Merge branch 'release/v1.1.20'

updated locks and versions bumped
bump crate versions
2023-06-06 10:54:17 +02:00 · 2023-06-06 10:35:42 +02:00 · 2023-06-06 10:07:06 +02:00 · 2023-06-06 10:00:11 +02:00 · 2023-06-05 10:30:34 +01:00 · 2023-06-05 11:07:23 +02:00
377 changed files with 23272 additions and 8614 deletions
@@ -11,30 +11,25 @@
 # In each subsection folders are ordered first by depth, then alphabetically.
 # This should make it easy to add new rules without breaking existing ones.

-# Something weird not covered by anything else
-* @futurechimp @mmsinclair
+# contracts
+/contracts/mixnet @durch @jstuczyn
+/contracts/vesting @durch @jstuczyn
+/contracts/service-provider-directory @octol

-# Rust rules:
-*.rs @durch @futurechimp @jstuczyn @neacsu @octol
-Cargo.* @durch @futurechimp @jstuczyn @neacsu @octol
+# crypto code
+/common/crypto/ @jstuczyn
+/common/nymcoconut/ @jstuczyn
+/common/dkg/ @jstuczyn
+/common/nymsphinx/ @jstuczyn

-# JS rules:
-*.js @mmsinclair @fmtabbara
-*.ts @mmsinclair @fmtabbara
-*.tsx @mmsinclair @fmtabbara
-*.jsx @mmsinclair @fmtabbara
+# rust sdk
+/sdk/rust/ @octol

-# Something looking like possible documentation rules:
-*.md @mfahampshire
+# nym-connect (rust)
+/nym-connect/desktop/src-tauri/ @octol

-# our docker scripts
-/docker/ @neacsu
+# nym-wallet (rust)
+/nym-wallet/src-tauri/ @octol

-# if there are any changes in the core crypto, I feel like Ania should take a look:
-/common/crypto/ @aniampio
-/common/nymsphinx/ @aniampio
-
-# Explorer and wallet should probably get looked by the product team
-/explorer/ @nymtech/product 
-/nym-wallet/ @nymtech/product 
-/wallet-web/ @nymtech/product
+# documentation
+/documentation @mfahampshire
@@ -0,0 +1,14 @@
+---
+name: 'Documentation'
+about: Suggest a fix or enhancement to the documentation or developer portal content
+title: "[DOCS]"
+labels: documentation
+assignees: mfahampshire
+
+---
+
+Is your issue either: 
+- [ ] a fix to existing documentation (e.g. fixing a broken link or incorrect command) 
+- [ ] an enhancement (e.g. adding a description for an undocumented feature)
+
+Please briefly describe your issue:
@@ -6,7 +6,7 @@
  },

  {
-    "os":"windows-latest",
+    "os":"windows10",
    "rust":"stable",
    "runOnEvent":"schedule"
  },
@@ -22,7 +22,7 @@
    "runOnEvent":"schedule"
  },
  {
-    "os":"windows-latest",
+    "os":"windows10",
    "rust":"beta",
    "runOnEvent":"schedule"
  },
@@ -38,7 +38,7 @@
    "runOnEvent":"schedule"
  },
  {
-    "os":"windows-latest",
+    "os":"windows10",
    "rust":"nightly",
    "runOnEvent":"schedule"
  },
@@ -0,0 +1,79 @@
+name: Upload nyxd to CI
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish-nyxd:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ubuntu-20.04]
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare build output directory
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/nyxd
+        run: |
+          rm -rf ci-builds || true
+          mkdir -p $OUTPUT_DIR
+          echo $OUTPUT_DIR
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get -y install build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools git
+        continue-on-error: true
+      
+      - name: Update env variables to include go
+        run: | 
+          sudo rm -rf /usr/local/go
+          curl https://dl.google.com/go/go1.19.2.linux-amd64.tar.gz | sudo tar -C/usr/local -zxvf -
+          cat <<'EOF' >>$HOME/.profile
+          export GOROOT=/usr/local/go
+          export GOPATH=$HOME/go
+          export GO111MODULE=on
+          export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
+          EOF
+          source $HOME/.profile
+
+      - name: Verify Go is installed
+        run: go version
+
+      - name: Clone nyxd repo
+        run: | 
+          git clone https://github.com/tommyv1987/nyxd
+          cd nyxd
+          git checkout release/v0.30.2
+
+      - name: Run nyxd
+        run: |
+          pwd
+          cd nyxd && make build
+          sleep 10
+          ls /home/runner/work/nym/nym/nyxd/build
+
+      - name: Prepare build output
+        shell: bash
+        env:
+          OUTPUT_DIR: ci-builds/nyxd
+        run: |
+          cp /home/runner/work/nym/nym/nyxd/build/nyxd $OUTPUT_DIR
+          WASMVM_SO=$(ldd /home/runner/work/nym/nym/nyxd/build/nyxd | grep "libwasm*" | awk '{ print $3 }')
+          ls $WASMVM_SO
+          sleep 3
+          cp $(echo $WASMVM_SO) $OUTPUT_DIR
+
+      - name: Deploy nyxd to CI www
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CI_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-avzr"
+          SOURCE: "ci-builds/"
+          REMOTE_HOST: ${{ secrets.CI_WWW_REMOTE_HOST }}
+          REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/builds/
+          EXCLUDE: "/dist/, /node_modules/"
@@ -4,14 +4,99 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

- nym-network-statistics properly handles signals ([#3209])
- add socks5 support for Rust SDK ([#3226], [#3255])
- add coconut bandwidth credential support for Rust SDK ([#3273]) 
+## [v1.1.20] (2023-06-06)

-[#3209]: https://github.com/nymtech/nym/issues/3209
-[#3226]: https://github.com/nymtech/nym/pull/3226
-[#3255]: https://github.com/nymtech/nym/pull/3255
-[#3273]: https://github.com/nymtech/nym/pull/3273
+- Explorer - Fix SP supported apps list ([#3458])
+- Investigate if we need to lower `SHUTDOWN_TIMEOUT` in  socks5 to zero (or almost zero) ([#3438])
+- Explorer - show all gateways in the default view regardless of the version number ([#3427])
+- service-provider-directory: add signature check when announcing ([#3360])
+- Support functionality for nym-name-service (nym-api, nym-cli, etc) ([#3355])
+- Edit the nym-network-requester to support the enabled-credentials-mode flag ([#3101])
+- [BUG] network requester documentation update ([#3493])
+- removing hardcoded version numbers ([#3485])
+- [BUG] network requester documentation update ([#3481])
+- [BUG] network requester documentation update ([#3469])
+- Sign when announcing service providers to the directory contract ([#3459])
+- mixnode documentation update ([#3435])
+- updated readme with new developer chat links + new docs links ([#3141])
+
+[#3458]: https://github.com/nymtech/nym/issues/3458
+[#3438]: https://github.com/nymtech/nym/issues/3438
+[#3427]: https://github.com/nymtech/nym/issues/3427
+[#3360]: https://github.com/nymtech/nym/issues/3360
+[#3355]: https://github.com/nymtech/nym/issues/3355
+[#3101]: https://github.com/nymtech/nym/issues/3101
+[#3493]: https://github.com/nymtech/nym/pull/3493
+[#3485]: https://github.com/nymtech/nym/pull/3485
+[#3481]: https://github.com/nymtech/nym/pull/3481
+[#3469]: https://github.com/nymtech/nym/pull/3469
+[#3459]: https://github.com/nymtech/nym/pull/3459
+[#3435]: https://github.com/nymtech/nym/pull/3435
+[#3141]: https://github.com/nymtech/nym/pull/3141
+
+## [v1.1.19] (2023-05-16)
+
+- nym-name-service endpoint in nym-api ([#3403])
+- Implement key storage for WASM client using IndexedDB (for browser) ([#3329])
+- Initial version of nym-name-service contract providing name aliases for nym-addresses ([#3274])
+- Update Cargo.lock ([#3410])
+
+[#3403]: https://github.com/nymtech/nym/issues/3403
+[#3329]: https://github.com/nymtech/nym/issues/3329
+[#3274]: https://github.com/nymtech/nym/issues/3274
+[#3410]: https://github.com/nymtech/nym/pull/3410
+
+## [v1.1.18] (2023-05-09)
+
+- Implement heartbeat messages between socks5 proxy and network requester ([#3215])
+
+[#3215]: https://github.com/nymtech/nym/issues/3215
+
+## [v1.1.17] (2023-05-02)
+
+- Add service-provider-directory-contract support to nym-cli ([#3334])
+- Start using the node-testing-utils (implemented in #3270) in nym-api Network monitor to simplify the logic there ([#3312])
+- Add service-provider-directory support to validator-client ([#3296])
+- Allow topology injection in our WASM client ('test my node' feature) ([#3270])
+- Expose service-provider-directory contract data in nym-api endpoints ([#3242])
+- Cache service provider contract in nym-api ([#3241])
+- Feature/1 1 17 docs ([#3370])
+- adding a test for SP endpoint ([#3367])
+- Feature/store cipher ([#3350])
+
+[#3334]: https://github.com/nymtech/nym/issues/3334
+[#3312]: https://github.com/nymtech/nym/issues/3312
+[#3296]: https://github.com/nymtech/nym/issues/3296
+[#3270]: https://github.com/nymtech/nym/issues/3270
+[#3242]: https://github.com/nymtech/nym/issues/3242
+[#3241]: https://github.com/nymtech/nym/issues/3241
+[#3370]: https://github.com/nymtech/nym/pull/3370
+[#3367]: https://github.com/nymtech/nym/pull/3367
+[#3350]: https://github.com/nymtech/nym/pull/3350
+
+## [v1.1.16] (2023-04-25)
+
+- Explorer - Fix sorting function on Stake Saturation. It is currently working per page and not globally ([#3320])
+- Poisson process gets stuck at too slow rate. Rework to more aggressively up-regulate ([#3309])
+- decrease the logging level of warnings associated with clients dropping packets due to gateway being overloaded (I'd say reduce it to debug/trace) - there are few sources of those, e.g. in real and cover traffic streams ([#3299])
+- Make the buffer size in `AvailableReader` depend on packet sizes the client is using + introduce read timeouts ([#3213])
+- Rust SDK - Support coconut, credential storage etc ([#2755])
+- version bump for next release ([#3349])
+- added coconut credential generation example ([#3339])
+- update mix-node setup docs with node description ([#3325])
+- exposed missing gateway commands in nym-cli ([#3324])
+- make sure to clear inner 'ack_map' in 'GatewaysReader' ([#3300])
+
+[#3320]: https://github.com/nymtech/nym/issues/3320
+[#3309]: https://github.com/nymtech/nym/issues/3309
+[#3299]: https://github.com/nymtech/nym/issues/3299
+[#3213]: https://github.com/nymtech/nym/issues/3213
+[#2755]: https://github.com/nymtech/nym/issues/2755
+[#3349]: https://github.com/nymtech/nym/pull/3349
+[#3339]: https://github.com/nymtech/nym/pull/3339
+[#3325]: https://github.com/nymtech/nym/pull/3325
+[#3324]: https://github.com/nymtech/nym/pull/3324
+[#3300]: https://github.com/nymtech/nym/pull/3300

 ## [v1.1.15] (2023-04-18)

@@ -37,6 +37,7 @@ members = [
    "common/cosmwasm-smart-contracts/group-contract",
    "common/cosmwasm-smart-contracts/mixnet-contract",
    "common/cosmwasm-smart-contracts/multisig-contract",
+    "common/cosmwasm-smart-contracts/name-service",
    "common/cosmwasm-smart-contracts/service-provider-directory",
    "common/cosmwasm-smart-contracts/vesting-contract",
    "common/credential-storage",
@@ -48,6 +49,7 @@ members = [
    "common/ledger",
    "common/mixnode-common",
    "common/network-defaults",
+    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
    "common/nymcoconut",
    "common/nymsphinx",
@@ -59,12 +61,14 @@ members = [
    "common/nymsphinx/forwarding",
    "common/nymsphinx/framing",
    "common/nymsphinx/params",
+    "common/nymsphinx/routing",
    "common/nymsphinx/types",
    "common/pemstore",
    "common/socks5-client-core",
    "common/socks5/proxy-helpers",
    "common/socks5/requests",
    "common/statistics",
+    "common/store-cipher",
    "common/task",
    "common/topology",
    "common/types",
@@ -108,19 +112,22 @@ license = "Apache-2.0"

 [workspace.dependencies]
 async-trait = "0.1.64"
+anyhow = "1.0.71"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 cfg-if = "1.0.0"
 cosmwasm-derive = "=1.0.0"
 cosmwasm-schema = "=1.0.0"
 cosmwasm-std = "=1.0.0"
 cosmwasm-storage = "=1.0.0"
-cw-utils = "=0.13.4"
+cw-controllers = "=0.13.4"
 cw-storage-plus = "=0.13.4"
+cw-utils = "=0.13.4"
 cw2 = { version = "=0.13.4" }
 cw3 = { version = "=0.13.4" }
 cw3-fixed-multisig = { version = "=0.13.4" }
 cw4 = { version = "=0.13.4" }
 dotenvy = "0.15.6"
+generic-array = "0.14.7"
 lazy_static = "1.4.0"
 log = "0.4"
 once_cell = "1.7.2"
@@ -131,3 +138,4 @@ tap = "1.0.1"
 thiserror = "1.0.38"
 tokio = "1.24.1"
 url = "2.2"
+zeroize = "1.6.0"
@@ -13,6 +13,10 @@ happy: fmt clippy-happy test
 # on all workspaces.
 build-release: build-release-main wasm

+# Deprecated
+# For backwards compatibility
+clippy-all: clippy
+
 # -----------------------------------------------------------------------------
 # Define targets for a given workspace
 #  $(1): name
@@ -52,11 +56,11 @@ fmt-$(1):
 	cargo fmt --manifest-path $(2)/Cargo.toml --all

 clippy-happy: clippy-happy-$(1)
-clippy-all: clippy-$(1) clippy-examples-$(1)
+clippy: clippy-$(1) clippy-examples-$(1)
 check: check-$(1)
 cargo-test: test-$(1)
 cargo-test-expensive: test-expensive-$(1)
-build: build-$(1) build-$(1)-examples
+build: build-$(1) build-examples-$(1)
 build-release-all: build-release-$(1)
 fmt: fmt-$(1)

@@ -95,6 +99,7 @@ CONTRACTS_OUT_DIR=contracts/target/wasm32-unknown-unknown/release
 VESTING_CONTRACT=$(CONTRACTS_OUT_DIR)/vesting_contract.wasm
 MIXNET_CONTRACT=$(CONTRACTS_OUT_DIR)/mixnet_contract.wasm
 SERVICE_PROVIDER_DIRECTORY_CONTRACT=$(CONTRACTS_OUT_DIR)/nym_service_provider_directory.wasm
+NAME_SERVICE_CONTRACT=$(CONTRACTS_OUT_DIR)/nym_name_service.wasm

 wasm: wasm-build wasm-opt

@@ -105,6 +110,7 @@ wasm-opt:
 	wasm-opt --disable-sign-ext -Os $(VESTING_CONTRACT) -o $(VESTING_CONTRACT)
 	wasm-opt --disable-sign-ext -Os $(MIXNET_CONTRACT) -o $(MIXNET_CONTRACT)
 	wasm-opt --disable-sign-ext -Os $(SERVICE_PROVIDER_DIRECTORY_CONTRACT) -o $(SERVICE_PROVIDER_DIRECTORY_CONTRACT)
+	wasm-opt --disable-sign-ext -Os $(NAME_SERVICE_CONTRACT) -o $(NAME_SERVICE_CONTRACT)

 # -----------------------------------------------------------------------------
 # Misc
@@ -21,8 +21,8 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr

 ### Building

-Platform build instructions are available on [our docs site](https://nymtech.net/docs/binaries/building-nym.html).
-Wallet build instructions are also available on [our docs site](https://nymtech.net/docs/stable/nym-apps/wallet#for-developers).
+Platform build instructions are available on [our docs site](https://nymtech.net/docs/binaries/build-nym.html).
+Wallet build instructions are also available on [our docs site](https://nymtech.net/docs/wallet/desktop-wallet.html).

 ### Developing

@@ -32,7 +32,11 @@ For Typescript components, please see [ts-packages](./ts-packages).

 ### Developer chat

-You can chat to us in [Keybase](https://keybase.io). Download their chat app, then click **Teams -> Join a team**. Type **nymtech.friends** into the team name and hit **continue**. For general chat, hang out in the **#general** channel. Our development takes places in the **#dev** channel. Node operators should be in the **#node-operators** channel.
+> We used to use Keybase for developer chats, but we have since migrated to Matrix and Discord. We no longer check the old **nymtech.friends** Keybase team. 
+
+You can chat to us in two places: 
+* The #dev channel on [Matrix](https://matrix.to/#/#dev:nymtech.chat)
+* The various developer channels on [Discord](https://discord.gg/nym)

 ### Rewards

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.15"
+version = "1.1.20"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -7,84 +7,53 @@ use crate::websocket;
 use futures::channel::mpsc;
 use log::*;
 use nym_bandwidth_controller::BandwidthController;
+use nym_client_core::client::base_client::non_wasm_helpers::create_bandwidth_controller;
+use nym_client_core::client::base_client::storage::OnDiskPersistent;
 use nym_client_core::client::base_client::{
    non_wasm_helpers, BaseClientBuilder, ClientInput, ClientOutput, ClientState,
 };
 use nym_client_core::client::inbound_messages::InputMessage;
+use nym_client_core::client::key_manager::persistence::OnDiskKeys;
 use nym_client_core::client::received_buffer::{
    ReceivedBufferMessage, ReceivedBufferRequestSender, ReconstructedMessagesReceiver,
 };
 use nym_client_core::config::persistence::key_pathfinder::ClientKeyPathfinder;
+use nym_credential_storage::persistent_storage::PersistentStorage;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_task::connections::TransmissionLane;
 use nym_task::TaskManager;
 use nym_validator_client::nyxd::QueryNyxdClient;
+use nym_validator_client::Client;
 use std::error::Error;
 use tokio::sync::watch::error::SendError;

-pub use nym_client_core::client::key_manager::KeyManager;
-use nym_credential_storage::persistent_storage::PersistentStorage;
 pub use nym_sphinx::addressing::clients::Recipient;
 pub use nym_sphinx::receiver::ReconstructedMessage;
-use nym_validator_client::Client;

 pub mod config;

+type NativeClientBuilder<'a> = BaseClientBuilder<'a, Client<QueryNyxdClient>, OnDiskPersistent>;
+
 pub struct SocketClient {
    /// Client configuration options, including, among other things, packet sending rates,
    /// key filepaths, etc.
    config: Config,
-
-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
 }

 impl SocketClient {
    pub fn new(config: Config) -> Self {
-        let pathfinder = ClientKeyPathfinder::new_from_config(config.get_base());
-        let key_manager = KeyManager::load_keys(&pathfinder).expect("failed to load stored keys");
-
-        SocketClient {
-            config,
-            key_manager,
-        }
-    }
-
-    pub fn new_with_keys(config: Config, key_manager: KeyManager) -> Self {
-        SocketClient {
-            config,
-            key_manager,
-        }
+        SocketClient { config }
    }

    async fn create_bandwidth_controller(
        config: &Config,
    ) -> BandwidthController<Client<QueryNyxdClient>, PersistentStorage> {
-        let details = nym_network_defaults::NymNetworkDetails::new_from_env();
-        let mut client_config =
-            nym_validator_client::Config::try_from_nym_network_details(&details)
-                .expect("failed to construct validator client config");
-        let nyxd_url = config
-            .get_base()
-            .get_validator_endpoints()
-            .pop()
-            .expect("No nyxd validator endpoint provided");
-        let api_url = config
-            .get_base()
-            .get_nym_api_endpoints()
-            .pop()
-            .expect("No validator api endpoint provided");
-        // overwrite env configuration with config URLs
-        client_config = client_config.with_urls(nyxd_url, api_url);
-        let client = nym_validator_client::Client::new_query(client_config)
-            .expect("Could not construct query client");
-        BandwidthController::new(
-            nym_credential_storage::initialise_persistent_storage(
-                config.get_base().get_database_path(),
-            )
-            .await,
-            client,
+        let storage = nym_credential_storage::initialise_persistent_storage(
+            config.get_base().get_database_path(),
        )
+        .await;
+
+        create_bandwidth_controller(config.get_base(), storage)
    }

    fn start_websocket_listener(
@@ -134,11 +103,13 @@ impl SocketClient {
        res
    }

-    pub async fn start_socket(self) -> Result<TaskManager, ClientError> {
-        if !self.config.get_socket_type().is_websocket() {
-            return Err(ClientError::InvalidSocketMode);
-        }
+    fn key_store(&self) -> OnDiskKeys {
+        let pathfinder = ClientKeyPathfinder::new_from_config(self.config.get_base());
+        OnDiskKeys::new(pathfinder)
+    }

+    // TODO: see if this could also be shared with socks5 client / nym-sdk maybe
+    async fn create_base_client_builder(&self) -> Result<NativeClientBuilder, ClientError> {
        // don't create bandwidth controller if credentials are disabled
        let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
            None
@@ -146,19 +117,28 @@ impl SocketClient {
            Some(Self::create_bandwidth_controller(&self.config).await)
        };

-        let base_builder = BaseClientBuilder::new_from_base_config(
+        let base_client = BaseClientBuilder::new_from_base_config(
            self.config.get_base(),
-            self.key_manager,
+            self.key_store(),
            bandwidth_controller,
            non_wasm_helpers::setup_fs_reply_surb_backend(
-                Some(self.config.get_base().get_reply_surb_database_path()),
-                self.config.get_debug_settings(),
+                self.config.get_base().get_reply_surb_database_path(),
+                &self.config.get_debug_settings().reply_surbs,
            )
            .await?,
        );

-        let self_address = base_builder.as_mix_recipient();
+        Ok(base_client)
+    }
+
+    pub async fn start_socket(self) -> Result<TaskManager, ClientError> {
+        if !self.config.get_socket_type().is_websocket() {
+            return Err(ClientError::InvalidSocketMode);
+        }
+
+        let base_builder = self.create_base_client_builder().await?;
        let mut started_client = base_builder.start_base().await?;
+        let self_address = started_client.address;
        let client_input = started_client.client_input.register_producer();
        let client_output = started_client.client_output.register_consumer();
        let client_state = started_client.client_state;
@@ -173,7 +153,7 @@ impl SocketClient {
        );

        info!("Client startup finished!");
-        info!("The address of this client is: {}", self_address);
+        info!("The address of this client is: {self_address}");

        Ok(started_client.task_manager)
    }
@@ -183,27 +163,9 @@ impl SocketClient {
            return Err(ClientError::InvalidSocketMode);
        }

-        // don't create bandwidth controller if credentials are disabled
-        let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
-            None
-        } else {
-            Some(Self::create_bandwidth_controller(&self.config).await)
-        };
-
-        let base_client = BaseClientBuilder::new_from_base_config(
-            self.config.get_base(),
-            self.key_manager,
-            bandwidth_controller,
-            non_wasm_helpers::setup_fs_reply_surb_backend(
-                Some(self.config.get_base().get_reply_surb_database_path()),
-                self.config.get_debug_settings(),
-            )
-            .await?,
-        );
-
-        let address = base_client.as_mix_recipient();
-
-        let mut started_client = base_client.start_base().await?;
+        let base_builder = self.create_base_client_builder().await?;
+        let mut started_client = base_builder.start_base().await?;
+        let address = started_client.address;
        let client_input = started_client.client_input.register_producer();
        let client_output = started_client.client_output.register_consumer();

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.15"
+version = "1.1.20"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -34,7 +34,14 @@ import {
  StakeSaturationResponse,
  UnbondedMixnodeResponse,
  VestingAccountInfo,
-  ContractState, VestingAccountsCoinPaged, VestingAccountsPaged, DelegationTimes, Delegations, Period, VestingAccountNode, DelegationBlock
+  ContractState,
+  VestingAccountsCoinPaged,
+  VestingAccountsPaged,
+  DelegationTimes,
+  Delegations,
+  Period,
+  VestingAccountNode,
+  DelegationBlock,
 } from '@nymproject/types';
 import QueryClient from './query-client';
 import SigningClient, { ISigningClient } from './signing-client';
@@ -207,7 +214,7 @@ export default class ValidatorClient implements INymClient {
    let mixNodes: UnbondedMixnodeResponse[] = [];
    const limit = 50;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedUnbondedMixnodesResponse = await this.client.getUnbondedMixNodes(
        this.mixnetContract,
@@ -230,7 +237,7 @@ export default class ValidatorClient implements INymClient {
    let mixNodes: MixNodeBond[] = [];
    const limit = 50;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedMixNodeBondResponse = await this.client.getMixNodeBonds(
        this.mixnetContract,
@@ -252,7 +259,7 @@ export default class ValidatorClient implements INymClient {
    let mixNodes: MixNodeDetails[] = [];
    const limit = 50;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedMixNodeDetailsResponse = await this.client.getMixNodesDetailed(
        this.mixnetContract,
@@ -284,7 +291,7 @@ export default class ValidatorClient implements INymClient {
    let delegations: Delegation[] = [];
    const limit = 250;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedMixDelegationsResponse = await this.client.getMixNodeDelegationsPaged(
        this.mixnetContract,
@@ -307,7 +314,7 @@ export default class ValidatorClient implements INymClient {
    let delegations: Delegation[] = [];
    const limit = 250;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedDelegatorDelegationsResponse = await this.client.getDelegatorDelegationsPaged(
        this.mixnetContract,
@@ -330,7 +337,7 @@ export default class ValidatorClient implements INymClient {
    let delegations: Delegation[] = [];
    const limit = 250;
    let startAfter;
-    for (; ;) {
+    for (;;) {
      // eslint-disable-next-line no-await-in-loop
      const pagedResponse: PagedAllDelegationsResponse = await this.client.getAllDelegationsPaged(
        this.mixnetContract,
@@ -518,11 +525,9 @@ export default class ValidatorClient implements INymClient {
    return (this.client as ISigningClient).updateContractStateParams(this.mixnetContract, newParams, fee, memo);
  }

-
-  // VESTING 
+  // VESTING
  // TODO - MOVE TO A DIFFERENT FILE

-
  public async getVestingAccountsPaged(): Promise<VestingAccountsPaged> {
    return this.client.getVestingAccountsPaged(this.vestingContract);
  }
@@ -608,9 +613,9 @@ export default class ValidatorClient implements INymClient {
  }

  public async getDelegation(address: string, mix_id: number): Promise<DelegationBlock> {
-    return this.client.getDelegation(this.vestingContract, address, mix_id );
+    return this.client.getDelegation(this.vestingContract, address, mix_id);
  }
- 
+
  public async getTotalDelegationAmount(address: string, mix_id: number, block_timestamp_sec: number): Promise<Coin> {
    return this.client.getTotalDelegationAmount(this.vestingContract, address, mix_id, block_timestamp_sec);
  }
@@ -618,4 +623,10 @@ export default class ValidatorClient implements INymClient {
  public async getCurrentVestingPeriod(address: string): Promise<Period> {
    return this.client.getCurrentVestingPeriod(this.vestingContract, address);
  }
+
+  // SIMULATE
+
+  public async simulateSend(signingAddress: string, from: string, to: string, amount: Coin[]) {
+    return (this.client as SigningClient).simulateSend(signingAddress, from, to, amount);
+  }
 }
@@ -40,9 +40,18 @@ import {
  RewardingParams,
  UnbondedMixnodeResponse,
  VestingAccountInfo,
-  ContractState, VestingAccountsCoinPaged, VestingAccountsPaged, DelegationTimes, Delegations, Period, VestingAccountNode, DelegationBlock
+  ContractState,
+  VestingAccountsCoinPaged,
+  VestingAccountsPaged,
+  DelegationTimes,
+  Delegations,
+  Period,
+  VestingAccountNode,
+  DelegationBlock,
 } from '@nymproject/types';
 import NymApiQuerier from './nym-api-querier';
+import { makeBankMsgSend } from './utils';
+import { ISimulateClient } from './types/simulate';

 // methods exposed by `SigningCosmWasmClient`
 export interface ICosmWasmSigning {
@@ -148,7 +157,7 @@ export interface INymSigning {
  clientAddress: string;
 }

-export interface ISigningClient extends IQueryClient, ICosmWasmSigning, INymSigning {
+export interface ISigningClient extends IQueryClient, ICosmWasmSigning, INymSigning, ISimulateClient {
  bondMixNode(
    mixnetContractAddress: string,
    mixNode: MixNode,
@@ -511,11 +520,11 @@ export default class SigningClient extends SigningCosmWasmClient implements ISig
    );
  }

-  // vesting related 
+  // vesting related

  getVestingAccountsPaged(vestingContractAddress: string): Promise<VestingAccountsPaged> {
    return this.nyxdQuerier.getVestingAccountsPaged(vestingContractAddress);
-  };
+  }

  getVestingAmountsAccountsPaged(vestingContractAddress: string): Promise<VestingAccountsCoinPaged> {
    return this.nyxdQuerier.getVestingAmountsAccountsPaged(vestingContractAddress);
@@ -569,7 +578,10 @@ export default class SigningClient extends SigningCosmWasmClient implements ISig
    return this.nyxdQuerier.getEndTime(vestingContractAddress, vestingAccountAddress);
  }

-  getOriginalVestingDetails(vestingContractAddress: string, vestingAccountAddress: string): Promise<OriginalVestingResponse> {
+  getOriginalVestingDetails(
+    vestingContractAddress: string,
+    vestingAccountAddress: string,
+  ): Promise<OriginalVestingResponse> {
    return this.nyxdQuerier.getOriginalVestingDetails(vestingContractAddress, vestingAccountAddress);
  }

@@ -589,7 +601,11 @@ export default class SigningClient extends SigningCosmWasmClient implements ISig
    return this.nyxdQuerier.getGateway(vestingContractAddress, address);
  }

-  getDelegationTimes(vestingContractAddress: string, mix_id: number, delegatorAddress: string): Promise<DelegationTimes> {
+  getDelegationTimes(
+    vestingContractAddress: string,
+    mix_id: number,
+    delegatorAddress: string,
+  ): Promise<DelegationTimes> {
    return this.nyxdQuerier.getDelegationTimes(vestingContractAddress, mix_id, delegatorAddress);
  }

@@ -597,15 +613,38 @@ export default class SigningClient extends SigningCosmWasmClient implements ISig
    return this.nyxdQuerier.getAllDelegations(vestingContractAddress);
  }

-  getDelegation(vestingContractAddress: string, vestingAccountAddress: string, mix_id: number): Promise<DelegationBlock> {
+  getDelegation(
+    vestingContractAddress: string,
+    vestingAccountAddress: string,
+    mix_id: number,
+  ): Promise<DelegationBlock> {
    return this.nyxdQuerier.getDelegation(vestingContractAddress, vestingAccountAddress, mix_id);
  }

-  getTotalDelegationAmount(vestingContractAddress: string, vestingAccountAddress: string, mix_id: number, block_timestamp_sec: number): Promise<Coin> {
-    return this.nyxdQuerier.getTotalDelegationAmount(vestingContractAddress, vestingAccountAddress, mix_id, block_timestamp_sec);
+  getTotalDelegationAmount(
+    vestingContractAddress: string,
+    vestingAccountAddress: string,
+    mix_id: number,
+    block_timestamp_sec: number,
+  ): Promise<Coin> {
+    return this.nyxdQuerier.getTotalDelegationAmount(
+      vestingContractAddress,
+      vestingAccountAddress,
+      mix_id,
+      block_timestamp_sec,
+    );
  }

  getCurrentVestingPeriod(vestingContractAddress: string, address: string): Promise<Period> {
    return this.nyxdQuerier.getCurrentVestingPeriod(vestingContractAddress, address);
  }
+
+  // simulation
+
+  // TODO consider adding multipling factor
+
+  simulateSend(signingAddress: string, from: string, to: string, amount: Coin[]) {
+    const sendMsg = makeBankMsgSend(from, to, amount);
+    return this.simulate(signingAddress, [sendMsg], 'simulate send tx');
+  }
 }
@@ -0,0 +1,31 @@
+import expect from 'expect';
+import ValidatorClient from '../..';
+
+const dotenv = require('dotenv');
+
+dotenv.config();
+
+// TODO: implement for QA with .env for mnemonics
+describe('Simualtions', () => {
+  let client: ValidatorClient;
+
+  beforeEach(async () => {
+    client = await ValidatorClient.connect(
+      process.env.mnemonic || '',
+      process.env.rpcAddress || '',
+      process.env.validatorAddress || '',
+      process.env.prefix || '',
+      process.env.mixnetContractAddress || '',
+      process.env.vestingContractAddress || '',
+      process.env.denom || '',
+    );
+  });
+
+  it('can simulate sending tokens', async () => {
+    const res = await client.simulateSend(client.address, client.address, client.address, [
+      { amount: '400000', denom: 'unym' },
+    ]);
+
+    expect(typeof res).toBe('number');
+  }).timeout(10000);
+});
@@ -0,0 +1,5 @@
+import { Coin } from '@cosmjs/proto-signing';
+
+export interface ISimulateClient {
+  simulateSend(signingAddress: string, from: string, to: string, amount: Coin[]): Promise<number>;
+}
@@ -0,0 +1,2 @@
+[build]
+target = "wasm32-unknown-unknown"
@@ -17,29 +17,39 @@ default = ["console_error_panic_hook"]
 offline-test = []

 [dependencies]
+async-trait = "0.1.68"
+bs58 = "0.4.0"
 futures = "0.3"
 js-sys = "0.3"
 rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 anyhow = "1.0"
-serde-wasm-bindgen = "0.4"
+serde-wasm-bindgen = "0.5"
 tokio = { version = "1.24.1", features = ["sync"] }
 url = "2.2"
 wasm-bindgen = { version = "=0.2.83", features = ["serde-serialize"]  }
 wasm-bindgen-futures = "0.4"
+thiserror = "1.0.40"
+zeroize = "1.6.0"
+
+wasm-timer = { git = "https://github.com/mmsinclair/wasm-timer", rev = "b9d1a54ad514c2f230a026afe0dde341e98cd7b6"}

 # internal
+nym-node-tester-utils = { path = "../../common/node-tester-utils" }
 nym-client-core = { path = "../../common/client-core", default-features = false, features = ["wasm"] }
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-credentials = { path = "../../common/credentials" }
 nym-credential-storage = { path = "../../common/credential-storage" }
-nym-crypto = { path = "../../common/crypto" }
+nym-crypto = { path = "../../common/crypto", features = ["asymmetric", "serde"] }
 nym-sphinx = { path = "../../common/nymsphinx" }
+nym-sphinx-acknowledgements = { path = "../../common/nymsphinx/acknowledgements", features = ["serde"]}
+nym-topology = { path = "../../common/topology" }
+nym-gateway-client = { path = "../../common/client-libs/gateway-client", default-features = false, features = ["wasm"] }
 nym-validator-client = { path = "../../common/client-libs/validator-client", default-features = false }
-wasm-utils = { path = "../../common/wasm-utils" }
 nym-task = { path = "../../common/task" }
+wasm-utils = { path = "../../common/wasm-utils", features = ["storage"], default-features = false }
 # The `console_error_panic_hook` crate provides better debugging of panics by
 # logging them with `console.error`. This is great for development, but requires
 # all the `std::fmt` and `std::panicking` infrastructure, so isn't great for
@@ -57,7 +67,7 @@ wee_alloc = { version = "0.4", optional = true }
 wasm-bindgen-test = "0.3"

 [package.metadata.wasm-pack.profile.release]
-wasm-opt = true
+wasm-opt = false

 [profile.release]
 lto = true
@@ -0,0 +1,2 @@
+node_modules
+dist
@@ -0,0 +1,5 @@
+// A dependency graph that contains any wasm must all be imported
+// asynchronously. This `bootstrap.js` file does the single async import, so
+// that no one else needs to worry about it again.
+import('./index.js')
+    .catch(e => console.error('Error importing `index.js`:', e));
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Nym WebAssembly Demo</title>
+</head>
+
+<body>
+<p>
+    <label>Sender: </label><input disabled="true" size="85" type="text" id="sender" value="">
+</p>
+
+<p>
+    <label>Recipient: </label><input size="85" type="text" id="recipient" value="">
+</p>
+<p>
+    <label>Message: </label><input type="text" id="message" value="Hello mixnet!">
+</p>
+<p>
+    <button id="send-button">Send</button>
+</p>
+
+<div>
+    <label>Mixnode Identity: </label>
+    <input type="text" size = "60" id="mixnode_identity" value="...">
+    <button id="magic-button">✨ Magic Test Button ✨</button>
+</div>
+
+
+<p>Send messages from your browser, through the mixnet, and to the recipient using the "send" button.</p>
+<p><span style='color: blue;'>Sent</span> messages show in blue, <span style='color: green;'>received</span>
+    messages show in green.</p>
+
+<hr>
+<p>
+    <span id="output"></span>
+</p>
+<script src="./bootstrap.js"></script>
+</body>
+
+</html>
@@ -0,0 +1,170 @@
+// Copyright 2020-2023 Nym Technologies SA
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+class WebWorkerClient {
+    worker = null;
+
+    constructor() {
+        this.worker = new Worker('./worker.js');
+
+        this.worker.onmessage = (ev) => {
+            if (ev.data && ev.data.kind) {
+                switch (ev.data.kind) {
+                    case 'Ready':
+                        const {selfAddress} = ev.data.args;
+                        displaySenderAddress(selfAddress);
+                        break;
+                    case 'ReceiveMessage':
+                        const {message, senderTag, isTestPacket } = ev.data.args;
+                        displayReceived(message, senderTag, isTestPacket);
+                        break;
+                    case 'DisableMagicTestButton':
+                        const magicButton = document.querySelector('#magic-button');
+                        magicButton.setAttribute('disabled', "true")
+                        break;
+                    case 'DisplayTesterResults':
+                        const {score, sentPackets, receivedPackets, receivedAcks, duplicatePackets, duplicateAcks} = ev.data.args;
+                        const resultText = `Test score: ${score}. Sent ${sentPackets} packets. Received ${receivedPackets} packets and ${receivedAcks} acks back. We also got ${duplicatePackets} duplicate packets and ${duplicateAcks} duplicate acks.`
+                        displayReceivedRawString(resultText)
+                        break;
+                }
+            }
+        };
+    }
+
+    sendMessage = (message, recipient) => {
+        if (!this.worker) {
+            console.error('Could not send message because worker does not exist');
+            return;
+        }
+
+        this.worker.postMessage({
+            kind: 'SendMessage',
+            args: {
+                message, recipient,
+            },
+        });
+    };
+
+    sendTestPacket = (mixnodeIdentity) => {
+        if (!this.worker) {
+            console.error('Could not send message because worker does not exist');
+            return;
+        }
+
+        this.worker.postMessage({
+            kind: 'TestPacket',
+            args: {
+                mixnodeIdentity,
+            },
+        });
+    }
+}
+
+let client = null;
+
+async function main() {
+    client = new WebWorkerClient();
+
+    const sendButton = document.querySelector('#send-button');
+    sendButton.onclick = function () {
+        sendMessageTo();
+    };
+
+    const magicButton = document.querySelector('#magic-button');
+    magicButton.onclick = function () {
+        sendTestPacket();
+    }
+}
+
+/**
+ * Create a Sphinx packet and send it to the mixnet through the gateway node.
+ *
+ * Message and recipient are taken from the values in the user interface.
+ *
+ */
+async function sendMessageTo() {
+    const message = document.getElementById('message').value;
+    const recipient = document.getElementById('recipient').value;
+
+    await client.sendMessage(message, recipient);
+    displaySend(message);
+}
+
+async function sendTestPacket() {
+    const mixnodeIdentity = document.getElementById('mixnode_identity').value;
+
+    await client.sendTestPacket(mixnodeIdentity)
+    displaySend(`sending test packets to: ${mixnodeIdentity}...`);
+}
+
+/**
+ * Display messages that have been sent up the websocket. Colours them blue.
+ *
+ * @param {string} message
+ */
+function displaySend(message) {
+    let timestamp = new Date().toISOString().substr(11, 12);
+
+    let sendDiv = document.createElement('div');
+    let paragraph = document.createElement('p');
+    paragraph.setAttribute('style', 'color: blue');
+    let paragraphContent = document.createTextNode(timestamp + ' sent >>> ' + message);
+    paragraph.appendChild(paragraphContent);
+
+    sendDiv.appendChild(paragraph);
+    document.getElementById('output').appendChild(sendDiv);
+}
+
+/**
+ * Display received text messages in the browser. Colour them green.
+ *
+ * @param {Uint8Array} raw
+ */
+function displayReceived(raw, sender_tag, isTestPacket) {
+    let content = new TextDecoder().decode(raw);
+    if (sender_tag !== undefined) {
+        console.log("this message also contained some surbs from", sender_tag)
+    }
+
+    if (isTestPacket) {
+        const decoded = JSON.parse(content)
+        content = `Received packet ${decoded.msg_id} / ${decoded.total_msgs} for node ${decoded.encoded_node_identity} (test: ${decoded.test_id})`
+    }
+
+    displayReceivedRawString(content)
+}
+
+
+function displayReceivedRawString(raw) {
+    let timestamp = new Date().toISOString().substr(11, 12);
+    let receivedDiv = document.createElement('div');
+    let paragraph = document.createElement('p');
+    paragraph.setAttribute('style', 'color: green');
+    let paragraphContent = document.createTextNode(timestamp + ' received >>> ' + raw);
+    paragraph.appendChild(paragraphContent);
+    receivedDiv.appendChild(paragraph);
+    document.getElementById('output').appendChild(receivedDiv);
+}
+
+/**
+ * Display the nymClient's sender address in the user interface
+ *
+ * @param {String} address
+ */
+function displaySenderAddress(address) {
+    document.getElementById('sender').value = address;
+}
+
+main();
@@ -0,0 +1,39 @@
+{
+  "name": "create-wasm-app",
+  "version": "0.1.0",
+  "description": "create an app to consume rust-generated wasm packages",
+  "main": "index.js",
+  "bin": {
+    "create-wasm-app": ".bin/create-wasm-app.js"
+  },
+  "scripts": {
+    "build": "webpack --config webpack.config.js",
+    "start": "webpack-dev-server --port 8001"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rustwasm/create-wasm-app.git"
+  },
+  "keywords": [
+    "webassembly",
+    "wasm",
+    "rust",
+    "webpack"
+  ],
+  "author": "Dave Hrycyszyn <futurechimp@users.noreply.github.com>",
+  "license": "Apache-2.0",
+  "bugs": {
+    "url": "https://github.com/nymtech/nym/issues"
+  },
+  "homepage": "https://nymtech.net/docs",
+  "devDependencies": {
+    "copy-webpack-plugin": "^10.2.4",
+    "hello-wasm-pack": "^0.1.0",
+    "webpack": "^5.70.0",
+    "webpack-cli": "^4.9.2",
+    "webpack-dev-server": "^4.7.4"
+  },
+  "dependencies": {
+    "@nymproject/nym-client-wasm": "file:../pkg"
+  }
+}
@@ -0,0 +1,33 @@
+const CopyWebpackPlugin = require('copy-webpack-plugin');
+const path = require('path');
+
+module.exports = {
+    performance: {
+        hints: false,
+        maxEntrypointSize: 512000,
+        maxAssetSize: 512000
+    },
+    entry: {
+        bootstrap: './bootstrap.js',
+        worker: './worker.js',
+    },
+    output: {
+        path: path.resolve(__dirname, 'dist'),
+        filename: '[name].js',
+    },
+    // mode: 'development',
+    mode: 'production',
+    plugins: [
+        new CopyWebpackPlugin({
+            patterns: [
+                'index.html',
+                {
+                    from: 'node_modules/@nymproject/nym-client-wasm/*.(js|wasm)',
+                    to: '[name][ext]',
+                },
+            ],
+        }),
+
+    ],
+    experiments: { syncWebAssembly: true },
+};
@@ -0,0 +1,348 @@
+// Copyright 2020-2023 Nym Technologies SA
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+importScripts('nym_client_wasm.js');
+
+console.log('Initializing worker');
+
+// wasm_bindgen creates a global variable (with the exports attached) that is in scope after `importScripts`
+const {
+    NymNodeTester,
+    WasmGateway,
+    WasmMixNode,
+    WasmNymTopology,
+    default_debug,
+    NymClientBuilder,
+    NymClient,
+    set_panic_hook,
+    Config,
+    GatewayEndpointConfig,
+    ClientStorage,
+    current_network_topology,
+    make_key,
+    make_key2
+} = wasm_bindgen;
+
+let client = null;
+let tester = null;
+
+function dummyTopology() {
+    const l1Mixnode = new WasmMixNode(
+        1,
+        'n1fzv4jc7fanl9s0qj02ge2ezk3kts545kjtek47',
+        '178.79.143.65',
+        1789,
+        '4Yr4qmEHd9sgsuQ83191FR2hD88RfsbMmB4tzhhZWriz',
+        '8ndjk5oZ6HxUZNScLJJ7hk39XtUqGexdKgW7hSX6kpWG',
+        1,
+        '1.10.0',
+    );
+    const l2Mixnode = new WasmMixNode(
+        2,
+        'n1z93z44vf8ssvdhujjvxcj4rd5e3lz0l60wdk70',
+        '109.74.197.180',
+        1789,
+        '7sVjiMrPYZrDWRujku9QLxgE8noT7NTgBAqizCsu7AoK',
+        'GepXwRnKZDd8x2nBWAajGGBVvF3mrpVMQBkgfrGuqRCN',
+        2,
+        '1.10.0',
+    );
+    const l3Mixnode = new WasmMixNode(
+        3,
+        'n1ptg680vnmef2cd8l0s9uyc4f0hgf3x8sed6w77',
+        '176.58.101.80',
+        1789,
+        'FoM5Mx9Pxk1g3zEqkS3APgtBeTtTo3M8k7Yu4bV6kK1R',
+        'DeYjrDC2AcQRVFshiKnbUo6bRvPyZ33QGYR2DLeFJ9qD',
+        3,
+        '1.10.0',
+    );
+
+    const gateway = new WasmGateway(
+        'n16evnn8glr0sham3matj8rg2s24m6x56ayk87ts',
+        '85.159.212.96',
+        1789,
+        9000,
+        '336yuXAeGEgedRfqTJZsG2YV7P13QH1bHv1SjCZYarc9',
+        'BtYjoWihiuFihGKQypmpSspbhmWDPxzqeTVSd8ciCpWL',
+        '1.10.1',
+    );
+
+    const mixnodes = new Map();
+    mixnodes.set(1, [l1Mixnode]);
+    mixnodes.set(2, [l2Mixnode]);
+    mixnodes.set(3, [l3Mixnode]);
+
+
+    const gateways = [gateway];
+
+    return new WasmNymTopology(mixnodes, gateways)
+}
+
+function printAndDisplayTestResult(result) {
+    result.log_details();
+
+    self.postMessage({
+        kind: 'DisplayTesterResults',
+        args: {
+            score: result.score(),
+            sentPackets: result.sent_packets,
+            receivedPackets: result.received_packets,
+            receivedAcks: result.received_acks,
+            duplicatePackets: result.duplicate_packets,
+            duplicateAcks: result.duplicate_acks,
+        },
+    });
+}
+
+function dummyGatewayConfig() {
+    return new GatewayEndpointConfig(
+        '336yuXAeGEgedRfqTJZsG2YV7P13QH1bHv1SjCZYarc9',
+        'n1rqqw8km7a0rvf8lr6k8dsdqvvkyn2mglj7xxfm',
+        'ws://85.159.212.96:9000',
+    )
+}
+
+async function testWithTester() {
+    const gatewayConfig = dummyGatewayConfig();
+
+    // A) construct with hardcoded topology
+    const topology = dummyTopology()
+    const nodeTester = await new NymNodeTester(gatewayConfig, topology);
+
+    // B) first get topology directly from nym-api
+    // const validator = 'https://qwerty-validator-api.qa.nymte.ch/api';
+    // const topology = await current_network_topology(validator)
+    // const nodeTester = await new NymNodeTester(gatewayConfig, topology);
+    //
+    // C) use nym-api in the constructor (note: it does no filtering for 'good' nodes on other layers)
+    // const validator = 'https://qwerty-validator-api.qa.nymte.ch/api';
+    // const nodeTester = await NymNodeTester.new_with_api(gatewayConfig, validator)
+
+    self.onmessage = async event => {
+        if (event.data && event.data.kind) {
+            switch (event.data.kind) {
+                case 'TestPacket': {
+                    const {mixnodeIdentity} = event.data.args;
+                    console.log("starting node test...");
+
+                    let result = await nodeTester.test_node(mixnodeIdentity);
+                    printAndDisplayTestResult(result)
+                }
+            }
+        }
+    };
+}
+
+async function testWithNymClient() {
+    const gatewayConfig = dummyGatewayConfig();
+    const topology = dummyTopology()
+
+    let received = 0
+
+    const onMessageHandler = (message) => {
+        received += 1;
+        self.postMessage({
+            kind: 'ReceiveMessage',
+            args: {
+                message,
+                senderTag: undefined,
+                isTestPacket: true,
+            },
+        });
+
+        // it's really up to the user to create proper callback here...
+        console.log(`received ${received} packets so far`)
+    };
+
+    console.log('Instantiating WASM client...');
+
+    let clientBuilder = NymClientBuilder.new_tester(gatewayConfig, topology, onMessageHandler)
+    console.log('Web worker creating WASM client...');
+    let local_client = await clientBuilder.start_client();
+    console.log('WASM client running!');
+
+    const selfAddress = local_client.self_address();
+
+    // set the global (I guess we don't have to anymore?)
+    client = local_client;
+
+    console.log(`Client address is ${selfAddress}`);
+    self.postMessage({
+        kind: 'Ready',
+        args: {
+            selfAddress,
+        },
+    });
+
+    // Set callback to handle messages passed to the worker.
+    self.onmessage = async event => {
+        console.log(event)
+        if (event.data && event.data.kind) {
+            switch (event.data.kind) {
+                case 'SendMessage': {
+                    const {message, recipient} = event.data.args;
+                    let uint8Array = new TextEncoder().encode(message);
+                    await client.send_regular_message(uint8Array, recipient);
+                    break;
+                }
+                case 'TestPacket': {
+                    const {mixnodeIdentity} = event.data.args;
+                    const req = await client.try_construct_test_packet_request(mixnodeIdentity);
+                    await client.change_hardcoded_topology(req.injectable_topology());
+                    await client.try_send_test_packets(req);
+                    break;
+                }
+            }
+        }
+    };
+}
+
+async function normalNymClientUsage() {
+    self.postMessage({kind: 'DisableMagicTestButton'});
+
+    // only really useful if you want to adjust some settings like traffic rate
+    // (if not needed you can just pass a null)
+    const debug = default_debug();
+
+    debug.disable_main_poisson_packet_distribution = true;
+    debug.disable_loop_cover_traffic_stream = true;
+    debug.use_extended_packet_size = false;
+    // debug.average_packet_delay_ms = BigInt(10);
+    // debug.average_ack_delay_ms = BigInt(10);
+    // debug.ack_wait_addition_ms = BigInt(3000);
+    // debug.ack_wait_multiplier = 10;
+
+    debug.topology_refresh_rate_ms = BigInt(60000)
+
+    const gatewayConfig = dummyGatewayConfig();
+    const validator = 'https://qwerty-validator-api.qa.nymte.ch/api';
+
+    const config = new Config('my-awesome-wasm-client', validator, gatewayConfig, debug);
+
+    const onMessageHandler = (message) => {
+        console.log(message);
+        self.postMessage({
+            kind: 'ReceiveMessage',
+            args: {
+                message,
+            },
+        });
+    };
+
+    console.log('Instantiating WASM client...');
+
+    let localClient = await new NymClient(config, onMessageHandler)
+    console.log('WASM client running!');
+
+    const selfAddress = localClient.self_address();
+
+    // set the global (I guess we don't have to anymore?)
+    client = localClient;
+
+    console.log(`Client address is ${selfAddress}`);
+    self.postMessage({
+        kind: 'Ready',
+        args: {
+            selfAddress,
+        },
+    });
+
+    // Set callback to handle messages passed to the worker.
+    self.onmessage = async event => {
+        console.log(event)
+        if (event.data && event.data.kind) {
+            switch (event.data.kind) {
+                case 'SendMessage': {
+                    const {message, recipient} = event.data.args;
+                    let uint8Array = new TextEncoder().encode(message);
+                    await client.send_regular_message(uint8Array, recipient);
+                    break;
+                }
+            }
+        }
+    };
+}
+
+async function messWithStorage() {
+    self.onmessage = async event => {
+        if (event.data && event.data.kind) {
+            switch (event.data.kind) {
+                case 'TestPacket': {
+                    const { mixnodeIdentity } = event.data.args;
+                    console.log("button clicked...", mixnodeIdentity);
+
+                    let id1 = "one";
+                    let id2 = "two";
+
+                    console.log("making store1 NO-ENC");
+                    let _storage1 = await ClientStorage.new_unencrypted(id1);
+
+                    console.log("making store2 ENC")
+                    let _storage2 = await new ClientStorage(id2, "my-secret-password");
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store1 WITH PASSWORD")
+                    //     let _storage1_alt = await new ClientStorage(id1, "password");
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store2 WITHOUT PASSWORD")
+                    //     let _storage2_alt = await ClientStorage.new_unencrypted(id2);
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store2 with WRONG PASSWORD")
+                    //     let _storage2_bad = await new ClientStorage(id2, "bad-password")
+
+
+                    //
+                    // console.log("read1: ", await storage1.read());
+                    // console.log("read2: ", await storage2.read());
+                    //
+                    // console.log("store1: ", await storage1.store("FOOMP"));
+                    //
+                    // console.log("read1: ", await storage1.read());
+                    // console.log("read2: ", await storage2.read());
+                }
+            }
+        }
+    };
+
+
+
+
+}
+
+async function main() {
+    // load WASM package
+    await wasm_bindgen('nym_client_wasm_bg.wasm');
+    console.log('Loaded WASM');
+
+    // sets up better stack traces in case of in-rust panics
+    set_panic_hook();
+
+    // run test on simplified and dedicated tester:
+    // await testWithTester()
+
+    // hook-up the whole client for testing
+    // await testWithNymClient()
+
+    // 'Normal' client setup (to send 'normal' messages)
+    await normalNymClientUsage()
+}
+
+// Let's get started!
+main();
@@ -25,7 +25,7 @@ pub struct Config {
    /// ID specifies the human readable ID of this particular client.
    pub(crate) id: String,

-    pub(crate) nym_api_url: Url,
+    pub(crate) nym_api_url: Option<Url>,

    pub(crate) disabled_credentials_mode: bool,

@@ -46,9 +46,11 @@ impl Config {
    ) -> Self {
        Config {
            id,
-            nym_api_url: validator_server
-                .parse()
-                .expect("provided url was malformed"),
+            nym_api_url: Some(
+                validator_server
+                    .parse()
+                    .expect("provided url was malformed"),
+            ),
            disabled_credentials_mode: true,
            gateway_endpoint,
            debug: debug.map(Into::into).unwrap_or_default(),
@@ -229,6 +231,11 @@ pub struct Topology {
    /// path. This timeout determines waiting period until it is decided that the packet
    /// did not reach its destination.
    pub topology_resolution_timeout_ms: u64,
+
+    /// Specifies whether the client should not refresh the network topology after obtaining
+    /// the first valid instance.
+    /// Supersedes `topology_refresh_rate_ms`.
+    pub disable_refreshing: bool,
 }

 impl From<Topology> for ConfigTopology {
@@ -238,6 +245,7 @@ impl From<Topology> for ConfigTopology {
            topology_resolution_timeout: Duration::from_millis(
                topology.topology_resolution_timeout_ms,
            ),
+            disable_refreshing: topology.disable_refreshing,
        }
    }
 }
@@ -247,6 +255,7 @@ impl From<ConfigTopology> for Topology {
        Topology {
            topology_refresh_rate_ms: topology.topology_refresh_rate.as_millis() as u64,
            topology_resolution_timeout_ms: topology.topology_resolution_timeout.as_millis() as u64,
+            disable_refreshing: topology.disable_refreshing,
        }
    }
 }
@@ -1,16 +1,42 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::error::WasmClientError;
+use crate::tester::helpers::WasmTestMessageExt;
+use crate::tester::{NodeTestMessage, DEFAULT_TEST_PACKETS};
+use crate::topology::WasmNymTopology;
 use js_sys::Promise;
-use nym_client_core::client::base_client::ClientInput;
+use nym_client_core::client::base_client::{ClientInput, ClientState};
 use nym_client_core::client::inbound_messages::InputMessage;
+use nym_topology::{MixLayer, NymTopology};
 use std::sync::Arc;
+use wasm_bindgen::prelude::*;
 use wasm_bindgen::JsValue;
 use wasm_bindgen_futures::future_to_promise;
+use wasm_utils::{console_log, simple_js_error};
+
+#[wasm_bindgen]
+pub struct NymClientTestRequest {
+    // serialized NodeTestMessage
+    pub(crate) test_msgs: Vec<Vec<u8>>,
+
+    // specially constructed network topology that only contains the target
+    // node on the tested layer
+    pub(crate) testable_topology: NymTopology,
+}
+
+#[wasm_bindgen]
+impl NymClientTestRequest {
+    pub fn injectable_topology(&self) -> WasmNymTopology {
+        self.testable_topology.clone().into()
+    }
+}

 // defining helper trait as we could directly call the method on the wrapper
 pub(crate) trait InputSender {
    fn send_message(&self, message: InputMessage) -> Promise;
+
+    fn send_messages(&self, messages: Vec<InputMessage>) -> Promise;
 }

 impl InputSender for Arc<ClientInput> {
@@ -19,12 +45,114 @@ impl InputSender for Arc<ClientInput> {
        future_to_promise(async move {
            match this.input_sender.send(message).await {
                Ok(_) => Ok(JsValue::null()),
-                Err(_) => {
-                    let js_error =
-                        js_sys::Error::new("InputMessageReceiver has stopped receiving!");
-                    Err(JsValue::from(js_error))
-                }
+                Err(_) => Err(simple_js_error(
+                    "InputMessageReceiver has stopped receiving!",
+                )),
            }
        })
    }
+
+    fn send_messages(&self, messages: Vec<InputMessage>) -> Promise {
+        let this = Arc::clone(self);
+        future_to_promise(async move {
+            for message in messages {
+                if this.input_sender.send(message).await.is_err() {
+                    return Err(simple_js_error(
+                        "InputMessageReceiver has stopped receiving!",
+                    ));
+                }
+            }
+            Ok(JsValue::null())
+        })
+    }
+}
+
+pub(crate) trait WasmTopologyExt {
+    /// Changes the current network topology to the provided value.
+    fn change_hardcoded_topology(&self, topology: WasmNymTopology) -> Promise;
+
+    /// Returns the current network topology.
+    fn current_topology(&self) -> Promise;
+
+    /// Checks whether the provided node exists in the known network topology and if so, returns its layer.
+    fn check_for_mixnode_existence(&self, mixnode_identity: String) -> Promise;
+
+    /// Creates a `NymClientTestRequest` with a variant of `this` topology where the target node is the only one on its layer.
+    fn mix_test_request(
+        &self,
+        test_id: u32,
+        mixnode_identity: String,
+        num_test_packets: Option<u32>,
+    ) -> Promise;
+}
+
+impl WasmTopologyExt for Arc<ClientState> {
+    fn change_hardcoded_topology(&self, topology: WasmNymTopology) -> Promise {
+        let this = Arc::clone(self);
+        future_to_promise(async move {
+            let nym_topology: NymTopology = topology.into();
+            console_log!("changing topology to {nym_topology:?}");
+            this.topology_accessor
+                .manually_change_topology(nym_topology)
+                .await;
+            Ok(JsValue::null())
+        })
+    }
+
+    fn current_topology(&self) -> Promise {
+        let this = Arc::clone(self);
+        future_to_promise(async move {
+            match this.topology_accessor.current_topology().await {
+                Some(topology) => Ok(JsValue::from(WasmNymTopology::from(topology))),
+                None => Err(WasmClientError::UnavailableNetworkTopology.into()),
+            }
+        })
+    }
+
+    /// Checks whether the target mixnode exists in the known network topology and returns its layer.
+    fn check_for_mixnode_existence(&self, mixnode_identity: String) -> Promise {
+        let this = Arc::clone(self);
+        future_to_promise(async move {
+            let Some(current_topology) = this.topology_accessor.current_topology().await else {
+                return Err(WasmClientError::UnavailableNetworkTopology.into())
+            };
+
+            match current_topology.find_mix_by_identity(&mixnode_identity) {
+                None => Err(WasmClientError::NonExistentMixnode { mixnode_identity }.into()),
+                Some(node) => Ok(JsValue::from(MixLayer::from(node.layer))),
+            }
+        })
+    }
+
+    fn mix_test_request(
+        &self,
+        test_id: u32,
+        mixnode_identity: String,
+        num_test_packets: Option<u32>,
+    ) -> Promise {
+        let num_test_packets = num_test_packets.unwrap_or(DEFAULT_TEST_PACKETS);
+
+        let this = Arc::clone(self);
+        future_to_promise(async move {
+            let Some(current_topology) = this.topology_accessor.current_topology().await else {
+                return Err(WasmClientError::UnavailableNetworkTopology.into())
+            };
+
+            let Some(mix) = current_topology.find_mix_by_identity(&mixnode_identity) else {
+                return Err(WasmClientError::NonExistentMixnode { mixnode_identity }.into());
+            };
+
+            let ext = WasmTestMessageExt::new(test_id);
+            let test_msgs = NodeTestMessage::mix_plaintexts(mix, num_test_packets, ext)
+                .map_err(WasmClientError::from)?;
+
+            let mut updated = current_topology.clone();
+            updated.set_mixes_in_layer(mix.layer.into(), vec![mix.to_owned()]);
+
+            Ok(JsValue::from(NymClientTestRequest {
+                test_msgs,
+                testable_topology: updated,
+            }))
+        })
+    }
 }
@@ -1,27 +1,37 @@
-// Copyright 2021-2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use self::config::Config;
-use crate::client::helpers::InputSender;
+use crate::client::helpers::{InputSender, NymClientTestRequest, WasmTopologyExt};
 use crate::client::response_pusher::ResponsePusher;
+use crate::constants::NODE_TESTER_CLIENT_ID;
+use crate::error::WasmClientError;
+use crate::helpers::{parse_recipient, parse_sender_tag, setup_reply_surb_storage_backend};
+use crate::storage::traits::FullWasmClientStorage;
+use crate::storage::ClientStorage;
+use crate::topology::WasmNymTopology;
 use js_sys::Promise;
 use nym_bandwidth_controller::wasm_mockups::{Client as FakeClient, DirectSigningNyxdClient};
 use nym_bandwidth_controller::BandwidthController;
 use nym_client_core::client::base_client::{
-    BaseClientBuilder, ClientInput, ClientOutput, CredentialsToggle,
+    BaseClientBuilder, ClientInput, ClientOutput, ClientState, CredentialsToggle,
 };
+use nym_client_core::client::inbound_messages::InputMessage;
 use nym_client_core::client::replies::reply_storage::browser_backend;
-use nym_client_core::client::{inbound_messages::InputMessage, key_manager::KeyManager};
+use nym_client_core::config::{
+    CoverTraffic, DebugConfig, GatewayEndpointConfig, Topology, Traffic,
+};
 use nym_credential_storage::ephemeral_storage::EphemeralStorage;
-use nym_sphinx::addressing::clients::Recipient;
-use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_task::connections::TransmissionLane;
 use nym_task::TaskManager;
+use nym_topology::provider_trait::{HardcodedTopologyProvider, TopologyProvider};
+use nym_topology::NymTopology;
 use rand::rngs::OsRng;
+use rand::RngCore;
 use std::sync::Arc;
 use wasm_bindgen::prelude::*;
 use wasm_bindgen_futures::future_to_promise;
-use wasm_utils::{console_error, console_log};
+use wasm_utils::{check_promise_result, console_log, PromisableResult};

 pub mod config;
 mod helpers;
@@ -31,6 +41,11 @@ mod response_pusher;
 pub struct NymClient {
    self_address: String,
    client_input: Arc<ClientInput>,
+    client_state: Arc<ClientState>,
+
+    // keep track of the "old" topology for the purposes of node tester
+    // so that it could be restored after the check is done
+    _full_topology: Option<NymTopology>,

    // even though we don't use graceful shutdowns, other components rely on existence of this struct
    // and if it's dropped, everything will start going offline
@@ -40,10 +55,9 @@ pub struct NymClient {
 #[wasm_bindgen]
 pub struct NymClientBuilder {
    config: Config,
+    custom_topology: Option<NymTopology>,

-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
-
+    storage_passphrase: Option<String>,
    reply_surb_storage_backend: browser_backend::Backend,

    on_message: js_sys::Function,
@@ -57,121 +71,208 @@ pub struct NymClientBuilder {
 #[wasm_bindgen]
 impl NymClientBuilder {
    #[wasm_bindgen(constructor)]
-    pub fn new(config: Config, on_message: js_sys::Function) -> Self {
-        //, key_manager: Option<KeyManager>) {
+    pub fn new(
+        config: Config,
+        on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
+    ) -> Self {
        NymClientBuilder {
-            reply_surb_storage_backend: Self::setup_reply_surb_storage_backend(&config),
+            reply_surb_storage_backend: setup_reply_surb_storage_backend(config.debug.reply_surbs),
            config,
-            key_manager: Self::setup_key_manager(),
+            custom_topology: None,
+            storage_passphrase,
            on_message,
            bandwidth_controller: None,
            disabled_credentials: true,
        }
    }

-    // TODO: once we make keys persistent, we'll require some kind of `init` method to generate
-    // a prior shared keypair between the client and the gateway
+    // no cover traffic
+    // no poisson delay
+    // hardcoded topology
+    // NOTE: you most likely want to use `[NymNodeTester]` instead.
+    pub fn new_tester(
+        gateway_config: GatewayEndpointConfig,
+        topology: WasmNymTopology,
+        on_message: js_sys::Function,
+    ) -> Self {
+        if !topology.ensure_contains(&gateway_config) {
+            panic!("the specified topology does not contain the gateway used by the client")
+        }

-    // perhaps this should be public?
-    fn setup_key_manager() -> KeyManager {
-        let mut rng = OsRng;
-        // for time being generate new keys each time...
-        console_log!("generated new set of keys");
-        KeyManager::new(&mut rng)
-    }
+        let full_config = Config {
+            id: NODE_TESTER_CLIENT_ID.to_string(),
+            nym_api_url: None,
+            disabled_credentials_mode: true,
+            gateway_endpoint: gateway_config,
+            debug: DebugConfig {
+                traffic: Traffic {
+                    disable_main_poisson_packet_distribution: true,
+                    ..Default::default()
+                },
+                cover_traffic: CoverTraffic {
+                    disable_loop_cover_traffic_stream: true,
+                    ..Default::default()
+                },
+                topology: Topology {
+                    disable_refreshing: true,
+                    ..Default::default()
+                },
+                ..Default::default()
+            },
+        };

-    // don't get too excited about the name, under the hood it's just a big fat placeholder
-    // with no persistence
-    fn setup_reply_surb_storage_backend(config: &Config) -> browser_backend::Backend {
-        browser_backend::Backend::new(
-            config
-                .debug
-                .reply_surbs
-                .minimum_reply_surb_storage_threshold,
-            config
-                .debug
-                .reply_surbs
-                .maximum_reply_surb_storage_threshold,
-        )
+        NymClientBuilder {
+            reply_surb_storage_backend: setup_reply_surb_storage_backend(
+                full_config.debug.reply_surbs,
+            ),
+            config: full_config,
+            custom_topology: Some(topology.into()),
+            on_message,
+            bandwidth_controller: None,
+            disabled_credentials: true,
+            storage_passphrase: None,
+        }
    }

    fn start_reconstructed_pusher(client_output: ClientOutput, on_message: js_sys::Function) {
        ResponsePusher::new(client_output, on_message).start()
    }

-    pub async fn start_client(self) -> Promise {
-        future_to_promise(async move {
-            console_log!("Starting the wasm client");
+    fn topology_provider(&mut self) -> Option<Box<dyn TopologyProvider>> {
+        if let Some(hardcoded_topology) = self.custom_topology.take() {
+            Some(Box::new(HardcodedTopologyProvider::new(hardcoded_topology)))
+        } else {
+            None
+        }
+    }

-            let disabled_credentials = if self.disabled_credentials {
-                CredentialsToggle::Disabled
-            } else {
-                CredentialsToggle::Enabled
-            };
+    async fn start_client_async(mut self) -> Result<NymClient, WasmClientError> {
+        console_log!("Starting the wasm client");

-            let base_builder = BaseClientBuilder::new(
-                &self.config.gateway_endpoint,
-                &self.config.debug,
-                self.key_manager,
-                self.bandwidth_controller,
-                self.reply_surb_storage_backend,
-                disabled_credentials,
-                vec![self.config.nym_api_url.clone()],
-            );
+        let maybe_topology_provider = self.topology_provider();

-            let self_address = base_builder.as_mix_recipient().to_string();
-            let mut started_client = match base_builder.start_base().await {
-                Ok(base_client) => base_client,
-                Err(err) => {
-                    let error_msg = format!("failed to start the base client components - {err}");
-                    console_error!("{}", error_msg);
-                    let js_error = js_sys::Error::new(&error_msg);
-                    return Err(JsValue::from(js_error));
-                }
-            };
+        let disabled_credentials = if self.disabled_credentials {
+            CredentialsToggle::Disabled
+        } else {
+            CredentialsToggle::Enabled
+        };

-            let client_input = started_client.client_input.register_producer();
-            let client_output = started_client.client_output.register_consumer();
+        let nym_api_endpoints = match self.config.nym_api_url {
+            Some(endpoint) => vec![endpoint],
+            None => Vec::new(),
+        };

-            Self::start_reconstructed_pusher(client_output, self.on_message);
+        // TODO: this will have to be re-used for surbs. but this is a problem for another PR.
+        let key_store =
+            ClientStorage::new_async(&self.config.id, self.storage_passphrase.take()).await?;

-            Ok(JsValue::from(NymClient {
-                self_address,
-                client_input: Arc::new(client_input),
-                _task_manager: started_client.task_manager,
-            }))
+        let mut base_builder: BaseClientBuilder<_, FullWasmClientStorage> = BaseClientBuilder::new(
+            &self.config.gateway_endpoint,
+            &self.config.debug,
+            key_store,
+            self.bandwidth_controller,
+            self.reply_surb_storage_backend,
+            disabled_credentials,
+            nym_api_endpoints,
+        );
+        if let Some(topology_provider) = maybe_topology_provider {
+            base_builder = base_builder.with_topology_provider(topology_provider);
+        }
+
+        let mut started_client = base_builder.start_base().await?;
+        let self_address = started_client.address.to_string();
+
+        let client_input = started_client.client_input.register_producer();
+        let client_output = started_client.client_output.register_consumer();
+
+        Self::start_reconstructed_pusher(client_output, self.on_message);
+
+        Ok(NymClient {
+            self_address,
+            client_input: Arc::new(client_input),
+            client_state: Arc::new(started_client.client_state),
+            _full_topology: None,
+            _task_manager: started_client.task_manager,
        })
    }
+
+    pub fn start_client(self) -> Promise {
+        future_to_promise(async move { self.start_client_async().await.into_promise_result() })
+    }
 }

 #[wasm_bindgen]
 impl NymClient {
+    async fn _new(
+        config: Config,
+        on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
+    ) -> Result<NymClient, WasmClientError> {
+        NymClientBuilder::new(config, on_message, storage_passphrase)
+            .start_client_async()
+            .await
+    }
+
+    #[wasm_bindgen(constructor)]
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(
+        config: Config,
+        on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
+    ) -> Promise {
+        future_to_promise(async move {
+            Self::_new(config, on_message, storage_passphrase)
+                .await
+                .into_promise_result()
+        })
+    }
+
    pub fn self_address(&self) -> String {
        self.self_address.clone()
    }

-    fn parse_recipient(recipient: &str) -> Result<Recipient, JsValue> {
-        match Recipient::try_from_base58_string(recipient) {
-            Ok(recipient) => Ok(recipient),
-            Err(err) => {
-                let error_msg = format!("{recipient} is not a valid Nym network recipient - {err}");
-                console_error!("{}", error_msg);
-                let js_error = js_sys::Error::new(&error_msg);
-                Err(JsValue::from(js_error))
-            }
-        }
+    pub fn try_construct_test_packet_request(
+        &self,
+        mixnode_identity: String,
+        num_test_packets: Option<u32>,
+    ) -> Promise {
+        // TODO: improve the source of rng (i.e. don't make it ephemeral...)
+        let mut ephemeral_rng = OsRng;
+        let test_id = ephemeral_rng.next_u32();
+        self.client_state
+            .mix_test_request(test_id, mixnode_identity, num_test_packets)
    }

-    fn parse_sender_tag(tag: &str) -> Result<AnonymousSenderTag, JsValue> {
-        match AnonymousSenderTag::try_from_base58_string(tag) {
-            Ok(tag) => Ok(tag),
-            Err(err) => {
-                let error_msg = format!("{tag} is not a valid Nym AnonymousSenderTag - {err}");
-                console_error!("{}", error_msg);
-                let js_error = js_sys::Error::new(&error_msg);
-                Err(JsValue::from(js_error))
-            }
-        }
+    pub fn change_hardcoded_topology(&self, topology: WasmNymTopology) -> Promise {
+        self.client_state.change_hardcoded_topology(topology)
+    }
+
+    pub fn current_network_topology(&self) -> Promise {
+        self.client_state.current_topology()
+    }
+
+    /// Sends a test packet through the current network topology.
+    /// It's the responsibility of the caller to ensure the correct topology has been injected and
+    /// correct onmessage handlers have been setup.
+    pub fn try_send_test_packets(&mut self, request: NymClientTestRequest) -> Promise {
+        // TOOD: use the premade packets instead
+        console_log!(
+            "Attempting to send {} test packets",
+            request.test_msgs.len()
+        );
+
+        // our address MUST BE valid
+        let recipient = parse_recipient(&self.self_address()).unwrap();
+
+        let lane = TransmissionLane::General;
+        let input_msgs = request
+            .test_msgs
+            .into_iter()
+            .map(|p| InputMessage::new_regular(recipient, p, lane))
+            .collect();
+
+        self.client_input.send_messages(input_msgs)
    }

    /// The simplest message variant where no additional information is attached.
@@ -184,10 +285,8 @@ impl NymClient {
            message.len() as f64 / 1024.0
        );

-        let recipient = match Self::parse_recipient(&recipient) {
-            Ok(recipient) => recipient,
-            Err(err) => return Promise::reject(&err),
-        };
+        let recipient = check_promise_result!(parse_recipient(&recipient));
+
        let lane = TransmissionLane::General;

        let input_msg = InputMessage::new_regular(recipient, message, lane);
@@ -213,10 +312,8 @@ impl NymClient {
            message.len() as f64 / 1024.0
        );

-        let recipient = match Self::parse_recipient(&recipient) {
-            Ok(recipient) => recipient,
-            Err(err) => return Promise::reject(&err),
-        };
+        let recipient = check_promise_result!(parse_recipient(&recipient));
+
        let lane = TransmissionLane::General;

        let input_msg = InputMessage::new_anonymous(recipient, message, reply_surbs, lane);
@@ -233,10 +330,8 @@ impl NymClient {
            message.len() as f64 / 1024.0
        );

-        let sender_tag = match Self::parse_sender_tag(&recipient_tag) {
-            Ok(recipient) => recipient,
-            Err(err) => return Promise::reject(&err),
-        };
+        let sender_tag = check_promise_result!(parse_sender_tag(&recipient_tag));
+
        let lane = TransmissionLane::General;

        let input_msg = InputMessage::new_reply(sender_tag, message, lane);
@@ -0,0 +1,5 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub(crate) const NODE_TESTER_ID: &str = "_nym-node-tester";
+pub(crate) const NODE_TESTER_CLIENT_ID: &str = "_nym-node-tester-client";
@@ -0,0 +1,106 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::storage::errors::ClientStorageError;
+use crate::topology::WasmTopologyError;
+use js_sys::Promise;
+use nym_client_core::error::ClientCoreError;
+use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
+use nym_gateway_client::error::GatewayClientError;
+use nym_node_tester_utils::error::NetworkTestingError;
+use nym_sphinx::addressing::clients::RecipientFormattingError;
+use nym_sphinx::anonymous_replies::requests::InvalidAnonymousSenderTagRepresentation;
+use nym_validator_client::ValidatorClientError;
+use thiserror::Error;
+use wasm_bindgen::JsValue;
+use wasm_utils::simple_js_error;
+
+// might as well start using well-defined error enum...
+#[derive(Debug, Error)]
+pub enum WasmClientError {
+    #[error(
+        "A node test is already in progress. Wait for it to finish before starting another one."
+    )]
+    TestInProgress,
+
+    #[error("experienced an issue with internal client components: {source}")]
+    BaseClientError {
+        #[from]
+        source: ClientCoreError,
+    },
+
+    #[error("The provided gateway identity is invalid: {source}")]
+    InvalidGatewayIdentity { source: Ed25519RecoveryError },
+
+    #[error("Gateway communication failure: {source}")]
+    GatewayClientError {
+        #[from]
+        source: GatewayClientError,
+    },
+
+    #[error("failed to query nym api: {source}")]
+    NymApiError {
+        #[from]
+        source: ValidatorClientError,
+    },
+
+    #[error("The provided topology was invalid: {source}")]
+    WasmTopologyError {
+        #[from]
+        source: WasmTopologyError,
+    },
+
+    #[error("failed to test the node: {source}")]
+    NodeTestingFailure {
+        #[from]
+        source: NetworkTestingError,
+    },
+
+    #[error("{raw} is not a valid url: {source}")]
+    MalformedUrl {
+        raw: String,
+        source: url::ParseError,
+    },
+
+    #[error("Network topology is currently unavailable")]
+    UnavailableNetworkTopology,
+
+    #[error("Mixnode {mixnode_identity} is not present in the current network topology")]
+    NonExistentMixnode { mixnode_identity: String },
+
+    #[error("{raw} is not a valid Nym network recipient: {source}")]
+    MalformedRecipient {
+        raw: String,
+        source: RecipientFormattingError,
+    },
+
+    #[error("{raw} is not a valid Nym AnonymousSenderTag: {source}")]
+    MalformedSenderTag {
+        raw: String,
+        source: InvalidAnonymousSenderTagRepresentation,
+    },
+
+    #[error(transparent)]
+    StorageError {
+        #[from]
+        source: ClientStorageError,
+    },
+}
+
+impl WasmClientError {
+    pub fn into_rejected_promise(self) -> Promise {
+        self.into()
+    }
+}
+
+impl From<WasmClientError> for JsValue {
+    fn from(value: WasmClientError) -> Self {
+        simple_js_error(value.to_string())
+    }
+}
+
+impl From<WasmClientError> for Promise {
+    fn from(value: WasmClientError) -> Self {
+        Promise::reject(&value.into())
+    }
+}
@@ -0,0 +1,74 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::WasmClientError;
+use crate::topology::WasmNymTopology;
+use js_sys::Promise;
+use nym_client_core::client::replies::reply_storage::browser_backend;
+use nym_client_core::config;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_topology::NymTopology;
+use nym_validator_client::NymApiClient;
+use url::Url;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen_futures::future_to_promise;
+use wasm_utils::PromisableResult;
+
+// don't get too excited about the name, under the hood it's just a big fat placeholder
+// with no persistence
+pub(crate) fn setup_reply_surb_storage_backend(
+    config: config::ReplySurbs,
+) -> browser_backend::Backend {
+    browser_backend::Backend::new(
+        config.minimum_reply_surb_storage_threshold,
+        config.maximum_reply_surb_storage_threshold,
+    )
+}
+
+pub(crate) fn parse_recipient(recipient: &str) -> Result<Recipient, WasmClientError> {
+    Recipient::try_from_base58_string(recipient).map_err(|source| {
+        WasmClientError::MalformedRecipient {
+            raw: recipient.to_string(),
+            source,
+        }
+    })
+}
+
+pub(crate) fn parse_sender_tag(tag: &str) -> Result<AnonymousSenderTag, WasmClientError> {
+    AnonymousSenderTag::try_from_base58_string(tag).map_err(|source| {
+        WasmClientError::MalformedSenderTag {
+            raw: tag.to_string(),
+            source,
+        }
+    })
+}
+
+pub(crate) async fn current_network_topology_async(
+    nym_api_url: String,
+) -> Result<WasmNymTopology, WasmClientError> {
+    let url: Url = match nym_api_url.parse() {
+        Ok(url) => url,
+        Err(source) => {
+            return Err(WasmClientError::MalformedUrl {
+                raw: nym_api_url,
+                source,
+            })
+        }
+    };
+
+    let api_client = NymApiClient::new(url);
+    let mixnodes = api_client.get_cached_active_mixnodes().await?;
+    let gateways = api_client.get_cached_gateways().await?;
+
+    Ok(NymTopology::from_detailed(mixnodes, gateways).into())
+}
+
+#[wasm_bindgen]
+pub fn current_network_topology(nym_api_url: String) -> Promise {
+    future_to_promise(async move {
+        current_network_topology_async(nym_api_url)
+            .await
+            .into_promise_result()
+    })
+}
@@ -1,4 +1,4 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use wasm_bindgen::prelude::*;
@@ -8,10 +8,23 @@ mod client;
 #[cfg(target_arch = "wasm32")]
 pub mod encoded_payload_helper;
 #[cfg(target_arch = "wasm32")]
+pub mod error;
+#[cfg(target_arch = "wasm32")]
 pub mod gateway_selector;
 #[cfg(target_arch = "wasm32")]
+pub mod storage;
+#[cfg(target_arch = "wasm32")]
+pub mod tester;
+#[cfg(target_arch = "wasm32")]
+pub mod topology;
+#[cfg(target_arch = "wasm32")]
 pub mod validation;

+#[cfg(target_arch = "wasm32")]
+mod helpers;
+
+mod constants;
+
 #[wasm_bindgen]
 pub fn set_panic_hook() {
    // When the `console_error_panic_hook` feature is enabled, we can call the
@@ -0,0 +1,25 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+use wasm_bindgen::JsValue;
+use wasm_utils::simple_js_error;
+use wasm_utils::storage::error::StorageError;
+
+#[derive(Debug, Error)]
+pub enum ClientStorageError {
+    #[error("failed to use the storage: {source}")]
+    StorageError {
+        #[from]
+        source: StorageError,
+    },
+
+    #[error("{typ} cryptographic key is not available in storage")]
+    CryptoKeyNotInStorage { typ: String },
+}
+
+impl From<ClientStorageError> for JsValue {
+    fn from(value: ClientStorageError) -> Self {
+        simple_js_error(value.to_string())
+    }
+}
@@ -0,0 +1,231 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::storage::errors::ClientStorageError;
+use js_sys::Promise;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_client::SharedKeys;
+use nym_sphinx::acknowledgements::AckKey;
+use std::sync::Arc;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen_futures::future_to_promise;
+use wasm_utils::storage::{IdbVersionChangeEvent, WasmStorage};
+use wasm_utils::PromisableResult;
+use zeroize::Zeroizing;
+
+pub(crate) mod errors;
+pub(crate) mod traits;
+
+const STORAGE_NAME_PREFIX: &str = "wasm-client-storage";
+const STORAGE_VERSION: u32 = 1;
+
+// v1 tables
+mod v1 {
+    // stores
+    pub const KEYS_STORE: &str = "keys";
+
+    // keys
+    pub const ED25519_IDENTITY_KEYPAIR: &str = "ed25519_identity_keypair";
+    pub const X25519_ENCRYPTION_KEYPAIR: &str = "x25519_encryption_key";
+
+    // TODO: for those we could actually use the subtle crypto storage
+    pub const AES128CTR_ACK_KEY: &str = "aes128ctr_ack_key";
+    pub const AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS: &str = "aes128ctr_blake3_hmac_gateway_keys";
+}
+
+#[wasm_bindgen]
+pub struct ClientStorage {
+    #[allow(dead_code)]
+    pub(crate) name: String,
+    pub(crate) inner: Arc<WasmStorage>,
+}
+
+#[wasm_bindgen]
+impl ClientStorage {
+    fn db_name(client_id: &str) -> String {
+        format!("{STORAGE_NAME_PREFIX}-{client_id}")
+    }
+
+    pub(crate) async fn new_async(
+        client_id: &str,
+        passphrase: Option<String>,
+    ) -> Result<Self, ClientStorageError> {
+        let name = Self::db_name(client_id);
+
+        // make sure the password is zeroized when no longer used, especially if we error out.
+        // special care must be taken on JS side to ensure it's correctly used there.
+        let passphrase = Zeroizing::new(passphrase);
+
+        let migrate_fn = Some(|evt: &IdbVersionChangeEvent| -> Result<(), JsValue> {
+            // Even if the web-sys bindings expose the version as a f64, the IndexedDB API
+            // works with an unsigned integer.
+            // See <https://github.com/rustwasm/wasm-bindgen/issues/1149>
+            let old_version = evt.old_version() as u32;
+
+            if old_version < 1 {
+                // migrating to version 1
+                let db = evt.db();
+
+                db.create_object_store(v1::KEYS_STORE)?;
+            }
+
+            Ok(())
+        });
+
+        let inner = WasmStorage::new(
+            &name,
+            STORAGE_VERSION,
+            migrate_fn,
+            passphrase.as_ref().map(|p| p.as_bytes()),
+        )
+        .await?;
+
+        Ok(ClientStorage {
+            inner: Arc::new(inner),
+            name,
+        })
+    }
+
+    #[wasm_bindgen(constructor)]
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(client_id: String, passphrase: String) -> Promise {
+        future_to_promise(async move {
+            Self::new_async(&client_id, Some(passphrase))
+                .await
+                .into_promise_result()
+        })
+    }
+
+    pub fn new_unencrypted(client_id: String) -> Promise {
+        future_to_promise(async move {
+            Self::new_async(&client_id, None)
+                .await
+                .into_promise_result()
+        })
+    }
+
+    async fn may_read_identity_keypair(
+        &self,
+    ) -> Result<Option<identity::KeyPair>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::ED25519_IDENTITY_KEYPAIR),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_encryption_keypair(
+        &self,
+    ) -> Result<Option<encryption::KeyPair>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::X25519_ENCRYPTION_KEYPAIR),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_ack_key(&self) -> Result<Option<AckKey>, ClientStorageError> {
+        self.inner
+            .read_value(v1::KEYS_STORE, JsValue::from_str(v1::AES128CTR_ACK_KEY))
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_gateway_shared_key(&self) -> Result<Option<SharedKeys>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn must_read_identity_keypair(&self) -> Result<identity::KeyPair, ClientStorageError> {
+        self.may_read_identity_keypair()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::ED25519_IDENTITY_KEYPAIR.to_string(),
+            })
+    }
+
+    async fn must_read_encryption_keypair(
+        &self,
+    ) -> Result<encryption::KeyPair, ClientStorageError> {
+        self.may_read_encryption_keypair()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::X25519_ENCRYPTION_KEYPAIR.to_string(),
+            })
+    }
+
+    async fn must_read_ack_key(&self) -> Result<AckKey, ClientStorageError> {
+        self.may_read_ack_key()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::AES128CTR_ACK_KEY.to_string(),
+            })
+    }
+
+    async fn must_read_gateway_shared_key(&self) -> Result<SharedKeys, ClientStorageError> {
+        self.may_read_gateway_shared_key()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS.to_string(),
+            })
+    }
+
+    async fn store_identity_keypair(
+        &self,
+        keypair: &identity::KeyPair,
+    ) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::ED25519_IDENTITY_KEYPAIR),
+                keypair,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_encryption_keypair(
+        &self,
+        keypair: &encryption::KeyPair,
+    ) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::X25519_ENCRYPTION_KEYPAIR),
+                keypair,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_ack_key(&self, key: &AckKey) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_ACK_KEY),
+                key,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_gateway_shared_key(&self, key: &SharedKeys) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS),
+                key,
+            )
+            .await
+            .map_err(Into::into)
+    }
+}
@@ -0,0 +1,76 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::storage::errors::ClientStorageError;
+use crate::storage::ClientStorage;
+use async_trait::async_trait;
+use nym_client_core::client::base_client::storage::MixnetClientStorage;
+use nym_client_core::client::key_manager::persistence::KeyStore;
+use nym_client_core::client::key_manager::KeyManager;
+use nym_client_core::client::replies::reply_storage::browser_backend;
+use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
+use wasm_utils::console_log;
+
+// temporary until other variants are properly implemented (probably it should get changed into `ClientStorage`
+// implementing all traits and everything getting combined
+pub struct FullWasmClientStorage {
+    key_store: ClientStorage,
+    reply_storage: browser_backend::Backend,
+    credential_storage: EphemeralCredentialStorage,
+}
+
+impl MixnetClientStorage for FullWasmClientStorage {
+    type KeyStore = ClientStorage;
+    type ReplyStore = browser_backend::Backend;
+    type CredentialStore = EphemeralCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_storage, self.credential_storage)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_storage
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_storage
+    }
+}
+
+#[async_trait(?Send)]
+impl KeyStore for ClientStorage {
+    type StorageError = ClientStorageError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        console_log!("attempting to load cryptographic keys...");
+
+        // all keys implement `ZeroizeOnDrop`, so if we return an Error, whatever was already loaded will be cleared
+        let identity_keypair = self.must_read_identity_keypair().await?;
+        let encryption_keypair = self.must_read_encryption_keypair().await?;
+        let ack_keypair = self.must_read_ack_key().await?;
+        let gateway_shared_key = self.must_read_gateway_shared_key().await?;
+
+        Ok(KeyManager::from_keys(
+            identity_keypair,
+            encryption_keypair,
+            gateway_shared_key,
+            ack_keypair,
+        ))
+    }
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError> {
+        console_log!("attempting to store cryptographic keys...");
+
+        self.store_identity_keypair(&keys.identity_keypair())
+            .await?;
+        self.store_encryption_keypair(&keys.encryption_keypair())
+            .await?;
+        self.store_ack_key(&keys.ack_key()).await?;
+        self.store_gateway_shared_key(&keys.gateway_shared_key())
+            .await
+    }
+}
@@ -0,0 +1,112 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::tester::helpers::{NodeTestResult, WasmTestMessageExt};
+use futures::StreamExt;
+use nym_node_tester_utils::processor::Received;
+use nym_node_tester_utils::receiver::ReceivedReceiver;
+use nym_sphinx::chunking::fragment::FragmentIdentifier;
+use std::collections::HashSet;
+use std::time::Duration;
+use tokio::sync::MutexGuard as AsyncMutexGuard;
+use wasm_utils::{console_error, console_log, console_warn};
+
+pub(crate) struct EphemeralTestReceiver<'a> {
+    sent_packets: u32,
+    expected_acks: HashSet<FragmentIdentifier>,
+
+    received_valid_messages: HashSet<u32>,
+    received_valid_acks: HashSet<FragmentIdentifier>,
+    duplicate_packets: u32,
+    duplicate_acks: u32,
+
+    timeout_duration: Duration,
+    receiver_permit: AsyncMutexGuard<'a, ReceivedReceiver<WasmTestMessageExt>>,
+}
+
+impl<'a> EphemeralTestReceiver<'a> {
+    pub(crate) fn finish(self) -> NodeTestResult {
+        NodeTestResult {
+            sent_packets: self.sent_packets,
+            received_packets: self.received_valid_messages.len() as u32,
+            received_acks: self.received_valid_acks.len() as u32,
+            duplicate_packets: self.duplicate_packets,
+            duplicate_acks: self.duplicate_acks,
+        }
+    }
+
+    pub(crate) fn new(
+        sent_packets: u32,
+        expected_acks: HashSet<FragmentIdentifier>,
+        receiver_permit: AsyncMutexGuard<'a, ReceivedReceiver<WasmTestMessageExt>>,
+        timeout: Duration,
+    ) -> Self {
+        EphemeralTestReceiver {
+            sent_packets,
+            expected_acks,
+            received_valid_messages: Default::default(),
+            received_valid_acks: Default::default(),
+            duplicate_packets: 0,
+            duplicate_acks: 0,
+            timeout_duration: timeout,
+            receiver_permit,
+        }
+    }
+
+    fn on_next_received_packet(&mut self, packet: Option<Received<WasmTestMessageExt>>) -> bool {
+        let Some(received_packet) = packet else {
+            // can't do anything more...
+            console_error!("packet receiver has stopped processing results!");
+            return true
+        };
+        match received_packet {
+            Received::Message(msg) => {
+                if !self.received_valid_messages.insert(msg.msg_id) {
+                    self.duplicate_packets += 1;
+                }
+            }
+            Received::Ack(frag_id) => {
+                if self.expected_acks.contains(&frag_id) {
+                    if !self.received_valid_acks.insert(frag_id) {
+                        self.duplicate_acks += 1
+                    }
+                } else {
+                    console_warn!("received an ack that was not part of the test! (id: {frag_id})")
+                }
+            }
+        }
+
+        if self.received_all() {
+            console_log!("already received all the packets! finishing the test...");
+            true
+        } else {
+            false
+        }
+    }
+
+    fn received_all(&self) -> bool {
+        self.received_valid_acks.len() == self.received_valid_messages.len()
+            && self.received_valid_acks.len() == self.sent_packets as usize
+    }
+
+    pub(crate) async fn perform_test(mut self) -> NodeTestResult {
+        let mut timeout_fut = wasm_timer::Delay::new(self.timeout_duration);
+
+        loop {
+            tokio::select! {
+                _ = &mut timeout_fut => {
+                    console_warn!("reached test timeout before receiving all packets.");
+                    break
+                }
+                received_packet = self.receiver_permit.next() => {
+                    let is_done = self.on_next_received_packet(received_packet);
+                    if is_done {
+                        break
+                    }
+                }
+            }
+        }
+
+        self.finish()
+    }
+}
@@ -0,0 +1,109 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// due to expansion of #[wasm_bindgen] macro on NodeTestResult
+#![allow(clippy::drop_non_drop)]
+
+use nym_node_tester_utils::processor::Received;
+use nym_node_tester_utils::receiver::ReceivedReceiver;
+use serde::{Deserialize, Serialize};
+use std::fmt::{Display, Formatter};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use tokio::sync::{Mutex as AsyncMutex, MutexGuard as AsyncMutexGuard};
+use wasm_bindgen::prelude::*;
+use wasm_utils::{console_log, console_warn};
+
+#[derive(Clone)]
+pub(super) struct ReceivedReceiverWrapper(Arc<AsyncMutex<ReceivedReceiver<WasmTestMessageExt>>>);
+
+impl ReceivedReceiverWrapper {
+    pub(super) fn new(inner: ReceivedReceiver<WasmTestMessageExt>) -> Self {
+        ReceivedReceiverWrapper(Arc::new(AsyncMutex::new(inner)))
+    }
+
+    pub(super) async fn clear_received_channel(&self) {
+        let mut lost_msgs = 0;
+        let mut lost_acks = 0;
+        let mut permit = self.0.lock().await;
+        while let Ok(Some(received)) = permit.try_next() {
+            match received {
+                Received::Message(_) => lost_msgs += 1,
+                Received::Ack(_) => lost_acks += 1,
+            }
+        }
+        if lost_msgs > 0 || lost_acks > 0 {
+            console_warn!("while preparing for the test run, we cleared {lost_msgs} messages and {lost_acks} acks that were received in the meantime.")
+        }
+    }
+
+    pub(super) async fn lock(&self) -> AsyncMutexGuard<'_, ReceivedReceiver<WasmTestMessageExt>> {
+        self.0.lock().await
+    }
+}
+
+#[derive(Serialize, Deserialize, Copy, Clone)]
+pub struct WasmTestMessageExt {
+    pub test_id: u32,
+}
+
+impl WasmTestMessageExt {
+    pub fn new(test_id: u32) -> Self {
+        WasmTestMessageExt { test_id }
+    }
+}
+
+// TODO: maybe put it in the tester utils
+#[wasm_bindgen]
+pub struct NodeTestResult {
+    pub sent_packets: u32,
+    pub received_packets: u32,
+    pub received_acks: u32,
+
+    pub duplicate_packets: u32,
+    pub duplicate_acks: u32,
+}
+
+impl Display for NodeTestResult {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        writeln!(f, "Test results: ")?;
+        writeln!(f, "Total score: {:.2}%", self.score())?;
+        writeln!(f, "Sent packets: {}", self.sent_packets)?;
+        writeln!(f, "Received (valid) packets: {}", self.received_packets)?;
+        writeln!(f, "Received (valid) acks: {}", self.received_acks)?;
+        writeln!(f, "Received duplicate packets: {}", self.duplicate_packets)?;
+        write!(f, "Received duplicate acks: {}", self.duplicate_acks)
+    }
+}
+
+#[wasm_bindgen]
+impl NodeTestResult {
+    pub fn log_details(&self) {
+        console_log!("{}", self)
+    }
+
+    pub fn score(&self) -> f32 {
+        let expected = self.sent_packets * 2;
+        let actual = (self.received_packets + self.received_acks)
+            .saturating_sub(self.duplicate_packets + self.duplicate_acks);
+
+        actual as f32 / expected as f32 * 100.
+    }
+}
+
+pub(crate) struct TestMarker {
+    value: Arc<AtomicBool>,
+}
+
+impl TestMarker {
+    pub fn new(value: Arc<AtomicBool>) -> Self {
+        Self { value }
+    }
+}
+
+impl Drop for TestMarker {
+    // make sure to clear the test flag when the marker is dropped
+    fn drop(&mut self) {
+        self.value.store(false, Ordering::SeqCst)
+    }
+}
@@ -0,0 +1,314 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::constants::NODE_TESTER_ID;
+use crate::error::WasmClientError;
+use crate::helpers::current_network_topology_async;
+use crate::storage::ClientStorage;
+use crate::tester::ephemeral_receiver::EphemeralTestReceiver;
+use crate::tester::helpers::{
+    NodeTestResult, ReceivedReceiverWrapper, TestMarker, WasmTestMessageExt,
+};
+use crate::topology::WasmNymTopology;
+use futures::channel::mpsc;
+use js_sys::Promise;
+use nym_bandwidth_controller::wasm_mockups::{Client as FakeClient, DirectSigningNyxdClient};
+use nym_bandwidth_controller::BandwidthController;
+use nym_client_core::client::key_manager::ManagedKeys;
+use nym_client_core::config::GatewayEndpointConfig;
+use nym_credential_storage::ephemeral_storage::EphemeralStorage;
+use nym_crypto::asymmetric::identity;
+use nym_gateway_client::GatewayClient;
+use nym_node_tester_utils::receiver::SimpleMessageReceiver;
+use nym_node_tester_utils::{NodeTester, TestMessage};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_sphinx::addressing::nodes::NodeIdentity;
+use nym_sphinx::params::PacketSize;
+use nym_sphinx::preparer::PreparedFragment;
+use nym_task::TaskManager;
+use nym_topology::NymTopology;
+use rand::rngs::OsRng;
+use std::collections::HashSet;
+use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
+use std::sync::{Arc, Mutex as SyncMutex};
+use std::time::Duration;
+use tokio::sync::Mutex as AsyncMutex;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen_futures::future_to_promise;
+use wasm_utils::{check_promise_result, console_log, PromisableResult};
+
+mod ephemeral_receiver;
+pub(crate) mod helpers;
+
+pub type NodeTestMessage = TestMessage<WasmTestMessageExt>;
+type LockedGatewayClient =
+    Arc<AsyncMutex<GatewayClient<FakeClient<DirectSigningNyxdClient>, EphemeralStorage>>>;
+
+pub(crate) const DEFAULT_TEST_TIMEOUT: Duration = Duration::from_secs(10);
+pub(crate) const DEFAULT_TEST_PACKETS: u32 = 20;
+
+#[wasm_bindgen]
+pub struct NymNodeTester {
+    test_in_progress: Arc<AtomicBool>,
+
+    // we need to increment the nonce between tests to distinguish the packets
+    // but we can't make the tester mutable because of wasm...
+    // so we're using the atomics
+    current_test_nonce: AtomicU32,
+
+    // blame all those mutexes on being unable to have an async method with internal mutability...
+    tester: Arc<SyncMutex<NodeTester<OsRng>>>,
+    gateway_client: LockedGatewayClient,
+
+    // we have to put it behind the lock due to wasm limitations and borrowing...
+    // the mutex acquisition should be instant as there aren't going to be any threads attempting
+    // to get simultaneous access
+    processed_receiver: ReceivedReceiverWrapper,
+
+    // even though we don't use graceful shutdowns, other components rely on existence of this struct
+    // and if it's dropped, everything will start going offline
+    _task_manager: TaskManager,
+}
+
+#[wasm_bindgen]
+pub struct NymNodeTesterBuilder {
+    gateway_config: GatewayEndpointConfig,
+
+    base_topology: NymTopology,
+
+    // unimplemented
+    bandwidth_controller:
+        Option<BandwidthController<FakeClient<DirectSigningNyxdClient>, EphemeralStorage>>,
+}
+
+fn address(keys: &ManagedKeys, gateway_identity: NodeIdentity) -> Recipient {
+    Recipient::new(
+        *keys.identity_public_key(),
+        *keys.encryption_public_key(),
+        gateway_identity,
+    )
+}
+
+#[wasm_bindgen]
+impl NymNodeTesterBuilder {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        gateway_config: GatewayEndpointConfig,
+        base_topology: WasmNymTopology,
+    ) -> NymNodeTesterBuilder {
+        NymNodeTesterBuilder {
+            gateway_config,
+            base_topology: base_topology.into(),
+            bandwidth_controller: None,
+        }
+    }
+
+    async fn _new_with_api(
+        gateway_config: GatewayEndpointConfig,
+        api_url: String,
+    ) -> Result<Self, WasmClientError> {
+        let topology = current_network_topology_async(api_url).await?;
+        Ok(NymNodeTesterBuilder::new(gateway_config, topology))
+    }
+
+    pub fn new_with_api(gateway_config: GatewayEndpointConfig, api_url: String) -> Promise {
+        future_to_promise(async move {
+            Self::_new_with_api(gateway_config, api_url)
+                .await
+                .into_promise_result()
+        })
+    }
+
+    async fn _setup_client(mut self) -> Result<NymNodeTester, WasmClientError> {
+        let mut rng = OsRng;
+        let task_manager = TaskManager::default();
+
+        let gateway_identity =
+            identity::PublicKey::from_base58_string(self.gateway_config.gateway_id)
+                .map_err(|source| WasmClientError::InvalidGatewayIdentity { source })?;
+
+        let key_store = ClientStorage::new_async(NODE_TESTER_ID, None).await?;
+        let mut managed_keys = ManagedKeys::load_or_generate(&mut rng, &key_store).await;
+
+        let (mixnet_message_sender, mixnet_message_receiver) = mpsc::unbounded();
+        let (ack_sender, ack_receiver) = mpsc::unbounded();
+
+        let mut gateway_client = GatewayClient::new(
+            self.gateway_config.gateway_listener,
+            managed_keys.identity_keypair(),
+            gateway_identity,
+            managed_keys.gateway_shared_key(),
+            mixnet_message_sender,
+            ack_sender,
+            Duration::from_secs(10),
+            self.bandwidth_controller.take(),
+            task_manager.subscribe(),
+        );
+
+        gateway_client.set_disabled_credentials_mode(true);
+        let shared_keys = gateway_client.authenticate_and_start().await?;
+        managed_keys
+            .deal_with_gateway_key(shared_keys, &key_store)
+            .await?;
+
+        // TODO: make those values configurable later
+        let tester = NodeTester::new(
+            rng,
+            self.base_topology,
+            Some(address(&managed_keys, gateway_identity)),
+            PacketSize::default(),
+            Duration::from_millis(5),
+            Duration::from_millis(5),
+            managed_keys.ack_key(),
+        );
+
+        let (processed_sender, processed_receiver) = mpsc::unbounded();
+
+        let mut receiver = SimpleMessageReceiver::new_sphinx_receiver(
+            managed_keys.encryption_keypair(),
+            managed_keys.ack_key(),
+            mixnet_message_receiver,
+            ack_receiver,
+            processed_sender,
+            task_manager.subscribe(),
+        );
+
+        nym_task::spawn(async move { receiver.run().await });
+
+        Ok(NymNodeTester {
+            test_in_progress: Arc::new(AtomicBool::new(false)),
+            current_test_nonce: Default::default(),
+            tester: Arc::new(SyncMutex::new(tester)),
+            gateway_client: Arc::new(AsyncMutex::new(gateway_client)),
+            processed_receiver: ReceivedReceiverWrapper::new(processed_receiver),
+            _task_manager: task_manager,
+        })
+    }
+
+    pub fn setup_client(self) -> Promise {
+        future_to_promise(async move { self._setup_client().await.into_promise_result() })
+    }
+}
+
+async fn test_mixnode(
+    test_packets: Vec<PreparedFragment>,
+    gateway_client: LockedGatewayClient,
+    processed_receiver: ReceivedReceiverWrapper,
+    _test_marker: TestMarker,
+    timeout: Duration,
+) -> Result<NodeTestResult, WasmClientError> {
+    let num_test_packets = test_packets.len() as u32;
+
+    let expected_ack_ids = test_packets
+        .iter()
+        .map(|p| p.fragment_identifier)
+        .collect::<HashSet<_>>();
+
+    let mix_packets = test_packets.into_iter().map(|p| p.mix_packet).collect();
+
+    // start by clearing any messages that might have been received between tests
+    processed_receiver.clear_received_channel().await;
+
+    // locking the gateway client so that we could get mutable access to data without having to declare
+    // self mutable
+    let mut gateway_permit = gateway_client.lock().await;
+    gateway_permit.batch_send_mix_packets(mix_packets).await?;
+
+    let receiver_permit = processed_receiver.lock().await;
+    let result =
+        EphemeralTestReceiver::new(num_test_packets, expected_ack_ids, receiver_permit, timeout)
+            .perform_test()
+            .await;
+
+    Ok(result)
+}
+
+#[wasm_bindgen]
+impl NymNodeTester {
+    #[wasm_bindgen(constructor)]
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(gateway_config: GatewayEndpointConfig, topology: WasmNymTopology) -> Promise {
+        console_log!("constructing node tester!");
+        NymNodeTesterBuilder::new(gateway_config, topology).setup_client()
+    }
+
+    async fn _new_with_api(
+        gateway_config: GatewayEndpointConfig,
+        api_url: String,
+    ) -> Result<Self, WasmClientError> {
+        NymNodeTesterBuilder::_new_with_api(gateway_config, api_url)
+            .await?
+            ._setup_client()
+            .await
+    }
+
+    pub fn new_with_api(gateway_config: GatewayEndpointConfig, api_url: String) -> Promise {
+        future_to_promise(async move {
+            Self::_new_with_api(gateway_config, api_url)
+                .await
+                .into_promise_result()
+        })
+    }
+
+    fn prepare_test_packets(
+        &self,
+        mixnode_identity: String,
+        test_nonce: u32,
+        num_test_packets: u32,
+    ) -> Result<Vec<PreparedFragment>, WasmClientError> {
+        let test_ext = WasmTestMessageExt::new(test_nonce);
+        let mut tester_permit = self.tester.lock().expect("mutex got poisoned");
+        tester_permit
+            .existing_identity_mixnode_test_packets(
+                mixnode_identity,
+                test_ext,
+                num_test_packets,
+                None,
+            )
+            .map_err(Into::into)
+    }
+
+    pub fn test_node(
+        &self,
+        mixnode_identity: String,
+        timeout_millis: Option<u64>,
+        num_test_packets: Option<u32>,
+    ) -> Promise {
+        // establish test parameters
+        let timeout = timeout_millis
+            .map(Duration::from_millis)
+            .unwrap_or(DEFAULT_TEST_TIMEOUT);
+        let num_test_packets = num_test_packets.unwrap_or(DEFAULT_TEST_PACKETS);
+
+        // mark start of the test
+        if self.test_in_progress.swap(true, Ordering::SeqCst) {
+            return WasmClientError::TestInProgress.into_rejected_promise();
+        }
+
+        // prepare test packets
+        // (I simultaneously feel both disgusted and amazed by this workaround)
+        let test_nonce = self.current_test_nonce.fetch_add(1, Ordering::Relaxed);
+        let test_packets = check_promise_result!(self.prepare_test_packets(
+            mixnode_identity,
+            test_nonce,
+            num_test_packets
+        ));
+
+        let processed_receiver_clone = self.processed_receiver.clone();
+        let gateway_client_clone = Arc::clone(&self.gateway_client);
+        let tester_marker = TestMarker::new(Arc::clone(&self.test_in_progress));
+
+        // start doing async things (send packets and watch for anything coming back)
+        future_to_promise(async move {
+            test_mixnode(
+                test_packets,
+                gateway_client_clone,
+                processed_receiver_clone,
+                tester_marker,
+                timeout,
+            )
+            .await
+            .into_promise_result()
+        })
+    }
+}
@@ -0,0 +1,262 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_client_core::config::GatewayEndpointConfig;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_topology::gateway::GatewayConversionError;
+use nym_topology::mix::{Layer, MixnodeConversionError};
+use nym_topology::{gateway, mix, MixLayer, NymTopology};
+use nym_validator_client::client::MixId;
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use thiserror::Error;
+use wasm_bindgen::prelude::wasm_bindgen;
+use wasm_bindgen::JsValue;
+use wasm_utils::{console_log, simple_js_error};
+
+#[derive(Debug, Error)]
+pub enum WasmTopologyError {
+    #[error("got invalid mix layer {value}. Expected 1, 2 or 3.")]
+    InvalidMixLayer { value: u8 },
+
+    #[error(transparent)]
+    GatewayConversion(#[from] GatewayConversionError),
+
+    #[error(transparent)]
+    MixnodeConversion(#[from] MixnodeConversionError),
+
+    #[error("The provided mixnode map was malformed: {source}")]
+    MalformedMixnodeMap { source: serde_wasm_bindgen::Error },
+
+    #[error("The provided gateway list was malformed: {source}")]
+    MalformedGatewayList { source: serde_wasm_bindgen::Error },
+}
+
+impl From<WasmTopologyError> for JsValue {
+    fn from(value: WasmTopologyError) -> Self {
+        simple_js_error(value.to_string())
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Debug)]
+pub struct WasmNymTopology {
+    inner: NymTopology,
+}
+
+#[wasm_bindgen]
+impl WasmNymTopology {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        // expected: BTreeMap<MixLayer, Vec<WasmMixNode>>,
+        // HashMap<MixLayer, Vec<WasmMixNode>> will also work because it has the same json representation
+        mixnodes: JsValue,
+        // expected: Vec<WasmGateway>
+        gateways: JsValue,
+    ) -> Result<WasmNymTopology, WasmTopologyError> {
+        let mixnodes: BTreeMap<MixLayer, Vec<WasmMixNode>> =
+            serde_wasm_bindgen::from_value(mixnodes)
+                .map_err(|source| WasmTopologyError::MalformedMixnodeMap { source })?;
+
+        let gateways: Vec<WasmGateway> = serde_wasm_bindgen::from_value(gateways)
+            .map_err(|source| WasmTopologyError::MalformedGatewayList { source })?;
+
+        let mut converted_mixes = BTreeMap::new();
+
+        for (layer, nodes) in mixnodes {
+            let layer_nodes = nodes
+                .into_iter()
+                .map(TryInto::try_into)
+                .collect::<Result<_, _>>()?;
+
+            converted_mixes.insert(layer, layer_nodes);
+        }
+
+        let gateways = gateways
+            .into_iter()
+            .map(TryInto::try_into)
+            .collect::<Result<_, _>>()?;
+
+        Ok(WasmNymTopology {
+            inner: NymTopology::new(converted_mixes, gateways),
+        })
+    }
+
+    pub(crate) fn ensure_contains(&self, gateway_config: &GatewayEndpointConfig) -> bool {
+        self.inner
+            .gateways()
+            .iter()
+            .any(|g| g.identity_key.to_base58_string() == gateway_config.gateway_id)
+    }
+
+    pub fn print(&self) {
+        if !self.inner.mixes().is_empty() {
+            console_log!("mixnodes:");
+            for (layer, nodes) in self.inner.mixes() {
+                console_log!("\tlayer {layer}:");
+                for node in nodes {
+                    console_log!("\t\t{} - {}", node.mix_id, node.identity_key)
+                }
+            }
+        } else {
+            console_log!("NO MIXNODES")
+        }
+
+        if !self.inner.gateways().is_empty() {
+            console_log!("gateways:");
+            for gateway in self.inner.gateways() {
+                console_log!("\t{}", gateway.identity_key)
+            }
+        } else {
+            console_log!("NO GATEWAYS")
+        }
+    }
+}
+
+impl From<WasmNymTopology> for NymTopology {
+    fn from(value: WasmNymTopology) -> Self {
+        value.inner
+    }
+}
+
+impl From<NymTopology> for WasmNymTopology {
+    fn from(value: NymTopology) -> Self {
+        WasmNymTopology { inner: value }
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct WasmMixNode {
+    pub mix_id: MixId,
+    #[wasm_bindgen(getter_with_clone)]
+    pub owner: String,
+    #[wasm_bindgen(getter_with_clone)]
+    pub host: String,
+    pub mix_port: u16,
+    #[wasm_bindgen(getter_with_clone)]
+    pub identity_key: String,
+    #[wasm_bindgen(getter_with_clone)]
+    pub sphinx_key: String,
+    pub layer: MixLayer,
+    #[wasm_bindgen(getter_with_clone)]
+    pub version: String,
+}
+
+#[wasm_bindgen]
+impl WasmMixNode {
+    #[wasm_bindgen(constructor)]
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        mix_id: MixId,
+        owner: String,
+        host: String,
+        mix_port: u16,
+        identity_key: String,
+        sphinx_key: String,
+        layer: MixLayer,
+        version: String,
+    ) -> Self {
+        Self {
+            mix_id,
+            owner,
+            host,
+            mix_port,
+            identity_key,
+            sphinx_key,
+            layer,
+            version,
+        }
+    }
+}
+
+impl TryFrom<WasmMixNode> for mix::Node {
+    type Error = WasmTopologyError;
+
+    fn try_from(value: WasmMixNode) -> Result<Self, Self::Error> {
+        let host = mix::Node::parse_host(&value.host)?;
+
+        // try to completely resolve the host in the mix situation to avoid doing it every
+        // single time we want to construct a path
+        let mix_host = mix::Node::extract_mix_host(&host, value.mix_port)?;
+
+        Ok(mix::Node {
+            mix_id: value.mix_id,
+            owner: value.owner,
+            host,
+            mix_host,
+            identity_key: identity::PublicKey::from_base58_string(&value.identity_key)
+                .map_err(MixnodeConversionError::from)?,
+            sphinx_key: encryption::PublicKey::from_base58_string(&value.sphinx_key)
+                .map_err(MixnodeConversionError::from)?,
+            layer: Layer::try_from(value.layer)
+                .map_err(|_| WasmTopologyError::InvalidMixLayer { value: value.layer })?,
+            version: value.version,
+        })
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct WasmGateway {
+    #[wasm_bindgen(getter_with_clone)]
+    pub owner: String,
+    #[wasm_bindgen(getter_with_clone)]
+    pub host: String,
+    pub mix_port: u16,
+    pub clients_port: u16,
+    #[wasm_bindgen(getter_with_clone)]
+    pub identity_key: String,
+    #[wasm_bindgen(getter_with_clone)]
+    pub sphinx_key: String,
+    #[wasm_bindgen(getter_with_clone)]
+    pub version: String,
+}
+
+#[wasm_bindgen]
+impl WasmGateway {
+    #[wasm_bindgen(constructor)]
+    pub fn new(
+        owner: String,
+        host: String,
+        mix_port: u16,
+        clients_port: u16,
+        identity_key: String,
+        sphinx_key: String,
+        version: String,
+    ) -> Self {
+        Self {
+            owner,
+            host,
+            mix_port,
+            clients_port,
+            identity_key,
+            sphinx_key,
+            version,
+        }
+    }
+}
+
+impl TryFrom<WasmGateway> for gateway::Node {
+    type Error = WasmTopologyError;
+
+    fn try_from(value: WasmGateway) -> Result<Self, Self::Error> {
+        let host = gateway::Node::parse_host(&value.host)?;
+
+        // try to completely resolve the host in the mix situation to avoid doing it every
+        // single time we want to construct a path
+        let mix_host = gateway::Node::extract_mix_host(&host, value.mix_port)?;
+
+        Ok(gateway::Node {
+            owner: value.owner,
+            host,
+            mix_host,
+            clients_port: value.clients_port,
+            identity_key: identity::PublicKey::from_base58_string(&value.identity_key)
+                .map_err(GatewayConversionError::from)?,
+            sphinx_key: encryption::PublicKey::from_base58_string(&value.sphinx_key)
+                .map_err(GatewayConversionError::from)?,
+            version: value.version,
+        })
+    }
+}
@@ -55,11 +55,16 @@ where
    Ok(state)
 }

-pub async fn get_credential<C: DkgQueryClient + Send + Sync, St: Storage>(
+pub async fn get_credential<C, St>(
    state: &State,
    client: &C,
    storage: &St,
-) -> Result<(), BandwidthControllerError> {
+) -> Result<(), BandwidthControllerError>
+where
+    C: DkgQueryClient + Send + Sync,
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
    let epoch_id = client.get_current_epoch().await?.epoch_id;
    let threshold = client
        .get_current_epoch_threshold()
@@ -83,7 +88,6 @@ pub async fn get_credential<C: DkgQueryClient + Send + Sync, St: Storage>(
            signature.to_bs58(),
            epoch_id.to_string(),
        )
-        .await?;
-
-    Ok(())
+        .await
+        .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
 }
@@ -16,7 +16,11 @@ pub enum BandwidthControllerError {
    Nyxd(#[from] nym_validator_client::nyxd::error::NyxdError),

    #[error("There was a credential storage error - {0}")]
-    CredentialStorageError(#[from] StorageError),
+    CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
+
+    // this should really be fully incorporated into the above, but messing with coconut is the last thing I want to do now
+    #[error(transparent)]
+    StorageError(#[from] StorageError),

    #[error("Coconut error - {0}")]
    CoconutError(#[from] CoconutError),
@@ -45,8 +45,13 @@ impl<C, St: Storage> BandwidthController<C, St> {
    ) -> Result<(nym_coconut_interface::Credential, i64), BandwidthControllerError>
    where
        C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
    {
-        let bandwidth_credential = self.storage.get_next_coconut_credential().await?;
+        let bandwidth_credential = self
+            .storage
+            .get_next_coconut_credential()
+            .await
+            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
        let voucher_value = u64::from_str(&bandwidth_credential.voucher_value)
            .map_err(|_| StorageError::InconsistentData)?;
        let voucher_info = bandwidth_credential.voucher_info.clone();
@@ -82,10 +87,16 @@ impl<C, St: Storage> BandwidthController<C, St> {
        ))
    }

-    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError> {
+    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError>
+    where
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
        // JS: shouldn't we send some contract/validator/gateway message here to actually, you know,
        // consume it?
-        Ok(self.storage.consume_coconut_credential(id).await?)
+        self.storage
+            .consume_coconut_credential(id)
+            .await
+            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
    }
 }

@@ -23,6 +23,7 @@ url = { version ="2.2", features = ["serde"] }
 tungstenite = { version = "0.13.0", default-features = false }
 tokio = { version = "1.24.1", features = ["macros"]}
 time = "0.3.17"
+zeroize = { workspace = true }

 # internal
 nym-bandwidth-controller = { path = "../bandwidth-controller" }
@@ -38,6 +39,7 @@ nym-topology = { path = "../topology" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
+nym-network-defaults = { path = "../network-defaults" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
 path = "../client-libs/validator-client"
@@ -1,6 +1,6 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
-//
+
 use crate::{client::replies::reply_storage, config::DebugConfig};

 pub fn setup_empty_reply_surb_backend(debug_config: &DebugConfig) -> reply_storage::Empty {
@@ -2,9 +2,11 @@
 // SPDX-License-Identifier: Apache-2.0

 use super::received_buffer::ReceivedBufferMessage;
+use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
-use crate::client::key_manager::KeyManager;
+use crate::client::key_manager::persistence::KeyStore;
+use crate::client::key_manager::ManagedKeys;
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
@@ -22,10 +24,11 @@ use crate::client::topology_control::{
 };
 use crate::config::{Config, DebugConfig, GatewayEndpointConfig};
 use crate::error::ClientCoreError;
-use crate::spawn_future;
+use crate::{config, spawn_future};
 use futures::channel::mpsc;
 use log::{debug, info};
 use nym_bandwidth_controller::BandwidthController;
+use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_gateway_client::{
    AcknowledgementReceiver, AcknowledgementSender, GatewayClient, MixnetMessageReceiver,
@@ -38,22 +41,21 @@ use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_task::{TaskClient, TaskManager};
 use nym_topology::provider_trait::TopologyProvider;
+use rand::thread_rng;
 use std::sync::Arc;
-use std::time::Duration;
 use tap::TapFallible;
 use url::Url;

-use nym_credential_storage::storage::Storage;
-#[cfg(not(target_arch = "wasm32"))]
-use nym_validator_client::nyxd::traits::DkgQueryClient;
-
 #[cfg(target_arch = "wasm32")]
 use nym_bandwidth_controller::wasm_mockups::DkgQueryClient;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_validator_client::nyxd::traits::DkgQueryClient;

 #[cfg(all(not(target_arch = "wasm32"), feature = "fs-surb-storage"))]
 pub mod non_wasm_helpers;

 pub mod helpers;
+pub mod storage;

 #[derive(Clone)]
 pub struct ClientInput {
@@ -152,31 +154,32 @@ impl From<bool> for CredentialsToggle {
    }
 }

-pub struct BaseClientBuilder<'a, B, C, St: Storage> {
+pub struct BaseClientBuilder<'a, C, S: MixnetClientStorage> {
    // due to wasm limitations I had to split it like this : (
    gateway_config: &'a GatewayEndpointConfig,
    debug_config: &'a DebugConfig,
    disabled_credentials: bool,
    nym_api_endpoints: Vec<Url>,
-    reply_storage_backend: B,
+    reply_storage_backend: S::ReplyStore,
+    key_store: S::KeyStore,

    custom_topology_provider: Option<Box<dyn TopologyProvider>>,
-    bandwidth_controller: Option<BandwidthController<C, St>>,
-    key_manager: KeyManager,
+    bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+    managed_keys: ManagedKeys,
 }

-impl<'a, B, C, St> BaseClientBuilder<'a, B, C, St>
+impl<'a, C, S> BaseClientBuilder<'a, C, S>
 where
-    B: ReplyStorageBackend + Send + Sync + 'static,
-    C: DkgQueryClient + Sync + Send + 'static,
-    St: Storage + 'static,
+    S: MixnetClientStorage + 'static,
+    C: DkgQueryClient + Send + Sync + 'static,
 {
+    // TODO: combine all storages
    pub fn new_from_base_config<T>(
        base_config: &'a Config<T>,
-        key_manager: KeyManager,
-        bandwidth_controller: Option<BandwidthController<C, St>>,
-        reply_storage_backend: B,
-    ) -> BaseClientBuilder<'a, B, C, St> {
+        key_store: S::KeyStore,
+        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        reply_storage_backend: S::ReplyStore,
+    ) -> BaseClientBuilder<'a, C, S> {
        BaseClientBuilder {
            gateway_config: base_config.get_gateway_endpoint_config(),
            debug_config: base_config.get_debug_config(),
@@ -184,20 +187,22 @@ where
            nym_api_endpoints: base_config.get_nym_api_endpoints(),
            bandwidth_controller,
            reply_storage_backend,
-            key_manager,
+            key_store,
+            managed_keys: ManagedKeys::Invalidated,
            custom_topology_provider: None,
        }
    }

+    // TODO: combine all storages
    pub fn new(
        gateway_config: &'a GatewayEndpointConfig,
        debug_config: &'a DebugConfig,
-        key_manager: KeyManager,
-        bandwidth_controller: Option<BandwidthController<C, St>>,
-        reply_storage_backend: B,
+        key_store: S::KeyStore,
+        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        reply_storage_backend: S::ReplyStore,
        credentials_toggle: CredentialsToggle,
        nym_api_endpoints: Vec<Url>,
-    ) -> BaseClientBuilder<'a, B, C, St> {
+    ) -> BaseClientBuilder<'a, C, S> {
        BaseClientBuilder {
            gateway_config,
            debug_config,
@@ -206,7 +211,8 @@ where
            reply_storage_backend,
            custom_topology_provider: None,
            bandwidth_controller,
-            key_manager,
+            key_store,
+            managed_keys: ManagedKeys::Invalidated,
        }
    }

@@ -215,10 +221,12 @@ where
        self
    }

-    pub fn as_mix_recipient(&self) -> Recipient {
+    // note: do **NOT** make this method public as its only valid usage is from within `start_base`
+    // because it relies on the crypto keys being already loaded
+    fn as_mix_recipient(&self) -> Recipient {
        Recipient::new(
-            *self.key_manager.identity_keypair().public_key(),
-            *self.key_manager.encryption_keypair().public_key(),
+            *self.managed_keys.identity_public_key(),
+            *self.managed_keys.encryption_public_key(),
            // TODO: below only works under assumption that gateway address == gateway id
            // (which currently is true)
            NodeIdentity::from_base58_string(&self.gateway_config.gateway_id).unwrap(),
@@ -308,7 +316,11 @@ where
        mixnet_message_sender: MixnetMessageSender,
        ack_sender: AcknowledgementSender,
        shutdown: TaskClient,
-    ) -> Result<GatewayClient<C, St>, ClientCoreError> {
+    ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
+    where
+        <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
        let gateway_id = self.gateway_config.gateway_id.clone();
        if gateway_id.is_empty() {
            return Err(ClientCoreError::GatewayIdUnknown);
@@ -321,19 +333,11 @@ where
        let gateway_identity = identity::PublicKey::from_base58_string(gateway_id)
            .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;

-        // disgusting wasm workaround since there's no key persistence there (nor `client init`)
-        let shared_key = if self.key_manager.is_gateway_key_set() {
-            Some(self.key_manager.gateway_shared_key())
-        } else {
-            log::info!("Gateway key not set! Will proceed anyway.");
-            None
-        };
-
        let mut gateway_client = GatewayClient::new(
            gateway_address,
-            self.key_manager.identity_keypair(),
+            self.managed_keys.identity_keypair(),
            gateway_identity,
-            shared_key,
+            self.managed_keys.gateway_shared_key(),
            mixnet_message_sender,
            ack_sender,
            self.debug_config
@@ -345,12 +349,20 @@ where

        gateway_client.set_disabled_credentials_mode(self.disabled_credentials);

-        gateway_client
+        let shared_key = gateway_client
            .authenticate_and_start()
            .await
            .tap_err(|err| {
                log::error!("Could not authenticate and start up the gateway connection - {err}")
            })?;
+
+        self.managed_keys
+            .deal_with_gateway_key(shared_key, &self.key_store)
+            .await
+            .map_err(|source| ClientCoreError::KeyStoreError {
+                source: Box::new(source),
+            })?;
+
        Ok(gateway_client)
    }

@@ -371,11 +383,12 @@ where
    // the current global view of topology
    async fn start_topology_refresher(
        topology_provider: Box<dyn TopologyProvider>,
-        refresh_rate: Duration,
+        topology_config: config::Topology,
        topology_accessor: TopologyAccessor,
-        shutdown: TaskClient,
+        mut shutdown: TaskClient,
    ) -> Result<(), ClientCoreError> {
-        let topology_refresher_config = TopologyRefresherConfig::new(refresh_rate);
+        let topology_refresher_config =
+            TopologyRefresherConfig::new(topology_config.topology_refresh_rate);

        let mut topology_refresher = TopologyRefresher::new(
            topology_refresher_config,
@@ -395,8 +408,17 @@ where
            return Err(ClientCoreError::InsufficientNetworkTopology(err));
        }

-        info!("Starting topology refresher...");
-        topology_refresher.start_with_shutdown(shutdown);
+        if topology_config.disable_refreshing {
+            // if we're not spawning the refresher, don't cause shutdown immediately
+            info!("The topology refesher is not going to be started");
+            shutdown.mark_as_success();
+        } else {
+            // don't spawn the refresher if we don't want to be refreshing the topology.
+            // only use the initial values obtained
+            info!("Starting topology refresher...");
+            topology_refresher.start_with_shutdown(shutdown);
+        }
+
        Ok(())
    }

@@ -405,55 +427,62 @@ where
    // over it. Perhaps GatewayClient needs to be thread-shareable or have some channel for
    // requests?
    fn start_mix_traffic_controller(
-        gateway_client: GatewayClient<C, St>,
+        gateway_client: GatewayClient<C, S::CredentialStore>,
        shutdown: TaskClient,
-    ) -> BatchMixMessageSender {
+    ) -> BatchMixMessageSender
+    where
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
        info!("Starting mix traffic controller...");
        let (mix_traffic_controller, mix_tx) = MixTrafficController::new(gateway_client);
        mix_traffic_controller.start_with_shutdown(shutdown);
        mix_tx
    }

+    // TODO: rename it as it implies the data is persistent whilst one can use InMemBackend
    async fn setup_persistent_reply_storage(
-        backend: B,
+        backend: S::ReplyStore,
        shutdown: TaskClient,
    ) -> Result<CombinedReplyStorage, ClientCoreError>
    where
-        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+        <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
+        S::ReplyStore: Send + Sync,
    {
-        if backend.is_active() {
-            log::trace!("Setup persistent reply storage");
-            let persistent_storage = PersistentReplyStorage::new(backend);
-            let mem_store = persistent_storage
-                .load_state_from_backend()
+        log::trace!("Setup persistent reply storage");
+        let persistent_storage = PersistentReplyStorage::new(backend);
+        let mem_store = persistent_storage
+            .load_state_from_backend()
+            .await
+            .map_err(|err| ClientCoreError::SurbStorageError {
+                source: Box::new(err),
+            })?;
+
+        let store_clone = mem_store.clone();
+        spawn_future(async move {
+            persistent_storage
+                .flush_on_shutdown(store_clone, shutdown)
                .await
-                .map_err(|err| ClientCoreError::SurbStorageError {
-                    source: Box::new(err),
-                })?;
+        });

-            let store_clone = mem_store.clone();
-            spawn_future(async move {
-                persistent_storage
-                    .flush_on_shutdown(store_clone, shutdown)
-                    .await
-            });
+        Ok(mem_store)
+    }

-            Ok(mem_store)
-        } else {
-            log::trace!("Setup inactive reply storage");
-            Ok(backend
-                .get_inactive_storage()
-                .map_err(|err| ClientCoreError::SurbStorageError {
-                    source: Box::new(err),
-                })?)
-        }
+    async fn initial_key_setup(&mut self) {
+        assert!(!self.managed_keys.is_valid());
+        let mut rng = thread_rng();
+        self.managed_keys = ManagedKeys::load_or_generate(&mut rng, &self.key_store).await;
    }

    pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
    where
-        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+        <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
+        S::ReplyStore: Send + Sync,
+        <S::KeyStore as KeyStore>::StorageError: Send + Sync,
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
    {
        info!("Starting nym client");
+        self.initial_key_setup().await;
+
        // channels for inter-component communication
        // TODO: make the channels be internally created by the relevant components
        // rather than creating them here, so say for example the buffer controller would create the request channels
@@ -500,14 +529,14 @@ where
        );
        Self::start_topology_refresher(
            topology_provider,
-            self.debug_config.topology.topology_refresh_rate,
+            self.debug_config.topology,
            shared_topology_accessor.clone(),
            task_manager.subscribe(),
        )
        .await?;

        Self::start_received_messages_buffer_controller(
-            self.key_manager.encryption_keypair(),
+            self.managed_keys.encryption_keypair(),
            received_buffer_request_receiver,
            mixnet_messages_receiver,
            reply_storage.key_storage(),
@@ -532,7 +561,7 @@ where

        let controller_config = real_messages_control::Config::new(
            self.debug_config,
-            self.key_manager.ack_key(),
+            self.managed_keys.ack_key(),
            self_address,
        );

@@ -557,7 +586,7 @@ where
        {
            Self::start_cover_traffic_stream(
                self.debug_config,
-                self.key_manager.ack_key(),
+                self.managed_keys.ack_key(),
                self_address,
                shared_topology_accessor.clone(),
                sphinx_message_sender,
@@ -569,6 +598,7 @@ where
        debug!("The address of this client is: {self_address}");

        Ok(BaseClient {
+            address: self_address,
            client_input: ClientInputStatus::AwaitingProducer {
                client_input: ClientInput {
                    connection_command_sender: client_connection_tx,
@@ -591,6 +621,7 @@ where
 }

 pub struct BaseClient {
+    pub address: Recipient,
    pub client_input: ClientInputStatus,
    pub client_output: ClientOutputStatus,
    pub client_state: ClientState,
@@ -1,19 +1,25 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::client::replies::reply_storage::{
    fs_backend, CombinedReplyStorage, ReplyStorageBackend,
 };
-use crate::config::DebugConfig;
+use crate::config;
+use crate::config::Config;
 use crate::error::ClientCoreError;
 use log::{error, info};
+use nym_bandwidth_controller::BandwidthController;
+use nym_credential_storage::storage::Storage as CredentialStorage;
+use nym_validator_client::nyxd::QueryNyxdClient;
+use nym_validator_client::Client;
 use std::path::Path;
 use std::{fs, io};
 use time::OffsetDateTime;
+use url::Url;

 async fn setup_fresh_backend<P: AsRef<Path>>(
    db_path: P,
-    debug_config: &DebugConfig,
+    surb_config: &config::ReplySurbs,
 ) -> Result<fs_backend::Backend, ClientCoreError> {
    info!("creating fresh surb database");
    let mut storage_backend = match fs_backend::Backend::init(db_path).await {
@@ -30,12 +36,8 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
    // it will only be happening on the very first run and in practice won't incur huge
    // costs since the storage is going to be empty
    let mem_store = CombinedReplyStorage::new(
-        debug_config
-            .reply_surbs
-            .minimum_reply_surb_storage_threshold,
-        debug_config
-            .reply_surbs
-            .maximum_reply_surb_storage_threshold,
+        surb_config.minimum_reply_surb_storage_threshold,
+        surb_config.maximum_reply_surb_storage_threshold,
    );
    storage_backend
        .init_fresh(&mem_store)
@@ -47,17 +49,13 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
    Ok(storage_backend)
 }

-fn setup_inactive_backend(debug_config: &DebugConfig) -> fs_backend::Backend {
-    info!("creating inactive surb database");
-    fs_backend::Backend::new_inactive(
-        debug_config
-            .reply_surbs
-            .minimum_reply_surb_storage_threshold,
-        debug_config
-            .reply_surbs
-            .maximum_reply_surb_storage_threshold,
-    )
-}
+// fn setup_inactive_backend(surb_config: &config::ReplySurbs) -> fs_backend::Backend {
+//     info!("creating inactive surb database");
+//     fs_backend::Backend::new_inactive(
+//         surb_config.minimum_reply_surb_storage_threshold,
+//         surb_config.maximum_reply_surb_storage_threshold,
+//     )
+// }

 fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
    let db_path = db_path.as_ref();
@@ -81,28 +79,56 @@ fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
 }

 pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
-    db_path: Option<P>,
-    debug_config: &DebugConfig,
+    db_path: P,
+    surb_config: &config::ReplySurbs,
 ) -> Result<fs_backend::Backend, ClientCoreError> {
-    if let Some(db_path) = db_path {
-        // if the database file doesnt exist, initialise fresh storage, otherwise attempt to load
-        // the existing one
-        let db_path = db_path.as_ref();
-        if db_path.exists() {
-            info!("loading existing surb database");
-            match fs_backend::Backend::try_load(db_path).await {
-                Ok(backend) => Ok(backend),
-                Err(err) => {
-                    error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
+    // if the database file doesnt exist, initialise fresh storage, otherwise attempt to load
+    // the existing one
+    let db_path = db_path.as_ref();
+    if db_path.exists() {
+        info!("loading existing surb database");
+        match fs_backend::Backend::try_load(db_path).await {
+            Ok(backend) => Ok(backend),
+            Err(err) => {
+                error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");

-                    archive_corrupted_database(db_path)?;
-                    setup_fresh_backend(db_path, debug_config).await
-                }
+                archive_corrupted_database(db_path)?;
+                setup_fresh_backend(db_path, surb_config).await
            }
-        } else {
-            setup_fresh_backend(db_path, debug_config).await
        }
    } else {
-        Ok(setup_inactive_backend(debug_config))
+        setup_fresh_backend(db_path, surb_config).await
    }
 }
+
+pub fn create_bandwidth_controller<T, St: CredentialStorage>(
+    config: &Config<T>,
+    storage: St,
+) -> BandwidthController<Client<QueryNyxdClient>, St> {
+    let nyxd_url = config
+        .get_validator_endpoints()
+        .pop()
+        .expect("No nyxd validator endpoint provided");
+    let api_url = config
+        .get_nym_api_endpoints()
+        .pop()
+        .expect("No validator api endpoint provided");
+
+    create_bandwidth_controller_with_urls(nyxd_url, api_url, storage)
+}
+
+pub fn create_bandwidth_controller_with_urls<St: CredentialStorage>(
+    nyxd_url: Url,
+    nym_api_url: Url,
+    storage: St,
+) -> BandwidthController<Client<QueryNyxdClient>, St> {
+    let details = nym_network_defaults::NymNetworkDetails::new_from_env();
+    let mut client_config = nym_validator_client::Config::try_from_nym_network_details(&details)
+        .expect("failed to construct validator client config");
+    // overwrite env configuration with config URLs
+    client_config = client_config.with_urls(nyxd_url, nym_api_url);
+    let client = nym_validator_client::Client::new_query(client_config)
+        .expect("Could not construct query client");
+
+    BandwidthController::new(storage, client)
+}
@@ -0,0 +1,115 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// TODO: combine those more closely. Perhaps into a single underlying store.
+// Like for persistent, on-disk, storage, what's the point of having 3 different databases?
+
+use crate::client::key_manager::persistence::{InMemEphemeralKeys, KeyStore};
+use crate::client::replies::reply_storage;
+use crate::client::replies::reply_storage::ReplyStorageBackend;
+use nym_credential_storage::ephemeral_storage::{
+    EphemeralStorage as EphemeralCredentialStorage, EphemeralStorage,
+};
+use nym_credential_storage::storage::Storage as CredentialStorage;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::key_manager::persistence::OnDiskKeys;
+
+#[cfg(not(target_arch = "wasm32"))]
+use nym_credential_storage::persistent_storage::PersistentStorage as PersistentCredentialStorage;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::replies::reply_storage::fs_backend;
+
+pub trait MixnetClientStorage {
+    type KeyStore: KeyStore;
+    type ReplyStore: ReplyStorageBackend;
+    type CredentialStore: CredentialStorage;
+
+    // this is a TERRIBLE name...
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore);
+
+    fn key_store(&self) -> &Self::KeyStore;
+    fn reply_store(&self) -> &Self::ReplyStore;
+    fn credential_store(&self) -> &Self::CredentialStore;
+}
+
+#[derive(Default)]
+pub struct Ephemeral {
+    key_store: InMemEphemeralKeys,
+    reply_store: reply_storage::Empty,
+    credential_store: EphemeralStorage,
+}
+
+impl Ephemeral {
+    pub fn new() -> Self {
+        Default::default()
+    }
+}
+
+impl MixnetClientStorage for Ephemeral {
+    type KeyStore = InMemEphemeralKeys;
+    type ReplyStore = reply_storage::Empty;
+    type CredentialStore = EphemeralCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_store, self.credential_store)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_store
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_store
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub struct OnDiskPersistent {
+    pub(crate) key_store: OnDiskKeys,
+    pub(crate) reply_store: fs_backend::Backend,
+    pub(crate) credential_store: PersistentCredentialStorage,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl OnDiskPersistent {
+    pub fn new(
+        key_store: OnDiskKeys,
+        reply_store: fs_backend::Backend,
+        credential_store: PersistentCredentialStorage,
+    ) -> Self {
+        Self {
+            key_store,
+            reply_store,
+            credential_store,
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl MixnetClientStorage for OnDiskPersistent {
+    type KeyStore = OnDiskKeys;
+    type ReplyStore = fs_backend::Backend;
+    type CredentialStore = PersistentCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_store, self.credential_store)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_store
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_store
+    }
+}
@@ -1,5 +1,9 @@
+// Copyright 2020-2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::connections::TransmissionLane;

 pub type InputMessageSender = tokio::sync::mpsc::Sender<InputMessage>;
@@ -7,6 +11,14 @@ pub type InputMessageReceiver = tokio::sync::mpsc::Receiver<InputMessage>;

 #[derive(Debug)]
 pub enum InputMessage {
+    /// Fire an already prepared mix packets into the network.
+    /// No guarantees are made about it. For example no retransmssion
+    /// will be attempted if it gets dropped.
+    Premade {
+        msgs: Vec<MixPacket>,
+        lane: TransmissionLane,
+    },
+
    /// The simplest message variant where no additional information is attached.
    /// You're simply sending your `data` to specified `recipient` without any tagging.
    ///
@@ -44,6 +56,10 @@ pub enum InputMessage {
 }

 impl InputMessage {
+    pub fn new_premade(msgs: Vec<MixPacket>, lane: TransmissionLane) -> Self {
+        InputMessage::Premade { msgs, lane }
+    }
+
    pub fn new_regular(recipient: Recipient, data: Vec<u8>, lane: TransmissionLane) -> Self {
        InputMessage::Regular {
            recipient,
@@ -82,7 +98,8 @@ impl InputMessage {
        match self {
            InputMessage::Regular { lane, .. }
            | InputMessage::Anonymous { lane, .. }
-            | InputMessage::Reply { lane, .. } => lane,
+            | InputMessage::Reply { lane, .. }
+            | InputMessage::Premade { lane, .. } => lane,
        }
    }
 }
@@ -1,227 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::config::persistence::key_pathfinder::ClientKeyPathfinder;
-use log::*;
-use nym_crypto::asymmetric::{encryption, identity};
-use nym_gateway_requests::registration::handshake::SharedKeys;
-use nym_sphinx::acknowledgements::AckKey;
-use rand::{CryptoRng, RngCore};
-use std::io;
-use std::sync::Arc;
-
-// Note: to support key rotation in the future, all keys will require adding an extra smart pointer,
-// most likely an AtomicCell, or if it doesn't work as I think it does, a Mutex. Although I think
-// AtomicCell includes a Mutex implicitly if the underlying type does not work atomically.
-// And I guess there will need to be some mechanism for a grace period when you can still
-// use the old key after new one was issued.
-
-// Remember that Arc<T> has Deref implementation for T
-#[derive(Clone)]
-pub struct KeyManager {
-    /// identity key associated with the client instance.
-    identity_keypair: Arc<identity::KeyPair>,
-
-    /// encryption key associated with the client instance.
-    encryption_keypair: Arc<encryption::KeyPair>,
-
-    /// shared key derived with the gateway during "registration handshake"
-    gateway_shared_key: Option<Arc<SharedKeys>>,
-
-    /// key used for producing and processing acknowledgement packets.
-    ack_key: Arc<AckKey>,
-}
-
-// The expected flow of a KeyManager "lifetime" is as follows:
-/*
-   1. ::new() is called during client-init
-   2. after gateway registration is completed [in init] ::insert_gateway_shared_key() is called
-   3. ::store_keys() is called before init finishes execution.
-   4. ::load_keys() is called at the beginning of each subsequent client-run
-   5. [not implemented] ::rotate_keys() is called periodically during client-run I presume?
-*/
-
-impl KeyManager {
-    /// Creates new instance of a [`KeyManager`]
-    pub fn new<R>(rng: &mut R) -> Self
-    where
-        R: RngCore + CryptoRng,
-    {
-        KeyManager {
-            identity_keypair: Arc::new(identity::KeyPair::new(rng)),
-            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
-            gateway_shared_key: None,
-            ack_key: Arc::new(AckKey::new(rng)),
-        }
-    }
-
-    pub fn from_keys(
-        id_keypair: identity::KeyPair,
-        enc_keypair: encryption::KeyPair,
-        gateway_shared_key: SharedKeys,
-        ack_key: AckKey,
-    ) -> Self {
-        Self {
-            identity_keypair: Arc::new(id_keypair),
-            encryption_keypair: Arc::new(enc_keypair),
-            gateway_shared_key: Some(Arc::new(gateway_shared_key)),
-            ack_key: Arc::new(ack_key),
-        }
-    }
-
-    /// Loads previously stored client keys from the disk.
-    fn load_client_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
-        let identity_keypair: identity::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_identity_key().to_owned(),
-                client_pathfinder.public_identity_key().to_owned(),
-            ))?;
-        let encryption_keypair: encryption::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_encryption_key().to_owned(),
-                client_pathfinder.public_encryption_key().to_owned(),
-            ))?;
-
-        let ack_key: AckKey = nym_pemstore::load_key(client_pathfinder.ack_key())?;
-
-        Ok(KeyManager {
-            identity_keypair: Arc::new(identity_keypair),
-            encryption_keypair: Arc::new(encryption_keypair),
-            gateway_shared_key: None,
-            ack_key: Arc::new(ack_key),
-        })
-    }
-
-    /// Loads previously stored keys from the disk. Fails if not all, including the shared gateway
-    /// key, is available.
-    pub fn load_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
-        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
-
-        let gateway_shared_key: SharedKeys =
-            nym_pemstore::load_key(client_pathfinder.gateway_shared_key())?;
-
-        key_manager.gateway_shared_key = Some(Arc::new(gateway_shared_key));
-
-        Ok(key_manager)
-    }
-
-    /// Loads previously stored keys from the disk. Fails if client keys are not availabe, but the
-    /// shared gateway key is optional.
-    pub fn load_keys_but_gateway_is_optional(
-        client_pathfinder: &ClientKeyPathfinder,
-    ) -> io::Result<Self> {
-        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
-
-        let gateway_shared_key: Result<SharedKeys, io::Error> =
-            nym_pemstore::load_key(client_pathfinder.gateway_shared_key());
-
-        // It's ok if the gateway key was not found
-        let gateway_shared_key = match gateway_shared_key {
-            Err(err) if err.kind() == io::ErrorKind::NotFound => Ok(None),
-            Err(err) => Err(err),
-            Ok(key) => Ok(Some(key)),
-        }?;
-
-        key_manager.gateway_shared_key = gateway_shared_key.map(Arc::new);
-
-        Ok(key_manager)
-    }
-
-    /// Stores all available keys on the disk.
-    // While perhaps there is no much point in storing the `AckKey` on the disk,
-    // it is done so for the consistency sake so that you wouldn't require an rng instance
-    // during `load_keys` to generate the said key.
-    pub fn store_keys(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
-        nym_pemstore::store_keypair(
-            self.identity_keypair.as_ref(),
-            &nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_identity_key().to_owned(),
-                client_pathfinder.public_identity_key().to_owned(),
-            ),
-        )?;
-        nym_pemstore::store_keypair(
-            self.encryption_keypair.as_ref(),
-            &nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_encryption_key().to_owned(),
-                client_pathfinder.public_encryption_key().to_owned(),
-            ),
-        )?;
-
-        nym_pemstore::store_key(self.ack_key.as_ref(), client_pathfinder.ack_key())?;
-
-        match self.gateway_shared_key.as_ref() {
-            None => debug!("No gateway shared key available to store!"),
-            Some(gate_key) => {
-                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
-            }
-        }
-
-        Ok(())
-    }
-
-    pub fn store_gateway_key(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
-        match self.gateway_shared_key.as_ref() {
-            None => {
-                return Err(io::Error::new(
-                    io::ErrorKind::Other,
-                    "trying to store a non-existing key",
-                ))
-            }
-            Some(gate_key) => {
-                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
-            }
-        }
-
-        Ok(())
-    }
-
-    /// Overwrite the existing identity keypair
-    pub fn set_identity_keypair(&mut self, id_keypair: identity::KeyPair) {
-        self.identity_keypair = Arc::new(id_keypair);
-    }
-
-    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
-    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
-        Arc::clone(&self.identity_keypair)
-    }
-
-    /// Overwrite the existing encryption keypair
-    pub fn set_encryption_keypair(&mut self, enc_keypair: encryption::KeyPair) {
-        self.encryption_keypair = Arc::new(enc_keypair);
-    }
-
-    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
-    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
-        Arc::clone(&self.encryption_keypair)
-    }
-
-    /// Overwrite the existing ack key
-    pub fn set_ack_key(&mut self, ack_key: AckKey) {
-        self.ack_key = Arc::new(ack_key);
-    }
-
-    /// Gets an atomically reference counted pointer to [`AckKey`].
-    pub fn ack_key(&self) -> Arc<AckKey> {
-        Arc::clone(&self.ack_key)
-    }
-
-    /// After shared key with the gateway is derived, puts its ownership to this instance of a [`KeyManager`].
-    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: Arc<SharedKeys>) {
-        self.gateway_shared_key = Some(gateway_shared_key)
-    }
-
-    /// Gets an atomically reference counted pointer to [`SharedKey`].
-    // since this function is not fully public, it is not expected to be used externally and
-    // hence it's up to us to ensure it's called in correct context
-    pub fn gateway_shared_key(&self) -> Arc<SharedKeys> {
-        Arc::clone(
-            self.gateway_shared_key
-                .as_ref()
-                .expect("tried to unwrap empty gateway key!"),
-        )
-    }
-
-    pub fn is_gateway_key_set(&self) -> bool {
-        self.gateway_shared_key.is_some()
-    }
-}
@@ -0,0 +1,265 @@
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::key_manager::persistence::KeyStore;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_sphinx::acknowledgements::AckKey;
+use rand::{CryptoRng, RngCore};
+use std::sync::Arc;
+use zeroize::ZeroizeOnDrop;
+
+pub mod persistence;
+
+pub enum ManagedKeys {
+    Initial(KeyManagerBuilder),
+    FullyDerived(KeyManager),
+
+    // I really hate the existence of this variant, but I couldn't come up with a better way to handle
+    // `Self::deal_with_gateway_key` otherwise.
+    Invalidated,
+}
+
+impl From<KeyManagerBuilder> for ManagedKeys {
+    fn from(value: KeyManagerBuilder) -> Self {
+        ManagedKeys::Initial(value)
+    }
+}
+
+impl From<KeyManager> for ManagedKeys {
+    fn from(value: KeyManager) -> Self {
+        ManagedKeys::FullyDerived(value)
+    }
+}
+
+impl ManagedKeys {
+    pub fn is_valid(&self) -> bool {
+        !matches!(self, ManagedKeys::Invalidated)
+    }
+
+    pub async fn must_load<S: KeyStore>(key_store: &S) -> Result<Self, S::StorageError> {
+        Ok(ManagedKeys::FullyDerived(
+            KeyManager::load_keys(key_store).await?,
+        ))
+    }
+
+    pub async fn load_or_generate<R, S>(rng: &mut R, key_store: &S) -> Self
+    where
+        R: RngCore + CryptoRng,
+        S: KeyStore,
+    {
+        if let Ok(loaded) = KeyManager::load_keys(key_store).await {
+            ManagedKeys::FullyDerived(loaded)
+        } else {
+            ManagedKeys::Initial(KeyManagerBuilder::new(rng))
+        }
+    }
+
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.identity_keypair(),
+            ManagedKeys::FullyDerived(keys) => keys.identity_keypair(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.encryption_keypair(),
+            ManagedKeys::FullyDerived(keys) => keys.encryption_keypair(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.ack_key(),
+            ManagedKeys::FullyDerived(keys) => keys.ack_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn gateway_shared_key(&self) -> Option<Arc<SharedKeys>> {
+        match self {
+            ManagedKeys::Initial(_) => None,
+            ManagedKeys::FullyDerived(keys) => Some(keys.gateway_shared_key()),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn identity_public_key(&self) -> &identity::PublicKey {
+        match self {
+            ManagedKeys::Initial(keys) => keys.identity_keypair.public_key(),
+            ManagedKeys::FullyDerived(keys) => keys.identity_keypair.public_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn encryption_public_key(&self) -> &encryption::PublicKey {
+        match self {
+            ManagedKeys::Initial(keys) => keys.encryption_keypair.public_key(),
+            ManagedKeys::FullyDerived(keys) => keys.encryption_keypair.public_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub async fn deal_with_gateway_key<S: KeyStore>(
+        &mut self,
+        gateway_shared_key: Arc<SharedKeys>,
+        key_store: &S,
+    ) -> Result<(), S::StorageError> {
+        let key_manager = match std::mem::replace(self, ManagedKeys::Invalidated) {
+            ManagedKeys::Initial(keys) => {
+                let key_manager = keys.insert_gateway_shared_key(gateway_shared_key);
+                key_manager.persist_keys(key_store).await?;
+                key_manager
+            }
+            ManagedKeys::FullyDerived(key_manager) => {
+                if !Arc::ptr_eq(&key_manager.gateway_shared_key, &gateway_shared_key)
+                    || key_manager.gateway_shared_key != gateway_shared_key
+                {
+                    // this should NEVER happen thus panic here
+                    panic!("derived fresh gateway shared key whilst already holding one!")
+                }
+                key_manager
+            }
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        };
+
+        *self = ManagedKeys::FullyDerived(key_manager);
+        Ok(())
+    }
+}
+
+// all of the keys really shouldn't be wrapped in `Arc`, but due to how the gateway client is currently
+// constructed, changing that would require more work than what it's worth
+pub struct KeyManagerBuilder {
+    /// identity key associated with the client instance.
+    identity_keypair: Arc<identity::KeyPair>,
+
+    /// encryption key associated with the client instance.
+    encryption_keypair: Arc<encryption::KeyPair>,
+
+    /// key used for producing and processing acknowledgement packets.
+    ack_key: Arc<AckKey>,
+}
+
+impl KeyManagerBuilder {
+    /// Creates new instance of a [`KeyManager`]
+    pub fn new<R>(rng: &mut R) -> Self
+    where
+        R: RngCore + CryptoRng,
+    {
+        KeyManagerBuilder {
+            identity_keypair: Arc::new(identity::KeyPair::new(rng)),
+            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
+            ack_key: Arc::new(AckKey::new(rng)),
+        }
+    }
+
+    pub fn insert_gateway_shared_key(self, gateway_shared_key: Arc<SharedKeys>) -> KeyManager {
+        KeyManager {
+            identity_keypair: self.identity_keypair,
+            encryption_keypair: self.encryption_keypair,
+            gateway_shared_key,
+            ack_key: self.ack_key,
+        }
+    }
+
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        Arc::clone(&self.identity_keypair)
+    }
+
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        Arc::clone(&self.encryption_keypair)
+    }
+
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        Arc::clone(&self.ack_key)
+    }
+}
+
+// Note: to support key rotation in the future, all keys will require adding an extra smart pointer,
+// most likely an AtomicCell, or if it doesn't work as I think it does, a Mutex. Although I think
+// AtomicCell includes a Mutex implicitly if the underlying type does not work atomically.
+// And I guess there will need to be some mechanism for a grace period when you can still
+// use the old key after new one was issued.
+
+// Remember that Arc<T> has Deref implementation for T
+#[derive(Clone)]
+pub struct KeyManager {
+    /// identity key associated with the client instance.
+    identity_keypair: Arc<identity::KeyPair>,
+
+    /// encryption key associated with the client instance.
+    encryption_keypair: Arc<encryption::KeyPair>,
+
+    /// shared key derived with the gateway during "registration handshake"
+    gateway_shared_key: Arc<SharedKeys>,
+
+    /// key used for producing and processing acknowledgement packets.
+    ack_key: Arc<AckKey>,
+}
+
+impl KeyManager {
+    pub fn from_keys(
+        id_keypair: identity::KeyPair,
+        enc_keypair: encryption::KeyPair,
+        gateway_shared_key: SharedKeys,
+        ack_key: AckKey,
+    ) -> Self {
+        Self {
+            identity_keypair: Arc::new(id_keypair),
+            encryption_keypair: Arc::new(enc_keypair),
+            gateway_shared_key: Arc::new(gateway_shared_key),
+            ack_key: Arc::new(ack_key),
+        }
+    }
+
+    pub async fn load_keys<S: KeyStore>(store: &S) -> Result<Self, S::StorageError> {
+        store.load_keys().await
+    }
+
+    pub async fn persist_keys<S: KeyStore>(&self, store: &S) -> Result<(), S::StorageError> {
+        store.store_keys(self).await
+    }
+
+    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        Arc::clone(&self.identity_keypair)
+    }
+
+    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        Arc::clone(&self.encryption_keypair)
+    }
+    /// Gets an atomically reference counted pointer to [`AckKey`].
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        Arc::clone(&self.ack_key)
+    }
+
+    /// Gets an atomically reference counted pointer to [`SharedKey`].
+    pub fn gateway_shared_key(&self) -> Arc<SharedKeys> {
+        Arc::clone(&self.gateway_shared_key)
+    }
+
+    pub fn remove_gateway_key(self) -> KeyManagerBuilder {
+        if Arc::strong_count(&self.gateway_shared_key) > 1 {
+            panic!("attempted to remove gateway key whilst still holding multiple references!")
+        }
+        KeyManagerBuilder {
+            identity_keypair: self.identity_keypair,
+            encryption_keypair: self.encryption_keypair,
+            ack_key: self.ack_key,
+        }
+    }
+}
+
+fn _assert_keys_zeroize_on_drop() {
+    fn _assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}
+
+    _assert_zeroize_on_drop::<identity::KeyPair>();
+    _assert_zeroize_on_drop::<encryption::KeyPair>();
+    _assert_zeroize_on_drop::<AckKey>();
+    _assert_zeroize_on_drop::<SharedKeys>();
+}
@@ -0,0 +1,214 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::key_manager::KeyManager;
+use async_trait::async_trait;
+use std::error::Error;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::config::persistence::key_pathfinder::ClientKeyPathfinder;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_crypto::asymmetric::{encryption, identity};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_gateway_requests::registration::handshake::SharedKeys;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_pemstore::KeyPairPath;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_sphinx::acknowledgements::AckKey;
+
+// we have to define it as an async trait since wasm storage is async
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait KeyStore {
+    type StorageError: Error;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError>;
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError>;
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Debug, thiserror::Error)]
+pub enum OnDiskKeysError {
+    #[error("failed to load {keys} keys from {:?} (private key) and {:?} (public key): {err}", .paths.private_key_path, .paths.public_key_path)]
+    KeyPairLoadFailure {
+        keys: String,
+        paths: nym_pemstore::KeyPairPath,
+        err: std::io::Error,
+    },
+
+    #[error("failed to store {keys} keys to {:?} (private key) and {:?} (public key): {err}", .paths.private_key_path, .paths.public_key_path)]
+    KeyPairStoreFailure {
+        keys: String,
+        paths: nym_pemstore::KeyPairPath,
+        err: std::io::Error,
+    },
+
+    #[error("failed to load {key} key from {path}: {err}")]
+    KeyLoadFailure {
+        key: String,
+        path: String,
+        err: std::io::Error,
+    },
+
+    #[error("failed to store {key} key to {path}: {err}")]
+    KeyStoreFailure {
+        key: String,
+        path: String,
+        err: std::io::Error,
+    },
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub struct OnDiskKeys {
+    pathfinder: ClientKeyPathfinder,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl From<ClientKeyPathfinder> for OnDiskKeys {
+    fn from(pathfinder: ClientKeyPathfinder) -> Self {
+        OnDiskKeys { pathfinder }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl OnDiskKeys {
+    pub fn new(pathfinder: ClientKeyPathfinder) -> Self {
+        OnDiskKeys { pathfinder }
+    }
+
+    fn load_key<T: PemStorableKey>(
+        &self,
+        path: &std::path::Path,
+        name: impl Into<String>,
+    ) -> Result<T, OnDiskKeysError> {
+        nym_pemstore::load_key(path).map_err(|err| OnDiskKeysError::KeyLoadFailure {
+            key: name.into(),
+            path: path.to_str().map(|s| s.to_owned()).unwrap_or_default(),
+            err,
+        })
+    }
+
+    fn load_keypair<T: PemStorableKeyPair>(
+        &self,
+        paths: KeyPairPath,
+        name: impl Into<String>,
+    ) -> Result<T, OnDiskKeysError> {
+        nym_pemstore::load_keypair(&paths).map_err(|err| OnDiskKeysError::KeyPairLoadFailure {
+            keys: name.into(),
+            paths,
+            err,
+        })
+    }
+
+    fn store_key<T: PemStorableKey>(
+        &self,
+        key: &T,
+        path: &std::path::Path,
+        name: impl Into<String>,
+    ) -> Result<(), OnDiskKeysError> {
+        nym_pemstore::store_key(key, path).map_err(|err| OnDiskKeysError::KeyStoreFailure {
+            key: name.into(),
+            path: path.to_str().map(|s| s.to_owned()).unwrap_or_default(),
+            err,
+        })
+    }
+
+    fn store_keypair<T: PemStorableKeyPair>(
+        &self,
+        keys: &T,
+        paths: KeyPairPath,
+        name: impl Into<String>,
+    ) -> Result<(), OnDiskKeysError> {
+        nym_pemstore::store_keypair(keys, &paths).map_err(|err| {
+            OnDiskKeysError::KeyPairStoreFailure {
+                keys: name.into(),
+                paths,
+                err,
+            }
+        })
+    }
+
+    fn load_keys(&self) -> Result<KeyManager, OnDiskKeysError> {
+        let identity_paths = self.pathfinder.identity_key_pair_path();
+        let encryption_paths = self.pathfinder.encryption_key_pair_path();
+
+        let identity_keypair: identity::KeyPair =
+            self.load_keypair(identity_paths, "identity keys")?;
+        let encryption_keypair: encryption::KeyPair =
+            self.load_keypair(encryption_paths, "encryption keys")?;
+
+        let ack_key: AckKey = self.load_key(self.pathfinder.ack_key(), "ack key")?;
+        let gateway_shared_key: SharedKeys =
+            self.load_key(self.pathfinder.gateway_shared_key(), "gateway shared keys")?;
+
+        Ok(KeyManager::from_keys(
+            identity_keypair,
+            encryption_keypair,
+            gateway_shared_key,
+            ack_key,
+        ))
+    }
+
+    fn store_keys(&self, keys: &KeyManager) -> Result<(), OnDiskKeysError> {
+        let identity_paths = self.pathfinder.identity_key_pair_path();
+        let encryption_paths = self.pathfinder.encryption_key_pair_path();
+
+        self.store_keypair(
+            keys.identity_keypair.as_ref(),
+            identity_paths,
+            "identity keys",
+        )?;
+        self.store_keypair(
+            keys.encryption_keypair.as_ref(),
+            encryption_paths,
+            "encryption keys",
+        )?;
+
+        self.store_key(keys.ack_key.as_ref(), self.pathfinder.ack_key(), "ack key")?;
+        self.store_key(
+            keys.gateway_shared_key.as_ref(),
+            self.pathfinder.gateway_shared_key(),
+            "gateway shared keys",
+        )?;
+
+        Ok(())
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl KeyStore for OnDiskKeys {
+    type StorageError = OnDiskKeysError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        self.load_keys()
+    }
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError> {
+        self.store_keys(keys)
+    }
+}
+
+#[derive(Default)]
+pub struct InMemEphemeralKeys;
+
+#[derive(Debug, thiserror::Error)]
+#[error("ephemeral keys can't be loaded from storage")]
+pub struct EphemeralKeysError;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl KeyStore for InMemEphemeralKeys {
+    type StorageError = EphemeralKeysError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        Err(EphemeralKeysError)
+    }
+
+    async fn store_keys(&self, _keys: &KeyManager) -> Result<(), Self::StorageError> {
+        Ok(())
+    }
+}
@@ -35,6 +35,7 @@ impl<C, St> MixTrafficController<C, St>
 where
    C: DkgQueryClient + Sync + Send + 'static,
    St: Storage + 'static,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
    pub fn new(
        gateway_client: GatewayClient<C, St>,
@@ -3,10 +3,12 @@

 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver};
 use crate::client::real_messages_control::message_handler::MessageHandler;
+use crate::client::real_messages_control::real_traffic_stream::RealMessage;
 use crate::client::replies::reply_controller::ReplyControllerSender;
 use log::*;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
+use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::connections::TransmissionLane;
 use rand::{CryptoRng, Rng};

@@ -41,6 +43,18 @@ where
        }
    }

+    async fn handle_premade_packets(&mut self, packets: Vec<MixPacket>, lane: TransmissionLane) {
+        self.message_handler
+            .send_premade_mix_packets(
+                packets
+                    .into_iter()
+                    .map(|p| RealMessage::new(p, None))
+                    .collect(),
+                lane,
+            )
+            .await
+    }
+
    async fn handle_reply(
        &mut self,
        recipient_tag: AnonymousSenderTag,
@@ -106,6 +120,7 @@ where
            } => {
                self.handle_reply(recipient_tag, data, lane).await;
            }
+            InputMessage::Premade { msgs, lane } => self.handle_premade_packets(msgs, lane).await,
        };
    }

@@ -131,7 +131,10 @@ where
        // send to `OutQueueControl` to eventually send to the mix network
        self.message_handler
            .forward_messages(
-                vec![RealMessage::new(prepared_fragment.mix_packet, frag_id)],
+                vec![RealMessage::new(
+                    prepared_fragment.mix_packet,
+                    Some(frag_id),
+                )],
                TransmissionLane::Retransmission,
            )
            .await
@@ -291,8 +291,10 @@ where
            .try_prepare_single_reply_chunk_for_sending(reply_surb, chunk_clone)
            .await?;

-        let real_messages =
-            RealMessage::new(prepared_fragment.mix_packet, chunk.fragment_identifier());
+        let real_messages = RealMessage::new(
+            prepared_fragment.mix_packet,
+            Some(chunk.fragment_identifier()),
+        );
        let delay = prepared_fragment.total_delay;
        let pending_ack =
            PendingAcknowledgement::new_anonymous(chunk, delay, target, is_extra_surb_request);
@@ -384,7 +386,8 @@ where
            let lane = raw.0;
            let fragment = raw.1;

-            let real_message = RealMessage::new(prepared.mix_packet, prepared.fragment_identifier);
+            let real_message =
+                RealMessage::new(prepared.mix_packet, Some(prepared.fragment_identifier));
            let delay = prepared.total_delay;
            let pending_ack = PendingAcknowledgement::new_anonymous(fragment, delay, target, false);

@@ -401,6 +404,14 @@ where
        Ok(())
    }

+    pub(crate) async fn send_premade_mix_packets(
+        &mut self,
+        msgs: Vec<RealMessage>,
+        lane: TransmissionLane,
+    ) {
+        self.forward_messages(msgs, lane).await;
+    }
+
    pub(crate) async fn try_send_plain_message(
        &mut self,
        recipient: Recipient,
@@ -444,8 +455,10 @@ where
                &recipient,
            )?;

-            let real_message =
-                RealMessage::new(prepared_fragment.mix_packet, fragment.fragment_identifier());
+            let real_message = RealMessage::new(
+                prepared_fragment.mix_packet,
+                Some(fragment.fragment_identifier()),
+            );
            let delay = prepared_fragment.total_delay;
            let pending_ack = PendingAcknowledgement::new_known(fragment, delay, recipient);

@@ -121,7 +121,7 @@ where
 #[derive(Debug)]
 pub(crate) struct RealMessage {
    mix_packet: MixPacket,
-    fragment_id: FragmentIdentifier,
+    fragment_id: Option<FragmentIdentifier>,
    // TODO: add info about it being constructed with reply-surb
 }

@@ -129,7 +129,7 @@ impl From<PreparedFragment> for RealMessage {
    fn from(fragment: PreparedFragment) -> Self {
        RealMessage {
            mix_packet: fragment.mix_packet,
-            fragment_id: fragment.fragment_identifier,
+            fragment_id: Some(fragment.fragment_identifier),
        }
    }
 }
@@ -139,7 +139,7 @@ impl RealMessage {
        self.mix_packet.sphinx_packet().len()
    }

-    pub(crate) fn new(mix_packet: MixPacket, fragment_id: FragmentIdentifier) -> Self {
+    pub(crate) fn new(mix_packet: MixPacket, fragment_id: Option<FragmentIdentifier>) -> Self {
        RealMessage {
            mix_packet,
            fragment_id,
@@ -255,7 +255,7 @@ where
                )
            }
            StreamMessage::Real(real_message) => {
-                (real_message.mix_packet, Some(real_message.fragment_id))
+                (real_message.mix_packet, real_message.fragment_id)
            }
        };

@@ -5,8 +5,6 @@ use crate::client::replies::reply_storage::backend::Empty;
 use crate::client::replies::reply_storage::{CombinedReplyStorage, ReplyStorageBackend};
 use async_trait::async_trait;

-use std::path::PathBuf;
-
 // well, right now we don't have the browser storage : (
 // so we keep everything in memory
 #[derive(Debug)]
@@ -29,22 +27,6 @@ impl Backend {
 impl ReplyStorageBackend for Backend {
    type StorageError = <Empty as ReplyStorageBackend>::StorageError;

-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        _db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        Ok(Backend {
-            empty: Empty {
-                min_surb_threshold: debug_config
-                    .reply_surbs
-                    .minimum_reply_surb_storage_threshold,
-                max_surb_threshold: debug_config
-                    .reply_surbs
-                    .maximum_reply_surb_storage_threshold,
-            },
-        })
-    }
-
    async fn flush_surb_storage(
        &mut self,
        storage: &CombinedReplyStorage,
@@ -59,8 +41,4 @@ impl ReplyStorageBackend for Backend {
    async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
        self.empty.load_surb_storage().await
    }
-
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        self.empty.get_inactive_storage()
-    }
 }
@@ -1,7 +1,6 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::client::base_client::non_wasm_helpers;
 use crate::client::replies::reply_storage::backend::fs_backend::manager::StorageManager;
 use crate::client::replies::reply_storage::backend::fs_backend::models::{
    ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
@@ -23,49 +22,11 @@ mod error;
 mod manager;
 mod models;

-#[derive(Debug)]
-enum StorageManagerState {
-    Storage(StorageManager),
-    Inactive(InactiveMetadata),
-}
-
-// When the storage backaed is initialized as inactive, it will still contain metadata parameters
-// that will be needed when the in-mem storage is fetched for use.
-#[derive(Debug)]
-struct InactiveMetadata {
-    pub minimum_reply_surb_storage_threshold: usize,
-    pub maximum_reply_surb_storage_threshold: usize,
-}
-
-impl StorageManagerState {
-    fn get(&self) -> &StorageManager {
-        match self {
-            StorageManagerState::Storage(manager) => manager,
-            StorageManagerState::Inactive(_) => {
-                panic!("tried to get storage of an inactive backend")
-            }
-        }
-    }
-
-    fn get_mut(&mut self) -> &mut StorageManager {
-        match self {
-            StorageManagerState::Storage(manager) => manager,
-            StorageManagerState::Inactive(_) => {
-                panic!("tried to get storage of an inactive backend")
-            }
-        }
-    }
-
-    fn is_active(&self) -> bool {
-        matches!(self, StorageManagerState::Storage(_))
-    }
-}
-
 #[derive(Debug)]
 pub struct Backend {
    temporary_old_path: Option<PathBuf>,
    database_path: PathBuf,
-    manager: StorageManagerState,
+    manager: StorageManager,
 }

 impl Backend {
@@ -85,26 +46,12 @@ impl Backend {
        let backend = Backend {
            temporary_old_path: None,
            database_path: owned_path,
-            manager: StorageManagerState::Storage(manager),
+            manager,
        };

        Ok(backend)
    }

-    pub fn new_inactive(
-        minimum_reply_surb_storage_threshold: usize,
-        maximum_reply_surb_storage_threshold: usize,
-    ) -> Self {
-        Backend {
-            temporary_old_path: None,
-            database_path: PathBuf::new(),
-            manager: StorageManagerState::Inactive(InactiveMetadata {
-                minimum_reply_surb_storage_threshold,
-                maximum_reply_surb_storage_threshold,
-            }),
-        }
-    }
-
    pub async fn try_load<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
        let owned_path: PathBuf = database_path.as_ref().into();
        if owned_path.file_name().is_none() {
@@ -176,12 +123,13 @@ impl Backend {
        Ok(Backend {
            temporary_old_path: None,
            database_path: owned_path,
-            manager: StorageManagerState::Storage(manager),
+            // manager: StorageManagerState::Storage(manager),
+            manager,
        })
    }

    async fn close_pool(&mut self) {
-        self.manager.get_mut().connection_pool.close().await;
+        self.manager.connection_pool.close().await;
    }

    async fn rotate(&mut self) -> Result<(), StorageError> {
@@ -200,9 +148,8 @@ impl Backend {

        fs::rename(&self.database_path, &temp_old)
            .map_err(|err| StorageError::DatabaseRenameError { source: err })?;
-        self.manager =
-            StorageManagerState::Storage(StorageManager::init(&self.database_path, true).await?);
-        self.manager.get_mut().create_status_table().await?;
+        self.manager = StorageManager::init(&self.database_path, true).await?;
+        self.manager.create_status_table().await?;

        self.temporary_old_path = Some(temp_old);
        Ok(())
@@ -219,27 +166,26 @@ impl Backend {
    }

    async fn start_storage_flush(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_flush_status(true).await?)
+        Ok(self.manager.set_flush_status(true).await?)
    }

    async fn end_storage_flush(&self) -> Result<(), StorageError> {
        self.manager
-            .get()
            .set_previous_flush_timestamp(OffsetDateTime::now_utc().unix_timestamp())
            .await?;
-        Ok(self.manager.get().set_flush_status(false).await?)
+        Ok(self.manager.set_flush_status(false).await?)
    }

    async fn start_client_use(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_client_in_use_status(true).await?)
+        Ok(self.manager.set_client_in_use_status(true).await?)
    }

    async fn stop_client_use(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_client_in_use_status(false).await?)
+        Ok(self.manager.set_client_in_use_status(false).await?)
    }

    async fn get_stored_tags(&self) -> Result<UsedSenderTags, StorageError> {
-        let stored = self.manager.get().get_tags().await?;
+        let stored = self.manager.get_tags().await?;

        // stop at the first instance of corruption. if even a single entry is malformed,
        // something weird has happened and we can't trust the rest of the data
@@ -255,7 +201,6 @@ impl Backend {
        for map_ref in tags.as_raw_iter() {
            let (recipient, tag) = map_ref.pair();
            self.manager
-                .get()
                .insert_tag(StoredSenderTag::new(*recipient, *tag))
                .await?;
        }
@@ -263,7 +208,7 @@ impl Backend {
    }

    async fn get_stored_reply_keys(&self) -> Result<SentReplyKeys, StorageError> {
-        let stored = self.manager.get().get_reply_keys().await?;
+        let stored = self.manager.get_reply_keys().await?;

        // stop at the first instance of corruption. if even a single entry is malformed,
        // something weird has happened and we can't trust the rest of the data
@@ -279,7 +224,6 @@ impl Backend {
        for map_ref in reply_keys.as_raw_iter() {
            let (digest, key) = map_ref.pair();
            self.manager
-                .get()
                .insert_reply_key(StoredReplyKey::new(*digest, *key))
                .await?;
        }
@@ -287,7 +231,7 @@ impl Backend {
    }

    async fn get_stored_reply_surbs(&self) -> Result<ReceivedReplySurbsMap, StorageError> {
-        let surb_senders = self.manager.get().get_surb_senders().await?;
+        let surb_senders = self.manager.get_surb_senders().await?;

        let metadata = self.get_reply_surb_storage_metadata().await?;
        let mut received_surbs = Vec::with_capacity(surb_senders.len());
@@ -297,7 +241,6 @@ impl Backend {
                sender.try_into()?;
            let stored_surbs = self
                .manager
-                .get()
                .get_reply_surbs(sender_id)
                .await?
                .into_iter()
@@ -325,7 +268,6 @@ impl Backend {
            let (tag, received_surbs) = map_ref.pair();
            let sender_id = self
                .manager
-                .get()
                .insert_surb_sender(StoredSurbSender::new(
                    *tag,
                    received_surbs.surbs_last_received_at(),
@@ -334,7 +276,6 @@ impl Backend {

            for reply_surb in received_surbs.surbs_ref() {
                self.manager
-                    .get()
                    .insert_reply_surb(StoredReplySurb::new(sender_id, reply_surb))
                    .await?
            }
@@ -346,7 +287,6 @@ impl Backend {
        &self,
    ) -> Result<ReplySurbStorageMetadata, StorageError> {
        self.manager
-            .get()
            .get_reply_surb_storage_metadata()
            .await
            .map_err(Into::into)
@@ -357,7 +297,6 @@ impl Backend {
        reply_surbs: &ReceivedReplySurbsMap,
    ) -> Result<(), StorageError> {
        self.manager
-            .get()
            .insert_reply_surb_storage_metadata(ReplySurbStorageMetadata::new(
                reply_surbs.min_surb_threshold(),
                reply_surbs.max_surb_threshold(),
@@ -371,24 +310,6 @@ impl Backend {
 impl ReplyStorageBackend for Backend {
    type StorageError = error::StorageError;

-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        non_wasm_helpers::setup_fs_reply_surb_backend(db_path, debug_config)
-            .await
-            .map_err(|err| {
-                log::error!("Failed to create storage: {err}");
-                Self::StorageError::FailedToCreateStorage {
-                    source: Box::new(err),
-                }
-            })
-    }
-
-    fn is_active(&self) -> bool {
-        self.manager.is_active()
-    }
-
    async fn start_storage_session(&self) -> Result<(), Self::StorageError> {
        self.start_client_use().await
    }
@@ -426,18 +347,6 @@ impl ReplyStorageBackend for Backend {
        Ok(CombinedReplyStorage::load(reply_keys, reply_surbs, tags))
    }

-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        match self.manager {
-            StorageManagerState::Storage(_) => {
-                panic!("tried to get inactive storage from an active storage backend")
-            }
-            StorageManagerState::Inactive(ref state) => Ok(CombinedReplyStorage::new(
-                state.minimum_reply_surb_storage_threshold,
-                state.maximum_reply_surb_storage_threshold,
-            )),
-        }
-    }
-
    async fn stop_storage_session(self) -> Result<(), Self::StorageError> {
        self.stop_client_use().await
    }
@@ -3,7 +3,7 @@

 use crate::client::replies::reply_storage::CombinedReplyStorage;
 use async_trait::async_trait;
-use std::{error::Error, path::PathBuf};
+use std::error::Error;
 use thiserror::Error;

 #[cfg(target_arch = "wasm32")]
@@ -26,24 +26,19 @@ pub struct Empty {
    pub max_surb_threshold: usize,
 }

+impl Default for Empty {
+    fn default() -> Self {
+        Empty {
+            min_surb_threshold: 20,
+            max_surb_threshold: 200,
+        }
+    }
+}
+
 #[async_trait]
 impl ReplyStorageBackend for Empty {
    type StorageError = UndefinedError;

-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        _db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        Ok(Self {
-            min_surb_threshold: debug_config
-                .reply_surbs
-                .minimum_reply_surb_storage_threshold,
-            max_surb_threshold: debug_config
-                .reply_surbs
-                .maximum_reply_surb_storage_threshold,
-        })
-    }
-
    async fn flush_surb_storage(
        &mut self,
        _storage: &CombinedReplyStorage,
@@ -64,28 +59,12 @@ impl ReplyStorageBackend for Empty {
            self.max_surb_threshold,
        ))
    }
-
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        Ok(CombinedReplyStorage::new(
-            self.min_surb_threshold,
-            self.max_surb_threshold,
-        ))
-    }
 }

 #[async_trait]
 pub trait ReplyStorageBackend: Sized {
    type StorageError: Error + 'static;

-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError>;
-
-    fn is_active(&self) -> bool {
-        true
-    }
-
    async fn start_storage_session(&self) -> Result<(), Self::StorageError> {
        Ok(())
    }
@@ -103,11 +82,6 @@ pub trait ReplyStorageBackend: Sized {

    async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError>;

-    /// In the case the storage backend is initialized in an inactive state (persisting data is
-    /// disabled), we might still need to fetch the (in-mem) storage and the parameters it was
-    /// created with.
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError>;
-
    async fn stop_storage_session(self) -> Result<(), Self::StorageError> {
        Ok(())
    }
@@ -743,6 +743,11 @@ pub struct Topology {
    /// did not reach its destination.
    #[serde(with = "humantime_serde")]
    pub topology_resolution_timeout: Duration,
+
+    /// Specifies whether the client should not refresh the network topology after obtaining
+    /// the first valid instance.
+    /// Supersedes `topology_refresh_rate_ms`.
+    pub disable_refreshing: bool,
 }

 impl Default for Topology {
@@ -750,6 +755,7 @@ impl Default for Topology {
        Topology {
            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
+            disable_refreshing: false,
        }
    }
 }
@@ -142,6 +142,7 @@ impl From<OldDebugConfigV1_1_13> for DebugConfig {
            topology: Topology {
                topology_refresh_rate: value.topology_refresh_rate,
                topology_resolution_timeout: value.topology_resolution_timeout,
+                disable_refreshing: false,
            },
            reply_surbs: ReplySurbs {
                minimum_reply_surb_storage_threshold: value.minimum_reply_surb_storage_threshold,
@@ -40,6 +40,14 @@ impl ClientKeyPathfinder {
        }
    }

+    pub fn identity_key_pair_path(&self) -> nym_pemstore::KeyPairPath {
+        nym_pemstore::KeyPairPath::new(self.private_identity_key(), self.public_identity_key())
+    }
+
+    pub fn encryption_key_pair_path(&self) -> nym_pemstore::KeyPairPath {
+        nym_pemstore::KeyPairPath::new(self.private_encryption_key(), self.public_encryption_key())
+    }
+
    pub fn any_file_exists(&self) -> bool {
        matches!(self.identity_public_key.try_exists(), Ok(true))
            || matches!(self.identity_private_key.try_exists(), Ok(true))
@@ -6,6 +6,7 @@ use nym_gateway_client::error::GatewayClientError;
 use nym_topology::gateway::GatewayConversionError;
 use nym_topology::NymTopologyError;
 use nym_validator_client::ValidatorClientError;
+use std::error::Error;

 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
@@ -41,13 +42,18 @@ pub enum ClientCoreError {

    #[error("experienced a failure with our reply surb persistent storage: {source}")]
    SurbStorageError {
-        source: Box<dyn std::error::Error + Send + Sync>,
+        source: Box<dyn Error + Send + Sync>,
+    },
+
+    #[error("experienced a failure with our cryptographic keys persistent storage: {source}")]
+    KeyStoreError {
+        source: Box<dyn Error + Send + Sync>,
    },

    #[error("The gateway id is invalid - {0}")]
    UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),

-    #[error("The identity of the gateway is unknwown - did you run init?")]
+    #[error("The identity of the gateway is unknown - did you run init?")]
    GatewayIdUnknown,

    #[error("The owner of the gateway is unknown - did you run init?")]
@@ -1,14 +1,10 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::{
-    client::key_manager::KeyManager,
-    config::{persistence::key_pathfinder::ClientKeyPathfinder, Config},
-    error::ClientCoreError,
-};
+use crate::error::ClientCoreError;
 use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
-use nym_config::NymConfig;
+use nym_credential_storage::storage::Storage;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
 use nym_gateway_requests::registration::handshake::SharedKeys;
@@ -29,10 +25,14 @@ use tokio::time::Instant;
 use tokio_tungstenite::connect_async;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
-
 #[cfg(not(target_arch = "wasm32"))]
 type WsConn = WebSocketStream<MaybeTlsStream<TcpStream>>;
-use nym_credential_storage::storage::Storage;
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::key_manager::persistence::OnDiskKeys;
+#[cfg(not(target_arch = "wasm32"))]
+use crate::config::{persistence::key_pathfinder::ClientKeyPathfinder, Config};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_config::NymConfig;

 #[cfg(target_arch = "wasm32")]
 use nym_bandwidth_controller::wasm_mockups::DirectSigningNyxdClient;
@@ -224,10 +224,14 @@ pub(super) async fn query_gateway_details(
    }
 }

-pub(super) async fn register_with_gateway<St: Storage>(
+pub(super) async fn register_with_gateway<St>(
    gateway: &gateway::Node,
    our_identity: Arc<identity::KeyPair>,
-) -> Result<Arc<SharedKeys>, ClientCoreError> {
+) -> Result<Arc<SharedKeys>, ClientCoreError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
    let timeout = Duration::from_millis(1500);
    let mut gateway_client: GatewayClient<DirectSigningNyxdClient, St> = GatewayClient::new_init(
        gateway.clients_address(),
@@ -246,15 +250,12 @@ pub(super) async fn register_with_gateway<St: Storage>(
    Ok(shared_keys)
 }

-pub(super) fn store_keys<T>(
-    key_manager: &KeyManager,
-    config: &Config<T>,
-) -> Result<(), ClientCoreError>
+// TODO: make it generic
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn on_disk_key_store<T>(config: &Config<T>) -> OnDiskKeys
 where
    T: NymConfig,
 {
    let pathfinder = ClientKeyPathfinder::new_from_config(config);
-    Ok(key_manager
-        .store_keys(&pathfinder)
-        .tap_err(|err| log::error!("Failed to generate keys: {err}"))?)
+    OnDiskKeys::new(pathfinder)
 }
@@ -1,20 +1,8 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 //! Collection of initialization steps used by client implementations

-use std::fmt::Display;
-
-use nym_sphinx::addressing::{clients::Recipient, nodes::NodeIdentity};
-use rand::rngs::OsRng;
-use serde::Serialize;
-use tap::TapFallible;
-
-use nym_config::NymConfig;
-use nym_credential_storage::storage::Storage;
-use nym_crypto::asymmetric::{encryption, identity};
-use url::Url;
-
 use crate::client::key_manager::KeyManager;
 use crate::{
    config::{
@@ -23,6 +11,16 @@ use crate::{
    },
    error::ClientCoreError,
 };
+use nym_config::NymConfig;
+use nym_credential_storage::storage::Storage;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_sphinx::addressing::{clients::Recipient, nodes::NodeIdentity};
+use serde::Serialize;
+use std::fmt::Display;
+use std::sync::Arc;
+use tap::TapFallible;
+use url::Url;

 mod helpers;

@@ -64,34 +62,29 @@ impl Display for InitResults {
    }
 }

-/// Create a new set of client keys.
-pub fn new_client_keys() -> KeyManager {
-    let mut rng = OsRng;
-    KeyManager::new(&mut rng)
-}
-
 /// Authenticate and register with a gateway.
 /// Either pick one at random by querying the available gateways from the nym-api, or use the
 /// chosen one if it's among the available ones.
 /// The shared key is added to the supplied `KeyManager` and the endpoint details are returned.
-pub async fn register_with_gateway<St: Storage>(
-    key_manager: &mut KeyManager,
+pub async fn register_with_gateway<St>(
+    identity_keys: Arc<identity::KeyPair>,
    nym_api_endpoints: Vec<Url>,
    chosen_gateway_id: Option<identity::PublicKey>,
    by_latency: bool,
-) -> Result<GatewayEndpointConfig, ClientCoreError> {
+) -> Result<(GatewayEndpointConfig, Arc<SharedKeys>), ClientCoreError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
    // Get the gateway details of the gateway we will use
    let gateway =
        helpers::query_gateway_details(nym_api_endpoints, chosen_gateway_id, by_latency).await?;
-    log::debug!("Querying gateway gives: {}", gateway);
-
-    let our_identity = key_manager.identity_keypair();
+    log::debug!("Querying gateway gives: {gateway}");

    // Establish connection, authenticate and generate keys for talking with the gateway
-    let shared_keys = helpers::register_with_gateway::<St>(&gateway, our_identity).await?;
-    key_manager.insert_gateway_shared_key(shared_keys);
+    let shared_keys = helpers::register_with_gateway::<St>(&gateway, identity_keys).await?;

-    Ok(gateway.into())
+    Ok((gateway.into(), shared_keys))
 }

 /// Convenience function for setting up the gateway for a client given a `Config`. Depending on the
@@ -101,6 +94,7 @@ pub async fn register_with_gateway<St: Storage>(
 /// b. Create a new gateway configuration but keep existing keys. This assumes that the caller
 ///    knows what they are doing and that the keys match the requested gateway.
 /// c. Create a new gateway configuration with a newly registered gateway and keys.
+#[cfg(not(target_arch = "wasm32"))]
 pub async fn setup_gateway_from_config<C, T, St>(
    register_gateway: bool,
    user_chosen_gateway_id: Option<identity::PublicKey>,
@@ -111,6 +105,7 @@ where
    C: NymConfig + ClientCoreConfigTrait,
    T: NymConfig,
    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
    let id = config.get_id();

@@ -137,18 +132,24 @@ where
        return Ok(gateway.into());
    }

+    let key_store = helpers::on_disk_key_store(config);
+    let mut rng = rand::thread_rng();
+    let mut managed_keys =
+        crate::client::key_manager::ManagedKeys::load_or_generate(&mut rng, &key_store).await;
+
    // Create new keys and derive our identity
-    let mut key_manager = new_client_keys();
-    let our_identity = key_manager.identity_keypair();
+    let our_identity = managed_keys.identity_keypair();

    // Establish connection, authenticate and generate keys for talking with the gateway
    eprintln!("Registering with new gateway");
    let shared_keys = helpers::register_with_gateway::<St>(&gateway, our_identity).await?;
-    key_manager.insert_gateway_shared_key(shared_keys);
+    managed_keys
+        .deal_with_gateway_key(shared_keys, &key_store)
+        .await
+        .map_err(|source| ClientCoreError::KeyStoreError {
+            source: Box::new(source),
+        })?;

-    // Write all keys to storage and just return the gateway endpoint config. It is assumed that we
-    // will load keys from storage when actually connecting.
-    helpers::store_keys(&key_manager, config)?;
    Ok(gateway.into())
 }

@@ -185,6 +186,15 @@ pub fn get_client_address(
    )
 }

+pub fn load_identity_keys(
+    pathfinder: &ClientKeyPathfinder,
+) -> Result<identity::KeyPair, ClientCoreError> {
+    let identity_keypair: identity::KeyPair =
+        nym_pemstore::load_keypair(&pathfinder.identity_key_pair_path())
+            .tap_err(|_| log::error!("Failed to read stored identity key files"))?;
+    Ok(identity_keypair)
+}
+
 /// Get the client address by loading the keys from stored files.
 pub fn get_client_address_from_stored_keys<T>(
    config: &Config<T>,
@@ -192,18 +202,6 @@ pub fn get_client_address_from_stored_keys<T>(
 where
    T: nym_config::NymConfig,
 {
-    fn load_identity_keys(
-        pathfinder: &ClientKeyPathfinder,
-    ) -> Result<identity::KeyPair, ClientCoreError> {
-        let identity_keypair: identity::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                pathfinder.private_identity_key().to_owned(),
-                pathfinder.public_identity_key().to_owned(),
-            ))
-            .tap_err(|_| log::error!("Failed to read stored identity key files"))?;
-        Ok(identity_keypair)
-    }
-
    fn load_sphinx_keys(
        pathfinder: &ClientKeyPathfinder,
    ) -> Result<encryption::KeyPair, ClientCoreError> {
@@ -72,6 +72,7 @@ impl<C, St> GatewayClient<C, St>
 where
    C: Sync + Send,
    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
    // TODO: put it all in a Config struct
    #[allow(clippy::too_many_arguments)]
@@ -79,6 +80,7 @@ where
        gateway_address: String,
        local_identity: Arc<identity::KeyPair>,
        gateway_identity: identity::PublicKey,
+        // TODO: make it mandatory. if you don't want to pass it, use `new_init`
        shared_key: Option<Arc<SharedKeys>>,
        mixnet_message_sender: MixnetMessageSender,
        ack_sender: AcknowledgementSender,
@@ -1,16 +1,17 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::GatewayClientError;
 pub use client::GatewayClient;
 use log::warn;
-use nym_gateway_requests::registration::handshake::SharedKeys;
 use nym_gateway_requests::BinaryResponse;
 pub use packet_router::{
    AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
 };
 use tungstenite::{protocol::Message, Error as WsError};

+pub use nym_gateway_requests::registration::handshake::SharedKeys;
+
 pub mod client;
 pub mod error;
 pub mod packet_router;
@@ -17,7 +17,9 @@ nym-mixnet-contract-common = { path = "../../cosmwasm-smart-contracts/mixnet-con
 nym-vesting-contract-common = { path = "../../cosmwasm-smart-contracts/vesting-contract" }
 nym-coconut-bandwidth-contract-common = { path = "../../cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-multisig-contract-common = { path = "../../cosmwasm-smart-contracts/multisig-contract" }
+nym-name-service-common = { path = "../../cosmwasm-smart-contracts/name-service" }
 nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contract" }
+nym-service-provider-directory-common = { path = "../../cosmwasm-smart-contracts/service-provider-directory" }
 nym-vesting-contract = { path = "../../../contracts/vesting" }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
@@ -63,6 +65,14 @@ name = "offline_signing"
 # (traits would need to be moved around and refactored themselves)
 required-features = ["nyxd-client"]

+[[example]]
+name = "query_service_provider_directory"
+required-features = ["nyxd-client"]
+
+[[example]]
+name = "query_name_service"
+required-features = ["nyxd-client"]
+
 [features]
 nyxd-client = [
    "async-trait",
@@ -0,0 +1,35 @@
+use std::str::FromStr;
+
+use cosmrs::AccountId;
+use nym_name_service_common::Address;
+use nym_network_defaults::{setup_env, NymNetworkDetails};
+use nym_validator_client::nyxd::traits::NameServiceQueryClient;
+
+#[tokio::main]
+async fn main() {
+    setup_env(Some(&"../../../envs/qa-qwerty.env".parse().unwrap()));
+    let network_details = NymNetworkDetails::new_from_env();
+    let config =
+        nym_validator_client::Config::try_from_nym_network_details(&network_details).unwrap();
+    let client = nym_validator_client::Client::new_query(config).unwrap();
+
+    let config = client.nyxd.get_name_service_config().await.unwrap();
+    println!("config: {config:?}");
+
+    let names_paged = client.nyxd.get_names_paged(None, None).await.unwrap();
+    println!("names (paged): {names_paged:#?}");
+
+    let names = client.nyxd.get_all_names().await.unwrap();
+    println!("names: {names:#?}");
+
+    let owner = AccountId::from_str("n1hmf957kc7arcd39rl7xq8l0a4zyg7kxnv7su87").unwrap();
+    let names_by_owner = client.nyxd.get_names_by_owner(owner).await.unwrap();
+    println!("names (by owner): {names_by_owner:#?}");
+
+    let nym_address = Address::new("client_id.client_key@gateway_id");
+    let names_by_address = client.nyxd.get_names_by_address(nym_address).await.unwrap();
+    println!("names (by address): {names_by_address:#?}");
+
+    let service_info = client.nyxd.get_name_entry(1).await;
+    println!("service info: {service_info:#?}");
+}
@@ -0,0 +1,43 @@
+use std::str::FromStr;
+
+use cosmrs::AccountId;
+use nym_network_defaults::{setup_env, NymNetworkDetails};
+use nym_service_provider_directory_common::NymAddress;
+use nym_validator_client::nyxd::traits::SpDirectoryQueryClient;
+
+#[tokio::main]
+async fn main() {
+    setup_env(Some(&"../../../envs/qa-qwerty.env".parse().unwrap()));
+    let network_details = NymNetworkDetails::new_from_env();
+    let config =
+        nym_validator_client::Config::try_from_nym_network_details(&network_details).unwrap();
+    let client = nym_validator_client::Client::new_query(config).unwrap();
+
+    let config = client.nyxd.get_service_config().await.unwrap();
+    println!("config: {config:?}");
+
+    let services_paged = client.nyxd.get_services_paged(None, None).await.unwrap();
+    println!("services (paged): {services_paged:#?}");
+
+    let services = client.nyxd.get_all_services().await.unwrap();
+    println!("services: {services:#?}");
+
+    let announcer = AccountId::from_str("n1hmf957kc7arcd39rl7xq8l0a4zyg7kxnv7su87").unwrap();
+    let services_by_announcer = client
+        .nyxd
+        .get_services_by_announcer(announcer)
+        .await
+        .unwrap();
+    println!("services (by announcer): {services_by_announcer:#?}");
+
+    let nym_address = NymAddress::new("foo.bar@gateway");
+    let services_by_nym_address = client
+        .nyxd
+        .get_services_by_nym_address(nym_address)
+        .await
+        .unwrap();
+    assert_eq!(services_by_announcer, services_by_nym_address);
+
+    let service_info = client.nyxd.get_service_info(1).await;
+    println!("service info: {service_info:#?}");
+}
@@ -1,6 +1,6 @@
 use crate::nyxd::error::NyxdError;
 use crate::nyxd::{Config as ClientConfig, NyxdClient, QueryNyxdClient};
-use crate::NymApiClient;
+use crate::{NymApiClient, ValidatorClientError};

 use crate::nyxd::traits::MixnetQueryClient;
 use colored::Colorize;
@@ -45,6 +45,23 @@ pub async fn run_validator_connection_test<H: BuildHasher + 'static>(
    )
 }

+pub async fn test_nyxd_url_connection(
+    network: NymNetworkDetails,
+    nyxd_url: Url,
+    address: cosmrs::AccountId,
+) -> Result<bool, ValidatorClientError> {
+    let config = ClientConfig::try_from_nym_network_details(&network)
+        .expect("failed to create valid nyxd client config");
+
+    let mut nyxd_client = NyxdClient::<QueryNyxdClient>::connect(config, nyxd_url.as_str())?;
+    // possibly redundant, but lets just leave it here
+    nyxd_client.set_mixnet_contract_address(address);
+    match test_nyxd_connection(network, &nyxd_url, &nyxd_client).await {
+        ConnectionResult::Nyxd(_, _, res) => Ok(res),
+        _ => Ok(false), // ✶ not possible to happens
+    }
+}
+
 fn setup_connection_tests<H: BuildHasher + 'static>(
    nyxd_urls: impl Iterator<Item = (NymNetworkDetails, Url)>,
    api_urls: impl Iterator<Item = (NymNetworkDetails, Url)>,
@@ -105,7 +122,7 @@ async fn test_nyxd_connection(
    {
        Ok(Err(NyxdError::TendermintError(e))) => {
            // If we get a tendermint-rpc error, we classify the node as not contactable
-            log::debug!("Checking: nyxd url: {url}: {}: {}", "failed".red(), e);
+            log::warn!("Checking: nyxd url: {url}: {}: {}", "failed".red(), e);
            false
        }
        Ok(Err(NyxdError::AbciError { code, log, .. })) => {
@@ -117,13 +134,13 @@ async fn test_nyxd_connection(
            );
            code == 18
        }
-        Ok(Err(error @ NyxdError::NoContractAddressAvailable)) => {
-            log::debug!("Checking: nyxd url: {url}: {}: {error}", "failed".red());
+        Ok(Err(error @ NyxdError::NoContractAddressAvailable(_))) => {
+            log::warn!("Checking: nyxd url: {url}: {}: {error}", "failed".red());
            false
        }
        Ok(Err(e)) => {
            // For any other error, we're optimistic and just try anyway.
-            log::debug!(
+            log::warn!(
                "Checking: nyxd_url: {url}: {}, but with error: {e}",
                "success".green()
            );
@@ -134,7 +151,7 @@ async fn test_nyxd_connection(
            true
        }
        Err(e) => {
-            log::debug!("Checking: nyxd_url: {url}: {}: {e}", "failed".red());
+            log::warn!("Checking: nyxd_url: {url}: {}: {e}", "failed".red());
            false
        }
    };
@@ -13,7 +13,8 @@ pub mod nyxd;
 pub mod signing;

 pub use crate::error::ValidatorClientError;
+pub use client::NymApiClient;
 pub use nym_api_requests::*;

 #[cfg(feature = "nyxd-client")]
-pub use client::{Client, CoconutApiClient, Config, NymApiClient};
+pub use client::{Client, CoconutApiClient, Config};
@@ -9,6 +9,9 @@ pub enum NymAPIError {
        source: reqwest::Error,
    },

+    #[error("Not found")]
+    NotFound,
+
    #[error("Request failed with error message - {0}")]
    GenericRequestFailure(String),

@@ -15,7 +15,9 @@ use nym_api_requests::models::{
 };
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
 use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, MixId};
-use reqwest::Response;
+use nym_name_service_common::response::NamesListResponse;
+use nym_service_provider_directory_common::response::ServicesListResponse;
+use reqwest::{Response, StatusCode};
 use serde::{Deserialize, Serialize};
 use url::Url;

@@ -76,6 +78,8 @@ impl Client {
        let res = self.send_get_request(path, params).await?;
        if res.status().is_success() {
            Ok(res.json().await?)
+        } else if res.status() == StatusCode::NOT_FOUND {
+            Err(NymAPIError::NotFound)
        } else {
            Err(NymAPIError::GenericRequestFailure(res.text().await?))
        }
@@ -480,6 +484,19 @@ impl Client {
        )
        .await
    }
+
+    pub async fn get_service_providers(&self) -> Result<ServicesListResponse, NymAPIError> {
+        log::trace!("Getting service providers");
+        self.query_nym_api(&[routes::API_VERSION, routes::SERVICE_PROVIDERS], NO_PARAMS)
+            .await
+    }
+
+    //pub async fn get_registered_names(&self) -> Result<Vec<NameEntry>, NymAPIError> {
+    pub async fn get_registered_names(&self) -> Result<NamesListResponse, NymAPIError> {
+        log::trace!("Getting registered names");
+        self.query_nym_api(&[routes::API_VERSION, routes::REGISTERED_NAMES], NO_PARAMS)
+            .await
+    }
 }

 // utility function that should solve the double slash problem in validator API forever.
@@ -32,3 +32,6 @@ pub const COMPUTE_REWARD_ESTIMATION: &str = "compute-reward-estimation";
 pub const AVG_UPTIME: &str = "avg_uptime";
 pub const STAKE_SATURATION: &str = "stake-saturation";
 pub const INCLUSION_CHANCE: &str = "inclusion-probability";
+
+pub const SERVICE_PROVIDERS: &str = "services";
+pub const REGISTERED_NAMES: &str = "names";
@@ -21,8 +21,8 @@ use std::{io, time::Duration};

 #[derive(Debug, Error)]
 pub enum NyxdError {
-    #[error("No contract address is available to perform the call")]
-    NoContractAddressAvailable,
+    #[error("No contract address is available to perform the call: {0}")]
+    NoContractAddressAvailable(String),

    #[error(transparent)]
    WalletError(#[from] DirectSecp256k1HdWalletError),
@@ -162,7 +162,7 @@ fn try_parse_abci_log(log: &abci::Log) -> Option<String> {
        .value()
        .contains("Maximum amount of locked coins has already been pledged")
    {
-        Some("Maximum amount of locked tokens has alredy been used. You can only use up to 10% of your locked tokens for bonding and delegating.".to_string())
+        Some("Maximum amount of locked tokens has already been used. You can only use up to 10% of your locked tokens for bonding and delegating.".to_string())
    } else {
        None
    }
@@ -16,7 +16,7 @@ use cosmrs::rpc::query::Query;
 use cosmrs::rpc::Error as TendermintRpcError;
 use cosmrs::rpc::HttpClientUrl;
 use cosmrs::tx::Msg;
-use log::debug;
+use log::{debug, trace};
 use nym_network_defaults::{ChainDetails, NymNetworkDetails};
 use serde::{Deserialize, Serialize};
 use std::convert::TryInto;
@@ -67,6 +67,8 @@ pub struct Config {
    pub(crate) group_contract_address: Option<AccountId>,
    pub(crate) multisig_contract_address: Option<AccountId>,
    pub(crate) coconut_dkg_contract_address: Option<AccountId>,
+    pub(crate) service_provider_contract_address: Option<AccountId>,
+    pub(crate) name_service_contract_address: Option<AccountId>,
    // TODO: add this in later commits
    // pub(crate) gas_price: GasPrice,
 }
@@ -77,8 +79,8 @@ impl Config {
        expected_prefix: &str,
    ) -> Result<Option<AccountId>, NyxdError> {
        if let Some(address) = raw {
-            debug!("Raw address:{:?}", raw);
-            debug!("Expected prefix:{:?}", expected_prefix);
+            trace!("Raw address:{:?}", raw);
+            trace!("Expected prefix:{:?}", expected_prefix);
            let parsed: AccountId = address
                .parse()
                .map_err(|_| NyxdError::MalformedAccountAddress(address.clone()))?;
@@ -131,6 +133,17 @@ impl Config {
                details.contracts.coconut_dkg_contract_address.as_ref(),
                prefix,
            )?,
+            service_provider_contract_address: Self::parse_optional_account(
+                details
+                    .contracts
+                    .service_provider_directory_contract_address
+                    .as_ref(),
+                prefix,
+            )?,
+            name_service_contract_address: Self::parse_optional_account(
+                details.contracts.name_service_contract_address.as_ref(),
+                prefix,
+            )?,
        })
    }
 }
@@ -246,6 +259,10 @@ impl<C> NyxdClient<C> {
        self.config.multisig_contract_address = Some(address);
    }

+    pub fn set_service_provider_contract_address(&mut self, address: AccountId) {
+        self.config.service_provider_contract_address = Some(address);
+    }
+
    // TODO: this should get changed into Result<&AccountId, NyxdError> (or Option<&AccountId> in future commits
    // note: what unwrap is doing here is just moving a failure that would have normally
    // occurred in `connect` when attempting to parse an empty address,
@@ -304,6 +321,16 @@ impl<C> NyxdClient<C> {
        self.config.coconut_dkg_contract_address.as_ref().unwrap()
    }

+    // The service provider directory contract is optional, so we return an Option not a Result
+    pub fn service_provider_contract_address(&self) -> Option<&AccountId> {
+        self.config.service_provider_contract_address.as_ref()
+    }
+
+    // The name service contract is optional, so we return an Option not a Result
+    pub fn name_service_contract_address(&self) -> Option<&AccountId> {
+        self.config.name_service_contract_address.as_ref()
+    }
+
    pub fn set_simulated_gas_multiplier(&mut self, multiplier: f32) {
        self.simulated_gas_multiplier = multiplier;
    }
@@ -16,15 +16,25 @@ mod mixnet_signing_client;
 mod multisig_signing_client;
 mod vesting_signing_client;

+mod sp_directory_query_client;
+mod sp_directory_signing_client;
+
+mod name_service_query_client;
+mod name_service_signing_client;
+
 pub use coconut_bandwidth_query_client::CoconutBandwidthQueryClient;
 pub use dkg_query_client::DkgQueryClient;
 pub use group_query_client::GroupQueryClient;
 pub use mixnet_query_client::MixnetQueryClient;
 pub use multisig_query_client::MultisigQueryClient;
+pub use name_service_query_client::NameServiceQueryClient;
+pub use sp_directory_query_client::SpDirectoryQueryClient;
 pub use vesting_query_client::VestingQueryClient;

 pub use coconut_bandwidth_signing_client::CoconutBandwidthSigningClient;
 pub use dkg_signing_client::DkgSigningClient;
 pub use mixnet_signing_client::MixnetSigningClient;
 pub use multisig_signing_client::MultisigSigningClient;
+pub use name_service_signing_client::NameServiceSigningClient;
+pub use sp_directory_signing_client::SpDirectorySigningClient;
 pub use vesting_signing_client::VestingSigningClient;
@@ -0,0 +1,109 @@
+use async_trait::async_trait;
+use cosmrs::AccountId;
+use nym_contracts_common::ContractBuildInformation;
+use nym_name_service_common::{
+    msg::QueryMsg as NameQueryMsg,
+    response::{ConfigResponse, NamesListResponse, PagedNamesListResponse},
+    Address, NameEntry, NameId,
+};
+use serde::Deserialize;
+
+use crate::nyxd::{error::NyxdError, CosmWasmClient, NyxdClient};
+
+#[async_trait]
+pub trait NameServiceQueryClient {
+    async fn query_name_service_contract<T>(&self, query: NameQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>;
+
+    async fn get_name_service_config(&self) -> Result<ConfigResponse, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::Config {})
+            .await
+    }
+
+    async fn get_name_entry(&self, name_id: NameId) -> Result<NameEntry, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::NameId { name_id })
+            .await
+    }
+
+    async fn get_names_paged(
+        &self,
+        start_after: Option<NameId>,
+        limit: Option<u32>,
+    ) -> Result<PagedNamesListResponse, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::All { limit, start_after })
+            .await
+    }
+
+    async fn get_names_by_owner(&self, owner: AccountId) -> Result<NamesListResponse, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::ByOwner {
+            owner: owner.to_string(),
+        })
+        .await
+    }
+
+    async fn get_names_by_address(&self, address: Address) -> Result<NamesListResponse, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::ByAddress { address })
+            .await
+    }
+
+    async fn get_name_service_contract_version(
+        &self,
+    ) -> Result<ContractBuildInformation, NyxdError> {
+        self.query_name_service_contract(NameQueryMsg::GetContractVersion {})
+            .await
+    }
+
+    async fn get_all_names(&self) -> Result<Vec<NameEntry>, NyxdError> {
+        let mut services = Vec::new();
+        let mut start_after = None;
+
+        loop {
+            let mut paged_response = self.get_names_paged(start_after.take(), None).await?;
+
+            let last_id = paged_response.names.last().map(|serv| serv.name_id);
+            services.append(&mut paged_response.names);
+
+            if let Some(start_after_res) = last_id {
+                start_after = Some(start_after_res)
+            } else {
+                break;
+            }
+        }
+
+        Ok(services)
+    }
+}
+
+#[async_trait]
+impl<C> NameServiceQueryClient for NyxdClient<C>
+where
+    C: CosmWasmClient + Send + Sync,
+{
+    async fn query_name_service_contract<T>(&self, query: NameQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        self.client
+            .query_contract_smart(
+                self.name_service_contract_address().ok_or(
+                    NyxdError::NoContractAddressAvailable("name service contract".to_string()),
+                )?,
+                &query,
+            )
+            .await
+    }
+}
+
+#[async_trait]
+impl<C> NameServiceQueryClient for crate::Client<C>
+where
+    C: CosmWasmClient + Send + Sync,
+{
+    async fn query_name_service_contract<T>(&self, query: NameQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        self.nyxd.query_name_service_contract(query).await
+    }
+}
@@ -0,0 +1,96 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use async_trait::async_trait;
+use nym_name_service_common::{msg::ExecuteMsg as NameExecuteMsg, Address, NameId, NymName};
+
+use crate::nyxd::{
+    coin::Coin, cosmwasm_client::types::ExecuteResult, error::NyxdError, Fee, NyxdClient,
+    SigningCosmWasmClient,
+};
+
+#[async_trait]
+pub trait NameServiceSigningClient {
+    async fn execute_name_service_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: NameExecuteMsg,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError>;
+
+    async fn register_name(
+        &self,
+        name: NymName,
+        address: Address,
+        deposit: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_name_service_contract(
+            fee,
+            NameExecuteMsg::Register { name, address },
+            vec![deposit],
+        )
+        .await
+    }
+
+    async fn delete_name_by_id(
+        &self,
+        name_id: NameId,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_name_service_contract(fee, NameExecuteMsg::DeleteId { name_id }, vec![])
+            .await
+    }
+
+    async fn delete_service_provider_by_name(
+        &self,
+        name: NymName,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_name_service_contract(fee, NameExecuteMsg::DeleteName { name }, vec![])
+            .await
+    }
+
+    async fn update_deposit_required(
+        &self,
+        deposit_required: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_name_service_contract(
+            fee,
+            NameExecuteMsg::UpdateDepositRequired {
+                deposit_required: deposit_required.into(),
+            },
+            vec![],
+        )
+        .await
+    }
+}
+
+#[async_trait]
+impl<C> NameServiceSigningClient for NyxdClient<C>
+where
+    C: SigningCosmWasmClient + Sync + Send,
+{
+    async fn execute_name_service_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: NameExecuteMsg,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier)));
+        let memo = msg.default_memo();
+        self.client
+            .execute(
+                self.address(),
+                self.name_service_contract_address().ok_or(
+                    NyxdError::NoContractAddressAvailable("name service contract".to_string()),
+                )?,
+                &msg,
+                fee,
+                memo,
+                funds,
+            )
+            .await
+    }
+}
@@ -0,0 +1,124 @@
+use async_trait::async_trait;
+use cosmrs::AccountId;
+use nym_contracts_common::{signing::Nonce, ContractBuildInformation};
+use nym_service_provider_directory_common::{
+    msg::QueryMsg as SpQueryMsg,
+    response::{
+        ConfigResponse, PagedServicesListResponse, ServiceInfoResponse, ServicesListResponse,
+    },
+    NymAddress, Service, ServiceId,
+};
+use serde::Deserialize;
+
+use crate::nyxd::{error::NyxdError, CosmWasmClient, NyxdClient};
+
+#[async_trait]
+pub trait SpDirectoryQueryClient {
+    async fn query_service_provider_contract<T>(&self, query: SpQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>;
+
+    async fn get_service_config(&self) -> Result<ConfigResponse, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::Config {})
+            .await
+    }
+
+    async fn get_service_info(
+        &self,
+        service_id: ServiceId,
+    ) -> Result<ServiceInfoResponse, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::ServiceId { service_id })
+            .await
+    }
+
+    async fn get_services_paged(
+        &self,
+        start_after: Option<ServiceId>,
+        limit: Option<u32>,
+    ) -> Result<PagedServicesListResponse, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::All { limit, start_after })
+            .await
+    }
+
+    async fn get_services_by_announcer(
+        &self,
+        announcer: AccountId,
+    ) -> Result<ServicesListResponse, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::ByAnnouncer {
+            announcer: announcer.to_string(),
+        })
+        .await
+    }
+
+    async fn get_services_by_nym_address(
+        &self,
+        nym_address: NymAddress,
+    ) -> Result<ServicesListResponse, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::ByNymAddress { nym_address })
+            .await
+    }
+
+    async fn get_sp_contract_version(&self) -> Result<ContractBuildInformation, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::GetContractVersion {})
+            .await
+    }
+
+    async fn get_all_services(&self) -> Result<Vec<Service>, NyxdError> {
+        let mut services = Vec::new();
+        let mut start_after = None;
+        loop {
+            let mut paged_response = self.get_services_paged(start_after.take(), None).await?;
+            services.append(&mut paged_response.services);
+
+            if let Some(start_after_res) = paged_response.start_next_after {
+                start_after = Some(start_after_res)
+            } else {
+                break;
+            }
+        }
+
+        Ok(services)
+    }
+
+    async fn get_service_signing_nonce(&self, address: &AccountId) -> Result<Nonce, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::SigningNonce {
+            address: address.to_string(),
+        })
+        .await
+    }
+}
+
+#[async_trait]
+impl<C> SpDirectoryQueryClient for NyxdClient<C>
+where
+    C: CosmWasmClient + Send + Sync,
+{
+    async fn query_service_provider_contract<T>(&self, query: SpQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        self.client
+            .query_contract_smart(
+                self.service_provider_contract_address().ok_or(
+                    NyxdError::NoContractAddressAvailable(
+                        "service provider directory contract".to_string(),
+                    ),
+                )?,
+                &query,
+            )
+            .await
+    }
+}
+
+#[async_trait]
+impl<C> SpDirectoryQueryClient for crate::Client<C>
+where
+    C: CosmWasmClient + Send + Sync,
+{
+    async fn query_service_provider_contract<T>(&self, query: SpQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        self.nyxd.query_service_provider_contract(query).await
+    }
+}
@@ -0,0 +1,112 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use async_trait::async_trait;
+use nym_contracts_common::signing::MessageSignature;
+use nym_service_provider_directory_common::{
+    msg::ExecuteMsg as SpExecuteMsg, NymAddress, ServiceDetails, ServiceId,
+};
+
+use crate::nyxd::{
+    coin::Coin, cosmwasm_client::types::ExecuteResult, error::NyxdError, Fee, NyxdClient,
+    SigningCosmWasmClient,
+};
+
+#[async_trait]
+pub trait SpDirectorySigningClient {
+    async fn execute_service_provider_directory_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: SpExecuteMsg,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError>;
+
+    async fn announce_service_provider(
+        &self,
+        service: ServiceDetails,
+        owner_signature: MessageSignature,
+        deposit: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_service_provider_directory_contract(
+            fee,
+            SpExecuteMsg::Announce {
+                service,
+                owner_signature,
+            },
+            vec![deposit],
+        )
+        .await
+    }
+
+    async fn delete_service_provider_by_id(
+        &self,
+        service_id: ServiceId,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_service_provider_directory_contract(
+            fee,
+            SpExecuteMsg::DeleteId { service_id },
+            vec![],
+        )
+        .await
+    }
+
+    async fn delete_service_provider_by_nym_address(
+        &self,
+        nym_address: NymAddress,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_service_provider_directory_contract(
+            fee,
+            SpExecuteMsg::DeleteNymAddress { nym_address },
+            vec![],
+        )
+        .await
+    }
+
+    async fn update_deposit_required(
+        &self,
+        deposit_required: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_service_provider_directory_contract(
+            fee,
+            SpExecuteMsg::UpdateDepositRequired {
+                deposit_required: deposit_required.into(),
+            },
+            vec![],
+        )
+        .await
+    }
+}
+
+#[async_trait]
+impl<C> SpDirectorySigningClient for NyxdClient<C>
+where
+    C: SigningCosmWasmClient + Sync + Send,
+{
+    async fn execute_service_provider_directory_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: SpExecuteMsg,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier)));
+        let memo = msg.default_memo();
+        self.client
+            .execute(
+                self.address(),
+                self.service_provider_contract_address().ok_or(
+                    NyxdError::NoContractAddressAvailable(
+                        "service provider directory contract".to_string(),
+                    ),
+                )?,
+                &msg,
+                fee,
+                memo,
+                funds,
+            )
+            .await
+    }
+}
@@ -38,3 +38,6 @@ nym-vesting-contract-common = { path = "../cosmwasm-smart-contracts/vesting-cont
 nym-coconut-bandwidth-contract-common = { path = "../cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-coconut-dkg-common = { path = "../cosmwasm-smart-contracts/coconut-dkg" }
 nym-multisig-contract-common = { path = "../cosmwasm-smart-contracts/multisig-contract" }
+nym-service-provider-directory-common = { path = "../cosmwasm-smart-contracts/service-provider-directory" }
+nym-name-service-common = { path = "../cosmwasm-smart-contracts/name-service" }
+nym-sphinx = { path = "../../common/nymsphinx" }
@@ -14,6 +14,7 @@ pub struct Mixnet {
    pub command: MixnetCommands,
 }

+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
 pub enum MixnetCommands {
    /// Query the mixnet directory
@@ -5,6 +5,8 @@ use clap::{Args, Subcommand};

 pub mod gateway;
 pub mod mixnode;
+pub mod name;
+pub mod service;

 #[derive(Debug, Args)]
 #[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
@@ -13,10 +15,15 @@ pub struct MixnetOperators {
    pub command: MixnetOperatorsCommands,
 }

+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
 pub enum MixnetOperatorsCommands {
    /// Manage your mixnode
    Mixnode(mixnode::MixnetOperatorsMixnode),
    /// Manage your gateway
    Gateway(gateway::MixnetOperatorsGateway),
+    /// Manage your service
+    ServiceProvider(service::MixnetOperatorsService),
+    /// Manage your registered name
+    Name(name::MixnetOperatorsName),
 }
@@ -0,0 +1,25 @@
+use clap::Parser;
+use log::{error, info};
+use nym_name_service_common::NameId;
+use nym_validator_client::nyxd::{error::NyxdError, traits::NameServiceSigningClient};
+use tap::TapFallible;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub id: NameId,
+}
+
+pub async fn delete(args: Args, client: SigningClient) -> Result<(), NyxdError> {
+    info!("Deleting registered name alias with id {}", args.id);
+
+    let res = client
+        .delete_name_by_id(args.id, None)
+        .await
+        .tap_err(|err| error!("Failed to delete name: {err:#?}"))?;
+
+    info!("Deleted: {res:?}");
+    Ok(())
+}
@@ -0,0 +1,19 @@
+use clap::{Args, Subcommand};
+
+pub mod delete;
+pub mod register;
+
+#[derive(Debug, Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct MixnetOperatorsName {
+    #[clap(subcommand)]
+    pub command: MixnetOperatorsNameCommands,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum MixnetOperatorsNameCommands {
+    /// Register a name alias for a nym address
+    Register(register::Args),
+    /// Delete name alias for a nym address
+    Delete(delete::Args),
+}
@@ -0,0 +1,43 @@
+use clap::Parser;
+use log::{error, info};
+use nym_name_service_common::{Address, Coin, NymName};
+use nym_validator_client::nyxd::{error::NyxdError, traits::NameServiceSigningClient};
+use tap::TapFallible;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// Name alias
+    #[clap(long)]
+    pub name: String,
+
+    /// Nym address that the alias is pointing to
+    #[clap(long)]
+    pub nym_address: String,
+
+    /// Deposit to be made to the service provider directory, in curent DENOMINATION (e.g. 'unym')
+    #[clap(long)]
+    pub deposit: u128,
+}
+
+pub async fn register(args: Args, client: SigningClient) -> Result<(), NyxdError> {
+    info!(
+        "Registering name alias '{}' for nym address '{}'",
+        args.name, args.nym_address
+    );
+
+    let name = NymName::new(&args.name).expect("invalid name");
+    let address = Address::new(&args.nym_address);
+
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+    let deposit = Coin::new(args.deposit, denom);
+
+    let res = client
+        .register_name(name, address, deposit.into(), None)
+        .await
+        .tap_err(|err| error!("Failed to register name: {err:#?}"))?;
+
+    info!("Registered name: {res:?}");
+    Ok(())
+}
@@ -0,0 +1,45 @@
+use clap::Parser;
+use log::info;
+use nym_contracts_common::signing::MessageSignature;
+use nym_service_provider_directory_common::{Coin, NymAddress, ServiceDetails, ServiceType};
+use nym_validator_client::nyxd::traits::SpDirectorySigningClient;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub nym_address: String,
+
+    #[clap(long)]
+    pub signature: MessageSignature,
+
+    /// Deposit to be made to the service provider directory, in curent DENOMINATION (e.g. 'unym')
+    #[clap(long)]
+    pub deposit: u128,
+
+    #[clap(long)]
+    pub identity_key: String,
+}
+
+pub async fn announce(args: Args, client: SigningClient) {
+    info!("Annoucing service provider");
+
+    let nym_address = NymAddress::Address(args.nym_address);
+    let service_type = ServiceType::NetworkRequester;
+    let service = ServiceDetails {
+        nym_address,
+        service_type,
+        identity_key: args.identity_key,
+    };
+
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+    let deposit = Coin::new(args.deposit, denom);
+
+    let res = client
+        .announce_service_provider(service, args.signature, deposit.into(), None)
+        .await
+        .expect("Failed to announce service provider");
+
+    info!("Announced service provider: {res:?}");
+}
@@ -0,0 +1,61 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    context::SigningClient,
+    utils::{account_id_to_cw_addr, DataWrapper},
+};
+
+use clap::Parser;
+use cosmwasm_std::Coin;
+
+use nym_bin_common::output_format::OutputFormat;
+use nym_service_provider_directory_common::{
+    signing_types::construct_service_provider_announce_sign_payload, NymAddress,
+    ServiceType::NetworkRequester,
+};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_validator_client::nyxd::traits::SpDirectoryQueryClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub nym_address: Recipient,
+
+    #[clap(long)]
+    pub amount: u128,
+
+    #[clap(long)]
+    pub identity_key: String,
+
+    #[clap(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+pub async fn create_payload(args: Args, client: SigningClient) {
+    let service = nym_service_provider_directory_common::ServiceDetails {
+        nym_address: NymAddress::new(&args.nym_address.to_string()),
+        service_type: NetworkRequester,
+        identity_key: args.identity_key,
+    };
+
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+    let deposit = Coin::new(args.amount, denom);
+
+    let nonce = match client.get_service_signing_nonce(client.address()).await {
+        Ok(nonce) => nonce,
+        Err(err) => {
+            eprint!(
+                "failed to query for the signing nonce of {}: {err}",
+                client.address()
+            );
+            return;
+        }
+    };
+
+    let address = account_id_to_cw_addr(client.address());
+    let payload =
+        construct_service_provider_announce_sign_payload(nonce, address, deposit, service);
+    let wrapper = DataWrapper::new(payload.to_base58_string().unwrap());
+    println!("{}", args.output.format(&wrapper))
+}
@@ -0,0 +1,23 @@
+use clap::Parser;
+use log::info;
+use nym_service_provider_directory_common::ServiceId;
+use nym_validator_client::nyxd::traits::SpDirectorySigningClient;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub id: ServiceId,
+}
+
+pub async fn delete(args: Args, client: SigningClient) {
+    info!("Deleting service provider with id {}", args.id);
+
+    let res = client
+        .delete_service_provider_by_id(args.id, None)
+        .await
+        .expect("Failed to delete service provider");
+
+    info!("Deleted: {res:?}");
+}
@@ -0,0 +1,23 @@
+use clap::{Args, Subcommand};
+
+pub mod announce;
+pub mod announce_sign_payload;
+pub mod delete;
+
+#[derive(Debug, Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct MixnetOperatorsService {
+    #[clap(subcommand)]
+    pub command: MixnetOperatorsServiceCommands,
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Debug, Subcommand)]
+pub enum MixnetOperatorsServiceCommands {
+    /// Announce service provider to the world
+    Announce(announce::Args),
+    /// Delete entry for service provider from the directory
+    Delete(delete::Args),
+    /// Create base58-encoded payload required for producing valid announce signature.
+    CreateServiceAnnounceSignPayload(announce_sign_payload::Args),
+}
@@ -5,6 +5,8 @@ use clap::{Args, Subcommand};

 pub mod query_all_gateways;
 pub mod query_all_mixnodes;
+pub mod query_all_names;
+pub mod query_all_service_providers;

 #[derive(Debug, Args)]
 #[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
@@ -19,4 +21,8 @@ pub enum MixnetQueryCommands {
    Mixnodes(query_all_mixnodes::Args),
    /// Query gateways
    Gateways(query_all_gateways::Args),
+    /// Query announced service-providers
+    ServiceProviders(query_all_service_providers::Args),
+    /// Query registed names
+    Names(query_all_names::Args),
 }
@@ -0,0 +1,53 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::Parser;
+use comfy_table::Table;
+use nym_validator_client::nym_api::error::NymAPIError;
+
+use crate::context::QueryClientWithNyxd;
+use crate::utils::show_error;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(value_parser)]
+    #[clap(help = "Optionally, the registered name to display")]
+    pub name: Option<String>,
+}
+
+pub async fn query(args: Args, client: &QueryClientWithNyxd) {
+    log::trace!("Querying all registered names");
+
+    match client.nym_api.get_registered_names().await {
+        Ok(res) => {
+            if let Some(name) = args.name {
+                let name = res.names.iter().find(|name_entry| {
+                    name_entry.name.name.to_string().eq_ignore_ascii_case(&name)
+                });
+                println!(
+                    "{}",
+                    ::serde_json::to_string_pretty(&name).expect("json formatting error")
+                );
+            } else {
+                let mut table = Table::new();
+
+                table.set_header(vec!["Name Id", "Owner", "Nym Address", "Name"]);
+                for name_entry in res.names {
+                    table.add_row(vec![
+                        name_entry.name_id.to_string(),
+                        name_entry.name.owner.to_string(),
+                        name_entry.name.address.to_string(),
+                        name_entry.name.name.to_string(),
+                    ]);
+                }
+
+                println!("The registered names in the directory are:");
+                println!("{table}");
+            }
+        }
+        Err(NymAPIError::NotFound) => {
+            println!("nym-api reports no name endpoint available");
+        }
+        Err(e) => show_error(e),
+    }
+}
@@ -0,0 +1,55 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::Parser;
+use comfy_table::Table;
+use nym_validator_client::nym_api::error::NymAPIError;
+
+use crate::context::QueryClientWithNyxd;
+use crate::utils::show_error;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(value_parser)]
+    #[clap(help = "Optionally, the service provider to display")]
+    pub nym_address: Option<String>,
+}
+
+pub async fn query(args: Args, client: &QueryClientWithNyxd) {
+    match client.nym_api.get_service_providers().await {
+        Ok(res) => {
+            if let Some(nym_address) = args.nym_address {
+                let service = res.services.iter().find(|service| {
+                    service
+                        .service
+                        .nym_address
+                        .to_string()
+                        .eq_ignore_ascii_case(&nym_address)
+                });
+                println!(
+                    "{}",
+                    ::serde_json::to_string_pretty(&service).expect("json formatting error")
+                );
+            } else {
+                let mut table = Table::new();
+
+                table.set_header(vec!["Service Id", "Announcer", "Type", "Nym Address"]);
+                for service in res.services {
+                    table.add_row(vec![
+                        service.service_id.to_string(),
+                        service.announcer.to_string(),
+                        service.service.service_type.to_string(),
+                        service.service.nym_address.to_string(),
+                    ]);
+                }
+
+                println!("The service providers in the directory are:");
+                println!("{table}");
+            }
+        }
+        Err(NymAPIError::NotFound) => {
+            println!("nym-api reports no service provider endpoint available");
+        }
+        Err(e) => show_error(e),
+    }
+}
@@ -1,6 +1,6 @@
 [package]
 name = "nym-contracts-common"
-version = "0.4.0"
+version = "0.5.0"
 description = "Common library for Nym cosmwasm contracts"
 edition = { workspace = true }
 authors = { workspace = true }
@@ -11,6 +11,9 @@ use std::ops::Mul;
 use std::str::FromStr;
 use thiserror::Error;

+pub type IdentityKey = String;
+pub type IdentityKeyRef<'a> = &'a str;
+
 pub fn truncate_decimal(amount: Decimal) -> Uint128 {
    amount * Uint128::new(1)
 }
@@ -1,6 +1,6 @@
 [package]
 name = "nym-mixnet-contract-common"
-version = "0.4.0"
+version = "0.6.0"
 description = "Common library for the Nym mixnet contract"
 rust-version = "1.62"
 edition = { workspace = true }
@@ -15,7 +15,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_repr = "0.1"
 schemars = "0.8"
 thiserror = "1.0"
-contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.4.0" }
+contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.5.0" }
 # use 0.4.1 as that's the version used by cosmwasm-std 1.0.0
 # (and ideally we don't want to pull the same dependency twice)
 serde-json-wasm = "=0.4.1"
@@ -4,6 +4,7 @@
 use crate::error::MixnetContractError;
 use crate::families::{Family, FamilyHead};
 use crate::{Layer, RewardedSetNodeStatus};
+use contracts_common::IdentityKey;
 use cosmwasm_std::Addr;
 use cosmwasm_std::Coin;
 use schemars::JsonSchema;
@@ -11,8 +12,6 @@ use serde::{Deserialize, Serialize};
 use std::ops::Index;

 // type aliases for better reasoning about available data
-pub type IdentityKey = String;
-pub type IdentityKeyRef<'a> = &'a str;
 pub type SphinxKey = String;
 pub type SphinxKeyRef<'a> = &'a str;
 pub type EpochId = u32;
--- a/Show More
+++ b/Show More