included sample contract queries

sample contract
[DOCs/operators]: Cleanup (#6184 )
2025-11-10 16:01:44 +00:00 · 2025-11-10 14:41:46 +00:00 · 2025-11-10 14:20:15 +00:00 · 2025-11-10 12:21:20 +00:00 · 2025-11-07 21:17:42 +00:00 · 2025-11-07 15:41:59 +00:00
264 changed files with 9403 additions and 10146 deletions
@@ -8,10 +8,13 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'nym-api/**'
+      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
+      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
      - 'nym-node-status-api/**'
+      - 'nym-registration-client/**'
      - 'nym-statistics-api/**'
      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
@@ -54,7 +54,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: test
-          args: --lib --manifest-path contracts/Cargo.toml
+          args: --lib --manifest-path contracts/Cargo.toml --all-features

      - name: Check formatting
        uses: actions-rs/cargo@v1
@@ -6,16 +6,14 @@ on:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
-      - "nym-connect/desktop/src/**"
-      - "nym-connect/desktop/package.json"
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
-      - "explorer/**"
+      - "explorer-v2/**"
      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: ubuntu-22.04
+    runs-on: arc-linux-latest
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
@@ -25,6 +23,7 @@ jobs:
      - uses: actions/setup-node@v4
        with:
          node-version: 20
+          
      - name: Setup yarn
        run: npm install -g yarn

@@ -37,14 +36,12 @@ jobs:
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Install wasm-opt
-        uses: ./.github/actions/install-wasm-opt
-        with:
-          version: '116'
+        run: cargo install wasm-opt

      - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version: "1.23.7"
+          go-version: "1.24.6"

      - name: Install
        run: yarn
@@ -52,7 +49,11 @@ jobs:
      - name: Build packages
        run: yarn build:ci

+      - name: Install again
+        run: yarn
+
      - name: Lint
        run: yarn lint
+        
      - name: Typecheck with tsc
        run: yarn tsc
@@ -8,7 +8,7 @@ on:

 jobs:
  build:
-    runs-on: custom-linux
+    runs-on: arc-linux-latest
    steps:
      - uses: actions/checkout@v4

@@ -4,7 +4,7 @@ on:

 jobs:
  publish:
-    runs-on: arc-ubuntu-22.04
+    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

@@ -17,10 +17,13 @@ jobs:
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install Rust stable
+      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
+          profile: minimal
          toolchain: stable
+          override: true
+          components: rustfmt, clippy

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -29,9 +32,9 @@ jobs:
        run: cargo install wasm-opt

      - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version: "1.23.7"
+          go-version: "1.24.6"

      - name: Install dependencies
        run: yarn
@@ -3,11 +3,6 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
-      gateway_probe_git_ref:
-        type: string
-        default: nym-vpn-core-v1.4.0
-        required: true
-        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -43,16 +38,6 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

-      - name: cleanup-gateway-probe-ref
-        id: cleanup_gateway_probe_ref
-        run: |
-          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
-          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
-          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
-
-      - name: Set GIT_TAG variable
-        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
-
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -61,24 +46,12 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
-
-      # - name: Remove existing tag if exists
-      #   run: |
-      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
-      #       git push --delete origin $${{ env.GIT_TAG }}
-      #       git tag -d $${{ env.GIT_TAG }}
-      #     fi
-
-      # - name: Create tag
-      #   run: |
-      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
-      #     git push origin $${{ env.GIT_TAG }}
+        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,6 +4,90 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2025.19-kase] (2025-10-30)
+
+- update ns agent workflow ([#6154])
+- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
+- bugfix: nym-credential-proxy query params parsing regression ([#6121])
+- bugfix: revert some dep updates introduced in #6043 ([#6120])
+- Skip ipv6 metadata endpoint request ([#6118])
+- update to no longer use 1mb files ([#6117])
+- chore: restore pending dkg contract state migration ([#6116])
+- Revert "Propagate cancel token to mixnet client" ([#6115])
+- Update dirs to 6.0 ([#6109])
+- Propagate cancel token to mixnet client ([#6105])
+- bugfix: retrieve and update ticketbook in the same query ([#6101])
+- bugfix: include network name in the default gateway probe config path ([#6100])
+- Bugfix/incompatibility fixes ([#6099])
+- [DOCs/operators] QUIC deployment script & docs ([#6098])
+- bugfix: testnet manager 02sql migration ([#6096])
+- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
+- bugfix: use custom topology provider for list of init gateways ([#6092])
+- Max/fix wasm client + build commands ([#6043])
+
+[#6154]: https://github.com/nymtech/nym/pull/6154
+[#6153]: https://github.com/nymtech/nym/pull/6153
+[#6121]: https://github.com/nymtech/nym/pull/6121
+[#6120]: https://github.com/nymtech/nym/pull/6120
+[#6118]: https://github.com/nymtech/nym/pull/6118
+[#6117]: https://github.com/nymtech/nym/pull/6117
+[#6116]: https://github.com/nymtech/nym/pull/6116
+[#6115]: https://github.com/nymtech/nym/pull/6115
+[#6109]: https://github.com/nymtech/nym/pull/6109
+[#6105]: https://github.com/nymtech/nym/pull/6105
+[#6101]: https://github.com/nymtech/nym/pull/6101
+[#6100]: https://github.com/nymtech/nym/pull/6100
+[#6099]: https://github.com/nymtech/nym/pull/6099
+[#6098]: https://github.com/nymtech/nym/pull/6098
+[#6096]: https://github.com/nymtech/nym/pull/6096
+[#6094]: https://github.com/nymtech/nym/pull/6094
+[#6092]: https://github.com/nymtech/nym/pull/6092
+[#6043]: https://github.com/nymtech/nym/pull/6043
+
+## [2025.18-jarlsberg] (2025-10-14)
+
+- ns-api: add descriptions to dVPN gateway responses ([#6102])
+- NS API: use new probe download filesize and milliseconds field ([#6097])
+- ns-api: use download files size from probes instead of parsing filenames ([#6095])
+- ns-api: add new fields for probe output for query_metadata and download file size and duration in ms ([#6091])
+- Bugfix/bloomfilters purge ([#6089])
+- Hotfix: Update API source in node ping tester script ([#6082])
+- Get wireguard keypair as arg instead of reading it from disk ([#6078])
+- Feature: Ping probe all nodes /described nodes from a server ([#6074])
+- Node Status API: add bridge information to dVPN endpoint ([#6069])
+- frontdoor typo fix ([#6067])
+- Feature: Node rewards tracker ([#6064])
+- [chore] Clippy fix ([#6060])
+- Registration Client ([#6059])
+- Bugfix: Nym node CLI download nym-node exception ([#6058])
+- Feature: Nym node html landing page ([#6053])
+- feat: DKG contract method for updating announce address ([#6050])
+- feat: NS ticket faucet ([#6047])
+- Bridge proto client params in Self-Described ([#6035])
+- Node Status API: remove sqlite support ([#6004])
+- Benny/ci contract fix ([#5962])
+
+[#6102]: https://github.com/nymtech/nym/pull/6102
+[#6097]: https://github.com/nymtech/nym/pull/6097
+[#6095]: https://github.com/nymtech/nym/pull/6095
+[#6091]: https://github.com/nymtech/nym/pull/6091
+[#6089]: https://github.com/nymtech/nym/pull/6089
+[#6082]: https://github.com/nymtech/nym/pull/6082
+[#6078]: https://github.com/nymtech/nym/pull/6078
+[#6074]: https://github.com/nymtech/nym/pull/6074
+[#6069]: https://github.com/nymtech/nym/pull/6069
+[#6067]: https://github.com/nymtech/nym/pull/6067
+[#6064]: https://github.com/nymtech/nym/pull/6064
+[#6060]: https://github.com/nymtech/nym/pull/6060
+[#6059]: https://github.com/nymtech/nym/pull/6059
+[#6058]: https://github.com/nymtech/nym/pull/6058
+[#6053]: https://github.com/nymtech/nym/pull/6053
+[#6050]: https://github.com/nymtech/nym/pull/6050
+[#6047]: https://github.com/nymtech/nym/pull/6047
+[#6035]: https://github.com/nymtech/nym/pull/6035
+[#6004]: https://github.com/nymtech/nym/pull/6004
+[#5962]: https://github.com/nymtech/nym/pull/5962
+
 ## [2025.17-isabirra] (2025-09-29)

 - Bugfix | Fix the registration handshake ([#6062])
@@ -150,7 +150,7 @@ members = [
    "tools/internal/contract-state-importer/importer-cli",
    "tools/internal/contract-state-importer/importer-contract",
    "tools/internal/mixnet-connectivity-check",
-    # "tools/internal/sdk-version-bump",
+#    "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
@@ -166,7 +166,7 @@ members = [
    "wasm/node-tester",
    "wasm/zknym-lib",
    "nym-gateway-probe"
-]
+, "query-tester"]

 default-members = [
    "clients/native",
@@ -215,7 +215,6 @@ base64 = "0.22.1"
 base85rs = "0.1.3"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
-bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
 blake3 = "1.7.0"
 bloomfilter = "3.0.1"
@@ -243,13 +242,11 @@ criterion = "0.5"
 csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
-curve25519-dalek = "4.1"
 dashmap = "5.5.3"
 # We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
 defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
 digest = "0.10.7"
-dirs = "5.0"
-doc-comment = "0.3"
+dirs = "6.0"
 dotenvy = "0.15.6"
 dyn-clone = "1.0.19"
 ecdsa = "0.16"
@@ -265,11 +262,8 @@ futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getset = "0.1.5"
 handlebars = "3.5.5"
-headers = "0.4.0"
 hex = "0.4.3"
-hex-literal = "0.3.3"
 hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
@@ -293,12 +287,10 @@ lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
-maxminddb = "0.23.0"
 mime = "0.3.17"
 moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
-okapi = "0.7.0"
 once_cell = "1.21.3"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
@@ -307,7 +299,6 @@ pem = "0.8"
 petgraph = "0.6.5"
 pin-project = "1.1"
 pnet_packet = "0.35.0"
-pin-project-lite = "0.2.16"
 publicsuffix = "2.3.0"
 proc_pidinfo = "0.1.3"
 quote = "1"
@@ -315,13 +306,10 @@ rand = "0.8.5"
 rand_chacha = "0.3"
 rand_core = "0.6.3"
 rand_distr = "0.4"
-rand_pcg = "0.3.1"
-rand_seeder = "0.2.3"
 rayon = "1.5.1"
 regex = "1.10.6"
 reqwest = { version = "0.12.15", default-features = false }
 rs_merkle = "1.5.0"
-safer-ffi = "0.1.13"
 schemars = "0.8.22"
 semver = "1.0.26"
 serde = "1.0.219"
@@ -368,6 +356,7 @@ tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
 ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
+typed-builder = "0.23.0"
 uniffi = "0.29.2"
 uniffi_build = "0.29.0"
 url = "2.5"
@@ -464,6 +453,11 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }

 [workspace.lints.clippy]
+suspicious = "deny"
+complexity = "deny"
+perf = "deny"
+style = "deny"
+
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"
@@ -107,16 +107,16 @@ sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
-	# $(MAKE) -C wasm/mix-fetch
+	$(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
 	# $(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	# npx lerna run --scope @nymproject/mix-fetch build --stream
-	# npx lerna run --scope @nymproject/node-tester build --stream
-	# yarn --cwd sdk/typescript/codegen/contract-clients build
+	npx lerna run --scope @nymproject/mix-fetch build --stream
+	npx lerna run --scope @nymproject/node-tester build --stream
+	yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
 WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
@@ -140,7 +140,8 @@ clippy: sdk-wasm-lint

 WASM_CONTRACT_DIR := contracts/target/wasm32-unknown-unknown/release
 # Find every direct contract folder that contains a Cargo.toml
-CONTRACT_DIRS := $(shell find contracts -type f -name Cargo.toml \( ! -path "contracts/Cargo.toml" \) | grep -v integration-tests | xargs -n1 dirname | sort -u)
+#CONTRACT_DIRS := $(shell find contracts -type f -name Cargo.toml \( ! -path "contracts/Cargo.toml" \) | grep -v integration-tests | xargs -n1 dirname | sort -u)
+CONTRACT_DIRS := contracts/example-contract

 CONTRACTS_OUT_DIR = contracts/artifacts

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.63"
+version = "1.1.65"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -60,6 +60,7 @@ impl SocketClient {
        let ClientInput {
            connection_command_sender,
            input_sender,
+            ..
        } = client_input;

        let ClientOutput {
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.63"
+version = "1.1.65"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -36,7 +36,7 @@ nym-bandwidth-controller = { path = "../bandwidth-controller" }
 nym-crypto = { path = "../crypto" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../gateway-requests" }
-nym-http-api-client = { path = "../http-api-client" }
+nym-http-api-client = { path = "../http-api-client", features = ["network-defaults"] }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-statistics-common = { path = "../statistics" }
@@ -114,13 +114,12 @@ where
        })?;
        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
-        let mut rng = rand::thread_rng();
        crate::init::helpers::gateways_for_init(
-            &mut rng,
            &core.client.nym_api_urls,
            user_agent,
            core.debug.topology.minimum_gateway_performance,
            core.debug.topology.ignore_ingress_epoch_role,
+            None,
        )
        .await?
    };
@@ -173,13 +173,12 @@ where
        })?;
        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
-        let mut rng = rand::thread_rng();
        crate::init::helpers::gateways_for_init(
-            &mut rng,
            &core.client.nym_api_urls,
            user_agent,
            core.debug.topology.minimum_gateway_performance,
            core.debug.topology.ignore_ingress_epoch_role,
+            None,
        )
        .await?
    };
@@ -7,11 +7,12 @@ use super::statistics_control::StatisticsControl;
 use crate::client::base_client::storage::helpers::store_client_keys;
 use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
+use crate::client::event_control::EventControl;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::key_manager::ClientKeys;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
-use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
+use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController, MixTrafficEvent};
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -66,13 +67,16 @@ use std::path::Path;
 use std::sync::Arc;
 use time::OffsetDateTime;
 use tokio::sync::mpsc::Sender;
-use tracing::*;
 use url::Url;

 #[cfg(target_arch = "wasm32")]
 #[cfg(debug_assertions)]
 use wasm_utils::console_log;

+/// Default number of retries for Nym API requests when using network details with domain fronting.
+/// This allows the client to try alternative URLs if the primary endpoint is unavailable.
+const DEFAULT_NYM_API_RETRIES: usize = 3;
+
 #[cfg(all(
    not(target_arch = "wasm32"),
    feature = "fs-surb-storage",
@@ -83,10 +87,28 @@ pub mod non_wasm_helpers;
 pub mod helpers;
 pub mod storage;

+#[derive(Clone, Copy, Debug)]
+pub enum MixnetClientEvent {
+    Traffic(MixTrafficEvent),
+}
+
+pub type EventReceiver = mpsc::UnboundedReceiver<MixnetClientEvent>;
+#[derive(Clone)]
+pub struct EventSender(pub mpsc::UnboundedSender<MixnetClientEvent>);
+
+impl EventSender {
+    pub fn send(&self, event: MixnetClientEvent) {
+        if let Err(err) = self.0.unbounded_send(event) {
+            tracing::warn!("Failed to send error event. The caller event reader was closed: {err}");
+        }
+    }
+}
+
 #[derive(Clone)]
 pub struct ClientInput {
    pub connection_command_sender: ConnectionCommandSender,
    pub input_sender: InputMessageSender,
+    pub client_request_sender: ClientRequestSender,
 }

 impl ClientInput {
@@ -194,10 +216,14 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
    client_store: S,
    dkg_query_client: Option<C>,

+    // Optional API URLs for domain fronting support
+    nym_api_urls: Option<Vec<nym_network_defaults::ApiUrl>>,
+
    wait_for_gateway: bool,
    custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
    custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
    shutdown: Option<ShutdownTracker>,
+    event_tx: Option<EventSender>,
    user_agent: Option<UserAgent>,

    setup_method: GatewaySetup,
@@ -222,10 +248,12 @@ where
            config: base_config,
            client_store,
            dkg_query_client,
+            nym_api_urls: None,
            wait_for_gateway: false,
            custom_topology_provider: None,
            custom_gateway_transceiver: None,
            shutdown: None,
+            event_tx: None,
            user_agent: None,
            setup_method: GatewaySetup::MustLoad { gateway_id: None },
            #[cfg(unix)]
@@ -243,6 +271,16 @@ where
        self
    }

+    /// Set Nym API URLs for domain fronting support.
+    ///
+    /// When provided, the client will use these API URLs (which include front_hosts)
+    /// to construct HTTP clients with domain fronting enabled.
+    #[must_use]
+    pub fn with_nym_api_urls(mut self, nym_api_urls: Vec<nym_network_defaults::ApiUrl>) -> Self {
+        self.nym_api_urls = Some(nym_api_urls);
+        self
+    }
+
    #[must_use]
    pub fn with_forget_me(mut self, forget_me: &ForgetMe) -> Self {
        self.config.debug.forget_me = *forget_me;
@@ -288,6 +326,12 @@ where
        self
    }

+    #[must_use]
+    pub fn with_event_tx(mut self, event_tx: EventSender) -> Self {
+        self.event_tx = Some(event_tx);
+        self
+    }
+
    #[must_use]
    pub fn with_user_agent(mut self, user_agent: UserAgent) -> Self {
        self.user_agent = Some(user_agent);
@@ -318,6 +362,18 @@ where
        details.client_address()
    }

+    fn start_event_control(
+        parent_event_tx: Option<EventSender>,
+        children_event_rx: EventReceiver,
+        shutdown_tracker: &ShutdownTracker,
+    ) {
+        let event_control = EventControl::new(parent_event_tx, children_event_rx);
+        shutdown_tracker.try_spawn_named_with_shutdown(
+            async move { event_control.run().await },
+            "EventControl",
+        );
+    }
+
    // future constantly pumping loop cover traffic at some specified average rate
    // the pumped traffic goes to the MixTrafficController
    fn start_cover_traffic_stream(
@@ -329,7 +385,7 @@ where
        stats_tx: ClientStatsSender,
        shutdown_tracker: &ShutdownTracker,
    ) {
-        info!("Starting loop cover traffic stream...");
+        tracing::info!("Starting loop cover traffic stream...");

        let mut stream = LoopCoverTrafficStream::new(
            ack_key,
@@ -361,7 +417,7 @@ where
        stats_tx: ClientStatsSender,
        shutdown_tracker: &ShutdownTracker,
    ) {
-        info!("Starting real traffic stream...");
+        tracing::info!("Starting real traffic stream...");

        let real_messages_controller = RealMessagesController::new(
            controller_config,
@@ -446,7 +502,7 @@ where
        metrics_reporter: ClientStatsSender,
        shutdown_tracker: &ShutdownTracker,
    ) {
-        info!("Starting received messages buffer controller...");
+        tracing::info!("Starting received messages buffer controller...");
        let controller = ReceivedMessagesBufferController::<SphinxMessageReceiver>::new(
            local_encryption_keypair,
            query_receiver,
@@ -557,7 +613,7 @@ where
            details_store
                .upgrade_stored_remote_gateway_key(gateway_client.gateway_identity(), &updated_key)
                .await.map_err(|err| {
-                error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
+                tracing::error!("failed to store upgraded gateway key! this connection might be forever broken now: {err}");
                ClientCoreError::GatewaysDetailsStoreError { source: Box::new(err) }
            })?
        }
@@ -654,7 +710,7 @@ where

        if topology_config.disable_refreshing {
            // if we're not spawning the refresher, don't cause shutdown immediately
-            info!("The background topology refresher is not going to be started");
+            tracing::info!("The background topology refresher is not going to be started");
        }

        let mut topology_refresher = TopologyRefresher::new(
@@ -664,7 +720,7 @@ where
        );
        // before returning, block entire runtime to refresh the current network view so that any
        // components depending on topology would see a non-empty view
-        info!("Obtaining initial network topology");
+        tracing::info!("Obtaining initial network topology");
        topology_refresher.try_refresh().await;

        if let Err(err) = topology_refresher.ensure_topology_is_routable().await {
@@ -690,13 +746,13 @@ where
                    .wait_for_gateway(local_gateway, waiting_timeout)
                    .await
                {
-                    error!(
+                    tracing::error!(
                        "the gateway did not come back online within the specified timeout: {err}"
                    );
                    return Err(err.into());
                }
            } else {
-                error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
+                tracing::error!("the gateway we're supposedly connected to does not exist. We'll not be able to send any packets to ourselves: {err}");
                return Err(err.into());
            }
        }
@@ -704,7 +760,7 @@ where
        if !topology_config.disable_refreshing {
            // don't spawn the refresher if we don't want to be refreshing the topology.
            // only use the initial values obtained
-            info!("Starting topology refresher...");
+            tracing::info!("Starting topology refresher...");
            shutdown_tracker.try_spawn_named_with_shutdown(
                async move { topology_refresher.run().await },
                "TopologyRefresher",
@@ -721,7 +777,7 @@ where
        input_sender: Sender<InputMessage>,
        shutdown_tracker: &ShutdownTracker,
    ) -> ClientStatsSender {
-        info!("Starting statistics control...");
+        tracing::info!("Starting statistics control...");
        StatisticsControl::create_and_start(
            config.debug.stats_reporting,
            user_agent
@@ -736,10 +792,17 @@ where
    fn start_mix_traffic_controller(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
        shutdown_tracker: &ShutdownTracker,
+        event_tx: EventSender,
    ) -> (BatchMixMessageSender, ClientRequestSender) {
-        info!("Starting mix traffic controller...");
-        let (mut mix_traffic_controller, mix_tx, client_tx) =
-            MixTrafficController::new(gateway_transceiver, shutdown_tracker.clone_shutdown_token());
+        tracing::info!("Starting mix traffic controller...");
+        let mut mix_traffic_controller = MixTrafficController::new(
+            gateway_transceiver,
+            shutdown_tracker.clone_shutdown_token(),
+            event_tx,
+        );
+
+        let mix_tx = mix_traffic_controller.mix_tx();
+        let client_tx = mix_traffic_controller.client_tx();

        shutdown_tracker.try_spawn_named(
            async move { mix_traffic_controller.run().await },
@@ -803,7 +866,7 @@ where
    {
        // if client keys do not exist already, create and persist them
        if key_store.load_keys().await.is_err() {
-            info!("could not find valid client keys - a new set will be generated");
+            tracing::info!("could not find valid client keys - a new set will be generated");
            let mut rng = OsRng;
            let keys = if let Some(derivation_material) = derivation_material {
                ClientKeys::from_master_key(&mut rng, &derivation_material)
@@ -818,21 +881,67 @@ where
    }

    fn construct_nym_api_client(
+        nym_api_urls: Option<&Vec<nym_network_defaults::ApiUrl>>,
        config: &Config,
        user_agent: Option<UserAgent>,
    ) -> Result<nym_http_api_client::Client, ClientCoreError> {
+        tracing::debug!(
+            "construct_nym_api_client called with nym_api_urls: {}",
+            nym_api_urls.is_some()
+        );
+
+        // If API URLs are provided, use new_with_fronted_urls() which handles domain fronting
+        if let Some(nym_api_urls) = nym_api_urls {
+            if nym_api_urls.is_empty() {
+                tracing::warn!("Provided nym_api_urls is empty, falling back to config endpoints");
+            } else {
+                tracing::info!(
+                    "Building nym-api client from provided URLs (with domain fronting support): {} URLs",
+                    nym_api_urls.len()
+                );
+
+                let mut builder =
+                    nym_http_api_client::ClientBuilder::new_with_fronted_urls(nym_api_urls.clone())
+                        .map_err(ClientCoreError::from)?
+                        .with_retries(DEFAULT_NYM_API_RETRIES);
+
+                if let Some(user_agent) = user_agent {
+                    builder = builder.with_user_agent(user_agent);
+                }
+
+                return builder.build().map_err(ClientCoreError::from);
+            }
+        }
+
+        // Fallback to basic client for backwards compatibility
+        tracing::debug!("Building basic nym-api HTTP client from config endpoints");
+
        let mut nym_api_urls = config.get_nym_api_endpoints();
+        if nym_api_urls.is_empty() {
+            tracing::warn!("No API endpoints configured in config, this may cause issues");
+        }
        nym_api_urls.shuffle(&mut thread_rng());

-        let mut builder = nym_http_api_client::Client::builder(nym_api_urls[0].clone())
-            .map_err(ClientCoreError::from)?;
+        // Convert config URLs to ApiUrl format for consistency
+        let api_urls: Vec<nym_network_defaults::ApiUrl> = nym_api_urls
+            .into_iter()
+            .map(|url| nym_network_defaults::ApiUrl {
+                url: url.to_string(),
+                front_hosts: None,
+            })
+            .collect();
+
+        tracing::debug!("Using {} config API endpoints", api_urls.len());
+
+        let mut builder = nym_http_api_client::ClientBuilder::new_with_fronted_urls(api_urls)
+            .map_err(ClientCoreError::from)?
+            .with_retries(DEFAULT_NYM_API_RETRIES)
+            .with_bincode();

        if let Some(user_agent) = user_agent {
            builder = builder.with_user_agent(user_agent);
        }

-        builder = builder.with_bincode();
-
        builder.build().map_err(ClientCoreError::from)
    }

@@ -850,7 +959,7 @@ where
        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
        <S::GatewaysDetailsStore as GatewaysDetailsStore>::StorageError: Sync + Send,
    {
-        info!("Starting nym client");
+        tracing::info!("Starting nym client");
        #[cfg(debug_assertions)]
        #[cfg(target_arch = "wasm32")]
        {
@@ -884,6 +993,9 @@ where
        // channels responsible for controlling real messages
        let (input_sender, input_receiver) = tokio::sync::mpsc::channel::<InputMessage>(1);

+        // channels responsible for event management
+        let (event_sender, event_receiver) = mpsc::unbounded();
+
        // channels responsible for controlling ack messages
        let (ack_sender, ack_receiver) = mpsc::unbounded();
        let shared_topology_accessor =
@@ -892,10 +1004,12 @@ where
        // Create a shutdown tracker for this client - either as a child of provided tracker
        // or get one from the registry
        let shutdown_tracker = match self.shutdown {
-            Some(parent_tracker) => parent_tracker.child_tracker(),
-            None => nym_task::get_sdk_shutdown_tracker()?,
+            Some(parent_tracker) => parent_tracker.clone(),
+            None => nym_task::create_sdk_shutdown_tracker()?,
        };

+        Self::start_event_control(self.event_tx, event_receiver, &shutdown_tracker);
+
        // channels responsible for dealing with reply-related fun
        let (reply_controller_sender, reply_controller_receiver) =
            reply_controller::requests::new_control_channels();
@@ -911,7 +1025,11 @@ where
            .dkg_query_client
            .map(|client| BandwidthController::new(credential_store, client));

-        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone())?;
+        let nym_api_client = Self::construct_nym_api_client(
+            self.nym_api_urls.as_ref(),
+            &self.config,
+            self.user_agent.clone(),
+        )?;
        let key_rotation_config = Self::determine_key_rotation_state(&nym_api_client).await?;

        let topology_provider = Self::setup_topology_provider(
@@ -926,7 +1044,7 @@ where
            self.user_agent.clone(),
            generate_client_stats_id(*self_address.identity()),
            input_sender.clone(),
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        );

        // needs to be started as the first thing to block if required waiting for the gateway
@@ -936,7 +1054,7 @@ where
            shared_topology_accessor.clone(),
            self_address.gateway(),
            self.wait_for_gateway,
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        )
        .await?;

@@ -956,7 +1074,7 @@ where
            stats_reporter.clone(),
            #[cfg(unix)]
            self.connection_fd_callback,
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        )
        .await?;
        let gateway_ws_fd = gateway_transceiver.ws_fd();
@@ -964,7 +1082,7 @@ where
        let reply_storage = Self::setup_persistent_reply_storage(
            reply_storage_backend,
            key_rotation_config,
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        )
        .await?;

@@ -975,7 +1093,7 @@ where
            reply_storage.key_storage(),
            reply_controller_sender.clone(),
            stats_reporter.clone(),
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        );

        // The message_sender is the transmitter for any component generating sphinx packets
@@ -985,7 +1103,8 @@ where

        let (message_sender, client_request_sender) = Self::start_mix_traffic_controller(
            gateway_transceiver,
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
+            EventSender(event_sender),
        );

        // Channels that the websocket listener can use to signal downstream to the real traffic
@@ -1015,7 +1134,7 @@ where
            shared_lane_queue_lengths.clone(),
            client_connection_rx,
            stats_reporter.clone(),
-            &shutdown_tracker.child_tracker(),
+            &shutdown_tracker.clone(),
        );

        if !self
@@ -1031,12 +1150,12 @@ where
                shared_topology_accessor.clone(),
                message_sender,
                stats_reporter.clone(),
-                &shutdown_tracker.child_tracker(),
+                &shutdown_tracker.clone(),
            );
        }

-        debug!("Core client startup finished!");
-        debug!("The address of this client is: {self_address}");
+        tracing::debug!("Core client startup finished!");
+        tracing::debug!("The address of this client is: {self_address}");

        #[cfg(debug_assertions)]
        #[cfg(target_arch = "wasm32")]
@@ -1052,6 +1171,7 @@ where
                client_input: ClientInput {
                    connection_command_sender: client_connection_tx,
                    input_sender,
+                    client_request_sender,
                },
            },
            client_output: ClientOutputStatus::AwaitingConsumer {
@@ -1067,7 +1187,6 @@ where
            },
            stats_reporter,
            shutdown_handle: shutdown_tracker, // The primary tracker for this client
-            client_request_sender,
            forget_me: self.config.debug.forget_me,
            remember_me: self.config.debug.remember_me,
        })
@@ -1081,8 +1200,57 @@ pub struct BaseClient {
    pub client_output: ClientOutputStatus,
    pub client_state: ClientState,
    pub stats_reporter: ClientStatsSender,
-    pub client_request_sender: ClientRequestSender,
    pub shutdown_handle: ShutdownTracker,
    pub forget_me: ForgetMe,
    pub remember_me: RememberMe,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_network_defaults::{ApiUrl, NymNetworkDetails};
+
+    #[test]
+    fn test_network_details_with_multiple_urls() {
+        // Verify that network details can be configured with multiple API URLs
+        let mut network_details = NymNetworkDetails::new_empty();
+        network_details.nym_api_urls = Some(vec![
+            ApiUrl {
+                url: "https://validator.nymtech.net/api/".to_string(),
+                front_hosts: None,
+            },
+            ApiUrl {
+                url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+                front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+            },
+        ]);
+
+        assert_eq!(network_details.nym_api_urls.as_ref().unwrap().len(), 2);
+        assert!(network_details.nym_api_urls.as_ref().unwrap()[1]
+            .front_hosts
+            .is_some());
+    }
+
+    #[test]
+    fn test_network_details_with_front_hosts() {
+        // Verify that ApiUrl can store domain fronting configuration
+        let api_url = ApiUrl {
+            url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+            front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+        };
+
+        assert_eq!(api_url.url, "https://nym-frontdoor.vercel.app/api/");
+        assert_eq!(api_url.front_hosts.as_ref().unwrap().len(), 2);
+        assert!(api_url
+            .front_hosts
+            .as_ref()
+            .unwrap()
+            .contains(&"vercel.app".to_string()));
+    }
+
+    #[test]
+    fn test_default_nym_api_retries_constant() {
+        // Verify the retry constant is set correctly
+        assert_eq!(DEFAULT_NYM_API_RETRIES, 3);
+    }
+}
@@ -205,7 +205,7 @@ impl LoopCoverTrafficStream<OsRng> {
                TrySendError::Full(_) => {
                    // This isn't a problem, if the channel is full means we're already sending the
                    // max amount of messages downstream can handle.
-                    tracing::debug!("Failed to send cover message - channel full");
+                    tracing::trace!("Failed to send cover message - channel full");
                }
                TrySendError::Closed(_) => {
                    tracing::warn!("Failed to send cover message - channel closed");
@@ -0,0 +1,40 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use futures::StreamExt;
+
+use crate::client::base_client::{EventReceiver, EventSender, MixnetClientEvent};
+
+/// Launches and manages task events, propagating upwards what is not strictly internal.
+pub(crate) struct EventControl {
+    parent_event_tx: Option<EventSender>,
+    children_event_rx: EventReceiver,
+}
+
+impl EventControl {
+    pub(crate) fn new(
+        parent_event_tx: Option<EventSender>,
+        children_event_rx: EventReceiver,
+    ) -> Self {
+        EventControl {
+            parent_event_tx,
+            children_event_rx,
+        }
+    }
+
+    fn is_internal(event: MixnetClientEvent) -> bool {
+        match event {
+            MixnetClientEvent::Traffic(_) => false,
+        }
+    }
+
+    pub(crate) async fn run(mut self) {
+        while let Some(event) = self.children_event_rx.next().await {
+            if let Some(parent_event_tx) = &self.parent_event_tx {
+                if !Self::is_internal(event) {
+                    parent_event_tx.send(event);
+                }
+            }
+        }
+    }
+}
@@ -1,7 +1,10 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::client::mix_traffic::transceiver::GatewayTransceiver;
+use crate::client::{
+    base_client::{EventSender, MixnetClientEvent},
+    mix_traffic::transceiver::GatewayTransceiver,
+};
 use nym_gateway_requests::ClientRequest;
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::ShutdownToken;
@@ -17,33 +20,41 @@ pub mod transceiver;

 // We remind ourselves that 32 x 32kb = 1024kb, a reasonable size for a network buffer.
 pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 32;
-const MAX_FAILURE_COUNT: usize = 100;
+
+/// Reduced from 100 to 20 to fail fast (~1-2 seconds instead of ~6 seconds).
+/// If we can't send 20 packets in a row, the gateway is unreachable.
+const MAX_FAILURE_COUNT: usize = 20;

 // that's also disgusting.
 pub struct Empty;

+#[derive(Clone, Copy, Debug)]
+pub enum MixTrafficEvent {
+    FailedSendingSphinx,
+}
+
 pub struct MixTrafficController {
    gateway_transceiver: Box<dyn GatewayTransceiver + Send>,

+    mix_tx: BatchMixMessageSender,
    mix_rx: BatchMixMessageReceiver,
    client_rx: ClientRequestReceiver,
+    client_tx: ClientRequestSender,

    // TODO: this is temporary work-around.
    // in long run `gateway_client` will be moved away from `MixTrafficController` anyway.
    consecutive_gateway_failure_count: usize,

    shutdown_token: ShutdownToken,
+    event_tx: EventSender,
 }

 impl MixTrafficController {
    pub fn new<T>(
        gateway_transceiver: T,
        shutdown_token: ShutdownToken,
-    ) -> (
-        MixTrafficController,
-        BatchMixMessageSender,
-        ClientRequestSender,
-    )
+        event_tx: EventSender,
+    ) -> MixTrafficController
    where
        T: GatewayTransceiver + Send + 'static,
    {
@@ -52,41 +63,32 @@ impl MixTrafficController {

        let (client_sender, client_receiver) = tokio::sync::mpsc::channel(8);

-        (
-            MixTrafficController {
-                gateway_transceiver: Box::new(gateway_transceiver),
-                mix_rx: message_receiver,
-                client_rx: client_receiver,
-                consecutive_gateway_failure_count: 0,
-                shutdown_token,
-            },
-            message_sender,
-            client_sender,
-        )
+        MixTrafficController {
+            gateway_transceiver: Box::new(gateway_transceiver),
+            mix_tx: message_sender,
+            mix_rx: message_receiver,
+            client_rx: client_receiver,
+            client_tx: client_sender,
+            consecutive_gateway_failure_count: 0,
+            shutdown_token,
+            event_tx,
+        }
    }

    pub fn new_dynamic(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
        shutdown_token: ShutdownToken,
-    ) -> (
-        MixTrafficController,
-        BatchMixMessageSender,
-        ClientRequestSender,
-    ) {
-        let (message_sender, message_receiver) =
-            tokio::sync::mpsc::channel(MIX_MESSAGE_RECEIVER_BUFFER_SIZE);
-        let (client_sender, client_receiver) = tokio::sync::mpsc::channel(8);
-        (
-            MixTrafficController {
-                gateway_transceiver,
-                mix_rx: message_receiver,
-                client_rx: client_receiver,
-                consecutive_gateway_failure_count: 0,
-                shutdown_token,
-            },
-            message_sender,
-            client_sender,
-        )
+        event_tx: EventSender,
+    ) -> MixTrafficController {
+        Self::new(gateway_transceiver, shutdown_token, event_tx)
+    }
+
+    pub fn client_tx(&self) -> ClientRequestSender {
+        self.client_tx.clone()
+    }
+
+    pub fn mix_tx(&self) -> BatchMixMessageSender {
+        self.mix_tx.clone()
    }

    async fn on_messages(
@@ -145,34 +147,31 @@ impl MixTrafficController {
                    trace!("MixTrafficController: Received shutdown");
                    break;
                }
-                mix_packets = self.mix_rx.recv() => match mix_packets {
-                    Some(mix_packets) => {
-                        if let Err(err) = self.on_messages(mix_packets).await {
-                            error!("Failed to send sphinx packet(s) to the gateway: {err}");
-                            if self.consecutive_gateway_failure_count == MAX_FAILURE_COUNT {
-                                // Disconnect from the gateway. If we should try to re-connect
-                                // is handled at a higher layer.
-                                error!("Failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead");
-                                // Do we need to handle the embedded mixnet client case
-                                // separately?
-                                break;
-                            }
+                // mix_rx should never error out as we're holding one instance of the sender
+
+                Some(mix_packets) = self.mix_rx.recv() =>  {
+                    if let Err(err) = self.on_messages(mix_packets).await {
+                        error!("Failed to send sphinx packet(s) to the gateway: {err}");
+                        if self.consecutive_gateway_failure_count == MAX_FAILURE_COUNT {
+                            // Disconnect from the gateway. If we should try to re-connect
+                            // is handled at a higher layer.
+                            error!("Failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead");
+                            // Do we need to handle the embedded mixnet client case
+                            // separately?
+                            self.event_tx.send(MixnetClientEvent::Traffic(MixTrafficEvent::FailedSendingSphinx));
+                            // IMO it shouldn't be signalled from there but it is how it is
+                            // TODO : report the failure upwards and shutdown from upwards
+                            // Gateway is dead, we have to shut down currently
+                            error!("Signalling shutdown from the MixTrafficController");
+                            self.shutdown_token.cancel();
+                            break;
                        }
-                    },
-                    None => {
-                        trace!("MixTrafficController: Stopping since channel closed");
-                        break;
-                    }
-                },
-                client_request = self.client_rx.recv() => match client_request {
-                    Some(client_request) => {
-                        self.on_client_request(client_request).await;
-                    },
-                    None => {
-                        trace!("MixTrafficController, client request channel closed");
-                        break
                    }
                },
+                // client_rx should never error out as we're holding one instance of the sender
+                Some(client_request) = self.client_rx.recv() => {
+                    self.on_client_request(client_request).await;
+                }
            }
        }
        debug!("MixTrafficController: Exiting");
@@ -3,6 +3,7 @@

 pub mod base_client;
 pub mod cover_traffic_stream;
+pub(crate) mod event_control;
 pub(crate) mod helpers;
 pub mod inbound_messages;
 pub mod key_manager;
@@ -298,6 +298,8 @@ where
                        "failed to send mixnet packet due to closed channel (outside of shutdown!)"
                    );
                }
+                // Early return to avoid further processing when channel is closed
+                return;
            }
            Ok(_) => {
                let event = if fragment_id.is_some() {
@@ -45,6 +45,7 @@ type WsConn = JSWebsocket;

 const CONCURRENT_GATEWAYS_MEASURED: usize = 20;
 const MEASUREMENTS: usize = 3;
+const DEFAULT_NYM_API_RETRIES: usize = 3;

 #[cfg(not(target_arch = "wasm32"))]
 const CONN_TIMEOUT: Duration = Duration::from_millis(1500);
@@ -132,25 +133,27 @@ impl<'a, G: ConnectableGateway> GatewayWithLatency<'a, G> {
    }
 }

-pub async fn gateways_for_init<R: Rng>(
-    rng: &mut R,
+pub async fn gateways_for_init(
    nym_apis: &[Url],
    user_agent: Option<UserAgent>,
    minimum_performance: u8,
    ignore_epoch_roles: bool,
+    retry_count: Option<usize>,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let nym_api = nym_apis
-        .choose(rng)
-        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
+    // Build client with ALL URLs for fallback support
+    let nym_api_urls: Vec<nym_http_api_client::Url> = nym_apis
+        .iter()
+        .map(|url| nym_http_api_client::Url::from(url.clone()))
+        .collect();

-    // Use the unified HTTP client directly with optional user agent
-    let mut builder = nym_http_api_client::Client::builder(nym_api.clone())
-        .map_err(|e| {
-            ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(
-                e,
-            ))
-        })?
-        .with_bincode(); // Use bincode for better performance
+    if nym_api_urls.is_empty() {
+        return Err(ClientCoreError::ListOfNymApisIsEmpty);
+    }
+
+    let retry_count = retry_count.unwrap_or(DEFAULT_NYM_API_RETRIES);
+    let mut builder = nym_http_api_client::ClientBuilder::new_with_urls(nym_api_urls.clone())?
+        .with_retries(retry_count)
+        .with_bincode();

    if let Some(user_agent) = user_agent {
        builder = builder.with_user_agent(user_agent);
@@ -160,7 +163,7 @@ pub async fn gateways_for_init<R: Rng>(
        ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(e))
    })?;

-    tracing::debug!("Fetching list of gateways from: {nym_api}");
+    tracing::debug!("Fetching list of gateways from: {:?}", nym_api_urls);

    // Use our helper to handle pagination
    let gateways = get_all_basic_entry_nodes_with_metadata(&client, true)
@@ -172,17 +175,15 @@ pub async fn gateways_for_init<R: Rng>(

    // filter out gateways below minimum performance and ones that could operate as a mixnode
    // (we don't want instability)
-    let valid_gateways = gateways
+    let valid_gateways: Vec<RoutingNode> = gateways
        .iter()
        .filter(|g| ignore_epoch_roles || !g.supported_roles.mixnode)
        .filter(|g| g.performance.round_to_integer() >= minimum_performance)
        .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<_>>();
-    tracing::debug!("After checking validity: {}", valid_gateways.len());
-    tracing::trace!("Valid gateways: {valid_gateways:#?}");
+        .collect();

    tracing::info!(
-        "and {} after validity and performance filtering",
+        "Found {} valid gateways after filtering",
        valid_gateways.len()
    );

@@ -345,13 +346,20 @@ pub(super) fn get_specified_gateway(
    must_use_tls: bool,
 ) -> Result<RoutingNode, ClientCoreError> {
    tracing::debug!("Requesting specified gateway: {gateway_identity}");
+
    let user_gateway = ed25519::PublicKey::from_base58_string(gateway_identity)
        .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;

    let gateway = gateways
        .iter()
        .find(|gateway| gateway.identity_key == user_gateway)
-        .ok_or_else(|| ClientCoreError::NoGatewayWithId(gateway_identity.to_string()))?;
+        .ok_or_else(|| {
+            tracing::debug!(
+                "Gateway {gateway_identity} not found in {} available gateways",
+                gateways.len()
+            );
+            ClientCoreError::NoGatewayWithId(gateway_identity.to_string())
+        })?;

    let Some(entry_details) = gateway.entry.as_ref() else {
        return Err(ClientCoreError::UnsupportedEntry {
@@ -414,3 +422,52 @@ pub(super) async fn register_with_gateway(
        authenticated_ephemeral_client: gateway_client,
    })
 }
+
+#[cfg(test)]
+mod tests {
+    use url::Url;
+
+    #[test]
+    fn test_single_url_builds_without_retries() {
+        let urls = [Url::parse("https://api.nym.com").unwrap()];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 1, "Should have exactly one URL");
+    }
+
+    #[test]
+    fn test_multiple_urls_prepared_for_retries() {
+        let urls = [
+            Url::parse("https://api1.nym.com").unwrap(),
+            Url::parse("https://api2.nym.com").unwrap(),
+            Url::parse("https://api3.nym.com").unwrap(),
+        ];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 3, "Should have all three URLs");
+        assert!(
+            nym_api_urls.len() > 1,
+            "Multiple URLs trigger retry behavior"
+        );
+    }
+
+    #[test]
+    fn test_empty_url_list_is_detected() {
+        let urls: Vec<Url> = vec![];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert!(nym_api_urls.is_empty(), "Empty list should remain empty");
+    }
+}
@@ -241,23 +241,28 @@ impl Epoch {
 //
 // Note: It's important that the variant ordering is not changed otherwise it would mess up the derived `PartialOrd`
 #[cw_serde]
-#[derive(Copy)]
+#[derive(Copy, Default)]
 pub enum EpochState {
+    #[default]
    WaitingInitialisation,
-    PublicKeySubmission { resharing: bool },
-    DealingExchange { resharing: bool },
-    VerificationKeySubmission { resharing: bool },
-    VerificationKeyValidation { resharing: bool },
-    VerificationKeyFinalization { resharing: bool },
+    PublicKeySubmission {
+        resharing: bool,
+    },
+    DealingExchange {
+        resharing: bool,
+    },
+    VerificationKeySubmission {
+        resharing: bool,
+    },
+    VerificationKeyValidation {
+        resharing: bool,
+    },
+    VerificationKeyFinalization {
+        resharing: bool,
+    },
    InProgress,
 }

-impl Default for EpochState {
-    fn default() -> Self {
-        Self::WaitingInitialisation
-    }
-}
-
 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
@@ -8,7 +8,7 @@ async fn main() -> anyhow::Result<()> {
    use sqlx::{Connection, SqliteConnection};
    use std::env;

-    let out_dir = env::var("OUT_DIR")?;
+    let out_dir = env::var("OUT_DIR").context("missing OUT_DIR env variable")?;
    let database_path = format!("{out_dir}/nym-credential-proxy-example.sqlite");

    // remove the db file if it already existed from previous build
@@ -127,6 +127,13 @@ pub enum CredentialProxyError {
    #[error("failed to create deposit")]
    DepositFailure,

+    #[error("failed to load jwt signing key from {path}: {err}")]
+    JWTSigningKeyLoadFailure {
+        path: String,
+        #[source]
+        err: std::io::Error,
+    },
+
    #[error("can't obtain sufficient number of credential shares due to unavailable quorum")]
    UnavailableSigningQuorum,

@@ -7,9 +7,9 @@ use crate::ticketbook_manager::TicketbookManager;
 use nym_compact_ecash::Base58;
 use nym_credential_proxy_requests::api::v1::ticketbook::models::{
    CurrentEpochResponse, DepositResponse, GlobalDataParams, MasterVerificationKeyResponse,
-    PartialVerificationKey, PartialVerificationKeysResponse, TicketbookAsyncRequest,
-    TicketbookObtainParams, TicketbookRequest, TicketbookWalletSharesAsyncResponse,
-    TicketbookWalletSharesResponse,
+    ObtainTicketBookSharesAsyncResponse, PartialVerificationKey, PartialVerificationKeysResponse,
+    TicketbookAsyncRequest, TicketbookObtainParams, TicketbookRequest,
+    TicketbookWalletSharesAsyncResponse, TicketbookWalletSharesResponse,
 };
 use time::OffsetDateTime;
 use tracing::{Instrument, Level, error, info, span, warn};
@@ -65,7 +65,7 @@ impl TicketbookManager {
        uuid: Uuid,
        request: TicketbookAsyncRequest,
        params: TicketbookObtainParams,
-    ) -> Result<TicketbookWalletSharesAsyncResponse, CredentialProxyError> {
+    ) -> Result<ObtainTicketBookSharesAsyncResponse, CredentialProxyError> {
        let requested_on = OffsetDateTime::now_utc();
        let span = span!(Level::INFO, "[async] obtain ticketboook", uuid = %uuid);
        async move {
@@ -110,7 +110,7 @@ impl TicketbookManager {
            }

            // 4. in the meantime, return the id to the user
-            Ok(TicketbookWalletSharesAsyncResponse { id, uuid })
+            Ok(TicketbookWalletSharesAsyncResponse { id, uuid }.into())
        }
        .instrument(span)
        .await
@@ -246,7 +246,7 @@ mod tests {
        let _exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[signing_keys.secret_key()],
-            &vec![signing_keys.verification_key()],
+            &[signing_keys.verification_key()],
            &signing_keys.verification_key(),
            &[1],
        )?;
@@ -263,7 +263,7 @@ mod tests {

        let wallet = issuance.aggregate_signature_shares(
            &signing_keys.verification_key(),
-            &vec![partial_wallet],
+            &[partial_wallet],
            sig_req,
        )?;

@@ -36,7 +36,11 @@ nym-sphinx-types = { path = "../nymsphinx/types", version = "0.2.0", default-fea
 nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }

 [dev-dependencies]
+anyhow = { workspace = true }
 rand_chacha = { workspace = true }
+serde_json = { workspace = true }
+nym-test-utils = { path = "../test-utils" }
+

 [features]
 default = []
@@ -17,6 +17,51 @@ pub mod bs58_ed25519_pubkey {
    }
 }

+pub mod vec_bs58_ed25519_pubkey {
+    use super::*;
+    use serde::{Deserialize, Deserializer, Serializer, ser::SerializeSeq};
+
+    pub fn serialize<S: Serializer>(
+        keys: &Vec<PublicKey>,
+        serializer: S,
+    ) -> Result<S::Ok, S::Error> {
+        let mut seq = serializer.serialize_seq(Some(keys.len()))?;
+        for key in keys {
+            seq.serialize_element(&Bs58KeyWrapper(*key))?;
+        }
+        seq.end()
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(
+        deserializer: D,
+    ) -> Result<Vec<PublicKey>, D::Error> {
+        let wrapped = Vec::<Bs58KeyWrapper>::deserialize(deserializer)?;
+        Ok(wrapped.into_iter().map(|k| k.0).collect())
+    }
+
+    struct Bs58KeyWrapper(PublicKey);
+
+    impl serde::Serialize for Bs58KeyWrapper {
+        fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+        where
+            S: Serializer,
+        {
+            bs58_ed25519_pubkey::serialize(&self.0, serializer)
+        }
+    }
+
+    impl<'de> Deserialize<'de> for Bs58KeyWrapper {
+        fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+        where
+            D: Deserializer<'de>,
+        {
+            Ok(Bs58KeyWrapper(bs58_ed25519_pubkey::deserialize(
+                deserializer,
+            )?))
+        }
+    }
+}
+
 pub mod bs58_ed25519_signature {
    use crate::asymmetric::ed25519::Signature;
    use serde::{Deserialize, Deserializer, Serializer};
@@ -33,3 +78,53 @@ pub mod bs58_ed25519_signature {
        Signature::from_base58_string(s).map_err(serde::de::Error::custom)
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use jwt_simple::reexports::{anyhow, serde_json};
+    use nym_test_utils::helpers::deterministic_rng;
+    use serde::{Deserialize, Serialize};
+
+    #[test]
+    fn vec_bs58_ed25519_pubkey_json() -> anyhow::Result<()> {
+        #[derive(Serialize, Deserialize, Debug, PartialEq)]
+        struct KeysWrapper(#[serde(with = "vec_bs58_ed25519_pubkey")] Vec<PublicKey>);
+
+        use crate::asymmetric::ed25519;
+        let mut rng = deterministic_rng();
+        let empty = KeysWrapper(vec![]);
+        let single_key = KeysWrapper(vec![PublicKey::from_base58_string(
+            "Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt",
+        )?]);
+        let three_keys = KeysWrapper(vec![
+            ed25519::KeyPair::new(&mut rng).public_key,
+            ed25519::KeyPair::new(&mut rng).public_key,
+            ed25519::KeyPair::new(&mut rng).public_key,
+        ]);
+
+        let se_empty = serde_json::to_string(&empty)?;
+        let se_single_key = serde_json::to_string(&single_key)?;
+        let se_three_keys = serde_json::to_string(&three_keys)?;
+
+        assert_eq!(se_empty, r#"[]"#);
+        assert_eq!(
+            se_single_key,
+            r#"["Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt"]"#
+        );
+        assert_eq!(
+            se_three_keys,
+            r#"["HmgHDV79LpnEaSUp8QZQwSroxVvS4RewF7yM9e7qu8y3","311xRh859qCd5MVqoPRCoNx26eYhLknGwtjzkkTJFGhf","A5BMp8WJ6Uk91U4JpWRv2Bc6X35AaRaSEy8QEWeAkaBv"]"#
+        );
+
+        let empty_de = serde_json::from_str::<KeysWrapper>(&se_empty)?;
+        let single_key_de = serde_json::from_str::<KeysWrapper>(&se_single_key)?;
+        let three_keys_de = serde_json::from_str::<KeysWrapper>(&se_three_keys)?;
+
+        assert_eq!(empty, empty_de);
+        assert_eq!(single_key, single_key_de);
+        assert_eq!(three_keys, three_keys_de);
+
+        Ok(())
+    }
+}
@@ -82,7 +82,7 @@ mod tests {
        let exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[keypair.secret_key()],
-            &vec![keypair.verification_key()],
+            &[keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -106,14 +106,14 @@ mod tests {
            .unwrap();

        let wallet = issuance
-            .aggregate_signature_shares(&keypair.verification_key(), &vec![partial_wallet], sig_req)
+            .aggregate_signature_shares(&keypair.verification_key(), &[partial_wallet], sig_req)
            .unwrap();

        let mut issued = issuance.into_issued_ticketbook(wallet, 1);
        let coin_indices_signatures = generate_coin_indices_signatures(
            nym_credentials_interface::ecash_parameters(),
            &[keypair.secret_key()],
-            &vec![keypair.verification_key()],
+            &[keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -296,6 +296,9 @@ impl std::error::Error for ReqwestErrorWrapper {}
 #[derive(Debug, Error)]
 #[allow(missing_docs)]
 pub enum HttpClientError {
+    #[error("did not provide any valid client URLs")]
+    NoUrlsProvided,
+
    #[error("failed to construct inner reqwest client: {source}")]
    ReqwestBuildError {
        #[source]
@@ -582,24 +585,29 @@ impl ClientBuilder {
            Self::new(alt)
        } else {
            let url = url.to_url()?;
-            Ok(Self::new_with_urls(vec![url]))
+            Self::new_with_urls(vec![url])
        }
    }

    /// Create a client builder from network details with sensible defaults
    #[cfg(feature = "network-defaults")]
+    // deprecating function since it's not clear from its signature whether the client
+    // would be constructed using `nym_api_urls` or `nym_vpn_api_urls`
+    #[deprecated(note = "use explicit Self::new_with_fronted_urls instead")]
    pub fn from_network(
        network: &nym_network_defaults::NymNetworkDetails,
    ) -> Result<Self, HttpClientError> {
-        let urls = network
-            .nym_api_urls
-            .as_ref()
-            .ok_or_else(|| {
-                HttpClientError::GenericRequestFailure(
-                    "No API URLs configured in network details".to_string(),
-                )
-            })?
-            .iter()
+        let urls = network.nym_api_urls.as_ref().cloned().unwrap_or_default();
+        Self::new_with_fronted_urls(urls.clone())
+    }
+
+    /// Create a client builder using the provided set of domain-fronted URLs
+    #[cfg(feature = "network-defaults")]
+    pub fn new_with_fronted_urls(
+        urls: Vec<nym_network_defaults::ApiUrl>,
+    ) -> Result<Self, HttpClientError> {
+        let urls = urls
+            .into_iter()
            .map(|api_url| {
                // Convert ApiUrl to our Url type with fronting support
                let mut url = Url::parse(&api_url.url)?;
@@ -611,15 +619,19 @@ impl ClientBuilder {
                        .iter()
                        .map(|host| format!("https://{}", host))
                        .collect();
-                    url = Url::new(api_url.url.clone(), Some(fronts))
-                        .map_err(|e| HttpClientError::GenericRequestFailure(e.to_string()))?;
+                    url = Url::new(api_url.url.clone(), Some(fronts)).map_err(|source| {
+                        HttpClientError::MalformedUrl {
+                            raw: api_url.url.clone(),
+                            source,
+                        }
+                    })?;
                }

                Ok(url)
            })
            .collect::<Result<Vec<_>, HttpClientError>>()?;

-        let mut builder = Self::new_with_urls(urls);
+        let mut builder = Self::new_with_urls(urls)?;

        // Enable domain fronting by default (on retry)
        #[cfg(feature = "tunneling")]
@@ -631,7 +643,11 @@ impl ClientBuilder {
    }

    /// Constructs a new http `ClientBuilder` from a valid url.
-    pub fn new_with_urls(urls: Vec<Url>) -> Self {
+    pub fn new_with_urls(urls: Vec<Url>) -> Result<Self, HttpClientError> {
+        if urls.is_empty() {
+            return Err(HttpClientError::NoUrlsProvided);
+        }
+
        let urls = Self::check_urls(urls);

        #[cfg(target_arch = "wasm32")]
@@ -640,7 +656,7 @@ impl ClientBuilder {
        #[cfg(not(target_arch = "wasm32"))]
        let reqwest_client_builder = default_builder();

-        ClientBuilder {
+        Ok(ClientBuilder {
            urls,
            timeout: None,
            custom_user_agent: false,
@@ -651,7 +667,7 @@ impl ClientBuilder {

            retry_limit: 0,
            serialization: SerializationFormat::Json,
-        }
+        })
    }

    /// Add an additional URL to the set usable by this constructed `Client`
@@ -886,6 +902,8 @@ impl Client {

        if self.base_urls.len() > 1 {
            let orig = self.current_idx.load(Ordering::Relaxed);
+
+            #[allow(unused_mut)]
            let mut next = (orig + 1) % self.base_urls.len();

            // if fronting is enabled we want to update to a host that has fronts configured
@@ -948,13 +966,13 @@ impl Client {

                    return (url.as_str(), url.front_str());
                } else {
-                    warn!(
-                        "Domain fronting is enabled, but no host_url is defined! Domain fronting WILL NOT WORK"
+                    tracing::debug!(
+                        "Domain fronting is enabled, but no host_url is defined for current URL"
                    )
                }
            } else {
-                warn!(
-                    "Domain fronting is enabled, but no front_url is defined! Domain fronting WILL NOT WORK"
+                tracing::debug!(
+                    "Domain fronting is enabled, but current URL has no front_hosts configured"
                )
            }
        }
@@ -21,6 +21,10 @@ inventory::collect!(ConfigRecord);
 /// Returns the default builder with all registered configurations applied.
 pub fn default_builder() -> ReqwestClientBuilder {
    let mut b = ReqwestClientBuilder::new();
+
+    #[cfg(feature = "debug-inventory")]
+    let mut test_client = ReqwestClientBuilder::new();
+
    let mut records: Vec<&'static ConfigRecord> =
        inventory::iter::<ConfigRecord>.into_iter().collect();
    records.sort_by_key(|r| r.priority); // lower runs first
@@ -35,6 +39,10 @@ pub fn default_builder() -> ReqwestClientBuilder {

    for r in records {
        b = (r.apply)(b);
+        #[cfg(feature = "debug-inventory")]
+        {
+            test_client = (r.apply)(test_client);
+        }
    }

    #[cfg(feature = "debug-inventory")]
@@ -47,7 +55,7 @@ pub fn default_builder() -> ReqwestClientBuilder {
        eprintln!("[HTTP-INVENTORY] Building test client to verify configuration...");

        // Try to build a client to see if it works
-        match b.try_clone().unwrap().build() {
+        match test_client.build() {
            Ok(client) => {
                eprintln!("[HTTP-INVENTORY] ✓ Client built successfully");
                eprintln!("[HTTP-INVENTORY] Client debug info: {:#?}", client);
@@ -2,77 +2,77 @@ use super::*;

 #[test]
 fn sanitizing_urls() {
-    let base_url: Url = "http://foomp.com".parse().unwrap();
+    let base_url: Url = "http://api.test".parse().unwrap();

    // works with a full string
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, "/foo//bar/", NO_PARAMS).as_str()
    );

    // (and leading slash doesn't matter)
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, "foo//bar/", NO_PARAMS).as_str()
    );

    // works with 1 segment
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["foo"], NO_PARAMS).as_str()
    );

    // works with 2 segments
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "bar"], NO_PARAMS).as_str()
    );

    // works with leading slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["/foo"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["/foo", "bar"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "/bar"], NO_PARAMS).as_str()
    );

    // works with trailing slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["foo/"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo/", "bar"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "bar/"], NO_PARAMS).as_str()
    );

    // works with both leading and trailing slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["/foo/"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["/foo/", "/bar/"], NO_PARAMS).as_str()
    );

    // adds params
    assert_eq!(
-        "http://foomp.com/foo/bar?foomp=baz",
+        "http://api.test/foo/bar?foomp=baz",
        sanitize_url(&base_url, &["foo", "bar"], &[("foomp", "baz")]).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar?arg1=val1&arg2=val2",
+        "http://api.test/foo/bar?arg1=val1&arg2=val2",
        sanitize_url(
            &base_url,
            &["/foo/", "/bar/"],
@@ -91,83 +91,87 @@ fn sanitizing_urls() {
 #[tokio::test]
 async fn api_client_retry() -> Result<(), Box<dyn std::error::Error>> {
    let client = ClientBuilder::new_with_urls(vec![
-        "http://broken.nym.badurl".parse()?,
-        "http://example.com/".parse()?,
-    ])
+        "http://broken.nym.test".parse()?,         // This will fail
+        "https://httpbin.org/status/200".parse()?, // This will succeed
+    ])?
    .with_retries(3)
    .build()?;

-    let req = client.create_get_request(&["/"], NO_PARAMS).unwrap();
+    let req = client.create_get_request(&[], NO_PARAMS).unwrap();
    let resp = client.send(req).await?;

-    assert_eq!(resp.status(), 200);
+    // The main test is that we successfully retried and switched to the working URL
+    // We accept any response from the working endpoint since external services can be unreliable
+    assert_eq!(
+        client.current_url().as_str(),
+        "https://httpbin.org/status/200"
+    );

-    // check that the url was updated
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    println!("Response status: {}", resp.status());

    Ok(())
 }

 #[test]
 fn host_updating() {
-    let url = Url::new("http://example.com", None).unwrap();
+    let url = Url::new("http://nym-api1.test", None).unwrap();
    let mut client = ClientBuilder::new(url).unwrap().build().unwrap();

    // check that the url is set correctly
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
+    assert_eq!(current_url.as_str(), "http://nym-api1.test/");
    assert_eq!(current_url.front_str(), None);

    // update the url
    client.update_host();

    // check that the url is still the same since there is one URL
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    // =======================================
    // we rotate through urls when available

    let new_urls = vec![
-        Url::new("http://example.com", None).unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api1.test", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    client.update_host();

    // check that the url got updated now that there are multiple URLs
-    assert_eq!(client.current_url().as_str(), "http://example.org/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api2.test/");
    assert_eq!(client.current_url().front_str(), None);

    client.update_host();
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    // =======================================
    // we rotate through urls when available if fronting is disabled

    let new_urls = vec![
        Url::new(
-            "http://example.com",
-            Some(vec!["http://front1.com", "http://front2.com"]),
+            "http://nym-api1.test",
+            Some(vec!["http://cdn1.test", "http://cdn2.test"]),
        )
        .unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);

-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    client.update_host();

    // check that the url got updated now that there are multiple URLs
-    assert_eq!(client.current_url().as_str(), "http://example.org/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api2.test/");
 }

 #[test]
 #[cfg(feature = "tunneling")]
 fn fronted_host_updating() {
-    let url = Url::new("http://example.com", Some(vec!["http://front1.com"])).unwrap();
+    let url = Url::new("http://nym-api.test", Some(vec!["http://cdn1.test"])).unwrap();
    let mut client = ClientBuilder::new(url)
        .unwrap()
        .with_fronting(crate::fronted::FrontPolicy::Always)
@@ -176,46 +180,103 @@ fn fronted_host_updating() {

    // check that the url is set correctly
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // update the url
    client.update_host();

    // check that the url is still the same since there is one URL and one front
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // =======================================
    // we rotate through front urls when available if fronting is enabled

    let new_urls = vec![
        Url::new(
-            "http://example.com",
-            Some(vec!["http://front1.com", "http://front2.com"]),
+            "http://nym-api.test",
+            Some(vec!["http://cdn1.test", "http://cdn2.test"]),
        )
        .unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);

    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // update the url - this should keep the same host but change the front
    client.update_host();

    let current_url = client.current_url();
    // check that the url is still the same since there is one URL
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front2.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn2.test"));

    // update the url - this should wrap around to the first front as the second url is not fronted
    client.update_host();

    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));
+}
+
+#[test]
+#[cfg(feature = "network-defaults")]
+fn from_network_configures_multiple_urls_and_retries() {
+    use nym_network_defaults::{ApiUrl, NymNetworkDetails};
+
+    // Create network details with multiple URLs and fronting
+    let mut network_details = NymNetworkDetails::new_empty();
+    network_details.nym_api_urls = Some(vec![
+        ApiUrl {
+            url: "https://validator.nymtech.net/api/".to_string(),
+            front_hosts: None,
+        },
+        ApiUrl {
+            url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+            front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+        },
+        ApiUrl {
+            url: "https://nym-frontdoor.global.ssl.fastly.net/api/".to_string(),
+            front_hosts: Some(vec!["yelp.global.ssl.fastly.net".to_string()]),
+        },
+    ]);
+
+    // Build client from network details
+    let client = ClientBuilder::new_with_fronted_urls(
+        network_details.nym_api_urls.clone().unwrap_or_default(),
+    )
+    .expect("Failed to create client from network")
+    .build()
+    .expect("Failed to build client");
+
+    // Verify all URLs were configured
+    assert_eq!(
+        client.base_urls().len(),
+        3,
+        "Expected 3 URLs to be configured from network details"
+    );
+
+    // Verify the URLs have fronting configured where appropriate
+    assert_eq!(
+        client.base_urls()[0].as_str(),
+        "https://validator.nymtech.net/api/"
+    );
+    assert!(client.base_urls()[0].front_str().is_none());
+
+    assert_eq!(
+        client.base_urls()[1].as_str(),
+        "https://nym-frontdoor.vercel.app/api/"
+    );
+    assert!(client.base_urls()[1].front_str().is_some());
+
+    assert_eq!(
+        client.base_urls()[2].as_str(),
+        "https://nym-frontdoor.global.ssl.fastly.net/api/"
+    );
+    assert!(client.base_urls()[2].front_str().is_some());
 }
@@ -183,6 +183,11 @@ impl Url {
        })
    }

+    /// Returns the underlying URL
+    pub fn inner_url(&self) -> &url::Url {
+        &self.url
+    }
+
    /// Returns true if the URL has a front domain set
    pub fn has_front(&self) -> bool {
        if let Some(fronts) = &self.fronts {
@@ -201,6 +206,11 @@ impl Url {
            .and_then(|url| url.host_str())
    }

+    /// Returns the fronts
+    pub fn fronts(&self) -> Option<&[url::Url]> {
+        self.fronts.as_deref()
+    }
+
    /// Return the string representation of the host (domain or IP address) for this URL, if any.
    pub fn host_str(&self) -> Option<&str> {
        self.url.host_str()
@@ -124,6 +124,8 @@ impl NymNetworkDetails {
            }
        }

+        let nym_api = var(var_names::NYM_API).expect("nym api not set");
+
        NymNetworkDetails::new_empty()
            .with_network_name(var(var_names::NETWORK_NAME).expect("network name not set"))
            .with_bech32_account_prefix(
@@ -149,7 +151,7 @@ impl NymNetworkDetails {
            })
            .with_additional_validator_endpoint(ValidatorDetails::new(
                var(var_names::NYXD).expect("nyxd validator not set"),
-                Some(var(var_names::NYM_API).expect("nym api not set")),
+                Some(nym_api.clone()),
                get_optional_env(var_names::NYXD_WEBSOCKET),
            ))
            .with_mixnet_contract(get_optional_env(var_names::MIXNET_CONTRACT_ADDRESS))
@@ -159,6 +161,10 @@ impl NymNetworkDetails {
            .with_multisig_contract(get_optional_env(var_names::MULTISIG_CONTRACT_ADDRESS))
            .with_coconut_dkg_contract(get_optional_env(var_names::COCONUT_DKG_CONTRACT_ADDRESS))
            .with_nym_vpn_api_url(get_optional_env(var_names::NYM_VPN_API))
+            .with_nym_api_urls(Some(vec![ApiUrl {
+                url: nym_api,
+                front_hosts: None,
+            }]))
    }

    pub fn new_mainnet() -> Self {
@@ -348,6 +354,12 @@ impl NymNetworkDetails {
        self
    }

+    #[must_use]
+    pub fn with_nym_api_urls(mut self, urls: Option<Vec<ApiUrl>>) -> Self {
+        self.nym_api_urls = urls;
+        self
+    }
+
    pub fn nym_vpn_api_url(&self) -> Option<Url> {
        self.nym_vpn_api_url.as_ref().map(|url| {
            url.parse()
@@ -119,6 +119,7 @@ where
        let ClientInput {
            connection_command_sender,
            input_sender,
+            ..
        } = client_input;

        let ClientOutput {
@@ -24,6 +24,6 @@ pub use crate::runtime_registry::RegistryAccessError;

 /// Get or create a ShutdownTracker for SDK use.
 /// This provides automatic task management without requiring manual setup.
-pub fn get_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
-    Ok(runtime_registry::RuntimeRegistry::get_or_create_sdk()?.shutdown_tracker_owned())
+pub fn create_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
+    Ok(runtime_registry::RuntimeRegistry::create_sdk()?.shutdown_tracker_owned())
 }
@@ -19,30 +19,45 @@ pub(crate) struct RuntimeRegistry {
 pub enum RegistryAccessError {
    #[error("the runtime registry is poisoned")]
    Poisoned,
+
+    #[error("The SDK ShutdownManager already exists")]
+    ExistingShutdownManager,
+
+    #[error("No existing SDK ShutdownManager")]
+    MissingShutdownManager,
 }

 impl RuntimeRegistry {
-    /// Get or create a ShutdownManager for SDK use.
+    /// Create a ShutdownManager for SDK use.
    /// This manager doesn't listen to OS signals, making it suitable for library use.
-    pub(crate) fn get_or_create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
+    /// This function overwrite any existing manager!
+    pub(crate) fn create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
+        let mut guard = REGISTRY
+            .sdk_manager
+            .write()
+            .map_err(|_| RegistryAccessError::Poisoned)?;
+
+        Ok(guard
+            .insert(Arc::new(
+                ShutdownManager::new_without_signals().with_cancel_on_panic(),
+            ))
+            .clone())
+    }
+
+    /// Get the  ShutdownManager for SDK use.
+    /// This manager doesn't listen to OS signals, making it suitable for library use.
+    /// Not yet used, but maybe in the future
+    #[allow(dead_code)]
+    pub(crate) fn get_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
        let guard = REGISTRY
            .sdk_manager
            .read()
            .map_err(|_| RegistryAccessError::Poisoned)?;
        if let Some(manager) = guard.as_ref() {
-            return Ok(manager.clone());
+            Ok(manager.clone())
+        } else {
+            Err(RegistryAccessError::MissingShutdownManager)
        }
-        drop(guard);
-
-        let mut guard = REGISTRY
-            .sdk_manager
-            .write()
-            .map_err(|_| RegistryAccessError::Poisoned)?;
-        Ok(guard
-            .get_or_insert_with(|| {
-                Arc::new(ShutdownManager::new_without_signals().with_cancel_on_panic())
-            })
-            .clone())
    }

    /// Check if an SDK manager has been created.
@@ -85,10 +100,13 @@ mod tests {

        assert!(!RuntimeRegistry::has_sdk_manager().unwrap());

-        let manager1 = RuntimeRegistry::get_or_create_sdk().unwrap();
+        // Error if nothing was created
+        assert!(RuntimeRegistry::get_sdk().is_err());
+
+        let manager1 = RuntimeRegistry::create_sdk().unwrap();
        assert!(RuntimeRegistry::has_sdk_manager().unwrap());

-        let manager2 = RuntimeRegistry::get_or_create_sdk().unwrap();
+        let manager2 = RuntimeRegistry::get_sdk().unwrap();
        // Should return the same instance
        assert!(Arc::ptr_eq(&manager1, &manager2));

@@ -15,9 +15,10 @@ jwt-simple = { workspace = true }
 reqwest = { workspace = true, features = ["rustls-tls"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
-time = { workspace = true, features = ["serde"] }
+time = { workspace = true, features = ["serde", "formatting", "parsing"] }
 thiserror = { workspace = true }
 tracing = { workspace = true }
+utoipa = { workspace = true, optional = true }

 nym-http-api-client = { path = "../http-api-client", default-features = false }
 nym-crypto = { path = "../crypto", features = ["asymmetric", "serde", "naive_jwt"] }
@@ -25,6 +26,12 @@ nym-crypto = { path = "../crypto", features = ["asymmetric", "serde", "naive_jwt
 [dev-dependencies]
 anyhow = { workspace = true }
 time = { workspace = true, features = ["macros"] }
+nym-test-utils = { path = "../test-utils" }
+nym-crypto = { path = "../crypto", features = ["rand"] }
+
+
+[features]
+openapi = ["utoipa"]

 [lints]
 workspace = true
@@ -1,31 +1,43 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::UpgradeModeCheckError;
 use nym_crypto::asymmetric::ed25519;
-use nym_http_api_client::generate_user_agent;
 use serde::{Deserialize, Serialize};
-use std::time::Duration;
 use time::OffsetDateTime;

-#[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Copy)]
+#[derive(Serialize, Deserialize, Debug, PartialEq, Clone)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct UpgradeModeAttestation {
    #[serde(flatten)]
    pub content: UpgradeModeAttestationContent,

    #[serde(with = "ed25519::bs58_ed25519_signature")]
+    #[cfg_attr(feature = "openapi", schema(value_type = String))]
    pub signature: ed25519::Signature,
 }

-#[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Copy)]
+impl UpgradeModeAttestation {
+    pub fn authorised_to_issue_jwt(&self, key: &ed25519::PublicKey) -> bool {
+        self.content.authorised_jwt_issuers.contains(key)
+    }
+}
+
+#[derive(Serialize, Deserialize, Debug, PartialEq, Clone)]
 #[serde(tag = "type")]
 #[serde(rename = "upgrade_mode")]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub struct UpgradeModeAttestationContent {
-    #[serde(with = "time::serde::timestamp")]
+    #[serde(with = "time::serde::rfc3339")]
+    #[cfg_attr(feature = "openapi", schema(value_type = String))]
    pub starting_time: OffsetDateTime,

    #[serde(with = "ed25519::bs58_ed25519_pubkey")]
+    #[cfg_attr(feature = "openapi", schema(value_type = String))]
    pub attester_public_key: ed25519::PublicKey,
+
+    #[serde(with = "ed25519::vec_bs58_ed25519_pubkey")]
+    #[cfg_attr(feature = "openapi", schema(value_type = Vec<String>))]
+    pub authorised_jwt_issuers: Vec<ed25519::PublicKey>,
 }

 impl UpgradeModeAttestation {
@@ -45,17 +57,26 @@ impl UpgradeModeAttestationContent {
    }
 }

-pub fn generate_new_attestation(key: &ed25519::PrivateKey) -> UpgradeModeAttestation {
-    generate_new_attestation_with_starting_time(key, OffsetDateTime::now_utc())
+pub fn generate_new_attestation(
+    key: &ed25519::PrivateKey,
+    authorised_jwt_issuers: Vec<ed25519::PublicKey>,
+) -> UpgradeModeAttestation {
+    generate_new_attestation_with_starting_time(
+        key,
+        authorised_jwt_issuers,
+        OffsetDateTime::now_utc(),
+    )
 }

 pub fn generate_new_attestation_with_starting_time(
    key: &ed25519::PrivateKey,
+    authorised_jwt_issuers: Vec<ed25519::PublicKey>,
    starting_time: OffsetDateTime,
 ) -> UpgradeModeAttestation {
    let content = UpgradeModeAttestationContent {
        starting_time,
        attester_public_key: key.into(),
+        authorised_jwt_issuers,
    };
    UpgradeModeAttestation {
        signature: key.sign(content.as_json()),
@@ -63,17 +84,19 @@ pub fn generate_new_attestation_with_starting_time(
    }
 }

-pub async fn attempt_retrieve(
+#[cfg(not(target_arch = "wasm32"))]
+pub async fn attempt_retrieve_attestation(
    url: &str,
-) -> Result<Option<UpgradeModeAttestation>, UpgradeModeCheckError> {
-    let retrieval_failure = |source| UpgradeModeCheckError::AttestationRetrievalFailure {
+    user_agent: Option<nym_http_api_client::UserAgent>,
+) -> Result<Option<UpgradeModeAttestation>, crate::UpgradeModeCheckError> {
+    let retrieval_failure = |source| crate::UpgradeModeCheckError::AttestationRetrievalFailure {
        url: url.to_string(),
        source,
    };

    let attestation = reqwest::ClientBuilder::new()
-        .user_agent(generate_user_agent!())
-        .timeout(Duration::from_secs(5))
+        .user_agent(user_agent.unwrap_or_else(|| nym_http_api_client::generate_user_agent!()))
+        .timeout(std::time::Duration::from_secs(5))
        .build()
        .map_err(retrieval_failure)?
        .get(url)
@@ -101,13 +124,20 @@ mod tests {
            163, 122, 170, 79, 198, 87, 85, 36, 29, 243, 92, 64, 161,
        ])?;

-        let attestation = generate_new_attestation_with_starting_time(&key, starting_time);
+        let authorised_jwt_issuers = vec![ed25519::PublicKey::from_base58_string(
+            "Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt",
+        )?];
+        let attestation = generate_new_attestation_with_starting_time(
+            &key,
+            authorised_jwt_issuers,
+            starting_time,
+        );

        let attestation_json = serde_json::to_string(&attestation)?;
        let attestation_content_json = attestation.content.as_json();

-        let expected_attestation = r#"{"type":"upgrade_mode","starting_time":1629720000,"attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt","signature":"5rWUr2ypaDTtrMKegMP3tQkkZGFAuhNTnEVCVe5Azv6QqvLzoGdQiMkFmeyhDd1XSfoXpL9fFM58rsdA1kf4GYMM"}"#;
-        let expected_content = r#"{"type":"upgrade_mode","starting_time":1629720000,"attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt"}"#;
+        let expected_attestation = r#"{"type":"upgrade_mode","starting_time":"2021-08-23T12:00:00Z","attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt","authorised_jwt_issuers":["Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt"],"signature":"5Kt9dfwvnkdnDcENbwNyitrxghyckWUYycBv8jUUn7hJUMohWEMc6otb3scXQfCrAGSE7FD5m7kr6auBmkAmfczY"}"#;
+        let expected_content = r#"{"type":"upgrade_mode","starting_time":"2021-08-23T12:00:00Z","attester_public_key":"3pkFcBXCEmbmXBT2G8CkFMuKisJcH54mbBGvncHaDibt","authorised_jwt_issuers":["Be9wH7xuXBRJAuV1pC7MALZv6a61RvWQ3SypsNarqTt"]}"#;

        assert_eq!(attestation_content_json, expected_content);
        assert_eq!(attestation_json, expected_attestation);
@@ -12,6 +12,9 @@ pub enum UpgradeModeCheckError {
    #[error("the jwt metadata didn't contain explicit public key")]
    MissingTokenPublicKey,

+    #[error("the jwt signer does not appear in the authorised attestation set")]
+    UnauthorisedIssuer,
+
    #[error("the attached public key was not valid ed25519 public key")]
    MalformedEd25519PublicKey { source: Ed25519RecoveryError },

@@ -65,6 +65,12 @@ pub fn validate_upgrade_mode_jwt(
        .map_err(|source| UpgradeModeCheckError::JwtVerificationFailure { source })?
        .custom;

+    // jwt itself is cryptographically valid,
+    // but let's see if this entity has been permitted to issue the token in the first place
+    if !attestation.authorised_to_issue_jwt(&ed25519_pub_key) {
+        return Err(UpgradeModeCheckError::UnauthorisedIssuer);
+    }
+
    Ok(attestation)
 }

@@ -73,6 +79,7 @@ mod tests {
    use super::*;
    use crate::generate_new_attestation;
    use nym_crypto::asymmetric::ed25519;
+    use nym_test_utils::helpers::deterministic_rng;

    #[test]
    fn generate_and_validate_jwt() {
@@ -86,15 +93,25 @@ mod tests {
            2, 52, 215, 241, 219, 200, 18, 159, 241, 76, 111, 42, 32,
        ])
        .unwrap();
-        let keys = ed25519::KeyPair::from(jwt_key);
+        let jwt_keys = ed25519::KeyPair::from(jwt_key);

-        let attestation = generate_new_attestation(&attestation_key);
+        let mut rng = deterministic_rng();
+        let unauthorised_jwt_keys = ed25519::KeyPair::new(&mut rng);
+
+        let attestation = generate_new_attestation(&attestation_key, vec![*jwt_keys.public_key()]);
        let jwt_issuer = generate_jwt_for_upgrade_mode_attestation(
-            attestation,
+            attestation.clone(),
            Duration::from_secs(60 * 60),
-            &keys,
+            &jwt_keys,
            Some("nym-credential-proxy"),
        );
+        let unauthorised_jwt = generate_jwt_for_upgrade_mode_attestation(
+            attestation.clone(),
+            Duration::from_secs(60 * 60),
+            &unauthorised_jwt_keys,
+            Some("nym-credential-proxy"),
+        );
+
        // we expect 'nym-credential-proxy' issuer
        assert!(validate_upgrade_mode_jwt(&jwt_issuer, Some("nym-credential-proxy")).is_ok());

@@ -104,10 +121,15 @@ mod tests {
        // we expect another-issuer
        assert!(validate_upgrade_mode_jwt(&jwt_issuer, Some("another-issuer")).is_err());

+        // the key is not in the authorised set inside the attestation
+        assert!(
+            validate_upgrade_mode_jwt(&unauthorised_jwt, Some("nym-credential-proxy")).is_err()
+        );
+
        let jwt_no_issuer = generate_jwt_for_upgrade_mode_attestation(
            attestation,
            Duration::from_secs(60 * 60),
-            &keys,
+            &jwt_keys,
            None,
        );
        // we expect 'nym-credential-proxy' issuer
@@ -6,8 +6,10 @@ pub(crate) mod error;
 pub(crate) mod jwt;

 pub use attestation::{
-    UpgradeModeAttestation, attempt_retrieve, generate_new_attestation,
-    generate_new_attestation_with_starting_time,
+    UpgradeModeAttestation, generate_new_attestation, generate_new_attestation_with_starting_time,
 };
 pub use error::UpgradeModeCheckError;
 pub use jwt::{generate_jwt_for_upgrade_mode_attestation, validate_upgrade_mode_jwt};
+
+#[cfg(not(target_arch = "wasm32"))]
+pub use attestation::attempt_retrieve_attestation;
@@ -160,13 +160,12 @@ pub async fn setup_gateway_from_api(
    minimum_performance: u8,
    ignore_epoch_roles: bool,
 ) -> Result<InitialisationResult, WasmCoreError> {
-    let mut rng = thread_rng();
    let gateways = gateways_for_init(
-        &mut rng,
        nym_apis,
        None,
        minimum_performance,
        ignore_epoch_roles,
+        None,
    )
    .await?;
    setup_gateway_wasm(client_store, force_tls, chosen_gateway, gateways).await
@@ -178,13 +177,12 @@ pub async fn current_gateways_wasm(
    minimum_performance: u8,
    ignore_epoch_roles: bool,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let mut rng = thread_rng();
    gateways_for_init(
-        &mut rng,
        nym_apis,
        user_agent,
        minimum_performance,
        ignore_epoch_roles,
+        None,
    )
    .await
 }
@@ -832,6 +832,15 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"

+[[package]]
+name = "example-contract"
+version = "0.1.0"
+dependencies = [
+ "cosmwasm-std",
+ "cw-storage-plus",
+ "serde",
+]
+
 [[package]]
 name = "ff"
 version = "0.13.0"
@@ -9,7 +9,7 @@ members = [
    "multisig/cw3-flex-multisig",
    "multisig/cw4-group",
    "vesting",
-    "performance",
+    "performance", "example-contract",
 ]

 [workspace.package]
@@ -255,10 +255,12 @@ pub fn query(deps: Deps<'_>, env: Env, msg: QueryMsg) -> Result<QueryResponse, C
 }

 #[entry_point]
-pub fn migrate(deps: DepsMut<'_>, _env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
+pub fn migrate(deps: DepsMut<'_>, env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
    set_build_information!(deps.storage)?;
    cw2::ensure_from_older_version(deps.storage, CONTRACT_NAME, CONTRACT_VERSION)?;

+    crate::queued_migrations::introduce_historical_epochs(deps, env)?;
+
    Ok(Response::new())
 }

@@ -9,6 +9,7 @@ use crate::epoch_state::storage::{load_current_epoch, save_epoch};
 use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
 use crate::state::storage::STATE;
+use crate::verification_key_shares::storage::vk_shares;
 use crate::Dealer;
 use cosmwasm_std::{Deps, DepsMut, Env, Event, MessageInfo, Response};
 use nym_coconut_dkg_common::dealer::{DealerRegistrationDetails, OwnershipTransfer};
@@ -109,7 +110,7 @@ pub fn try_transfer_ownership(
    DEALERS_INDICES.save(deps.storage, &transfer_to, &current_index)?;
    DEALERS_INDICES.remove(deps.storage, &info.sender);

-    // update registration detail for every epoch the current dealer has participated in the protocol
+    // update registration detail and share information for every epoch the current dealer has participated in the protocol
    // ideally, we'd have only updated the current epoch, but the way the contract is constructed
    // forbids that otherwise we'd have introduced inconsistency
    for epoch_id in 0..=epoch.epoch_id {
@@ -117,6 +118,11 @@ pub fn try_transfer_ownership(
            EPOCH_DEALERS_MAP.remove(deps.storage, (epoch_id, &info.sender));
            EPOCH_DEALERS_MAP.save(deps.storage, (epoch_id, &transfer_to), &details)?;
        }
+        if let Some(mut vk_share) = vk_shares().may_load(deps.storage, (&info.sender, epoch_id))? {
+            vk_shares().remove(deps.storage, (&info.sender, epoch_id))?;
+            vk_share.owner = transfer_to.clone();
+            vk_shares().save(deps.storage, (&transfer_to, epoch_id), &vk_share)?;
+        }
    }

    let Some(transaction_info) = env.transaction else {
@@ -161,6 +167,14 @@ pub fn try_update_announce_address(
    details.announce_address = new_address.clone();
    EPOCH_DEALERS_MAP.save(deps.storage, (epoch.epoch_id, &info.sender), &details)?;

+    let mut contract_share = vk_shares().load(deps.storage, (&info.sender, epoch.epoch_id))?;
+    contract_share.announce_address = new_address.clone();
+    vk_shares().save(
+        deps.storage,
+        (&info.sender, epoch.epoch_id),
+        &contract_share,
+    )?;
+
    Ok(Response::new().add_event(
        Event::new("dkg-announce-address-update")
            .add_attribute("dealer", info.sender)
@@ -228,9 +242,14 @@ pub(crate) mod tests {
 #[cfg(feature = "testable-dkg-contract")]
 mod tests_with_mock {
    use super::*;
-    use crate::testable_dkg_contract::{init_contract_tester, DkgContractTesterExt};
+    use crate::testable_dkg_contract::{
+        init_contract_tester, init_contract_tester_with_group_members, DkgContractTesterExt,
+    };
+    use anyhow::Context;
    use cosmwasm_std::testing::message_info;
-    use nym_contracts_common_testing::ContractOpts;
+    use nym_coconut_dkg_common::msg::QueryMsg;
+    use nym_coconut_dkg_common::verification_key::PagedVKSharesResponse;
+    use nym_contracts_common_testing::{ChainOpts, ContractOpts};

    #[test]
    fn transferring_ownership() -> anyhow::Result<()> {
@@ -248,6 +267,7 @@ mod tests_with_mock {
        contract.run_initial_dummy_dkg();
        let old_index = DEALERS_INDICES.load(&contract, &group_member)?;
        let old_details = EPOCH_DEALERS_MAP.load(&contract, (0, &group_member))?;
+        let old_share = vk_shares().load(&contract, (&group_member, 0))?;

        let not_group_member = contract.addr_make("not_group_member");
        let (deps, env) = contract.deps_mut_env();
@@ -277,13 +297,20 @@ mod tests_with_mock {
        assert!(EPOCH_DEALERS_MAP
            .may_load(&contract, (0, &group_member))?
            .is_none());
+        assert!(vk_shares()
+            .may_load(&contract, (&group_member, 0))?
+            .is_none());

        let new_index = DEALERS_INDICES.load(&contract, &new_group_member)?;
        let new_details = EPOCH_DEALERS_MAP.load(&contract, (0, &new_group_member))?;
+        let new_share = vk_shares().load(&contract, (&new_group_member, 0))?;

        // the underlying info hasn't changed
        assert_eq!(old_index, new_index);
        assert_eq!(old_details, new_details);
+        assert_ne!(old_share, new_share);
+        assert_eq!(old_share.owner, group_member);
+        assert_eq!(new_share.owner, new_group_member);

        assert_eq!(
            OWNERSHIP_TRANSFER_LOG.load(
@@ -436,9 +463,91 @@ mod tests_with_mock {
        assert_eq!(old_details1, new_details1);
        assert_eq!(old_details2, new_details2);

-        // most  recent entry is updated
+        // most recent entry is updated
        assert_eq!(new_details3.announce_address, new_address);

        Ok(())
    }
+
+    #[test]
+    fn updating_announce_address_updates_vk_shares() -> anyhow::Result<()> {
+        let mut contract = init_contract_tester_with_group_members(3);
+        let group_member = contract.random_group_member();
+
+        contract.run_initial_dummy_dkg(); // => epoch 0
+        contract.run_reset_dkg(); // => epoch 1
+
+        // LEAVE DKG MEMBERSHIP
+        contract.remove_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 2
+
+        // COME BACK
+        contract.add_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 3
+
+        let old_address = EPOCH_DEALERS_MAP
+            .load(&contract, (3, &group_member))?
+            .announce_address;
+
+        let old_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let old_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let old_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(old_share2.is_none());
+        let old_share3 = vk_shares().may_load(&contract, (&group_member, 3))?;
+        assert!(old_share3.is_some());
+
+        let new_address = "https://new-address.com".to_string();
+        try_update_announce_address(
+            contract.deps_mut(),
+            message_info(&group_member, &[]),
+            new_address.clone(),
+        )?;
+
+        let new_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let new_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let new_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(new_share2.is_none());
+        let new_share3 = vk_shares().load(&contract, (&group_member, 3))?;
+
+        // old epoch data is unchanged
+        assert_eq!(old_share0, new_share0);
+        assert_eq!(old_share1, new_share1);
+        assert_eq!(old_share2, new_share2);
+
+        // most recent entry is updated
+        assert_eq!(new_share3.announce_address, new_address);
+
+        // finally an integration check against query endpoint
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 0,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, old_address);
+
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 3,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, new_address);
+
+        Ok(())
+    }
 }
@@ -1,2 +1,21 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
+
+use crate::epoch_state::storage::HISTORICAL_EPOCH;
+use crate::error::ContractError;
+use cosmwasm_std::{DepsMut, Env};
+
+pub fn introduce_historical_epochs(deps: DepsMut, env: Env) -> Result<(), ContractError> {
+    if HISTORICAL_EPOCH.may_load(deps.storage)?.is_some() {
+        return Err(ContractError::FailedMigration {
+            comment: "this migration has already been run before".to_string(),
+        });
+    }
+
+    #[allow(deprecated)]
+    let current = crate::epoch_state::storage::CURRENT_EPOCH.load(deps.storage)?;
+    // we won't have information on intermediate states prior to now, but that's not the end of the world
+    HISTORICAL_EPOCH.save(deps.storage, &current, env.block.height)?;
+
+    Ok(())
+}
@@ -62,12 +62,18 @@ impl TestableNymContract for DkgContract {
    where
        Self: Sized,
    {
-        init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+        init_contract_tester()
    }
 }

 pub fn init_contract_tester() -> ContractTester<DkgContract> {
-    DkgContract::init().with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
+    init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+}
+
+pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
+    prepare_contract_tester_builder_with_group_members(members)
+        .build()
+        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
 }

 pub fn prepare_contract_tester_builder_with_group_members<C>(
@@ -137,12 +143,6 @@ where
    builder
 }

-pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
-    prepare_contract_tester_builder_with_group_members(members)
-        .build()
-        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
-}
-
 pub trait DkgContractTesterExt:
    ContractOpts<ExecuteMsg = ExecuteMsg, QueryMsg = QueryMsg, ContractError = ContractError>
    + ChainOpts
@@ -0,0 +1,30 @@
+[package]
+name = "example-contract"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+exclude = [
+    # Those files are rust-optimizer artifacts. You might want to commit them for convenience but they should not be part of the source code publication.
+    "contract.wasm",
+    "hash.txt",
+    "artifacts",
+]
+
+[lib]
+name = "example_contract"
+crate-type = ["cdylib", "rlib"]
+
+
+[dependencies]
+cosmwasm-std = { workspace = true }
+cw-storage-plus = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+
+
+[lints]
+workspace = true
@@ -0,0 +1,5 @@
+wasm:
+	RUSTFLAGS='-C link-arg=-s' cargo build --release --target wasm32-unknown-unknown
+
+generate-schema:
+	cargo schema
@@ -0,0 +1,123 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_std::{
+    entry_point, to_json_binary, Addr, Coin, Deps, DepsMut, Env, Event, MessageInfo, QueryResponse,
+    Response,
+};
+use cw_storage_plus::Item;
+use serde::{Deserialize, Serialize};
+
+pub(crate) const COUNTER: Item<u32> = Item::new("counter");
+
+#[derive(Serialize, Deserialize)]
+pub struct InstantiateMsg {
+    initial_counter: u32,
+}
+
+#[derive(Serialize, Deserialize)]
+pub enum ExecuteMsg {
+    IncrementCounter {},
+    DecrementCounter {},
+    SetCounter { to: u32 },
+}
+
+#[derive(Serialize, Deserialize)]
+pub enum QueryMsg {
+    GetCounter {},
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct MigrateMsg {}
+
+#[entry_point]
+pub fn instantiate(
+    mut deps: DepsMut<'_>,
+    env: Env,
+    info: MessageInfo,
+    msg: InstantiateMsg,
+) -> Result<Response, String> {
+    COUNTER
+        .save(deps.storage, &msg.initial_counter)
+        .map_err(|err| err.to_string())?;
+    Ok(Response::default())
+}
+
+#[entry_point]
+pub fn execute(
+    deps: DepsMut<'_>,
+    env: Env,
+    info: MessageInfo,
+    msg: ExecuteMsg,
+) -> Result<Response, String> {
+    match msg {
+        ExecuteMsg::IncrementCounter {} => {
+            let current_value = COUNTER.load(deps.storage).map_err(|err| err.to_string())?;
+            COUNTER
+                .save(deps.storage, &(current_value + 1))
+                .map_err(|err| err.to_string())?;
+        }
+        ExecuteMsg::DecrementCounter {} => {
+            let current_value = COUNTER.load(deps.storage).map_err(|err| err.to_string())?;
+            COUNTER
+                .save(deps.storage, &(current_value - 1))
+                .map_err(|err| err.to_string())?;
+        }
+        ExecuteMsg::SetCounter { to } => {
+            COUNTER
+                .save(deps.storage, &(to))
+                .map_err(|err| err.to_string())?;
+        }
+    }
+    Ok(Response::new().add_event(Event::new("my-amazing-event").add_attribute("key1", "value1")))
+}
+
+#[entry_point]
+pub fn query(deps: Deps<'_>, env: Env, msg: QueryMsg) -> Result<QueryResponse, String> {
+    let query_res = match msg {
+        QueryMsg::GetCounter {} => {
+            to_json_binary(&COUNTER.load(deps.storage).map_err(|err| err.to_string())?)
+        }
+    };
+
+    Ok(query_res.map_err(|err| err.to_string())?)
+}
+
+#[entry_point]
+pub fn migrate(mut deps: DepsMut<'_>, _env: Env, msg: MigrateMsg) -> Result<Response, String> {
+    Ok(Response::default())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use cosmwasm_std::from_json;
+    use cosmwasm_std::testing::{message_info, mock_dependencies, mock_env};
+
+    #[test]
+    fn it_works() {
+        let mut deps = mock_dependencies();
+        let env = mock_env();
+
+        let init_msg = InstantiateMsg {
+            initial_counter: 123,
+        };
+
+        let sender = message_info(&deps.api.addr_make("mock-sender"), &[]);
+        instantiate(deps.as_mut(), env, sender, init_msg).unwrap();
+
+        assert_eq!(COUNTER.load(deps.as_ref().storage).unwrap(), 123);
+
+        let msg = ExecuteMsg::IncrementCounter {};
+        let sender = message_info(&deps.api.addr_make("mock-sender"), &[]);
+
+        execute(deps.as_mut(), mock_env(), sender, msg).unwrap();
+        assert_eq!(COUNTER.load(deps.as_ref().storage).unwrap(), 124);
+
+        let msg = QueryMsg::GetCounter {};
+        let query_res = query(deps.as_ref(), mock_env(), msg).unwrap();
+        println!("raw binary: {:?}", query_res);
+        println!("string: {:?}", String::from_utf8_lossy(&query_res));
+        println!("deserialised: {:?}", from_json::<u32>(query_res).unwrap());
+    }
+}
@@ -0,0 +1 @@
+pub mod contract;
@@ -1,12 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn legacy_mixnode_bonding() {
-        todo!()
-    }
-}
@@ -2,7 +2,3 @@
 // SPDX-License-Identifier: Apache-2.0

 pub(crate) mod transactions;
-
-// the purpose of that module is to keep track of tests of legacy features that will eventually be phased out
-// such as standalone mixnode/gateway bonding
-pub(crate) mod legacy;
@@ -1,27 +1,26 @@
-```ts copy filename="mixFetchExample.tsx"
-import React, { useState } from 'react';
-import CircularProgress from '@mui/material/CircularProgress';
-import Button from '@mui/material/Button';
-import TextField from '@mui/material/TextField';
-import Typography from '@mui/material/Typography';
-import Box from '@mui/material/Box';
-import { mixFetch } from '@nymproject/mix-fetch-full-fat';
-import Stack from '@mui/material/Stack';
-import Paper from '@mui/material/Paper';
-import type { SetupMixFetchOps } from '@nymproject/mix-fetch';
+```tsx copy filename="mixFetchExample.tsx"
+import React, { useState } from "react";
+import CircularProgress from "@mui/material/CircularProgress";
+import Button from "@mui/material/Button";
+import TextField from "@mui/material/TextField";
+import Typography from "@mui/material/Typography";
+import Box from "@mui/material/Box";
+import { mixFetch } from "@nymproject/mix-fetch-full-fat";
+import Stack from "@mui/material/Stack";
+import Paper from "@mui/material/Paper";
+import type { SetupMixFetchOps } from "@nymproject/mix-fetch-full-fat";

-const defaultUrl = 'https://nym.com/favicon.svg';
-const args = { mode: 'unsafe-ignore-cors' };
+const defaultUrl = "https://nymtech.net/.wellknown/network-requester/exit-policy.txt";
+const args = { mode: "unsafe-ignore-cors" };

 const mixFetchOptions: SetupMixFetchOps = {
-  preferredGateway: '6Gb7ftQdKveMjPyrxDXeAtfYAX7Zg5mVZHtnRC5MmZ1B', // with WSS
-  preferredNetworkRequester:
-    '8rRGWy54oC8drFL9DepMegBt2DLrsqQwCoHMXt9nsnTo.2XjCPVbb4FpQ9hNRcXwb9mTzEAVVk1zf1tcch3wdtNEA@6Gb7ftQdKveMjPyrxDXeAtfYAX7Zg5mVZHtnRC5MmZ1B',
+  preferredGateway: "2xU4CBE6QiiYt6EyBXSALwxkNvM7gqJfjHXaMkjiFmYW", // with WSS
+  // preferredNetworkRequester:
+  //   "CTDxrcXgrZHWyCWnuCgjpJPghQUcEVz1HkhUr5mGdFnT.3UAww1YWNyVNYNWFQL1LaHYouQtDiXBGK5GiDZgpXkTK@2RFtU5BwxvJJXagAWAEuaPgb5ZVPRoy2542TT93Edw6v",
  mixFetchOverride: {
    requestTimeoutMs: 60_000,
  },
  forceTls: true, // force WSS
-  extra: {},
 };

 export const MixFetch = () => {
@@ -45,7 +44,7 @@ export const MixFetch = () => {
  };

  return (
-    <div style={{ marginTop: '1rem' }}>
+    <div style={{ marginTop: "1rem" }}>
      <Stack direction="row">
        <TextField
          disabled={busy}
@@ -56,7 +55,12 @@ export const MixFetch = () => {
          defaultValue={defaultUrl}
          onChange={(e) => setUrl(e.target.value)}
        />
-        <Button variant="outlined" disabled={busy} sx={{ marginLeft: '1rem' }} onClick={handleFetch}>
+        <Button
+          variant="outlined"
+          disabled={busy}
+          sx={{ marginLeft: "1rem" }}
+          onClick={handleFetch}
+        >
          Fetch
        </Button>
      </Stack>
@@ -1,15 +1,19 @@
 ```ts copy filename="MixnetWASMClientExample.tsx"
-import React, { useEffect, useState } from 'react';
-import { createNymMixnetClient, NymMixnetClient, Payload } from '@nymproject/sdk-full-fat';
-import Box from '@mui/material/Box';
-import CircularProgress from '@mui/material/CircularProgress';
-import Paper from '@mui/material/Paper';
-import Typography from '@mui/material/Typography';
-import Stack from '@mui/material/Stack';
-import TextField from '@mui/material/TextField';
-import Button from '@mui/material/Button';
+import React, { useEffect, useState } from "react";
+import {
+  createNymMixnetClient,
+  NymMixnetClient,
+  Payload,
+} from "@nymproject/sdk-full-fat";
+import Box from "@mui/material/Box";
+import CircularProgress from "@mui/material/CircularProgress";
+import Paper from "@mui/material/Paper";
+import Typography from "@mui/material/Typography";
+import Stack from "@mui/material/Stack";
+import TextField from "@mui/material/TextField";
+import Button from "@mui/material/Button";

-const nymApiUrl = 'https://validator.nymtech.net/api';
+const nymApiUrl = "https://validator.nymtech.net/api";

 export const Traffic = () => {
  const [nym, setNym] = useState<NymMixnetClient>();
@@ -17,27 +21,31 @@ export const Traffic = () => {
  const [recipient, setRecipient] = useState<string>();
  const [payload, setPayload] = useState<Payload>();
  const [receivedMessage, setReceivedMessage] = useState<string>();
+  const [buttonEnabled, setButtonEnabled] = useState<boolean>(false);

  const init = async () => {
    const client = await createNymMixnetClient();
    setNym(client);

+    // start the client and connect to a gateway
    await client?.client.start({
      clientId: crypto.randomUUID(),
      nymApiUrl,
      forceTls: true, // force WSS
    });

+    // check when is connected and set the self address
    client?.events.subscribeToConnected((e) => {
      const { address } = e.args;
      setSelfAddress(address);
    });

+    // show whether the client is ready or not
    client?.events.subscribeToLoaded((e) => {
-      console.log('Client ready: ', e.args);
+      console.log("Client ready: ", e.args);
    });

-
+    // show message payload content when received
    client?.events.subscribeToTextMessageReceivedEvent((e) => {
      console.log(e.args.payload);
      setReceivedMessage(e.args.payload);
@@ -48,7 +56,8 @@ export const Traffic = () => {
    await nym?.client.stop();
  };

-  const send = () => nym.client.send({ payload, recipient });
+  const send = () =>
+    payload && recipient && nym?.client.send({ payload, recipient });

  useEffect(() => {
    init();
@@ -57,9 +66,17 @@ export const Traffic = () => {
    };
  }, []);

+  useEffect(() => {
+    if (recipient && payload) {
+      setButtonEnabled(true);
+    } else {
+      setButtonEnabled(false);
+    }
+  }, [recipient, payload]);
+
  if (!nym || !selfAddress) {
    return (
-      <Box sx={{ display: 'flex' }}>
+      <Box sx={{ display: "flex" }}>
        <CircularProgress />
      </Box>
    );
@@ -67,10 +84,10 @@ export const Traffic = () => {

  return (
    <Box padding={3}>
-      <Paper style={{ marginTop: '1rem', padding: '2rem' }}>
+      <Paper style={{ marginTop: "1rem", padding: "2rem" }}>
        <Stack spacing={3}>
          <Typography variant="body1">My self address is:</Typography>
-          <Typography variant="body1">{selfAddress || 'loading'}</Typography>
+          <Typography variant="body1">{selfAddress || "loading"}</Typography>
          <Typography variant="h5">Communication through the Mixnet</Typography>
          <TextField
            type="text"
@@ -83,15 +100,22 @@ export const Traffic = () => {
            placeholder="Message to send"
            multiline
            rows={4}
-            onChange={(e) => setPayload({ message: e.target.value, mimeType: 'text/plain' })}
+            onChange={(e) =>
+              setPayload({ message: e.target.value, mimeType: "text/plain" })
+            }
            size="small"
          />
-          <Button variant="outlined" onClick={() => send()} disabled={!payload || !recipient} sx={{width: 'fit-content'}}>
+          <Button
+            variant="outlined"
+            onClick={() => send()}
+            disabled={!buttonEnabled}
+            sx={{ width: "fit-content" }}
+          >
            Send
          </Button>
        </Stack>
        {receivedMessage && (
-          <Stack spacing={3} style={{ marginTop: '1rem' }}>
+          <Stack spacing={3} style={{ marginTop: "1rem" }}>
            <Typography variant="h5">Message Received!</Typography>
            <Typography fontFamily="monospace">{receivedMessage}</Typography>
          </Stack>
@@ -9,13 +9,13 @@ import Stack from "@mui/material/Stack";
 import Paper from "@mui/material/Paper";
 import type { SetupMixFetchOps } from "@nymproject/mix-fetch-full-fat";

-const defaultUrl = "https://nym.com/favicon.svg";
+const defaultUrl = "https://nymtech.net/.wellknown/network-requester/exit-policy.txt";
 const args = { mode: "unsafe-ignore-cors" };

 const mixFetchOptions: SetupMixFetchOps = {
-  preferredGateway: "6Gb7ftQdKveMjPyrxDXeAtfYAX7Zg5mVZHtnRC5MmZ1B", // with WSS
-  preferredNetworkRequester:
-    "8rRGWy54oC8drFL9DepMegBt2DLrsqQwCoHMXt9nsnTo.2XjCPVbb4FpQ9hNRcXwb9mTzEAVVk1zf1tcch3wdtNEA@6Gb7ftQdKveMjPyrxDXeAtfYAX7Zg5mVZHtnRC5MmZ1B",
+  preferredGateway: "2xU4CBE6QiiYt6EyBXSALwxkNvM7gqJfjHXaMkjiFmYW", // with WSS
+  // preferredNetworkRequester:
+  //   "CTDxrcXgrZHWyCWnuCgjpJPghQUcEVz1HkhUr5mGdFnT.3UAww1YWNyVNYNWFQL1LaHYouQtDiXBGK5GiDZgpXkTK@2RFtU5BwxvJJXagAWAEuaPgb5ZVPRoy2542TT93Edw6v",
  mixFetchOverride: {
    requestTimeoutMs: 60_000,
  },
@@ -0,0 +1,2 @@
+export const ICMP =
+  "ICMP (Internet Control Message Protocol) is a network layer protocol used for sending error messages and operational information regarding network conditions. It is commonly utilized for diagnostic purposes, such as sending ping requests to check the reachability of a host. ICMP helps in managing and controlling network traffic by providing feedback about issues in the communication environment.";
@@ -0,0 +1,3 @@
+export const IPR =
+  "IPR (IP Packet Router) is a component that routes packets to the Internet on behalf of clients within the Nym network. It uses multiplexed streams, NAT, and SURBs for anonymity.";
+
@@ -0,0 +1,93 @@
+import { Callout } from 'nextra/components';
+
+
+## Mixnet: Node Performance Calculation
+
+Performance is a value between `0` and `1`. The final performance number is a result of multiplying [config score](#config-score-calculation) and [routing score](#routing-score-calculation).
+
+<Callout type="info" emoji="📌">
+> **node_performance = config_score \* routing_score**
+</Callout>
+
+Performance value is an average of last 24h.
+
+<Callout>
+All parameters regarding performance score can be browsed or pull live from:
+
+`https://validator.nymtech.net/api/v1/nym-nodes/annotation/<NODE_ID>`
+
+In case you don't know your nodes `NODE_ID`, it's easy to find as long as your node is bonded. Visit [validator.nymtech.net/api/v1/nym-nodes/bonded](https://validator.nymtech.net/api/v1/nym-nodes/bonded) and search your node using `identity_key` or bonding Nyx account address (denoted as `owner`).
+</Callout>
+
+### Config Score Calculation
+
+Config score is in place to ensure that the node configuration is done properly so the node is eligible for taking part in Nym network. The API looks into these paramteres:
+
+1. If the node binary is `nym-node` (not legacy `nym-mixnode` or `nym-gateway`): `1` if `True`, `0` if `False`
+2. If [Terms & Conditions](/operators/nodes/nym-node/setup.mdx#terms--conditions) are accepted: `1` if `True`, `0` if `False`
+3. If the nodes self described endpoint is available: `1` if `True`, `0` if `False`
+4. Version of `nym-node` binary: decreasing weight for outdated versions, as [explained below](#versions-behind-calculation)
+
+**The `config_score` calculation formula:**
+
+<Callout type="info" emoji="📌">
+> **config_score = is_tc_accepted \* is_nym-node_binary \* self_described_api_available \* ( 0.995 ^ ( ( X * versions_behind) ^ 1.65 ) )**
+</Callout>
+
+First three points have binary values of either `0` or `1`, with a following logic:
+
+| **Run `nym-node` binary** | **T&C's accepted** | **Self described available** | **Value** |
+| :--                       | :--                | :--                          | ---:      |
+| **True**                  | **True**           | **True**                     | **1**     |
+| True                      | False              | False                        | 0         |
+| True                      | True               | False                        | 0         |
+| False                     | True               | True                         | 0         |
+| False                     | False              | True                         | 0         |
+| True                      | False              | True                         | 0         |
+| False                     | False              | False                        | 0         |
+| False                     | True               | False                        | 0         |
+
+**Only if ALL conditions above are `True` the node can have any chance to be selected, as otherwise the probability will always be 0.**
+
+<Callout type="info" emoji="ℹ️">
+Besides these values, the API also checks whether the node is bonded in Mixnet smart contract as a Nym Node or legacy node (Mixnode or Gateway). **Only nodes bonded as Nym Node in Mixnet smart contract can be selected to the Rewrded set. Thus, if you haven't migrated your node yet, please [follow these steps](/operators/nodes/nym-node/bonding#migrate-to-nym-node-in-mixnet-smart-contract)!**
+</ Callout>
+
+#### Versions Behind Calculation
+
+From release `2024.14-crunch` (`nym-node v1.2.0`), the `config_score` parameter takes into account also nodes version (denoted as `versions_behind`). The "current version" is the one marked as `Latest` in the [repository](https://github.com/nymtech/nym/releases/). The parameter `versions_behind` indicates the number of versions between the `Latest` version and the version run by the node, and it is factored into the config score with this formula:
+
+<Callout type="info" emoji="📌">
+> **0.995 ^ ( ( X * versions_behind ) ^ 1.65 )**
+>
+> where: <br />
+> **X = 1;       for patches** <br />
+> **X = 10;      for minor versions** <br />
+> **X = 100;     for major versions**
+</Callout>
+
+> The exact parameters are live accessible on [`/v1/status/config-score-details`](https://validator.nymtech.net/api/swagger/index.html#/Status/config_score_details).
+
+Our versioning convention is: `major_version . minor_version . patch`
+
+For example `nym-node` on version `1.2.0` is on 1st major version, 2nd minor and 0 patches.
+
+Note that the `X` multiplier heavily lowers the `config_score` when nodes are outdated with respect to more significant updates. See the the table and graph below:
+
+| **Version behind**  | **Patches (X = 1)** | **Minor versions (X = 10)** | **Major versions (X = 100)** |
+| :--                 | --:       | --: | --: |
+| 0 (current version) | 1.0 | 1.0 | 1.0 |
+| 1 | 0.995 | 0.7994 | 0.0000 |
+| 2 | 0.9844 | 0.4953 | 0.0000 |
+| 3 | 0.9698 | 0.2536 | 0.0000 |
+| 4 | 0.9518 | 0.1102 | 0.0000 |
+| 5 | 0.9311 | 0.0413 | 0.0000 |
+
+
+![](/images/operators/tokenomics/reward_version_graph.png)
+
+As you can see above, the algorithm is designed to give maximum selection score (`1`) to the latest version, while non-upgraded nodes receive a lower score. The score decreases faster when the node has failed to make a major version upgrade, and slower when the node is behind only with minor updates. This scoring de-prioritizes the selection of outdated nodes, even if their saturation and performance are high. Nodes are selected probabilistically in each epoch (60 min), according to their scores, to be part of the Rewarded set. This scoring mechanism gives priority to the operators running up-to-date nodes, ensuring that the network is as updated as possible.
+
+### Routing Score Calculation
+
+Routing score is measured by Nym Network Monitor which sends thousands of packages through different routes every 15 minutes and measures how many were dropped on the way. Test result represents percentage of packets succesfully returned which are then converted into floats bettween `0` and `1`.
@@ -0,0 +1,223 @@
+import { Callout } from 'nextra/components';
+import { Steps } from 'nextra/components';
+import { Green, Yellow, Red, Gray } from 'components/severity.jsx'
+import { IPR } from 'components/operators/snippets/ipr.js';
+import { ICMP } from 'components/operators/snippets/icmp.js';
+
+## WireGuard: Gateways Performance Calculation
+
+> If you are looking for a page with a guide to run your own `gateway-probe` instance, go [here](/operators/performance-and-testing/gateway-probe).
+
+<Callout type="info" emoji="ℹ️">
+**Note that there is only one binary `nym-node` for [all network functionalities](/operators/nodes/nym-node/setup#functionality-mode) (defined by a positional argument `--mode`).**
+
+When we say *Exit Gateway* in connection to Wireguard, we talk about a `nym-node` running in a mode Exit Gateway (`--mode exit-gateway`) with Wireguard enabled. Such node is listed in [NymVPN application](https://nym.com) as an Exit Gateway and an Entry Gateway for both dVPN (2-hop) and Mixnet (5-hop) options. That's because every Exit Gateway can serve as an Entry, not vice versa for Mixnet and every Gateway with Wireguard enabled option (`--wireguard-enabled true`) can always serve as both Entry and Exit for dVPN (provided that they are correctly [configured](/operators/nodes/nym-node/configuration)).
+</Callout>
+
+**Please note that even the most perfectly configured Gateway, running on the strongest machine may not always be listed as a suggested node in the app. If you are interested to learn the details why, check out the [Gateway Probe Details page](/operators/performance-and-testing/gateway-probe-details).**
+
+### Summary
+
+A simplified explanation of node performance measuring is that the [Node Status API](https://node-status.nym.com) runs [gateway probes](/operators/performance-and-testing/gateway-probe) that connect to gateways to:
+
+- Check the configuration of gateways
+  - Checks a list of capabilities (e.g. can route IPv4 traffic in mixnet mode)
+  - Checks a list of configuration (e.g. runs <abbr title={IPR}>IPR</abbr>, has exit policy)
+- Acts like a user:
+  - Registers a mixnet client
+  - Registers a wireguard peer and tops up bandwidth with a zk-nym
+  - Sends <abbr title={ICMP}>ICMP</abbr> ping packets
+  - Downloads files
+
+The results are collected and stored in the [Node Status API](https://node-status.nym.com) and can be also veiwed per node in [Node Status Observatory](https://harbourmaster.nymtech.net).
+
+The [NymVPN API directory](https://nymvpn.com/api/public/v1/directory/gateways) cache uses the output of the gateway probes to calculate and display hints to users about the contention on each gateway and what they might expect if they use the gateway. The section [*Gateway Roles & Requirements* below](#gateway-roles--requirements) explains how are these stats measured and what is their significance.
+
+### Performance Score
+
+Gateways are listed in NymVPN application displaying various stats.
+
+![](/images/operators/nym-vpn-sceenshots/nym-vpn-score1.png)
+
+There are four colored score bars.
+
+![](/images/operators/nym-vpn-sceenshots/nym-vpn-score2.png)
+
+This is how they are defined:
+
+<Steps>
+
+###### 1. Overall performance: 
+
+Calculated by mixnet performance score multiplied by WireGuard performance, this is the formula: 
+<Callout type="info" emoji="📌">
+> **mixnet_performance * (download_speed_score * ping_ips_performance_v4)**
+</Callout>
+- <Green>High</Green>: `> 75%`
+- <Yellow>Medium</Yellow>: `> 50%`
+- <Red>Low</Red>: > `10%`
+- <Gray>Offline</Gray>: `≤ 10%`
+
+- **Download speed scoring:** 
+<Callout type="info" emoji="📌">
+> **\> 5 Mbps = 1.0** <br />
+> **\> 2 Mbps = 0.75** <br />
+> **\> 1 Mbps = 0.5** <br />
+> **\> 0.5 Mbps = 0.25** <br />
+> **otherwise = 0.1**
+</Callout>
+
+###### 2. Server Load:
+
+A load indicator based on ping success
+
+- <Green>Low</Green>: `> 80%` ping success (low load)
+- <Yellow>Medium</Yellow>: `> 40%` ping success (medium load)
+- <Red>High</Red>: `≤ 40%` ping success (node under stress, high load)
+
+###### 3. Uptime:
+
+A routing score of Mixnet (5-hop) is indicated this way:
+- <Green>High</Green>: `> 80%` mixnet packet delivery success
+- <Yellow>Medium</Yellow>: `> 60%` mixnet packet delivery success
+- <Red>Low</Red>: `> 10%` mixnet packet delivery success
+- <Gray>Offline</Gray>: `≤ 10%` mixnet packet delivery success
+
+</Steps>
+
+Note that there are caches in place to keep various dept of details to provide info for different pieces of the software. Their timing differs and it can lead to small discrepancies of outcome in between multiple clients observed by users at the same time.
+
+See the [*Gateway Roles & Requirements*](#gateway-roles--requirements) to understand how these stats get measured.
+
+<Callout>
+You can find more details [directly in the code](https://github.com/nymtech/nym-vpn-client/blob/develop/nym-vpn-app/src/hooks/useScore.ts#L10).
+</Callout>
+
+### Gateway Roles & Requirements
+
+A node configuration break down coming alongside basic [server configuration](/operators/nodes/preliminary-steps/vps-setup) required for the nodes in specific roles:
+
+- **Entry Gateway - Mixnet:**
+    - Node configured (running with `--mode` argument) as `entry-gateway` or `exit-gateway` (as Exit works as Entry too)
+    - `WS/WSS` ports (9000/9001) accessible
+    - [IPv6 configured](/operators/nodes/nym-node/configuration#quick-ipv6-check)
+- **Exit Gateway - Mixnet:**
+    - Node configured (running with `--mode` argument) as `exit-gateway`, that configuration ensures that:
+        - <abbr title={IPR}>IPR</abbr> address present
+        - NR address present
+    - [IPv6 configured](/operators/nodes/nym-node/configuration#quick-ipv6-check)
+    - NymTun configured - using [NetworkTunnelManager](/operators/nodes/nym-node/configuration#routing-configuration)
+
+- **Entry & Exit Gateway - dVPN (WireGuard mode):**
+    - Node configured as Wireguard node: `--wireguard-enabled true`
+    - Authenticator address present
+    - NymWG configured - using [NetworkTunnelManager](/operators/nodes/nym-node/configuration#routing-configuration)
+    - [Metadata port open for WG](/operators/nodes/nym-node/configuration#fixing-metadata-port-showing-not-open-in-probe-results)
+    - Wireguard exit policy [configured](/operators/nodes/nym-node/configuration#wireguard-exit-policy-configuration)
+    - [IPv6 configured](/operators/nodes/nym-node/configuration#quick-ipv6-check)
+    - Recommended: [QUIC bridge setup](/operators/nodes/nym-node/configuration#quic-transport-bridge-deployment)
+
+### How Probe Works
+
+Nym Gateway probe is perfomance measurement program running tests through various routes. Operators can run their [local instance of Gateway probe](/operators/performance-and-testing/gateway-probe) or use visit of our dashboards to conveniently see probe results.
+
+- [Node Status dashboard](https://node-status.nym.com/dvpn): Shows latest probe results on one board
+- [Nym Node Status Observatory](https://harbourmaster.nymtech.net): New version of a good old Nym Harbourmaster, allowing operators preview stats of each node
+
+The following sections explain what is measured in order to collect stats to the [API enpoint](https://nymvpn.com/api/public/v1/directory/gateways) and in the section [*Complete Setup Checklist*](#complete-setup-checklist) below you can see the order of measurements.
+
+#### Entry Gateway - Mixnet (5-hop)
+
+**Tests:**
+
+- `can_connect`: Can connect to client WS/WSS endpoint (ports 9000/9001)
+- `can_route`: Entry gateway correctly forwards packets into the mixnet
+
+**To Pass:**
+
+- Expose correct `WS` and or `WSS` ports (`9000`/ `9001`)
+- Ensure DNS A/AAAA records resolve correctly
+- Verify IPv6 is actually reachable (not just in DNS)
+- Keep node online and monitor packet loss
+
+#### Exit Gateway (IPR) - Mixnet (5-hop)
+
+**Tests:**
+
+- `can_connect`: Can connect to <abbr title={IPR}>IPR</abbr>
+- `can_route_ip_v4`: IPv4 routing works
+- `can_route_ip_external_v4`: IPv4 routing to external internet works
+- `can_route_ip_v6`: IPv6 routing works
+- `can_route_ip_external_v6`: IPv6 routing to external internet works
+
+**To Pass:**
+
+- Ensure upstream routing and NAT allow both IPv4 and IPv6 traffic to external internet
+- Check system firewall rules (bidirectional)
+- Confirm outbound reachability to common external hosts on both stacks
+- Run node with `mode=exit-gateway` - this by default includes entry-gateway mode.
+
+#### Gateways - WireGuard (dVPN / 2-hop)
+
+**Tests:**
+
+- `can_register`: Authentication flow completes successfully
+- `can_handshake`: WireGuard handshake succeeds
+- `can_resolve_dns`: DNS resolution works
+- `can_query_metadata_v4`: Can query metadata endpoint
+- `ping_hosts_performance` / `ping_ips_performance`: Latency and packet loss metrics
+
+**To Pass:**
+
+- Open WireGuard UDP port `51822` (public)
+- Ensure metadata TCP port `51830` is accessible inside the WireGuard tunnel (at `10.1.0.1:51830`) for bandwidth queries/topup
+- Keep QUIC bridge (`UDP 4443`) healthy if deployed
+- Reduce server latency/jitter (depends on provider and location)
+- Ensure DNS resolvers are reliable
+- Pass the `--wireguard-enabled true` flag in the node config
+
+### Probe Freshness
+
+- Probes run continuously; each node is typically tested every ~2 hours
+- If a probe fails or times out, the gateway will have stale probe data until the next successful probe completes
+- `last_updated_utc`: Timestamp indicating when the last successful probe test completed
+
+See [*Complete Setup Checklist*](#complete-setup-checklist) to understand the order of tests.
+
+### Complete Setup Checklist
+
+**If one test fails, the following points don't get checked!**
+
+#### On-Chain & Configuration
+
+- [ ] [Bonded on-chain](/operators/nodes/nym-node/bonding) with [correct role](/operators/nodes/nym-node/setup#functionality-mode) (`exit-gateway`) and correct ports opened exposed
+- [ ] Self-description endpoint is reachable
+- [ ] [T&Cs accepted](/operators/nodes/nym-node/setup#terms--conditions)
+
+#### Network & Ports
+
+- [ ] **Mixnet**: Port `1789` (mixnet) accessible; ports `9000` (`WS`) and `9001` (`WSS`) accessible with valid [TLS for WSS](/operators/nodes/nym-node/configuration/proxy-configuration#reverse-proxy-configuration)
+- [ ] [**QUIC bridge**](/operators/nodes/nym-node/configuration#quic-transport-bridge-deployment) (if used): UDP 4443 with valid addresses and SNI host
+- [ ] [**WireGuard**](/operators/nodes/nym-node/configuration#routing-configuration): `UDP 51822` open (public); `TCP 51830` accessible [inside WireGuard tunnel](/operators/nodes/nym-node/configuration#fixing-metadata-port-showing-not-open-in-probe-results) (`10.1.0.1:51830`); `--wireguard-enabled true` set in node config
+- [ ] **Exit (<abbr title={IPR}>IPR</abbr>)**: [IPv4 and IPv6](/operators/nodes/nym-node/configuration#routing-configuration) routing to external internet configured
+- [ ] **DNS**: A/AAAA records correct; IPv6 actually reachable (test, don't just add DNS)
+
+#### Performance Targets
+
+- [ ] Achieve `≥ 60%` mixnet performance (Medium)
+- [ ] Aim for `≥ 80%` (High) for optimal visibility
+- [ ] Keep latency and packet loss low (excessive load reduces performance scores)
+- [ ] Keep uptime high (network monitor tracks this)
+
+#### Probe Results (Verify All Pass)
+
+- [ ] Entry: `can_connect=true` and `can_route=true`
+- [ ] Exit: `can_connect=true` and all v4/v6 routing flags are `true`
+- [ ] WireGuard: `can_register`, `can_handshake`, `can_resolve_dns`, and `can_query_metadata_v4` all pass; ping metrics good
+
+#### Recommended
+
+- [ ] [WSS enabled](/operators/nodes/nym-node/configuration/proxy-configuration) (connections may fail on clients if only WS is available)
+- [ ] [QUIC bridge](/operators/nodes/nym-node/configuration#quic-transport-bridge-deployment) operational (ensures your node appears when users enable QUIC only filter on the app)
+- [ ] Accurate geo/IP information (country/region/residential filters rely on this)
+- [ ] Stay on most recent supported binary version - [old versions are penalised](/operators/performance-and-testing#versions-behind-calculation)
@@ -3,7 +3,7 @@ import { Callout } from 'nextra/components';
 import { AccordionTemplate } from 'components/accordion-template.tsx';

 <Callout type="info" emoji="ℹ️">
-**QUIC bridge is a requirement for all nodes which enable Wireguard functionality. Note that it this feature is compatible with nodes from `v1.18.0` (platform release [`v2025.17-isabirra`](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.17-isabirra)) and newer!**
+**QUIC bridge is a requirement for all nodes which enable Wireguard functionality. Note that it this feature is compatible with nodes from `v1.19.0` (platform release [`v2025.18-jarlsberg`](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.17-isabirra)) and newer!**
 </ Callout>

 Nym Network uses various [transport bridges](https://github.com/nymtech/nym-bridges/blob/main/README.md) for routing the packets. Right now operators need to configure [our implementation](https://github.com/nymtech/nym-bridges/tree/main/nym-bridge) of general-purpose transport layer network protocol called [QUIC](https://en.wikipedia.org/wiki/QUIC).
@@ -12,36 +12,43 @@ Operators can use [Nym Bridge Configuration Tool](https://github.com/nymtech/nym

 **We recommend a more convenient QUIC bridge deployment using a script [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh), following the steps below.**

+<Callout type="warning" emoji="⚠️">
+This script assumes that you follow the convention of running a `nym-node` as `root`. In case you run as a [non-root user](/operators/nodes/nym-node/configuration#running-nym-node-as-a-non-root), please follow [manual QUIC bridge setup](https://github.com/nymtech/nym-bridges/blob/main/README.md) and ask for support in the [Matrix channel](https://matrix.to/#/#operators:nymtech.chat).
+</Callout>
+
 <Steps>
 ###### 1. Download [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh) script
 - SSH to your server
+- **Run as root**
 - Download the script and make executable
 ```sh
-wget https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh && \
+curl -L https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh -o quic_bridge_deployment.sh && \
 chmod +x quic_bridge_deployment.sh
 ```

-
 ###### 2. Run the script with `full_bridge_setup` command
 - Optional: open `tmux` in case you will need to run another commands on the VPS
 - Run the script with a command `full_bridge_setup`
 ```sh
-./nym-node-setup/quic_bridge_deployment.sh full_bridge_setup
+./quic_bridge_deployment.sh full_bridge_setup
 ```

 ###### 3. Follow the interactive prompts
- When you are asked for bridge binary URL, look here for one to match your system: [builds.ci.nymte.ch/QUIC](https://builds.ci.nymte.ch/QUIC/)
- When you are asked to enter forward address, it's your IPv4 used for bonding the node, alongside port `:51822` (an example: `172.232.238.161:51822`)
- To find out your IP address you can always run:
-    - IPv4: `curl -4 https://ifconfig.co/ip`
-    - IPv6: `curl -6 https://ifconfig.co/ip`
- **For all prompts with default options, we highly recommend to stick to default (press enter)**
+- Make sure you don't just press enter to insert default values if your setup is different, for example in case of path to the config file

-###### 4. Restart the node service
+###### 4. Validate
+
+- After running the script, ensure that the bridges are running correctly:
+```sh
+systemctl status nym-bridge.service
+```
+
+###### 5. Restart `nym-node` service
 - When done with the deployment, please restart your node systemd service
 ```sh
 service nym-node restart && journalctl -u nym-node.service -f --all
 ```
+
 </Steps>

 Congratulation, you deployed QUIC transport bridge! The script offers a standalone tweaks and checks, you can always run it without any argument to see all the options:
@@ -52,51 +59,27 @@ Congratulation, you deployed QUIC transport bridge! The script offers a standalo
 <AccordionTemplate name="Command output">
 ```shell
 root@localhost:~# ./quic_bridge_deployment.sh
-iptables-persistent is already installed.
-Usage: ./quic_bridge_deployment.sh [command] [options]
+Logs are being saved locally to: /var/log/nym-bridge-helper.log
+These logs never leave your machine.

-Nym QUIC Bridge Deployment Helper Script

-Bridge Installation & Configuration:
-  check_bridge_installation       - Check bridge installation status
-  show_bridge_config              - Display bridge configuration files
-  show_bridge_keys                - Display bridge key information
-  show_bridge_info                - Show comprehensive bridge information
-  verify_bridge_prerequisites     - Verify all prerequisites are met
+Usage: ./quic_bridge_deployment.sh [command]

-Bridge Setup Commands:
-  install_bridge_binary           - Download and install nym-bridge binary
-  generate_bridge_keys            - Generate ED25519 bridge identity keys
-  create_client_params            - Create client_bridge_params.json
-  create_bridge_config            - Create bridges.toml configuration
-  create_bridge_service           - Create systemd service file
-  full_bridge_setup               - Interactive full bridge setup wizard
+Commands:
+  full_bridge_setup            - Run full setup
+  install_bridge_binary        - Install nym-bridge (.deb; falls back to source build if libc too old)
+  install_bridge_cfg_tool      - Install bridge-cfg (prebuilt; falls back to source build if libc too old)
+  run_bridge_cfg_generate      - Generate bridges.toml
+  create_bridge_service        - Setup systemd service (respects .deb-provided service)
+  adjust_ip_forwarding         - Enable forwarding
+  apply_bridge_iptables_rules  - NAT rules
+  configure_dns_and_icmp       - Allow ICMP/DNS

-Network Configuration Commands:
-  adjust_ip_forwarding            - Enable IPv4 and IPv6 forwarding
-  apply_bridge_iptables_rules     - Apply iptables rules for QUIC bridge (nymwg)
-  configure_dns_and_icmp          - Allow ICMP ping tests and configure DNS
-  remove_duplicate_bridge_rules   - Remove duplicate iptables rules for nymwg

-Network Inspection Commands:
-  fetch_and_display_ipv6          - Show IPv6 on default network device
-  fetch_wg_ipv6_address           - Fetch IPv6 for nymwg interface
-  check_bridge_iptables           - Check iptables rules for nymwg
-  check_ipv6_ipv4_forwarding      - Check IPv4 and IPv6 forwarding status
-  check_ip_routing                - Display IP routing tables
-
-Testing Commands:
-  perform_pings                   - Test IPv4 and IPv6 connectivity
-  test_bridge_connectivity        - Comprehensive bridge connectivity test
-
-Service Management Commands:
-  check_bridge_service_status     - Check nym-bridge and nym-node service status
-  show_bridge_logs [lines]        - Show recent nym-bridge logs (default: 50 lines)
-
-Quick Start:
-  1. Run 'verify_bridge_prerequisites' to check prerequisites
-  2. Run 'check_bridge_installation' to verify installation
-  3. Run 'test_bridge_connectivity' to test connectivity
+------------------------------------------
+Script exited with errors (code: 1).
+Check the log at: /var/log/nym-bridge-helper.log
+------------------------------------------
 ```
 </AccordionTemplate>

@@ -104,7 +87,9 @@ Quick Start:
 If you have followed the steps outlined above, but the metadata port is not shown as open in either the Node Status API's probe results or an explorer that gets its data from the API, see below:

 <Steps>
-###### 1.
+**Run as root**
+
+###### 1. Confirm correct `config.toml` private IPv4 address
 Ensure that in your `config.toml` file, this value is set to the default one - any other value here will cause the metadata endpoint to fail:

 ```
@@ -115,7 +100,7 @@ private_ipv4 = '10.1.0.1'

 Then restart your node.

-###### 2.
+###### 2. Open the needed port
 Run this command if not already done:
 ```
 ufw allow in on nymwg to any port 51830 proto tcp
@@ -131,7 +116,7 @@ Then ensure the metadata endpoint is listening from the correct address with:
 netstat -an | egrep LISTEN | egrep "51830"
 ```

-###### 3.
+###### 3. Validate the setup
 Once the Node Status API has run a probe on your node, the probe results will reflect this - `can_query_metadata_v4` will have `true` as a value.

 The quickest way to check this is by using the [NymVPN API](https://nymvpn.com/api/public/v1/directory/gateways?show_vpn_only=true) and checking the same field:
@@ -5,7 +5,7 @@
  },
  "mixmining_reserve": {
    "denom": "unym",
-    "amount": "180875972213757"
+    "amount": "178754510529387"
  },
  "vesting_tokens": {
    "denom": "unym",
@@ -13,6 +13,6 @@
  },
  "circulating_supply": {
    "denom": "unym",
-    "amount": "819124027786243"
+    "amount": "821245489470613"
  }
 }
@@ -1 +1 @@
-819_124_027
+821_245_489
@@ -1 +1 @@
-5_024
+4_965
@@ -1 +1 @@
-250_614
+251_263
@@ -1 +1 @@
-60_147_392
+60_303_169
@@ -1 +1 @@
-60_147_391
+60_303_168
@@ -1,7 +1,7 @@
 | **Item**           | **Description**                                       |   **Amount in NYM** |
 |:-------------------|:------------------------------------------------------|--------------------:|
 | Total Supply       | Maximum amount of NYM token in existence              |       1_000_000_000 |
-| Mixmining Reserve  | Tokens releasing for operators rewards                |         180_875_972 |
+| Mixmining Reserve  | Tokens releasing for operators rewards                |         178_754_510 |
 | Vesting Tokens     | Tokens locked outside of cicrulation for future claim |                   0 |
-| Circulating Supply | Amount of unlocked tokens                             |         819_124_027 |
-| Stake Saturation   | Optimal size of node self-bond + delegation           |             250_614 |
+| Circulating Supply | Amount of unlocked tokens                             |         821_245_489 |
+| Stake Saturation   | Optimal size of node self-bond + delegation           |             251_263 |
@@ -1,10 +1,10 @@
 {
  "interval": {
-    "reward_pool": "180875972213757.135840914936141948",
-    "staking_supply": "60147391744900.170789956043539529",
+    "reward_pool": "178754510529387.687865580967403579",
+    "staking_supply": "60303168385204.800235781003503301",
    "staking_supply_scale_factor": "0.07342892",
-    "epoch_reward_budget": "5024332561.493253773358748226",
-    "stake_saturation_point": "250614132270.417378291483514748",
+    "epoch_reward_budget": "4965403070.260769107377249094",
+    "stake_saturation_point": "251263201605.02000098242084793",
    "sybil_resistance": "0.3",
    "active_set_work_factor": "10",
    "interval_pool_emission": "0.02"
@@ -1 +1 @@
-Monday, October 13th 2025, 13:24:56 UTC
+Monday, November 10th 2025, 13:30:27 UTC
@@ -11,7 +11,7 @@ options:
  --no_routing_history  Display node stats without routing history
  --no_verloc_metrics   Display node stats without verloc metrics
  -m, --markdown        Display results in markdown format
-  -o, --output [OUTPUT]
+  -o [OUTPUT], --output [OUTPUT]
                        Save results to file (in current dir or supply with
                        path without filename)
 ```
@@ -18,23 +18,23 @@
 | [Hostslick](https://hostslick.com)                                                                                   | Netherlands, Germany                                                                                                                                | Yes, on by default                   | Yes                                                | Good amount of bandwidth for the price. Make sure you open the ticket if you want to run Exit node                                                                                                                  | 07/2024            |
 | [Incognet](https://incognet.io)                                                                                      | Netherlands and USA                                                                                                                                 | Yes, on by default                   | Yes                                                | They allow Tor exit nodes but you must adhere to their rules https://incognet.io/tor-exits                                                                                                                          | 07/2024            |
 | [Incognet](https://incognet.io/kansas-city-dedicated-servers)                                                        | USA, Netherlands                                                                                                                                    | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Ionos](https://www.ionos.com/servers/amd-servers)                                                                   | US, DE, UK, ESP, FR                                                                                                                                 | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Ionos](https://www.ionos.com/servers/amd-servers)                                                                   | USA, DE, UK, ESP, FR                                                                                                                                | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [IsHosting](https://ishosting.com/en)                                                                                | Brazil, Netherlands                                                                                                                                 | Yes, based on ticket                 | Yes                                                | Expensive                                                                                                                                                                                                           | 05/2024            |
-| [Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134) | US, NL, DE, UK, CA, SG, JP, AUS, HK                                                                                                                 | nan                                  | No                                                 | KYC mandatory                                                                                                                                                                                                       | 07/2025            |
+| [Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134) | USA, NL, DE, UK, CA, SG, JP, AUS, HK                                                                                                                | nan                                  | No                                                 | KYC mandatory                                                                                                                                                                                                       | 07/2025            |
 | [Linode](https://linode.com)                                                                                         | USA, Canada, Japan, India, Indonesia, Sweden, Netherlands, Germany, Brazil, France, UK, Australia, Italy                                            | Yes out of the box                   | No, only through [BitLAunch](https://bitlaunch.io) | IPv6 sometimes need to be re-added in Networking tab, no reboot needed                                                                                                                                              | 05/2024            |
 | [LiteServer](https://liteserver.nl)                                                                                  | Netherlands                                                                                                                                         | Yes, on by default                   | Yes                                                | Very reliable Dutch provider. They do allow Relay nodes but for Exit nodes you need to contact them. Always check T&C https://liteserver.nl/legal                                                                   | 07/2024            |
 | [Lowendbox](https://lowendbox.com/category/dedicated-servers)                                                        |                                                                                                                                                     |                                      |                                                    | Just an aggregator with good offers                                                                                                                                                                                 | 07/2025            |
 | [M247](https://m247.com/eu/services/host/dedicated-servers/)                                                         | UK, Austria, Br, Sw, Jp, Poland, Fr, USA, Netherlands                                                                                               | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Mebilcom](https://www.melbicom.net/dedicatedserver/)                                                                | NL, US, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL                                                                                            | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Mebilcom](https://www.melbicom.net/dedicatedserver/)                                                                | NL, USA, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL                                                                                           | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Mevspace](https://mevspace.com)                                                                                     | Poland                                                                                                                                              | Yes, on by default                   | Yes                                                | Flexible Polish providers with 3 DCs in Poland. They do allow Tor Exit nodes but you may need a dedicated server for this. Make sure you open a ticket to check. As of today's date, they have 48h for 1 EUR tariff | 07/2024            |
 | [Misaka](https://www.misaka.io/)                                                                                     | South Africa                                                                                                                                        | Yes, native support                  | No                                                 | Very Expensive                                                                                                                                                                                                      | 05/2024            |
 | [NiceVPS](https://nicevps.net/)                                                                                      | Netherlands                                                                                                                                         | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Njalla](https://nja.la)                                                                                             | Sweden                                                                                                                                              | Yes                                  | Yes                                                | Privacy vandguards! The biggest VPS 45 is 3 cores only, but it works better than many “larger” servers on the market.                                                                                               | 05/2024            |
 | [OVH](https://us.ovhcloud.com/bare-metal/rise/rise-3/)                                                               | USA, DE, FR, UK, PL, CA                                                                                                                             |                                      | No                                                 | Not all locations always available                                                                                                                                                                                  | 07/2025            |
-| [Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6)                                                     | PL, FR, NL, UA, US, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR       | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6)                                                     | PL, FR, NL, UA, USA, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR      | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [PrivateLayer](https://privatelayer.com)                                                                             | Swiss                                                                                                                                               | Yes                                  | Yes                                                | Slow customer response                                                                                                                                                                                              | 07/2025            |
 | [Privex](https://www.privex.io/tor-exit-policy/)                                                                     | USA, Germany, Sweden                                                                                                                                | Yes                                  | Yes                                                | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Psychz](https://www.psychz.net)                                                                                     | US, UK, Brazil, Japan, Russia, South Africa and many more                                                                                           | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Psychz](https://www.psychz.net)                                                                                     | USA, UK, Brazil, Japan, Russia, South Africa and many more                                                                                          | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
 | [RDP](https://rdp.sh)                                                                                                | Netherlands, USA, Poland                                                                                                                            | Yes, on by default                   | Yes                                                | German provider. Exit nodes are allowed, policy is here https://rdp.sh/docs/faq/tor ports 25,465,587 must be closed. Make sure you open a ticket before running an exit node.                                       | 07/2024            |
 | [Servermania](https://www.servermania.com/dedicated-servers-hosting.htm)                                             | USA, Canada                                                                                                                                         | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Svea](https://svea.net/vps)                                                                                         | Sweden                                                                                                                                              | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
@@ -0,0 +1,12 @@
+export const Green = ({ children }) => (
+  <span style={{ color: '#22C55E', fontWeight: 600 }}>{children}</span>
+);
+export const Yellow = ({ children }) => (
+  <span style={{ color: '#FACC15', fontWeight: 600 }}>{children}</span>
+);
+export const Red = ({ children }) => (
+  <span style={{ color: '#EF4444', fontWeight: 600 }}>{children}</span>
+);
+export const Gray = ({ children }) => (
+  <span style={{ color: '#6B7280', fontWeight: 600 }}>{children}</span>
+);
@@ -21,11 +21,11 @@
 [Lowendbox](https://lowendbox.com/category/dedicated-servers), , , ,Just an aggregator with good offers,07/2025
 [Thundervm](https://thundervm.com/en/hosting/dedicated-server),"USA, UK, France, Italy, Switzerland, Netherlands",,Yes, ,07/2025
 [OVH](https://us.ovhcloud.com/bare-metal/rise/rise-3/),"USA, DE, FR, UK, PL, CA", ,No,Not all locations always available,07/2025
-[Mebilcom](https://www.melbicom.net/dedicatedserver/),"NL, US, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL",,No,,07/2025
+[Mebilcom](https://www.melbicom.net/dedicatedserver/),"NL, USA, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL",,No,,07/2025
 [Servermania](https://www.servermania.com/dedicated-servers-hosting.htm),"USA, Canada",,No,,07/2025
-[Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6),"PL, FR, NL, UA, US, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR",Yes,No,,07/2025
-[Ionos](https://www.ionos.com/servers/amd-servers),"US, DE, UK, ESP, FR",,No,,07/2025
-[Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134),"US, NL, DE, UK, CA, SG, JP, AUS, HK",,No,KYC mandatory,07/2025
+[Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6),"PL, FR, NL, UA, USA, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR",Yes,No,,07/2025
+[Ionos](https://www.ionos.com/servers/amd-servers),"USA, DE, UK, ESP, FR",,No,,07/2025
+[Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134),"USA, NL, DE, UK, CA, SG, JP, AUS, HK",,No,KYC mandatory,07/2025
 [M247](https://m247.com/eu/services/host/dedicated-servers/),"UK, Austria, Br, Sw, Jp, Poland, Fr, USA, Netherlands",Yes,No,,07/2025
 [Hostroyale](https://hostroyale.com/hosting/dedicated-server/),Various countries with different pricing,, Yes,,07/2025
 [DataPacket](https://www.datapacket.com/pricing),"NL, GR, SK, BE, RO, HU, DK, IE, DE, UA, PT, GB, ES, FR, IT, NO, CZ, BG, SE, AT, PL, HR, CH, USA, CO, AR, PE, MX, CL, TR, ZA, NG, IL, HK, AU, SG, JP",Yes,,,07/2025
@@ -35,7 +35,7 @@
 [Colocall](https://www.colocall.net/),Ukraine,Yes,,,07/2025
 [Incognet](https://incognet.io/kansas-city-dedicated-servers),"USA, Netherlands",Yes,,,07/2025
 [FranTech](https://my.frantech.ca),USA,Yes,,,07/2025
-[Psychz](https://www.psychz.net),"US, UK, Brazil, Japan, Russia, South Africa and many more",Yes,,,07/2025
+[Psychz](https://www.psychz.net),"USA, UK, Brazil, Japan, Russia, South Africa and many more",Yes,,,07/2025
 [Fsit](https://www.fsit.com/server/vps-vserver-kvm),Swiss,Yes,Yes,,07/2025
 [NiceVPS](https://nicevps.net/),Netherlands,Yes,,,07/2025
 [Dataclub](https://www.dataclub.eu/),"Latvia, Sweden, Netherlands",Yes,,,07/2027
@@ -38,8 +38,8 @@
    "@nextui-org/accordion": "^2.0.40",
    "@nextui-org/react": "^2.4.8",
    "@nymproject/contract-clients": ">=1.2.4-rc.2 || ^1",
-    "@nymproject/mix-fetch-full-fat": ">=1.2.4-rc.2 || ^1",
-    "@nymproject/sdk-full-fat": ">=1.2.4-rc.2 || ^1",
+    "@nymproject/mix-fetch-full-fat": ">=1.5.1-rc.0 || ^1.4.1",
+    "@nymproject/sdk-full-fat": ">=1.5.1-rc.0 || ^1.4.1",
    "@redocly/cli": "^1.25.15",
    "@types/mdx": "^2.0.13",
    "chain-registry": "^1.19.0",
@@ -1,16 +1,4 @@

 # Introduction

-import { Callout } from 'nextra/components';
-
-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
-Welcome to the documentation for Nym's TypeScript SDK!
-
-This guide contains information about the various TypeScript SDK modules that facilitate interaction with different components of the Nym stack, including the Nym mixnet, the Nyx blockchain, and Coconut credentials.
+This guide contains information about the various TypeScript SDK modules that facilitate interaction with different components of the Nym stack: the Nym mixnet & the Nyx blockchain.
@@ -1,14 +1,6 @@
 # TS SDK FAQ
 import { Callout } from 'nextra/components'

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 ## Why and when does the mixnet client complain about insufficient topology?

 It will in one of the following cases:
@@ -2,14 +2,6 @@

 import { Callout } from 'nextra/components';

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 You might need some help bundling packages from the Nym Typescript SDK into your package.

 Here are some things that could go wrong:
@@ -2,14 +2,6 @@ import { Callout } from 'nextra/components';

 # Troubleshooting bundling with ESbuild

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 If you've been following the steps outlined in the Examples section, your development environment should be configured as follows:

 #### Environment Setup
@@ -3,14 +3,6 @@ import { Callout } from 'nextra/components';
 # Troubleshooting bundling with Webpack


-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 ## Webpack > 5 ESM

 For any project using Webpack, you´ll need the following rule in your `webpack.config.js` above version 5:
@@ -2,14 +2,6 @@ import { Callout } from 'nextra/components'

 # Cosmos Kit

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 The wonderful people of Cosmology have made some [fantastic components](https://cosmoskit.com/) that can be used with
 Nym. These include:

@@ -1,13 +1,6 @@
 import { Callout } from 'nextra/components';

 # `mixFetch`
-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>

 An easy way to secure parts or all of your web app is to replace calls to [`fetch`](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch) with `mixFetch`:

@@ -1,13 +1,6 @@
 import { Callout } from 'nextra/components'

 # Mixnet Client
-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
 As you know by now, in order to send or receive messages over the mixnet, you'll need to use the [`SDK Client`](https://www.npmjs.com/package/@nymproject/sdk), which will allow you to create apps that can use the Nym mixnet and Coconut credentials.

 This client is message based - it can only send a one-way message to another client's address.
@@ -1,13 +1,7 @@
 import { Callout } from 'nextra/components'

 # Nym Smart Contract Clients
-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.

-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
 As previously mentioned, to query or execute on any of the Nym contracts, you'll need to use one of the [`Contract Clients`](https://www.npmjs.com/package/@nymproject/contract-clients), which contains read-only query and signing clients for all of Nym's smart contracts.

 ##### Contract Clients list
@@ -4,14 +4,6 @@ import { Callout } from 'nextra/components'

 The different modules in the Typescript SDK allow developers to start building browser-based applications quickly. Simply import the SDK module of your choice – depending on the component from the Nym architecture you want to use – into your code via NPM, as you would any other TypeScript library.

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 <Callout type="info" emoji="ℹ️">
    Other than the `Contract Clients`, SDK modules come in four different flavours (ESM, CJS and full-fat for ESM and CJS).
    This documentation focuses on examples using the `full-fat` versions.
@@ -4,15 +4,6 @@ import { NPMLink } from '../../../components/npm';

 ## SDK overview

-
-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 The Typescript SDK allows developers to start building browser-based Nym-based applications quickly, by simply importing the SDK modules into their code via NPM as they would any other Typescript library.

 Currently developers can use different packages from the Typescript SDK to run the following entirely in browser:
@@ -6,14 +6,6 @@ import FormattedCosmoskitExampleCode from '../../../../code-examples/sdk/typescr

 import { Callout } from 'nextra/components'

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 Below is an example that uses [CosmosKit](https://cosmoskit.com/) to connect and sign a fake transaction with your [Keplr wallet](https://www.keplr.app/) or
 [Ledger hardware wallet](https://www.ledger.com/) to this page:

@@ -6,14 +6,6 @@ import FormattedMixFetchExampleCode from '../../../../code-examples/sdk/typescri
 import { Callout } from 'nextra/components'


-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-



@@ -7,14 +7,6 @@ import { Callout } from 'nextra/components'



-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 The Nym Mixnet contract keeps a directory of all mixnodes that can be used to mix traffic.

 Here is a live example of querying the Mixnet Contract for a paged list of mixnodes:
@@ -5,13 +5,6 @@ import Box from '@mui/material/Box';
 import FormattedTrafficExampleCode from '../../../../code-examples/sdk/typescript/traffic-example-code.mdx';


-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
 Use this tool to experiment with the mixnet: send and receive messages!

 <Traffic />
@@ -13,14 +13,6 @@ import FormattedWalletDelegationsCode from '../../../../code-examples/sdk/typesc

 import { Callout } from 'nextra/components'

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 Here's a small wallet example using testnet for you to test out!

 <WalletContextProvider>
@@ -3,14 +3,6 @@ import { Callout } from 'nextra/components'

 ## MixFetch

-<Callout type="error">
-    The TypeScript SDK is currently not avaliable to use: a network upgrade elsewhere has caused a problem which is not currently fixed. TS SDK Clients are not able to connect to the network.
-
-    When the issue is resolved, this will be reflected in the documentation.
-
-    Thanks for your patience!
-</Callout>
-
 Use the [`mixFetch`](https://www.npmjs.com/package/@nymproject/mix-fetch) package as a drop-in replacement for `fetch`to send HTTP requests over the Nym mixnet:

 ```ts
@@ -6,6 +6,7 @@
  "sandbox": "Sandbox Testnet",
  "binaries": "Binaries",
  "nodes": "Nodes & Validators Guides",
+  "performance-and-testing": "Performance Measurement",
  "tools": "Tools",
  "troubleshooting": "Troubleshooting",
  "tokenomics": "Tokenomics",
@@ -49,6 +49,403 @@ This page displays a full list of all the changes during our release cycle from

 <VarInfo />

+## `v2025.19-kase`
+
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.19-kase)
+- [`nym-node`](nodes/nym-node.mdx) version `1.20.0`
+
+```sh
+nym-node
+Binary Name:        nym-node
+Build Timestamp:    2025-10-30T12:43:37.933354749Z
+Build Version:      1.20.0
+Commit SHA:         75a6d3426bd18dca600ad1cfa39b0a3c4f319c69
+Commit Date:        2025-10-30T11:59:32.000000000+01:00
+Commit Branch:      HEAD
+rustc Version:      1.88.0
+rustc Channel:      stable
+cargo Profile:      release
+```
+
+### Operators Updates & Tools
+
+<Callout type="info" emoji="ℹ️">
+**When this platform release becomes latest, we would like to ask operators ruuning any Gateway mode of `nym-node`, to use new version of [QUIC brige deployment tool](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh) and install QUIC `nym-bridge` on their server, following [these steps](#quic-transport-bridge-deployment).**
+</Callout>
+
+Alongside this platform release we are happy to introduce several improvements and new tools for node operators.
+
+- [Updated version of QUIC brige deployment tool](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh), **if you run a `nym-node` in any Gateway mode, please install QUIC on your server, following [these steps](#quic-transport-bridge-deployment)**
+
+- [New **Nym Node Status Dashboard**](https://node-status.nym.com)
+
+- [New **Harbourmaster** aka ***Nym Node Status Observatory***](https://harbourmaster.nymtech.net)
+
+
+
+### Features
+
+- [Propagate cancel token to mixnet client](https://github.com/nymtech/nym/pull/6105): Ensures cancellation token propagation to mixnet client
+
+- [[DOCs/operators] QUIC deployment script & docs](https://github.com/nymtech/nym/pull/6098): Script and documentation for QUIC deployment, referencing `nym-bridges` repository  
+
+- [Move gateway probe to monorepo (Rust edition 2024)](https://github.com/nymtech/nym/pull/6094): Moves `nym-gateway-probe` and related packages into monorepo, updates to Rust 2024 edition
+
+- [Expose reference to Mnemonic from `DirectSecp256k1HdWallet`](https://github.com/nymtech/nym/pull/6083): Adds safer accessors for mnemonic references and deprecates unsafe cloning
+
+### Bugfix
+
+- [Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2](https://github.com/nymtech/nym/pull/6153): Add circuit breaker  
+<AccordionTemplate name={<TestingSteps/>}>
+ **Summary:**
+- Network-requester started successfully  
+- SOCKS5 client started successfully  
+- Traffic was proxied through the mixnet  
+- Shutdown was clean  
+- No 'channel closed (outside of shutdown!)' errors  
+</AccordionTemplate>
+
+- [`nym-credential-proxy` query params parsing regression](https://github.com/nymtech/nym/pull/6121): Fix query deserialization issue with `serde_urlencoded` breaking compatibility with VPN API
+
+- [Revert some dep updates introduced in #6043](https://github.com/nymtech/nym/pull/6120): Revert dependency updates that broke ANSI escape characters within tracing output
+
+- [Skip IPv6 metadata endpoint request](https://github.com/nymtech/nym/pull/6118): Skip querying IPv4-only metadata endpoints during IPv6 probing tests
+
+- [Revert "Propagate cancel token to mixnet client"](https://github.com/nymtech/nym/pull/6115): Reverts earlier change due to premature mixnet exit issues
+
+- [Retrieve and update ticketbook in the same query](https://github.com/nymtech/nym/pull/6101): Fix concurrency issue with multiple agents retrieving ticketbooks simultaneously
+
+- [Include network name in default gateway probe config path](https://github.com/nymtech/nym/pull/6100): Prevents reuse of credentials across different networks
+
+- [Incompatibility fixes](https://github.com/nymtech/nym/pull/6099): Fixes several incompatibilities, including initialization and build mismatches
+
+- [Testnet manager `02sql` migration](https://github.com/nymtech/nym/pull/6096): Fix invalid FK constraint blocking SQL migration
+
+- [Use custom topology provider for list of init gateways](https://github.com/nymtech/nym/pull/6092): Fixes SDK bug where clients ignored custom topology provider on registration
+
+- [Fix `WASM` client + build commands](https://github.com/nymtech/nym/pull/6043): Fixes WASM client hang and runtime time-related issues; improves internal dev testing stability
+
+### Refactors & Maintenance
+
+- [Update to no longer use 1mb files](https://github.com/nymtech/nym/pull/6117)
+
+- [Restore pending DKG contract state migration](https://github.com/nymtech/nym/pull/6116)
+
+- [Update `dirs` to `6.0`](https://github.com/nymtech/nym/pull/6109): Minor dependency update, safe for compatibility
+
+## `v2025.18-jarlsberg`
+
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.18-jarlsberg)
+- [`nym-node`](nodes/nym-node.mdx) version `1.19.0`
+
+```sh
+nym-node
+Binary Name:        nym-node
+Build Timestamp:    2025-10-15T09:04:32.043934599Z
+Build Version:      1.19.0
+Commit SHA:         2235a6e1477bea7368ee5443a298f544deb63504
+Commit Date:        2025-10-15T10:22:16.000000000+02:00
+Commit Branch:      master
+rustc Version:      1.92.0-nightly
+rustc Channel:      nightly
+cargo Profile:      release
+```
+
+### API Changes
+There have been a few updates to the Node Status API (used by the NymVPN API) to do with Nodes' metadata endpoints, which are used to determine if they are running a QUIC bridge.
+
+- [Node Status API: add bridge information to dVPN endpoint](https://github.com/nymtech/nym/pull/6069)
+Scrape the `/api/v1/bridges/client-params` endpoint from nodes to get bridge information and add to the dVPN output:
+
+ ```
+ {
+ 	"identity_key": "3wqfp9ebaajgV8HRKYHeZuZCNXgitnW8BbytxyBH65xZ",
+ 	"name": "middle winner wing",
+ 	"authenticator": {
+ 		"address": "6CQMtm9DqUj7mPVkSD9YarjUuPh7mJaZQnnHWxNpgByh.AGXiTivVieBULeDhL9tuyMKgRydoT67sFCjeoERDN84k@3wqfp9ebaajgV8HRKYHeZuZCNXgitnW8BbytxyBH65xZ"
+ 	},
+ 	"ip_packet_router": {
+ 		"address": "GA47h8294m7f6ciyFuDkjk3mmqrvALqboL2o22jkqFhi.22SdTGBWKFrrBM31hMgzjmgduSH1nosnbE9dgNcY2CXz@3wqfp9ebaajgV8HRKYHeZuZCNXgitnW8BbytxyBH65xZ"
+ 	},
+ 	"location": {
+ 		"two_letter_iso_country_code": "GB",
+ 		"latitude": 51.5085,
+ 		"longitude": -0.1257
+ 	},
+ 	"last_probe": {
+ 		"last_updated_utc": "2025-09-02T18:19:10Z",
+ 		"outcome": {
+ 		"as_entry": {
+ 			"can_connect": true,
+ 			"can_route": true
+ 		},
+ 		"as_exit": {
+ 			"can_connect": true,
+ 			"can_route_ip_external_v4": true,
+ 			"can_route_ip_external_v6": true,
+ 			"can_route_ip_v4": true,
+ 			"can_route_ip_v6": true
+ 		},
+ 		"wg": {
+ 			"can_handshake_v4": true,
+ 			"can_handshake_v6": true,
+ 			"can_register": true,
+ 			"can_resolve_dns_v4": true,
+ 			"can_resolve_dns_v6": true,
+ 			"download_duration_sec_v4": 0,
+ 			"download_duration_sec_v6": 5,
+ 			"download_error_v4": "",
+ 			"download_error_v6": "",
+ 			"downloaded_file_v4": "https://proof.ovh.net/files/1Mb.dat",
+ 			"downloaded_file_v6": "https://proof.ovh.net/files/10Mb.dat",
+ 			"ping_hosts_performance_v4": 1,
+ 			"ping_hosts_performance_v6": 1,
+ 			"ping_ips_performance_v4": 1,
+ 			"ping_ips_performance_v6": 0.6666667,
+ 			"can_handshake": true,
+ 			"can_resolve_dns": true,
+ 			"ping_hosts_performance": 1,
+ 			"ping_ips_performance": 1
+ 		}
+ 		}
+ 	},
+ 	"ip_addresses": [
+ 		"178.79.168.250",
+ 		"2a01:7e00::f03c:95ff:fef8:77f"
+ 	],
+ 	"mix_port": 1789,
+ 	"role": "EntryGateway",
+ 	"entry": {
+ 		"hostname": "nym-circ.anonym.tech",
+ 		"ws_port": 9000,
+ 		"wss_port": 9443
+ 	},
+ + 	"bridges":{
+ + 		"version": 0,
+ + 		"transports": [
+ + 			{
+ + 				"transport_type": "quic_plain",
+ + 				"args": {
+ + 					"addresses":  ["[2a01:7e00::f03c:95ff:fef8:77f]:4443", "178.79.168.250:4443"],
+ + 					"id_pubkey": "gyKl6DN9hgdPGhEzdf9gY4Ha2GzrOwSzLCguxeTVTJU=",
+ + 					"host": "netdna.bootstrapcdn.com"
+ + 				}
+ + 			}
+ + 		]
+ + 	}
+ 	"performance": "1",
+ 	"build_information": {
+ 		"build_version": "1.16.0",
+ 		"commit_branch": "build",
+ 		"commit_sha": "7f97f13799342f864e1b106e8cafc9f6d6c24c0f"
+ 	}
+ }
+ ```
+
+- [ns-api: add new fields for probe output for query_metadata and download file size and duration in ms](https://github.com/nymtech/nym/pull/6091)
+
+This PR adds new fields to the Node Status API:
+
+ ```json
+ {
+   "node": "ByxGq9hpDQu6Wc8augEh22w7CRWJHPNfDshB1b8nfWkh",
+   "used_entry": "ByxGq9hpDQu6Wc8augEh22w7CRWJHPNfDshB1b8nfWkh",
+   "outcome": {
+     "as_entry": {
+       "can_connect": true,
+       "can_route": true
+     },
+     "as_exit": {
+       "can_connect": true,
+       "can_route_ip_v4": true,
+       "can_route_ip_external_v4": true,
+       "can_route_ip_v6": true,
+       "can_route_ip_external_v6": true
+     },
+     "wg": {
+       "can_register": true,
+       "can_query_metadata_v4": true, // <--------------------------------
+       "can_handshake_v4": true,
+       "can_resolve_dns_v4": true,
+       "ping_hosts_performance_v4": 1.0,
+       "ping_ips_performance_v4": 1.0,
+       "can_handshake_v6": true,
+       "can_resolve_dns_v6": true,
+       "ping_hosts_performance_v6": 1.0,
+       "ping_ips_performance_v6": 0.93333334,
+       "download_duration_sec_v4": 2,
+       "download_duration_milliseconds_v4": 2034, // <--------------------------------
+       "downloaded_file_size_bytes_v4": 1048576, // <--------------------------------
+       "downloaded_file_v4": "https://nym-bandwidth-monitoring.ops-d86.workers.dev/1mb.dat",
+       "download_error_v4": "",
+       "download_duration_sec_v6": 5,
+       "downloaded_file_size_bytes_v6": 1048576,
+       "download_duration_milliseconds_v6": 5501,
+       "downloaded_file_v6": "https://proof.ovh.net/files/1Mb.dat",
+       "download_error_v6": ""
+     }
+   }
+ }
+ ```
+
+- [ns-api: add descriptions to dVPN gateway responses](https://github.com/nymtech/nym/pull/6102)
+This PR adds the `description` field to dVPN gateways in `/dvpn/v1/directory/gateways`.
+
+- [NS API: use new probe download filesize and milliseconds field](https://github.com/nymtech/nym/pull/6097)
+This PR uses the new fields in mainnet to calculate the probe download score.
+
+- [ns-api: use download files size from probes instead of parsing filenames](https://github.com/nymtech/nym/pull/6095) This PR uses the new field in the probe results that says how many bytes were downloaded to calculate the speed of download. It only uses downloads on ipv4 and ignores ipv6 for now. This might change in the future.
+
+- [Node Status API: remove sqlite support](https://github.com/nymtech/nym/pull/6004)
+This PR removes sqlite support, requiring pgsql to run the NS API.
+
+ It also fixes the following issues:
+
+ - deserialisation of `NodeDescription`
+ - defaults for `WireguardDetails` for deserialisation
+
+ It also bumps the version to v4.0.0.
+
+### Operators Updates & Tools
+
+- [Node rewards tracker](https://github.com/nymtech/nym/pull/6064)
+This PR introduces a script fetching operators rewards based on provided Nyx account addresses provided in `data/wallet-addresses.csv`.
+
+<AccordionTemplate name="Info">
+ **Output is:**
+     1. Printed table in terminal
+     3. Sheet with complete info stored in `data/node-balances.csv`
+     4. Historical data yaml file stored in `data/data.yaml` - this file should not be changed manually, as
+     all values older than 30 days get auto-removed
+
+ **RUN**
+
+ Before you start fill first column of `data/wallet-addresses.csv` called `addresses` with your Nyx account addresses and (optionally) second column called `tag` with an entity, for example *"mysquad"* and *"personal"* to get sorted output per entity.
+
+ - Csv example with `tag`s:
+ ```
+ n1foofoofoo, personal
+ n1barbarbar, personal
+ n1bazbazbaz, mysquad
+ n1lollollol, mysquad
+ ```
+ - For operators having all nodes under one entity, the tag field will be left empty. Example:
+ ```csv
+ n1foofoofoo
+ n1barbarbar
+ n1bazbazbaz
+ ```
+
+Documentation coming soon.
+</AccordionTemplate>
+
+- [Bugfix/bloomfilters purge](https://github.com/nymtech/nym/pull/6089)
+This PR fixes bug where old replay protection bloomfilters were never getting removed.
+
+
+### Features
+- [Get wireguard keypair as arg instead of reading it from disk](https://github.com/nymtech/nym/pull/6078)
+
+- [Registration Client](https://github.com/nymtech/nym/pull/6059)
+ This PR introduces the `RegistrationClient` whose eventual job will be to handle registration with gateway and bandwidth control. This is step 1, where it only handles registration and then hands back the control channel to the vpn-client.
+
+<AccordionTemplate name="Info">
+
+ **nym-wg-gateway-client**
+ This crate has been smooshed with the nym-authenticator-client as they were doing the same thing : talking with the Authenticator.
+
+ **nym-authenticator-client**
+ The job of the `AuthenticatorClient` is to talk to the `Authenticator`s via the mixnet. They both make use of a `AuthClientMixnetListener` that handles interaction with the mixnet client. No more `SharedMixnetClient`, only clear owners. That component could be turned into an actual multiplexer, but that's out of scope.
+
+ It is designed to be able to shut down, since it won't be necessary for bandwidth top up in the future.
+
+ Lots of types and traits were copied in both repos, some of them are sadly still there. Further work could be done to improve messaging ( `ClientMessage` and `AuthenticatorRequests` for example)
+
+ **nym-ip-packet-client**
+ This crate has minor changes, focused on getting rid of the `SharedMixnetClient`. It still talks to the `IpPacketRouter` but it owns the `MixnetClient`
+
+ **Nym-registration-client**
+ Brand new crates, whose current job is to run a `MixnetClient` with the given options,  register with the component related to the tunnel type, and hand back the necessary component for running the tunnel.
+
+ **authenticator-requests**
+ Mostly refactoring, lots of code was duplicated in the vpn-client repo
+
+ **misc**
+ The rest are qol changes that might not be needed right away but that is preparing the future improvements coming soon™
+ </AccordionTemplate>
+
+- [Feature: Ping probe all nodes /described nodes from a server](https://github.com/nymtech/nym/pull/6074)
+This script should be ran from a node hosting server. It pings all IPs listed in /described endpoint and returns a file with unreachable IPs. Such list gives operator an idea on IPs potentially blocking their IP.
+
+- [Feature: Nym node html landing page](https://github.com/nymtech/nym/pull/6053)
+This PR introduces a new landing page which contains:
+  - no more deprecated tornul
+  - new nym theme
+  - bold text about DMCA
+  - hook for nym-node-cli to use it and add $EMAIL prompted to the operator
+
+- [feat: DKG contract method for updating announce address](https://github.com/nymtech/nym/pull/6050)
+
+- [feat: NS ticket faucet](https://github.com/nymtech/nym/pull/6047)
+Overview: modifies the Node Status API so that it keeps a buffer of tickets inside its storage that it gives out when new test runs get requested. it also slightly adjusts the ticketbook API in a bit hacky way to allow importing ticketbooks with specific index ranges. However, those changes also involve modifying cli arguments passed to both NS API and gateway probes. The associated vpn-client repo branch is `feature/ticket-faucet-probe` which for the same reason is not yet ready
+
+<AccordionTemplate name="Info">
+**Node Status API**
+**Added**
+ - `--config-env-file` / `-c` (optional) - helper allowing testing locally on non-mainnet networks without passing everything through env variables
+ - `--mnemonic` (env: `NYM_NODE_STATUS_API_MNEMONIC`) - account used for obtaining ticketbooks
+ - `--max-concurrent-deposits` (env: `NYM_NODE_STATUS_API_MAX_CONCURRENT_DEPOSITS`) (optional; default: 5) - Specifies the maximum number of deposits the node status api can make in a single transaction. Note that each deposit batch is followed by the same number of sequential signing requests
+ - `--tickets-buffer-size` (env: `NYM_NODE_STATUS_API_TICKETS_BUFFER`) (optional; default: 50) - Specifies the size of the tickets buffer the node status api should have available at any time for each ticket type.
+ - `--tickets-buffer-check-interval` (env: `NYM_NODE_STATUS_API_TICKETS_CHECK_INTERVAL`) (optional; default: 1min) - Specifies interval at which the node status api should check if it has sufficient number of tickets buffered
+ - `--quorum-check-interval` (env: `NYM_NODE_STATUS_API_QUORUM_CHECK_INTERVAL`) (optional; default: 5min) - Specifies interval at which the node status api should check if signing quorum is available
+ - `--buffered-ticket-types` (env: `NYM_NODE_STATUS_BUFFERED_TICKET_TYPES`) (optional; default: `[V1MixnetEntry, V1WireguardEntry, V1WireguardExit]`) - Specifies types of tickets to buffer
+ - `--ecash-client-identifier-bs58` (env: `NYM_NODE_STATUS_API_ECASH_CLIENT_IDENTIFIER_BS58`) - Identifier used for deriving keys embedded in the issued ticketbooks (i.e. seed for the client identity). It can be a random string, but make sure it has sufficient entropy. it has to be base58 encoded.
+
+**Node Status Agent**
+**Removed**
+ - `--mnemonic` - no longer needed as tickets are obtained throught the faucet
+
+**Gateway Probe (vpn-client repo)**
+**Added**
+ - `--ticket-materials` - all the encoded generated tickets (and global data) needed by the probe
+ - `--ticket-materials-revision` - revision of the serialisation to help with decoding (not strictly needed, but it was already available)
+**Removed**
+ - `--mnemonic` - no longer needed as tickets are obtained throught the faucet
+</AccordionTemplate>
+
+- [Bridge proto client params in Self-Described](https://github.com/nymtech/nym/pull/6035)
+This PR gives the nym-node a way to expose information about the bridge protocols that the node supports, and the parameters that are necessary to connect using those protocols.
+
+<AccordionTemplate name="Info">
+ This is meant to be usable by the node status API to be be included into node descriptors that are compiled for the vpn client.
+
+ - Adds a new field to the nym-node config `gateway_tasks.storage_paths.bridge_client_params`
+   - IF the new config field is present a new self-described endpoint is available at `/v1/bridges/client-params`
+   - IF the new config field is NOT present the endpoint is not exposed.
+
+ I arbitrarily chose config v8 as the oldest nym-node configuration version that supports the option. This can probably be propogated further backwards if necessary.
+
+ NOTE: The new `/bridges/client-params` endpoint does not have swagger / utopia docs associated. This interface will likely change in several upcoming iterations and serving from file (for now) means that the types are not defined internally.
+
+ tested as working on node `3wqfp9eb` both when file is provided in config (sucessful response) and when file is not specified in config (path gives 404).
+
+ </AccordionTemplate>
+
+### Refactors & Maintenance
+- [[chore] Clippy fix](https://github.com/nymtech/nym/pull/6060)
+
+- [Bugfix: Nym node CLI download nym-node exception](https://github.com/nymtech/nym/pull/6058)
+This PR fixes a case when the "Latest" platform release doesn't include `nym-node` by prompting user to insert binary URL instead of failing. Additionally it fixes fetching new landing page script in the CLI.
+
+- [Benny/ci contract fix](https://github.com/nymtech/nym/pull/5962)
+
+- [frontdoor typo fix](https://github.com/nymtech/nym/pull/6067)
+
+- [Hotfix: Update API source in node ping tester script](https://github.com/nymtech/nym/pull/6082)
+This PR fixes initial development bug where a wrong API endpoint was used.
+ `https://validator.nymtech.net/api/v1/nym-nodes/described` gets all nym nodes, not just gateways.
+ Code is simplified accordingly.
+
 ## QUIC Transport Bridge Deployment

 <QuicDeploymentSteps />
@@ -108,7 +505,7 @@ All of the routes removed had already been deprecated over a year ago. This is m
 <AccordionTemplate name="Removed API routes">

 ### Legacy mixnodes related:
- 
+
 - `/v1/mixnodes`
 - `/v1/mixnodes/active`
 - `/v1/mixnodes/active/detailed`
@@ -130,9 +527,9 @@ All of the routes removed had already been deprecated over a year ago. This is m
 - `/v1/status/mixnodes/detailed-unfiltered`
 - `/v1/status/mixnode/{mix_id}/report`
 - `/v1/status/mixnode/{mix_id}/avg_uptime`
- 
+
 ### Legacy gateways related:
- 
+
 - `/v1/gateways`
 - `/v1/gateways/described`
 - `/v1/gateways/blacklisted`
@@ -144,21 +541,21 @@ All of the routes removed had already been deprecated over a year ago. This is m
 </AccordionTemplate>

 #### Structs changes:
- 
+
 - `MixnodeUptimeHistoryResponse` no longer has `owner` field
 - `GatewayUptimeHistoryResponse` no longer has `owner` field
- 
- 
+
+
 #### New Routes Added

 - `/v1/nym-nodes/stake-saturation/{node_id}` - as a better replacement for `/v1/status/mixnode/{mix_id}/stake-saturation` as this information might be potentially useful and can be applied to any nym-node, not just a legacy mixnode.
 - `/v1/legacy/mixnodes` - returns a list of bonded legacy mixnodes that haven't migrated to nym-nodes
 - `/v1/legacy/gateways` - returns a list of bonded legacy gateways that haven't migrated to nym-nodes
- 
+
 #### Node Status API
- 
+
 Furthermore the changes remove all scraping of legacy mixnodes from NS and the following routes are removed:
- 
+
 - `/v2/mixnodes/{mix_id}`
 - `/v2/mixnodes`

@@ -229,7 +626,7 @@ Furthermore the changes remove all scraping of legacy mixnodes from NS and the f
 ### Operators Updates & Tools

 <Callout type="info" emoji="ℹ️">
-Nodes receiving stake as a part of [**Nym Delegation Program**](https://nym.com/network/DP) are updated weekly based on the [rules](https://forms.nym.com/form/#/2/form/view/BRh8QroXFinjOF4D3FHgYiX76zbiRvUV2Sy+czaoKFQ) without prior notification given to the operators. 
+Nodes receiving stake as a part of [**Nym Delegation Program**](https://nym.com/network/DP) are updated weekly based on the [rules](https://forms.nym.com/form/#/2/form/view/BRh8QroXFinjOF4D3FHgYiX76zbiRvUV2Sy+czaoKFQ) without prior notification given to the operators.

 [**Nym Delegation account**](https://explorer.nym.spectredao.net/account/n1rnxpdpx3kldygsklfft0gech7fhfcux4zst5lw) `n1rnxpdpx3kldygsklfft0gech7fhfcux4zst5lw` is a single source of truth. If you expect your node to have Nym team stake and it doesn't, please reach out in in the [**Node Operators Matrix channel**](https://matrix.to/#/#operators:nymtech.chat).
 </Callout>
@@ -252,32 +649,32 @@ nym-vpnc connect --enable-two-hop  --entry-gateway-id 7CWjY3QFoA9dgE535u9bQiXCfz

 - [Feature/testing utils](https://github.com/nymtech/nym/pull/5963): This PR introduces a couple of general helpers, in particular some mocks for sending across values using Stream/Sink and AsyncRead/AsyncWrite without actual underlying networking. Example implementation are with NymNoise (which was the original inspiration) and gateway handshake.

- [Backport metadata endpoint](https://github.com/nymtech/nym/pull/6010) 
+- [Backport metadata endpoint](https://github.com/nymtech/nym/pull/6010)

 ### Bugfix

 - [Fix rust `1.89` `clippy` issues](https://github.com/nymtech/nym/pull/5944)

- [`http api` client adjustment](https://github.com/nymtech/nym/pull/5953): It fixes missing `feature-lock` when cloning the client and adds helper macro for user agent creation  
+- [`http api` client adjustment](https://github.com/nymtech/nym/pull/5953): It fixes missing `feature-lock` when cloning the client and adds helper macro for user agent creation

 - [Fix `ci-build` for linux (and use updated runner)](https://github.com/nymtech/nym/pull/5958): This PR fixes our build pipeline by using correct (updated) linux runner and updates all the conditional steps that were behind `ubuntu` runners (which no longer exist)

- [Fixing the ci for ns agent](https://github.com/nymtech/nym/pull/5965) 
+- [Fixing the ci for ns agent](https://github.com/nymtech/nym/pull/5965)

 - [Manually calculate per node work on rewarded set changes](https://github.com/nymtech/nym/pull/5972): This PR fixes:
-    1. Nym rewarded set was set to X, for argument sake say 200 
+    1. Nym rewarded set was set to X, for argument sake say 200
    2. We sent transaction to update it to Y, say 100
    3. This internally updated the interval rewarding parameters inside the mixnet contract including the default active and standby node work factors. Note that the rewarded set itself stayed the same, as it only changes after epoch rolls over and new one is assigned (by the `nym-api`)
   4. Epoch has finished and `nym-api` wanted to do the rewarding. It grabbed the **current** rewarded set (of X, 200) and started calculating the total work in the system. But since the contract already had new parameters (adjusted for size of Y, 100), the result was greater than 1 thus `nym-api` was preventably blowing up.
    To fix it we introduce additional checks, so that if the current rewarded set does not match the specification defined in the contract rewarding parameters, `nym-api` will attempt to do its best to manually calculate work factors for this epoch.

- [Fix the ns api ci workflow](https://github.com/nymtech/nym/pull/5981) 
+- [Fix the ns api ci workflow](https://github.com/nymtech/nym/pull/5981)

- [Make sure tables are removed in correct order to not trigger FK constraint issue](https://github.com/nymtech/nym/pull/5987) 
+- [Make sure tables are removed in correct order to not trigger FK constraint issue](https://github.com/nymtech/nym/pull/5987)

 ### Refactors & Maintenance

- [Move credential verifier in peer controller](https://github.com/nymtech/nym/pull/5938): This PR is to not duplicate the verifier code (minus the actual verification operation, which is harder to unit test because of expiration checks) 
+- [Move credential verifier in peer controller](https://github.com/nymtech/nym/pull/5938): This PR is to not duplicate the verifier code (minus the actual verification operation, which is harder to unit test because of expiration checks)

 - [Remove unused import](https://github.com/nymtech/nym/pull/5942)

@@ -288,7 +685,7 @@ nym-vpnc connect --enable-two-hop  --entry-gateway-id 7CWjY3QFoA9dgE535u9bQiXCfz
 - [Remove freshness check on testrun submit](https://github.com/nymtech/nym/pull/5977):
    - Freshness is enforced by a background task that marks test runs as stale after a configured amount of time
    - Make existing freshness period configurable to avoid code changes in the future
-    - Added `humantime` for parsing  
+    - Added `humantime` for parsing

 - [Move authenticator into gateway crate](https://github.com/nymtech/nym/pull/5982)

@@ -311,7 +708,7 @@ nym-vpnc connect --enable-two-hop  --entry-gateway-id 7CWjY3QFoA9dgE535u9bQiXCfz

 - [Ecash liveness check](https://github.com/nymtech/nym/pull/5890)

- [Basic zulip client for sending messages](https://github.com/nymtech/nym/pull/5913): In order to be able to send zulip notifications about *emergency* upgrade mode being activated, we need some sort of client. Unfortunately there isn't any rust library that's maintained (the only one had last commit 4 years ago). This simple thing now currently only supports message sending 
+- [Basic zulip client for sending messages](https://github.com/nymtech/nym/pull/5913): In order to be able to send zulip notifications about *emergency* upgrade mode being activated, we need some sort of client. Unfortunately there isn't any rust library that's maintained (the only one had last commit 4 years ago). This simple thing now currently only supports message sending

 - [`nym-node` debug command to reset providers db](https://github.com/nymtech/nym/pull/5914)

@@ -321,7 +718,7 @@ nym-vpnc connect --enable-two-hop  --entry-gateway-id 7CWjY3QFoA9dgE535u9bQiXCfz

 ### Refactors & Maintenance

- [Allow compatibility with 'CDLA-Permissive-2.0'](https://github.com/nymtech/nym/pull/5910): This license is present in the included `webpki-roots` 
+- [Allow compatibility with 'CDLA-Permissive-2.0'](https://github.com/nymtech/nym/pull/5910): This license is present in the included `webpki-roots`

 - [Migrate strum to `0.27.2`](https://github.com/nymtech/nym/pull/5960): This PR migrates strum to the latest. Notably all macros' were moved into `strum_macros`. The rest stays the same.

@@ -346,9 +743,9 @@ cargo Profile:      release

 ### Operators Updates & Tools

-  Stark Industries is on a sanction list by EU. IP addresses managed by Stark Ind. and their subsidies (ASN 44477 / ASN 33993) had been put on [spamhaus.org](http://spamhaus.org/) [list](https://www.spamhaus.org/drop/asndrop.json). The effect on NymVPN user experience is that Exit Gateways IPs hosted on Stark Ind. are seen as a spam proxies by many online services.  
+-  Stark Industries is on a sanction list by EU. IP addresses managed by Stark Ind. and their subsidies (ASN 44477 / ASN 33993) had been put on [spamhaus.org](http://spamhaus.org/) [list](https://www.spamhaus.org/drop/asndrop.json). The effect on NymVPN user experience is that Exit Gateways IPs hosted on Stark Ind. are seen as a spam proxies by many online services.

- We ask operators - especially Exit Gateways - to consider moving to another ISP. Visit an updated [ISP list](community-counsel/isp-list) and feel free to add more providers, following [these steps](community-counsel/add-content). 
+- We ask operators - especially Exit Gateways - to consider moving to another ISP. Visit an updated [ISP list](community-counsel/isp-list) and feel free to add more providers, following [these steps](community-counsel/add-content).

 ### Features

@@ -362,13 +759,13 @@ cargo Profile:      release
 - [`sqlx-pool-guard`: allocate more memory on windows](https://github.com/nymtech/nym/pull/5896):
    - Allocate 1.5x more memory than reported by the system to provide a safety margin
    - Increase number of retry attempts to 5
-    
+

 - [dkg epoch dealers query](https://github.com/nymtech/nym/pull/5899)

 - [dkg snapshot epoch](https://github.com/nymtech/nym/pull/5900): In order to determine if signer quorum has been down at particular height, we need to know with certainty the dkg epoch id corresponding to given block height. This PR makes it possible. Every time epoch state is changed (due to DKG progress), snapshot is saved and can be queried. This doesn't work for past data, but given mainnet has only had a single DKG instance, that's not an issue.

- [`sqlx-pool-guard`: obtain filename from connect options](https://github.com/nymtech/nym/pull/5905): 
+- [`sqlx-pool-guard`: obtain filename from connect options](https://github.com/nymtech/nym/pull/5905):

 ### Refactors & Maintenance

@@ -424,7 +821,7 @@ cargo Profile:      release

 - [Remove old explorer references](https://github.com/nymtech/nym/pull/5846)

- [Listen for shutdown signals during nym-node startup](https://github.com/nymtech/nym/pull/5879): This is to avoid situation where the process can't be killed without 'kill -9' because the logic to listen to shutdown signals hasn't been hit yet 
+- [Listen for shutdown signals during nym-node startup](https://github.com/nymtech/nym/pull/5879): This is to avoid situation where the process can't be killed without 'kill -9' because the logic to listen to shutdown signals hasn't been hit yet

 ### Bugfixes

@@ -2484,7 +2881,7 @@ cargo Profile:      release
 <Callout type="warning" emoji="⚠️">
 After changes coming along with `v2024.13-magura` (`nym-node v1.1.10`), Nym Explorer is no longer picking all values correctly. Instead of fixing this outdated explorer, we are working on a new one, coming out soon.

-[Nym Harbourmaster](https://harbourmaster.nymtech.net) has cache of 90min, expect your values to be updated with delay. We are aware of some issues with Nym Harbourmaster and working hard to resolve them in the upcoming explorer v2. To check your routing values in real time, you can use [`nym-gateway-probe`](nodes/performance-and-testing/gateway-probe).
+[Nym Harbourmaster](https://harbourmaster.nymtech.net) has cache of 90min, expect your values to be updated with delay. We are aware of some issues with Nym Harbourmaster and working hard to resolve them in the upcoming explorer v2. To check your routing values in real time, you can use [`nym-gateway-probe`](performance-and-testing/gateway-probe).
 </Callout>

 ### Operators Updates & Tools
@@ -40,6 +40,9 @@ If you want to explore kickstart options and examples, learn how to integrate wi
 * [Validators](nodes/validator-setup.mdx)
 * [Nym API Setup](nodes/validator-setup/nym-api.mdx)

+**Performance Monitoring**
+* [Performance, probe and measurements](performance-and-testing)
+
 **Tokenomics, rewards and roadmap**
 * [General tokenomics page](tokenomics.mdx)
 * [Nym Node rewards page](tokenomics/mixnet-rewards.mdx)
@@ -2,6 +2,5 @@
  "preliminary-steps": "Preliminary Steps",
  "nym-node": "Nym Node",
  "validator-setup": "Nyx Validator Setup",
-  "maintenance": "Maintenance",
-  "performance-and-testing": "Performance Monitoring & Testing"
+  "maintenance": "Maintenance"
 }
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 _024
 _965
@@ -1 +1 @@
 _614
 _263