNymPacket>,
     current_reconnection_attempt: Arc<AtomicU32>,
+    // Identifies the `ManagedConnection` task currently owning this entry; used
+    // to ensure drop-time eviction only fires on the still-owning task.
+    handle_token: Arc<()>,
 }
 
 impl ConnectionSender {
-    fn new(channel: mpsc::Sender<FramedNymPacket>) -> Self {
+    fn new(channel: mpsc::Sender<FramedNymPacket>, handle_token: Arc<()>) -> Self {
         ConnectionSender {
             channel,
             current_reconnection_attempt: Arc::new(AtomicU32::new(0)),
+            handle_token,
         }
     }
 }
@@ -107,6 +112,31 @@ struct ManagedConnection {
     message_receiver: ReceiverStream<FramedNymPacket>,
     connection_timeout: Duration,
     current_reconnection: Arc<AtomicU32>,
+    active_connections: ActiveConnections,
+    handle_token: Arc<()>,
+}
+
+// Evicts the cache entry on task exit (only if still owned by this task).
+// Without this, a stale `ConnectionSender` survives after the peer disconnects
+// and the next outbound packet is silently swallowed by the dead TCP.
+struct EvictOnDrop {
+    active_connections: ActiveConnections,
+    address: SocketAddr,
+    handle_token: Arc<()>,
+}
+
+impl Drop for EvictOnDrop {
+    fn drop(&mut self) {
+        let address = self.address;
+        let handle_token = &self.handle_token;
+        self.active_connections.remove_if(&address, |_, sender| {
+            Arc::ptr_eq(&sender.handle_token, handle_token)
+        });
+        trace!(
+            peer = %address,
+            "managed connection task exited; evicted owning cache entry"
+        );
+    }
 }
 
 impl ManagedConnection {
@@ -116,6 +146,8 @@ impl ManagedConnection {
         message_receiver: mpsc::Receiver<FramedNymPacket>,
         connection_timeout: Duration,
         current_reconnection: Arc<AtomicU32>,
+        active_connections: ActiveConnections,
+        handle_token: Arc<()>,
     ) -> Self {
         ManagedConnection {
             address,
@@ -123,72 +155,30 @@ impl ManagedConnection {
             message_receiver: ReceiverStream::new(message_receiver),
             connection_timeout,
             current_reconnection,
+            active_connections,
+            handle_token,
         }
     }
 
     async fn run(self) {
         let address = self.address;
+        let _evict_guard = EvictOnDrop {
+            active_connections: self.active_connections,
+            address,
+            handle_token: self.handle_token,
+        };
+
         let reconnection_attempt = self.current_reconnection.load(Ordering::Acquire);
         let connect_start = tokio::time::Instant::now();
         let connection_fut = TcpStream::connect(address);
 
-        let conn = match tokio::time::timeout(self.connection_timeout, connection_fut).await {
-            Ok(stream_res) => match stream_res {
-                Ok(stream) => {
-                    let connect_ms = connect_start.elapsed().as_millis() as u64;
-                    debug!(
-                        peer = %address,
-                        connect_ms,
-                        "Managed to establish connection to {}", self.address
-                    );
-
-                    let noise_start = tokio::time::Instant::now();
-                    let noise_stream =
-                        match upgrade_noise_initiator(stream, &self.noise_config).await {
-                            Ok(noise_stream) => noise_stream,
-                            Err(err) => {
-                                let noise_handshake_ms = noise_start.elapsed().as_millis() as u64;
-                                warn!(
-                                    event = "connection.failed.noise",
-                                    peer = %address,
-                                    error = %err,
-                                    connect_ms,
-                                    noise_handshake_ms,
-                                    reconnection_attempt,
-                                    exit_reason = "noise_error",
-                                    "Failed to perform Noise initiator handshake with {address}"
-                                );
-                                self.current_reconnection.fetch_add(1, Ordering::SeqCst);
-                                return;
-                            }
-                        };
-                    let noise_handshake_ms = noise_start.elapsed().as_millis() as u64;
-                    self.current_reconnection.store(0, Ordering::Release);
-                    debug!(
-                        peer = %address,
-                        connect_ms,
-                        noise_handshake_ms,
-                        "Noise initiator handshake completed for {:?}", address
-                    );
-                    Framed::new(noise_stream, NymCodec)
-                }
-                Err(err) => {
-                    let connect_ms = connect_start.elapsed().as_millis() as u64;
-                    warn!(
-                        event = "connection.failed.connect",
-                        peer = %address,
-                        error = %err,
-                        connect_ms,
-                        reconnection_attempt,
-                        exit_reason = "connect_error",
-                        "failed to establish connection to {address}"
-                    );
-                    return;
-                }
-            },
+        // 1. attempt to establish the connection with timeout
+        let maybe_stream = match tokio::time::timeout(self.connection_timeout, connection_fut).await
+        {
+            Ok(stream) => stream,
             Err(_) => {
                 let connect_ms = connect_start.elapsed().as_millis() as u64;
-                warn!(
+                debug!(
                     event = "connection.failed.timeout",
                     peer = %address,
                     timeout_ms = self.connection_timeout.as_millis() as u64,
@@ -203,21 +193,133 @@ impl ManagedConnection {
             }
         };
 
-        if let Err(err) = self.message_receiver.map(Ok).forward(conn).await {
-            warn!(
-                event = "connection.forward_error",
-                peer = %address,
-                error = %err,
-                exit_reason = "forward_error",
-                "Failed to forward packets to {address}: {err}"
-            );
-        }
+        // 2. check if it actually succeeded
+        let stream = match maybe_stream {
+            Ok(stream) => stream,
+            Err(err) => {
+                let connect_ms = connect_start.elapsed().as_millis() as u64;
+                debug!(
+                    event = "connection.failed.connect",
+                    peer = %address,
+                    error = %err,
+                    connect_ms,
+                    reconnection_attempt,
+                    exit_reason = "connect_error",
+                    "failed to establish connection to {address}"
+                );
+                return;
+            }
+        };
 
+        let connect_ms = connect_start.elapsed().as_millis() as u64;
         debug!(
             peer = %address,
-            exit_reason = "sender_dropped",
-            "connection manager to {address} finished"
+            connect_ms,
+            "Managed to establish connection to {}", self.address
         );
+
+        // 3. perform noise handshake (if applicable)
+        let noise_start = tokio::time::Instant::now();
+        let noise_stream = match upgrade_noise_initiator(stream, &self.noise_config).await {
+            Ok(noise_stream) => noise_stream,
+            Err(err) => {
+                let noise_handshake_ms = noise_start.elapsed().as_millis() as u64;
+                debug!(
+                    event = "connection.failed.noise",
+                    peer = %address,
+                    error = %err,
+                    connect_ms,
+                    noise_handshake_ms,
+                    reconnection_attempt,
+                    exit_reason = "noise_error",
+                    "Failed to perform Noise initiator handshake with {address}"
+                );
+                self.current_reconnection.fetch_add(1, Ordering::SeqCst);
+                return;
+            }
+        };
+        let noise_handshake_ms = noise_start.elapsed().as_millis() as u64;
+        self.current_reconnection.store(0, Ordering::Release);
+        debug!(
+            peer = %address,
+            connect_ms,
+            noise_handshake_ms,
+            "Noise initiator handshake completed for {:?}", address
+        );
+        let conn = Framed::new(noise_stream, NymCodec);
+
+        // 4. start handling the framed stream
+        run_io_loop(conn, self.message_receiver, address).await;
+    }
+}
+
+// The connection is unidirectional (send-only); we read from it solely to
+// notice peer FIN/RST while idle so we can evict the cache entry before the
+// next outbound send finds it stale.
+async fn run_io_loop<T>(
+    conn: Framed<T, NymCodec>,
+    mut receiver: ReceiverStream<FramedNymPacket>,
+    address: SocketAddr,
+) where
+    T: AsyncRead + AsyncWrite + Unpin,
+{
+    let (mut sink, mut stream) = conn.split();
+
+    loop {
+        tokio::select! {
+            msg = stream.next() => {
+                match msg {
+                    None => {
+                        debug!(
+                            peer = %address,
+                            exit_reason = "peer_closed",
+                            "peer closed mixnet connection to {address}"
+                        );
+                        break;
+                    }
+                    Some(Err(err)) => {
+                        debug!(
+                            event = "connection.read_error",
+                            peer = %address,
+                            error = %err,
+                            exit_reason = "read_error",
+                            "read error on mixnet connection to {address}: {err}"
+                        );
+                        break;
+                    }
+                    Some(Ok(_)) => {
+                        trace!(
+                            peer = %address,
+                            "unexpected inbound packet on mixnet connection to {address}; discarding"
+                        );
+                    }
+                }
+            }
+            outgoing = receiver.next() => {
+                match outgoing {
+                    None => {
+                        debug!(
+                            peer = %address,
+                            exit_reason = "sender_dropped",
+                            "connection manager to {address} finished"
+                        );
+                        break;
+                    }
+                    Some(packet) => {
+                        if let Err(err) = sink.send(packet).await {
+                            debug!(
+                                event = "connection.forward_error",
+                                peer = %address,
+                                error = %err,
+                                exit_reason = "forward_error",
+                                "Failed to forward packet to {address}: {err}"
+                            );
+                            break;
+                        }
+                    }
+                }
+            }
+        }
     }
 }
 
@@ -264,13 +366,18 @@ impl Client {
             sender.try_send(pending_packet).unwrap();
         }
 
+        // Ownership token for the task we're about to spawn; lets it tell
+        // on exit whether the cache entry still names it.
+        let handle_token = Arc::new(());
+
         // if we already tried to connect to `address` before, grab the current attempt count
         let current_reconnection_attempt =
             if let Some(mut existing) = self.active_connections.get_mut(&address) {
                 existing.channel = sender;
+                existing.handle_token = Arc::clone(&handle_token);
                 Arc::clone(&existing.current_reconnection_attempt)
             } else {
-                let new_entry = ConnectionSender::new(sender);
+                let new_entry = ConnectionSender::new(sender, Arc::clone(&handle_token));
                 let current_attempt = Arc::clone(&new_entry.current_reconnection_attempt);
                 self.active_connections.insert(address, new_entry);
                 current_attempt
@@ -285,6 +392,7 @@ impl Client {
 
         let connections_count = self.connections_count.clone();
         let noise_config = self.noise_config.clone();
+        let active_connections = self.active_connections.clone();
         tokio::spawn(async move {
             // before executing the manager, wait for what was specified, if anything
             if let Some(backoff) = backoff {
@@ -299,6 +407,8 @@ impl Client {
                 receiver,
                 initial_connection_timeout,
                 current_reconnection_attempt,
+                active_connections,
+                handle_token,
             )
             .run()
             .await;
@@ -428,4 +538,102 @@ mod tests {
             client.config.maximum_reconnection_backoff
         );
     }
+
+    fn test_addr() -> SocketAddr {
+        "127.0.0.1:1".parse().unwrap()
+    }
+
+    fn insert_with_token(
+        active: &ActiveConnections,
+        addr: SocketAddr,
+        token: Arc<()>,
+    ) -> mpsc::Receiver<FramedNymPacket> {
+        let (tx, rx) = mpsc::channel(1);
+        active.insert(addr, ConnectionSender::new(tx, token));
+        rx
+    }
+
+    #[test]
+    fn evict_on_drop_removes_entry_when_token_still_matches() {
+        let active = ActiveConnections::default();
+        let addr = test_addr();
+        let token = Arc::new(());
+        let _rx = insert_with_token(&active, addr, Arc::clone(&token));
+
+        assert!(active.get(&addr).is_some());
+
+        {
+            let _guard = EvictOnDrop {
+                active_connections: active.clone(),
+                address: addr,
+                handle_token: token,
+            };
+        }
+
+        assert!(
+            active.get(&addr).is_none(),
+            "owning task's drop should evict the entry"
+        );
+    }
+
+    #[test]
+    fn evict_on_drop_preserves_entry_replaced_by_newer_make_connection() {
+        // Simulates the race: old task's run() has returned, but before its
+        // drop guard fires, a concurrent `make_connection` replaced the
+        // entry's channel + handle_token with a fresh task's token.
+        let active = ActiveConnections::default();
+        let addr = test_addr();
+        let old_token = Arc::new(());
+        let new_token = Arc::new(());
+        let _rx_new = insert_with_token(&active, addr, Arc::clone(&new_token));
+
+        {
+            let _guard = EvictOnDrop {
+                active_connections: active.clone(),
+                address: addr,
+                handle_token: old_token,
+            };
+        }
+
+        assert!(
+            active.get(&addr).is_some(),
+            "old task's drop must not clobber the newer entry"
+        );
+    }
+
+    #[tokio::test]
+    async fn io_loop_exits_when_peer_closes_idle_connection() {
+        // The fix's second half: while no packets are flowing, peer FIN/RST
+        // must still be observed so the cache entry can be evicted before the
+        // next send finds it stale.
+        let (a, b) = tokio::io::duplex(64);
+        let conn = Framed::new(a, NymCodec);
+        let (_tx, rx) = mpsc::channel(1);
+
+        let task = tokio::spawn(run_io_loop(conn, ReceiverStream::new(rx), test_addr()));
+
+        // Simulate peer closing both directions of the connection.
+        drop(b);
+
+        tokio::time::timeout(Duration::from_secs(1), task)
+            .await
+            .expect("io_loop must notice peer close while idle")
+            .expect("io_loop task must not panic");
+    }
+
+    #[tokio::test]
+    async fn io_loop_exits_when_sender_dropped() {
+        let (a, _b) = tokio::io::duplex(64);
+        let conn = Framed::new(a, NymCodec);
+        let (tx, rx) = mpsc::channel(1);
+
+        let task = tokio::spawn(run_io_loop(conn, ReceiverStream::new(rx), test_addr()));
+
+        drop(tx);
+
+        tokio::time::timeout(Duration::from_secs(1), task)
+            .await
+            .expect("io_loop must exit when the upstream sender is dropped")
+            .expect("io_loop task must not panic");
+    }
 }

common/client-libs/mixnet-client/src/forwarder.rs

@@ -21,12 +21,16 @@ impl From<mpsc::UnboundedSender<PacketToForward>> for MixForwardingSender {
 }
 
 impl MixForwardingSender {
-    pub fn forward_packet(&self, packet: impl Into<PacketToForward>) -> Result<(), SendError> {
+    pub fn forward_packet(&self, packet: PacketToForward) -> Result<(), SendError> {
         self.0
-            .unbounded_send(packet.into())
+            .unbounded_send(packet)
             .map_err(|err| err.into_send_error())
     }
 
+    pub fn forward_client_packet_without_delay(&self, packet: MixPacket) -> Result<(), SendError> {
+        self.forward_packet(PacketToForward::client_packet_without_delay(packet))
+    }
+
     #[allow(clippy::len_without_is_empty)]
     pub fn len(&self) -> usize {
         self.0.len()
@@ -38,35 +42,23 @@ pub type MixForwardingReceiver = mpsc::UnboundedReceiver<PacketToForward>;
 pub struct PacketToForward {
     pub packet: MixPacket,
     pub forward_delay_target: Option<Instant>,
-}
-
-impl From<MixPacket> for PacketToForward {
-    fn from(packet: MixPacket) -> Self {
-        PacketToForward::new_no_delay(packet)
-    }
-}
-
-impl From<(MixPacket, Option<Instant>)> for PacketToForward {
-    fn from((packet, delay_until): (MixPacket, Option<Instant>)) -> Self {
-        PacketToForward::new(packet, delay_until)
-    }
-}
-
-impl From<(MixPacket, Instant)> for PacketToForward {
-    fn from((packet, delay_until): (MixPacket, Instant)) -> Self {
-        PacketToForward::new(packet, Some(delay_until))
-    }
+    pub network_monitor_packet: bool,
 }
 
 impl PacketToForward {
-    pub fn new(packet: MixPacket, forward_delay_target: Option<Instant>) -> Self {
+    pub fn new(
+        packet: MixPacket,
+        forward_delay_target: Option<Instant>,
+        network_monitor_packet: bool,
+    ) -> Self {
         PacketToForward {
             packet,
             forward_delay_target,
+            network_monitor_packet,
         }
     }
 
-    pub fn new_no_delay(packet: MixPacket) -> Self {
-        Self::new(packet, None)
+    pub fn client_packet_without_delay(packet: MixPacket) -> Self {
+        Self::new(packet, None, false)
     }
 }

common/client-libs/validator-client/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-validator-client"
+description = "Client for interacting with Nyx Cosmos SDK blockchain"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
-description = "Client for interacting with Nyx Cosmos SDK blockchain"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -24,6 +26,7 @@ nym-ecash-contract-common = { workspace = true }
 nym-multisig-contract-common = { workspace = true }
 nym-group-contract-common = { workspace = true }
 nym-performance-contract-common = { workspace = true }
+nym-network-monitors-contract-common = { workspace = true }
 nym-serde-helpers = { workspace = true, features = ["hex", "base64"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

common/client-libs/validator-client/src/client.rs

@@ -104,6 +104,14 @@ impl TryFrom<NymNetworkDetails> for Config {
 }
 
 impl Config {
+    pub fn new(nyxd_url: Url, api_url: Url, nyxd_config: nyxd::Config) -> Self {
+        Config {
+            api_url,
+            nyxd_url,
+            nyxd_config,
+        }
+    }
+
     pub fn try_from_nym_network_details(
         details: &NymNetworkDetails,
     ) -> Result<Self, ValidatorClientError> {
@@ -114,6 +122,15 @@ impl Config {
             .map(|url| Url::parse(url))
             .collect::<Result<Vec<_>, _>>()?;
 
+        if let Some(nym_api_urls) = details.nym_api_urls.as_ref() {
+            api_url.extend(
+                nym_api_urls
+                    .iter()
+                    .map(|url| url.url.parse())
+                    .collect::<Result<Vec<_>, _>>()?,
+            );
+        }
+
         if api_url.is_empty() {
             return Err(ValidatorClientError::NoAPIUrlAvailable);
         }

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -15,11 +15,15 @@ use nym_api_requests::ecash::models::{
     VerifyEcashTicketBody,
 };
 use nym_api_requests::ecash::VerificationKeyResponse;
+use nym_api_requests::models::network_monitor::{
+    KnownNetworkMonitorResponse, StressTestBatchSubmission,
+};
 use nym_api_requests::models::{
-    AnnotationResponse, ApiHealthResponse, BinaryBuildInformationOwned, ChainBlocksStatusResponse,
-    ChainStatusResponse, KeyRotationInfoResponse, NodePerformanceResponse, NodeRefreshBody,
-    NymNodeDescriptionV1, NymNodeDescriptionV2, PerformanceHistoryResponse, RewardedSetResponse,
-    SignerInformationResponse,
+    AnnotationResponseV1, ApiHealthResponse, BinaryBuildInformationOwned,
+    ChainBlocksStatusResponse, ChainStatusResponse, KeyRotationInfoResponse,
+    NodePerformanceResponse, NodeRefreshBody, NymNodeDescriptionV1, NymNodeDescriptionV2,
+    PerformanceHistoryResponse, RewardedSetResponse, SignerInformationResponse,
+    StressTestBatchSubmissionResponse,
 };
 use nym_api_requests::pagination::PaginatedResponse;
 use nym_http_api_client::{ApiClient, NO_PARAMS};
@@ -976,7 +980,7 @@ pub trait NymApiClientExt: ApiClient {
     async fn get_node_annotation(
         &self,
         node_id: NodeId,
-    ) -> Result<AnnotationResponse, NymAPIError> {
+    ) -> Result<AnnotationResponseV1, NymAPIError> {
         self.get_json(
             &[
                 routes::V1_API_VERSION,
@@ -1359,6 +1363,53 @@ pub trait NymApiClientExt: ApiClient {
 
         Ok(SemiSkimmedNodesWithMetadata::new(nodes, metadata))
     }
+
+    /// Queries the nym-api for whether a particular ed25519 identity key is currently recognised
+    /// as an authorised network monitor permitted to submit stress testing results.
+    ///
+    /// `identity_key` is expected to be the base58-encoded form of the ed25519 public key.
+    #[instrument(level = "debug", skip(self))]
+    async fn get_known_network_monitor(
+        &self,
+        identity_key: IdentityKeyRef<'_>,
+    ) -> Result<KnownNetworkMonitorResponse, NymAPIError> {
+        self.get_json(
+            &[
+                routes::V3_API_VERSION,
+                routes::NYM_NODES_ROUTES,
+                routes::STRESS_TESTING,
+                routes::STRESS_TESTING_KNOWN_MONITORS,
+                identity_key,
+            ],
+            NO_PARAMS,
+        )
+        .await
+    }
+
+    /// Submit a signed batch of stress-testing results to nym-api on behalf of a network monitor
+    /// orchestrator.
+    ///
+    /// The caller is expected to have produced `request` via
+    /// `StressTestBatchSubmissionContent::new(...)` and signed it with the orchestrator's ed25519
+    /// key; nym-api will reject submissions that are stale, replayed, unauthorised, or whose
+    /// signature fails to verify.
+    #[instrument(level = "debug", skip(self, request))]
+    async fn submit_stress_testing_results(
+        &self,
+        request: &StressTestBatchSubmission,
+    ) -> Result<StressTestBatchSubmissionResponse, NymAPIError> {
+        self.post_json(
+            &[
+                routes::V3_API_VERSION,
+                routes::NYM_NODES_ROUTES,
+                routes::STRESS_TESTING,
+                routes::STRESS_TESTING_BATCH_SUBMIT,
+            ],
+            NO_PARAMS,
+            request,
+        )
+        .await
+    }
 }
 
 // Client is already nym_http_api_client::Client (re-exported above), so just one impl needed

common/client-libs/validator-client/src/nym_api/routes.rs

@@ -49,6 +49,9 @@ pub mod nym_nodes {
     pub const NYM_NODES_REWARDED_SET: &str = "rewarded-set";
     pub const NYM_NODES_REFRESH_DESCRIBED: &str = "refresh-described";
     pub const BY_ADDRESSES: &str = "by-addresses";
+    pub const STRESS_TESTING: &str = "stress-testing";
+    pub const STRESS_TESTING_KNOWN_MONITORS: &str = "known-monitors";
+    pub const STRESS_TESTING_BATCH_SUBMIT: &str = "batch-submit";
 }
 
 pub const STATUS_ROUTES: &str = "status";

common/client-libs/validator-client/src/nyxd/contract_traits/mod.rs

@@ -13,6 +13,7 @@ pub mod ecash_query_client;
 pub mod group_query_client;
 pub mod mixnet_query_client;
 pub mod multisig_query_client;
+pub mod network_monitors_query_client;
 pub mod performance_query_client;
 pub mod vesting_query_client;
 
@@ -22,6 +23,7 @@ pub mod ecash_signing_client;
 pub mod group_signing_client;
 pub mod mixnet_signing_client;
 pub mod multisig_signing_client;
+pub mod network_monitors_signing_client;
 pub mod performance_signing_client;
 pub mod vesting_signing_client;
 
@@ -31,6 +33,9 @@ pub use ecash_query_client::{EcashQueryClient, PagedEcashQueryClient};
 pub use group_query_client::{GroupQueryClient, PagedGroupQueryClient};
 pub use mixnet_query_client::{MixnetQueryClient, PagedMixnetQueryClient};
 pub use multisig_query_client::{MultisigQueryClient, PagedMultisigQueryClient};
+pub use network_monitors_query_client::{
+    NetworkMonitorsQueryClient, PagedNetworkMonitorsQueryClient,
+};
 pub use performance_query_client::{PagedPerformanceQueryClient, PerformanceQueryClient};
 pub use vesting_query_client::{PagedVestingQueryClient, VestingQueryClient};
 
@@ -40,6 +45,7 @@ pub use ecash_signing_client::EcashSigningClient;
 pub use group_signing_client::GroupSigningClient;
 pub use mixnet_signing_client::MixnetSigningClient;
 pub use multisig_signing_client::MultisigSigningClient;
+pub use network_monitors_signing_client::NetworkMonitorsSigningClient;
 pub use performance_signing_client::PerformanceSigningClient;
 pub use vesting_signing_client::VestingSigningClient;
 
@@ -49,6 +55,7 @@ pub trait NymContractsProvider {
     fn mixnet_contract_address(&self) -> Option<&AccountId>;
     fn vesting_contract_address(&self) -> Option<&AccountId>;
     fn performance_contract_address(&self) -> Option<&AccountId>;
+    fn network_monitors_contract_address(&self) -> Option<&AccountId>;
 
     // coconut-related
     fn ecash_contract_address(&self) -> Option<&AccountId>;
@@ -62,6 +69,7 @@ pub struct TypedNymContracts {
     pub mixnet_contract_address: Option<AccountId>,
     pub vesting_contract_address: Option<AccountId>,
     pub performance_contract_address: Option<AccountId>,
+    pub network_monitors_contract_address: Option<AccountId>,
 
     pub ecash_contract_address: Option<AccountId>,
     pub group_contract_address: Option<AccountId>,
@@ -86,6 +94,10 @@ impl TryFrom<NymContracts> for TypedNymContracts {
                 .performance_contract_address
                 .map(|addr| addr.parse())
                 .transpose()?,
+            network_monitors_contract_address: value
+                .network_monitors_contract_address
+                .map(|addr| addr.parse())
+                .transpose()?,
             ecash_contract_address: value
                 .ecash_contract_address
                 .map(|addr| addr.parse())

common/client-libs/validator-client/src/nyxd/contract_traits/network_monitors_query_client.rs

@@ -0,0 +1,107 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::collect_paged;
+use crate::nyxd::contract_traits::NymContractsProvider;
+use crate::nyxd::error::NyxdError;
+use crate::nyxd::CosmWasmClient;
+use async_trait::async_trait;
+use nym_network_monitors_contract_common::{
+    AuthorisedNetworkMonitor, AuthorisedNetworkMonitorOrchestratorsResponse,
+    AuthorisedNetworkMonitorsPagedResponse, QueryMsg as NetworkMonitorsQueryMsg,
+};
+use serde::Deserialize;
+use std::net::SocketAddr;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait NetworkMonitorsQueryClient {
+    async fn query_network_monitors_contract<T>(
+        &self,
+        query: NetworkMonitorsQueryMsg,
+    ) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>;
+
+    async fn get_admin(&self) -> Result<cw_controllers::AdminResponse, NyxdError> {
+        self.query_network_monitors_contract(NetworkMonitorsQueryMsg::Admin {})
+            .await
+    }
+
+    async fn get_network_monitor_orchestrators(
+        &self,
+    ) -> Result<AuthorisedNetworkMonitorOrchestratorsResponse, NyxdError> {
+        self.query_network_monitors_contract(
+            NetworkMonitorsQueryMsg::NetworkMonitorOrchestrators {},
+        )
+        .await
+    }
+
+    async fn get_network_monitor_agents_paged(
+        &self,
+        start_next_after: Option<SocketAddr>,
+        limit: Option<u32>,
+    ) -> Result<AuthorisedNetworkMonitorsPagedResponse, NyxdError> {
+        self.query_network_monitors_contract(NetworkMonitorsQueryMsg::NetworkMonitorAgents {
+            start_next_after,
+            limit,
+        })
+        .await
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait PagedNetworkMonitorsQueryClient: NetworkMonitorsQueryClient {
+    async fn get_all_network_monitor_agents(
+        &self,
+    ) -> Result<Vec<AuthorisedNetworkMonitor>, NyxdError> {
+        collect_paged!(self, get_network_monitor_agents_paged, authorised)
+    }
+}
+
+#[async_trait]
+impl<T> PagedNetworkMonitorsQueryClient for T where T: NetworkMonitorsQueryClient {}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl<C> NetworkMonitorsQueryClient for C
+where
+    C: CosmWasmClient + NymContractsProvider + Send + Sync,
+{
+    async fn query_network_monitors_contract<T>(
+        &self,
+        query: NetworkMonitorsQueryMsg,
+    ) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        let contract_address = &self
+            .network_monitors_contract_address()
+            .ok_or_else(|| NyxdError::unavailable_contract_address("network monitors contract"))?;
+        self.query_contract_smart(contract_address, &query).await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::nyxd::contract_traits::tests::IgnoreValue;
+
+    // it's enough that this compiles and clippy is happy about it
+    #[allow(dead_code)]
+    fn all_query_variants_are_covered<C: NetworkMonitorsQueryClient + Send + Sync>(
+        client: C,
+        msg: NetworkMonitorsQueryMsg,
+    ) {
+        match msg {
+            NetworkMonitorsQueryMsg::Admin {} => client.get_admin().ignore(),
+            NetworkMonitorsQueryMsg::NetworkMonitorOrchestrators {} => {
+                client.get_network_monitor_orchestrators().ignore()
+            }
+            NetworkMonitorsQueryMsg::NetworkMonitorAgents { .. } => {
+                client.get_network_monitor_agents_paged(None, None).ignore()
+            }
+        };
+    }
+}

common/client-libs/validator-client/src/nyxd/contract_traits/network_monitors_signing_client.rs

@@ -0,0 +1,205 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::nyxd::contract_traits::NymContractsProvider;
+use crate::nyxd::cosmwasm_client::types::ExecuteResult;
+use crate::nyxd::error::NyxdError;
+use crate::nyxd::{Coin, Fee, SigningCosmWasmClient};
+use crate::signing::signer::OfflineSigner;
+use async_trait::async_trait;
+use nym_network_monitors_contract_common::ExecuteMsg as NetworkMonitorsExecuteMsg;
+use std::net::SocketAddr;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait NetworkMonitorsSigningClient {
+    async fn execute_network_monitors_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: NetworkMonitorsExecuteMsg,
+        memo: String,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError>;
+
+    async fn update_admin(
+        &self,
+        admin: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::UpdateAdmin { admin };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::UpdateAdmin".into(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn authorise_network_monitor_orchestrator(
+        &self,
+        address: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::AuthoriseNetworkMonitorOrchestrator { address };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::AuthoriseNetworkMonitorOrchestrator".into(),
+            vec![],
+        )
+        .await
+    }
+
+    /// Announce (or rotate) the ed25519 identity key of the calling network monitor orchestrator.
+    ///
+    /// The caller must already be an authorised orchestrator; the contract validates that
+    /// `identity_key` is a well-formed base-58 encoding of a 32-byte ed25519 public key.
+    async fn update_orchestrator_identity_key(
+        &self,
+        identity_key: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::UpdateOrchestratorIdentityKey { key: identity_key };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::UpdateOrchestratorIdentityKey".into(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn revoke_network_monitor_orchestrator(
+        &self,
+        address: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::RevokeNetworkMonitorOrchestrator { address };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::RevokeNetworkMonitorOrchestrator".into(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn authorise_network_monitor(
+        &self,
+        mixnet_address: SocketAddr,
+        bs58_x25519_noise: String,
+        noise_version: u8,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::AuthoriseNetworkMonitor {
+            mixnet_address,
+            bs58_x25519_noise,
+            noise_version,
+        };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::AuthoriseNetworkMonitor".into(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn revoke_network_monitor(
+        &self,
+        address: SocketAddr,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::RevokeNetworkMonitor { address };
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::RevokeNetworkMonitor".into(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn revoke_all_network_monitors(
+        &self,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let msg = NetworkMonitorsExecuteMsg::RevokeAllNetworkMonitors;
+        self.execute_network_monitors_contract(
+            fee,
+            msg,
+            "NetworkMonitorsExecuteMsg::RevokeAllNetworkMonitors".into(),
+            vec![],
+        )
+        .await
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl<C> NetworkMonitorsSigningClient for C
+where
+    C: SigningCosmWasmClient + NymContractsProvider + Sync,
+    NyxdError: From<<Self as OfflineSigner>::Error>,
+{
+    async fn execute_network_monitors_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: NetworkMonitorsExecuteMsg,
+        memo: String,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let contract_address = &self
+            .network_monitors_contract_address()
+            .ok_or_else(|| NyxdError::unavailable_contract_address("network monitors contract"))?;
+
+        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
+
+        let signer_address = &self.signer_addresses()[0];
+        self.execute(signer_address, contract_address, &msg, fee, memo, funds)
+            .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::nyxd::contract_traits::tests::IgnoreValue;
+    use nym_network_monitors_contract_common::ExecuteMsg;
+
+    // it's enough that this compiles and clippy is happy about it
+    #[allow(dead_code)]
+    fn all_execute_variants_are_covered<C: NetworkMonitorsSigningClient + Send + Sync>(
+        client: C,
+        msg: NetworkMonitorsExecuteMsg,
+    ) {
+        match msg {
+            NetworkMonitorsExecuteMsg::UpdateAdmin { admin } => {
+                client.update_admin(admin, None).ignore()
+            }
+            ExecuteMsg::AuthoriseNetworkMonitorOrchestrator { address } => client
+                .authorise_network_monitor_orchestrator(address, None)
+                .ignore(),
+            ExecuteMsg::UpdateOrchestratorIdentityKey { key } => {
+                client.update_orchestrator_identity_key(key, None).ignore()
+            }
+            ExecuteMsg::RevokeNetworkMonitorOrchestrator { address } => client
+                .revoke_network_monitor_orchestrator(address, None)
+                .ignore(),
+            ExecuteMsg::AuthoriseNetworkMonitor {
+                mixnet_address: address,
+                bs58_x25519_noise,
+                noise_version,
+            } => client
+                .authorise_network_monitor(address, bs58_x25519_noise, noise_version, None)
+                .ignore(),
+            ExecuteMsg::RevokeNetworkMonitor { address } => {
+                client.revoke_network_monitor(address, None).ignore()
+            }
+            ExecuteMsg::RevokeAllNetworkMonitors => {
+                client.revoke_all_network_monitors(None).ignore()
+            }
+        };
+    }
+}

common/client-libs/validator-client/src/nyxd/cosmwasm_client/mod.rs

@@ -36,7 +36,7 @@ pub mod logs;
 pub mod module_traits;
 pub mod types;
 
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub(crate) struct SigningClientOptions {
     gas_price: GasPrice,
     simulated_gas_multiplier: f32,
@@ -80,6 +80,17 @@ impl<C, S> MaybeSigningClient<C, S> {
             opts,
         }
     }
+
+    pub(crate) fn clone_query_client(&self) -> MaybeSigningClient<C, NoSigner>
+    where
+        C: Clone,
+    {
+        MaybeSigningClient {
+            client: self.client.clone(),
+            signer: Default::default(),
+            opts: self.opts.clone(),
+        }
+    }
 }
 
 #[cfg(feature = "http-client")]

common/client-libs/validator-client/src/nyxd/mod.rs

@@ -24,6 +24,8 @@ use async_trait::async_trait;
 use cosmrs::tendermint::{abci, evidence::Evidence, Genesis};
 use cosmrs::tx::{Raw, SignDoc};
 use cosmwasm_std::Addr;
+use nym_contracts_common::build_information::CONTRACT_BUILD_INFO_STORAGE_KEY;
+use nym_contracts_common::ContractBuildInformation;
 use nym_network_defaults::{ChainDetails, NymNetworkDetails};
 use serde::{de::DeserializeOwned, Serialize};
 use std::fmt::Debug;
@@ -40,6 +42,7 @@ pub use crate::nyxd::{
     fee::Fee,
 };
 pub use crate::rpc::TendermintRpcClient;
+pub use bip39;
 pub use coin::Coin;
 pub use cosmrs::{
     bank::MsgSend,
@@ -70,14 +73,19 @@ pub use tendermint_rpc::{
     Paging, Request, Response, SimpleRequest,
 };
 
+pub use nym_ecash_contract_common;
+pub use nym_mixnet_contract_common;
+pub use nym_multisig_contract_common;
+pub use nym_network_monitors_contract_common;
+pub use nym_performance_contract_common;
+pub use nym_vesting_contract_common;
+
 #[cfg(feature = "http-client")]
 use crate::http_client;
 #[cfg(feature = "http-client")]
 use crate::{DirectSigningHttpRpcNyxdClient, QueryHttpRpcNyxdClient};
 #[cfg(feature = "http-client")]
 use cosmrs::rpc::{HttpClient, HttpClientUrl};
-use nym_contracts_common::build_information::CONTRACT_BUILD_INFO_STORAGE_KEY;
-use nym_contracts_common::ContractBuildInformation;
 
 pub mod coin;
 pub mod contract_traits;
@@ -262,6 +270,16 @@ impl<C, S> NyxdClient<C, S> {
         }
     }
 
+    pub fn clone_query_client(&self) -> NyxdClient<C>
+    where
+        C: Clone,
+    {
+        NyxdClient {
+            client: self.client.clone_query_client(),
+            config: self.config.clone(),
+        }
+    }
+
     pub fn current_config(&self) -> &Config {
         &self.config
     }
@@ -289,6 +307,10 @@ impl<C, S> NyxdClient<C, S> {
     pub fn set_simulated_gas_multiplier(&mut self, multiplier: f32) {
         self.config.simulated_gas_multiplier = multiplier;
     }
+
+    pub fn get_nym_contracts(&self) -> TypedNymContracts {
+        self.config.contracts.clone()
+    }
 }
 
 impl<C, S> NymContractsProvider for NyxdClient<C, S> {
@@ -303,6 +325,12 @@ impl<C, S> NymContractsProvider for NyxdClient<C, S> {
     fn performance_contract_address(&self) -> Option<&AccountId> {
         self.config.contracts.performance_contract_address.as_ref()
     }
+    fn network_monitors_contract_address(&self) -> Option<&AccountId> {
+        self.config
+            .contracts
+            .network_monitors_contract_address
+            .as_ref()
+    }
 
     fn ecash_contract_address(&self) -> Option<&AccountId> {
         self.config.contracts.ecash_contract_address.as_ref()

common/commands/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-cli-commands"
+description = "Common commands crate used by the nym-cli tool for interacting with the Nyx Cosmos SDK blockchain and Mixnet endpoints"
 version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common commands crate used by the nym-cli tool for interacting with the Nyx Cosmos SDK blockchain and Mixnet endpoints"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/config/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-config"
+description = "Config related helpers and functions"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
+repository.workspace = true
 homepage.workspace = true
-description = "Config related helpers and functions"
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/coconut-dkg/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-coconut-dkg-common"
+description = "Common crate for Nym's DKG cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's DKG cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/contracts-common-testing/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-contracts-common-testing"
+description = "Common crate for cosmwasm contract tests"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
-description = "Common crate for cosmwasm contract tests"
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-contracts-common"
-version.workspace = true
 description = "Common library for Nym cosmwasm contracts"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 bs58 = { workspace = true }

common/cosmwasm-smart-contracts/easy_addr/Cargo.toml

@@ -2,8 +2,8 @@
 name = "easy-addr"
 version.workspace = true
 edition = "2021"
-publish = false
 license.workspace = true
+publish = false
 
 [lib]
 proc-macro = true

common/cosmwasm-smart-contracts/ecash-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-ecash-contract-common"
+description = "Common crate for Nym's ecash/zknym cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's ecash/zknym cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/ecash-contract/src/counters.rs

@@ -14,5 +14,6 @@ pub struct PoolCounters {
 
     /// Represents the total amount of tickets requested to be redeemed from the contract and get moved into the holding account,
     /// after that functionality got disabled.
+    #[serde(default)]
     pub tickets_requested_and_not_redeemed: u64,
 }

common/cosmwasm-smart-contracts/group-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-group-contract-common"
+description = "Common crate for Nym's group cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's group cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-schema = { workspace = true }

common/cosmwasm-smart-contracts/mixnet-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-mixnet-contract-common"
-version.workspace = true
 description = "Common library for the Nym mixnet contract"
-rust-version = "1.85"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 bs58 = { workspace = true }

common/cosmwasm-smart-contracts/multisig-contract/Cargo.toml

@@ -1,10 +1,16 @@
 [package]
 name = "nym-multisig-contract-common"
+description = "Common code for the Nym multisig CosmWasm smart contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common code for the Nym multisig CosmWasm smart contract"
+repository.workspace = true
 homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-schema = { workspace = true }

common/cosmwasm-smart-contracts/network-monitors-contract/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "nym-network-monitors-contract-common"
+description = "Common library for the Nym Network Monitors contract"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+readme.workspace = true
+version.workspace = true
+
+[dependencies]
+thiserror = { workspace = true }
+serde = { workspace = true }
+schemars = { workspace = true }
+
+cosmwasm-std = { workspace = true }
+cosmwasm-schema = { workspace = true }
+cw-controllers = { workspace = true }
+
+[features]
+schema = []
+
+[lints]
+workspace = true

common/cosmwasm-smart-contracts/network-monitors-contract/src/constants.rs

@@ -0,0 +1,8 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod storage_keys {
+    pub const CONTRACT_ADMIN: &str = "contract-admin";
+    pub const AUTHORISED_ORCHESTRATORS: &str = "authorised-orchestrators";
+    pub const AUTHORISED_NETWORK_MONITORS: &str = "authorised-network-monitors";
+}

common/cosmwasm-smart-contracts/network-monitors-contract/src/error.rs

@@ -0,0 +1,30 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_std::Addr;
+use cw_controllers::AdminError;
+use thiserror::Error;
+
+#[derive(Error, Debug, PartialEq)]
+pub enum NetworkMonitorsContractError {
+    #[error("could not perform contract migration: {comment}")]
+    FailedMigration { comment: String },
+
+    #[error(transparent)]
+    Admin(#[from] AdminError),
+
+    #[error("unauthorised")]
+    Unauthorized,
+
+    #[error("address {addr} is not an authorised orchestrator")]
+    NotAnOrchestrator { addr: Addr },
+
+    #[error("Failed to recover x25519 public key from its base58 representation: {0}")]
+    MalformedX25519AgentNoiseKey(String),
+
+    #[error("Failed to recover ed25519 public key from its base58 representation: {0}")]
+    MalformedEd25519OrchestratorIdentityKey(String),
+
+    #[error(transparent)]
+    StdErr(#[from] cosmwasm_std::StdError),
+}

common/cosmwasm-smart-contracts/network-monitors-contract/src/lib.rs

@@ -0,0 +1,11 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod constants;
+pub mod error;
+pub mod msg;
+pub mod types;
+
+pub use error::*;
+pub use msg::{ExecuteMsg, InstantiateMsg, MigrateMsg, QueryMsg};
+pub use types::*;

common/cosmwasm-smart-contracts/network-monitors-contract/src/msg.rs

@@ -0,0 +1,78 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use std::net::SocketAddr;
+
+#[cfg(feature = "schema")]
+use crate::{
+    AuthorisedNetworkMonitorOrchestratorsResponse, AuthorisedNetworkMonitorsPagedResponse,
+};
+
+#[cw_serde]
+pub struct InstantiateMsg {
+    /// Address of the initial network monitor orchestrator.
+    pub orchestrator_address: String,
+}
+
+#[cw_serde]
+pub enum ExecuteMsg {
+    /// Change the admin
+    UpdateAdmin { admin: String },
+
+    /// Authorise new network monitor orchestrator
+    AuthoriseNetworkMonitorOrchestrator { address: String },
+
+    /// Attempt to update the announced identity key of this orchestrator
+    UpdateOrchestratorIdentityKey { key: String },
+
+    /// Revoke network monitor orchestrator authorisation.
+    RevokeNetworkMonitorOrchestrator { address: String },
+
+    /// Authorise new network monitor (or renew authorisation)
+    /// granting additional privileges when sending mixnet packets to Nym nodes.
+    AuthoriseNetworkMonitor {
+        /// Mixnet address of the agent.
+        /// The underlying ip address is going to be used as ingress to the nodes,
+        /// and the full socket address announces the egress and the association with the noise key
+        mixnet_address: SocketAddr,
+
+        /// Base-58 encoded noise key of the agent.
+        bs58_x25519_noise: String,
+
+        /// Version of the noise protocol used by the agent.
+        noise_version: u8,
+    },
+
+    /// Revoke network monitor authorisation.
+    RevokeNetworkMonitor { address: SocketAddr },
+
+    /// Revoke all network monitor authorisations.
+    RevokeAllNetworkMonitors,
+}
+
+#[cw_serde]
+#[cfg_attr(feature = "schema", derive(cosmwasm_schema::QueryResponses))]
+pub enum QueryMsg {
+    #[cfg_attr(feature = "schema", returns(cw_controllers::AdminResponse))]
+    Admin {},
+
+    // no need for pagination as we don't expect even a double digit of those
+    #[cfg_attr(
+        feature = "schema",
+        returns(AuthorisedNetworkMonitorOrchestratorsResponse)
+    )]
+    NetworkMonitorOrchestrators {},
+
+    #[cfg_attr(feature = "schema", returns(AuthorisedNetworkMonitorsPagedResponse))]
+    NetworkMonitorAgents {
+        /// Pagination control for the values returned by the query. Note that the provided value itself will **not** be used for the response.
+        start_next_after: Option<SocketAddr>,
+
+        /// Controls the maximum number of entries returned by the query. Note that too large values will be overwritten by a saner default.
+        limit: Option<u32>,
+    },
+}
+
+#[cw_serde]
+pub struct MigrateMsg {}

common/cosmwasm-smart-contracts/network-monitors-contract/src/types.rs

@@ -0,0 +1,53 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::{Addr, Timestamp};
+use std::net::SocketAddr;
+
+pub type OrchestratorAddress = Addr;
+
+#[cw_serde]
+pub struct AuthorisedNetworkMonitorOrchestrator {
+    /// The address associated with the network monitor orchestrator.
+    pub address: Addr,
+
+    /// Base-58 encoded identity key of the orchestrator, announced by the orchestrator itself
+    /// on startup.
+    pub identity_key: Option<String>,
+
+    /// Timestamp of when the network monitor was authorised.
+    pub authorised_at: Timestamp,
+}
+
+#[cw_serde]
+pub struct AuthorisedNetworkMonitor {
+    /// Mixnet address of the agent.
+    /// The underlying ip address is going to be used as ingress to the nodes,
+    /// and the full socket address announces the egress and the association with the noise key
+    pub mixnet_address: SocketAddr,
+
+    /// The address of the orchestrator that authorised the network monitor agent.
+    pub authorised_by: OrchestratorAddress,
+
+    /// Timestamp of when the network monitor was authorised.
+    pub authorised_at: Timestamp,
+
+    /// Base-58 encoded noise key of the agent.
+    pub bs58_x25519_noise: String,
+
+    /// Version of the noise protocol used by the agent.
+    pub noise_version: u8,
+}
+
+#[cw_serde]
+pub struct AuthorisedNetworkMonitorOrchestratorsResponse {
+    pub authorised: Vec<AuthorisedNetworkMonitorOrchestrator>,
+}
+
+#[cw_serde]
+pub struct AuthorisedNetworkMonitorsPagedResponse {
+    pub authorised: Vec<AuthorisedNetworkMonitor>,
+
+    pub start_next_after: Option<SocketAddr>,
+}

common/cosmwasm-smart-contracts/nym-performance-contract/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-performance-contract-common"
+description = "Common crate for Nym's group performance contract"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
-description = "Common crate for Nym's group performance contract"
+publish = true
 
 [dependencies]
 thiserror = { workspace = true }

common/cosmwasm-smart-contracts/nym-pool-contract/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-pool-contract-common"
-version.workspace = true
 description = "Common library for the Nym Pool contract"
+version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
+publish = true
 
 [dependencies]
 thiserror = { workspace = true }

common/cosmwasm-smart-contracts/vesting-contract/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-vesting-contract-common"
-version.workspace = true
 description = "Common library for the Nym vesting contract"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-std = { workspace = true }

common/credential-proxy/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-credential-proxy-lib"
+description = "Build script and core functionality of the Nym Credential Proxy"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Build script and core functionality of the Nym Credential Proxy"
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/credential-proxy/src/deposits_buffer/mod.rs

@@ -13,8 +13,9 @@ use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 use tokio::sync::Mutex as AsyncMutex;
+use tokio::time::Instant;
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, info, instrument, warn};
+use tracing::{debug, error, info, instrument, warn};
 use uuid::Uuid;
 
 pub use helpers::{BufferedDeposit, PerformedDeposits, make_deposits_request, split_deposits};
@@ -146,9 +147,14 @@ impl DepositsBuffer {
 
     // if we're here, we know we're below the threshold
     fn maybe_refill_deposits(&self) {
-        if let Some(mut guard) = self.inner.deposits_refill_task.try_get_new_task_guard() {
+        if let Some((mut guard, completion_guard)) =
+            self.inner.deposits_refill_task.try_get_new_task_guard()
+        {
             let this = self.clone();
-            *guard = Some(tokio::spawn(async move { this.refill_deposits().await }));
+            *guard = Some(tokio::spawn(async move {
+                let _completion_guard = completion_guard;
+                this.refill_deposits().await
+            }));
         }
     }
 
@@ -179,6 +185,8 @@ impl DepositsBuffer {
         requested_on: OffsetDateTime,
         client_pubkey: PublicKeyUser,
     ) -> Result<BufferedDeposit, CredentialProxyError> {
+        let wait_start = Instant::now();
+        let mut i = 0;
         loop {
             tokio::time::sleep(Duration::from_millis(500)).await;
             if let Some(buffered_deposit) = self.inner.unused_deposits.lock().await.pop() {
@@ -195,6 +203,15 @@ impl DepositsBuffer {
                 // make sure there's always a task working in the background in case deposits get used up too quickly
                 self.maybe_refill_deposits()
             }
+            i += 1;
+            let elapsed = wait_start.elapsed();
+            if elapsed > Duration::from_secs(5) && i % 10 == 0 {
+                warn!("we've been waiting for over 5s to make a deposit - something is wrong!")
+            } else if elapsed > Duration::from_secs(10) && i % 5 == 0 {
+                error!(
+                    "we've been waiting for over 10s to make a deposit - something is SERIOUSLY wrong!"
+                )
+            }
         }
     }
 

common/credential-proxy/src/deposits_buffer/refill_task.rs

@@ -3,12 +3,22 @@
 
 use crate::error::CredentialProxyError;
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Mutex as StdMutex, MutexGuard};
+use std::sync::{Arc, Mutex as StdMutex, MutexGuard};
 use tokio::task::JoinHandle;
 use tracing::{debug, error};
 
 pub(super) type RefillTaskResult = Result<(), CredentialProxyError>;
 
+pub(super) struct InProgressGuard {
+    in_progress: Arc<AtomicBool>,
+}
+
+impl Drop for InProgressGuard {
+    fn drop(&mut self) {
+        self.in_progress.store(false, Ordering::SeqCst);
+    }
+}
+
 #[derive(Default)]
 pub(super) struct RefillTask {
     // note that we can only have a single transaction in progress (or it'd mess up with our sequence numbers)
@@ -16,7 +26,7 @@ pub(super) struct RefillTask {
     // we'll have to increase the number of deposits per transaction
     join_handle: StdMutex<Option<JoinHandle<RefillTaskResult>>>,
 
-    in_progress: AtomicBool,
+    in_progress: Arc<AtomicBool>,
 }
 
 impl RefillTask {
@@ -28,9 +38,15 @@ impl RefillTask {
             .is_ok()
     }
 
+    /// Returns `None` if a refill is already in progress. On success, returns the
+    /// join-handle guard (to store the new `JoinHandle` into) and an [`InProgressGuard`]
+    /// that **must be moved into the spawned task** — it resets the flag when dropped.
     pub(super) fn try_get_new_task_guard(
         &self,
-    ) -> Option<MutexGuard<'_, Option<JoinHandle<RefillTaskResult>>>> {
+    ) -> Option<(
+        MutexGuard<'_, Option<JoinHandle<RefillTaskResult>>>,
+        InProgressGuard,
+    )> {
         // sanity check for concurrent request
         if !self.try_set_in_progress() {
             debug!("another task has already started deposit refill request");
@@ -48,7 +64,11 @@ impl RefillTask {
             }
         }
 
-        Some(guard)
+        let completion_guard = InProgressGuard {
+            in_progress: Arc::clone(&self.in_progress),
+        };
+
+        Some((guard, completion_guard))
     }
 
     pub(super) fn take_task_join_handle(&self) -> Option<JoinHandle<RefillTaskResult>> {
@@ -56,3 +76,34 @@ impl RefillTask {
         self.join_handle.lock().expect("mutex got poisoned").take()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn in_progress_resets_after_guard_drop() {
+        let task = RefillTask::default();
+
+        let (guard, completion_guard) = task.try_get_new_task_guard().unwrap();
+        drop(guard);
+        assert!(task.try_get_new_task_guard().is_none());
+
+        drop(completion_guard);
+        assert!(task.try_get_new_task_guard().is_some());
+    }
+
+    #[test]
+    fn in_progress_resets_on_panic() {
+        let task = RefillTask::default();
+
+        let (guard, completion_guard) = task.try_get_new_task_guard().unwrap();
+        drop(guard);
+
+        let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let _g = completion_guard;
+            panic!("simulated refill task panic");
+        }));
+        assert!(task.try_get_new_task_guard().is_some());
+    }
+}

common/credential-proxy/src/quorum_checker.rs

@@ -57,6 +57,7 @@ impl QuorumStateChecker {
     }
 
     async fn check_quorum_state(&self) -> Result<bool, CredentialProxyError> {
+        info!("checking the current quorum state");
         let client_guard = self.client.query_chain().await;
 
         // split the operation as we only need to hold the reference to chain client for the first part
@@ -65,6 +66,7 @@ impl QuorumStateChecker {
         drop(client_guard);
 
         let res = check_known_dealers(dkg_details).await?;
+        info!("there are {} known DKG dealers", res.results.len());
 
         let Some(signing_threshold) = res.threshold else {
             warn!(
@@ -76,12 +78,33 @@ impl QuorumStateChecker {
         let mut working_issuer = 0;
 
         for result in res.results {
+            let dealer = &result.information;
+            let info = format!("[id: {}] @ {}", dealer.node_index, dealer.announce_address);
             if result.chain_available() && result.signing_available() {
+                info!("✅ {info} is fully available");
                 working_issuer += 1;
+            } else if !result.chain_available() && !result.signing_available() {
+                warn!("❌ {info} is not available for both chain and signing");
+            } else if !result.chain_available() {
+                warn!("❌ {info} is not available for chain");
+            } else {
+                warn!("❌ {info} is not available for signing");
             }
         }
 
-        Ok((working_issuer as u64) >= signing_threshold)
+        let available = (working_issuer as u64) >= signing_threshold;
+
+        if available {
+            info!(
+                "✅ Quorum state is available with {working_issuer} out of {signing_threshold} issuers"
+            )
+        } else {
+            error!(
+                "❌ Quorum state is not available with {working_issuer} out of {signing_threshold} issuers"
+            )
+        }
+
+        Ok(available)
     }
 
     pub async fn run_forever(self) {

common/credential-storage/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-credential-storage"
+description = "Crate for handling and storing spent and unspent zknym ticketbooks"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-rust-version.workspace = true
-description = "Crate for handling and storing spent and unspent zknym ticketbooks"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/credential-utils/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-credential-utils"
+description = "Utils crate for dealing with zknym credentials"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Utils crate for dealing with zknym credentials"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]

common/credential-verification/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-credential-verification"
+description = "Store and verify zknym credentials"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Store and verify zknym credentials"
+publish = true
 
 [dependencies]
 async-trait = { workspace = true }

common/credentials-interface/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-credentials-interface"
+description = "Interface for Nym's compact eacash / zknym credential scheme"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Interface for Nym's compact eacash / zknym credential scheme"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/credentials/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-credentials"
+description = "Crate for using Nym's zknym credentials"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Crate for using Nym's zknym credentials"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/crypto/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-crypto"
-version.workspace = true
 description = "Crypto library for the nym mixnet"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 aes-gcm-siv = { workspace = true, optional = true }

common/crypto/src/lib.rs

@@ -31,3 +31,5 @@ pub use aes_gcm_siv::{Aes128GcmSiv, Aes256GcmSiv};
 pub use blake3;
 #[cfg(feature = "stream_cipher")]
 pub use ctr;
+#[cfg(feature = "hashing")]
+pub use sha2;

common/dkg/Cargo.toml

@@ -1,13 +1,17 @@
 [package]
 name = "nym-dkg"
-version.workspace = true
-edition = "2021"
-resolver = "2"
-license.workspace = true
 description = "Nym's Distributed Key Generation functionality"
+version.workspace = true
+authors.workspace = true
+edition = "2021"
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
+resolver = "2"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/ecash-signer-check-types/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-ecash-signer-check-types"
+description = "Crate containing types for the `ecash-signer-check` crate used to check if zknym signers are up and running properly"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Crate containing types for the `ecash-signer-check` crate used to check if zknym signers are up and running properly"
+publish = true
 
 [dependencies]
 semver = { workspace = true }

common/ecash-signer-check-types/src/helper_traits.rs

@@ -6,7 +6,7 @@ use nym_coconut_dkg_common::verification_key::VerificationKeyShare;
 use nym_crypto::asymmetric::ed25519;
 use std::time::Duration;
 use time::OffsetDateTime;
-use tracing::{debug, warn};
+use tracing::warn;
 
 pub trait Verifiable {
     fn verify_signature(&self, pub_key: &ed25519::PublicKey) -> bool;
@@ -36,6 +36,7 @@ pub trait ChainResponse: Verifiable + TimestampedResponse {
 
         // we rely on information provided from the api itself AS LONG AS it's not too outdated
         if self.timestamp() + stale_response_threshold < now {
+            warn!("chain status response is stale");
             return false;
         }
         self.chain_synced()
@@ -96,26 +97,27 @@ pub trait SignerResponse: Verifiable + TimestampedResponse {
 
         // we rely on information provided from the api itself AS LONG AS it's not too outdated
         if self.timestamp() + stale_response_threshold < now {
+            warn!("stale signer response");
             return false;
         }
 
         if !self.has_signing_keys() {
-            debug!("missing signing keys");
+            warn!("missing signing keys");
             return false;
         }
 
         if self.signer_disabled() {
-            debug!("signer functionalities explicitly disabled");
+            warn!("signer functionalities are explicitly disabled");
             return false;
         }
 
         if !self.is_ecash_signer() {
-            debug!("signer doesn't recognise it's a signer for this epoch");
+            warn!("signer doesn't recognise it's a signer for this epoch");
             return false;
         }
 
         if dkg_epoch_id != self.dkg_ecash_epoch_id() {
-            debug!(
+            warn!(
                 "mismatched dkg epoch id. current: {dkg_epoch_id}, signer's: {}",
                 self.dkg_ecash_epoch_id()
             );

common/ecash-signer-check-types/src/status.rs

@@ -11,10 +11,11 @@ use nym_crypto::asymmetric::ed25519;
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
 use time::OffsetDateTime;
+use tracing::warn;
 use utoipa::ToSchema;
 
-pub(crate) const CHAIN_STALL_THRESHOLD: Duration = Duration::from_secs(5 * 60);
-pub(crate) const STALE_RESPONSE_THRESHOLD: Duration = Duration::from_secs(5 * 60);
+pub(crate) const CHAIN_STALL_THRESHOLD: Duration = Duration::from_secs(10 * 60);
+pub(crate) const STALE_RESPONSE_THRESHOLD: Duration = Duration::from_secs(10 * 60);
 
 // the reason for generics is not to remove duplication of code,
 // but because without them, we'd be having problems with circular dependencies,
@@ -188,6 +189,7 @@ where
         };
 
         let SignerStatus::Tested { result } = &self.status else {
+            warn!("no valid chain response");
             return false;
         };
         result
@@ -239,6 +241,7 @@ where
         };
 
         let SignerStatus::Tested { result } = &self.status else {
+            warn!("no valid signer response");
             return false;
         };
         result.signing_status.signing_available(

common/ecash-signer-check/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-ecash-signer-check"
+description = "Functions to interact with zknym signers, checking their status and health"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Functions to interact with zknym signers, checking their status and health"
+publish = true
 
 [dependencies]
 futures = { workspace = true }

common/ecash-time/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-ecash-time"
+description = "Time-related helper functions for Nym's zknym scheme"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Time-related helper functions for Nym's zknym scheme"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/exit-policy/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-exit-policy"
+description = "Get and set the Nym Exit Policy, used by Exit Gateways"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Get and set the Nym Exit Policy, used by Exit Gateways"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/gateway-requests/Cargo.toml

@@ -3,14 +3,17 @@
 
 [package]
 name = "nym-gateway-requests"
+description = "Request and response definitions for Nym Gateway <> client communication"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Request and response definitions for Nym Gateway <> client communication"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/gateway-stats-storage/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-gateway-stats-storage"
+description = "Functionality Nym Gateway statistics storage"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
-description = "Functionality Nym Gateway statistics storage"
+readme.workspace = true
+publish = true
 
 [dependencies]
 sqlx = { workspace = true, features = [

common/gateway-storage/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-gateway-storage"
+description = "Crate handling db setup and use for Nym Gateways, used for credentials, packets, connections"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
-description = "Crate handling db setup and use for Nym Gateways, used for credentials, packets, connections"
+readme.workspace = true
+publish = true
 
 [dependencies]
 async-trait = { workspace = true }

common/http-api-client-macro/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-http-api-client-macro"
+description = "Proc-macros for configuring HTTP clients globally via the `inventory` crate"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Proc-macros for configuring HTTP clients globally via the `inventory` crate"
+publish = true
 
 [lib]
 proc-macro = true

common/http-api-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-http-api-client"
+description = "Nym's HTTP API client, examples, and tests"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Nym's HTTP API client, examples, and tests"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -33,6 +36,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 itertools = { workspace = true }
 inventory = { workspace = true }
+fastrand = { workspace = true }
 tokio = { workspace = true, features = ["rt", "macros", "time"] }
 rustls = { workspace=true }
 # used for decoding text responses (they were already implicitly included)

common/http-api-client/src/dns.rs

@@ -55,9 +55,8 @@ use std::{
 
 use hickory_resolver::{
     TokioResolver,
-    config::{NameServerConfig, NameServerConfigGroup, ResolverConfig, ResolverOpts},
-    lookup_ip::LookupIpIntoIter,
-    name_server::TokioConnectionProvider,
+    config::{CLOUDFLARE, NameServerConfig, QUAD9, ResolverConfig, ResolverOpts},
+    net::{NetError, runtime::TokioRuntimeProvider},
 };
 use once_cell::sync::OnceCell;
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
@@ -113,7 +112,7 @@ pub enum ResolveError {
     #[error("invalid name: {0}")]
     InvalidNameError(String),
     #[error("hickory-dns resolver error: {0}")]
-    ResolveError(#[from] hickory_resolver::ResolveError),
+    ResolveError(#[from] NetError),
     #[error("high level lookup timed out")]
     Timeout,
     #[error("hostname not found in static lookup table")]
@@ -123,7 +122,10 @@ pub enum ResolveError {
 impl ResolveError {
     /// Returns true if the error is a timeout.
     pub fn is_timeout(&self) -> bool {
-        matches!(self, ResolveError::Timeout)
+        matches!(
+            self,
+            ResolveError::Timeout | ResolveError::ResolveError(NetError::Timeout)
+        )
     }
 }
 
@@ -167,18 +169,17 @@ impl Resolve for HickoryDnsResolver {
     fn resolve(&self, name: Name) -> Resolving {
         let use_system = self.use_system.load(std::sync::atomic::Ordering::Relaxed);
         let use_shared = self.use_shared;
-        let resolver = if use_system {
-            match self
-                .system_resolver
+        let result = if use_system {
+            self.system_resolver
                 .get_or_try_init(|| HickoryDnsResolver::new_resolver_system(use_shared))
-            {
-                Ok(r) => r.clone(),
-                Err(e) => return Box::pin(return_err(e)),
-            }
         } else {
             self.state
-                .get_or_init(|| HickoryDnsResolver::new_resolver(use_shared))
-                .clone()
+                .get_or_try_init(|| HickoryDnsResolver::new_resolver(use_shared))
+        };
+
+        let resolver = match result {
+            Ok(r) => r.clone(),
+            Err(err) => return Box::pin(return_err(err)),
         };
 
         let maybe_static = self.static_base.clone();
@@ -227,9 +228,11 @@ async fn resolve(
     let primary_err = match resolve_fut.await {
         Err(_) => ResolveError::Timeout,
         Ok(Ok(lookup)) => {
-            let addrs: Addrs = Box::new(SocketAddrs {
-                iter: lookup.into_iter(),
-            });
+            // Shuffle so that successive connection attempts cycle through all
+            // returned IPs rather than always hitting the same first address.
+            let mut ips = Vec::from_iter(lookup.iter());
+            fastrand::shuffle(&mut ips);
+            let addrs: Addrs = Box::new(ips.into_iter().map(|ip| SocketAddr::new(ip, 0)));
             return Ok(addrs);
         }
         Ok(Err(e)) => {
@@ -256,18 +259,6 @@ async fn resolve(
     Err(primary_err)
 }
 
-struct SocketAddrs {
-    iter: LookupIpIntoIter,
-}
-
-impl Iterator for SocketAddrs {
-    type Item = SocketAddr;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        self.iter.next().map(|ip_addr| SocketAddr::new(ip_addr, 0))
-    }
-}
-
 impl HickoryDnsResolver {
     /// Returns an instance of the shared resolver.
     pub fn shared() -> Self {
@@ -288,7 +279,7 @@ impl HickoryDnsResolver {
                 .clone()
         } else {
             self.state
-                .get_or_init(|| HickoryDnsResolver::new_resolver(self.use_shared))
+                .get_or_try_init(|| HickoryDnsResolver::new_resolver(self.use_shared))?
                 .clone()
         };
 
@@ -311,11 +302,11 @@ impl HickoryDnsResolver {
         }
     }
 
-    fn new_resolver(use_shared: bool) -> TokioResolver {
+    fn new_resolver(use_shared: bool) -> Result<TokioResolver, ResolveError> {
         // using a closure here is slightly gross, but this makes sure that if the
         // lazy-init returns an error it can be handled by the client
         if use_shared {
-            SHARED_RESOLVER.state.get_or_init(new_resolver).clone()
+            SHARED_RESOLVER.state.get_or_try_init(new_resolver).cloned()
         } else {
             new_resolver()
         }
@@ -367,7 +358,7 @@ impl HickoryDnsResolver {
     /// Clear entries from the static table that would return entries during the pre-resolve stage.
     /// This means that all lookups will attempt to use the network resolver again before the static
     /// table is consulted.
-    ///  
+    ///
     /// Entries elevated to pre-resolve from fallback (added from default or using
     /// [`set_fallback`]`) will have their cache timeout cleared. Entries added directly to
     /// pre-resolve (using [`Self::set_static_preresolve`]) will be removed.
@@ -438,20 +429,7 @@ impl HickoryDnsResolver {
 
     /// Get the list of currently available nameserver configs.
     pub fn all_configured_name_servers(&self) -> Vec<NameServerConfig> {
-        default_nameserver_group().to_vec()
-    }
-
-    /// Get the list of currently used nameserver configs.
-    pub fn active_name_servers(&self) -> Vec<NameServerConfig> {
-        if !self.use_shared {
-            return self
-                .state
-                .get()
-                .map(|r| r.config().name_servers().to_vec())
-                .unwrap_or(self.all_configured_name_servers());
-        }
-
-        SHARED_RESOLVER.active_name_servers()
+        default_nameserver_group()
     }
 
     /// Do a trial resolution using each nameserver individually to test which are working and which
@@ -477,65 +455,60 @@ impl HickoryDnsResolver {
 ///
 /// Caches successfully resolved addresses for 30 minutes to prevent continual use of remote lookup.
 /// This resolver is intended to be used for OUR API endpoints that do not rapidly rotate IPs.
-fn new_resolver() -> TokioResolver {
+fn new_resolver() -> Result<TokioResolver, ResolveError> {
     let name_servers = default_nameserver_group_ipv4_only();
 
     configure_and_build_resolver(name_servers)
 }
 
-fn configure_and_build_resolver<G>(name_servers: G) -> TokioResolver
-where
-    G: Into<NameServerConfigGroup>,
-{
+fn configure_and_build_resolver(
+    name_servers: Vec<NameServerConfig>,
+) -> Result<TokioResolver, ResolveError> {
     let options = HickoryDnsResolver::default_options();
-    let name_servers: NameServerConfigGroup = name_servers.into();
     info!("building new configured resolver");
     debug!("configuring resolver with {options:?}, {name_servers:?}");
 
     let config = ResolverConfig::from_parts(None, Vec::new(), name_servers);
     let mut resolver_builder =
-        TokioResolver::builder_with_config(config, TokioConnectionProvider::default());
+        TokioResolver::builder_with_config(config, TokioRuntimeProvider::default());
 
     resolver_builder = resolver_builder.with_options(options);
 
-    resolver_builder.build()
+    Ok(resolver_builder.build()?)
 }
 
-fn filter_ipv4(nameservers: impl AsRef<[NameServerConfig]>) -> Vec<NameServerConfig> {
+fn filter_ipv4(nameservers: impl IntoIterator<Item = NameServerConfig>) -> Vec<NameServerConfig> {
     nameservers
-        .as_ref()
-        .iter()
-        .filter(|ns| ns.socket_addr.is_ipv4())
-        .cloned()
+        .into_iter()
+        .filter(|ns| ns.ip.is_ipv4())
         .collect()
 }
 
 #[allow(unused)]
-fn filter_ipv6(nameservers: impl AsRef<[NameServerConfig]>) -> Vec<NameServerConfig> {
+fn filter_ipv6(nameservers: impl IntoIterator<Item = NameServerConfig>) -> Vec<NameServerConfig> {
     nameservers
-        .as_ref()
-        .iter()
-        .filter(|ns| ns.socket_addr.is_ipv6())
-        .cloned()
+        .into_iter()
+        .filter(|ns| ns.ip.is_ipv6())
         .collect()
 }
 
 #[allow(unused)]
-fn default_nameserver_group() -> NameServerConfigGroup {
-    let mut name_servers = NameServerConfigGroup::quad9_tls();
-    name_servers.merge(NameServerConfigGroup::quad9_https());
-    name_servers.merge(NameServerConfigGroup::cloudflare_tls());
-    name_servers.merge(NameServerConfigGroup::cloudflare_https());
-    name_servers
+fn default_nameserver_group() -> Vec<NameServerConfig> {
+    QUAD9
+        .tls()
+        .chain(QUAD9.https())
+        .chain(CLOUDFLARE.tls())
+        .chain(CLOUDFLARE.https())
+        .collect()
 }
 
-fn default_nameserver_group_ipv4_only() -> NameServerConfigGroup {
-    filter_ipv4(&default_nameserver_group() as &[NameServerConfig]).into()
+fn default_nameserver_group_ipv4_only() -> Vec<NameServerConfig> {
+    filter_ipv4(default_nameserver_group())
 }
 
 #[allow(unused)]
-fn default_nameserver_group_ipv6_only() -> NameServerConfigGroup {
-    filter_ipv6(&default_nameserver_group() as &[NameServerConfig]).into()
+fn default_nameserver_group_ipv6_only() -> Vec<NameServerConfig> {
+    filter_ipv6(default_nameserver_group())
 }
 
 /// Create a new resolver with the default configuration, which reads from the system DNS config
@@ -550,7 +523,7 @@ fn new_resolver_system() -> Result<TokioResolver, ResolveError> {
 
     resolver_builder = resolver_builder.with_options(options);
 
-    Ok(resolver_builder.build())
+    Ok(resolver_builder.build()?)
 }
 
 fn new_default_static_fallback() -> StaticResolver {
@@ -577,7 +550,7 @@ async fn trial_nameservers_inner(
 async fn trial_lookup(name_server: NameServerConfig, query: &str) -> Result<(), ResolveError> {
     debug!("running ns trial {name_server:?} query={query}");
 
-    let resolver = configure_and_build_resolver(vec![name_server]);
+    let resolver = configure_and_build_resolver(vec![name_server])?;
 
     match tokio::time::timeout(DEFAULT_OVERALL_LOOKUP_TIMEOUT, resolver.ipv4_lookup(query)).await {
         Ok(Ok(_)) => Ok(()),
@@ -590,8 +563,10 @@ async fn trial_lookup(name_server: NameServerConfig, query: &str) -> Result<(),
 mod test {
     use super::*;
     use itertools::Itertools;
-    use std::collections::HashMap;
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+    use std::{
+        collections::HashMap,
+        net::{IpAddr, Ipv4Addr, Ipv6Addr},
+    };
 
     /// IP addresses guaranteed to fail attempts to resolve
     ///
@@ -670,26 +645,16 @@ mod test {
         let mut ns_ips = GUARANTEED_BROKEN_IPS_1.to_vec();
         ns_ips.push(good_cf_ip);
 
-        let broken_ns_https = NameServerConfigGroup::from_ips_https(
-            &ns_ips,
-            443,
-            "cloudflare-dns.com".to_string(),
-            true,
-        );
+        let domain = Arc::<str>::from("cloudflare-dns.com");
+        let path = Arc::<str>::from("/dns-query");
+        let broken_ns_https = GUARANTEED_BROKEN_IPS_1
+            .iter()
+            .chain([&good_cf_ip])
+            .map(|ip| NameServerConfig::https(*ip, domain.clone(), Some(path.clone())))
+            .collect::<Vec<_>>();
 
-        let inner = configure_and_build_resolver(broken_ns_https);
-
-        // create a new resolver that won't mess with the shared resolver used by other tests
-        let resolver = HickoryDnsResolver {
-            use_shared: false,
-            state: Arc::new(OnceCell::with_value(inner)),
-            static_base: Some(Default::default()),
-            ..Default::default()
-        };
-
-        let name_servers = resolver.state.get().unwrap().config().name_servers();
-        for (ns, result) in trial_nameservers_inner(name_servers).await {
-            if ns.socket_addr.ip() == good_cf_ip {
+        for (ns, result) in trial_nameservers_inner(&broken_ns_https).await {
+            if ns.ip == good_cf_ip {
                 assert!(result.is_ok())
             } else {
                 assert!(result.is_err())
@@ -705,21 +670,20 @@ mod test {
         fn build_broken_resolver() -> Result<TokioResolver, ResolveError> {
             info!("building new faulty resolver");
 
-            let mut broken_ns_group = NameServerConfigGroup::from_ips_tls(
-                GUARANTEED_BROKEN_IPS_1,
-                853,
-                "cloudflare-dns.com".to_string(),
-                true,
-            );
-            let broken_ns_https = NameServerConfigGroup::from_ips_https(
-                GUARANTEED_BROKEN_IPS_1,
-                443,
-                "cloudflare-dns.com".to_string(),
-                true,
-            );
-            broken_ns_group.merge(broken_ns_https);
+            let domain = Arc::<str>::from("cloudflare-dns.com");
+            let path = Arc::<str>::from("/dns-query");
+            let broken_ns_group = GUARANTEED_BROKEN_IPS_1
+                .iter()
+                .map(|ip| NameServerConfig::tls(*ip, domain.clone()))
+                .chain(
+                    GUARANTEED_BROKEN_IPS_1
+                        .iter()
+                        .map(|ip| NameServerConfig::https(*ip, domain.clone(), Some(path.clone())))
+                        .collect::<Vec<_>>(),
+                )
+                .collect::<Vec<_>>();
 
-            Ok(configure_and_build_resolver(broken_ns_group))
+            configure_and_build_resolver(broken_ns_group)
         }
 
         #[tokio::test]
@@ -740,7 +704,7 @@ mod test {
             build_broken_resolver()?;
             let domain = "ifconfig.me";
             let result = resolver.resolve_str(domain).await;
-            assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+            assert!(result.is_err_and(|e| e.is_timeout()));
 
             let duration = time_start.elapsed();
             assert!(duration < resolver.overall_dns_timeout + Duration::from_secs(1));
@@ -774,25 +738,11 @@ mod test {
             // unsuccessful lookup - primary times out, and not in static table
             let domain = "non-existent.nymtech.net";
             let result = resolver.resolve_str(domain).await;
-            assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+            assert!(result.is_err_and(|e| e.is_timeout()));
 
             Ok(())
         }
 
-        #[test]
-        fn default_resolver_uses_ipv4_only_nameservers() {
-            let resolver = HickoryDnsResolver::thread_resolver();
-            resolver
-                .active_name_servers()
-                .iter()
-                .all(|cfg| cfg.socket_addr.is_ipv4());
-
-            SHARED_RESOLVER
-                .active_name_servers()
-                .iter()
-                .all(|cfg| cfg.socket_addr.is_ipv4());
-        }
-
         #[tokio::test]
         #[cfg(any())] // #[ignore] we run --ignore in CI/CD assuming it just means slow -_-
         // This test impacts the state of the shared resolver and as such is disabled to avoid

common/http-api-client/src/lib.rs

@@ -141,9 +141,7 @@
 
 use http::header::USER_AGENT;
 pub use inventory;
-pub use reqwest;
-pub use reqwest::ClientBuilder as ReqwestClientBuilder;
-pub use reqwest::StatusCode;
+pub use reqwest::{self, ClientBuilder as ReqwestClientBuilder, StatusCode};
 use std::error::Error;
 
 pub mod registry;
@@ -152,19 +150,21 @@ use crate::path::RequestPath;
 use async_trait::async_trait;
 use bytes::Bytes;
 use cfg_if::cfg_if;
-use http::HeaderMap;
-use http::header::{ACCEPT, CONTENT_TYPE};
+use http::{
+    HeaderMap,
+    header::{ACCEPT, CONTENT_TYPE},
+};
 use itertools::Itertools;
 use mime::Mime;
-use reqwest::header::HeaderValue;
-use reqwest::{RequestBuilder, Response};
-use serde::de::DeserializeOwned;
-use serde::{Deserialize, Serialize};
-use std::fmt::Display;
+use reqwest::{RequestBuilder, Response, header::HeaderValue};
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
 #[cfg(not(target_arch = "wasm32"))]
 use std::io::ErrorKind;
-use std::sync::atomic::{AtomicUsize, Ordering};
-use std::time::Duration;
+use std::{
+    fmt::Display,
+    sync::atomic::{AtomicUsize, Ordering},
+    time::Duration,
+};
 use thiserror::Error;
 use tracing::{debug, instrument, warn};
 
@@ -1152,7 +1152,10 @@ impl ApiClientCore for Client {
 
             #[cfg(target_arch = "wasm32")]
             let response: Result<Response, HttpClientError> = {
-                let client = self.reqwest_client.as_ref().unwrap_or(&*SHARED_CLIENT);
+                let client = self
+                    .reqwest_client
+                    .as_ref()
+                    .unwrap_or_else(|| &*SHARED_CLIENT);
                 Ok(
                     wasmtimer::tokio::timeout(self.request_timeout, client.execute(req))
                         .await
@@ -1162,7 +1165,10 @@ impl ApiClientCore for Client {
 
             #[cfg(not(target_arch = "wasm32"))]
             let response = {
-                let client = self.reqwest_client.as_ref().unwrap_or(&*SHARED_CLIENT);
+                let client = self
+                    .reqwest_client
+                    .as_ref()
+                    .unwrap_or_else(|| &*SHARED_CLIENT);
                 client.execute(req).await
             };
 
@@ -1268,7 +1274,7 @@ pub(crate) fn might_be_network_interference(err: &reqwest::Error) -> bool {
             } else if let Some(_tls_err) = e.downcast_ref::<rustls::Error>() {
                 // try downcast to TLS error
                 return true;
-            } else if let Some(resolve_err) = e.downcast_ref::<hickory_resolver::ResolveError>() {
+            } else if let Some(resolve_err) = e.downcast_ref::<hickory_resolver::net::NetError>() {
                 // try downcast to DNS error
                 return resolve_err.is_nx_domain();
             } else {

common/http-api-client/src/path.rs

@@ -10,7 +10,9 @@ fn sanitize_fragment(segment: &str) -> &str {
     segment.trim_matches(|c: char| c.is_whitespace() || c == '/')
 }
 
+/// Defines a path that can be used to make a request to an API.
 pub trait RequestPath: Debug {
+    /// Sanitise the request path by removing empty segments and trimming whitespace and slashes
     fn to_sanitized_segments(&self) -> Vec<&str>;
 }
 

common/http-api-common/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-http-api-common"
+description = "Common crate for Nym-related HTTP API interaction"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Common crate for Nym-related HTTP API interaction"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html