Merge pull request #6741 from nymtech/fix/issue-windows

Fix windows open log viewer

.github/workflows/cd-docs.yml

@@ -15,10 +15,8 @@ jobs:
       - uses: actions/checkout@v6
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
-      - name: Install pip3
-        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
-        run: sudo pip3 install pandas tabulate
+        run: sudo apt install -y python3-pandas python3-tabulate
       - name: Install rsync
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -41,6 +39,8 @@ jobs:
 
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
       - name: Generate sitemap

.github/workflows/ci-build-upload-binaries.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [arc-linux-latest]
+        platform: [arc-ubuntu-22.04]
 
     runs-on: ${{ matrix.platform }}
     env:

.github/workflows/ci-build.yml

@@ -90,7 +90,7 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api -- -D warnings
+          args: --workspace --all-targets --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client -- -D warnings
 
       - name: Clippy (non-macos)
         if: contains(matrix.os, 'linux') || contains(matrix.os, 'windows')
@@ -104,14 +104,15 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
+          args: --workspace --exclude nym-gateway-probe --exclude nym-node-status-api --exclude nym-node-status-agent --exclude nym-node-status-client
 
-        # only build on linux because of wg FFI bindings of its dependency (network probe)
-      - name: Build nym-node-status-api (linux only)
+        # Build Go FFI-dependent crates separately (requires Go, only available on Linux CI)
+      - name: Build nym-node-status-api and nym-node-status-agent (linux only)
         if: runner.os == 'Linux'
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: -p nym-node-status-api
+          args: -p nym-node-status-api -p nym-node-status-agent
 
       - name: Build all examples
         if: contains(matrix.os, 'linux')

.github/workflows/ci-contracts.yml

@@ -35,7 +35,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Install cosmwasm-check
-        run: cargo install cosmwasm-check
+        run: cargo install cosmwasm-check --locked
 
       - name: Install wasm-opt
         uses: ./.github/actions/install-wasm-opt

.github/workflows/ci-crates-publish-dry-run.yml

@@ -15,6 +15,9 @@ env:
 jobs:
   publish-dry-run:
     runs-on: arc-linux-latest
+    timeout-minutes: 35
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -59,20 +62,60 @@ jobs:
       - name: Bump versions (local only)
         run: |
           cargo workspaces version custom ${{ inputs.version }} \
-            --allow-branch ${{ github.ref_name }} \
             --no-git-commit \
+            --yes
+
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
 
       # Dry run may show cascading dependency errors because packages aren't
       # actually uploaded - these are expected and ignored. We check for real
       # errors like packaging failures, missing metadata, or invalid Cargo.toml.
       - name: Publish (dry run)
         run: |
-          output=$(cargo workspaces publish --dry-run --allow-dirty 2>&1) || true
-          echo "$output"
+          set +e
+          publish_status=1
+          max_attempts=2
+          attempt=1
+          rm -f /tmp/publish-dry-run.log
 
-          # Check for real errors (not cascading dependency errors)
-          # Cascading errors mention "crates.io index", real errors mention "Cargo.toml"
-          echo "$output" | grep -i "Cargo.toml" && exit 1 || true
+          while [ "$attempt" -le "$max_attempts" ]; do
+            echo "Dry-run publish attempt ${attempt}/${max_attempts}"
+            cargo workspaces publish --dry-run --allow-dirty 2>&1 | tee /tmp/publish-dry-run.log
+            publish_status=${PIPESTATUS[0]}
+
+            if [ "$publish_status" -eq 0 ]; then
+              break
+            fi
+
+            # Retry once for interruption/runner issues.
+            if [ "$attempt" -lt "$max_attempts" ] && \
+              { [ "$publish_status" -eq 130 ] || [ "$publish_status" -eq 137 ]; }; then
+              echo "Publish dry-run interrupted (exit ${publish_status}), retrying in 10s..."
+              sleep 10
+              attempt=$((attempt + 1))
+              continue
+            fi
+
+            break
+          done
+          set -e
+
+          if grep -Eiq \
+            "failed to verify manifest|failed to parse manifest|invalid Cargo.toml|error: package .* has no (description|license|repository)" \
+            /tmp/publish-dry-run.log; then
+            echo "Detected real packaging/manifest errors"
+            exit 1
+          fi
+
+          # In dry-run mode, non-zero publish status is expected due to
+          # dependency-cascade failures against crates.io index.
+          if [ "$publish_status" -ne 0 ]; then
+            echo "Dry-run publish returned non-zero (${publish_status}) but no real manifest blockers were detected."
+          fi
+
+          echo "Only expected dry-run dependency cascade errors detected (if any)."
 
       # Show the list of packages published
       - name: Show package versions

.github/workflows/ci-crates-publish-resume.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6

.github/workflows/ci-crates-publish.yml

@@ -17,6 +17,8 @@ on:
 jobs:
   publish:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6

.github/workflows/ci-crates-version-bump.yml

@@ -15,6 +15,8 @@ env:
 jobs:
   version-bump:
     runs-on: arc-linux-latest
+    env:
+      RUSTUP_PERMIT_COPY_RENAME: 1
     permissions:
       contents: write
     steps:

.github/workflows/ci-docs.yml

@@ -6,6 +6,8 @@ on:
     branches-ignore: [master]
     paths:
       - "documentation/docs/**"
+      - "sdk/typescript/packages/sdk/src/**"
+      - "sdk/typescript/packages/mix-fetch/src/**"
       - ".github/workflows/ci-docs.yml"
 
 jobs:
@@ -20,10 +22,8 @@ jobs:
       - uses: actions/checkout@v6
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
-      - name: Install pip3
-        run: sudo apt install -y python3-pip
       - name: Install Python3 modules
-        run: sudo pip3 install pandas tabulate
+        run: sudo apt install -y python3-pandas python3-tabulate
       - name: Install rsync
         run: sudo apt-get install -y rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -44,8 +44,27 @@ jobs:
           command: build
           args: --workspace --release
 
+      - name: Check if TypeScript SDK source changed
+        id: check-ts-sdk
+        run: |
+          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -qE '^sdk/typescript/packages/(sdk|mix-fetch)/src/'; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+        working-directory: ${{ github.workspace }}
+
+      - name: Regenerate TypeDoc API reference
+        if: steps.check-ts-sdk.outputs.changed == 'true'
+        run: |
+          npm install -g typedoc@0.25.13 typedoc-plugin-markdown@4.0.3
+          cd ${{ github.workspace }}/sdk/typescript/packages/sdk && typedoc --skipErrorChecking
+          cd ${{ github.workspace }}/sdk/typescript/packages/mix-fetch && typedoc --skipErrorChecking
+
       - name: Install project dependencies
         run: pnpm i
+      - name: Generate llms-full.txt
+        run: pnpm run generate:llms
       - name: Build project
         run: pnpm run build
       - name: Generate sitemap

.github/workflows/ci-nym-wallet-frontend.yml

@@ -0,0 +1,41 @@
+name: ci-nym-wallet-frontend
+
+on:
+  pull_request:
+    paths:
+      - 'nym-wallet/**'
+      - '.github/workflows/ci-nym-wallet-frontend.yml'
+
+jobs:
+  types-lint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: nym-wallet/.nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --network-timeout 100000
+
+      - name: Build TypeScript packages (wallet depends on @nymproject/types, etc.)
+        run: yarn build:types
+
+      - name: Build @nymproject/mui-theme and @nymproject/react (wallet imports subpaths)
+        run: yarn build:packages
+
+      - name: Typecheck nym-wallet
+        run: yarn --cwd nym-wallet tsc
+
+      - name: Lint nym-wallet
+        run: yarn --cwd nym-wallet lint
+
+      - name: Yarn audit (workspace lockfile; informational)
+        run: yarn audit --level critical
+        continue-on-error: true
+
+      - name: Unit tests (nym-wallet)
+        run: yarn --cwd nym-wallet test

.github/workflows/ci-nym-wallet-rust.yml

@@ -41,6 +41,9 @@ jobs:
           sed -i.bak '1s/^/\[profile.dev\]\ndebug = false\n\n/' Cargo.toml
           git diff
 
+      - name: Ensure nym-wallet/dist exists for Tauri
+        run: mkdir -p nym-wallet/dist
+
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
@@ -71,3 +74,16 @@ jobs:
         with:
           command: clippy
           args: --manifest-path nym-wallet/Cargo.toml --workspace --all-features --all-targets -- -D warnings
+
+      - name: Install cargo-audit
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-audit --locked
+
+      - name: Cargo audit (nym-wallet workspace)
+        uses: actions-rs/cargo@v1
+        with:
+          command: audit
+        working-directory: nym-wallet
+        continue-on-error: true

.github/workflows/ci-nym-wallet-storybook.yml

@@ -1,53 +0,0 @@
-name: ci-nym-wallet-storybook
-
-on:
-  pull_request:
-    paths:
-      - 'nym-wallet/**'
-      - '.github/workflows/ci-nym-wallet-storybook.yml'
-
-jobs:
-  build:
-    runs-on: arc-linux-latest-dind
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install rsync
-        run: sudo apt-get install rsync
-        continue-on-error: true
-
-      - uses: rlespinasse/github-slug-action@v3.x
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-
-      - name: Setup yarn
-        run: npm install -g yarn
-
-      - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-
-      - name: Install wasm-pack
-        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
-
-      - name: Build dependencies
-        run: yarn && yarn build
-
-      - name: Build storybook
-        run: yarn storybook:build
-        working-directory: ./nym-wallet
-
-      - name: Deploy branch to CI www (storybook)
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "nym-wallet/storybook-static/"
-          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
-          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/wallet-${{ env.GITHUB_REF_SLUG }}
-          EXCLUDE: "/dist/, /node_modules/"

.github/workflows/nightly-nym-wallet-build.yml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools libsoup-3.0-dev libjavascriptcoregtk-4.1-dev
         if: matrix.os == 'ubuntu-22.04'
 
       - name: Install rust toolchain

.github/workflows/publish-nym-binaries.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: arc-linux-latest
+          - os: arc-ubuntu-22.04
             target: x86_64-unknown-linux-gnu
     runs-on:  ${{ matrix.os }}
 

.github/workflows/publish-nym-wallet-macos.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
           
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable

.github/workflows/publish-nym-wallet-ubuntu.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
           cache: 'yarn'
       
       - name: Install Rust toolchain
@@ -72,6 +72,41 @@ jobs:
             find target/release/bundle -type d -name "*appimage*" -o -name "*AppImage*" || echo "No AppImage directories found"
             find target/release/bundle -name "*.AppImage" -o -name "*.appimage" || echo "No AppImage files found"
           fi
+
+      - name: Inspect AppImage (hook + bundled graphics libs)
+        shell: bash
+        run: |
+          set -euo pipefail
+          APPIMAGE_REL=$(find target/release/bundle -name '*.AppImage' | head -n 1)
+          if [ -z "${APPIMAGE_REL}" ]; then
+            echo "No AppImage under target/release/bundle"
+            exit 1
+          fi
+          APPIMAGE_ABS="${GITHUB_WORKSPACE}/nym-wallet/${APPIMAGE_REL}"
+          chmod +x "${APPIMAGE_ABS}"
+          EXTRACT_DIR=$(mktemp -d)
+          cd "${EXTRACT_DIR}"
+          "${APPIMAGE_ABS}" --appimage-extract
+          # Tauri only stages appimage "files" under /usr/ into the AppDir; paths like /apprun-hooks/ never reach the image.
+          # Wayland + WEBKIT_DISABLE_DMABUF_RENDERER defaults are applied in main() instead (see configure_linux_wayland_defaults).
+          HOOK=$(find squashfs-root -name '99-nym-wayland.sh' 2>/dev/null | head -n 1)
+          if [ -n "${HOOK}" ]; then
+            echo "Found legacy apprun hook at ${HOOK}"
+          else
+            echo "No apprun-hooks/99-nym-wayland.sh (expected): Wayland defaults are set in-process."
+          fi
+          find squashfs-root/usr/lib -maxdepth 6 \
+            \( -name 'libwayland-client.so*' -o -name 'libEGL.so*' -o -name 'libgbm.so*' \) \
+            2>/dev/null | sort > "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          wc -l "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt"
+          head -50 "${GITHUB_WORKSPACE}/nym-wallet/appimage-bundled-graphics-libs.txt" || true
+
+      - name: Upload AppImage graphics lib inventory
+        uses: actions/upload-artifact@v6
+        with:
+          name: nym-wallet-appimage-lib-inventory
+          path: nym-wallet/appimage-bundled-graphics-libs.txt
+          retention-days: 30
       
       - name: Create AppImage tarball if needed
         run: |

.github/workflows/publish-nym-wallet-win11.yml

@@ -26,6 +26,9 @@ jobs:
     outputs:
       release_tag: ${{ github.ref_name }}
 
+    env:
+      SIGN_WINDOWS: ${{ github.event_name == 'release' || inputs.sign }}
+
     steps:
       - uses: actions/checkout@v6
 
@@ -37,48 +40,82 @@ jobs:
       - name: Setup MSBuild.exe
         uses: microsoft/setup-msbuild@v2
 
+      # No cache:yarn here: setup-node needs yarn on PATH to populate the cache, but this runner
+      # only gets yarn from the step below.
       - name: Node
         uses: actions/setup-node@v4
         with:
-          node-version: 21
+          node-version: 22.13.0
+
+      - name: Install Yarn (classic)
+        shell: bash
+        run: npm install -g yarn@1.22.22
+
+      - name: Strip Authenticode thumbprint (avoid signtool on runner)
+        working-directory: nym-wallet/src-tauri
+        if: ${{ env.SIGN_WINDOWS == 'true' || (github.event_name == 'workflow_dispatch' && !inputs.sign) }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if ! command -v yq >/dev/null 2>&1; then
+            echo "yq is required on this runner to edit tauri.conf.json"
+            exit 1
+          fi
+          yq eval --inplace '
+            del(.bundle.windows.certificateThumbprint) |
+            del(.bundle.windows.digestAlgorithm) |
+            del(.bundle.windows.timestampUrl)
+          ' tauri.conf.json
 
       - name: Download EV CodeSignTool from ssl.com
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
         run: |
           curl -L0 https://www.ssl.com/download/codesigntool-for-linux-and-macos/ -o codesigntool.zip
           unzip codesigntool.zip
       - name: Get EV certificate credential id
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         id: get_credential_ids
         shell: bash
         run: |
           echo "SSL_COM_CREDENTIAL_ID=$(./CodeSignTool.sh get_credential_ids -username=${{ secrets.SSL_COM_USERNAME }} -password=${{ secrets.SSL_COM_PASSWORD }} | sed -n '1!p' | sed 's/- //')" >> "$GITHUB_OUTPUT"
       - name: Add custom sign command to tauri.conf.json
         working-directory: nym-wallet/src-tauri
-        if: ${{ inputs.sign }}
+        if: env.SIGN_WINDOWS == 'true'
         shell: bash
+        env:
+          SSL_SIGN_USER: ${{ secrets.SSL_COM_USERNAME }}
+          SSL_SIGN_PASS: ${{ secrets.SSL_COM_PASSWORD }}
+          SSL_SIGN_CRED: ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_SIGN_TOTP: ${{ secrets.SSL_COM_TOTP_SECRET }}
         run: |
-          yq eval --inplace '.bundle.windows +=
-          {
-            "signCommand": {
-              "cmd": "C:\Program Files\Git\bin\bash.EXE",
-              "args": [
-                "/c/actions-runner/_work/nym/nym/nym-wallet/src-tauri/CodeSignTool.sh",
-                "sign",
-                "-username ${{ secrets.SSL_COM_USERNAME }}",
-                "-password ${{ secrets.SSL_COM_PASSWORD }}",
-                "-credential_id ${{ steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}",
-                "-totp_secret ${{ secrets.SSL_COM_TOTP_SECRET }}",
-                "-program_name NymWallet",
-                "-input_file_path",
-                "%1",
-                "-override"
-              ]
+          set -euo pipefail
+          if ! command -v cygpath >/dev/null 2>&1; then
+            echo "cygpath not found; install Git for Windows or use bash from Git SDK"
+            exit 1
+          fi
+          export SCRIPT_UNIX="$(cygpath -u "$GITHUB_WORKSPACE/nym-wallet/src-tauri/CodeSignTool.sh")"
+          yq eval --inplace '
+            .bundle.windows += {
+              "signCommand": {
+                "cmd": "C:/Program Files/Git/bin/bash.exe",
+                "args": [
+                  strenv(SCRIPT_UNIX),
+                  "sign",
+                  ("-username " + strenv(SSL_SIGN_USER)),
+                  ("-password " + strenv(SSL_SIGN_PASS)),
+                  ("-credential_id " + strenv(SSL_SIGN_CRED)),
+                  ("-totp_secret " + strenv(SSL_SIGN_TOTP)),
+                  "-program_name NymWallet",
+                  "-input_file_path",
+                  "%1",
+                  "-override"
+                ]
+              }
             }
-          }' tauri.conf.json
+          ' tauri.conf.json
       - name: Install project dependencies
         shell: bash
         run: cd .. && yarn --network-timeout 100000
@@ -93,10 +130,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          SSL_COM_USERNAME: ${{ inputs.sign && secrets.SSL_COM_USERNAME }}
-          SSL_COM_PASSWORD: ${{ inputs.sign && secrets.SSL_COM_PASSWORD }}
-          SSL_COM_CREDENTIAL_ID: ${{ inputs.sign && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
-          SSL_COM_TOTP_SECRET: ${{ inputs.sign && secrets.SSL_COM_TOTP_SECRET }}
+          SSL_COM_USERNAME: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_USERNAME }}
+          SSL_COM_PASSWORD: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_PASSWORD }}
+          SSL_COM_CREDENTIAL_ID: ${{ env.SIGN_WINDOWS == 'true' && steps.get_credential_ids.outputs.SSL_COM_CREDENTIAL_ID }}
+          SSL_COM_TOTP_SECRET: ${{ env.SIGN_WINDOWS == 'true' && secrets.SSL_COM_TOTP_SECRET }}
         run: |
           echo "Starting build process..."
           yarn build
@@ -167,4 +204,4 @@ jobs:
     needs: publish-tauri
     with:
       release_tag: ${{ needs.publish-tauri.outputs.release_tag || github.ref_name }}
-    secrets: inherit
+    secrets: inherit

.github/workflows/push-network-monitor-agent.yaml

@@ -0,0 +1,61 @@
+name: Build and upload Network Monitor Agent container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-agent"
+  CONTAINER_NAME: "network-monitor-agent"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+ 
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: New env vars
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
+          

.github/workflows/push-network-monitor-orchestrator.yaml

@@ -0,0 +1,57 @@
+name: Build and upload Network Monitor Orchestrator container to harbor.nymte.ch
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_image:
+        description: 'Tag image as a release (prefix with golden-)'
+        required: true
+        default: false
+        type: boolean
+
+env:
+  WORKING_DIRECTORY: "nym-network-monitor-v3/nym-network-monitor-orchestrator"
+  CONTAINER_NAME: "network-monitor-orchestrator"
+
+jobs:
+  build-container:
+    runs-on: arc-linux-latest-dind
+    steps:
+      - name: Login to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: harbor.nymte.ch
+          username: ${{ secrets.HARBOR_ROBOT_USERNAME }}
+          password: ${{ secrets.HARBOR_ROBOT_SECRET }}
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Configure git identity
+        run: |
+          git config --global user.email "lawrence@nymtech.net"
+          git config --global user.name "Lawrence Stalder"
+
+      - name: Get version from Cargo.toml
+        id: get_version
+        run: |
+          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
+          echo "result=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Initialize RELEASE_TAG
+        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
+
+      - name: Set RELEASE_TAG for release
+        if: github.event.inputs.release_image == 'true'
+        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
+
+      - name: Set IMAGE_NAME_AND_TAGS variable
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+
+      - name: Log image name
+        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"
+
+      - name: Build and push image to Harbor
+        run: |
+          docker build  -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags

.github/workflows/resume-publish-crates-io.yml

@@ -25,6 +25,10 @@ jobs:
       - name: Install cargo-workspaces
         run: cargo install cargo-workspaces
 
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
+
       - name: Publish remaining crates
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.gitignore

@@ -27,6 +27,7 @@ v6-topology.json
 /explorer/public/downloads/mixmining.json
 /explorer/public/downloads/topology.json
 /nym-wallet/dist/*
+/nym-wallet/appimage-bundled-graphics-libs.txt
 /clients/validator/examples/nym-driver-example/current-contract.txt
 validator-api/v4.json
 validator-api/v6.json
@@ -46,7 +47,6 @@ storybook-static
 **/.DS_Store
 cpu-cycles/libcpucycles/build
 foxyfox.env
-scratch.txt
 
 .next
 ppa-private-key.b64

CHANGELOG.md

@@ -4,6 +4,104 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2026.9-venaco] (2026-05-06)
+
+- Fix for v9 IPR  ([#6710])
+- Only init SHARED_CLIENT if requested ([#6708])
+- Fixes to crates and CI ([#6686])
+- Return ipv6 addresses as well ([#6684])
+- Fix invalid ticket spend ([#6683])
+- Block non-public IPR/NR checks ([#6670])
+
+[#6710]: https://github.com/nymtech/nym/pull/6710
+[#6708]: https://github.com/nymtech/nym/pull/6708
+[#6686]: https://github.com/nymtech/nym/pull/6686
+[#6684]: https://github.com/nymtech/nym/pull/6684
+[#6683]: https://github.com/nymtech/nym/pull/6683
+[#6670]: https://github.com/nymtech/nym/pull/6670
+
+## [2026.8-urda] (2026-04-20)
+
+- Include all gateways in the returned list ([#6649])
+- Optimize GW probe in NS agent ([#6636])
+- Max/sdk docrs ([#6566])
+- Max/sdk stream wrapper ([#6320])
+
+[#6649]: https://github.com/nymtech/nym/pull/6649
+[#6636]: https://github.com/nymtech/nym/pull/6636
+[#6566]: https://github.com/nymtech/nym/pull/6566
+[#6320]: https://github.com/nymtech/nym/pull/6320
+
+## [2026.7-tola] (2026-04-07)
+
+- Simon/ecash contract serde fix ([#6634])
+- Update Fallback IP for Nym API ([#6622])
+- Nym Node spam logging ([#6621])
+- feat: multiple deposit prices ([#6608])
+- move format_debug_bytes in common crate ([#6580])
+- bugfix: make sure client keys are generated before requesting credentials ([#6579])
+- Fix socks5 GW probe regression ([#6576])
+- Max/lp stream framing ([#6573])
+- HTTP domain rotation conditions ([#6570])
+
+[#6634]: https://github.com/nymtech/nym/pull/6634
+[#6622]: https://github.com/nymtech/nym/pull/6622
+[#6621]: https://github.com/nymtech/nym/pull/6621
+[#6608]: https://github.com/nymtech/nym/pull/6608
+[#6580]: https://github.com/nymtech/nym/pull/6580
+[#6579]: https://github.com/nymtech/nym/pull/6579
+[#6576]: https://github.com/nymtech/nym/pull/6576
+[#6573]: https://github.com/nymtech/nym/pull/6573
+[#6570]: https://github.com/nymtech/nym/pull/6570
+
+## [2026.6-stilton] (2026-03-25)
+
+- lp fixes ([#6601])
+- bugfix: allow deserialisation of LP data from either snake_case or lowercase ([#6586])
+- bugfix: make sure to run cargo install cosmwasm-check with --locked flag during CI ([#6568])
+- Add LP to NS UI ([#6562])
+- feat: nyxd watcher ([#6561])
+- Additional ticket for agent ([#6551])
+- bugfix: make sure to use old values from metrics debug config during v12 migration (#6546) ([#6547])
+- typo ([#6543])
+- rng changes for a Send variant ([#6541])
+- Add LP fields ([#6535])
+- enable LP registration in registration client ([#6534])
+- chore: rename LpMessage to LpFrame ([#6530])
+- chore: LP improvements ([#6526])
+- Remove dep leak of strum iterator ([#6522])
+- chore: update ts-rs dep ([#6517])
+- addressing LP PR comments ([#6513])
+- remove redundant LP state machine in favour of in place processing ([#6512])
+- chore: split up lp listener ([#6507])
+- feat: enable mutual KKT exchange ([#6505])
+- feat: introduce /v3/unstable/nym-nodes/semi-skimmed to aggregate LP information ([#6499])
+- Max/asyncread asyncwrite nym client ([#6318])
+- feat: localnet v2 ([#6277])
+
+[#6601]: https://github.com/nymtech/nym/pull/6601
+[#6586]: https://github.com/nymtech/nym/pull/6586
+[#6568]: https://github.com/nymtech/nym/pull/6568
+[#6562]: https://github.com/nymtech/nym/pull/6562
+[#6561]: https://github.com/nymtech/nym/pull/6561
+[#6551]: https://github.com/nymtech/nym/pull/6551
+[#6547]: https://github.com/nymtech/nym/pull/6547
+[#6543]: https://github.com/nymtech/nym/pull/6543
+[#6541]: https://github.com/nymtech/nym/pull/6541
+[#6535]: https://github.com/nymtech/nym/pull/6535
+[#6534]: https://github.com/nymtech/nym/pull/6534
+[#6530]: https://github.com/nymtech/nym/pull/6530
+[#6526]: https://github.com/nymtech/nym/pull/6526
+[#6522]: https://github.com/nymtech/nym/pull/6522
+[#6517]: https://github.com/nymtech/nym/pull/6517
+[#6513]: https://github.com/nymtech/nym/pull/6513
+[#6512]: https://github.com/nymtech/nym/pull/6512
+[#6507]: https://github.com/nymtech/nym/pull/6507
+[#6505]: https://github.com/nymtech/nym/pull/6505
+[#6499]: https://github.com/nymtech/nym/pull/6499
+[#6318]: https://github.com/nymtech/nym/pull/6318
+[#6277]: https://github.com/nymtech/nym/pull/6277
+
 ## [2026.5-raclette] (2026-03-10)
 
 - bugfix: correctly populate gateway probe LP data ([#6533])

Cargo.toml

@@ -147,6 +147,7 @@ members = [
     "sdk/ffi/go",
     "sdk/ffi/shared",
     "sdk/rust/nym-sdk",
+    "smolmix/core",
     "service-providers/common",
     "service-providers/ip-packet-router",
     "service-providers/network-requester",
@@ -184,7 +185,6 @@ default-members = [
     "nym-api",
     "nym-credential-proxy/nym-credential-proxy",
     "nym-node",
-    "nym-node-status-api/nym-node-status-agent",
     "nym-statistics-api",
     "nym-validator-rewarder",
     "nyx-chain-watcher",
@@ -280,6 +280,7 @@ getrandom03 = { package = "getrandom", version = "=0.3.3" }
 glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
+hickory-proto = "0.25.2"
 hickory-resolver = "0.25.2"
 hkdf = "0.12.3"
 hmac = "0.12.1"
@@ -334,6 +335,7 @@ rayon = "1.5.1"
 regex = "1.10.6"
 reqwest = { version = "0.13.1", default-features = false }
 rs_merkle = "1.5.0"
+rustls = { version = "0.23.37", default-features = false }
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
@@ -347,6 +349,8 @@ serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
 sha2 = "0.10.3"
 si-scale = "0.2.3"
+smolmix = { version = "0.0.1", path = "smolmix/core" }
+smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.8.6"
@@ -367,6 +371,8 @@ tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
+tokio-rustls = "0.26"
+tokio-smoltcp = "0.5"
 tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
@@ -398,14 +404,14 @@ prometheus = { version = "0.14.0" }
 
 
 # libcrux
-libcrux-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-ecdh = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-curve25519 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-chacha20poly1305 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-psq = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-ml-kem = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-sha3 = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
-libcrux-traits = { git = "https://github.com/cryspen/libcrux", rev = "b17f8687b67cdcfc10b55aeecc998bbbca28f775" }
+libcrux-kem = "0.0.7"
+libcrux-ecdh = "0.0.6"
+libcrux-curve25519 = "0.0.6"
+libcrux-chacha20poly1305 = "0.0.7"
+libcrux-psq = "0.0.8"
+libcrux-ml-kem = "0.0.8"
+libcrux-sha3 = "0.0.8"
+libcrux-traits = "0.0.8"
 
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
 nym-api-requests = { version = "1.20.4", path = "nym-api/nym-api-requests" }
@@ -559,6 +565,7 @@ wasm-bindgen = "0.2.99"
 wasm-bindgen-futures = "0.4.49"
 wasm-bindgen-test = "0.3.49"
 wasmtimer = "0.4.1"
+webpki-roots = "0.26"
 web-sys = "0.3.76"
 
 # for local development:

ansible/nym-node/playbooks/group_vars/all.yml

@@ -60,7 +60,8 @@ packages:
 ## SYSTEM MAINTENANCE PLAYBOOK KNOBS
 ###############################################################################
 
-# nym_version: "v2025.21-mozzarella"
+# To use particular version instead of Latest, provide in such form: 
+# nym_version: "nym-binaries-v2026.7-tola"
 
 ## NOTE:
 ## if you want to pin Nym to a specific version instead of using the
@@ -117,4 +118,4 @@ packages:
 
 # enable_writeback_tuning: true
 # writeback_dirty_writeback_centisecs: 1500
-# writeback_dirty_expire_centisecs: 6000
+# writeback_dirty_expire_centisecs: 6000

ansible/nym-node/roles/tunnel/tasks/main.yml

@@ -1,11 +1,30 @@
 ---
-- name: Configure tunnel manager
+- name: Ensure nym binaries directory exists
+  file:
+    path: /root/nym-binaries
+    state: directory
+    mode: "0755"
   tags:
+    - tunnel
     - network_tunnel_manager
-  become: true
-  command:
-    cmd: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
+    - ntm
+
+- name: Download network tunnel manager
+  get_url:
+    url: "{{ tunnel_manager_url }}"
+    dest: /root/nym-binaries/network-tunnel-manager.sh
+    mode: "0755"
+    force: yes
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm
+    
+- name: Run network tunnel manager
+  command: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
   loop:
     - complete_networking_configuration
-  register: tunnel_mgr
-  failed_when: false
+  tags:
+    - tunnel
+    - network_tunnel_manager
+    - ntm

clients/native/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-client"
-version = "1.1.72"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
+version = "1.1.76"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

clients/native/websocket-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-websocket-requests"
+description = "Request and response definitions for Nym client websocket connections"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Request and response definitions for Nym client websocket connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

clients/socks5/Cargo.toml

@@ -1,11 +1,11 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.72"
-authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
+version = "1.1.76"
+authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
+rust-version = "1.85"
 publish = false
 
 [dependencies]

common/async-file-watcher/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-async-file-watcher"
+description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 version.workspace = true
+authors.workspace = true
 edition.workspace = true
 license.workspace = true
-description = "Simple file watcher that sends a notification whenever there was any change in the watched file"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/authenticator-requests/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-authenticator-requests"
+description = "Crate defining requests and responses for the Nym authenticator client"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Crate defining requests and responses for the Nym authenticator client"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 base64 = { workspace = true }

common/bandwidth-controller/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-bandwidth-controller"
+description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Crate for controlling the use of zknym credentials to ensure constant bandwidth availability for NymVPN app"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/bandwidth-controller/src/acquire/mod.rs

@@ -34,7 +34,7 @@ where
     let signing_key = ed25519::PrivateKey::new(&mut rng);
     let expiration = expiration.unwrap_or_else(ecash_default_expiration_date);
 
-    let deposit_amount = client.get_required_deposit_amount().await?;
+    let deposit_amount = client.get_default_deposit_amount().await?;
     info!("we'll need to deposit {deposit_amount} to obtain the ticketbook");
     let result = client
         .make_ticketbook_deposit(

common/bin-common/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-bin-common"
-version.workspace = true
 description = "Common code for nym binaries"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 clap = { workspace = true, features = ["derive"], optional = true }
@@ -38,6 +43,7 @@ default = []
 openapi = ["utoipa"]
 output_format = ["serde_json", "dep:clap"]
 bin_info_schema = ["schemars"]
+ip_check = []
 basic_tracing = ["dep:tracing", "dep:tracing-subscriber"]
 otel-otlp = [
     "basic_tracing",

common/bin-common/src/ip_check/mod.rs

@@ -1,29 +1,12 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
-// use `ip` feature without nightly
-// issue: https://github.com/rust-lang/rust/issues/27709
-pub(crate) const fn is_global_ip(ip: &IpAddr) -> bool {
+pub const fn is_global_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(addr) => is_global_ipv4(addr),
         IpAddr::V6(addr) => is_global_ipv6(addr),
     }
 }
 
-const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
-}
-
-const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
-}
-
-const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
-}
-
 const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
     !(ip.octets()[0] == 0 // "This network"
         || ip.is_private()
@@ -42,6 +25,18 @@ const fn is_global_ipv4(ip: &Ipv4Addr) -> bool {
         || ip.is_broadcast())
 }
 
+const fn is_shared_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 100 && (ip.octets()[1] & 0b1100_0000 == 0b0100_0000)
+}
+
+const fn is_benchmarking_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] == 198 && (ip.octets()[1] & 0xfe) == 18
+}
+
+const fn is_reserved_ipv4(ip: &Ipv4Addr) -> bool {
+    ip.octets()[0] & 240 == 240 && !ip.is_broadcast()
+}
+
 const fn is_documentation_ipv6(ip: &Ipv6Addr) -> bool {
     (ip.segments()[0] == 0x2001) && (ip.segments()[1] == 0xdb8)
 }

common/bin-common/src/lib.rs

@@ -9,3 +9,6 @@ pub mod completions;
 
 #[cfg(feature = "output_format")]
 pub mod output_format;
+
+#[cfg(feature = "ip_check")]
+pub mod ip_check;

common/client-core/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-client-core"
+description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 version.workspace = true
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2024"
-rust-version = "1.85"
 license.workspace = true
-description = "Crate containing core client functionality and configs, used by all other Nym client implentations"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/config-types/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-client-core-config-types"
+description = "Low level configs and constants used by Nym clients and nodes"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Low level configs and constants used by Nym clients and nodes"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/gateways-storage/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-client-core-gateways-storage"
+description = "Functionality for Nym clients to store and retrive Gateway connections"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-rust-version.workspace = true
-description = "Functionality for Nym clients to store and retrive Gateway connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-core/surb-storage/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-client-core-surb-storage"
+description = "Functionality for Nym clients to generate and use Single Use Reply Blocks (SURBs)"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Functionality for Nym clients to generate and use Single Use Reply Blocks (SURBs)"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/gateway-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-gateway-client"
+description = "Functions and types for Nym client <> Gateway connections"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Functions and types for Nym client <> Gateway connections"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/mixnet-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-mixnet-client"
+description = "Client for Mix Node <> Mix Node & Mix Node <> Gateway communication"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Client for Mix Node <> Mix Node & Mix Node <> Gateway communication"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/mixnet-client/src/client.rs

@@ -342,7 +342,7 @@ impl SendWithoutResponse for Client {
         sending_res.map_err(|err| {
             match err {
                 TrySendError::Full(_) => {
-                    warn!(
+                    trace!(
                         event = "mixclient.try_send",
                         peer = %address,
                         result = "full_dropped",

common/client-libs/validator-client/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-validator-client"
+description = "Client for interacting with Nyx Cosmos SDK blockchain"
 version.workspace = true
 authors = ["Jędrzej Stuczyński <andrew@nymtech.net>"]
 edition = "2021"
-rust-version = "1.85"
 license.workspace = true
-description = "Client for interacting with Nyx Cosmos SDK blockchain"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/client-libs/validator-client/src/nyxd/contract_traits/ecash_query_client.rs

@@ -8,6 +8,7 @@ use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmwasm_std::Coin;
 use nym_ecash_contract_common::deposit::LatestDepositResponse;
+use nym_ecash_contract_common::deposit_statistics::DepositsStatistics;
 use nym_ecash_contract_common::msg::QueryMsg as EcashQueryMsg;
 use serde::Deserialize;
 
@@ -17,6 +18,9 @@ pub use nym_ecash_contract_common::blacklist::{
 pub use nym_ecash_contract_common::deposit::{
     Deposit, DepositData, DepositId, DepositResponse, PagedDepositsResponse,
 };
+pub use nym_ecash_contract_common::reduced_deposit::{
+    WhitelistedAccount, WhitelistedAccountsResponse,
+};
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -42,8 +46,18 @@ pub trait EcashQueryClient {
             .await
     }
 
-    async fn get_required_deposit_amount(&self) -> Result<Coin, NyxdError> {
-        self.query_ecash_contract(EcashQueryMsg::GetRequiredDepositAmount {})
+    async fn get_default_deposit_amount(&self) -> Result<Coin, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetDefaultDepositAmount {})
+            .await
+    }
+
+    async fn get_reduced_deposit_amount(&self, address: String) -> Result<Option<Coin>, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetReducedDepositAmount { address })
+            .await
+    }
+
+    async fn get_all_whitelisted_accounts(&self) -> Result<WhitelistedAccountsResponse, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetAllWhitelistedAccounts {})
             .await
     }
 
@@ -65,6 +79,11 @@ pub trait EcashQueryClient {
         self.query_ecash_contract(EcashQueryMsg::GetDepositsPaged { start_after, limit })
             .await
     }
+
+    async fn get_deposits_statistics(&self) -> Result<DepositsStatistics, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetDepositsStatistics {})
+            .await
+    }
 }
 
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -122,10 +141,17 @@ mod tests {
             EcashQueryMsg::GetDepositsPaged { limit, start_after } => {
                 client.get_deposits_paged(start_after, limit).ignore()
             }
-            EcashQueryMsg::GetRequiredDepositAmount {} => {
-                client.get_required_deposit_amount().ignore()
+            EcashQueryMsg::GetDefaultDepositAmount {} => {
+                client.get_default_deposit_amount().ignore()
+            }
+            EcashQueryMsg::GetReducedDepositAmount { address } => {
+                client.get_reduced_deposit_amount(address).ignore()
+            }
+            EcashQueryMsg::GetAllWhitelistedAccounts {} => {
+                client.get_all_whitelisted_accounts().ignore()
             }
             EcashQueryMsg::GetLatestDeposit {} => client.get_latest_deposit().ignore(),
+            EcashQueryMsg::GetDepositsStatistics {} => client.get_deposits_statistics().ignore(),
         };
     }
 }

common/client-libs/validator-client/src/nyxd/contract_traits/ecash_signing_client.rs

@@ -62,13 +62,47 @@ pub trait EcashSigningClient {
         new_deposit: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        let req = EcashExecuteMsg::UpdateDepositValue {
+        let req = EcashExecuteMsg::UpdateDefaultDepositValue {
             new_deposit: new_deposit.into(),
         };
         self.execute_ecash_contract(fee, req, "Ecash::UpdateDepositValue".to_string(), vec![])
             .await
     }
 
+    async fn set_reduced_deposit_price(
+        &self,
+        address: String,
+        deposit: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::SetReducedDepositPrice {
+            address,
+            deposit: deposit.into(),
+        };
+        self.execute_ecash_contract(
+            fee,
+            req,
+            "Ecash::SetReducedDepositPrice".to_string(),
+            vec![],
+        )
+        .await
+    }
+
+    async fn remove_reduced_deposit_price(
+        &self,
+        address: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::RemoveReducedDepositPrice { address };
+        self.execute_ecash_contract(
+            fee,
+            req,
+            "Ecash::RemoveReducedDepositPrice".to_string(),
+            vec![],
+        )
+        .await
+    }
+
     async fn propose_for_blacklist(
         &self,
         public_key: String,
@@ -141,9 +175,15 @@ mod tests {
                 .ignore(),
             ExecuteMsg::RedeemTickets { .. } => unimplemented!(), // no redeem tickets method for the client
             ExecuteMsg::UpdateAdmin { admin } => client.update_admin(admin, None).ignore(),
-            ExecuteMsg::UpdateDepositValue { new_deposit } => client
+            ExecuteMsg::UpdateDefaultDepositValue { new_deposit } => client
                 .update_deposit_value(new_deposit.into(), None)
                 .ignore(),
+            ExecuteMsg::SetReducedDepositPrice { address, deposit } => client
+                .set_reduced_deposit_price(address, deposit.into(), None)
+                .ignore(),
+            ExecuteMsg::RemoveReducedDepositPrice { address } => {
+                client.remove_reduced_deposit_price(address, None).ignore()
+            }
         };
     }
 }

common/commands/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-cli-commands"
+description = "Common commands crate used by the nym-cli tool for interacting with the Nyx Cosmos SDK blockchain and Mixnet endpoints"
 version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common commands crate used by the nym-cli tool for interacting with the Nyx Cosmos SDK blockchain and Mixnet endpoints"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/config/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-config"
+description = "Config related helpers and functions"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
+repository.workspace = true
 homepage.workspace = true
-description = "Config related helpers and functions"
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/coconut-dkg/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-coconut-dkg-common"
+description = "Common crate for Nym's DKG cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's DKG cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/contracts-common-testing/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-contracts-common-testing"
+description = "Common crate for cosmwasm contract tests"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
-description = "Common crate for cosmwasm contract tests"
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-contracts-common"
-version.workspace = true
 description = "Common library for Nym cosmwasm contracts"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 bs58 = { workspace = true }

common/cosmwasm-smart-contracts/easy_addr/Cargo.toml

@@ -2,8 +2,8 @@
 name = "easy-addr"
 version.workspace = true
 edition = "2021"
-publish = false
 license.workspace = true
+publish = false
 
 [lib]
 proc-macro = true

common/cosmwasm-smart-contracts/ecash-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-ecash-contract-common"
+description = "Common crate for Nym's ecash/zknym cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's ecash/zknym cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/cosmwasm-smart-contracts/ecash-contract/src/counters.rs

@@ -6,6 +6,14 @@ use cosmwasm_std::Coin;
 
 #[cw_serde]
 pub struct PoolCounters {
+    /// Represents the total amount of funds deposited into the contract.
     pub total_deposited: Coin,
+
+    /// Represents the total amount of funds redeemed from the contract that got transferred into the holding account.
     pub total_redeemed: Coin,
+
+    /// Represents the total amount of tickets requested to be redeemed from the contract and get moved into the holding account,
+    /// after that functionality got disabled.
+    #[serde(default)]
+    pub tickets_requested_and_not_redeemed: u64,
 }

common/cosmwasm-smart-contracts/ecash-contract/src/deposit_statistics.rs

@@ -0,0 +1,38 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::Coin;
+use std::collections::HashMap;
+
+/// Aggregate statistics about all deposits made through the ecash contract.
+#[cw_serde]
+pub struct DepositsStatistics {
+    /// Total number of deposits ever made (at any price tier),
+    /// derived from the deposit id counter.
+    pub total_deposits_made: u32,
+
+    /// Total value of all deposits ever made (at any price tier),
+    /// sourced from `PoolCounters::total_deposited`.
+    pub total_deposited: Coin,
+
+    /// Number of deposits made at the default (non-reduced) price.
+    pub total_deposits_made_with_default_price: u32,
+
+    /// Total value deposited at the default price.
+    pub total_deposited_with_default_price: Coin,
+
+    /// Number of deposits made at any custom (reduced) price, summed across all whitelisted accounts.
+    pub total_deposits_made_with_custom_price: u32,
+
+    /// Total value deposited at custom prices, summed across all whitelisted accounts.
+    pub total_deposited_with_custom_price: Coin,
+
+    /// Per-account breakdown of deposit counts for whitelisted addresses.
+    // note: we use String for addressing due to serialisation incompatibility
+    pub deposits_made_with_custom_price: HashMap<String, u32>,
+
+    /// Per-account breakdown of deposited amounts for whitelisted addresses.
+    // note: we use String for addressing due to serialisation incompatibility
+    pub deposited_with_custom_price: HashMap<String, Coin>,
+}

common/cosmwasm-smart-contracts/ecash-contract/src/error.rs

@@ -65,4 +65,26 @@ pub enum EcashContractError {
 
     #[error("the account blacklisting hasn't been fully implemented yet")]
     UnimplementedBlacklisting,
+
+    #[error("reduced deposit must use the same denom as the default deposit (expected '{expected}', got '{got}')")]
+    InvalidReducedDepositDenom { expected: String, got: String },
+
+    #[error(
+        "reduced deposit amount ({reduced}) must be strictly less than the default ({default})"
+    )]
+    ReducedDepositNotReduced {
+        reduced: cosmwasm_std::Uint128,
+        default: cosmwasm_std::Uint128,
+    },
+
+    #[error("address '{address}' does not have a custom reduced deposit price set")]
+    NoReducedDepositPrice { address: String },
+
+    #[error(
+        "deposit amount ({amount}) must be at least the ticket book size ({ticket_book_size})"
+    )]
+    DepositBelowTicketBookSize {
+        amount: cosmwasm_std::Uint128,
+        ticket_book_size: u64,
+    },
 }

common/cosmwasm-smart-contracts/ecash-contract/src/lib.rs

@@ -4,10 +4,12 @@
 pub mod blacklist;
 pub mod counters;
 pub mod deposit;
+pub mod deposit_statistics;
 pub mod error;
 pub mod event_attributes;
 pub mod events;
 pub mod msg;
 pub mod redeem_credential;
+pub mod reduced_deposit;
 
 pub use error::EcashContractError;

common/cosmwasm-smart-contracts/ecash-contract/src/msg.rs

@@ -9,6 +9,10 @@ use crate::blacklist::{BlacklistedAccountResponse, PagedBlacklistedAccountRespon
 #[cfg(feature = "schema")]
 use crate::deposit::{DepositResponse, LatestDepositResponse, PagedDepositsResponse};
 #[cfg(feature = "schema")]
+use crate::deposit_statistics::DepositsStatistics;
+#[cfg(feature = "schema")]
+use crate::reduced_deposit::WhitelistedAccountsResponse;
+#[cfg(feature = "schema")]
 use cosmwasm_schema::QueryResponses;
 
 #[cw_serde]
@@ -42,10 +46,25 @@ pub enum ExecuteMsg {
         admin: String,
     },
 
-    UpdateDepositValue {
+    #[serde(alias = "update_deposit_value")]
+    UpdateDefaultDepositValue {
         new_deposit: Coin,
     },
 
+    /// Set (or overwrite) a reduced deposit price for a specific address.
+    /// Only callable by the contract admin.
+    SetReducedDepositPrice {
+        address: String,
+        deposit: Coin,
+    },
+
+    /// Remove the reduced deposit price for a specific address, reverting them to
+    /// the default price. Returns an error if the address has no custom price set.
+    /// Only callable by the contract admin.
+    RemoveReducedDepositPrice {
+        address: String,
+    },
+
     // TODO: properly implement
     ProposeToBlacklist {
         public_key: String,
@@ -68,7 +87,15 @@ pub enum QueryMsg {
     },
 
     #[cfg_attr(feature = "schema", returns(Coin))]
-    GetRequiredDepositAmount {},
+    #[serde(alias = "get_required_deposit_amount")]
+    #[serde(alias = "GetRequiredDepositAmount")]
+    GetDefaultDepositAmount {},
+
+    #[cfg_attr(feature = "schema", returns(Option<Coin>))]
+    GetReducedDepositAmount { address: String },
+
+    #[cfg_attr(feature = "schema", returns(WhitelistedAccountsResponse))]
+    GetAllWhitelistedAccounts {},
 
     #[cfg_attr(feature = "schema", returns(DepositResponse))]
     GetDeposit { deposit_id: u32 },
@@ -81,7 +108,22 @@ pub enum QueryMsg {
         limit: Option<u32>,
         start_after: Option<u32>,
     },
+
+    #[cfg_attr(feature = "schema", returns(DepositsStatistics))]
+    GetDepositsStatistics {},
 }
 
 #[cw_serde]
-pub struct MigrateMsg {}
+pub struct MigrateMsg {
+    /// Initial set of whitelisted accounts with their reduced deposit prices.
+    /// Each entry is validated and stored during migration.
+    pub initial_whitelist: Vec<WhitelistedDeposit>,
+}
+
+/// An address and its reduced deposit price, used when seeding the whitelist
+/// via migration.
+#[cw_serde]
+pub struct WhitelistedDeposit {
+    pub address: String,
+    pub deposit: Coin,
+}

common/cosmwasm-smart-contracts/ecash-contract/src/reduced_deposit.rs

@@ -0,0 +1,16 @@
+// Copyright 2026 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::{Addr, Coin};
+
+#[cw_serde]
+pub struct WhitelistedAccount {
+    pub address: Addr,
+    pub deposit: Coin,
+}
+
+#[cw_serde]
+pub struct WhitelistedAccountsResponse {
+    pub whitelisted_accounts: Vec<WhitelistedAccount>,
+}

common/cosmwasm-smart-contracts/group-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-group-contract-common"
+description = "Common crate for Nym's group cosmwasm contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common crate for Nym's group cosmwasm contract"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-schema = { workspace = true }

common/cosmwasm-smart-contracts/mixnet-contract/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-mixnet-contract-common"
-version.workspace = true
 description = "Common library for the Nym mixnet contract"
-rust-version = "1.85"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 bs58 = { workspace = true }

common/cosmwasm-smart-contracts/multisig-contract/Cargo.toml

@@ -1,10 +1,16 @@
 [package]
 name = "nym-multisig-contract-common"
+description = "Common code for the Nym multisig CosmWasm smart contract"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Common code for the Nym multisig CosmWasm smart contract"
+repository.workspace = true
 homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-schema = { workspace = true }

common/cosmwasm-smart-contracts/nym-performance-contract/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-performance-contract-common"
+description = "Common crate for Nym's group performance contract"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
-description = "Common crate for Nym's group performance contract"
+publish = true
 
 [dependencies]
 thiserror = { workspace = true }

common/cosmwasm-smart-contracts/nym-pool-contract/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-pool-contract-common"
-version.workspace = true
 description = "Common library for the Nym Pool contract"
+version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-rust-version.workspace = true
+rust-version = "1.85"
 readme.workspace = true
+publish = true
 
 [dependencies]
 thiserror = { workspace = true }

common/cosmwasm-smart-contracts/vesting-contract/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-vesting-contract-common"
-version.workspace = true
 description = "Common library for the Nym vesting contract"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version = "1.85"
+readme.workspace = true
+publish = true
 
 [dependencies]
 cosmwasm-std = { workspace = true }

common/credential-proxy/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-credential-proxy-lib"
+description = "Build script and core functionality of the Nym Credential Proxy"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Build script and core functionality of the Nym Credential Proxy"
+publish = true
 
 [dependencies]
 anyhow = { workspace = true }

common/credential-proxy/src/deposits_buffer/mod.rs

@@ -13,8 +13,9 @@ use std::sync::Arc;
 use std::time::Duration;
 use time::OffsetDateTime;
 use tokio::sync::Mutex as AsyncMutex;
+use tokio::time::Instant;
 use tokio_util::sync::CancellationToken;
-use tracing::{debug, info, instrument, warn};
+use tracing::{debug, error, info, instrument, warn};
 use uuid::Uuid;
 
 pub use helpers::{BufferedDeposit, PerformedDeposits, make_deposits_request, split_deposits};
@@ -146,9 +147,14 @@ impl DepositsBuffer {
 
     // if we're here, we know we're below the threshold
     fn maybe_refill_deposits(&self) {
-        if let Some(mut guard) = self.inner.deposits_refill_task.try_get_new_task_guard() {
+        if let Some((mut guard, completion_guard)) =
+            self.inner.deposits_refill_task.try_get_new_task_guard()
+        {
             let this = self.clone();
-            *guard = Some(tokio::spawn(async move { this.refill_deposits().await }));
+            *guard = Some(tokio::spawn(async move {
+                let _completion_guard = completion_guard;
+                this.refill_deposits().await
+            }));
         }
     }
 
@@ -179,6 +185,8 @@ impl DepositsBuffer {
         requested_on: OffsetDateTime,
         client_pubkey: PublicKeyUser,
     ) -> Result<BufferedDeposit, CredentialProxyError> {
+        let wait_start = Instant::now();
+        let mut i = 0;
         loop {
             tokio::time::sleep(Duration::from_millis(500)).await;
             if let Some(buffered_deposit) = self.inner.unused_deposits.lock().await.pop() {
@@ -195,6 +203,15 @@ impl DepositsBuffer {
                 // make sure there's always a task working in the background in case deposits get used up too quickly
                 self.maybe_refill_deposits()
             }
+            i += 1;
+            let elapsed = wait_start.elapsed();
+            if elapsed > Duration::from_secs(5) && i % 10 == 0 {
+                warn!("we've been waiting for over 5s to make a deposit - something is wrong!")
+            } else if elapsed > Duration::from_secs(10) && i % 5 == 0 {
+                error!(
+                    "we've been waiting for over 10s to make a deposit - something is SERIOUSLY wrong!"
+                )
+            }
         }
     }
 

common/credential-proxy/src/deposits_buffer/refill_task.rs

@@ -3,12 +3,22 @@
 
 use crate::error::CredentialProxyError;
 use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::{Mutex as StdMutex, MutexGuard};
+use std::sync::{Arc, Mutex as StdMutex, MutexGuard};
 use tokio::task::JoinHandle;
 use tracing::{debug, error};
 
 pub(super) type RefillTaskResult = Result<(), CredentialProxyError>;
 
+pub(super) struct InProgressGuard {
+    in_progress: Arc<AtomicBool>,
+}
+
+impl Drop for InProgressGuard {
+    fn drop(&mut self) {
+        self.in_progress.store(false, Ordering::SeqCst);
+    }
+}
+
 #[derive(Default)]
 pub(super) struct RefillTask {
     // note that we can only have a single transaction in progress (or it'd mess up with our sequence numbers)
@@ -16,7 +26,7 @@ pub(super) struct RefillTask {
     // we'll have to increase the number of deposits per transaction
     join_handle: StdMutex<Option<JoinHandle<RefillTaskResult>>>,
 
-    in_progress: AtomicBool,
+    in_progress: Arc<AtomicBool>,
 }
 
 impl RefillTask {
@@ -28,9 +38,15 @@ impl RefillTask {
             .is_ok()
     }
 
+    /// Returns `None` if a refill is already in progress. On success, returns the
+    /// join-handle guard (to store the new `JoinHandle` into) and an [`InProgressGuard`]
+    /// that **must be moved into the spawned task** — it resets the flag when dropped.
     pub(super) fn try_get_new_task_guard(
         &self,
-    ) -> Option<MutexGuard<'_, Option<JoinHandle<RefillTaskResult>>>> {
+    ) -> Option<(
+        MutexGuard<'_, Option<JoinHandle<RefillTaskResult>>>,
+        InProgressGuard,
+    )> {
         // sanity check for concurrent request
         if !self.try_set_in_progress() {
             debug!("another task has already started deposit refill request");
@@ -48,7 +64,11 @@ impl RefillTask {
             }
         }
 
-        Some(guard)
+        let completion_guard = InProgressGuard {
+            in_progress: Arc::clone(&self.in_progress),
+        };
+
+        Some((guard, completion_guard))
     }
 
     pub(super) fn take_task_join_handle(&self) -> Option<JoinHandle<RefillTaskResult>> {
@@ -56,3 +76,34 @@ impl RefillTask {
         self.join_handle.lock().expect("mutex got poisoned").take()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn in_progress_resets_after_guard_drop() {
+        let task = RefillTask::default();
+
+        let (guard, completion_guard) = task.try_get_new_task_guard().unwrap();
+        drop(guard);
+        assert!(task.try_get_new_task_guard().is_none());
+
+        drop(completion_guard);
+        assert!(task.try_get_new_task_guard().is_some());
+    }
+
+    #[test]
+    fn in_progress_resets_on_panic() {
+        let task = RefillTask::default();
+
+        let (guard, completion_guard) = task.try_get_new_task_guard().unwrap();
+        drop(guard);
+
+        let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let _g = completion_guard;
+            panic!("simulated refill task panic");
+        }));
+        assert!(task.try_get_new_task_guard().is_some());
+    }
+}

common/credential-proxy/src/shared_state/nyxd_client.rs

@@ -6,7 +6,7 @@ use crate::helpers::LockTimer;
 use nym_ecash_contract_common::msg::ExecuteMsg;
 use nym_validator_client::nyxd::contract_traits::NymContractsProvider;
 use nym_validator_client::nyxd::cosmwasm_client::types::ExecuteResult;
-use nym_validator_client::nyxd::{Coin, Config, CosmWasmClient, NyxdClient};
+use nym_validator_client::nyxd::{AccountId, Coin, Config, CosmWasmClient, NyxdClient};
 use nym_validator_client::{DirectSigningHttpRpcNyxdClient, nyxd};
 use std::ops::Deref;
 use std::sync::Arc;
@@ -50,6 +50,10 @@ impl ChainClient {
         Ok(ChainClient(Arc::new(RwLock::new(client))))
     }
 
+    pub async fn address(&self) -> AccountId {
+        self.0.read().await.address()
+    }
+
     pub async fn query_chain(&self) -> ChainReadPermit<'_> {
         let _acquire_timer = LockTimer::new("acquire chain query permit");
         self.0.read().await

common/credential-proxy/src/shared_state/required_deposit_cache.rs

@@ -8,6 +8,7 @@ use nym_validator_client::nyxd::contract_traits::EcashQueryClient;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::sync::RwLock;
+use tracing::{info, warn};
 
 pub struct CachedDeposit {
     valid_until: OffsetDateTime,
@@ -56,13 +57,29 @@ impl RequiredDepositCache {
 
         // update cache
         drop(read_guard);
+
+        let address = chain_client.address().await;
+        info!("checking deposit required by {address}");
         let mut write_guard = self.inner.write().await;
-        let deposit_amount = chain_client
-            .query_chain()
-            .await
-            .get_required_deposit_amount()
+
+        let read_permit = chain_client.query_chain().await;
+        let reduced = read_permit
+            .get_reduced_deposit_amount(address.to_string())
             .await?;
 
+        let deposit_amount = match reduced {
+            Some(reduced) => {
+                info!("we're permitted to use reduced price");
+                reduced
+            }
+            None => {
+                warn!(
+                    "using default deposit value {address} is not whitelisted for price reduction"
+                );
+                read_permit.get_default_deposit_amount().await?
+            }
+        };
+
         let nym_coin: Coin = deposit_amount.into();
 
         write_guard.update(nym_coin.clone());

common/credential-storage/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-credential-storage"
+description = "Crate for handling and storing spent and unspent zknym ticketbooks"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-rust-version.workspace = true
-description = "Crate for handling and storing spent and unspent zknym ticketbooks"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/credential-utils/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-credential-utils"
+description = "Utils crate for dealing with zknym credentials"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Utils crate for dealing with zknym credentials"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]

common/credential-verification/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-credential-verification"
+description = "Store and verify zknym credentials"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Store and verify zknym credentials"
+publish = true
 
 [dependencies]
 async-trait = { workspace = true }

common/credential-verification/src/ecash/credential_sender.rs

@@ -3,25 +3,19 @@
 
 use crate::Error;
 use crate::ecash::error::EcashTicketError;
-use crate::ecash::helpers::for_each_api_concurrent;
 use crate::ecash::state::SharedState;
 use cosmwasm_std::Fraction;
 use cw_utils::ThresholdResponse;
 use futures::channel::mpsc::UnboundedReceiver;
 use futures::{Stream, StreamExt};
-use nym_api_requests::constants::MIN_BATCH_REDEMPTION_DELAY;
-use nym_api_requests::ecash::models::{BatchRedeemTicketsBody, VerifyEcashTicketBody};
+use nym_api_requests::ecash::models::VerifyEcashTicketBody;
 use nym_credentials_interface::Bandwidth;
 use nym_credentials_interface::{ClientTicket, TicketType};
 use nym_validator_client::EcashApiClient;
 use nym_validator_client::coconut::EcashApiError;
-use nym_validator_client::nym_api::{EpochId, NymApiClientExt};
+use nym_validator_client::nym_api::NymApiClientExt;
 use nym_validator_client::nyxd::AccountId;
-use nym_validator_client::nyxd::contract_traits::{
-    EcashSigningClient, MultisigQueryClient, MultisigSigningClient, PagedMultisigQueryClient,
-};
-use nym_validator_client::nyxd::cosmwasm_client::ContractResponseData;
-use nym_validator_client::nyxd::cw3::Status;
+use nym_validator_client::nyxd::contract_traits::MultisigQueryClient;
 use si_scale::helpers::bibytes2;
 use std::collections::{HashMap, HashSet};
 use std::ops::Deref;
@@ -31,22 +25,6 @@ use tokio::sync::{Mutex, RwLockReadGuard};
 use tokio::time::{Duration, Instant, interval_at};
 use tracing::{debug, error, info, instrument, trace, warn};
 
-enum ProposalResult {
-    Executed,
-    Rejected,
-    Pending,
-}
-
-impl ProposalResult {
-    fn is_pending(&self) -> bool {
-        matches!(self, ProposalResult::Pending)
-    }
-
-    fn is_rejected(&self) -> bool {
-        matches!(self, ProposalResult::Rejected)
-    }
-}
-
 struct PendingVerification {
     ticket: ClientTicket,
 
@@ -68,43 +46,6 @@ impl PendingVerification {
     }
 }
 
-struct PendingRedemptionVote {
-    proposal_id: u64,
-    digest: Vec<u8>,
-    included_serial_numbers: Vec<Vec<u8>>,
-    epoch_id: EpochId,
-
-    // vec of node ids of apis that haven't sent a valid response
-    pending: Vec<u64>,
-}
-
-impl PendingRedemptionVote {
-    fn new(
-        proposal_id: u64,
-        digest: Vec<u8>,
-        included_serial_numbers: Vec<Vec<u8>>,
-        epoch_id: EpochId,
-        pending: Vec<u64>,
-    ) -> Self {
-        PendingRedemptionVote {
-            proposal_id,
-            digest,
-            included_serial_numbers,
-            epoch_id,
-            pending,
-        }
-    }
-
-    fn to_request_body(&self, gateway_cosmos_addr: AccountId) -> BatchRedeemTicketsBody {
-        BatchRedeemTicketsBody::new(
-            self.digest.clone(),
-            self.proposal_id,
-            self.included_serial_numbers.clone(),
-            gateway_cosmos_addr,
-        )
-    }
-}
-
 pub struct CredentialHandlerConfig {
     /// Specifies the multiplier for revoking a malformed/double-spent ticket
     /// (if it has to go all the way to the nym-api for verification)
@@ -132,7 +73,6 @@ pub struct CredentialHandler {
     ticket_receiver: UnboundedReceiver<ClientTicket>,
     shared_state: SharedState,
     pending_tickets: Vec<PendingVerification>,
-    pending_redemptions: Vec<PendingRedemptionVote>,
 }
 
 impl CredentialHandler {
@@ -184,75 +124,6 @@ impl CredentialHandler {
         Ok(pending)
     }
 
-    async fn rebuild_pending_votes(
-        shared_state: &SharedState,
-    ) -> Result<Vec<PendingRedemptionVote>, EcashTicketError> {
-        // 1. get all tickets that were not fully verified
-        let unverified = shared_state.storage.get_all_unresolved_proposals().await?;
-        let mut pending = Vec::with_capacity(unverified.len());
-
-        let epoch_id = shared_state.current_epoch_id().await?;
-        let apis = shared_state
-            .api_clients(epoch_id)
-            .await?
-            .iter()
-            .map(|s| (s.cosmos_address.to_string(), s.node_id))
-            .collect::<Vec<_>>();
-
-        for proposal_id in unverified {
-            // get all of the votes
-            let votes = shared_state
-                .start_query()
-                .await
-                .get_all_votes(proposal_id as u64)
-                .await
-                .map_err(EcashTicketError::chain_query_failure)?
-                .into_iter()
-                .map(|v| v.voter)
-                .collect::<HashSet<_>>();
-
-            let mut missing_votes = Vec::new();
-
-            // see who hasn't voted
-            for (api_address, api_id) in &apis {
-                // for each signer, check if they have actually voted; if not, that's the missing guy
-                if !votes.contains(api_address) {
-                    missing_votes.push(*api_id)
-                }
-            }
-
-            // attempt to rebuild SN and digest from the proposal info + storage data
-            let proposal_info = shared_state
-                .start_query()
-                .await
-                .query_proposal(proposal_id as u64)
-                .await
-                .map_err(EcashTicketError::chain_query_failure)?;
-
-            let tickets = shared_state
-                .storage
-                .get_all_proposed_tickets_with_sn(proposal_id as u32)
-                .await?;
-            let digest =
-                BatchRedeemTicketsBody::make_digest(tickets.iter().map(|t| &t.serial_number));
-            let encoded_digest = bs58::encode(&digest).into_string();
-            if encoded_digest != proposal_info.description {
-                error!("the lost proposal {proposal_id} does not have a matching digest!");
-                continue;
-            }
-
-            pending.push(PendingRedemptionVote {
-                proposal_id: proposal_id as u64,
-                digest,
-                included_serial_numbers: tickets.into_iter().map(|t| t.serial_number).collect(),
-                epoch_id,
-                pending: missing_votes,
-            })
-        }
-
-        Ok(pending)
-    }
-
     pub(crate) async fn new(
         config: CredentialHandlerConfig,
         ticket_receiver: UnboundedReceiver<ClientTicket>,
@@ -276,51 +147,15 @@ impl CredentialHandler {
         // on startup read pending credentials and api responses from the storage
         let pending_tickets = Self::rebuild_pending_tickets(&shared_state).await?;
 
-        // on startup read pending proposals from the storage
-        // then reconstruct the votes by querying the multisig contract for votes on those proposals
-        // digest from the description and count from the message
-        let pending_redemptions = Self::rebuild_pending_votes(&shared_state).await?;
-
         Ok(CredentialHandler {
             config,
             multisig_threshold,
             ticket_receiver,
             shared_state,
             pending_tickets,
-            pending_redemptions,
         })
     }
 
-    // the argument is temporary as we'll be reading from the storage
-    async fn create_redemption_proposal(
-        &self,
-        commitment: &[u8],
-        number_of_tickets: u16,
-    ) -> Result<u64, EcashTicketError> {
-        let res = self
-            .shared_state
-            .start_tx()
-            .await
-            .request_ticket_redemption(
-                bs58::encode(commitment).into_string(),
-                number_of_tickets,
-                None,
-            )
-            .await
-            .map_err(|source| EcashTicketError::RedemptionProposalCreationFailure { source })?;
-
-        // that one is quite tricky because proposal exists on chain, but we didn't get the id...
-        // but it should be quite impossible to ever reach this unless we make breaking changes
-        let proposal_id = res
-            .parse_singleton_u64_contract_data()
-            .inspect_err(|err| error!("reached seemingly impossible error! could not recover the redemption proposal id: {err}"))
-            .map_err(|source| EcashTicketError::ProposalIdParsingFailure { source })?;
-
-        info!("created redemption proposal {proposal_id} to redeem {number_of_tickets} tickets");
-
-        Ok(proposal_id)
-    }
-
     /// Attempt to send ticket verification request to the provided ecash verifier.
     async fn verify_ticket(
         &self,
@@ -522,42 +357,7 @@ impl CredentialHandler {
     async fn resolve_pending(&mut self) -> Result<(), EcashTicketError> {
         let mut still_failing = Vec::new();
 
-        // 1. attempt to resolve all pending proposals
-        while let Some(mut pending) = self.pending_redemptions.pop() {
-            match self.try_resolve_pending_proposal(&mut pending, None).await {
-                Ok(resolution) => {
-                    if resolution.is_pending() {
-                        warn!(
-                            "still failed to reach quorum for proposal {}. apis: {:?} haven't responded. we'll retry later",
-                            pending.proposal_id, pending.pending
-                        );
-                        still_failing.push(pending);
-                    } else {
-                        self.shared_state
-                            .storage
-                            .clear_post_proposal_data(
-                                pending.proposal_id as u32,
-                                OffsetDateTime::now_utc(),
-                                resolution.is_rejected(),
-                            )
-                            .await?;
-                    }
-                }
-                Err(err) => {
-                    error!(
-                        "experienced internal error when attempting to resolve pending proposal: {err}"
-                    );
-                    // make sure to update internal state to not lose any data
-                    self.pending_redemptions.push(pending);
-                    self.pending_redemptions.append(&mut still_failing);
-                    return Err(err);
-                }
-            }
-        }
-
-        let mut still_failing = Vec::new();
-
-        // 2. attempt to verify the remaining tickets
+        // 1. attempt to verify the remaining tickets
         while let Some(mut pending) = self.pending_tickets.pop() {
             // possible optimisation: if there's a lot of pending tickets, pre-emptively grab locks for api_clients
             match self
@@ -595,362 +395,14 @@ impl CredentialHandler {
         Ok(())
     }
 
-    /// Attempt to send batch redemption request to the provided ecash verifier.
-    async fn redeem_tickets(
-        &self,
-        proposal_id: u64,
-        request: &BatchRedeemTicketsBody,
-        client: &EcashApiClient,
-    ) -> Result<bool, EcashTicketError> {
-        match client.api_client.batch_redeem_ecash_tickets(request).await {
-            Ok(res) => {
-                let accepted = if res.proposal_accepted {
-                    trace!("{client} has accepted proposal {proposal_id}");
-                    true
-                } else {
-                    warn!("{client} has rejected proposal {proposal_id}");
-                    false
-                };
-
-                Ok(accepted)
-            }
-            Err(err) => {
-                error!(
-                    "failed to send proposal {proposal_id} for redemption vote to ecash signer '{client}': {err}. if we don't reach quorum, we'll retry later"
-                );
-                Ok(false)
-            }
-        }
-    }
-
-    async fn try_execute_proposal(&self, proposal_id: u64) -> Result<(), EcashTicketError> {
-        self.shared_state
-            .start_tx()
-            .await
-            .execute_proposal(proposal_id, None)
-            .await
-            .map_err(
-                |source| EcashTicketError::RedemptionProposalExecutionFailure {
-                    proposal_id,
-                    source,
-                },
-            )?;
-        Ok(())
-    }
-
-    async fn get_proposal_status(&self, proposal_id: u64) -> Result<Status, EcashTicketError> {
-        Ok(self
-            .shared_state
-            .start_query()
-            .await
-            .query_proposal(proposal_id)
-            .await
-            .map_err(EcashTicketError::chain_query_failure)?
-            .status)
-    }
-
-    async fn try_finalize_proposal(
-        &self,
-        proposal_id: u64,
-    ) -> Result<ProposalResult, EcashTicketError> {
-        match self.get_proposal_status(proposal_id).await? {
-            Status::Pending => {
-                // the voting hasn't even begun!
-                error!("impossible case! the proposal {proposal_id} is still pending");
-                Ok(ProposalResult::Pending)
-            }
-            Status::Open => {
-                debug!("proposal {proposal_id} is still open and needs more votes");
-                Ok(ProposalResult::Pending)
-            }
-            Status::Rejected => {
-                warn!("proposal {proposal_id} has been rejected");
-                Ok(ProposalResult::Rejected)
-            }
-            Status::Passed => {
-                info!(
-                    "proposal {proposal_id} has already been passed - we just need to execute it"
-                );
-                self.try_execute_proposal(proposal_id).await?;
-                info!("executed proposal {proposal_id}");
-                Ok(ProposalResult::Executed)
-            }
-            Status::Executed => {
-                info!("proposal {proposal_id} has already been executed - nothing to do!");
-                Ok(ProposalResult::Executed)
-            }
-        }
-    }
-
-    async fn try_resolve_pending_proposal(
-        &self,
-        pending: &mut PendingRedemptionVote,
-        api_clients: Option<RwLockReadGuard<'_, Vec<EcashApiClient>>>,
-    ) -> Result<ProposalResult, EcashTicketError> {
-        let proposal_id = pending.proposal_id;
-
-        info!(
-            "attempting to resolve pending redemption proposal {proposal_id} to redeem {} tickets",
-            pending.included_serial_numbers.len()
-        );
-
-        // check if the proposal still needs more votes from the apis
-        let result = self.try_finalize_proposal(proposal_id).await?;
-        if !result.is_pending() {
-            return Ok(result);
-        }
-
-        let api_clients = match api_clients {
-            Some(clients) => clients,
-            None => self.shared_state.api_clients(pending.epoch_id).await?,
-        };
-
-        let redemption_request = pending.to_request_body(self.shared_state.address.clone());
-
-        // TODO: optimisation: tell other apis they can purge our tickets even if they haven't voted
-
-        let total = api_clients.len();
-        let api_failures = Mutex::new(Vec::new());
-        let rejected = AtomicUsize::new(0);
-
-        for_each_api_concurrent(&api_clients, &pending.pending, |ecash_client| async {
-            // errors are only returned on hard, storage, failures
-            match self
-                .redeem_tickets(pending.proposal_id, &redemption_request, ecash_client)
-                .await
-            {
-                Err(err) => {
-                    error!("internal failure. could not proceed with ticket redemption: {err}");
-                    api_failures.lock().await.push(ecash_client.node_id);
-                }
-                Ok(false) => {
-                    rejected.fetch_add(1, Ordering::SeqCst);
-                }
-                _ => {}
-            }
-        })
-        .await;
-
-        let api_failures = api_failures.into_inner();
-        let num_failures = api_failures.len();
-        pending.pending = api_failures;
-
-        let rejected = rejected.into_inner();
-        let rejected_ratio = rejected as f32 / total as f32;
-        let rejected_perc = rejected_ratio * 100.;
-        if rejected_ratio >= (1. - self.multisig_threshold) {
-            error!(
-                "{rejected_perc:.2}% of signers rejected proposal {proposal_id}. we won't be able to execute it"
-            );
-            // no need to query the chain as with so many rejections it's impossible it has passed.
-            return Ok(ProposalResult::Rejected);
-        }
-
-        let accepted_ratio = (total - rejected - num_failures) as f32 / total as f32;
-        let accepted_perc = accepted_ratio * 100.;
-        match accepted_ratio {
-            n if n < self.multisig_threshold => {
-                error!(
-                    "less than 2/3 of signers ({accepted_perc:.2}%) accepted proposal {proposal_id}. we're not yet be able to execute it to get funds out"
-                );
-                return Ok(ProposalResult::Pending);
-            }
-            n if n < self.config.minimum_api_quorum => {
-                warn!(
-                    "the system seems to be a bit unstable: less than 80%, but more than 67% of signers ({accepted_perc:.2}%) accepted proposal {proposal_id}"
-                );
-            }
-            _ => {
-                trace!("{accepted_perc:.2}% of signers accepted proposal {proposal_id}");
-            }
-        }
-
-        // attempt to execute the proposal if it reached the required threshold
-        self.try_finalize_proposal(proposal_id).await
-    }
-
-    async fn maybe_redeem_tickets(&mut self) -> Result<(), EcashTicketError> {
-        if !self.pending_tickets.is_empty() {
-            return Err(EcashTicketError::PendingTickets);
-        }
-
-        let latest_stored = self.shared_state.storage.latest_proposal().await?;
-
-        // check if we have already created the proposal but crashed before persisting it in the db
-        //
-        // if we have some persisted proposals in storage, try to see if there's anything more recent on chain
-        // (i.e. the missing proposal)
-        // if not (i.e. this would have been our first) check the latest page of proposals.
-        // while this is not ideal, realistically speaking we probably crashed few minutes ago
-        // and worst case scenario we'll just recreate the proposal instead
-        //
-        // LIMITATION: if MULTIPLE proposals got created in between, well. though luck.
-        let latest_on_chain = if let Some(latest_stored) = &latest_stored {
-            // those are sorted in ASCENDING way
-            self.shared_state
-                .proposals_since(latest_stored.proposal_id as u64)
-                .await?
-                .pop()
-        } else {
-            // but those are DESCENDING
-            self.shared_state
-                .last_proposal_page()
-                .await?
-                .first()
-                .cloned()
-        };
-
-        let now = OffsetDateTime::now_utc();
-
-        let prior_proposal = match (&latest_stored, latest_on_chain) {
-            (None, None) => {
-                // we haven't created any proposals before
-                trace!("this could be our first redemption proposal");
-                None
-            }
-            (Some(stored), None) => {
-                if stored.created_at + MIN_BATCH_REDEMPTION_DELAY > now {
-                    trace!("too soon to create new redemption proposal");
-                    return Ok(());
-                }
-                None
-            }
-            (_, Some(on_chain)) => {
-                warn!(
-                    "we seem to have crashed after creating proposal, but before persisting it onto disk!"
-                );
-
-                Some(on_chain)
-            }
-        };
-
-        // technically we could have been just caching all of those serial numbers as we verify tickets,
-        // but given how infrequently we call this, there's no point in wasting this memory
-        let verified_tickets = self
-            .shared_state
-            .storage
-            .get_all_verified_tickets_with_sn()
-            .await?;
-
-        // TODO: somehow simplify that nasty nested if
-        if verified_tickets.len() < self.config.minimum_redemption_tickets {
-            // bypass the number of tickets check if we're about to lose our rewards due to expiration
-            if let Some(latest_stored) = latest_stored {
-                if latest_stored.created_at + self.config.maximum_time_between_redemption < now {
-                    {}
-                } else {
-                    debug!(
-                        "we only have {} verified tickets. there's no point in creating a redemption request yet. (we need at least {} (configurable))",
-                        verified_tickets.len(),
-                        self.config.minimum_redemption_tickets
-                    );
-                    return Ok(());
-                }
-            } else {
-                // first proposal
-                debug!(
-                    "we only have {} verified tickets. there's no point in creating a redemption request yet. (we need at least {} (configurable))",
-                    verified_tickets.len(),
-                    self.config.minimum_redemption_tickets
-                );
-                return Ok(());
-            }
-        }
-
-        // this should have been ensured when querying
-        assert!(verified_tickets.len() <= u16::MAX as usize);
-
-        let digest =
-            BatchRedeemTicketsBody::make_digest(verified_tickets.iter().map(|t| &t.serial_number));
-        let encoded_digest = bs58::encode(&digest).into_string();
-
-        let prior_proposal_id = if let Some(prior_proposal) = prior_proposal {
-            if prior_proposal.description == encoded_digest {
-                info!("we have already created proposal for those tickets");
-                Some(prior_proposal.id)
-            } else {
-                warn!(
-                    "our missed proposal seem to have been for different tickets - abandoning it"
-                );
-                None
-            }
-        } else {
-            None
-        };
-
-        // if the proposal has already existed on chain, do use it. otherwise create a new one
-        let proposal_id = if let Some(prior) = prior_proposal_id {
-            prior
-        } else {
-            self.create_redemption_proposal(&digest, verified_tickets.len() as u16)
-                .await?
-        };
-
-        if proposal_id > u32::MAX as u64 {
-            // realistically will we ever reach it? no.
-            panic!(
-                "we have created more than {} proposals. we can't handle that.",
-                u32::MAX
-            )
-        }
-
-        self.shared_state
-            .storage
-            .insert_redemption_proposal(
-                &verified_tickets,
-                proposal_id as u32,
-                OffsetDateTime::now_utc(),
-            )
-            .await?;
-
-        let current_epoch = self.shared_state.current_epoch_id().await?;
-        let api_clients = self.shared_state.api_clients(current_epoch).await?;
-        let ids = api_clients.iter().map(|c| c.node_id).collect();
-        let mut pending = PendingRedemptionVote::new(
-            proposal_id,
-            digest,
-            verified_tickets
-                .into_iter()
-                .map(|t| t.serial_number)
-                .collect(),
-            current_epoch,
-            ids,
-        );
-
-        let resolution = self
-            .try_resolve_pending_proposal(&mut pending, Some(api_clients))
-            .await?;
-        if resolution.is_pending() {
-            warn!(
-                "failed to reach quorum for proposal {proposal_id}. apis: {:?} haven't responded. we'll retry later",
-                pending.pending
-            );
-            self.pending_redemptions.push(pending);
-        } else {
-            self.shared_state
-                .storage
-                .clear_post_proposal_data(
-                    proposal_id as u32,
-                    OffsetDateTime::now_utc(),
-                    resolution.is_rejected(),
-                )
-                .await?;
-        }
-
-        Ok(())
-    }
-
     async fn periodic_operations(&mut self) -> Result<(), EcashTicketError> {
         trace!(
-            "attempting to resolve all pending operations -> tickets that are waiting for verification and possibly redemption"
+            "attempting to resolve all pending operations -> tickets that are waiting for verification"
         );
 
-        // 1. retry all operations that have failed in the past: verification requests and pending redemption
+        // retry the pending verification requests that have failed before
         self.resolve_pending().await?;
 
-        // 2. if applicable, attempt to redeem all newly verified tickets
-        self.maybe_redeem_tickets().await?;
-
         Ok(())
     }
 

common/credential-verification/src/ecash/helpers.rs

@@ -7,7 +7,7 @@ use std::future::Future;
 use std::ops::Deref;
 use tokio::sync::RwLockReadGuard;
 
-pub(crate) fn apis_stream<'a>(
+pub fn apis_stream<'a>(
     // if needed we could make this argument more generic to accept either locks or iterators, etc.
     all_clients: &'a RwLockReadGuard<'a, Vec<EcashApiClient>>,
     filter_by_id: &'a [u64],
@@ -22,7 +22,7 @@ pub(crate) fn apis_stream<'a>(
     )
 }
 
-pub(crate) async fn for_each_api_concurrent<'a, F, Fut>(
+pub async fn for_each_api_concurrent<'a, F, Fut>(
     all_clients: &'a RwLockReadGuard<'a, Vec<EcashApiClient>>,
     filter_by_id: &'a [u64],
     f: F,

common/credential-verification/src/ecash/mod.rs

@@ -20,7 +20,7 @@ use tracing::error;
 
 pub mod credential_sender;
 pub mod error;
-mod helpers;
+pub mod helpers;
 mod state;
 pub mod traits;
 

common/credential-verification/src/ecash/state.rs

@@ -3,17 +3,12 @@
 
 use crate::Error;
 use crate::ecash::error::EcashTicketError;
-use cosmwasm_std::{CosmosMsg, WasmMsg, from_json};
 use nym_credentials_interface::VerificationKeyAuth;
-use nym_ecash_contract_common::msg::ExecuteMsg;
 use nym_gateway_storage::traits::BandwidthGatewayStorage;
 use nym_validator_client::coconut::all_ecash_api_clients;
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::AccountId;
-use nym_validator_client::nyxd::contract_traits::{
-    DkgQueryClient, MultisigQueryClient, NymContractsProvider,
-};
-use nym_validator_client::nyxd::cw3::ProposalResponse;
+use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, NymContractsProvider};
 use nym_validator_client::{DirectSigningHttpRpcNyxdClient, EcashApiClient};
 use std::collections::BTreeMap;
 use std::ops::Deref;
@@ -77,53 +72,6 @@ impl SharedState {
         Ok(this)
     }
 
-    fn created_redemption_proposal(&self, proposal: &ProposalResponse) -> bool {
-        let Some(msg) = proposal.msgs.first() else {
-            return false;
-        };
-        let CosmosMsg::Wasm(WasmMsg::Execute { msg, .. }) = msg else {
-            return false;
-        };
-        let Ok(ExecuteMsg::RedeemTickets { gw, .. }) = from_json(msg) else {
-            return false;
-        };
-
-        gw == self.address.as_ref()
-    }
-
-    /// retrieve all redemption proposals made by this gateway since, but excluding, the provided id
-    pub(crate) async fn proposals_since(
-        &self,
-        proposal_id: u64,
-    ) -> Result<Vec<ProposalResponse>, EcashTicketError> {
-        Ok(self
-            .start_query()
-            .await
-            .list_proposals(Some(proposal_id), None)
-            .await
-            .map_err(EcashTicketError::chain_query_failure)?
-            .proposals
-            .into_iter()
-            .filter(|p| self.created_redemption_proposal(p))
-            .collect())
-    }
-
-    /// retrieve all redemption proposals made by this gateway that are available on the last page of the query
-    pub(crate) async fn last_proposal_page(
-        &self,
-    ) -> Result<Vec<ProposalResponse>, EcashTicketError> {
-        Ok(self
-            .start_query()
-            .await
-            .reverse_proposals(None, None)
-            .await
-            .map_err(EcashTicketError::chain_query_failure)?
-            .proposals
-            .into_iter()
-            .filter(|p| self.created_redemption_proposal(p))
-            .collect())
-    }
-
     async fn set_epoch_data(
         &self,
         epoch_id: EpochId,
@@ -240,24 +188,6 @@ impl SharedState {
             data.get(&epoch_id).map(|d| &d.master_key).unwrap()
         }))
     }
-
-    pub(crate) async fn start_tx(&self) -> RwLockWriteGuard<'_, DirectSigningHttpRpcNyxdClient> {
-        self.nyxd_client.write().await
-    }
-
-    pub(crate) async fn start_query(&self) -> RwLockReadGuard<'_, DirectSigningHttpRpcNyxdClient> {
-        self.nyxd_client.read().await
-    }
-
-    pub(crate) async fn current_epoch_id(&self) -> Result<EpochId, EcashTicketError> {
-        Ok(self
-            .start_query()
-            .await
-            .get_current_epoch()
-            .await
-            .map_err(EcashTicketError::chain_query_failure)?
-            .epoch_id)
-    }
 }
 
 pub(crate) struct EpochState {

common/credentials-interface/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-credentials-interface"
+description = "Interface for Nym's compact eacash / zknym credential scheme"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Interface for Nym's compact eacash / zknym credential scheme"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/credentials/Cargo.toml

@@ -1,12 +1,16 @@
 [package]
 name = "nym-credentials"
+description = "Crate for using Nym's zknym credentials"
 version.workspace = true
+authors.workspace = true
 edition = "2021"
 license.workspace = true
-description = "Crate for using Nym's zknym credentials"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/crypto/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-crypto"
-version.workspace = true
 description = "Crypto library for the nym mixnet"
-edition = { workspace = true }
+version.workspace = true
 authors = { workspace = true }
+edition = { workspace = true }
 license = { workspace = true }
 repository = { workspace = true }
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 aes-gcm-siv = { workspace = true, optional = true }

common/dkg/Cargo.toml

@@ -1,13 +1,17 @@
 [package]
 name = "nym-dkg"
-version.workspace = true
-edition = "2021"
-resolver = "2"
-license.workspace = true
 description = "Nym's Distributed Key Generation functionality"
+version.workspace = true
+authors.workspace = true
+edition = "2021"
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
+resolver = "2"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/ecash-signer-check-types/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-ecash-signer-check-types"
+description = "Crate containing types for the `ecash-signer-check` crate used to check if zknym signers are up and running properly"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Crate containing types for the `ecash-signer-check` crate used to check if zknym signers are up and running properly"
+publish = true
 
 [dependencies]
 semver = { workspace = true }

common/ecash-signer-check/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-ecash-signer-check"
+description = "Functions to interact with zknym signers, checking their status and health"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Functions to interact with zknym signers, checking their status and health"
+publish = true
 
 [dependencies]
 futures = { workspace = true }

common/ecash-time/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-ecash-time"
+description = "Time-related helper functions for Nym's zknym scheme"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Time-related helper functions for Nym's zknym scheme"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/exit-policy/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-exit-policy"
+description = "Get and set the Nym Exit Policy, used by Exit Gateways"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Get and set the Nym Exit Policy, used by Exit Gateways"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/gateway-requests/Cargo.toml

@@ -3,14 +3,17 @@
 
 [package]
 name = "nym-gateway-requests"
+description = "Request and response definitions for Nym Gateway <> client communication"
 version.workspace = true
 authors = ["Jedrzej Stuczynski <andrew@nymtech.net>"]
 edition = "2021"
 license.workspace = true
-description = "Request and response definitions for Nym Gateway <> client communication"
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/gateway-stats-storage/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-gateway-stats-storage"
+description = "Functionality Nym Gateway statistics storage"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
-description = "Functionality Nym Gateway statistics storage"
+readme.workspace = true
+publish = true
 
 [dependencies]
 sqlx = { workspace = true, features = [

common/gateway-storage/Cargo.toml

@@ -1,14 +1,16 @@
 [package]
 name = "nym-gateway-storage"
+description = "Crate handling db setup and use for Nym Gateways, used for credentials, packets, connections"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
-description = "Crate handling db setup and use for Nym Gateways, used for credentials, packets, connections"
+readme.workspace = true
+publish = true
 
 [dependencies]
 async-trait = { workspace = true }

common/http-api-client-macro/Cargo.toml

@@ -1,15 +1,16 @@
 [package]
 name = "nym-http-api-client-macro"
+description = "Proc-macros for configuring HTTP clients globally via the `inventory` crate"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
 rust-version.workspace = true
 readme.workspace = true
-description = "Proc-macros for configuring HTTP clients globally via the `inventory` crate"
+publish = true
 
 [lib]
 proc-macro = true

common/http-api-client/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-http-api-client"
+description = "Nym's HTTP API client, examples, and tests"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Nym's HTTP API client, examples, and tests"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -33,7 +36,9 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 itertools = { workspace = true }
 inventory = { workspace = true }
+fastrand = { workspace = true }
 tokio = { workspace = true, features = ["rt", "macros", "time"] }
+rustls = { workspace=true }
 # used for decoding text responses (they were already implicitly included)
 bytes = { workspace = true }
 encoding_rs = { workspace = true }

common/http-api-client/src/dns.rs

@@ -56,7 +56,6 @@ use std::{
 use hickory_resolver::{
     TokioResolver,
     config::{NameServerConfig, NameServerConfigGroup, ResolverConfig, ResolverOpts},
-    lookup_ip::LookupIpIntoIter,
     name_server::TokioConnectionProvider,
 };
 use once_cell::sync::OnceCell;
@@ -227,9 +226,11 @@ async fn resolve(
     let primary_err = match resolve_fut.await {
         Err(_) => ResolveError::Timeout,
         Ok(Ok(lookup)) => {
-            let addrs: Addrs = Box::new(SocketAddrs {
-                iter: lookup.into_iter(),
-            });
+            // Shuffle so that successive connection attempts cycle through all
+            // returned IPs rather than always hitting the same first address.
+            let mut ips: Vec<IpAddr> = lookup.into_iter().collect();
+            fastrand::shuffle(&mut ips);
+            let addrs: Addrs = Box::new(ips.into_iter().map(|ip| SocketAddr::new(ip, 0)));
             return Ok(addrs);
         }
         Ok(Err(e)) => {
@@ -256,18 +257,6 @@ async fn resolve(
     Err(primary_err)
 }
 
-struct SocketAddrs {
-    iter: LookupIpIntoIter,
-}
-
-impl Iterator for SocketAddrs {
-    type Item = SocketAddr;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        self.iter.next().map(|ip_addr| SocketAddr::new(ip_addr, 0))
-    }
-}
-
 impl HickoryDnsResolver {
     /// Returns an instance of the shared resolver.
     pub fn shared() -> Self {

common/http-api-client/src/dns/constants.rs

@@ -4,7 +4,7 @@ use std::collections::HashMap;
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
 pub const NYM_API_DOMAIN: &str = "validator.nymtech.net";
-pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))];
+pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(92, 39, 63, 14))];
 
 pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com";
 pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))];

common/http-api-client/src/lib.rs

@@ -161,6 +161,8 @@ use reqwest::{RequestBuilder, Response};
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use std::fmt::Display;
+#[cfg(not(target_arch = "wasm32"))]
+use std::io::ErrorKind;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::Duration;
 use thiserror::Error;
@@ -1150,7 +1152,10 @@ impl ApiClientCore for Client {
 
             #[cfg(target_arch = "wasm32")]
             let response: Result<Response, HttpClientError> = {
-                let client = self.reqwest_client.as_ref().unwrap_or(&*SHARED_CLIENT);
+                let client = self
+                    .reqwest_client
+                    .as_ref()
+                    .unwrap_or_else(|| &*SHARED_CLIENT);
                 Ok(
                     wasmtimer::tokio::timeout(self.request_timeout, client.execute(req))
                         .await
@@ -1160,21 +1165,20 @@ impl ApiClientCore for Client {
 
             #[cfg(not(target_arch = "wasm32"))]
             let response = {
-                let client = self.reqwest_client.as_ref().unwrap_or(&*SHARED_CLIENT);
+                let client = self
+                    .reqwest_client
+                    .as_ref()
+                    .unwrap_or_else(|| &*SHARED_CLIENT);
                 client.execute(req).await
             };
 
             match response {
                 Ok(resp) => return Ok(resp),
                 Err(err) => {
-                    // only if there was a network issue should we consider updating the host info
-                    //
-                    // note: for now this includes DNS resolution failure, I am not sure how I would go about
-                    // segregating that based on the interface provided by request for errors.
                     #[cfg(target_arch = "wasm32")]
                     let is_network_err = err.is_timeout();
                     #[cfg(not(target_arch = "wasm32"))]
-                    let is_network_err = err.is_timeout() || err.is_connect();
+                    let is_network_err = might_be_network_interference(&err);
 
                     if is_network_err {
                         // if we have multiple urls, update to the next
@@ -1222,6 +1226,68 @@ impl ApiClientCore for Client {
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_ERR_SOURCE_ITERATIONS: usize = 4;
+
+/// This functions attempts to check the error returned by reqwest to see if
+/// rotating host informtion (for clients with mutliple hosts defined) could be
+/// helpful. This looks for situations where the error could plausibly be caused
+/// by a network adversary, or where rotating to an equival hostname might help.
+///
+/// For example --> NetworkUnreachable will not be helped by rotating domains,
+/// but ConnectionReset might be caused by a network adversary blocking by SNI
+/// which could possibly benefit from rotating domains.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn might_be_network_interference(err: &reqwest::Error) -> bool {
+    if err.is_timeout() {
+        return true;
+    }
+
+    if !(err.is_connect() || err.is_request()) {
+        return false;
+    }
+
+    // The io::Error source is several layers deep, for clarity this is done as a loop
+    // * reqwest::Error -> hyper_util::Error
+    // * hyper_util::Error -> hyper_util::ClientError
+    // * hyper_util::ClientError -> io::Error
+    let mut inner = err.source();
+    for _ in 0..MAX_ERR_SOURCE_ITERATIONS {
+        if let Some(e) = inner {
+            if let Some(io_err) = e.downcast_ref::<std::io::Error>() {
+                // try downcast to io::Error from <dyn std::error:Error>
+                match io_err.kind() {
+                    // device not connected to the internet
+                    ErrorKind::NetworkUnreachable | ErrorKind::NetworkDown => return false,
+                    // connection errors can indicate connection interference
+                    ErrorKind::ConnectionReset
+                    | ErrorKind::HostUnreachable
+                    | ErrorKind::ConnectionRefused => return true,
+                    // TLS errors get wrapped in custom io::Errors
+                    ErrorKind::Other | ErrorKind::InvalidData => {
+                        // io::Error get_ref works while source doesn't here -_-
+                        //   if you don't like it take it up with the rust devs https://users.rust-lang.org/t/question-about-implementation-of-std-source/121117
+                        inner = io_err.get_ref().map(|e| e as &dyn std::error::Error);
+                    }
+                    _ => return false,
+                }
+            } else if let Some(_tls_err) = e.downcast_ref::<rustls::Error>() {
+                // try downcast to TLS error
+                return true;
+            } else if let Some(resolve_err) = e.downcast_ref::<hickory_resolver::ResolveError>() {
+                // try downcast to DNS error
+                return resolve_err.is_nx_domain();
+            } else {
+                inner = e.source();
+            }
+        } else {
+            break;
+        }
+    }
+
+    false
+}
+
 /// Common usage functionality for the http client.
 ///
 /// These functions allow for cleaner downstream usage free of type parameters and unneeded imports.

common/http-api-common/Cargo.toml

@@ -1,13 +1,16 @@
 [package]
 name = "nym-http-api-common"
+description = "Common crate for Nym-related HTTP API interaction"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Common crate for Nym-related HTTP API interaction"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 

common/inclusion-probability/Cargo.toml

@@ -1,11 +1,16 @@
 [package]
 name = "nym-inclusion-probability"
-version.workspace = true
 description = "Nym active set probability simulator"
-edition.workspace = true
+version.workspace = true
 authors.workspace = true
+edition.workspace = true
 license.workspace = true
 repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 [dependencies]
 log = { workspace = true }

common/ip-packet-requests/Cargo.toml

@@ -1,16 +1,23 @@
 [package]
 name = "nym-ip-packet-requests"
+description = "Codec, signing functionality, and different version definitions for IP packet request and responses"
 version.workspace = true
 authors.workspace = true
+edition.workspace = true
+license.workspace = true
 repository.workspace = true
 homepage.workspace = true
 documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-description = "Codec, signing functionality, and different version definitions for IP packet request and responses"
+rust-version.workspace = true
+readme.workspace = true
+publish = true
 
 
+[features]
+test-utils = ["pnet_packet"]
+
 [dependencies]
+pnet_packet = { workspace = true, optional = true }
 bincode = { workspace = true }
 bytes = { workspace = true }
 nym-bin-common = { workspace = true }
@@ -18,8 +25,10 @@ nym-crypto = { workspace = true }
 nym-service-provider-requests-common = { workspace = true }
 nym-sphinx = { workspace = true }
 rand = { workspace = true }
+semver = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
 time = { workspace = true }
 tokio = { workspace = true, features = ["time"] }
 tokio-util = { workspace = true, features = ["codec"] }
+tracing = { workspace = true }

common/ip-packet-requests/src/icmp_utils.rs

@@ -0,0 +1,117 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// Extracted from sdk/rust/nym-sdk/examples/ipr_tunnel.rs
+
+//! ICMP/ICMPv6 packet construction and reply detection helpers for testing
+//! IPR connectivity. Gated behind the `test-utils` feature.
+
+use std::net::{Ipv4Addr, Ipv6Addr};
+
+use pnet_packet::Packet;
+use pnet_packet::icmp::echo_reply::EchoReplyPacket;
+use pnet_packet::icmp::echo_request::MutableEchoRequestPacket;
+use pnet_packet::icmp::{IcmpPacket, IcmpTypes};
+use pnet_packet::icmpv6::Icmpv6Types;
+use pnet_packet::ipv4::{Ipv4Flags, MutableIpv4Packet};
+use pnet_packet::ipv6::MutableIpv6Packet;
+
+/// Build a complete IPv4 ICMP echo request packet.
+pub fn build_icmp_ping(src: Ipv4Addr, dst: Ipv4Addr, seq: u16) -> Option<Vec<u8>> {
+    let mut echo = MutableEchoRequestPacket::owned(vec![0u8; 64])?;
+    echo.set_icmp_type(IcmpTypes::EchoRequest);
+    echo.set_icmp_code(pnet_packet::icmp::IcmpCode::new(0));
+    echo.set_sequence_number(seq);
+    let cksum = pnet_packet::icmp::checksum(&IcmpPacket::new(echo.packet())?);
+    echo.set_checksum(cksum);
+
+    let total_len = 20 + echo.packet().len();
+    let mut ip = MutableIpv4Packet::owned(vec![0u8; total_len])?;
+    ip.set_version(4);
+    ip.set_header_length(5);
+    ip.set_total_length(total_len as u16);
+    ip.set_ttl(64);
+    ip.set_next_level_protocol(pnet_packet::ip::IpNextHeaderProtocols::Icmp);
+    ip.set_source(src);
+    ip.set_destination(dst);
+    ip.set_flags(Ipv4Flags::DontFragment);
+    ip.set_payload(echo.packet());
+
+    let mut buf = ip.consume_to_immutable().packet().to_vec();
+    let cksum = ipv4_checksum(&buf);
+    buf[10] = (cksum >> 8) as u8;
+    buf[11] = cksum as u8;
+    Some(buf)
+}
+
+/// Build a complete IPv6 ICMPv6 echo request packet.
+pub fn build_icmpv6_ping(src: Ipv6Addr, dst: Ipv6Addr, seq: u16) -> Option<Vec<u8>> {
+    let mut echo =
+        pnet_packet::icmpv6::echo_request::MutableEchoRequestPacket::owned(vec![0u8; 64])?;
+    echo.set_icmpv6_type(Icmpv6Types::EchoRequest);
+    echo.set_icmpv6_code(pnet_packet::icmpv6::Icmpv6Code::new(0));
+    echo.set_sequence_number(seq);
+    let cksum = pnet_packet::icmpv6::checksum(
+        &pnet_packet::icmpv6::Icmpv6Packet::new(echo.packet())?,
+        &src,
+        &dst,
+    );
+    echo.set_checksum(cksum);
+
+    let payload_len = echo.packet().len();
+    let mut ip = MutableIpv6Packet::owned(vec![0u8; 40 + payload_len])?;
+    ip.set_version(6);
+    ip.set_payload_length(payload_len as u16);
+    ip.set_next_header(pnet_packet::ip::IpNextHeaderProtocols::Icmpv6);
+    ip.set_hop_limit(64);
+    ip.set_source(src);
+    ip.set_destination(dst);
+    ip.set_payload(echo.packet());
+
+    Some(ip.consume_to_immutable().packet().to_vec())
+}
+
+/// Check if a raw packet is an IPv4 ICMP echo reply destined to `expected_dst`.
+pub fn is_echo_reply_v4(data: &[u8], expected_dst: Ipv4Addr) -> bool {
+    let Some(ip) = pnet_packet::ipv4::Ipv4Packet::new(data) else {
+        return false;
+    };
+    if ip.get_destination() != expected_dst {
+        return false;
+    }
+    if ip.get_next_level_protocol() != pnet_packet::ip::IpNextHeaderProtocols::Icmp {
+        return false;
+    }
+    let Some(reply) = EchoReplyPacket::new(ip.payload()) else {
+        return false;
+    };
+    reply.get_icmp_type() == IcmpTypes::EchoReply
+}
+
+/// Check if a raw packet is an IPv6 ICMPv6 echo reply destined to `expected_dst`.
+pub fn is_echo_reply_v6(data: &[u8], expected_dst: Ipv6Addr) -> bool {
+    let Some(ip) = pnet_packet::ipv6::Ipv6Packet::new(data) else {
+        return false;
+    };
+    if ip.get_destination() != expected_dst {
+        return false;
+    }
+    if ip.get_next_header() != pnet_packet::ip::IpNextHeaderProtocols::Icmpv6 {
+        return false;
+    }
+    let Some(reply) = pnet_packet::icmpv6::echo_reply::EchoReplyPacket::new(ip.payload()) else {
+        return false;
+    };
+    reply.get_icmpv6_type() == Icmpv6Types::EchoReply
+}
+
+fn ipv4_checksum(header: &[u8]) -> u16 {
+    let mut sum = 0u32;
+    for i in (0..20).step_by(2) {
+        sum += ((header[i] as u32) << 8) | header[i + 1] as u32;
+    }
+    while (sum >> 16) > 0 {
+        sum = (sum & 0xFFFF) + (sum >> 16);
+    }
+    !sum as u16
+}

common/ip-packet-requests/src/lib.rs

@@ -3,10 +3,37 @@ use std::fmt::{Display, Formatter};
 use std::net::{Ipv4Addr, Ipv6Addr};
 
 pub mod codec;
+#[cfg(feature = "test-utils")]
+pub mod icmp_utils;
+pub mod response_helpers;
 pub mod sign;
 pub mod v6;
 pub mod v7;
 pub mod v8;
+pub mod v9;
+
+/// Highest IPR protocol version that is allowed to be sent as a **non-stream** mixnet payload
+/// (i.e. not wrapped in `LpFrameKind::SphinxStream`).
+pub const MAX_NON_STREAM_VERSION: u8 = v8::VERSION;
+
+/// First IPR protocol version that **requires** the SphinxStream (LP) transport for non-stream
+/// mixnet sends, matching the node-side enforcement in `ip-packet-router`.
+pub const SPHINX_STREAM_VERSION_THRESHOLD: u8 = v9::VERSION;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const _: () = {
+        assert!(SPHINX_STREAM_VERSION_THRESHOLD > MAX_NON_STREAM_VERSION);
+    };
+
+    #[test]
+    fn stream_transport_threshold_is_consistent() {
+        assert_eq!(MAX_NON_STREAM_VERSION, 8);
+        assert_eq!(SPHINX_STREAM_VERSION_THRESHOLD, 9);
+    }
+}
 
 // version 3: initial version
 // version 4: IPv6 support
@@ -14,6 +41,8 @@ pub mod v8;
 // version 6: Increase the available IPs
 // version 7: Add signature support (for the future)
 // version 8: Anonymous sends
+// version 9: LP-framed transport (SphinxStream)
+// response_helpers: shared IPR response parsing (nym-ip-packet-client + nym-sdk)
 
 #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct IpPair {

common/ip-packet-requests/src/response_helpers.rs

@@ -0,0 +1,134 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use bytes::{Bytes, BytesMut};
+use tokio_util::codec::Decoder;
+use tracing::{error, info, warn};
+
+use crate::{
+    IpPair,
+    codec::MultiIpPacketCodec,
+    v8::response::{
+        ConnectResponseReply, ControlResponse, InfoLevel, IpPacketResponse, IpPacketResponseData,
+    },
+};
+
+#[derive(Debug, thiserror::Error)]
+pub enum IprResponseError {
+    #[error("no version byte in message")]
+    NoVersionByte,
+
+    #[error("version mismatch: received v{received}, expected v{expected}")]
+    VersionMismatch { expected: u8, received: u8 },
+
+    #[error("expected control response, got {0:?}")]
+    UnexpectedResponse(IpPacketResponseData),
+
+    #[error("connect denied: {0:?}")]
+    ConnectDenied(crate::v8::response::ConnectFailureReason),
+}
+
+pub enum MixnetMessageOutcome {
+    IpPackets(Vec<Bytes>),
+    Disconnect,
+}
+
+// Extracted from:
+//   nym-ip-packet-client/src/helpers.rs — check_ipr_message_version()
+//   sdk/rust/nym-sdk/src/ip_packet_client/listener.rs — check_ipr_message_version()
+/// Check that the first byte of an IPR message matches the expected protocol version.
+pub fn check_ipr_message_version(data: &[u8], expected: u8) -> Result<(), IprResponseError> {
+    let version = data.first().ok_or(IprResponseError::NoVersionByte)?;
+    if *version != expected {
+        return Err(IprResponseError::VersionMismatch {
+            expected,
+            received: *version,
+        });
+    }
+    Ok(())
+}
+
+// Extracted from:
+//   nym-ip-packet-client/src/connect.rs — handle_connect_response() + handle_ip_packet_router_response()
+//   sdk/rust/nym-sdk/src/ip_packet_client/discovery.rs — parse_connect_response()
+/// Parse an IPR connect response, returning allocated IPs on success.
+pub fn parse_connect_response(response: IpPacketResponse) -> Result<IpPair, IprResponseError> {
+    let control_response = match response.data {
+        IpPacketResponseData::Control(c) => c,
+        other => return Err(IprResponseError::UnexpectedResponse(other)),
+    };
+
+    match *control_response {
+        ControlResponse::Connect(connect_resp) => match connect_resp.reply {
+            ConnectResponseReply::Success(success) => Ok(success.ips),
+            ConnectResponseReply::Failure(reason) => Err(IprResponseError::ConnectDenied(reason)),
+        },
+        _ => Err(IprResponseError::UnexpectedResponse(
+            IpPacketResponseData::Control(control_response),
+        )),
+    }
+}
+
+// Extracted from:
+//   nym-ip-packet-client/src/listener.rs — IprListener::handle_reconstructed_message()
+//   sdk/rust/nym-sdk/src/ip_packet_client/listener.rs — handle_ipr_response()
+/// Parse raw IPR response bytes into an outcome.
+///
+/// Logs non-fatal conditions (unknown control messages, deserialization
+/// failures) and returns `None` for them.
+pub fn handle_ipr_response(data: &[u8]) -> Option<MixnetMessageOutcome> {
+    match IpPacketResponse::from_bytes(data) {
+        Ok(response) => match response.data {
+            IpPacketResponseData::Data(data_response) => {
+                let mut codec = MultiIpPacketCodec::new();
+                let mut buf = BytesMut::from(data_response.ip_packet.as_ref());
+                let mut packets = Vec::new();
+                loop {
+                    match codec.decode(&mut buf) {
+                        Ok(Some(packet)) => packets.push(packet.into_bytes()),
+                        Ok(None) => break,
+                        Err(e) => {
+                            warn!("Failed to decode bundled IP packet: {e}");
+                            break;
+                        }
+                    }
+                }
+                Some(MixnetMessageOutcome::IpPackets(packets))
+            }
+            IpPacketResponseData::Control(control_response) => match *control_response {
+                ControlResponse::Connect(_) => {
+                    info!("Received connect response when already connected - ignoring");
+                    None
+                }
+                ControlResponse::Disconnect(_) | ControlResponse::UnrequestedDisconnect(_) => {
+                    info!("Received disconnect from IPR");
+                    Some(MixnetMessageOutcome::Disconnect)
+                }
+                ControlResponse::Pong(_) => {
+                    info!("Received pong response");
+                    None
+                }
+                ControlResponse::Health(_) => {
+                    info!("Received health response");
+                    None
+                }
+                ControlResponse::Info(info_resp) => {
+                    let msg = format!(
+                        "Received info response from the mixnet: {}",
+                        info_resp.reply
+                    );
+                    match info_resp.level {
+                        InfoLevel::Info => info!("{msg}"),
+                        InfoLevel::Warn => warn!("{msg}"),
+                        InfoLevel::Error => error!("{msg}"),
+                    }
+                    None
+                }
+            },
+        },
+        Err(err) => {
+            warn!("Failed to deserialize IPR response: {err}");
+            None
+        }
+    }
+}

common/ip-packet-requests/src/v8/response.rs

@@ -179,11 +179,15 @@ impl IpPacketResponse {
         make_bincode_serializer().serialize(self)
     }
 
+    pub fn from_bytes(data: &[u8]) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(data)
+    }
+
     pub fn from_reconstructed_message(
         message: &nym_sphinx::receiver::ReconstructedMessage,
     ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
+        Self::from_bytes(&message.message)
     }
 }