ci: fix

Add connect_timeout to registration client
Add connect timeout
2025-10-23 12:45:52 +02:00 · 2025-10-22 15:41:26 +02:00 · 2025-10-22 15:21:12 +02:00 · 2025-10-22 10:42:26 +01:00 · 2025-10-22 11:08:21 +02:00 · 2025-10-21 19:34:20 +02:00
47 changed files with 1000 additions and 296 deletions
@@ -54,7 +54,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: test
-          args: --lib --manifest-path contracts/Cargo.toml
+          args: --lib --manifest-path contracts/Cargo.toml --all-features

      - name: Check formatting
        uses: actions-rs/cargo@v1
@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -38,6 +43,16 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -46,12 +61,24 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,46 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.19-kase] (2025-10-30)
-
- update ns agent workflow ([#6154])
- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
- bugfix: nym-credential-proxy query params parsing regression ([#6121])
- bugfix: revert some dep updates introduced in #6043 ([#6120])
- Skip ipv6 metadata endpoint request ([#6118])
- update to no longer use 1mb files ([#6117])
- chore: restore pending dkg contract state migration ([#6116])
- Revert "Propagate cancel token to mixnet client" ([#6115])
- Update dirs to 6.0 ([#6109])
- Propagate cancel token to mixnet client ([#6105])
- bugfix: retrieve and update ticketbook in the same query ([#6101])
- bugfix: include network name in the default gateway probe config path ([#6100])
- Bugfix/incompatibility fixes ([#6099])
- [DOCs/operators] QUIC deployment script & docs ([#6098])
- bugfix: testnet manager 02sql migration ([#6096])
- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
- bugfix: use custom topology provider for list of init gateways ([#6092])
- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)

 - ns-api: add descriptions to dVPN gateway responses ([#6102])
@@ -4824,7 +4824,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.68"
+version = "1.1.67"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -5050,7 +5050,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5133,7 +5133,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -6354,7 +6354,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.66"
+version = "1.1.65"
 dependencies = [
 "addr",
 "anyhow",
@@ -6404,7 +6404,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.20.0"
+version = "1.19.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6930,7 +6930,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.65"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -7669,7 +7669,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.30"
+version = "0.1.29"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.65"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.65"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -36,7 +36,7 @@ nym-bandwidth-controller = { path = "../bandwidth-controller" }
 nym-crypto = { path = "../crypto" }
 nym-gateway-client = { path = "../client-libs/gateway-client" }
 nym-gateway-requests = { path = "../gateway-requests" }
-nym-http-api-client = { path = "../http-api-client" }
+nym-http-api-client = { path = "../http-api-client", features = ["network-defaults"] }
 nym-nonexhaustive-delayqueue = { path = "../nonexhaustive-delayqueue" }
 nym-sphinx = { path = "../nymsphinx" }
 nym-statistics-common = { path = "../statistics" }
@@ -114,13 +114,12 @@ where
        })?;
        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
-        let mut rng = rand::thread_rng();
        crate::init::helpers::gateways_for_init(
-            &mut rng,
            &core.client.nym_api_urls,
            user_agent,
            core.debug.topology.minimum_gateway_performance,
            core.debug.topology.ignore_ingress_epoch_role,
+            None,
        )
        .await?
    };
@@ -141,6 +140,7 @@ where
        available_gateways,
        #[cfg(unix)]
        connection_fd_callback: None,
+        connect_timeout: None,
    };

    let init_details =
@@ -173,13 +173,12 @@ where
        })?;
        hardcoded_topology.entry_capable_nodes().cloned().collect()
    } else {
-        let mut rng = rand::thread_rng();
        crate::init::helpers::gateways_for_init(
-            &mut rng,
            &core.client.nym_api_urls,
            user_agent,
            core.debug.topology.minimum_gateway_performance,
            core.debug.topology.ignore_ingress_epoch_role,
+            None,
        )
        .await?
    };
@@ -189,6 +188,7 @@ where
        available_gateways,
        #[cfg(unix)]
        connection_fd_callback: None,
+        connect_timeout: None,
    };

    let init_details =
@@ -65,6 +65,7 @@ use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use std::path::Path;
 use std::sync::Arc;
+use std::time::Duration;
 use time::OffsetDateTime;
 use tokio::sync::mpsc::Sender;
 use url::Url;
@@ -73,6 +74,10 @@ use url::Url;
 #[cfg(debug_assertions)]
 use wasm_utils::console_log;

+/// Default number of retries for Nym API requests when using network details with domain fronting.
+/// This allows the client to try alternative URLs if the primary endpoint is unavailable.
+const DEFAULT_NYM_API_RETRIES: usize = 3;
+
 #[cfg(all(
    not(target_arch = "wasm32"),
    feature = "fs-surb-storage",
@@ -212,6 +217,9 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
    client_store: S,
    dkg_query_client: Option<C>,

+    // Optional API URLs for domain fronting support
+    nym_api_urls: Option<Vec<nym_network_defaults::ApiUrl>>,
+
    wait_for_gateway: bool,
    custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
    custom_gateway_transceiver: Option<Box<dyn GatewayTransceiver + Send>>,
@@ -223,6 +231,7 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {

    #[cfg(unix)]
    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+    connect_timeout: Option<Duration>,

    derivation_material: Option<DerivationMaterial>,
 }
@@ -241,6 +250,7 @@ where
            config: base_config,
            client_store,
            dkg_query_client,
+            nym_api_urls: None,
            wait_for_gateway: false,
            custom_topology_provider: None,
            custom_gateway_transceiver: None,
@@ -250,6 +260,7 @@ where
            setup_method: GatewaySetup::MustLoad { gateway_id: None },
            #[cfg(unix)]
            connection_fd_callback: None,
+            connect_timeout: None,
            derivation_material: None,
        }
    }
@@ -263,6 +274,16 @@ where
        self
    }

+    /// Set Nym API URLs for domain fronting support.
+    ///
+    /// When provided, the client will use these API URLs (which include front_hosts)
+    /// to construct HTTP clients with domain fronting enabled.
+    #[must_use]
+    pub fn with_nym_api_urls(mut self, nym_api_urls: Vec<nym_network_defaults::ApiUrl>) -> Self {
+        self.nym_api_urls = Some(nym_api_urls);
+        self
+    }
+
    #[must_use]
    pub fn with_forget_me(mut self, forget_me: &ForgetMe) -> Self {
        self.config.debug.forget_me = *forget_me;
@@ -338,6 +359,11 @@ where
        self
    }

+    pub fn with_connect_timeout(mut self, timeout: Duration) -> Self {
+        self.connect_timeout = Some(timeout);
+        self
+    }
+
    // note: do **NOT** make this method public as its only valid usage is from within `start_base`
    // because it relies on the crypto keys being already loaded
    fn mix_address(details: &InitialisationResult) -> Recipient {
@@ -515,6 +541,7 @@ where
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+        connect_timeout: Option<Duration>,
        shutdown_tracker: &ShutdownTracker,
    ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
    where
@@ -559,6 +586,7 @@ where
                    stats_reporter,
                    #[cfg(unix)]
                    connection_fd_callback,
+                    connect_timeout,
                    shutdown_tracker.clone_shutdown_token(),
                )
            };
@@ -622,6 +650,7 @@ where
        packet_router: PacketRouter,
        stats_reporter: ClientStatsSender,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+        connect_timeout: Option<Duration>,
        shutdown_tracker: &ShutdownTracker,
    ) -> Result<Box<dyn GatewayTransceiver + Send>, ClientCoreError>
    where
@@ -654,6 +683,7 @@ where
            stats_reporter,
            #[cfg(unix)]
            connection_fd_callback,
+            connect_timeout,
            shutdown_tracker,
        )
        .await?;
@@ -783,7 +813,7 @@ where
            event_tx,
        );

-        let mix_tx = mix_traffic_controller.mix_tx();
+        let mix_tx = mix_traffic_controller.mix_rx();
        let client_tx = mix_traffic_controller.client_tx();

        shutdown_tracker.try_spawn_named(
@@ -863,21 +893,67 @@ where
    }

    fn construct_nym_api_client(
+        nym_api_urls: Option<&Vec<nym_network_defaults::ApiUrl>>,
        config: &Config,
        user_agent: Option<UserAgent>,
    ) -> Result<nym_http_api_client::Client, ClientCoreError> {
+        tracing::debug!(
+            "construct_nym_api_client called with nym_api_urls: {}",
+            nym_api_urls.is_some()
+        );
+
+        // If API URLs are provided, use new_with_fronted_urls() which handles domain fronting
+        if let Some(nym_api_urls) = nym_api_urls {
+            if nym_api_urls.is_empty() {
+                tracing::warn!("Provided nym_api_urls is empty, falling back to config endpoints");
+            } else {
+                tracing::info!(
+                    "Building nym-api client from provided URLs (with domain fronting support): {} URLs",
+                    nym_api_urls.len()
+                );
+
+                let mut builder =
+                    nym_http_api_client::ClientBuilder::new_with_fronted_urls(nym_api_urls.clone())
+                        .map_err(ClientCoreError::from)?
+                        .with_retries(DEFAULT_NYM_API_RETRIES);
+
+                if let Some(user_agent) = user_agent {
+                    builder = builder.with_user_agent(user_agent);
+                }
+
+                return builder.build().map_err(ClientCoreError::from);
+            }
+        }
+
+        // Fallback to basic client for backwards compatibility
+        tracing::debug!("Building basic nym-api HTTP client from config endpoints");
+
        let mut nym_api_urls = config.get_nym_api_endpoints();
+        if nym_api_urls.is_empty() {
+            tracing::warn!("No API endpoints configured in config, this may cause issues");
+        }
        nym_api_urls.shuffle(&mut thread_rng());

-        let mut builder = nym_http_api_client::Client::builder(nym_api_urls[0].clone())
-            .map_err(ClientCoreError::from)?;
+        // Convert config URLs to ApiUrl format for consistency
+        let api_urls: Vec<nym_network_defaults::ApiUrl> = nym_api_urls
+            .into_iter()
+            .map(|url| nym_network_defaults::ApiUrl {
+                url: url.to_string(),
+                front_hosts: None,
+            })
+            .collect();
+
+        tracing::debug!("Using {} config API endpoints", api_urls.len());
+
+        let mut builder = nym_http_api_client::ClientBuilder::new_with_fronted_urls(api_urls)
+            .map_err(ClientCoreError::from)?
+            .with_retries(DEFAULT_NYM_API_RETRIES)
+            .with_bincode();

        if let Some(user_agent) = user_agent {
            builder = builder.with_user_agent(user_agent);
        }

-        builder = builder.with_bincode();
-
        builder.build().map_err(ClientCoreError::from)
    }

@@ -940,8 +1016,8 @@ where
        // Create a shutdown tracker for this client - either as a child of provided tracker
        // or get one from the registry
        let shutdown_tracker = match self.shutdown {
-            Some(parent_tracker) => parent_tracker.clone(),
-            None => nym_task::create_sdk_shutdown_tracker()?,
+            Some(parent_tracker) => parent_tracker.child_tracker(),
+            None => nym_task::get_sdk_shutdown_tracker()?,
        };

        Self::start_event_control(self.event_tx, event_receiver, &shutdown_tracker);
@@ -961,7 +1037,11 @@ where
            .dkg_query_client
            .map(|client| BandwidthController::new(credential_store, client));

-        let nym_api_client = Self::construct_nym_api_client(&self.config, self.user_agent.clone())?;
+        let nym_api_client = Self::construct_nym_api_client(
+            self.nym_api_urls.as_ref(),
+            &self.config,
+            self.user_agent.clone(),
+        )?;
        let key_rotation_config = Self::determine_key_rotation_state(&nym_api_client).await?;

        let topology_provider = Self::setup_topology_provider(
@@ -976,7 +1056,7 @@ where
            self.user_agent.clone(),
            generate_client_stats_id(*self_address.identity()),
            input_sender.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
        );

        // needs to be started as the first thing to block if required waiting for the gateway
@@ -986,7 +1066,7 @@ where
            shared_topology_accessor.clone(),
            self_address.gateway(),
            self.wait_for_gateway,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
        )
        .await?;

@@ -1006,7 +1086,8 @@ where
            stats_reporter.clone(),
            #[cfg(unix)]
            self.connection_fd_callback,
-            &shutdown_tracker.clone(),
+            self.connect_timeout,
+            &shutdown_tracker.child_tracker(),
        )
        .await?;
        let gateway_ws_fd = gateway_transceiver.ws_fd();
@@ -1014,7 +1095,7 @@ where
        let reply_storage = Self::setup_persistent_reply_storage(
            reply_storage_backend,
            key_rotation_config,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
        )
        .await?;

@@ -1025,7 +1106,7 @@ where
            reply_storage.key_storage(),
            reply_controller_sender.clone(),
            stats_reporter.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
        );

        // The message_sender is the transmitter for any component generating sphinx packets
@@ -1035,7 +1116,7 @@ where

        let (message_sender, client_request_sender) = Self::start_mix_traffic_controller(
            gateway_transceiver,
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
            EventSender(event_sender),
        );

@@ -1066,7 +1147,7 @@ where
            shared_lane_queue_lengths.clone(),
            client_connection_rx,
            stats_reporter.clone(),
-            &shutdown_tracker.clone(),
+            &shutdown_tracker.child_tracker(),
        );

        if !self
@@ -1082,7 +1163,7 @@ where
                shared_topology_accessor.clone(),
                message_sender,
                stats_reporter.clone(),
-                &shutdown_tracker.clone(),
+                &shutdown_tracker.child_tracker(),
            );
        }

@@ -1136,3 +1217,53 @@ pub struct BaseClient {
    pub forget_me: ForgetMe,
    pub remember_me: RememberMe,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nym_network_defaults::{ApiUrl, NymNetworkDetails};
+
+    #[test]
+    fn test_network_details_with_multiple_urls() {
+        // Verify that network details can be configured with multiple API URLs
+        let mut network_details = NymNetworkDetails::new_empty();
+        network_details.nym_api_urls = Some(vec![
+            ApiUrl {
+                url: "https://validator.nymtech.net/api/".to_string(),
+                front_hosts: None,
+            },
+            ApiUrl {
+                url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+                front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+            },
+        ]);
+
+        assert_eq!(network_details.nym_api_urls.as_ref().unwrap().len(), 2);
+        assert!(network_details.nym_api_urls.as_ref().unwrap()[1]
+            .front_hosts
+            .is_some());
+    }
+
+    #[test]
+    fn test_network_details_with_front_hosts() {
+        // Verify that ApiUrl can store domain fronting configuration
+        let api_url = ApiUrl {
+            url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+            front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+        };
+
+        assert_eq!(api_url.url, "https://nym-frontdoor.vercel.app/api/");
+        assert_eq!(api_url.front_hosts.as_ref().unwrap().len(), 2);
+        assert!(api_url
+            .front_hosts
+            .as_ref()
+            .unwrap()
+            .contains(&"vercel.app".to_string()));
+    }
+
+    #[test]
+    fn test_default_nym_api_retries_constant() {
+        // Verify the retry constant is set correctly
+        assert_eq!(DEFAULT_NYM_API_RETRIES, 3);
+    }
+}
@@ -205,7 +205,7 @@ impl LoopCoverTrafficStream<OsRng> {
                TrySendError::Full(_) => {
                    // This isn't a problem, if the channel is full means we're already sending the
                    // max amount of messages downstream can handle.
-                    tracing::trace!("Failed to send cover message - channel full");
+                    tracing::debug!("Failed to send cover message - channel full");
                }
                TrySendError::Closed(_) => {
                    tracing::warn!("Failed to send cover message - channel closed");
@@ -20,10 +20,7 @@ pub mod transceiver;

 // We remind ourselves that 32 x 32kb = 1024kb, a reasonable size for a network buffer.
 pub const MIX_MESSAGE_RECEIVER_BUFFER_SIZE: usize = 32;
-
-/// Reduced from 100 to 20 to fail fast (~1-2 seconds instead of ~6 seconds).
-/// If we can't send 20 packets in a row, the gateway is unreachable.
-const MAX_FAILURE_COUNT: usize = 20;
+const MAX_FAILURE_COUNT: usize = 100;

 // that's also disgusting.
 pub struct Empty;
@@ -87,7 +84,7 @@ impl MixTrafficController {
        self.client_tx.clone()
    }

-    pub fn mix_tx(&self) -> BatchMixMessageSender {
+    pub fn mix_rx(&self) -> BatchMixMessageSender {
        self.mix_tx.clone()
    }

@@ -159,11 +156,6 @@ impl MixTrafficController {
                            // Do we need to handle the embedded mixnet client case
                            // separately?
                            self.event_tx.send(MixnetClientEvent::Traffic(MixTrafficEvent::FailedSendingSphinx));
-                            // IMO it shouldn't be signalled from there but it is how it is
-                            // TODO : report the failure upwards and shutdown from upwards
-                            // Gateway is dead, we have to shut down currently
-                            error!("Signalling shutdown from the MixTrafficController");
-                            self.shutdown_token.cancel();
                            break;
                        }
                    }
@@ -298,8 +298,6 @@ where
                        "failed to send mixnet packet due to closed channel (outside of shutdown!)"
                    );
                }
-                // Early return to avoid further processing when channel is closed
-                return;
            }
            Ok(_) => {
                let event = if fragment_id.is_some() {
@@ -45,6 +45,7 @@ type WsConn = JSWebsocket;

 const CONCURRENT_GATEWAYS_MEASURED: usize = 20;
 const MEASUREMENTS: usize = 3;
+const DEFAULT_NYM_API_RETRIES: usize = 3;

 #[cfg(not(target_arch = "wasm32"))]
 const CONN_TIMEOUT: Duration = Duration::from_millis(1500);
@@ -132,25 +133,27 @@ impl<'a, G: ConnectableGateway> GatewayWithLatency<'a, G> {
    }
 }

-pub async fn gateways_for_init<R: Rng>(
-    rng: &mut R,
+pub async fn gateways_for_init(
    nym_apis: &[Url],
    user_agent: Option<UserAgent>,
    minimum_performance: u8,
    ignore_epoch_roles: bool,
+    retry_count: Option<usize>,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let nym_api = nym_apis
-        .choose(rng)
-        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
+    // Build client with ALL URLs for fallback support
+    let nym_api_urls: Vec<nym_http_api_client::Url> = nym_apis
+        .iter()
+        .map(|url| nym_http_api_client::Url::from(url.clone()))
+        .collect();

-    // Use the unified HTTP client directly with optional user agent
-    let mut builder = nym_http_api_client::Client::builder(nym_api.clone())
-        .map_err(|e| {
-            ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(
-                e,
-            ))
-        })?
-        .with_bincode(); // Use bincode for better performance
+    if nym_api_urls.is_empty() {
+        return Err(ClientCoreError::ListOfNymApisIsEmpty);
+    }
+
+    let retry_count = retry_count.unwrap_or(DEFAULT_NYM_API_RETRIES);
+    let mut builder = nym_http_api_client::ClientBuilder::new_with_urls(nym_api_urls.clone())?
+        .with_retries(retry_count)
+        .with_bincode();

    if let Some(user_agent) = user_agent {
        builder = builder.with_user_agent(user_agent);
@@ -160,7 +163,7 @@ pub async fn gateways_for_init<R: Rng>(
        ClientCoreError::ValidatorClientError(nym_validator_client::ValidatorClientError::from(e))
    })?;

-    tracing::debug!("Fetching list of gateways from: {nym_api}");
+    tracing::debug!("Fetching list of gateways from: {:?}", nym_api_urls);

    // Use our helper to handle pagination
    let gateways = get_all_basic_entry_nodes_with_metadata(&client, true)
@@ -172,17 +175,15 @@ pub async fn gateways_for_init<R: Rng>(

    // filter out gateways below minimum performance and ones that could operate as a mixnode
    // (we don't want instability)
-    let valid_gateways = gateways
+    let valid_gateways: Vec<RoutingNode> = gateways
        .iter()
        .filter(|g| ignore_epoch_roles || !g.supported_roles.mixnode)
        .filter(|g| g.performance.round_to_integer() >= minimum_performance)
        .filter_map(|gateway| gateway.try_into().ok())
-        .collect::<Vec<_>>();
-    tracing::debug!("After checking validity: {}", valid_gateways.len());
-    tracing::trace!("Valid gateways: {valid_gateways:#?}");
+        .collect();

    tracing::info!(
-        "and {} after validity and performance filtering",
+        "Found {} valid gateways after filtering",
        valid_gateways.len()
    );

@@ -345,13 +346,20 @@ pub(super) fn get_specified_gateway(
    must_use_tls: bool,
 ) -> Result<RoutingNode, ClientCoreError> {
    tracing::debug!("Requesting specified gateway: {gateway_identity}");
+
    let user_gateway = ed25519::PublicKey::from_base58_string(gateway_identity)
        .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;

    let gateway = gateways
        .iter()
        .find(|gateway| gateway.identity_key == user_gateway)
-        .ok_or_else(|| ClientCoreError::NoGatewayWithId(gateway_identity.to_string()))?;
+        .ok_or_else(|| {
+            tracing::debug!(
+                "Gateway {gateway_identity} not found in {} available gateways",
+                gateways.len()
+            );
+            ClientCoreError::NoGatewayWithId(gateway_identity.to_string())
+        })?;

    let Some(entry_details) = gateway.entry.as_ref() else {
        return Err(ClientCoreError::UnsupportedEntry {
@@ -374,6 +382,7 @@ pub(super) async fn register_with_gateway(
    gateway_listener: Url,
    our_identity: Arc<ed25519::KeyPair>,
    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+    connect_timeout: Option<Duration>,
 ) -> Result<RegistrationResult, ClientCoreError> {
    let mut gateway_client = GatewayClient::new_init(
        gateway_listener,
@@ -381,6 +390,7 @@ pub(super) async fn register_with_gateway(
        our_identity.clone(),
        #[cfg(unix)]
        connection_fd_callback,
+        connect_timeout,
    );

    gateway_client.establish_connection().await.map_err(|err| {
@@ -414,3 +424,52 @@ pub(super) async fn register_with_gateway(
        authenticated_ephemeral_client: gateway_client,
    })
 }
+
+#[cfg(test)]
+mod tests {
+    use url::Url;
+
+    #[test]
+    fn test_single_url_builds_without_retries() {
+        let urls = [Url::parse("https://api.nym.com").unwrap()];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 1, "Should have exactly one URL");
+    }
+
+    #[test]
+    fn test_multiple_urls_prepared_for_retries() {
+        let urls = vec![
+            Url::parse("https://api1.nym.com").unwrap(),
+            Url::parse("https://api2.nym.com").unwrap(),
+            Url::parse("https://api3.nym.com").unwrap(),
+        ];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert_eq!(nym_api_urls.len(), 3, "Should have all three URLs");
+        assert!(
+            nym_api_urls.len() > 1,
+            "Multiple URLs trigger retry behavior"
+        );
+    }
+
+    #[test]
+    fn test_empty_url_list_is_detected() {
+        let urls: Vec<Url> = vec![];
+
+        let nym_api_urls: Vec<nym_http_api_client::Url> = urls
+            .iter()
+            .map(|url| nym_http_api_client::Url::from(url.clone()))
+            .collect();
+
+        assert!(nym_api_urls.is_empty(), "Empty list should remain empty");
+    }
+}
@@ -23,6 +23,7 @@ use nym_topology::node::RoutingNode;
 use rand::rngs::OsRng;
 use rand::{CryptoRng, RngCore};
 use serde::Serialize;
+use std::time::Duration;
 #[cfg(unix)]
 use std::{os::fd::RawFd, sync::Arc};

@@ -56,6 +57,7 @@ async fn setup_new_gateway<K, D>(
    selection_specification: GatewaySelectionSpecification,
    available_gateways: Vec<RoutingNode>,
    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+    connect_timeout: Option<Duration>,
 ) -> Result<InitialisationResult, ClientCoreError>
 where
    K: KeyStore,
@@ -117,6 +119,7 @@ where
                our_identity,
                #[cfg(unix)]
                connection_fd_callback,
+                connect_timeout,
            )
            .await?;
            (
@@ -213,6 +216,7 @@ where
            available_gateways,
            #[cfg(unix)]
            connection_fd_callback,
+            connect_timeout,
        } => {
            tracing::debug!("GatewaySetup::New with spec: {specification:?}");
            setup_new_gateway(
@@ -222,6 +226,7 @@ where
                available_gateways,
                #[cfg(unix)]
                connection_fd_callback,
+                connect_timeout,
            )
            .await
        }
@@ -21,6 +21,7 @@ use std::fmt::{Debug, Display};
 #[cfg(unix)]
 use std::os::fd::RawFd;
 use std::sync::Arc;
+use std::time::Duration;
 use time::OffsetDateTime;
 use url::Url;

@@ -214,6 +215,9 @@ pub enum GatewaySetup {
        /// Callback useful for allowing initial connection to gateway
        #[cfg(unix)]
        connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+
+        /// Timeout for establishing connection
+        connect_timeout: Option<Duration>,
    },

    ReuseConnection {
@@ -239,6 +243,7 @@ impl Debug for GatewaySetup {
                available_gateways,
                #[cfg(unix)]
                    connection_fd_callback: _,
+                connect_timeout: _,
            } => f
                .debug_struct("GatewaySetup::New")
                .field("specification", specification)
@@ -280,6 +285,7 @@ impl GatewaySetup {
            available_gateways: vec![],
            #[cfg(unix)]
            connection_fd_callback: None,
+            connect_timeout: None,
        }
    }

@@ -38,6 +38,7 @@ use url::Url;

 #[cfg(unix)]
 use std::os::fd::RawFd;
+use std::time::Duration;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio::time::sleep;

@@ -104,10 +105,13 @@ pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
    // currently unused (but populated)
    negotiated_protocol: Option<u8>,

-    // Callback on the fd as soon as the connection has been established
+    /// Callback on the fd as soon as the connection has been established
    #[cfg(unix)]
    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,

+    /// Maximum duration to wait for a connection to be established when set
+    connect_timeout: Option<Duration>,
+
    /// Listen to shutdown messages and send notifications back to the task manager
    shutdown_token: ShutdownToken,
 }
@@ -124,6 +128,7 @@ impl<C, St> GatewayClient<C, St> {
        bandwidth_controller: Option<BandwidthController<C, St>>,
        stats_reporter: ClientStatsSender,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+        connect_timeout: Option<Duration>,
        shutdown_token: ShutdownToken,
    ) -> Self {
        GatewayClient {
@@ -141,6 +146,7 @@ impl<C, St> GatewayClient<C, St> {
            negotiated_protocol: None,
            #[cfg(unix)]
            connection_fd_callback,
+            connect_timeout,
            shutdown_token,
        }
    }
@@ -208,6 +214,7 @@ impl<C, St> GatewayClient<C, St> {
            &self.gateway_address,
            #[cfg(unix)]
            self.connection_fd_callback.clone(),
+            self.connect_timeout,
        )
        .await?;

@@ -1132,6 +1139,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
        gateway_identity: ed25519::PublicKey,
        local_identity: Arc<ed25519::KeyPair>,
        #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+        connect_timeout: Option<Duration>,
    ) -> Self {
        log::trace!("Initialising gateway client");
        use futures::channel::mpsc;
@@ -1158,6 +1166,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            negotiated_protocol: None,
            #[cfg(unix)]
            connection_fd_callback,
+            connect_timeout,
            shutdown_token,
        }
    }
@@ -1190,6 +1199,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
            negotiated_protocol: self.negotiated_protocol,
            #[cfg(unix)]
            connection_fd_callback: self.connection_fd_callback,
+            connect_timeout: self.connect_timeout,
            shutdown_token,
        }
    }
@@ -1,6 +1,7 @@
 use crate::error::GatewayClientError;

 use nym_http_api_client::HickoryDnsResolver;
+use std::time::Duration;
 #[cfg(unix)]
 use std::{
    os::fd::{AsRawFd, RawFd},
@@ -17,6 +18,7 @@ use std::net::SocketAddr;
 pub(crate) async fn connect_async(
    endpoint: &str,
    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+    connect_timeout: Option<Duration>,
 ) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), GatewayClientError> {
    use tokio::net::TcpSocket;

@@ -64,7 +66,22 @@ pub(crate) async fn connect_async(
            callback.as_ref()(socket.as_raw_fd());
        }

-        match socket.connect(sock_addr).await {
+        let connect_res = if let Some(connect_timeout) = connect_timeout {
+            match tokio::time::timeout(connect_timeout, socket.connect(sock_addr)).await {
+                Ok(res) => res,
+                Err(_elapsed) => {
+                    stream = Err(GatewayClientError::NetworkConnectionTimeout {
+                        address: endpoint.to_owned(),
+                        timeout: connect_timeout,
+                    });
+                    continue;
+                }
+            }
+        } else {
+            socket.connect(sock_addr).await
+        };
+
+        match connect_res {
            Ok(s) => {
                stream = Ok(s);
                break;
@@ -4,6 +4,7 @@
 use nym_gateway_requests::registration::handshake::error::HandshakeError;
 use nym_gateway_requests::{GatewayRequestsError, SimpleGatewayRequestsError};
 use std::io;
+use std::time::Duration;
 use thiserror::Error;
 use tungstenite::Error as WsError;

@@ -46,6 +47,9 @@ pub enum GatewayClientError {
        source: Box<WsError>,
    },

+    #[error("timeout when establishing connection: {address}, timeout: {timeout:?}")]
+    NetworkConnectionTimeout { address: String, timeout: Duration },
+
    #[error("no socket address for endpoint: {address}")]
    NoEndpointForConnection { address: String },

@@ -296,6 +296,9 @@ impl std::error::Error for ReqwestErrorWrapper {}
 #[derive(Debug, Error)]
 #[allow(missing_docs)]
 pub enum HttpClientError {
+    #[error("did not provide any valid client URLs")]
+    NoUrlsProvided,
+
    #[error("failed to construct inner reqwest client: {source}")]
    ReqwestBuildError {
        #[source]
@@ -582,24 +585,29 @@ impl ClientBuilder {
            Self::new(alt)
        } else {
            let url = url.to_url()?;
-            Ok(Self::new_with_urls(vec![url]))
+            Self::new_with_urls(vec![url])
        }
    }

    /// Create a client builder from network details with sensible defaults
    #[cfg(feature = "network-defaults")]
+    // deprecating function since it's not clear from its signature whether the client
+    // would be constructed using `nym_api_urls` or `nym_vpn_api_urls`
+    #[deprecated(note = "use explicit Self::new_with_fronted_urls instead")]
    pub fn from_network(
        network: &nym_network_defaults::NymNetworkDetails,
    ) -> Result<Self, HttpClientError> {
-        let urls = network
-            .nym_api_urls
-            .as_ref()
-            .ok_or_else(|| {
-                HttpClientError::GenericRequestFailure(
-                    "No API URLs configured in network details".to_string(),
-                )
-            })?
-            .iter()
+        let urls = network.nym_api_urls.as_ref().cloned().unwrap_or_default();
+        Self::new_with_fronted_urls(urls.clone())
+    }
+
+    /// Create a client builder using the provided set of domain-fronted URLs
+    #[cfg(feature = "network-defaults")]
+    pub fn new_with_fronted_urls(
+        urls: Vec<nym_network_defaults::ApiUrl>,
+    ) -> Result<Self, HttpClientError> {
+        let urls = urls
+            .into_iter()
            .map(|api_url| {
                // Convert ApiUrl to our Url type with fronting support
                let mut url = Url::parse(&api_url.url)?;
@@ -611,15 +619,19 @@ impl ClientBuilder {
                        .iter()
                        .map(|host| format!("https://{}", host))
                        .collect();
-                    url = Url::new(api_url.url.clone(), Some(fronts))
-                        .map_err(|e| HttpClientError::GenericRequestFailure(e.to_string()))?;
+                    url = Url::new(api_url.url.clone(), Some(fronts)).map_err(|source| {
+                        HttpClientError::MalformedUrl {
+                            raw: api_url.url.clone(),
+                            source,
+                        }
+                    })?;
                }

                Ok(url)
            })
            .collect::<Result<Vec<_>, HttpClientError>>()?;

-        let mut builder = Self::new_with_urls(urls);
+        let mut builder = Self::new_with_urls(urls)?;

        // Enable domain fronting by default (on retry)
        #[cfg(feature = "tunneling")]
@@ -631,7 +643,11 @@ impl ClientBuilder {
    }

    /// Constructs a new http `ClientBuilder` from a valid url.
-    pub fn new_with_urls(urls: Vec<Url>) -> Self {
+    pub fn new_with_urls(urls: Vec<Url>) -> Result<Self, HttpClientError> {
+        if urls.is_empty() {
+            return Err(HttpClientError::NoUrlsProvided);
+        }
+
        let urls = Self::check_urls(urls);

        #[cfg(target_arch = "wasm32")]
@@ -640,7 +656,7 @@ impl ClientBuilder {
        #[cfg(not(target_arch = "wasm32"))]
        let reqwest_client_builder = default_builder();

-        ClientBuilder {
+        Ok(ClientBuilder {
            urls,
            timeout: None,
            custom_user_agent: false,
@@ -651,7 +667,7 @@ impl ClientBuilder {

            retry_limit: 0,
            serialization: SerializationFormat::Json,
-        }
+        })
    }

    /// Add an additional URL to the set usable by this constructed `Client`
@@ -948,13 +964,13 @@ impl Client {

                    return (url.as_str(), url.front_str());
                } else {
-                    warn!(
-                        "Domain fronting is enabled, but no host_url is defined! Domain fronting WILL NOT WORK"
+                    tracing::debug!(
+                        "Domain fronting is enabled, but no host_url is defined for current URL"
                    )
                }
            } else {
-                warn!(
-                    "Domain fronting is enabled, but no front_url is defined! Domain fronting WILL NOT WORK"
+                tracing::debug!(
+                    "Domain fronting is enabled, but current URL has no front_hosts configured"
                )
            }
        }
@@ -21,6 +21,10 @@ inventory::collect!(ConfigRecord);
 /// Returns the default builder with all registered configurations applied.
 pub fn default_builder() -> ReqwestClientBuilder {
    let mut b = ReqwestClientBuilder::new();
+
+    #[cfg(feature = "debug-inventory")]
+    let mut test_client = ReqwestClientBuilder::new();
+
    let mut records: Vec<&'static ConfigRecord> =
        inventory::iter::<ConfigRecord>.into_iter().collect();
    records.sort_by_key(|r| r.priority); // lower runs first
@@ -35,6 +39,10 @@ pub fn default_builder() -> ReqwestClientBuilder {

    for r in records {
        b = (r.apply)(b);
+        #[cfg(feature = "debug-inventory")]
+        {
+            test_client = (r.apply)(test_client);
+        }
    }

    #[cfg(feature = "debug-inventory")]
@@ -47,7 +55,7 @@ pub fn default_builder() -> ReqwestClientBuilder {
        eprintln!("[HTTP-INVENTORY] Building test client to verify configuration...");

        // Try to build a client to see if it works
-        match b.try_clone().unwrap().build() {
+        match test_client.build() {
            Ok(client) => {
                eprintln!("[HTTP-INVENTORY] ✓ Client built successfully");
                eprintln!("[HTTP-INVENTORY] Client debug info: {:#?}", client);
@@ -2,77 +2,77 @@ use super::*;

 #[test]
 fn sanitizing_urls() {
-    let base_url: Url = "http://foomp.com".parse().unwrap();
+    let base_url: Url = "http://api.test".parse().unwrap();

    // works with a full string
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, "/foo//bar/", NO_PARAMS).as_str()
    );

    // (and leading slash doesn't matter)
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, "foo//bar/", NO_PARAMS).as_str()
    );

    // works with 1 segment
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["foo"], NO_PARAMS).as_str()
    );

    // works with 2 segments
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "bar"], NO_PARAMS).as_str()
    );

    // works with leading slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["/foo"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["/foo", "bar"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "/bar"], NO_PARAMS).as_str()
    );

    // works with trailing slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["foo/"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo/", "bar"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["foo", "bar/"], NO_PARAMS).as_str()
    );

    // works with both leading and trailing slash
    assert_eq!(
-        "http://foomp.com/foo",
+        "http://api.test/foo",
        sanitize_url(&base_url, &["/foo/"], NO_PARAMS).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar",
+        "http://api.test/foo/bar",
        sanitize_url(&base_url, &["/foo/", "/bar/"], NO_PARAMS).as_str()
    );

    // adds params
    assert_eq!(
-        "http://foomp.com/foo/bar?foomp=baz",
+        "http://api.test/foo/bar?foomp=baz",
        sanitize_url(&base_url, &["foo", "bar"], &[("foomp", "baz")]).as_str()
    );
    assert_eq!(
-        "http://foomp.com/foo/bar?arg1=val1&arg2=val2",
+        "http://api.test/foo/bar?arg1=val1&arg2=val2",
        sanitize_url(
            &base_url,
            &["/foo/", "/bar/"],
@@ -91,83 +91,87 @@ fn sanitizing_urls() {
 #[tokio::test]
 async fn api_client_retry() -> Result<(), Box<dyn std::error::Error>> {
    let client = ClientBuilder::new_with_urls(vec![
-        "http://broken.nym.badurl".parse()?,
-        "http://example.com/".parse()?,
-    ])
+        "http://broken.nym.test".parse()?,         // This will fail
+        "https://httpbin.org/status/200".parse()?, // This will succeed
+    ])?
    .with_retries(3)
    .build()?;

-    let req = client.create_get_request(&["/"], NO_PARAMS).unwrap();
+    let req = client.create_get_request(&[], NO_PARAMS).unwrap();
    let resp = client.send(req).await?;

-    assert_eq!(resp.status(), 200);
+    // The main test is that we successfully retried and switched to the working URL
+    // We accept any response from the working endpoint since external services can be unreliable
+    assert_eq!(
+        client.current_url().as_str(),
+        "https://httpbin.org/status/200"
+    );

-    // check that the url was updated
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    println!("Response status: {}", resp.status());

    Ok(())
 }

 #[test]
 fn host_updating() {
-    let url = Url::new("http://example.com", None).unwrap();
+    let url = Url::new("http://nym-api1.test", None).unwrap();
    let mut client = ClientBuilder::new(url).unwrap().build().unwrap();

    // check that the url is set correctly
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
+    assert_eq!(current_url.as_str(), "http://nym-api1.test/");
    assert_eq!(current_url.front_str(), None);

    // update the url
    client.update_host();

    // check that the url is still the same since there is one URL
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    // =======================================
    // we rotate through urls when available

    let new_urls = vec![
-        Url::new("http://example.com", None).unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api1.test", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    client.update_host();

    // check that the url got updated now that there are multiple URLs
-    assert_eq!(client.current_url().as_str(), "http://example.org/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api2.test/");
    assert_eq!(client.current_url().front_str(), None);

    client.update_host();
-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    // =======================================
    // we rotate through urls when available if fronting is disabled

    let new_urls = vec![
        Url::new(
-            "http://example.com",
-            Some(vec!["http://front1.com", "http://front2.com"]),
+            "http://nym-api1.test",
+            Some(vec!["http://cdn1.test", "http://cdn2.test"]),
        )
        .unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);

-    assert_eq!(client.current_url().as_str(), "http://example.com/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api1.test/");

    client.update_host();

    // check that the url got updated now that there are multiple URLs
-    assert_eq!(client.current_url().as_str(), "http://example.org/");
+    assert_eq!(client.current_url().as_str(), "http://nym-api2.test/");
 }

 #[test]
 #[cfg(feature = "tunneling")]
 fn fronted_host_updating() {
-    let url = Url::new("http://example.com", Some(vec!["http://front1.com"])).unwrap();
+    let url = Url::new("http://nym-api.test", Some(vec!["http://cdn1.test"])).unwrap();
    let mut client = ClientBuilder::new(url)
        .unwrap()
        .with_fronting(crate::fronted::FrontPolicy::Always)
@@ -176,46 +180,103 @@ fn fronted_host_updating() {

    // check that the url is set correctly
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // update the url
    client.update_host();

    // check that the url is still the same since there is one URL and one front
    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // =======================================
    // we rotate through front urls when available if fronting is enabled

    let new_urls = vec![
        Url::new(
-            "http://example.com",
-            Some(vec!["http://front1.com", "http://front2.com"]),
+            "http://nym-api.test",
+            Some(vec!["http://cdn1.test", "http://cdn2.test"]),
        )
        .unwrap(),
-        Url::new("http://example.org", None).unwrap(),
+        Url::new("http://nym-api2.test", None).unwrap(),
    ];
    client.change_base_urls(new_urls);

    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));

    // update the url - this should keep the same host but change the front
    client.update_host();

    let current_url = client.current_url();
    // check that the url is still the same since there is one URL
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front2.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn2.test"));

    // update the url - this should wrap around to the first front as the second url is not fronted
    client.update_host();

    let current_url = client.current_url();
-    assert_eq!(current_url.as_str(), "http://example.com/");
-    assert_eq!(current_url.front_str(), Some("front1.com"));
+    assert_eq!(current_url.as_str(), "http://nym-api.test/");
+    assert_eq!(current_url.front_str(), Some("cdn1.test"));
+}
+
+#[test]
+#[cfg(feature = "network-defaults")]
+fn from_network_configures_multiple_urls_and_retries() {
+    use nym_network_defaults::{ApiUrl, NymNetworkDetails};
+
+    // Create network details with multiple URLs and fronting
+    let mut network_details = NymNetworkDetails::new_empty();
+    network_details.nym_api_urls = Some(vec![
+        ApiUrl {
+            url: "https://validator.nymtech.net/api/".to_string(),
+            front_hosts: None,
+        },
+        ApiUrl {
+            url: "https://nym-frontdoor.vercel.app/api/".to_string(),
+            front_hosts: Some(vec!["vercel.app".to_string(), "vercel.com".to_string()]),
+        },
+        ApiUrl {
+            url: "https://nym-frontdoor.global.ssl.fastly.net/api/".to_string(),
+            front_hosts: Some(vec!["yelp.global.ssl.fastly.net".to_string()]),
+        },
+    ]);
+
+    // Build client from network details
+    let client = ClientBuilder::new_with_fronted_urls(
+        network_details.nym_api_urls.clone().unwrap_or_default(),
+    )
+    .expect("Failed to create client from network")
+    .build()
+    .expect("Failed to build client");
+
+    // Verify all URLs were configured
+    assert_eq!(
+        client.base_urls().len(),
+        3,
+        "Expected 3 URLs to be configured from network details"
+    );
+
+    // Verify the URLs have fronting configured where appropriate
+    assert_eq!(
+        client.base_urls()[0].as_str(),
+        "https://validator.nymtech.net/api/"
+    );
+    assert!(client.base_urls()[0].front_str().is_none());
+
+    assert_eq!(
+        client.base_urls()[1].as_str(),
+        "https://nym-frontdoor.vercel.app/api/"
+    );
+    assert!(client.base_urls()[1].front_str().is_some());
+
+    assert_eq!(
+        client.base_urls()[2].as_str(),
+        "https://nym-frontdoor.global.ssl.fastly.net/api/"
+    );
+    assert!(client.base_urls()[2].front_str().is_some());
 }
@@ -183,6 +183,11 @@ impl Url {
        })
    }

+    /// Returns the underlying URL
+    pub fn inner_url(&self) -> &url::Url {
+        &self.url
+    }
+
    /// Returns true if the URL has a front domain set
    pub fn has_front(&self) -> bool {
        if let Some(fronts) = &self.fronts {
@@ -201,6 +206,11 @@ impl Url {
            .and_then(|url| url.host_str())
    }

+    /// Returns the fronts
+    pub fn fronts(&self) -> Option<&[url::Url]> {
+        self.fronts.as_deref()
+    }
+
    /// Return the string representation of the host (domain or IP address) for this URL, if any.
    pub fn host_str(&self) -> Option<&str> {
        self.url.host_str()
@@ -124,6 +124,8 @@ impl NymNetworkDetails {
            }
        }

+        let nym_api = var(var_names::NYM_API).expect("nym api not set");
+
        NymNetworkDetails::new_empty()
            .with_network_name(var(var_names::NETWORK_NAME).expect("network name not set"))
            .with_bech32_account_prefix(
@@ -149,7 +151,7 @@ impl NymNetworkDetails {
            })
            .with_additional_validator_endpoint(ValidatorDetails::new(
                var(var_names::NYXD).expect("nyxd validator not set"),
-                Some(var(var_names::NYM_API).expect("nym api not set")),
+                Some(nym_api.clone()),
                get_optional_env(var_names::NYXD_WEBSOCKET),
            ))
            .with_mixnet_contract(get_optional_env(var_names::MIXNET_CONTRACT_ADDRESS))
@@ -159,6 +161,10 @@ impl NymNetworkDetails {
            .with_multisig_contract(get_optional_env(var_names::MULTISIG_CONTRACT_ADDRESS))
            .with_coconut_dkg_contract(get_optional_env(var_names::COCONUT_DKG_CONTRACT_ADDRESS))
            .with_nym_vpn_api_url(get_optional_env(var_names::NYM_VPN_API))
+            .with_nym_api_urls(Some(vec![ApiUrl {
+                url: nym_api,
+                front_hosts: None,
+            }]))
    }

    pub fn new_mainnet() -> Self {
@@ -348,6 +354,12 @@ impl NymNetworkDetails {
        self
    }

+    #[must_use]
+    pub fn with_nym_api_urls(mut self, urls: Option<Vec<ApiUrl>>) -> Self {
+        self.nym_api_urls = urls;
+        self
+    }
+
    pub fn nym_vpn_api_url(&self) -> Option<Url> {
        self.nym_vpn_api_url.as_ref().map(|url| {
            url.parse()
@@ -24,6 +24,6 @@ pub use crate::runtime_registry::RegistryAccessError;

 /// Get or create a ShutdownTracker for SDK use.
 /// This provides automatic task management without requiring manual setup.
-pub fn create_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
-    Ok(runtime_registry::RuntimeRegistry::create_sdk()?.shutdown_tracker_owned())
+pub fn get_sdk_shutdown_tracker() -> Result<ShutdownTracker, RegistryAccessError> {
+    Ok(runtime_registry::RuntimeRegistry::get_or_create_sdk()?.shutdown_tracker_owned())
 }
@@ -19,45 +19,30 @@ pub(crate) struct RuntimeRegistry {
 pub enum RegistryAccessError {
    #[error("the runtime registry is poisoned")]
    Poisoned,
-
-    #[error("The SDK ShutdownManager already exists")]
-    ExistingShutdownManager,
-
-    #[error("No existing SDK ShutdownManager")]
-    MissingShutdownManager,
 }

 impl RuntimeRegistry {
-    /// Create a ShutdownManager for SDK use.
+    /// Get or create a ShutdownManager for SDK use.
    /// This manager doesn't listen to OS signals, making it suitable for library use.
-    /// This function overwrite any existing manager!
-    pub(crate) fn create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
-        let mut guard = REGISTRY
-            .sdk_manager
-            .write()
-            .map_err(|_| RegistryAccessError::Poisoned)?;
-
-        Ok(guard
-            .insert(Arc::new(
-                ShutdownManager::new_without_signals().with_cancel_on_panic(),
-            ))
-            .clone())
-    }
-
-    /// Get the  ShutdownManager for SDK use.
-    /// This manager doesn't listen to OS signals, making it suitable for library use.
-    /// Not yet used, but maybe in the future
-    #[allow(dead_code)]
-    pub(crate) fn get_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
+    pub(crate) fn get_or_create_sdk() -> Result<Arc<ShutdownManager>, RegistryAccessError> {
        let guard = REGISTRY
            .sdk_manager
            .read()
            .map_err(|_| RegistryAccessError::Poisoned)?;
        if let Some(manager) = guard.as_ref() {
-            Ok(manager.clone())
-        } else {
-            Err(RegistryAccessError::MissingShutdownManager)
+            return Ok(manager.clone());
        }
+        drop(guard);
+
+        let mut guard = REGISTRY
+            .sdk_manager
+            .write()
+            .map_err(|_| RegistryAccessError::Poisoned)?;
+        Ok(guard
+            .get_or_insert_with(|| {
+                Arc::new(ShutdownManager::new_without_signals().with_cancel_on_panic())
+            })
+            .clone())
    }

    /// Check if an SDK manager has been created.
@@ -100,13 +85,10 @@ mod tests {

        assert!(!RuntimeRegistry::has_sdk_manager().unwrap());

-        // Error if nothing was created
-        assert!(RuntimeRegistry::get_sdk().is_err());
-
-        let manager1 = RuntimeRegistry::create_sdk().unwrap();
+        let manager1 = RuntimeRegistry::get_or_create_sdk().unwrap();
        assert!(RuntimeRegistry::has_sdk_manager().unwrap());

-        let manager2 = RuntimeRegistry::get_sdk().unwrap();
+        let manager2 = RuntimeRegistry::get_or_create_sdk().unwrap();
        // Should return the same instance
        assert!(Arc::ptr_eq(&manager1, &manager2));

@@ -23,6 +23,7 @@ use nym_topology::{EpochRewardedSet, NymTopology, RoutingNode};
 use nym_validator_client::client::IdentityKey;
 use nym_validator_client::{nym_api::NymApiClientExt, UserAgent};
 use rand::thread_rng;
+use std::time::Duration;
 use url::Url;
 use wasm_bindgen::prelude::wasm_bindgen;
 use wasm_bindgen_futures::future_to_promise;
@@ -127,6 +128,7 @@ pub async fn setup_gateway_wasm(
    force_tls: bool,
    chosen_gateway: Option<IdentityKey>,
    gateways: Vec<RoutingNode>,
+    connect_timeout: Option<Duration>,
 ) -> Result<InitialisationResult, WasmCoreError> {
    // TODO: so much optimization and extra features could be added here, but that's for the future

@@ -144,6 +146,7 @@ pub async fn setup_gateway_wasm(
        GatewaySetup::New {
            specification: selection_spec,
            available_gateways: gateways,
+            connect_timeout,
        }
    };

@@ -159,17 +162,24 @@ pub async fn setup_gateway_from_api(
    nym_apis: &[Url],
    minimum_performance: u8,
    ignore_epoch_roles: bool,
+    connect_timeout: Option<Duration>,
 ) -> Result<InitialisationResult, WasmCoreError> {
-    let mut rng = thread_rng();
    let gateways = gateways_for_init(
-        &mut rng,
        nym_apis,
        None,
        minimum_performance,
        ignore_epoch_roles,
+        None,
    )
    .await?;
-    setup_gateway_wasm(client_store, force_tls, chosen_gateway, gateways).await
+    setup_gateway_wasm(
+        client_store,
+        force_tls,
+        chosen_gateway,
+        gateways,
+        connect_timeout,
+    )
+    .await
 }

 pub async fn current_gateways_wasm(
@@ -178,13 +188,12 @@ pub async fn current_gateways_wasm(
    minimum_performance: u8,
    ignore_epoch_roles: bool,
 ) -> Result<Vec<RoutingNode>, ClientCoreError> {
-    let mut rng = thread_rng();
    gateways_for_init(
-        &mut rng,
        nym_apis,
        user_agent,
        minimum_performance,
        ignore_epoch_roles,
+        None,
    )
    .await
 }
@@ -194,9 +203,17 @@ pub async fn setup_from_topology(
    force_tls: bool,
    topology: &NymTopology,
    client_store: &ClientStorage,
+    connect_timeout: Option<Duration>,
 ) -> Result<InitialisationResult, WasmCoreError> {
    let gateways = topology.entry_capable_nodes().cloned().collect::<Vec<_>>();
-    setup_gateway_wasm(client_store, force_tls, explicit_gateway, gateways).await
+    setup_gateway_wasm(
+        client_store,
+        force_tls,
+        explicit_gateway,
+        gateways,
+        connect_timeout,
+    )
+    .await
 }

 pub async fn generate_new_client_keys(store: &ClientStorage) -> Result<(), WasmCoreError> {
@@ -215,6 +232,7 @@ pub async fn add_gateway(
    min_performance: u8,
    ignore_epoch_roles: bool,
    storage: &ClientStorage,
+    connect_timeout: Option<Duration>,
 ) -> Result<(), WasmCoreError> {
    let selection_spec = GatewaySelectionSpecification::new(
        preferred_gateway.clone(),
@@ -269,6 +287,7 @@ pub async fn add_gateway(
    let gateway_setup = GatewaySetup::New {
        specification: selection_spec,
        available_gateways,
+        connect_timeout,
    };

    let init_details = setup_gateway(gateway_setup, storage, storage).await?;
@@ -9,6 +9,7 @@ use crate::epoch_state::storage::{load_current_epoch, save_epoch};
 use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
 use crate::state::storage::STATE;
+use crate::verification_key_shares::storage::vk_shares;
 use crate::Dealer;
 use cosmwasm_std::{Deps, DepsMut, Env, Event, MessageInfo, Response};
 use nym_coconut_dkg_common::dealer::{DealerRegistrationDetails, OwnershipTransfer};
@@ -109,7 +110,7 @@ pub fn try_transfer_ownership(
    DEALERS_INDICES.save(deps.storage, &transfer_to, &current_index)?;
    DEALERS_INDICES.remove(deps.storage, &info.sender);

-    // update registration detail for every epoch the current dealer has participated in the protocol
+    // update registration detail and share information for every epoch the current dealer has participated in the protocol
    // ideally, we'd have only updated the current epoch, but the way the contract is constructed
    // forbids that otherwise we'd have introduced inconsistency
    for epoch_id in 0..=epoch.epoch_id {
@@ -117,6 +118,11 @@ pub fn try_transfer_ownership(
            EPOCH_DEALERS_MAP.remove(deps.storage, (epoch_id, &info.sender));
            EPOCH_DEALERS_MAP.save(deps.storage, (epoch_id, &transfer_to), &details)?;
        }
+        if let Some(mut vk_share) = vk_shares().may_load(deps.storage, (&info.sender, epoch_id))? {
+            vk_shares().remove(deps.storage, (&info.sender, epoch_id))?;
+            vk_share.owner = transfer_to.clone();
+            vk_shares().save(deps.storage, (&transfer_to, epoch_id), &vk_share)?;
+        }
    }

    let Some(transaction_info) = env.transaction else {
@@ -161,6 +167,14 @@ pub fn try_update_announce_address(
    details.announce_address = new_address.clone();
    EPOCH_DEALERS_MAP.save(deps.storage, (epoch.epoch_id, &info.sender), &details)?;

+    let mut contract_share = vk_shares().load(deps.storage, (&info.sender, epoch.epoch_id))?;
+    contract_share.announce_address = new_address.clone();
+    vk_shares().save(
+        deps.storage,
+        (&info.sender, epoch.epoch_id),
+        &contract_share,
+    )?;
+
    Ok(Response::new().add_event(
        Event::new("dkg-announce-address-update")
            .add_attribute("dealer", info.sender)
@@ -228,9 +242,14 @@ pub(crate) mod tests {
 #[cfg(feature = "testable-dkg-contract")]
 mod tests_with_mock {
    use super::*;
-    use crate::testable_dkg_contract::{init_contract_tester, DkgContractTesterExt};
+    use crate::testable_dkg_contract::{
+        init_contract_tester, init_contract_tester_with_group_members, DkgContractTesterExt,
+    };
+    use anyhow::Context;
    use cosmwasm_std::testing::message_info;
-    use nym_contracts_common_testing::ContractOpts;
+    use nym_coconut_dkg_common::msg::QueryMsg;
+    use nym_coconut_dkg_common::verification_key::PagedVKSharesResponse;
+    use nym_contracts_common_testing::{ChainOpts, ContractOpts};

    #[test]
    fn transferring_ownership() -> anyhow::Result<()> {
@@ -248,6 +267,7 @@ mod tests_with_mock {
        contract.run_initial_dummy_dkg();
        let old_index = DEALERS_INDICES.load(&contract, &group_member)?;
        let old_details = EPOCH_DEALERS_MAP.load(&contract, (0, &group_member))?;
+        let old_share = vk_shares().load(&contract, (&group_member, 0))?;

        let not_group_member = contract.addr_make("not_group_member");
        let (deps, env) = contract.deps_mut_env();
@@ -277,13 +297,20 @@ mod tests_with_mock {
        assert!(EPOCH_DEALERS_MAP
            .may_load(&contract, (0, &group_member))?
            .is_none());
+        assert!(vk_shares()
+            .may_load(&contract, (&group_member, 0))?
+            .is_none());

        let new_index = DEALERS_INDICES.load(&contract, &new_group_member)?;
        let new_details = EPOCH_DEALERS_MAP.load(&contract, (0, &new_group_member))?;
+        let new_share = vk_shares().load(&contract, (&new_group_member, 0))?;

        // the underlying info hasn't changed
        assert_eq!(old_index, new_index);
        assert_eq!(old_details, new_details);
+        assert_ne!(old_share, new_share);
+        assert_eq!(old_share.owner, group_member);
+        assert_eq!(new_share.owner, new_group_member);

        assert_eq!(
            OWNERSHIP_TRANSFER_LOG.load(
@@ -436,9 +463,91 @@ mod tests_with_mock {
        assert_eq!(old_details1, new_details1);
        assert_eq!(old_details2, new_details2);

-        // most  recent entry is updated
+        // most recent entry is updated
        assert_eq!(new_details3.announce_address, new_address);

        Ok(())
    }
+
+    #[test]
+    fn updating_announce_address_updates_vk_shares() -> anyhow::Result<()> {
+        let mut contract = init_contract_tester_with_group_members(3);
+        let group_member = contract.random_group_member();
+
+        contract.run_initial_dummy_dkg(); // => epoch 0
+        contract.run_reset_dkg(); // => epoch 1
+
+        // LEAVE DKG MEMBERSHIP
+        contract.remove_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 2
+
+        // COME BACK
+        contract.add_group_member(group_member.clone());
+        contract.run_reset_dkg(); // => epoch 3
+
+        let old_address = EPOCH_DEALERS_MAP
+            .load(&contract, (3, &group_member))?
+            .announce_address;
+
+        let old_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let old_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let old_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(old_share2.is_none());
+        let old_share3 = vk_shares().may_load(&contract, (&group_member, 3))?;
+        assert!(old_share3.is_some());
+
+        let new_address = "https://new-address.com".to_string();
+        try_update_announce_address(
+            contract.deps_mut(),
+            message_info(&group_member, &[]),
+            new_address.clone(),
+        )?;
+
+        let new_share0 = vk_shares().load(&contract, (&group_member, 0))?;
+        let new_share1 = vk_shares().load(&contract, (&group_member, 1))?;
+        let new_share2 = vk_shares().may_load(&contract, (&group_member, 2))?;
+        assert!(new_share2.is_none());
+        let new_share3 = vk_shares().load(&contract, (&group_member, 3))?;
+
+        // old epoch data is unchanged
+        assert_eq!(old_share0, new_share0);
+        assert_eq!(old_share1, new_share1);
+        assert_eq!(old_share2, new_share2);
+
+        // most recent entry is updated
+        assert_eq!(new_share3.announce_address, new_address);
+
+        // finally an integration check against query endpoint
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 0,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, old_address);
+
+        let epoch0_shares: PagedVKSharesResponse =
+            contract.query(&QueryMsg::GetVerificationKeys {
+                epoch_id: 3,
+                limit: None,
+                start_after: None,
+            })?;
+        assert_eq!(epoch0_shares.shares.len(), 3);
+
+        let member_share = epoch0_shares
+            .shares
+            .iter()
+            .find(|s| s.owner == group_member)
+            .context("failed to find member's share")?;
+        assert_eq!(member_share.announce_address, new_address);
+
+        Ok(())
+    }
 }
@@ -62,12 +62,18 @@ impl TestableNymContract for DkgContract {
    where
        Self: Sized,
    {
-        init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+        init_contract_tester()
    }
 }

 pub fn init_contract_tester() -> ContractTester<DkgContract> {
-    DkgContract::init().with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
+    init_contract_tester_with_group_members(DEFAULT_GROUP_MEMBERS)
+}
+
+pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
+    prepare_contract_tester_builder_with_group_members(members)
+        .build()
+        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
 }

 pub fn prepare_contract_tester_builder_with_group_members<C>(
@@ -137,12 +143,6 @@ where
    builder
 }

-pub fn init_contract_tester_with_group_members(members: usize) -> ContractTester<DkgContract> {
-    prepare_contract_tester_builder_with_group_members(members)
-        .build()
-        .with_common_storage_key(CommonStorageKeys::Admin, "dkg-admin")
-}
-
 pub trait DkgContractTesterExt:
    ContractOpts<ExecuteMsg = ExecuteMsg, QueryMsg = QueryMsg, ContractError = ContractError>
    + ChainOpts
@@ -1,12 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn legacy_mixnode_bonding() {
-        todo!()
-    }
-}
@@ -2,7 +2,3 @@
 // SPDX-License-Identifier: Apache-2.0

 pub(crate) mod transactions;
-
-// the purpose of that module is to keep track of tests of legacy features that will eventually be phased out
-// such as standalone mixnode/gateway bonding
-pub(crate) mod legacy;
@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.68"
+version = "1.1.67"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -190,6 +190,7 @@ impl PacketSender {
            ),
            #[cfg(unix)]
            None,
+            None,
            fresh_gateway_client_data.shutdown_token.clone(),
        );

@@ -1,17 +1,21 @@
 # this will only work with VPN, otherwise remove the harbor part
 FROM harbor.nymte.ch/dockerhub/rust:latest AS builder

+ARG GIT_REF=main
+
 RUN apt update && apt install -yy libdbus-1-dev pkg-config libclang-dev

 # Install go
 RUN wget https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O go.tar.gz
 RUN tar -xzvf go.tar.gz -C /usr/local
-ENV PATH=/go/bin:/usr/local/go/bin:$PATH

-COPY ./ /usr/src/nym
-WORKDIR /usr/src/nym
+RUN git clone https://github.com/nymtech/nym-vpn-client /usr/src/nym-vpn-client
+RUN cd /usr/src/nym-vpn-client && git checkout $GIT_REF
+ENV PATH=/go/bin:/usr/local/go/bin:$PATH
+WORKDIR /usr/src/nym-vpn-client/nym-vpn-core
 RUN cargo build --release --package nym-gateway-probe

+COPY ./ /usr/src/nym
 WORKDIR /usr/src/nym/nym-node-status-api/nym-node-status-agent
 RUN cargo build --release

@@ -31,7 +35,7 @@ RUN apt-get update && apt-get install -y ca-certificates
 WORKDIR /nym

 COPY --from=builder /usr/src/nym/target/release/nym-node-status-agent ./
-COPY --from=builder /usr/src/nym/target/release/nym-gateway-probe ./
+COPY --from=builder /usr/src/nym-vpn-client/nym-vpn-core/target/release/nym-gateway-probe ./
 COPY --from=builder /usr/src/nym/nym-node-status-api/nym-node-status-agent/entrypoint.sh ./
 RUN chmod +x /nym/entrypoint.sh

@@ -57,7 +57,7 @@ async fn run(
        .clone()
        .expect("rust sdk mainnet default missing api_url");

-    let nym_api = nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])
+    let nym_api = nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])?
        .no_hickory_dns()
        .with_timeout(nym_api_client_timeout)
        .build()?;
@@ -98,7 +98,7 @@ impl Monitor {
            .expect("rust sdk mainnet default missing api_url");

        let nym_api =
-            nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])
+            nym_http_api_client::ClientBuilder::new_with_urls(vec![default_api_url.into()])?
                .no_hickory_dns()
                .with_timeout(self.nym_api_client_timeout)
                .build()?;
@@ -3,7 +3,7 @@

 [package]
 name = "nym-node"
-version = "1.20.0"
+version = "1.19.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -38,6 +38,7 @@ pub struct BuilderConfig {
    pub cancel_token: CancellationToken,
    #[cfg(unix)]
    pub connection_fd_callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+    pub connect_timeout: Option<Duration>,
 }

 #[derive(Clone, Default, Debug, Eq, PartialEq)]
@@ -56,6 +57,55 @@ pub struct MixnetClientConfig {
 }

 impl BuilderConfig {
+    /// Creates a new BuilderConfig with all required parameters.
+    ///
+    /// However, consider using `BuilderConfig::builder()` instead.
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        entry_node: NymNodeWithKeys,
+        exit_node: NymNodeWithKeys,
+        data_path: Option<PathBuf>,
+        mixnet_client_config: MixnetClientConfig,
+        two_hops: bool,
+        user_agent: UserAgent,
+        custom_topology_provider: Box<dyn TopologyProvider + Send + Sync>,
+        network_env: NymNetworkDetails,
+        cancel_token: CancellationToken,
+        #[cfg(unix)] connection_fd_callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+        connect_timeout: Option<Duration>,
+    ) -> Self {
+        Self {
+            entry_node,
+            exit_node,
+            data_path,
+            mixnet_client_config,
+            two_hops,
+            user_agent,
+            custom_topology_provider,
+            network_env,
+            cancel_token,
+            #[cfg(unix)]
+            connection_fd_callback,
+            connect_timeout,
+        }
+    }
+
+    /// Creates a builder for BuilderConfig
+    ///
+    /// This is the preferred way to construct a BuilderConfig.
+    ///
+    /// # Example
+    /// ```ignore
+    /// let config = BuilderConfig::builder()
+    ///     .entry_node(entry)
+    ///     .exit_node(exit)
+    ///     .user_agent(agent)
+    ///     .build()?;
+    /// ```
+    pub fn builder() -> BuilderConfigBuilder {
+        BuilderConfigBuilder::default()
+    }
+
    pub fn mixnet_client_debug_config(&self) -> DebugConfig {
        if self.two_hops {
            two_hop_debug_config(&self.mixnet_client_config)
@@ -116,6 +166,7 @@ impl BuilderConfig {
            .credentials_mode(true)
            .with_remember_me(remember_me)
            .custom_topology_provider(self.custom_topology_provider);
+
        #[cfg(unix)]
        let builder = builder.with_connection_fd_callback(self.connection_fd_callback);

@@ -205,3 +256,212 @@ fn log_mixnet_client_config(debug_config: &DebugConfig) {
 fn true_to_disabled(val: bool) -> &'static str {
    if val { "disabled" } else { "enabled" }
 }
+
+/// Error type for BuilderConfig validation
+#[derive(Debug, Clone, thiserror::Error)]
+#[allow(clippy::enum_variant_names)]
+pub enum BuilderConfigError {
+    #[error("entry_node is required")]
+    MissingEntryNode,
+    #[error("exit_node is required")]
+    MissingExitNode,
+    #[error("mixnet_client_config is required")]
+    MissingMixnetClientConfig,
+    #[error("user_agent is required")]
+    MissingUserAgent,
+    #[error("custom_topology_provider is required")]
+    MissingTopologyProvider,
+    #[error("network_env is required")]
+    MissingNetworkEnv,
+    #[error("cancel_token is required")]
+    MissingCancelToken,
+    #[cfg(unix)]
+    #[error("connection_fd_callback is required")]
+    MissingConnectionFdCallback,
+}
+
+/// Builder for `BuilderConfig`
+///
+/// This provides a more convenient way to construct a `BuilderConfig` compared to the
+/// `new()` constructor with many arguments.
+#[derive(Default)]
+pub struct BuilderConfigBuilder {
+    entry_node: Option<NymNodeWithKeys>,
+    exit_node: Option<NymNodeWithKeys>,
+    data_path: Option<PathBuf>,
+    mixnet_client_config: Option<MixnetClientConfig>,
+    two_hops: bool,
+    user_agent: Option<UserAgent>,
+    custom_topology_provider: Option<Box<dyn TopologyProvider + Send + Sync>>,
+    network_env: Option<NymNetworkDetails>,
+    cancel_token: Option<CancellationToken>,
+    #[cfg(unix)]
+    connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+    connect_timeout: Option<Duration>,
+}
+
+impl BuilderConfigBuilder {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn entry_node(mut self, entry_node: NymNodeWithKeys) -> Self {
+        self.entry_node = Some(entry_node);
+        self
+    }
+
+    pub fn exit_node(mut self, exit_node: NymNodeWithKeys) -> Self {
+        self.exit_node = Some(exit_node);
+        self
+    }
+
+    pub fn data_path(mut self, data_path: Option<PathBuf>) -> Self {
+        self.data_path = data_path;
+        self
+    }
+
+    pub fn mixnet_client_config(mut self, mixnet_client_config: MixnetClientConfig) -> Self {
+        self.mixnet_client_config = Some(mixnet_client_config);
+        self
+    }
+
+    pub fn two_hops(mut self, two_hops: bool) -> Self {
+        self.two_hops = two_hops;
+        self
+    }
+
+    pub fn user_agent(mut self, user_agent: UserAgent) -> Self {
+        self.user_agent = Some(user_agent);
+        self
+    }
+
+    pub fn custom_topology_provider(
+        mut self,
+        custom_topology_provider: Box<dyn TopologyProvider + Send + Sync>,
+    ) -> Self {
+        self.custom_topology_provider = Some(custom_topology_provider);
+        self
+    }
+
+    pub fn network_env(mut self, network_env: NymNetworkDetails) -> Self {
+        self.network_env = Some(network_env);
+        self
+    }
+
+    pub fn cancel_token(mut self, cancel_token: CancellationToken) -> Self {
+        self.cancel_token = Some(cancel_token);
+        self
+    }
+
+    #[cfg(unix)]
+    pub fn connection_fd_callback(
+        mut self,
+        connection_fd_callback: Arc<dyn Fn(RawFd) + Send + Sync>,
+    ) -> Self {
+        self.connection_fd_callback = Some(connection_fd_callback);
+        self
+    }
+
+    pub fn with_connect_timeout(mut self, connect_timeout: Duration) -> Self {
+        self.connect_timeout = Some(connect_timeout);
+        self
+    }
+
+    /// Builds the `BuilderConfig`.
+    ///
+    /// Returns an error if any required field is missing.
+    pub fn build(self) -> Result<BuilderConfig, BuilderConfigError> {
+        Ok(BuilderConfig {
+            entry_node: self
+                .entry_node
+                .ok_or(BuilderConfigError::MissingEntryNode)?,
+            exit_node: self.exit_node.ok_or(BuilderConfigError::MissingExitNode)?,
+            data_path: self.data_path,
+            mixnet_client_config: self
+                .mixnet_client_config
+                .ok_or(BuilderConfigError::MissingMixnetClientConfig)?,
+            two_hops: self.two_hops,
+            user_agent: self
+                .user_agent
+                .ok_or(BuilderConfigError::MissingUserAgent)?,
+            custom_topology_provider: self
+                .custom_topology_provider
+                .ok_or(BuilderConfigError::MissingTopologyProvider)?,
+            network_env: self
+                .network_env
+                .ok_or(BuilderConfigError::MissingNetworkEnv)?,
+            cancel_token: self
+                .cancel_token
+                .ok_or(BuilderConfigError::MissingCancelToken)?,
+            #[cfg(unix)]
+            connection_fd_callback: self
+                .connection_fd_callback
+                .ok_or(BuilderConfigError::MissingConnectionFdCallback)?,
+            connect_timeout: self.connect_timeout,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_mixnet_client_config_default_values() {
+        let config = MixnetClientConfig::default();
+        assert!(!config.disable_poisson_rate);
+        assert!(!config.disable_background_cover_traffic);
+        assert_eq!(config.min_mixnode_performance, None);
+        assert_eq!(config.min_gateway_performance, None);
+    }
+
+    #[test]
+    fn test_builder_config_builder_fails_without_required_fields() {
+        // Building without any fields should fail with specific error
+        let result = BuilderConfig::builder().build();
+        assert!(result.is_err());
+        match result {
+            Err(BuilderConfigError::MissingEntryNode) => (), // Expected
+            Err(e) => panic!("Expected MissingEntryNode, got: {}", e),
+            Ok(_) => panic!("Expected error, got Ok"),
+        }
+    }
+
+    #[test]
+    fn test_builder_config_builder_validates_all_required_fields() {
+        // Test that each required field is validated
+        let result = BuilderConfig::builder().build();
+        assert!(result.is_err());
+
+        // Short-circuits at first missing field, so we just verify it's one of the expected errors
+        #[allow(unreachable_patterns)] // All variants are covered, but keeping catch-all for safety
+        match result {
+            Err(BuilderConfigError::MissingEntryNode)
+            | Err(BuilderConfigError::MissingExitNode)
+            | Err(BuilderConfigError::MissingMixnetClientConfig)
+            | Err(BuilderConfigError::MissingUserAgent)
+            | Err(BuilderConfigError::MissingTopologyProvider)
+            | Err(BuilderConfigError::MissingNetworkEnv)
+            | Err(BuilderConfigError::MissingCancelToken) => (),
+            #[cfg(unix)]
+            Err(BuilderConfigError::MissingConnectionFdCallback) => (),
+            Err(e) => panic!("Unexpected error: {}", e),
+            Ok(_) => panic!("Expected validation error, got Ok"),
+        }
+    }
+
+    #[test]
+    fn test_builder_config_builder_method_chaining() {
+        // Test that builder methods chain properly and return Self
+        let builder = BuilderConfig::builder();
+
+        // Verify the builder returns itself for chaining
+        let builder = builder.two_hops(true);
+        let builder = builder.two_hops(false);
+        let builder = builder.data_path(None);
+
+        // Builder should still fail because required fields are missing
+        let result = builder.build();
+        assert!(result.is_err());
+    }
+}
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4

 [[package]]
 name = "NymWallet"
@@ -773,7 +773,7 @@ dependencies = [
 [[package]]
 name = "bls12_381"
 version = "0.8.0"
-source = "git+https://github.com/jstuczyn/bls12_381?branch=temp/experimental-serdect-updated#9bf520059cb28323fc51469cae86868ef4fa6fbd"
+source = "git+https://github.com/jstuczyn/bls12_381?branch=temp%2Fexperimental-serdect-updated#9bf520059cb28323fc51469cae86868ef4fa6fbd"
 dependencies = [
 "digest 0.10.7",
 "ff",
@@ -1723,15 +1723,6 @@ dependencies = [
 "dirs-sys 0.3.7",
 ]

-[[package]]
-name = "dirs"
-version = "5.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
-dependencies = [
- "dirs-sys 0.4.1",
-]
-
 [[package]]
 name = "dirs"
 version = "6.0.0"
@@ -1752,18 +1743,6 @@ dependencies = [
 "winapi",
 ]

-[[package]]
-name = "dirs-sys"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users 0.4.6",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "dirs-sys"
 version = "0.5.0"
@@ -4100,7 +4079,7 @@ dependencies = [
 name = "nym-config"
 version = "0.1.0"
 dependencies = [
- "dirs 5.0.1",
+ "dirs 6.0.0",
 "handlebars",
 "log",
 "nym-network-defaults",
@@ -38,6 +38,7 @@ use std::path::Path;
 use std::path::PathBuf;
 #[cfg(unix)]
 use std::sync::Arc;
+use std::time::Duration;
 use url::Url;
 use zeroize::Zeroizing;

@@ -405,6 +406,9 @@ where
    #[cfg(unix)]
    connection_fd_callback: Option<Arc<dyn Fn(std::os::fd::RawFd) + Send + Sync>>,

+    /// Timeout for establishing a connection
+    connect_timeout: Option<Duration>,
+
    forget_me: ForgetMe,

    remember_me: RememberMe,
@@ -466,6 +470,7 @@ where
            user_agent: None,
            #[cfg(unix)]
            connection_fd_callback: None,
+            connect_timeout: None,
            forget_me,
            remember_me,
            derivation_material: None,
@@ -555,21 +560,22 @@ where
    async fn available_gateways(&mut self) -> Result<Vec<RoutingNode>, ClientCoreError> {
        if let Some(ref mut custom_provider) = self.custom_topology_provider {
            if let Some(topology) = custom_provider.get_new_topology().await {
-                return Ok(topology.entry_gateways().cloned().collect());
+                // Use entry_capable_nodes() instead of entry_gateways() to include
+                // all entry-capable nodes, not just actively assigned ones
+                return Ok(topology.entry_capable_nodes().cloned().collect());
            }
        }

        let nym_api_endpoints = self.get_api_endpoints();
        let topology_cfg = &self.config.debug_config.topology;
        let user_agent = self.user_agent.clone();
-        let mut rng = OsRng;

        gateways_for_init(
-            &mut rng,
            &nym_api_endpoints,
            user_agent,
            topology_cfg.minimum_gateway_performance,
            topology_cfg.ignore_ingress_epoch_role,
+            None,
        )
        .await
    }
@@ -588,6 +594,7 @@ where
            available_gateways,
            #[cfg(unix)]
            connection_fd_callback: self.connection_fd_callback.clone(),
+            connect_timeout: self.connect_timeout,
        })
    }

@@ -705,6 +712,16 @@ where
            .config
            .as_base_client_config(nyxd_endpoints, nym_api_endpoints.clone());

+        tracing::debug!(
+            "SDK: Passing nym_api_urls to BaseClientBuilder (has {} nym_api_urls)",
+            self.config
+                .network_details
+                .nym_api_urls
+                .as_ref()
+                .map(|urls| urls.len())
+                .unwrap_or(0)
+        );
+
        let mut base_builder: BaseClientBuilder<_, _> =
            BaseClientBuilder::new(base_config, self.storage, self.dkg_query_client)
                .with_wait_for_gateway(self.wait_for_gateway)
@@ -712,6 +729,11 @@ where
                .with_remember_me(&self.remember_me)
                .with_derivation_material(self.derivation_material);

+        // Add nym_api_urls if available in network_details
+        if let Some(nym_api_urls) = self.config.network_details.nym_api_urls.clone() {
+            base_builder = base_builder.with_nym_api_urls(nym_api_urls);
+        }
+
        if let Some(user_agent) = self.user_agent {
            base_builder = base_builder.with_user_agent(user_agent);
        }
@@ -720,11 +742,15 @@ where
            base_builder = base_builder.with_topology_provider(topology_provider);
        }

-        // Use custom shutdown if provided, otherwise the sdk one will be used later down the line
-        if let Some(shutdown_tracker) = self.custom_shutdown {
-            base_builder = base_builder.with_shutdown(shutdown_tracker);
-        }
-
+        // Use custom shutdown if provided, otherwise get from registry
+        let shutdown_tracker = match self.custom_shutdown {
+            Some(custom) => custom,
+            None => {
+                // Auto-create from registry for SDK use
+                nym_task::get_sdk_shutdown_tracker()?
+            }
+        };
+        base_builder = base_builder.with_shutdown(shutdown_tracker);
        if let Some(event_tx) = self.event_tx {
            base_builder = base_builder.with_event_tx(event_tx);
        }
@@ -738,6 +764,10 @@ where
            base_builder = base_builder.with_connection_fd_callback(connection_fd_callback);
        }

+        if let Some(connect_timeout) = self.connect_timeout {
+            base_builder = base_builder.with_connect_timeout(connect_timeout);
+        }
+
        let started_client = base_builder.start_base().await?;
        self.state = BuilderState::Registered {};
        let nym_address = started_client.address;
@@ -789,7 +819,7 @@ where
            client_output,
            client_state.clone(),
            nym_address,
-            started_client.shutdown_handle.clone(),
+            started_client.shutdown_handle.child_tracker(),
            packet_type,
        );

@@ -876,3 +906,17 @@ impl IncludedSurbs {
        Self::ExposeSelfAddress
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_mixnet_builder_default_no_custom_client() {
+        let builder = MixnetClientBuilder::new_ephemeral();
+        assert!(
+            builder.build().is_ok(),
+            "Builder should succeed without custom client"
+        );
+    }
+}
@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.66"
+version = "1.1.65"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.85"
@@ -226,7 +226,8 @@ mod tests {
                error!("{err}");
                // this is not an ideal way of checking it, but if test fails due to networking failures
                // it should be fine to progress
-                if err.to_string().contains("nym api request failed") {
+                let err_str = err.to_string();
+                if err_str.contains("nym api") || err_str.contains("failed to connect") {
                    return Ok(());
                }
                return Err(err);
@@ -291,7 +292,8 @@ mod tests {
                error!("{err}");
                // this is not an ideal way of checking it, but if test fails due to networking failures
                // it should be fine to progress
-                if err.to_string().contains("nym api request failed") {
+                let err_str = err.to_string();
+                if err_str.contains("nym api") || err_str.contains("failed to connect") {
                    return Ok(());
                }
                return Err(err);
@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.65"
+version = "1.1.64"
 authors.workspace = true
 edition = "2021"
 license.workspace = true
@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.30"
+version = "0.1.29"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -222,6 +222,7 @@ impl NymClientBuilder {
                self.config.base.debug.topology.minimum_gateway_performance,
                self.config.base.debug.topology.ignore_ingress_epoch_role,
                &client_store,
+                None,
            )
            .await?;
        }
@@ -158,6 +158,7 @@ impl MixFetchClientBuilder {
                self.config.base.debug.topology.minimum_gateway_performance,
                self.config.base.debug.topology.ignore_ingress_epoch_role,
                &client_store,
+                None,
            )
            .await?;
        }
@@ -153,6 +153,7 @@ impl NymNodeTesterBuilder {
                false,
                &self.base_topology,
                client_store,
+                None,
            )
            .await?)
        }
@@ -211,6 +212,7 @@ impl NymNodeTesterBuilder {
                    packet_router,
                    self.bandwidth_controller.take(),
                    ClientStatsSender::new(None, stats_sender_task),
+                    None,
                    gateway_task,
                )
            };
Author	SHA1	Message	Date
Andrej Mihajlov	637d9a4ebf	ci: fix	2025-10-23 12:45:52 +02:00
Andrej Mihajlov	ecf6e849d9	Add connect_timeout to registration client	2025-10-22 15:41:26 +02:00
Andrej Mihajlov	6156e2656e	Add connect timeout	2025-10-22 15:21:12 +02:00
Jędrzej Stuczyński	bd2174641e	bugfix: update internal owner address in transferred share (#6139 )	2025-10-22 10:42:26 +01:00
Tommy Verrall	59b62fabc9	Merge pull request #6134 from nymtech/feature/domain-fronting-v2 Domain fronting	2025-10-22 11:08:21 +02:00
Tommy Verrall	e6f4bae895	Last failing test - fix	2025-10-21 19:34:20 +02:00
Tommy Verrall	d71742af32	Use explicit Vec<ApiUrl> handling in BaseClientBuilder - Replace NymNetworkDetails with explicit API URL handling - Fix deprecated from_network() usage and improve fallback logic - Add URL validation and remove unused backwards compatibility	2025-10-21 19:15:24 +02:00
Tommy Verrall	3b7c07e249	Actually commit the recommended changes	2025-10-21 18:12:38 +02:00
Tommy Verrall	3b429dde69	Fix broken tests in CI	2025-10-21 16:29:26 +02:00
Tommy Verrall	3a29c296da	Replace deprecated from_network() with new_with_fronted_urls()	2025-10-21 16:05:41 +02:00
Tommy Verrall	8544c54f8f	Merge develop into feature/domain-fronting-v2 - Use new_with_fronted_urls() for explicit domain fronting - Deprecate from_network() in favor of explicit method	2025-10-21 15:58:20 +02:00
Jędrzej Stuczyński	9f9639950b	feat: expose more explicit new_with_fronted_urls builder for http API client (#6136 )	2025-10-21 14:47:58 +01:00
Jędrzej Stuczyński	111a0b20b6	bugfix: update stored epoch share when changing ownership (#6135 )	2025-10-21 14:10:20 +01:00
Tommy Verrall	67b300d0b8	Fix new_from_env() to populate nym_api_urls for domain fronting	2025-10-21 12:22:51 +02:00
Jędrzej Stuczyński	88c4e0ce6c	bugfix: update stored epoch share when changing announce address (#6131 ) * bugfix: update stored epoch share when changing announce address * chore: remove placeholder legacy mixnode bonding test [mixnet contract]	2025-10-21 10:59:17 +01:00
Tommy Verrall	f6800aff0a	fix all clippy messages	2025-10-21 11:32:47 +02:00
Tommy Verrall	0c7c927ca2	Add more tests for retry logic	2025-10-21 11:32:47 +02:00
Tommy Verrall	a69c8b1660	Fix confusing tracing logs	2025-10-21 11:32:47 +02:00
Tommy Verrall	f3ea310a46	Fix retries - this is working	2025-10-21 11:32:46 +02:00
Tommy Verrall	92f9ff035d	Add configuration-based domain fronting support Changes: - Add network_details field to BaseClientBuilder (optional, backwards compatible) - Add with_network_details() method for opt-in domain fronting - Update construct_nym_api_client() to use from_network() when network_details provided - Enable network-defaults feature in nym-client-core Cargo.toml - SDK passes network_details to BaseClientBuilder	2025-10-21 11:32:46 +02:00
Tommy Verrall	5a817e1df1	Merge pull request #6126 from nymtech/multiple-fall-back-urls Changes: Multiple URL fallback with configurable retries (defaults to 3) Infallible URL conversion per Andrews feedback (Url::from() instead of parse().ok()) Non-breaking builder pattern for BuilderConfig per Andrej's "too many arguments" feedback Reverted redundant node filtering per Andrew's clarification that API already filters by supported_roles.entry	2025-10-21 11:27:37 +02:00
Tommy Verrall	a07a24db00	Fix CI issues	2025-10-21 11:01:04 +02:00
Tommy Verrall	a0cb812eff	Allow clippy::enum_variant_names for BuilderConfigError	2025-10-21 10:35:57 +02:00
Tommy Verrall	923c1fa184	Improve error handling Changes: - Replace String error with BuilderConfigError enum in BuilderConfigBuilder - Update tests to use pattern matching instead of string assertions	2025-10-20 16:57:31 +02:00
Tommy Verrall	35ea7e4926	- Add DEFAULT_NYM_API_RETRIES constant (replaces magic number 3) - Run cargo fmt on all affected packages - All clippy warnings resolved	2025-10-20 16:51:07 +02:00
Tommy Verrall	d1cb9afaf0	not sure what happened but it's fixed	2025-10-20 15:20:24 +02:00
Tommy Verrall	79d4b4b2e3	Merge branch 'develop' into multiple-fall-back-urls	2025-10-20 15:16:36 +02:00
Tommy Verrall	8460b33946	Merge branch 'multiple-fall-back-urls' of https://github.com/nymtech/nym into multiple-fall-back-urls	2025-10-20 15:16:17 +02:00
Tommy Verrall	ae6539e07c	Merge resolution	2025-10-20 15:14:48 +02:00
Tommy Verrall	18cebdfedc	Add accessor methods for Url internals Add inner_url() and fronts() accessor methods to nym_http_api_client::Url for VPN client integration	2025-10-20 14:33:57 +02:00
Tommy Verrall	c448ec823a	Remove tests for removed with_nym_api_client method These tests were referencing with_nym_api_client() which was removed when cleaning domain fronting code from this branch	2025-10-20 11:52:04 +02:00
Tommy Verrall	a266137278	Add optional builder pattern for BuilderConfig (non-breaking) Addresses @jstuczyn's feedback about too many arguments by adding BuilderConfigBuilder as an alternative to the existing new() method.	2025-10-20 11:39:50 +02:00
Tommy Verrall	6f4dfd1dab	fix conversion type && make the retry count configurable	2025-10-20 11:15:31 +02:00
Andy Duplain	57719787db	Merge pull request #6130 from nymtech/andy/url_fronts VPN-4262: Update `Url` to return `url` and `front` fields.	2025-10-17 15:44:08 +01:00
Andy Duplain	29a57bf172	VPN-4262: Update `Url` to return `url` and `front` fields. The VPN client is using the `Url` type alot now and in order to avoid double URL-parsing we would like the content of the `Url` type exposed.	2025-10-17 15:37:07 +01:00
Tommy Verrall	db813b6e3e	Revert node filtering changes per Andrew's feedback Andrew clarified that get_basic_entry_assigned_nodes_v2() already filters by supported_roles.entry	2025-10-17 15:18:28 +02:00
Tommy Verrall	1be5ba310a	Remove domain fronting code to keep gateway changes only This branch now contains only gateway registration improvements: - Multiple URL fallback support in gateways_for_init() - Get all entry-capable nodes for registration - Performance and code quality improvements	2025-10-17 14:27:31 +02:00
Tommy Verrall	41ff3f7824	Address PR feedback: simplify code and reduce log noise - Reverted all changes to topology_control/nym_api_provider.rs - Changed info/warn logs to debug for custom client messages - Removed unused _rng parameter from gateways_for_init() - Simplified URL builder to always use new_with_urls()	2025-10-17 14:20:12 +02:00
Tommy Verrall	c9d4d62446	Fix clippy warnings: use arrays instead of vec! in tests	2025-10-17 13:30:30 +02:00
Tommy Verrall	e839a0d80e	Merge develop into multiple-fall-back-urls Resolved conflicts: - Added event_tx field to MixnetClientBuilder alongside custom_nym_api_client - Both features are independent and coexist: * custom_nym_api_client: for domain fronting support * event_tx: for event handling - Updated all constructors and methods to properly handle both fields	2025-10-17 13:23:04 +02:00
Tommy Verrall	cd61f930bf	feat: pass custom HTTP client through SDK stack for domain fronting - Add with_nym_api_client() to BaseClientBuilder, MixnetClientBuilder, and RegistrationClientBuilderConfig - Modify nym_api_provider to fetch all nodes then filter by supported_roles.entry (fixes metadata inconsistency) - Update helpers.rs to build HTTP client with all nym_apis URLs and retries for fallback support - Fix SDK to use entry_capable_nodes() instead of entry_gateways() for broader gateway selection This enables domain fronting and URL rotation throughout the entire SDK stack, improving censorship resistance and connection reliability. All changes are backward compatible - custom client is optional.	2025-10-17 08:36:23 +02:00
Tommy Verrall	edcf2b1204	enable URL rotation and retries for mixnet gateway init	2025-10-16 16:22:57 +02:00