[DOCs/operators]: Release notes for v2025.19 kase (#6157 )

* add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix
change migration and bump version
2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00
32 changed files with 282 additions and 910 deletions
@@ -8,13 +8,10 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'nym-api/**'
-      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
-      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
      - 'nym-node-status-api/**'
-      - 'nym-registration-client/**'
      - 'nym-statistics-api/**'
      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -38,6 +43,16 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -46,12 +61,24 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,78 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.20-leerdammer] (2025-11-12)
-
- Max/tweak ts sdk actions ([#6185])
- chore: resolve clippy 1.91 warnings ([#6168])
- [chore] Remove unused dependencies ([#6151])
- Use typed-builder for registration client builder config ([#6150])
- tommy is too quick ([#6149])
- configurable mixnet client startup timeout ([#6148])
- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
- Bugfix: Add circuit breaker ([#6143])
- bugfix: update internal owner address in transferred share ([#6139])
- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
- bugfix: update stored epoch share when changing ownership ([#6135])
- Domain fronting ([#6134])
- bugfix: update stored epoch share when changing announce address ([#6131])
-
-[#6185]: https://github.com/nymtech/nym/pull/6185
-[#6168]: https://github.com/nymtech/nym/pull/6168
-[#6151]: https://github.com/nymtech/nym/pull/6151
-[#6150]: https://github.com/nymtech/nym/pull/6150
-[#6149]: https://github.com/nymtech/nym/pull/6149
-[#6148]: https://github.com/nymtech/nym/pull/6148
-[#6145]: https://github.com/nymtech/nym/pull/6145
-[#6143]: https://github.com/nymtech/nym/pull/6143
-[#6139]: https://github.com/nymtech/nym/pull/6139
-[#6138]: https://github.com/nymtech/nym/pull/6138
-[#6136]: https://github.com/nymtech/nym/pull/6136
-[#6135]: https://github.com/nymtech/nym/pull/6135
-[#6134]: https://github.com/nymtech/nym/pull/6134
-[#6131]: https://github.com/nymtech/nym/pull/6131
-
-## [2025.19-kase] (2025-10-30)
-
- update ns agent workflow ([#6154])
- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
- bugfix: nym-credential-proxy query params parsing regression ([#6121])
- bugfix: revert some dep updates introduced in #6043 ([#6120])
- Skip ipv6 metadata endpoint request ([#6118])
- update to no longer use 1mb files ([#6117])
- chore: restore pending dkg contract state migration ([#6116])
- Revert "Propagate cancel token to mixnet client" ([#6115])
- Update dirs to 6.0 ([#6109])
- Propagate cancel token to mixnet client ([#6105])
- bugfix: retrieve and update ticketbook in the same query ([#6101])
- bugfix: include network name in the default gateway probe config path ([#6100])
- Bugfix/incompatibility fixes ([#6099])
- [DOCs/operators] QUIC deployment script & docs ([#6098])
- bugfix: testnet manager 02sql migration ([#6096])
- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
- bugfix: use custom topology provider for list of init gateways ([#6092])
- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)

 - ns-api: add descriptions to dVPN gateway responses ([#6102])
@@ -4824,7 +4824,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.69"
+version = "1.1.67"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -5050,7 +5050,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.66"
+version = "1.1.64"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5133,7 +5133,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.66"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -6050,7 +6050,6 @@ dependencies = [
 "thiserror 2.0.12",
 "tokio",
 "tracing",
- "tracing-subscriber",
 "url",
 "wasmtimer",
 ]
@@ -6355,7 +6354,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.67"
+version = "1.1.65"
 dependencies = [
 "addr",
 "anyhow",
@@ -6405,7 +6404,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.21.0"
+version = "1.19.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6932,7 +6931,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.66"
+version = "1.1.64"
 dependencies = [
 "bs58",
 "clap",
@@ -7671,7 +7670,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.31"
+version = "0.1.29"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.66"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.66"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -45,7 +45,7 @@ pub enum ClientCoreError {

    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),

    #[error("no gateways on network")]
    NoGatewaysOnNetwork,
@@ -441,7 +441,7 @@ mod tests {

    #[test]
    fn test_multiple_urls_prepared_for_retries() {
-        let urls = [
+        let urls = vec![
            Url::parse("https://api1.nym.com").unwrap(),
            Url::parse("https://api2.nym.com").unwrap(),
            Url::parse("https://api3.nym.com").unwrap(),
@@ -30,6 +30,7 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
+                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -39,6 +39,7 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
+                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -54,7 +54,7 @@ pub enum GatewayClientError {

    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
+    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),

    #[error("No shared key was provided or obtained")]
    NoSharedKeyAvailable,
@@ -241,28 +241,23 @@ impl Epoch {
 //
 // Note: It's important that the variant ordering is not changed otherwise it would mess up the derived `PartialOrd`
 #[cw_serde]
-#[derive(Copy, Default)]
+#[derive(Copy)]
 pub enum EpochState {
-    #[default]
    WaitingInitialisation,
-    PublicKeySubmission {
-        resharing: bool,
-    },
-    DealingExchange {
-        resharing: bool,
-    },
-    VerificationKeySubmission {
-        resharing: bool,
-    },
-    VerificationKeyValidation {
-        resharing: bool,
-    },
-    VerificationKeyFinalization {
-        resharing: bool,
-    },
+    PublicKeySubmission { resharing: bool },
+    DealingExchange { resharing: bool },
+    VerificationKeySubmission { resharing: bool },
+    VerificationKeyValidation { resharing: bool },
+    VerificationKeyFinalization { resharing: bool },
    InProgress,
 }

+impl Default for EpochState {
+    fn default() -> Self {
+        Self::WaitingInitialisation
+    }
+}
+
 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
@@ -246,7 +246,7 @@ mod tests {
        let _exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[signing_keys.secret_key()],
-            &[signing_keys.verification_key()],
+            &vec![signing_keys.verification_key()],
            &signing_keys.verification_key(),
            &[1],
        )?;
@@ -263,7 +263,7 @@ mod tests {

        let wallet = issuance.aggregate_signature_shares(
            &signing_keys.verification_key(),
-            &[partial_wallet],
+            &vec![partial_wallet],
            sig_req,
        )?;

@@ -82,7 +82,7 @@ mod tests {
        let exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[keypair.secret_key()],
-            &[keypair.verification_key()],
+            &vec![keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -106,14 +106,14 @@ mod tests {
            .unwrap();

        let wallet = issuance
-            .aggregate_signature_shares(&keypair.verification_key(), &[partial_wallet], sig_req)
+            .aggregate_signature_shares(&keypair.verification_key(), &vec![partial_wallet], sig_req)
            .unwrap();

        let mut issued = issuance.into_issued_ticketbook(wallet, 1);
        let coin_indices_signatures = generate_coin_indices_signatures(
            nym_credentials_interface::ecash_parameters(),
            &[keypair.secret_key()],
-            &[keypair.verification_key()],
+            &vec![keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -32,7 +32,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 itertools = { workspace = true }
 inventory = { workspace = true }
-tokio = { workspace = true, features = ["rt", "macros", "time"] }
+
 # used for decoding text responses (they were already implicitly included)
 bytes = { workspace = true }
 encoding_rs = { workspace = true }
@@ -52,4 +52,5 @@ workspace = true
 features = ["tokio"]

 [dev-dependencies]
-tracing-subscriber.workspace = true
+tokio = { workspace = true, features = ["rt", "macros"] }
+
@@ -30,26 +30,19 @@
 use crate::ClientBuilder;

 use std::{
-    collections::HashMap,
-    net::{IpAddr, SocketAddr},
-    str::FromStr,
+    net::SocketAddr,
    sync::{Arc, LazyLock},
-    time::Duration,
 };

 use hickory_resolver::{
-    TokioResolver,
+    ResolveError, TokioResolver,
    config::{LookupIpStrategy, NameServerConfigGroup, ResolverConfig, ServerOrderingStrategy},
-    lookup_ip::LookupIpIntoIter,
+    lookup_ip::{LookupIp, LookupIpIntoIter},
    name_server::TokioConnectionProvider,
 };
 use once_cell::sync::OnceCell;
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
-use tracing::*;
-
-mod constants;
-mod static_resolver;
-pub use static_resolver::*;
+use tracing::warn;

 impl ClientBuilder {
    /// Override the DNS resolver implementation used by the underlying http client.
@@ -66,6 +59,10 @@ impl ClientBuilder {
    }
 }

+struct SocketAddrs {
+    iter: LookupIpIntoIter,
+}
+
 // n.b. static items do not call [`Drop`] on program termination, so this won't be deallocated.
 // this is fine, as the OS can deallocate the terminated program faster than we can free memory
 // but tools like valgrind might report "memory leaks" as it isn't obvious this is intentional.
@@ -75,17 +72,11 @@ static SHARED_RESOLVER: LazyLock<HickoryDnsResolver> = LazyLock::new(|| {
 });

 #[derive(Debug, thiserror::Error)]
-#[allow(missing_docs)]
+#[error("hickory-dns resolver error: {hickory_error}")]
 /// Error occurring while resolving a hostname into an IP address.
-pub enum ResolveError {
-    #[error("invalid name: {0}")]
-    InvalidNameError(String),
-    #[error("hickory-dns resolver error: {0}")]
-    ResolveError(#[from] hickory_resolver::ResolveError),
-    #[error("high level lookup timed out")]
-    Timeout,
-    #[error("hostname not found in static lookup table")]
-    StaticLookupMiss,
+pub struct HickoryDnsError {
+    #[from]
+    hickory_error: ResolveError,
 }

 /// Wrapper around an `AsyncResolver`, which implements the `Resolve` trait.
@@ -96,120 +87,71 @@ pub enum ResolveError {
 /// The default initialization uses a shared underlying `AsyncResolver`. If a thread local resolver
 /// is required use `thread_resolver()` to build a resolver with an independently instantiated
 /// internal `AsyncResolver`.
-#[derive(Debug, Clone)]
+#[derive(Debug, Default, Clone)]
 pub struct HickoryDnsResolver {
    // Since we might not have been called in the context of a
    // Tokio Runtime in initialization, so we must delay the actual
    // construction of the resolver.
    state: Arc<OnceCell<TokioResolver>>,
    fallback: Option<Arc<OnceCell<TokioResolver>>>,
-    static_base: Option<Arc<OnceCell<StaticResolver>>>,
    dont_use_shared: bool,
-    /// Overall timeout for dns lookup associated with any individual host resolution. For example,
-    /// use of retries, server_ordering_strategy, etc. ends absolutely if this timeout is reached.
-    overall_dns_timeout: Duration,
-}
-
-impl Default for HickoryDnsResolver {
-    fn default() -> Self {
-        Self {
-            state: Default::default(),
-            // Disable system resolver fallback by default - often blocked by firewalls in VPN environments
-            // Enable static fallback for known domains
-            fallback: None,
-            static_base: Some(Default::default()),
-            dont_use_shared: Default::default(),
-            overall_dns_timeout: Duration::from_secs(10),
-        }
-    }
 }

 impl Resolve for HickoryDnsResolver {
    fn resolve(&self, name: Name) -> Resolving {
        let resolver = self.state.clone();
        let maybe_fallback = self.fallback.clone();
-        let maybe_static = self.static_base.clone();
        let independent = self.dont_use_shared;
-        let overall_dns_timeout = self.overall_dns_timeout;
        Box::pin(async move {
-            resolve(
-                name,
-                resolver,
-                maybe_fallback,
-                maybe_static,
-                independent,
-                overall_dns_timeout,
-            )
-            .await
-            .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)
+            let resolver = resolver.get_or_try_init(|| {
+                // using a closure here is slightly gross, but this makes sure that if the
+                // lazy-init returns an error it can be handled by the client
+                if independent {
+                    new_resolver()
+                } else {
+                    Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
+                }
+            })?;
+
+            // try the primary DNS resolver that we set up (DoH or DoT or whatever)
+            let lookup = match resolver.lookup_ip(name.as_str()).await {
+                Ok(res) => res,
+                Err(e) => {
+                    if let Some(ref fallback) = maybe_fallback {
+                        // on failure use the fall back system configured DNS resolver
+                        if !e.is_no_records_found() {
+                            warn!("primary DNS failed w/ error {e}: using system fallback");
+                        }
+                        let resolver = fallback.get_or_try_init(|| {
+                            // using a closure here is slightly gross, but this makes sure that if the
+                            // lazy-init returns an error it can be handled by the client
+                            if independent {
+                                new_resolver_system()
+                            } else {
+                                Ok(SHARED_RESOLVER
+                                    .fallback
+                                    .as_ref()
+                                    .ok_or(e)? // if the shared resolver has no fallback return the original error
+                                    .get_or_try_init(new_resolver_system)?
+                                    .clone())
+                            }
+                        })?;
+
+                        resolver.lookup_ip(name.as_str()).await?
+                    } else {
+                        return Err(e.into());
+                    }
+                }
+            };
+
+            let addrs: Addrs = Box::new(SocketAddrs {
+                iter: lookup.into_iter(),
+            });
+            Ok(addrs)
        })
    }
 }

-async fn resolve(
-    name: Name,
-    resolver: Arc<OnceCell<TokioResolver>>,
-    maybe_fallback: Option<Arc<OnceCell<TokioResolver>>>,
-    maybe_static: Option<Arc<OnceCell<StaticResolver>>>,
-    independent: bool,
-    overall_dns_timeout: Duration,
-) -> Result<Addrs, ResolveError> {
-    let resolver = resolver.get_or_try_init(|| HickoryDnsResolver::new_resolver(independent))?;
-
-    // Attempt a lookup using the primary resolver
-    let resolve_fut = tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
-    let primary_err = match resolve_fut.await {
-        Err(_) => ResolveError::Timeout,
-        Ok(Ok(lookup)) => {
-            let addrs: Addrs = Box::new(SocketAddrs {
-                iter: lookup.into_iter(),
-            });
-            return Ok(addrs);
-        }
-        Ok(Err(e)) => {
-            // on failure use the fall back system configured DNS resolver
-            if !e.is_no_records_found() {
-                warn!("primary DNS failed w/ error: {e}");
-            }
-            e.into()
-        }
-    };
-
-    // If the primary resolver encountered an error, attempt a lookup using the fallback
-    // resolver if one is configured.
-    if let Some(ref fallback) = maybe_fallback {
-        let resolver =
-            fallback.get_or_try_init(|| HickoryDnsResolver::new_resolver_system(independent))?;
-
-        let resolve_fut =
-            tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
-        if let Ok(Ok(lookup)) = resolve_fut.await {
-            let addrs: Addrs = Box::new(SocketAddrs {
-                iter: lookup.into_iter(),
-            });
-            return Ok(addrs);
-        }
-    }
-
-    // If no record has been found and a static map of fallback addresses is configured
-    // check the table for our entry
-    if let Some(ref static_resolver) = maybe_static {
-        debug!("checking static");
-        let resolver =
-            static_resolver.get_or_init(|| HickoryDnsResolver::new_static_fallback(independent));
-
-        if let Ok(addrs) = resolver.resolve(name).await {
-            return Ok(addrs);
-        }
-    }
-
-    Err(primary_err)
-}
-
-struct SocketAddrs {
-    iter: LookupIpIntoIter,
-}
-
 impl Iterator for SocketAddrs {
    type Item = SocketAddr;

@@ -220,22 +162,28 @@ impl Iterator for SocketAddrs {

 impl HickoryDnsResolver {
    /// Attempt to resolve a domain name to a set of ['IpAddr']s
-    pub async fn resolve_str(
-        &self,
-        name: &str,
-    ) -> Result<impl Iterator<Item = IpAddr> + use<>, ResolveError> {
-        let n =
-            Name::from_str(name).map_err(|_| ResolveError::InvalidNameError(name.to_string()))?;
-        resolve(
-            n,
-            self.state.clone(),
-            self.fallback.clone(),
-            self.static_base.clone(),
-            self.dont_use_shared,
-            self.overall_dns_timeout,
-        )
-        .await
-        .map(|addrs| addrs.map(|socket_addr| socket_addr.ip()))
+    pub async fn resolve_str(&self, name: &str) -> Result<LookupIp, HickoryDnsError> {
+        let resolver = self.state.get_or_try_init(|| self.new_resolver())?;
+
+        // try the primary DNS resolver that we set up (DoH or DoT or whatever)
+        let lookup = match resolver.lookup_ip(name).await {
+            Ok(res) => res,
+            Err(e) => {
+                if let Some(ref fallback) = self.fallback {
+                    // on failure use the fall back system configured DNS resolver
+                    if !e.is_no_records_found() {
+                        warn!("primary DNS failed w/ error {e}: using system fallback");
+                    }
+
+                    let resolver = fallback.get_or_try_init(|| self.new_resolver_system())?;
+                    resolver.lookup_ip(name).await?
+                } else {
+                    return Err(e.into());
+                }
+            }
+        };
+
+        Ok(lookup)
    }

    /// Create a (lazy-initialized) resolver that is not shared across threads.
@@ -246,20 +194,16 @@ impl HickoryDnsResolver {
        }
    }

-    fn new_resolver(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
-        // using a closure here is slightly gross, but this makes sure that if the
-        // lazy-init returns an error it can be handled by the client
-        if dont_use_shared {
+    fn new_resolver(&self) -> Result<TokioResolver, HickoryDnsError> {
+        if self.dont_use_shared {
            new_resolver()
        } else {
            Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
        }
    }

-    fn new_resolver_system(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
-        // using a closure here is slightly gross, but this makes sure that if the
-        // lazy-init returns an error it can be handled by the client
-        if dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
+    fn new_resolver_system(&self) -> Result<TokioResolver, HickoryDnsError> {
+        if self.dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
            new_resolver_system()
        } else {
            Ok(SHARED_RESOLVER
@@ -271,18 +215,8 @@ impl HickoryDnsResolver {
        }
    }

-    fn new_static_fallback(dont_use_shared: bool) -> StaticResolver {
-        if !dont_use_shared && let Some(ref shared_resolver) = SHARED_RESOLVER.static_base {
-            shared_resolver
-                .get_or_init(new_default_static_fallback)
-                .clone()
-        } else {
-            new_default_static_fallback()
-        }
-    }
-
    /// Enable fallback to the system default resolver if the primary (DoX) resolver fails
-    pub fn enable_system_fallback(&mut self) -> Result<(), ResolveError> {
+    pub fn enable_system_fallback(&mut self) -> Result<(), HickoryDnsError> {
        self.fallback = Some(Default::default());
        let _ = self
            .fallback
@@ -297,52 +231,22 @@ impl HickoryDnsResolver {
    pub fn disable_system_fallback(&mut self) {
        self.fallback = None;
    }
-
-    /// Get the current map of hostname to address in use by the fallback static lookup if one
-    /// exists.
-    pub fn get_static_fallbacks(&self) -> Option<HashMap<String, Vec<IpAddr>>> {
-        Some(self.static_base.as_ref()?.get()?.get_addrs())
-    }
-
-    /// Set (or overwrite) the map of addresses used in the fallback static hostname lookup
-    pub fn set_static_fallbacks(&mut self, addrs: HashMap<String, Vec<IpAddr>>) {
-        let cell = OnceCell::new();
-        cell.set(StaticResolver::new(addrs))
-            .expect("infallible assign");
-        self.static_base = Some(Arc::new(cell));
-    }
 }

 /// Create a new resolver with a custom DoT based configuration. The options are overridden to look
 /// up for both IPv4 and IPv6 addresses to work with "happy eyeballs" algorithm.
-///
-/// Timeout Defaults to 5 seconds
-/// Number of retries after lookup failure before giving up Defaults to 2
-///
-/// Caches successfully resolved addresses for 30 minutes to prevent continual use of remote lookup.
-/// This resolver is intended to be used for OUR API endpoints that do not rapidly rotate IPs.
-fn new_resolver() -> Result<TokioResolver, ResolveError> {
-    info!("building new configured resolver");
-
+fn new_resolver() -> Result<TokioResolver, HickoryDnsError> {
    let mut name_servers = NameServerConfigGroup::quad9_tls();
    name_servers.merge(NameServerConfigGroup::quad9_https());
    name_servers.merge(NameServerConfigGroup::cloudflare_tls());
    name_servers.merge(NameServerConfigGroup::cloudflare_https());

-    configure_and_build_resolver(name_servers)
-}
-
-fn configure_and_build_resolver(
-    name_servers: NameServerConfigGroup,
-) -> Result<TokioResolver, ResolveError> {
    let config = ResolverConfig::from_parts(None, Vec::new(), name_servers);
    let mut resolver_builder =
        TokioResolver::builder_with_config(config, TokioConnectionProvider::default());

-    resolver_builder.options_mut().ip_strategy = get_ip_strategy();
+    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;
    resolver_builder.options_mut().server_ordering_strategy = ServerOrderingStrategy::RoundRobin;
-    // Cache successful responses for queries received by this resolver for 30 min minimum.
-    resolver_builder.options_mut().positive_min_ttl = Some(Duration::from_secs(1800));

    Ok(resolver_builder.build())
 }
@@ -350,54 +254,20 @@ fn configure_and_build_resolver(
 /// Create a new resolver with the default configuration, which reads from the system DNS config
 /// (i.e. `/etc/resolve.conf` in unix). The options are overridden to look up for both IPv4 and IPv6
 /// addresses to work with "happy eyeballs" algorithm.
-fn new_resolver_system() -> Result<TokioResolver, ResolveError> {
+fn new_resolver_system() -> Result<TokioResolver, HickoryDnsError> {
    let mut resolver_builder = TokioResolver::builder_tokio()?;
-    resolver_builder.options_mut().ip_strategy = get_ip_strategy();
+    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;

    Ok(resolver_builder.build())
 }

-fn new_default_static_fallback() -> StaticResolver {
-    StaticResolver::new(constants::default_static_addrs())
-}
-
-/// Check if IPv6 stack is available for DNS resolution.
-fn should_use_ipv6_dns() -> bool {
-    use std::net::UdpSocket;
-
-    match UdpSocket::bind("[::]:0") {
-        Ok(_) => {
-            debug!("IPv6 stack available - enabling dual-stack DNS");
-            true
-        }
-        Err(e) => {
-            debug!("IPv6 unavailable ({}), using IPv4-only DNS", e);
-            false
-        }
-    }
-}
-
-/// Get DNS lookup strategy based on IPv6 availability.
-fn get_ip_strategy() -> LookupIpStrategy {
-    if should_use_ipv6_dns() {
-        debug!("Using dual-stack DNS (IPv4 + IPv6)");
-        LookupIpStrategy::Ipv4AndIpv6
-    } else {
-        debug!("Using IPv4-only DNS");
-        LookupIpStrategy::Ipv4Only
-    }
-}
-
 #[cfg(test)]
 mod test {
    use super::*;
-    use itertools::Itertools;
-    use std::collections::HashMap;

    #[tokio::test]
-    async fn reqwest_with_custom_dns() {
-        let var_name = HickoryDnsResolver::default();
-        let resolver = var_name;
+    async fn reqwest_hickory_doh() {
+        let resolver = HickoryDnsResolver::default();
        let client = reqwest::ClientBuilder::new()
            .dns_resolver(resolver.into())
            .build()
@@ -416,7 +286,7 @@ mod test {
    }

    #[tokio::test]
-    async fn dns_lookup() -> Result<(), ResolveError> {
+    async fn dns_lookup() -> Result<(), HickoryDnsError> {
        let resolver = HickoryDnsResolver::default();

        let domain = "ifconfig.me";
@@ -426,153 +296,4 @@ mod test {

        Ok(())
    }
-
-    #[tokio::test]
-    async fn static_resolver_as_fallback() -> Result<(), ResolveError> {
-        let example_domain = "non-existent.nymvpn.com";
-        let mut resolver = HickoryDnsResolver {
-            ..Default::default()
-        };
-
-        let result = resolver.resolve_str(example_domain).await;
-        assert!(result.is_err()); // should be NXDomain
-
-        resolver.static_base = Some(Default::default());
-
-        let mut addr_map = HashMap::new();
-        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
-        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
-        addr_map.insert(example_domain.to_string(), vec![example_ip4, example_ip6]);
-
-        resolver.set_static_fallbacks(addr_map);
-
-        let mut addrs = resolver.resolve_str(example_domain).await?;
-        assert!(addrs.contains(&example_ip4));
-        assert!(addrs.contains(&example_ip6));
-        Ok(())
-    }
-
-    #[test]
-    fn default_resolver_fallback_config() {
-        let resolver = HickoryDnsResolver::default();
-        assert!(
-            resolver.fallback.is_none(),
-            "system fallback should be disabled by default for VPN environments"
-        );
-        assert!(
-            resolver.static_base.is_some(),
-            "static fallback should be enabled by default"
-        );
-    }
-
-    #[test]
-    fn ipv6_detection_returns_valid_strategy() {
-        let strategy = get_ip_strategy();
-        match strategy {
-            LookupIpStrategy::Ipv4Only | LookupIpStrategy::Ipv4AndIpv6 => {}
-            _ => panic!("Unexpected IP strategy returned: {:?}", strategy),
-        }
-    }
-
-    #[test]
-    fn ipv6_dns_detection_is_consistent() {
-        let first_result = should_use_ipv6_dns();
-        let second_result = should_use_ipv6_dns();
-        assert_eq!(first_result, second_result);
-    }
-}
-
-#[cfg(test)]
-mod failure_test {
-    use super::*;
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-
-    /// IP addresses guaranteed to fail attempts to resolve
-    ///
-    /// Addresses drawn from blocks set off by RFC5737 (ipv4) and RFC3849 (ipv6)
-    const GUARANTEED_BROKEN_IPS_1: &[IpAddr] = &[
-        IpAddr::V4(Ipv4Addr::new(192, 0, 2, 1)),
-        IpAddr::V4(Ipv4Addr::new(198, 51, 100, 1)),
-        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1111)),
-        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1001)),
-    ];
-
-    // Create a resolver that behaves the same as the custom configured router, except for the fact
-    // that it is guaranteed to fail.
-    fn build_broken_resolver() -> Result<TokioResolver, ResolveError> {
-        info!("building new faulty resolver");
-
-        let mut broken_ns_group = NameServerConfigGroup::from_ips_tls(
-            GUARANTEED_BROKEN_IPS_1,
-            853,
-            "cloudflare-dns.com".to_string(),
-            true,
-        );
-        let broken_ns_https = NameServerConfigGroup::from_ips_https(
-            GUARANTEED_BROKEN_IPS_1,
-            443,
-            "cloudflare-dns.com".to_string(),
-            true,
-        );
-        broken_ns_group.merge(broken_ns_https);
-
-        configure_and_build_resolver(broken_ns_group)
-    }
-
-    #[tokio::test]
-    async fn dns_lookup_failures() -> Result<(), ResolveError> {
-        let time_start = std::time::Instant::now();
-
-        let r = OnceCell::new();
-        r.set(build_broken_resolver().expect("failed to build resolver"))
-            .expect("broken resolver init error");
-
-        // create a new resolver that won't mess with the shared resolver used by other tests
-        let resolver = HickoryDnsResolver {
-            dont_use_shared: true,
-            state: Arc::new(r),
-            overall_dns_timeout: Duration::from_secs(5),
-            ..Default::default()
-        };
-        build_broken_resolver()?;
-        let domain = "ifconfig.me";
-        let result = resolver.resolve_str(domain).await;
-        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
-
-        let duration = time_start.elapsed();
-        assert!(duration < resolver.overall_dns_timeout + Duration::from_secs(1));
-
-        Ok(())
-    }
-
-    #[tokio::test]
-    async fn fallback_to_static() -> Result<(), ResolveError> {
-        let r = OnceCell::new();
-        r.set(build_broken_resolver().expect("failed to build resolver"))
-            .expect("broken resolver init error");
-
-        // create a new resolver that won't mess with the shared resolver used by other tests
-        let resolver = HickoryDnsResolver {
-            dont_use_shared: true,
-            state: Arc::new(r),
-            static_base: Some(Default::default()),
-            overall_dns_timeout: Duration::from_secs(5),
-            ..Default::default()
-        };
-        build_broken_resolver()?;
-
-        // successful lookup using fallback to static resolver
-        let domain = "nymvpn.com";
-        let _ = resolver
-            .resolve_str(domain)
-            .await
-            .expect("failed to resolve address in static lookup");
-
-        // unsuccessful lookup - primary times out, and not in
-        let domain = "non-existent.nymtech.net";
-        let result = resolver.resolve_str(domain).await;
-        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
-
-        Ok(())
-    }
 }
@@ -1,73 +0,0 @@
-#![allow(missing_docs)]
-
-use std::collections::HashMap;
-use std::net::{IpAddr, Ipv4Addr};
-
-pub const NYM_API_DOMAIN: &str = "validator.nymtech.net";
-pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))];
-
-pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com";
-pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))];
-
-pub const NYM_FRONTDOOR_VERCEL_DOMAIN: &str = "nym-frontdoor.vercel.app";
-pub const NYM_FRONTDOOR_VERCEL_IPS: &[IpAddr] = &[
-    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
-    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
-];
-
-pub const NYM_FRONTDOOR_FASTLY_DOMAIN: &str = "nym-frontdoor.global.ssl.fastly.net";
-pub const NYM_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
-    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
-];
-
-pub const NYMVPN_FRONTDOOR_FASTLY_DOMAIN: &str = "nymvpn-frontdoor.global.ssl.fastly.net";
-pub const NYMVPN_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
-    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
-    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
-];
-
-pub const VERCEL_APP_DOMAIN: &str = "vercel.app";
-pub const VERCEL_APP_IPS: &[IpAddr] = &[
-    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
-    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
-];
-
-pub const VERCEL_COM_DOMAIN: &str = "vercel.com";
-pub const VERCEL_COM_IPS: &[IpAddr] = &[
-    IpAddr::V4(Ipv4Addr::new(198, 169, 2, 129)),
-    IpAddr::V4(Ipv4Addr::new(198, 169, 1, 193)),
-];
-
-pub const NYM_COM_DOMAIN: &str = "nym.com";
-pub const NYM_COM_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 22))];
-
-pub const NYM_STATS_API_DOMAIN: &str = "nym-statistics-api.nymtech.cc";
-pub const NYM_STATS_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(91, 92, 153, 96))];
-
-pub fn default_static_addrs() -> HashMap<String, Vec<IpAddr>> {
-    let mut m = HashMap::new();
-    m.insert(NYM_API_DOMAIN.to_string(), NYM_API_IPS.to_vec());
-    m.insert(NYM_VPN_API_DOMAIN.to_string(), NYM_VPN_API_IPS.to_vec());
-    m.insert(
-        NYM_FRONTDOOR_VERCEL_DOMAIN.to_string(),
-        NYM_FRONTDOOR_VERCEL_IPS.to_vec(),
-    );
-    m.insert(
-        NYM_FRONTDOOR_FASTLY_DOMAIN.to_string(),
-        NYM_FRONTDOOR_FASTLY_IPS.to_vec(),
-    );
-    m.insert(
-        NYMVPN_FRONTDOOR_FASTLY_DOMAIN.to_string(),
-        NYMVPN_FRONTDOOR_FASTLY_IPS.to_vec(),
-    );
-    m.insert(VERCEL_APP_DOMAIN.to_string(), VERCEL_APP_IPS.to_vec());
-    m.insert(VERCEL_COM_DOMAIN.to_string(), VERCEL_COM_IPS.to_vec());
-    m.insert(NYM_COM_DOMAIN.to_string(), NYM_COM_IPS.to_vec());
-    m.insert(NYM_STATS_API_DOMAIN.to_string(), NYM_STATS_API_IPS.to_vec());
-    m
-}
@@ -1,89 +0,0 @@
-use crate::dns::ResolveError;
-
-use std::{
-    collections::HashMap,
-    net::{IpAddr, SocketAddr},
-    sync::{Arc, Mutex},
-};
-
-use reqwest::dns::{Addrs, Name, Resolve, Resolving};
-use tracing::*;
-
-#[derive(Debug, Default, Clone)]
-pub struct StaticResolver {
-    static_addr_map: Arc<Mutex<HashMap<String, Vec<IpAddr>>>>,
-}
-
-impl StaticResolver {
-    pub fn new(static_entries: HashMap<String, Vec<IpAddr>>) -> StaticResolver {
-        debug!("building static resolver");
-        Self {
-            static_addr_map: Arc::new(Mutex::new(static_entries)),
-        }
-    }
-
-    pub fn get_addrs(&self) -> HashMap<String, Vec<IpAddr>> {
-        self.static_addr_map.lock().unwrap().clone()
-    }
-}
-
-impl Resolve for StaticResolver {
-    fn resolve(&self, name: Name) -> Resolving {
-        debug!("looking up {name:?} in static resolver");
-        let addr_map = self.static_addr_map.clone();
-        Box::pin(async move {
-            let addr_map = addr_map.lock().unwrap();
-            let lookup = match addr_map.get(name.as_str()) {
-                None => return Err(ResolveError::StaticLookupMiss.into()),
-                Some(addrs) => addrs,
-            };
-            let addrs: Addrs = Box::new(
-                lookup
-                    .clone()
-                    .into_iter()
-                    .map(|ip_addr| SocketAddr::new(ip_addr, 0)),
-            );
-
-            Ok(addrs)
-        })
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use itertools::Itertools;
-
-    use super::*;
-    use std::error::Error as StdError;
-    use std::str::FromStr;
-
-    #[tokio::test]
-    async fn lookup_using_static_resolver() -> Result<(), Box<dyn StdError + Send + Sync>> {
-        let example_domain = String::from("static.nymvpn.com");
-
-        // lookup for domain for which there is no entry
-        let resolver = StaticResolver::new(HashMap::new());
-
-        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
-        let result = resolver.resolve(url).await;
-        assert!(result.is_err());
-        match result {
-            Ok(_) => panic!("lookup with empty map should fail"),
-            Err(e) => assert_eq!(e.to_string(), ResolveError::StaticLookupMiss.to_string()),
-        }
-
-        // Successful lookup
-        let mut addr_map = HashMap::new();
-        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
-        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
-        addr_map.insert(example_domain.clone(), vec![example_ip4, example_ip6]);
-
-        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
-        let resolver = StaticResolver::new(addr_map);
-        let mut addrs = resolver.resolve(url).await?;
-        assert!(addrs.contains(&SocketAddr::new(example_ip4, 0)));
-        assert!(addrs.contains(&SocketAddr::new(example_ip6, 0)));
-
-        Ok(())
-    }
-}
@@ -179,7 +179,7 @@ mod dns;
 mod path;

 #[cfg(not(target_arch = "wasm32"))]
-pub use dns::{HickoryDnsResolver, ResolveError};
+pub use dns::{HickoryDnsError, HickoryDnsResolver};

 // helper for generating user agent based on binary information
 #[cfg(not(target_arch = "wasm32"))]
@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.69"
+version = "1.1.67"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -2,7 +2,7 @@ use nym_credentials_interface::TicketType;
 use nym_sdk::mixnet::InputMessage;

 #[derive(thiserror::Error, Debug)]
-pub enum AuthenticationClientError {
+pub enum Error {
    #[error("mixnet client stopped returning responses")]
    NoMixnetMessagesReceived,

@@ -42,19 +42,10 @@ pub enum AuthenticationClientError {

    #[error("unknown authenticator version number")]
    UnsupportedAuthenticatorVersion,
-}

-#[derive(thiserror::Error, Debug)]
-pub enum RegistrationError {
-    #[error(transparent)]
-    NoCredentialSent(AuthenticationClientError), // This intentionnally doesn't use `from` to avoid random ? operator to land here when they shouldn't
-
-    #[error("an error occured after a credential was sent : {source}")]
-    CredentialSent {
-        #[source]
-        source: AuthenticationClientError,
-    },
+    #[error("failed to wait on AuthenticatorClientListener")]
+    FailedToJoinOnTask(#[from] tokio::task::JoinError),
 }

 // Result type based on our error type
-pub(crate) type Result<T> = std::result::Result<T, AuthenticationClientError>;
+pub type Result<T> = std::result::Result<T, Error>;
@@ -6,11 +6,11 @@ use nym_bandwidth_controller::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND
 use nym_crypto::asymmetric::x25519::KeyPair;
 use nym_registration_common::GatewayData;
 use std::net::{IpAddr, SocketAddr};
+use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Duration;
 use tracing::{debug, error, trace};

-use crate::error::Result;
 use crate::mixnet_listener::{MixnetMessageBroadcastReceiver, MixnetMessageInputSender};
 use nym_authenticator_requests::{
    AuthenticatorVersion, client_message::ClientMessage, response::AuthenticatorResponse,
@@ -25,7 +25,7 @@ mod error;
 mod helpers;
 mod mixnet_listener;

-pub use crate::error::{AuthenticationClientError, RegistrationError};
+pub use crate::error::{Error, Result};
 pub use crate::mixnet_listener::{AuthClientMixnetListener, AuthClientMixnetListenerHandle};

 pub struct AuthenticatorClient {
@@ -91,7 +91,7 @@ impl AuthenticatorClient {
        self.mixnet_sender
            .send(input_message)
            .await
-            .map_err(|e| AuthenticationClientError::SendMixnetMessage(Box::new(e)))?;
+            .map_err(|e| Error::SendMixnetMessage(Box::new(e)))?;

        Ok(request_id)
    }
@@ -104,11 +104,11 @@ impl AuthenticatorClient {
            tokio::select! {
                _ = &mut timeout => {
                    error!("Timed out waiting for reply to connect request");
-                    return Err(AuthenticationClientError::TimeoutWaitingForConnectResponse);
+                    return Err(Error::TimeoutWaitingForConnectResponse);
                }
                msg = self.mixnet_listener.recv() => match msg {
                    Err(_) => {
-                        return Err(AuthenticationClientError::NoMixnetMessagesReceived);
+                        return Err(Error::NoMixnetMessagesReceived);
                    }
                    Ok(msg) => {
                        let Some(header) = msg.message.first_chunk::<2>() else {
@@ -131,12 +131,12 @@ impl AuthenticatorClient {
                        // Then we deserialize the message
                        debug!("AuthClient: got message while waiting for connect response with version {version:?}");
                        let ret: Result<AuthenticatorResponse> = match version {
-                            AuthenticatorVersion::V1 => Err(AuthenticationClientError::UnsupportedVersion),
+                            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
                            AuthenticatorVersion::V2 => v2::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V3 => v3::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V4 => v4::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
-                            AuthenticatorVersion::UNKNOWN => Err(AuthenticationClientError::UnknownVersion),
+                            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
                        };
                        let Ok(response) = ret else {
                            // This is ok, it's likely just one of our self-pings
@@ -158,14 +158,10 @@ impl AuthenticatorClient {
        &mut self,
        controller: &dyn BandwidthTicketProvider,
        ticketbook_type: TicketType,
-    ) -> std::result::Result<GatewayData, RegistrationError> {
+    ) -> Result<GatewayData> {
        debug!("Registering with the wg gateway...");
        let init_message = match self.auth_version {
-            AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
-                return Err(RegistrationError::NoCredentialSent(
-                    AuthenticationClientError::UnsupportedAuthenticatorVersion,
-                ));
-            }
+            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
            AuthenticatorVersion::V2 => {
                ClientMessage::Initial(Box::new(v2::registration::InitMessage {
                    pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
@@ -186,20 +182,16 @@ impl AuthenticatorClient {
                    pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                }))
            }
+            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
        };
        trace!("sending init msg to {}: {:?}", &self.ip_addr, &init_message);
-        let response = self
-            .send_and_wait_for_response(&init_message)
-            .await
-            .map_err(RegistrationError::NoCredentialSent)?;
+        let response = self.send_and_wait_for_response(&init_message).await?;
        let registered_data = match response {
            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
                // Unwrap since we have already checked that we have the keypair.
                debug!("Verifying data");
                if let Err(e) = pending_registration_response.verify(self.keypair.private_key()) {
-                    return Err(RegistrationError::NoCredentialSent(
-                        AuthenticationClientError::VerificationFailed(e),
-                    ));
+                    return Err(Error::VerificationFailed(e));
                }

                trace!(
@@ -207,7 +199,6 @@ impl AuthenticatorClient {
                    &self.ip_addr, &pending_registration_response
                );

-                // This call takes care of updating the credential count in storage, so failure of this must be counted as credential waste
                let credential = Some(
                    controller
                        .get_ecash_ticket(
@@ -216,21 +207,15 @@ impl AuthenticatorClient {
                            DEFAULT_TICKETS_TO_SPEND,
                        )
                        .await
-                        .map_err(|source| RegistrationError::CredentialSent {
-                            source: AuthenticationClientError::GetTicket {
-                                ticketbook_type,
-                                source,
-                            },
+                        .map_err(|source| Error::GetTicket {
+                            ticketbook_type,
+                            source,
                        })?
                        .data,
                );

                let finalized_message = match self.auth_version {
-                    AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
-                        return Err(RegistrationError::CredentialSent {
-                            source: AuthenticationClientError::UnsupportedAuthenticatorVersion,
-                        });
-                    }
+                    AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
                    AuthenticatorVersion::V2 => {
                        ClientMessage::Final(Box::new(v2::registration::FinalMessage {
                            gateway_client: v2::registration::GatewayClient::new(
@@ -275,29 +260,23 @@ impl AuthenticatorClient {
                            credential,
                        }))
                    }
+                    AuthenticatorVersion::UNKNOWN => {
+                        return Err(Error::UnsupportedAuthenticatorVersion);
+                    }
                };
                trace!(
                    "sending final msg to {}: {:?}",
                    &self.ip_addr, &finalized_message
                );

-                let response = self
-                    .send_and_wait_for_response(&finalized_message)
-                    .await
-                    .map_err(|source| RegistrationError::CredentialSent { source })?;
+                let response = self.send_and_wait_for_response(&finalized_message).await?;
                let AuthenticatorResponse::Registered(registered_response) = response else {
-                    return Err(RegistrationError::CredentialSent {
-                        source: AuthenticationClientError::InvalidGatewayAuthResponse,
-                    });
+                    return Err(Error::InvalidGatewayAuthResponse);
                };
                registered_response
            }
            AuthenticatorResponse::Registered(registered_response) => registered_response,
-            _ => {
-                return Err(RegistrationError::NoCredentialSent(
-                    AuthenticationClientError::InvalidGatewayAuthResponse,
-                ));
-            }
+            _ => return Err(Error::InvalidGatewayAuthResponse),
        };

        trace!(
@@ -307,7 +286,12 @@ impl AuthenticatorClient {

        let gateway_data = GatewayData {
            public_key: registered_data.pub_key().inner().into(),
-            endpoint: SocketAddr::new(self.ip_addr, registered_data.wg_port()),
+            endpoint: SocketAddr::from_str(&format!(
+                "{}:{}",
+                self.ip_addr,
+                registered_data.wg_port()
+            ))
+            .map_err(Error::FailedToParseEntryGatewaySocketAddr)?,
            private_ipv4: registered_data.private_ips().ipv4,
            private_ipv6: registered_data.private_ips().ipv6,
        };
@@ -315,12 +299,9 @@ impl AuthenticatorClient {
        Ok(gateway_data)
    }

-    // This is up to the caller to know nothing is ever spent there
    pub async fn query_bandwidth(&mut self) -> Result<Option<i64>> {
        let query_message = match self.auth_version {
-            AuthenticatorVersion::V1 => {
-                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
-            }
+            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
            AuthenticatorVersion::V2 => ClientMessage::Query(Box::new(QueryMessageImpl {
                pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                version: AuthenticatorVersion::V2,
@@ -337,9 +318,7 @@ impl AuthenticatorClient {
                pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                version: AuthenticatorVersion::V5,
            })),
-            AuthenticatorVersion::UNKNOWN => {
-                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
-            }
+            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
        };
        let response = self.send_and_wait_for_response(&query_message).await?;

@@ -353,7 +332,7 @@ impl AuthenticatorClient {
                    return Ok(None);
                }
            }
-            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
+            _ => return Err(Error::InvalidGatewayAuthResponse),
        };

        let remaining_pretty = if available_bandwidth > 1024 * 1024 {
@@ -368,13 +347,13 @@ impl AuthenticatorClient {
        );
        if available_bandwidth < 1024 * 1024 {
            tracing::warn!(
-                "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon"
-            );
+                            "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon
+            "
+                        );
        }
        Ok(Some(available_bandwidth))
    }

-    // Since the caller provides the credential, it knows it is spent
    pub async fn top_up(&mut self, credential: CredentialSpendingData) -> Result<i64> {
        let top_up_message = match self.auth_version {
            AuthenticatorVersion::V3 => ClientMessage::TopUp(Box::new(v3::topup::TopUpMessage {
@@ -392,7 +371,7 @@ impl AuthenticatorClient {
                credential,
            })),
            AuthenticatorVersion::V1 | AuthenticatorVersion::V2 | AuthenticatorVersion::UNKNOWN => {
-                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
+                return Err(Error::UnsupportedAuthenticatorVersion);
            }
        };
        let response = self.send_and_wait_for_response(&top_up_message).await?;
@@ -401,7 +380,7 @@ impl AuthenticatorClient {
            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
                top_up_bandwidth_response.available_bandwidth()
            }
-            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
+            _ => return Err(Error::InvalidGatewayAuthResponse),
        };

        Ok(remaining_bandwidth)
@@ -50,7 +50,7 @@ impl AuthClientMixnetListener {
        }
    }

-    async fn run(mut self) {
+    async fn run(mut self) -> Self {
        let mixnet_cancel_token = self.mixnet_client.cancellation_token();
        self.shutdown_token.run_until_cancelled(async {
            loop {
@@ -95,8 +95,12 @@ impl AuthClientMixnetListener {
            tracing::debug!("AuthClientMixnetListener is shutting down");
        }).await;

-        tracing::debug!("AuthClientMixnetListener: Disconnect mixnet client");
-        if !mixnet_cancel_token.is_cancelled() {
+        self
+    }
+
+    // Disconnects the mixnet client and effectively drop itself, since it doesn't work without one, and reconnecting isn't supported
+    pub async fn disconnect_mixnet_client(self) {
+        if !self.mixnet_client.cancellation_token().is_cancelled() {
            self.mixnet_client.disconnect().await;
        }
    }
@@ -124,7 +128,7 @@ pub struct AuthClientMixnetListenerHandle {
    message_sender: MixnetMessageInputSender,
    cancellation_token: CancellationToken,
    mixnet_cancellation_token: CancellationToken,
-    handle: JoinHandle<()>,
+    handle: JoinHandle<AuthClientMixnetListener>,
 }

 impl AuthClientMixnetListenerHandle {
@@ -144,8 +148,13 @@ impl AuthClientMixnetListenerHandle {
        // If shutdown was externally called, that call is a no-op
        // If we're only stopping this, it is very much needed
        self.cancellation_token.cancel();
-        if let Err(e) = self.handle.await {
-            tracing::error!("Error waiting for auth clients mixnet listener to stop: {e}")
+        match self.handle.await {
+            Ok(auth_client_mixnet_listener) => {
+                auth_client_mixnet_listener.disconnect_mixnet_client().await;
+            }
+            Err(e) => {
+                tracing::error!("Error waiting for auth clients mixnet listener to stop: {e}");
+            }
        }
    }
 }
@@ -765,7 +765,7 @@ async fn connect_exit(
    );
    // The IPR supports cancellation, but it's unused in the gateway probe
    let cancel_token = CancellationToken::new();
-    let mut ipr_client = IprClientConnect::new(mixnet_client, cancel_token);
+    let mut ipr_client = IprClientConnect::new(mixnet_client, cancel_token).await;

    let maybe_ip_pair = ipr_client.connect(exit_router_address).await;
    let mixnet_client = ipr_client.into_mixnet_client();
@@ -43,7 +43,7 @@ pub struct IprClientConnect {
 }

 impl IprClientConnect {
-    pub fn new(mixnet_client: MixnetClient, cancel_token: CancellationToken) -> Self {
+    pub async fn new(mixnet_client: MixnetClient, cancel_token: CancellationToken) -> Self {
        Self {
            mixnet_client,
            connected: ConnectionState::Disconnected,
@@ -1,17 +1,21 @@
 # this will only work with VPN, otherwise remove the harbor part
 FROM harbor.nymte.ch/dockerhub/rust:latest AS builder

+ARG GIT_REF=main
+
 RUN apt update && apt install -yy libdbus-1-dev pkg-config libclang-dev

 # Install go
 RUN wget https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O go.tar.gz
 RUN tar -xzvf go.tar.gz -C /usr/local
-ENV PATH=/go/bin:/usr/local/go/bin:$PATH

-COPY ./ /usr/src/nym
-WORKDIR /usr/src/nym
+RUN git clone https://github.com/nymtech/nym-vpn-client /usr/src/nym-vpn-client
+RUN cd /usr/src/nym-vpn-client && git checkout $GIT_REF
+ENV PATH=/go/bin:/usr/local/go/bin:$PATH
+WORKDIR /usr/src/nym-vpn-client/nym-vpn-core
 RUN cargo build --release --package nym-gateway-probe

+COPY ./ /usr/src/nym
 WORKDIR /usr/src/nym/nym-node-status-api/nym-node-status-agent
 RUN cargo build --release

@@ -31,7 +35,7 @@ RUN apt-get update && apt-get install -y ca-certificates
 WORKDIR /nym

 COPY --from=builder /usr/src/nym/target/release/nym-node-status-agent ./
-COPY --from=builder /usr/src/nym/target/release/nym-gateway-probe ./
+COPY --from=builder /usr/src/nym-vpn-client/nym-vpn-core/target/release/nym-gateway-probe ./
 COPY --from=builder /usr/src/nym/nym-node-status-api/nym-node-status-agent/entrypoint.sh ./
 RUN chmod +x /nym/entrypoint.sh

@@ -3,7 +3,7 @@

 [package]
 name = "nym-node"
-version = "1.21.0"
+version = "1.19.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -35,85 +35,19 @@ pub enum RegistrationClientError {
    #[error("timeout connecting the mixnet client")]
    Timeout(#[from] tokio::time::error::Elapsed),

-    #[error(
-        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
-    )]
-    WireguardEntryRegistration {
+    #[error("failed to register wireguard with the gateway for {gateway_id}")]
+    EntryGatewayRegisterWireguard {
        gateway_id: String,
        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
        #[source]
-        source: Box<nym_authenticator_client::AuthenticationClientError>,
+        source: Box<nym_authenticator_client::Error>,
    },

-    #[error(
-        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
-    )]
-    WireguardExitRegistration {
+    #[error("failed to register wireguard with the gateway for {gateway_id}")]
+    ExitGatewayRegisterWireguard {
        gateway_id: String,
        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
        #[source]
-        source: Box<nym_authenticator_client::AuthenticationClientError>,
-    },
-
-    #[error(
-        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
-    )]
-    WireguardEntryRegistrationCredentialSent {
-        gateway_id: String,
-        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
-        #[source]
-        source: Box<nym_authenticator_client::AuthenticationClientError>,
-    },
-
-    #[error(
-        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
-    )]
-    WireguardExitRegistrationCredentialSent {
-        gateway_id: String,
-        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
-        #[source]
-        source: Box<nym_authenticator_client::AuthenticationClientError>,
+        source: Box<nym_authenticator_client::Error>,
    },
 }
-
-impl RegistrationClientError {
-    pub fn from_authenticator_error(
-        error: nym_authenticator_client::RegistrationError,
-        gateway_id: String,
-        authenticator_address: nym_sdk::mixnet::Recipient,
-        entry: bool,
-    ) -> Self {
-        match error {
-            nym_authenticator_client::RegistrationError::NoCredentialSent(source) => {
-                if entry {
-                    Self::WireguardEntryRegistration {
-                        gateway_id,
-                        authenticator_address: Box::new(authenticator_address),
-                        source: Box::new(source),
-                    }
-                } else {
-                    Self::WireguardExitRegistration {
-                        gateway_id,
-                        authenticator_address: Box::new(authenticator_address),
-                        source: Box::new(source),
-                    }
-                }
-            }
-            nym_authenticator_client::RegistrationError::CredentialSent { source } => {
-                if entry {
-                    Self::WireguardEntryRegistrationCredentialSent {
-                        gateway_id,
-                        authenticator_address: Box::new(authenticator_address),
-                        source: Box::new(source),
-                    }
-                } else {
-                    Self::WireguardExitRegistrationCredentialSent {
-                        gateway_id,
-                        authenticator_address: Box::new(authenticator_address),
-                        source: Box::new(source),
-                    }
-                }
-            }
-        }
-    }
-}
@@ -9,7 +9,6 @@ use nym_credentials_interface::TicketType;
 use nym_ip_packet_client::IprClientConnect;
 use nym_registration_common::AssignedAddresses;
 use nym_sdk::mixnet::{EventReceiver, MixnetClient, Recipient};
-use tracing::debug;

 use crate::config::RegistrationClientConfig;

@@ -35,49 +34,23 @@ pub struct RegistrationClient {
    event_rx: EventReceiver,
 }

-// Bundle of an actual error and the underlying mixnet client so it can be shutdown correctly if needed
-struct RegistrationError {
-    mixnet_client: Option<MixnetClient>,
-    source: crate::RegistrationClientError,
-}
-
 impl RegistrationClient {
-    async fn register_mix_exit(self) -> Result<RegistrationResult, RegistrationError> {
+    async fn register_mix_exit(self) -> Result<RegistrationResult, RegistrationClientError> {
        let entry_mixnet_gateway_ip = self.config.entry.node.ip_address;

        let exit_mixnet_gateway_ip = self.config.exit.node.ip_address;

-        let Some(ipr_address) = self.config.exit.node.ipr_address else {
-            return Err(RegistrationError {
-                mixnet_client: Some(self.mixnet_client),
-                source: RegistrationClientError::NoIpPacketRouterAddress {
-                    node_id: self.config.exit.node.identity.to_base58_string(),
-                },
-            });
-        };
-
+        let ipr_address = self.config.exit.node.ipr_address.ok_or(
+            RegistrationClientError::NoIpPacketRouterAddress {
+                node_id: self.config.exit.node.identity.to_base58_string(),
+            },
+        )?;
        let mut ipr_client =
-            IprClientConnect::new(self.mixnet_client, self.cancel_token.child_token());
-
-        let interface_addresses = match self
-            .cancel_token
-            .run_until_cancelled(ipr_client.connect(ipr_address))
+            IprClientConnect::new(self.mixnet_client, self.cancel_token.clone()).await;
+        let interface_addresses = ipr_client
+            .connect(ipr_address)
            .await
-        {
-            Some(Ok(addr)) => addr,
-            Some(Err(e)) => {
-                return Err(RegistrationError {
-                    mixnet_client: Some(ipr_client.into_mixnet_client()),
-                    source: RegistrationClientError::ConnectToIpPacketRouter(e),
-                });
-            }
-            None => {
-                return Err(RegistrationError {
-                    mixnet_client: Some(ipr_client.into_mixnet_client()),
-                    source: RegistrationClientError::Cancelled,
-                });
-            }
-        };
+            .map_err(RegistrationClientError::ConnectToIpPacketRouter)?;

        Ok(RegistrationResult::Mixnet(Box::new(
            MixnetRegistrationResult {
@@ -94,24 +67,18 @@ impl RegistrationClient {
        )))
    }

-    async fn register_wg(self) -> Result<RegistrationResult, RegistrationError> {
-        let Some(entry_auth_address) = self.config.entry.node.authenticator_address else {
-            return Err(RegistrationError {
-                mixnet_client: Some(self.mixnet_client),
-                source: RegistrationClientError::AuthenticationNotPossible {
-                    node_id: self.config.entry.node.identity.to_base58_string(),
-                },
-            });
-        };
+    async fn register_wg(self) -> Result<RegistrationResult, RegistrationClientError> {
+        let entry_auth_address = self.config.entry.node.authenticator_address.ok_or(
+            RegistrationClientError::AuthenticationNotPossible {
+                node_id: self.config.entry.node.identity.to_base58_string(),
+            },
+        )?;

-        let Some(exit_auth_address) = self.config.exit.node.authenticator_address else {
-            return Err(RegistrationError {
-                mixnet_client: Some(self.mixnet_client),
-                source: RegistrationClientError::AuthenticationNotPossible {
-                    node_id: self.config.exit.node.identity.to_base58_string(),
-                },
-            });
-        };
+        let exit_auth_address = self.config.exit.node.authenticator_address.ok_or(
+            RegistrationClientError::AuthenticationNotPossible {
+                node_id: self.config.exit.node.identity.to_base58_string(),
+            },
+        )?;

        let entry_version = self.config.entry.node.version;
        tracing::debug!("Entry gateway version: {entry_version}");
@@ -120,10 +87,8 @@ impl RegistrationClient {

        // Start the auth client mixnet listener, which will listen for incoming messages from the
        // mixnet and rebroadcast them to the auth clients.
-        // From this point on, we don't need to care about the mixnet client anymore
        let mixnet_listener =
-            AuthClientMixnetListener::new(self.mixnet_client, self.cancel_token.child_token())
-                .start();
+            AuthClientMixnetListener::new(self.mixnet_client, self.cancel_token.clone()).start();

        let mut entry_auth_client = AuthenticatorClient::new(
            mixnet_listener.subscribe(),
@@ -150,35 +115,24 @@ impl RegistrationClient {
        let exit_fut = exit_auth_client
            .register_wireguard(&*self.bandwidth_controller, TicketType::V1WireguardExit);

-        let (entry, exit) = Box::pin(
-            self.cancel_token
-                .run_until_cancelled(async { tokio::join!(entry_fut, exit_fut) }),
-        )
-        .await
-        .ok_or(RegistrationError {
-            mixnet_client: None,
-            source: RegistrationClientError::Cancelled,
-        })?;
+        let (entry, exit) = Box::pin(async { tokio::join!(entry_fut, exit_fut) }).await;

-        let entry = entry.map_err(|source| RegistrationError {
-            mixnet_client: None,
-            source: RegistrationClientError::from_authenticator_error(
-                source,
-                self.config.entry.node.identity.to_base58_string(),
-                entry_auth_address,
-                true,
-            ),
-        })?;
-
-        let exit = exit.map_err(|source| RegistrationError {
-            mixnet_client: None,
-            source: RegistrationClientError::from_authenticator_error(
-                source,
-                self.config.exit.node.identity.to_base58_string(),
-                exit_auth_address,
-                false,
-            ),
-        })?;
+        let entry =
+            entry.map_err(
+                |source| RegistrationClientError::EntryGatewayRegisterWireguard {
+                    gateway_id: self.config.entry.node.identity.to_base58_string(),
+                    authenticator_address: Box::new(entry_auth_address),
+                    source: Box::new(source),
+                },
+            )?;
+        let exit =
+            exit.map_err(
+                |source| RegistrationClientError::ExitGatewayRegisterWireguard {
+                    gateway_id: self.config.exit.node.identity.to_base58_string(),
+                    authenticator_address: Box::new(exit_auth_address),
+                    source: Box::new(source),
+                },
+            )?;

        Ok(RegistrationResult::Wireguard(Box::new(
            WireguardRegistrationResult {
@@ -193,23 +147,16 @@ impl RegistrationClient {
    }

    pub async fn register(self) -> Result<RegistrationResult, RegistrationClientError> {
-        let registration_result = if self.config.two_hops {
-            self.register_wg().await
-        } else {
-            self.register_mix_exit().await
-        };
-
-        // If we failed to register, and we were the owner of the mixnet client, shut it down
-        match registration_result {
-            Ok(result) => Ok(result),
-            Err(error) => {
-                debug!("Registration failed");
-                if let Some(mixnet_client) = error.mixnet_client {
-                    debug!("Shutting down mixnet client");
-                    mixnet_client.disconnect().await;
+        self.cancel_token
+            .clone()
+            .run_until_cancelled(async {
+                if self.config.two_hops {
+                    self.register_wg().await
+                } else {
+                    self.register_mix_exit().await
                }
-                Err(error.source)
-            }
-        }
+            })
+            .await
+            .ok_or(RegistrationClientError::Cancelled)?
    }
 }
@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.67"
+version = "1.1.65"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.85"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.66"
+version = "1.1.64"
 authors.workspace = true
 edition = "2021"
 license.workspace = true
@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.31"
+version = "0.1.29"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
Author	SHA1	Message	Date
import this	340960d957	[DOCs/operators]: Release notes for v2025.19 kase (#6157 ) * add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix	2025-10-31 09:02:13 +00:00
Mark Sinclair	554e446208	change migration and bump version	2025-10-31 09:02:13 +00:00
Mark Sinclair	a6325b922a	bump version to rc	2025-10-31 09:02:13 +00:00
Mark Sinclair	fae4768b99	add tracing output	2025-10-31 09:02:13 +00:00
Mark Sinclair	2689a4dbd8	clippy	2025-10-31 09:02:13 +00:00
Mark Sinclair	02e40ccaef	save custom_http_port to db	2025-10-31 09:02:13 +00:00
Mark Sinclair	b216338364	allow NS API to run once for scraping for troubleshooting and debugging	2025-10-31 09:02:13 +00:00
Mark Sinclair	4a83bb9ba8	wip	2025-10-31 09:02:13 +00:00
Mark Sinclair	66ec3b037f	ns-api: fix scraping bug when operator specifies custom node HTTP API port in bond	2025-10-31 09:02:13 +00:00
import this	168baa5071	[Feature/operators]: QUIC bridge deployment script v2 (#6145 ) * new quick deployment script * docs tweak * update script to use .deb postinst * final clean - ready to go * correct nym-node config dir search with a fallback	2025-10-31 09:02:13 +00:00
Simon Wicky	7aef468839	remove unused deps (#6151 )	2025-10-31 09:02:12 +00:00
Simon Wicky	cb3ccd7f7e	use typed builder (#6150 )	2025-10-31 09:02:12 +00:00
Simon Wicky	16509dbace	allow overwriting existing sdk shutdown manager	2025-10-31 09:02:12 +00:00
Simon Wicky	b907ccbd5b	typo	2025-10-31 09:02:12 +00:00
Simon Wicky	7b3194d7d2	calling for shutdown from the MixTrafficController	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	0b81edfc66	using same hierarchy of trackers for client shutdown control	2025-10-31 09:02:12 +00:00
Tommy Verrall	8c6150e5ef	Internal comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	46164a389a	Fix comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	96d256b48f	Better message to come in the PR description	2025-10-31 09:02:12 +00:00
Simon Wicky	f98b93f60e	tommy is too quick	2025-10-31 09:02:12 +00:00
Simon Wicky	0f6c356f39	configurable mixnet client startup timeout	2025-10-31 09:02:12 +00:00
p17o	cf3f5d9a53	Update quic_bridge_deployment.sh for IPv4 and .deb package (#6138 ) Updated ping commands to explicitly use IPv4 and adjusted file permission checks with sudo. Changed the forward address prompt to specify IPv4 and modified the binary download process to fetch and install the latest .deb release URL automatically.	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	2f47e6349a	bugfix: update internal owner address in transferred share (#6139 )	2025-10-31 09:02:12 +00:00
Tommy Verrall	4b2b5390d3	Last failing test - fix	2025-10-31 09:02:12 +00:00
Tommy Verrall	734ff63f6d	Use explicit Vec<ApiUrl> handling in BaseClientBuilder - Replace NymNetworkDetails with explicit API URL handling - Fix deprecated from_network() usage and improve fallback logic - Add URL validation and remove unused backwards compatibility	2025-10-31 09:02:11 +00:00
Tommy Verrall	910c24e7da	Actually commit the recommended changes	2025-10-31 09:02:11 +00:00
Tommy Verrall	c96b73172a	Fix broken tests in CI	2025-10-31 09:02:11 +00:00
Tommy Verrall	823c2c7262	Replace deprecated from_network() with new_with_fronted_urls()	2025-10-31 09:02:11 +00:00
Jędrzej Stuczyński	03d1b72a9e	feat: expose more explicit new_with_fronted_urls builder for http API client (#6136 )	2025-10-31 09:02:10 +00:00
Jędrzej Stuczyński	066669440f	bugfix: update stored epoch share when changing ownership (#6135 )	2025-10-31 09:01:27 +00:00
Jędrzej Stuczyński	9fb3443fd1	bugfix: update stored epoch share when changing announce address (#6131 ) * bugfix: update stored epoch share when changing announce address * chore: remove placeholder legacy mixnode bonding test [mixnet contract]	2025-10-31 09:01:27 +00:00
Tommy Verrall	cd89a590b5	Fix new_from_env() to populate nym_api_urls for domain fronting	2025-10-31 09:01:27 +00:00
Tommy Verrall	06cb8bd969	fix all clippy messages	2025-10-31 09:01:27 +00:00
Tommy Verrall	c72fef169c	Add more tests for retry logic	2025-10-31 09:01:27 +00:00
Tommy Verrall	3c27eb41b8	Fix confusing tracing logs	2025-10-31 09:01:27 +00:00
Tommy Verrall	2428374fe7	Fix retries - this is working	2025-10-31 09:01:27 +00:00
Tommy Verrall	5a491f0a7e	Add configuration-based domain fronting support Changes: - Add network_details field to BaseClientBuilder (optional, backwards compatible) - Add with_network_details() method for opt-in domain fronting - Update construct_nym_api_client() to use from_network() when network_details provided - Enable network-defaults feature in nym-client-core Cargo.toml - SDK passes network_details to BaseClientBuilder	2025-10-31 09:01:27 +00:00
Tommy Verrall	530f9ccb6f	Fix CI issues	2025-10-31 09:01:26 +00:00
Tommy Verrall	2228a81d43	Allow clippy::enum_variant_names for BuilderConfigError	2025-10-31 09:01:26 +00:00
Tommy Verrall	c8a1b53071	Improve error handling Changes: - Replace String error with BuilderConfigError enum in BuilderConfigBuilder - Update tests to use pattern matching instead of string assertions	2025-10-31 09:01:26 +00:00
Tommy Verrall	b896aaaed1	- Add DEFAULT_NYM_API_RETRIES constant (replaces magic number 3) - Run cargo fmt on all affected packages - All clippy warnings resolved	2025-10-31 09:01:26 +00:00
Tommy Verrall	828ffc6710	not sure what happened but it's fixed	2025-10-31 09:01:26 +00:00
Andy Duplain	05cdb27029	VPN-4262: Update `Url` to return `url` and `front` fields. The VPN client is using the `Url` type alot now and in order to avoid double URL-parsing we would like the content of the `Url` type exposed.	2025-10-31 09:01:26 +00:00
Tommy Verrall	3f29d3eba5	Add accessor methods for Url internals Add inner_url() and fronts() accessor methods to nym_http_api_client::Url for VPN client integration	2025-10-31 09:01:22 +00:00
Tommy Verrall	aa2c41dc41	Merge resolution	2025-10-31 09:01:02 +00:00
Tommy Verrall	048de771ab	Remove tests for removed with_nym_api_client method These tests were referencing with_nym_api_client() which was removed when cleaning domain fronting code from this branch	2025-10-31 09:01:02 +00:00
Tommy Verrall	e1b06f02f3	Add optional builder pattern for BuilderConfig (non-breaking) Addresses @jstuczyn's feedback about too many arguments by adding BuilderConfigBuilder as an alternative to the existing new() method.	2025-10-31 09:01:02 +00:00
Tommy Verrall	b5b8b8f224	fix conversion type && make the retry count configurable	2025-10-31 09:01:02 +00:00
Tommy Verrall	2d7141dfb1	Revert node filtering changes per Andrew's feedback Andrew clarified that get_basic_entry_assigned_nodes_v2() already filters by supported_roles.entry	2025-10-31 09:01:02 +00:00
Tommy Verrall	a07522258f	Remove domain fronting code to keep gateway changes only This branch now contains only gateway registration improvements: - Multiple URL fallback support in gateways_for_init() - Get all entry-capable nodes for registration - Performance and code quality improvements	2025-10-31 09:00:17 +00:00
Tommy Verrall	547a441002	Address PR feedback: simplify code and reduce log noise - Reverted all changes to topology_control/nym_api_provider.rs - Changed info/warn logs to debug for custom client messages - Removed unused _rng parameter from gateways_for_init() - Simplified URL builder to always use new_with_urls()	2025-10-31 09:00:17 +00:00
Tommy Verrall	93208fb5e0	Fix clippy warnings: use arrays instead of vec! in tests	2025-10-31 09:00:17 +00:00
Bogdan-Ștefan Neacşu	c9b50dd979	Introduce event backchannel (#6119 ) * Introduce even backchannel * Rust fmt * Rename Event to MixnetClientEvent * Use unbounded_send for events * Remove unused file * Remove mut borrow * Event hierarchy and mixnet client intermediary * Export MixTrafficEvent in sdk	2025-10-31 09:00:15 +00:00
Jędrzej Stuczyński	74cdfd5d94	Merge pull request #6099 from nymtech/bugfix/incompatibility-fixes Bugfix/incompatibility fixes	2025-10-31 08:59:40 +00:00
Jędrzej Stuczyński	953e813f0e	Bugfix/bloomfilters purge (#6089 ) * remove all old bloomfilters upon starting binary * remove old bloomfilter file upon purging secondary data	2025-10-31 08:59:38 +00:00
Tommy Verrall	29cf5058a6	feat: pass custom HTTP client through SDK stack for domain fronting - Add with_nym_api_client() to BaseClientBuilder, MixnetClientBuilder, and RegistrationClientBuilderConfig - Modify nym_api_provider to fetch all nodes then filter by supported_roles.entry (fixes metadata inconsistency) - Update helpers.rs to build HTTP client with all nym_apis URLs and retries for fallback support - Fix SDK to use entry_capable_nodes() instead of entry_gateways() for broader gateway selection This enables domain fronting and URL rotation throughout the entire SDK stack, improving censorship resistance and connection reliability. All changes are backward compatible - custom client is optional.	2025-10-31 08:57:08 +00:00
Tommy Verrall	a2856552d8	enable URL rotation and retries for mixnet gateway init	2025-10-31 08:57:08 +00:00
Andrej Mihajlov	a33c603471	Update dirs to 6.0	2025-10-31 08:57:08 +00:00
Jędrzej Stuczyński	a9f9266992	bugfix: nym-credential-proxy query params parsing regression (#6121 )	2025-10-31 08:57:08 +00:00
Tommy Verrall	cf34d0d24a	Skip ipv6 metadata endpoint request (#6118 ) Co-authored-by: Tommy Verrall <tommy@nymtech.net>	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	5fa7b0a709	bugfix: revert some dep updates introduced in #6043 (#6120 )	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	e232b4fd24	Revert "Propagate cancel token to mixnet client" This reverts commit `50a259d454`.	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	609f174e8d	chore: restore pending dkg contract state migration (#6116 ) since it has not yet been run on mainnet	2025-10-31 08:57:07 +00:00
benedetta davico	a0f4627647	Update lib.go	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	258f8f5f5d	bugfix: retrieve and update ticketbook in the same query (#6101 ) * bugfix: retrieve and update ticketbook in the same query * bump up NS version * Update Cargo.toml * remove SKIP LOCKED part of the query --------- Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:07 +00:00
mfahampshire	38220e05f1	DOCS Jarlsberg Release (#6111 ) * First pass release notes * build info	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	6250ebe235	Propagate cancel token to mixnet client	2025-10-31 08:57:07 +00:00
mfahampshire	a55323c0e2	Patch for operators to open wg metadata port (#6106 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	baa8ac3610	bugfix: use custom topology provider for list of init gateways (#6092 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	933da11e8f	bugfix: include network name in the default gateway probe config path (#6100 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	0469036da4	feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet (#6083 ) * feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet * updated getters for stringified mnemonic	2025-10-31 08:57:07 +00:00
Georgio Nicolas	63f9a856fa	Another offering for Clippy	2025-10-31 08:57:07 +00:00
Georgio Nicolas	c068948c62	Offerings for clippy	2025-10-31 08:57:06 +00:00
Georgio Nicolas	0105f9fa5e	Precompute BSGS table	2025-10-31 08:57:06 +00:00
Georgio Nicolas	004c737965	Use LazyLock to precompute generators	2025-10-31 08:57:06 +00:00
Georgio Nicolas	549121ca32	Fix clippy suggestion	2025-10-31 08:57:06 +00:00
Georgio Nicolas	3f2278dafc	Fix zeroization	2025-10-31 08:57:06 +00:00
Georgio Nicolas	25ce0ac814	replace unsafe static values by function calls	2025-10-31 08:57:06 +00:00
Mark Sinclair	38d313a101	ns-api: add descriptions to dVPN gateway responses (#6102 ) * ns-api: add descriptions to dVPN gateway responses * clippy * fmt --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
import this	f67bc0ead5	[DOCs/operators] QUIC deployment script & docs (#6098 ) * add quic_bridge_deployment.sh * create a snippet with quick install steps * add quic deployment to changelog * add quic deployment to node config page * add version compatibility callout * last edits and scraped stats update * correct name of QUIC snippet * fix naming * fix naming * re-run python-prebuild.sh aka time-now updated * attempt to fix vercel build the hard way * rerun npm * build with pnpm * restore lock file and rebuild w pnpm * chore: update pnpm lockfile * attempt to fix build * attempt to fix runtime builds * update ci-docs run OS	2025-10-31 08:57:06 +00:00
Mark Sinclair	90aaa3572d	Update ci-docs.yml	2025-10-31 08:57:06 +00:00
Mark Sinclair	ecc61e4a4a	NS API: use new probe download filesize and milliseconds field (#6097 ) * use milliseconds field * change score thresholds * bump to version 4.0.8 * NS API: adjust score categories (#6103) * testing scores * test version * Update Cargo.toml --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com> Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	22ac4919e5	bugfix: testnet manager 02sql migration (#6096 )	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	a1e7cc8e87	chore: remove unnecessary closure in 'calculate_score' inside node-status-api	2025-10-31 08:57:06 +00:00
Mark Sinclair	57df00637c	ns-api: use download files size from probes instead of parsing filenames	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	c7eb3bdb7b	moved nym-gateway-probe to monorepo and updated rust-edition to 2024 (#6094 ) dont build netstack in CI additional rust 2024 fixes fixes removed temp.rs first round of cleanup removed duplicated NS types moved gateway probe to the monorepo	2025-10-31 08:57:05 +00:00
Mark Sinclair	8f9b704541	ns-api: add new fields for probe output for query_metadata and download file size and duration in ms (#6091 ) Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
Mark Sinclair	6a956c790a	NS API: clamp `load` to `offline` when score is `offline` and add `mixnet_score` field to preformance_v2 (#6076 ) * ns-api: when `score` is `Offline`, clamp `load` to `Offline` * ns-api: bump version * ns-api: add mixnet score field to performance_v2 struct --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
mfahampshire	2ff5c7221a	Max/fix wasm client + build commands (#6043 ) * Debug logging * Yield based logging * Reintroduce non-dummy task manager, try add counting for BatchMessageSender, a couple of compiler target introductions on use statements. * Fixed time runtime err * Uncomment forgetme/rememberme * remove diffs from debug * missed commented out forgetme * yet more forgetme comments * * Added missing clientreqestsender clone to wasm client to stop premature drop & busyloop * Removed hacky mem::forget fix * Remove debug panic_hook * Conditional import + use of wasm_utils::console_log * add wasm_util dep * Commenting out or removing debug logging * Remove missed comment * cleanup gitignore * clippy * update go version in ci * removed unused deps * add clippy ignore * remove mixfetch from ci build * add minifetch fix * comment out unused ts builds * stop contract clients killing ci for the moment * wasm target locking for imports * Either remove console_log! macro or introduce cfg(debug_assertions) * downgrade netlink * debug assertions for console_log import * modify config logging (debug -> normal) * remove clone for client_request_sender + grab directly in struct creation * reintroduce debug print for config in debug mode * remove ood / unused custom topology from worker example file * clippy * clippy - ignore todo() tests * modified humantime test in line with new parsing rules	2025-10-31 08:56:49 +00:00